Mcpoidcconfig v1alpha1 — toolhive.stacklok.dev

apiVersion string

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

kind string

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

metadata object

spec object

MCPOIDCConfigSpec defines the desired state of MCPOIDCConfig. MCPOIDCConfig resources are namespace-scoped and can only be referenced by MCPServer resources in the same namespace.

inline object

Inline contains direct OIDC configuration. Only used when Type is "inline".

caBundleRef object

CABundleRef references a ConfigMap containing the CA certificate bundle. When specified, ToolHive auto-mounts the ConfigMap and auto-computes ThvCABundlePath.

configMapRef object

ConfigMapRef references a ConfigMap containing the CA certificate bundle. If Key is not specified, it defaults to "ca.crt".

key string required

The key to select.

name string

Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

optional boolean

Specify whether the ConfigMap or its key must be defined

clientId string

ClientID is the OIDC client ID

clientSecretRef object

ClientSecretRef is a reference to a Kubernetes Secret containing the client secret

key string required

Key is the key within the secret

name string required

Name is the name of the secret

insecureAllowHTTP boolean

InsecureAllowHTTP allows HTTP (non-HTTPS) OIDC issuers for development/testing. WARNING: This is insecure and should NEVER be used in production.

introspectionUrl string

IntrospectionURL is the URL for token introspection endpoint

issuer string required

Issuer is the OIDC issuer URL

jwksAllowPrivateIP boolean

JWKSAllowPrivateIP allows JWKS/OIDC endpoints on private IP addresses. Note: at runtime, if either JWKSAllowPrivateIP or ProtectedResourceAllowPrivateIP is true, private IPs are allowed for all OIDC HTTP requests (JWKS, discovery, introspection).

jwksAuthTokenPath string

JWKSAuthTokenPath is the path to file containing bearer token for JWKS/OIDC requests

jwksUrl string

JWKSURL is the URL to fetch the JWKS from

protectedResourceAllowPrivateIP boolean

ProtectedResourceAllowPrivateIP allows protected resource endpoint on private IP addresses. Note: at runtime, if either ProtectedResourceAllowPrivateIP or JWKSAllowPrivateIP is true, private IPs are allowed for all OIDC HTTP requests (JWKS, discovery, introspection).

kubernetesServiceAccount object

KubernetesServiceAccount configures OIDC for Kubernetes service account token validation. Only used when Type is "kubernetesServiceAccount".

introspectionUrl string

IntrospectionURL is the URL for token introspection endpoint. If empty, OIDC discovery will be used to automatically determine the introspection URL.

issuer string

Issuer is the OIDC issuer URL.

jwksUrl string

JWKSURL is the URL to fetch the JWKS from. If empty, OIDC discovery will be used to automatically determine the JWKS URL.

namespace string

Namespace is the namespace of the service account. If empty, uses the MCPServer's namespace.

serviceAccount string

ServiceAccount is the name of the service account to validate tokens for. If empty, uses the pod's service account.

useClusterAuth boolean

UseClusterAuth enables using the Kubernetes cluster's CA bundle and service account token. When true, uses /var/run/secrets/kubernetes.io/serviceaccount/ca.crt for TLS verification and /var/run/secrets/kubernetes.io/serviceaccount/token for bearer token authentication. Defaults to true if not specified.

type string required

Type is the type of OIDC configuration source

enum: kubernetesServiceAccount, inline

status object

MCPOIDCConfigStatus defines the observed state of MCPOIDCConfig

conditions []object

Conditions represent the latest available observations of the MCPOIDCConfig's state

lastTransitionTime string required

lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

format: date-time

message string required

message is a human readable message indicating details about the transition. This may be an empty string.

maxLength: 32768

observedGeneration integer

observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

format: int64

minimum: 0

reason string required

reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$

minLength: 1

maxLength: 1024

status string required

status of the condition, one of True, False, Unknown.

enum: True, False, Unknown

type string required

type of condition in CamelCase or in foo.example.com/CamelCase.

pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$

maxLength: 316

configHash string

ConfigHash is a hash of the current configuration for change detection

observedGeneration integer

ObservedGeneration is the most recent generation observed for this MCPOIDCConfig.

format: int64

referencingWorkloads []object

ReferencingWorkloads is a list of workload resources that reference this MCPOIDCConfig. Each entry identifies the workload by kind and name.

kind string required

Kind is the type of workload resource

enum: MCPServer, VirtualMCPServer, MCPRemoteProxy

name string required

Name is the name of the workload resource

minLength: 1