Skip to content

Commit 4643741

Browse files
yroblataskbot
yrobla
and
taskbot
authored
Do not force to pass client id and secret for token exchange (#2531)
Those are optional for some endpoints such as sts, so no need to enforce them Co-authored-by: taskbot <[email protected]>
1 parent b632568 commit 4643741

15 files changed

+220
-66
lines changed

‎cmd/thv-operator/api/v1alpha1/mcpexternalauthconfig_types.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,12 +35,14 @@ type TokenExchangeConfig struct {
3535
TokenURL string `json:"tokenUrl"`
3636

3737
// ClientID is the OAuth 2.0 client identifier
38-
// +kubebuilder:validation:Required
39-
ClientID string `json:"clientId"`
38+
// Optional for some token exchange flows (e.g., Google Cloud Workforce Identity)
39+
// +optional
40+
ClientID string `json:"clientId,omitempty"`
4041

4142
// ClientSecretRef is a reference to a secret containing the OAuth 2.0 client secret
42-
// +kubebuilder:validation:Required
43-
ClientSecretRef SecretKeyRef `json:"clientSecretRef"`
43+
// Optional for some token exchange flows (e.g., Google Cloud Workforce Identity)
44+
// +optional
45+
ClientSecretRef *SecretKeyRef `json:"clientSecretRef,omitempty"`
4446

4547
// Audience is the target audience for the exchanged token
4648
// +kubebuilder:validation:Required

‎cmd/thv-operator/api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cmd/thv-operator/controllers/mcpexternalauthconfig_controller_test.go‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ func TestMCPExternalAuthConfigReconciler_calculateConfigHash(t *testing.T) {
3737
TokenExchange: &mcpv1alpha1.TokenExchangeConfig{
3838
TokenURL: "https://oauth.example.com/token",
3939
ClientID: "test-client-id",
40-
ClientSecretRef: mcpv1alpha1.SecretKeyRef{
40+
ClientSecretRef: &mcpv1alpha1.SecretKeyRef{
4141
Name: "test-secret",
4242
Key: "client-secret",
4343
},
@@ -53,7 +53,7 @@ func TestMCPExternalAuthConfigReconciler_calculateConfigHash(t *testing.T) {
5353
TokenExchange: &mcpv1alpha1.TokenExchangeConfig{
5454
TokenURL: "https://oauth.example.com/token",
5555
ClientID: "test-client-id",
56-
ClientSecretRef: mcpv1alpha1.SecretKeyRef{
56+
ClientSecretRef: &mcpv1alpha1.SecretKeyRef{
5757
Name: "test-secret",
5858
Key: "client-secret",
5959
},
@@ -88,7 +88,7 @@ func TestMCPExternalAuthConfigReconciler_calculateConfigHash(t *testing.T) {
8888
TokenExchange: &mcpv1alpha1.TokenExchangeConfig{
8989
TokenURL: "https://oauth.example.com/token",
9090
ClientID: "client1",
91-
ClientSecretRef: mcpv1alpha1.SecretKeyRef{
91+
ClientSecretRef: &mcpv1alpha1.SecretKeyRef{
9292
Name: "secret1",
9393
Key: "key1",
9494
},
@@ -100,7 +100,7 @@ func TestMCPExternalAuthConfigReconciler_calculateConfigHash(t *testing.T) {
100100
TokenExchange: &mcpv1alpha1.TokenExchangeConfig{
101101
TokenURL: "https://oauth.example.com/token",
102102
ClientID: "client2",
103-
ClientSecretRef: mcpv1alpha1.SecretKeyRef{
103+
ClientSecretRef: &mcpv1alpha1.SecretKeyRef{
104104
Name: "secret2",
105105
Key: "key2",
106106
},
@@ -137,7 +137,7 @@ func TestMCPExternalAuthConfigReconciler_Reconcile(t *testing.T) {
137137
TokenExchange: &mcpv1alpha1.TokenExchangeConfig{
138138
TokenURL: "https://oauth.example.com/token",
139139
ClientID: "test-client",
140-
ClientSecretRef: mcpv1alpha1.SecretKeyRef{
140+
ClientSecretRef: &mcpv1alpha1.SecretKeyRef{
141141
Name: "test-secret",
142142
Key: "client-secret",
143143
},
@@ -160,7 +160,7 @@ func TestMCPExternalAuthConfigReconciler_Reconcile(t *testing.T) {
160160
TokenExchange: &mcpv1alpha1.TokenExchangeConfig{
161161
TokenURL: "https://oauth.example.com/token",
162162
ClientID: "test-client",
163-
ClientSecretRef: mcpv1alpha1.SecretKeyRef{
163+
ClientSecretRef: &mcpv1alpha1.SecretKeyRef{
164164
Name: "test-secret",
165165
Key: "client-secret",
166166
},
@@ -268,7 +268,7 @@ func TestMCPExternalAuthConfigReconciler_findReferencingMCPServers(t *testing.T)
268268
TokenExchange: &mcpv1alpha1.TokenExchangeConfig{
269269
TokenURL: "https://oauth.example.com/token",
270270
ClientID: "test-client",
271-
ClientSecretRef: mcpv1alpha1.SecretKeyRef{
271+
ClientSecretRef: &mcpv1alpha1.SecretKeyRef{
272272
Name: "test-secret",
273273
Key: "client-secret",
274274
},
@@ -387,7 +387,7 @@ func TestGetExternalAuthConfigForMCPServer(t *testing.T) {
387387
TokenExchange: &mcpv1alpha1.TokenExchangeConfig{
388388
TokenURL: "https://oauth.example.com/token",
389389
ClientID: "test-client",
390-
ClientSecretRef: mcpv1alpha1.SecretKeyRef{
390+
ClientSecretRef: &mcpv1alpha1.SecretKeyRef{
391391
Name: "test-secret",
392392
Key: "client-secret",
393393
},
@@ -480,7 +480,7 @@ func TestMCPExternalAuthConfigReconciler_handleDeletion(t *testing.T) {
480480
TokenExchange: &mcpv1alpha1.TokenExchangeConfig{
481481
TokenURL: "https://oauth.example.com/token",
482482
ClientID: "test-client",
483-
ClientSecretRef: mcpv1alpha1.SecretKeyRef{
483+
ClientSecretRef: &mcpv1alpha1.SecretKeyRef{
484484
Name: "test-secret",
485485
Key: "client-secret",
486486
},
@@ -507,7 +507,7 @@ func TestMCPExternalAuthConfigReconciler_handleDeletion(t *testing.T) {
507507
TokenExchange: &mcpv1alpha1.TokenExchangeConfig{
508508
TokenURL: "https://oauth.example.com/token",
509509
ClientID: "test-client",
510-
ClientSecretRef: mcpv1alpha1.SecretKeyRef{
510+
ClientSecretRef: &mcpv1alpha1.SecretKeyRef{
511511
Name: "test-secret",
512512
Key: "client-secret",
513513
},
@@ -603,7 +603,7 @@ func TestMCPExternalAuthConfigReconciler_ConfigChangeTriggersReconciliation(t *t
603603
TokenExchange: &mcpv1alpha1.TokenExchangeConfig{
604604
TokenURL: "https://oauth.example.com/token",
605605
ClientID: "test-client",
606-
ClientSecretRef: mcpv1alpha1.SecretKeyRef{
606+
ClientSecretRef: &mcpv1alpha1.SecretKeyRef{
607607
Name: "test-secret",
608608
Key: "client-secret",
609609
},

