Add embeddedAuthServer type to MCPExternalAuthConfig CRD #3488
+1,871
−53
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Large PR Detected
This PR exceeds 1000 lines of changes and requires justification before it can be reviewed.
How to unblock this PR:
Add a section to your PR description with the following format:
## Large PR Justification
[Explain why this PR must be large, such as:]
- Generated code that cannot be split
- Large refactoring that must be atomic
- Multiple related changes that would break if separated
- Migration or data transformationAlternative:
Consider splitting this PR into smaller, focused changes (< 1000 lines each) for easier review and reduced risk.
See our Contributing Guidelines for more details.
This review will be automatically dismissed once you add the justification section.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #3488 +/- ##
==========================================
- Coverage 65.34% 65.28% -0.07%
==========================================
Files 403 403
Lines 39206 39223 +17
==========================================
- Hits 25618 25605 -13
- Misses 11607 11627 +20
- Partials 1981 1991 +10 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
github-actions
bot
added
size/XL
github-actions
bot
dismissed
their stale review
Large PR justification has been provided. Thank you!
Contributor
|
✅ Large PR justification has been provided. The size review has been dismissed and this PR can now proceed with normal review. |
tgrunnagle
requested review from
ChrisJBurns,
JAORMX,
jerm-dro,
jhrozek and
yrobla
as code owners
jhrozek
reviewed
Jan 28, 2026
Contributor
jhrozek
left a comment
jhrozek
left a comment
There was a problem hiding this comment.
I think the audiences field should be removed, I think it would be also nice to at least provide a nice default for scopes and redirectUrl
yrobla
reviewed
Jan 29, 2026
jhrozek
previously approved these changes
Jan 29, 2026
tgrunnagle
force-pushed
the
auth-server_issue-226_2026-01-28
branch
from
00fa629 to
6f8c0fe
Compare
github-actions
bot
added
size/XL
jhrozek
previously approved these changes
Jan 29, 2026
Add support for embedded OAuth2/OIDC authorization server configuration in the MCPExternalAuthConfig CRD. This enables MCP servers in Kubernetes to integrate with an embedded auth server that delegates to upstream IDPs. New types added: - EmbeddedAuthServerConfig: Main config with issuer, signing keys, HMAC secrets, token lifespans, upstream providers, and allowed audiences - TokenLifespanConfig: Duration settings for access/refresh/auth code tokens - UpstreamProviderConfig: Upstream IDP config with OIDC/OAuth2 support - OIDCUpstreamConfig: OIDC-specific configuration with discovery support - OAuth2UpstreamConfig: OAuth2-specific configuration with explicit endpoints Webhook validation ensures: - Mutual exclusivity between auth config types - Upstream provider type matches its config (oidc/oauth2) - Currently only one upstream provider is supported Closes stacklok/stacklok-epics#226 Update deploy/charts/operator-crds/README.md Address internal review feedback Align CRDs with go config types Run `task crdref-gen` Address feedback - Remove `AllowedAudiences` and `ScopesSupported` from `EmbeddedAuthServerConfig` - Make `RedirectURI` optional so that a MCPExternalAuthConfig can be shared among multiple MCP servers. If not specified, it will default to `{mcp_server_url}/oauth/callback` - Reduce code duplication in MCPExternalAuthConfig webhook and update corresponding tests - Re run `task operator-generate && task operator-manifests`, `task build`, `task test`, `task crdref-gen`, `pre-commit run --all-files` Update inaccurate comment CRD updates - Update issuer validation pattern to allow `http` schema, prohibit query, fragment - make `HMACSecretRefs` and `SigningKeySecretRefs` optional (given ephemeral HMAC and key support) - Run generate tasks, build, test, crdref-gen Fix lint
And run `pre-commit run --all-files`
tgrunnagle
force-pushed
the
auth-server_issue-226_2026-01-28
branch
from
6f8c0fe to
63bca5f
Compare
github-actions
bot
added
size/XL
github-actions
bot
added
size/XL
jhrozek
approved these changes
Jan 30, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Add the
embeddedAuthServerauthentication type to theMCPExternalAuthConfigCRD, enabling MCP servers in Kubernetes to integrate with an embedded OAuth2/OIDC authorization server.Issue: stacklok/stacklok-epics#226
Changes
ExternalAuthTypeEmbeddedAuthServerconstant with value"embeddedAuthServer"EmbeddedAuthServerConfigstruct with configuration for:TokenLifespanConfig,UpstreamProviderConfig,OIDCUpstreamConfig, andOAuth2UpstreamConfigstructsTest Plan
task operator-generate && task operator-manifests)Large PR Justification