‎cmd/thv-operator/controllers/mcpremoteproxy_controller_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -492,7 +492,7 @@ func TestHandleExternalAuthConfig(t *testing.T) {
492492
TokenExchange: &mcpv1alpha1.TokenExchangeConfig{
493493
TokenURL: "https://keycloak.com/token",
494494
ClientID: "client-id",
495-
ClientSecretRef: mcpv1alpha1.SecretKeyRef{
495+
ClientSecretRef: &mcpv1alpha1.SecretKeyRef{
496496
Name: "secret",
497497
Key: "key",
498498
},
@@ -532,7 +532,7 @@ func TestHandleExternalAuthConfig(t *testing.T) {
532532
TokenExchange: &mcpv1alpha1.TokenExchangeConfig{
533533
TokenURL: "https://keycloak.com/token",
534534
ClientID: "client-id",
535-
ClientSecretRef: mcpv1alpha1.SecretKeyRef{
535+
ClientSecretRef: &mcpv1alpha1.SecretKeyRef{
536536
Name: "secret",
537537
Key: "key",
538538
},

‎cmd/thv-operator/controllers/mcpremoteproxy_deployment_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -595,7 +595,7 @@ func TestBuildEnvVarsForProxy(t *testing.T) {
595595
TokenExchange: &mcpv1alpha1.TokenExchangeConfig{
596596
TokenURL: "https://oauth.com/token",
597597
ClientID: "client",
598-
ClientSecretRef: mcpv1alpha1.SecretKeyRef{
598+
ClientSecretRef: &mcpv1alpha1.SecretKeyRef{
599599
Name: "secret",
600600
Key: "key",
601601
},

‎cmd/thv-operator/controllers/mcpremoteproxy_reconciler_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@ func TestMCPRemoteProxyFullReconciliation(t *testing.T) {
185185
TokenExchange: &mcpv1alpha1.TokenExchangeConfig{
186186
TokenURL: "https://oauth.example.com/token",
187187
ClientID: "client-id",
188-
ClientSecretRef: mcpv1alpha1.SecretKeyRef{
188+
ClientSecretRef: &mcpv1alpha1.SecretKeyRef{
189189
Name: "oauth-secret",
190190
Key: "client-secret",
191191
},
@@ -752,7 +752,7 @@ func TestGenerateTokenExchangeEnvVarsShared(t *testing.T) {
752752
TokenExchange: &mcpv1alpha1.TokenExchangeConfig{
753753
TokenURL: "https://oauth.com/token",
754754
ClientID: "client-id",
755-
ClientSecretRef: mcpv1alpha1.SecretKeyRef{
755+
ClientSecretRef: &mcpv1alpha1.SecretKeyRef{
756756
Name: "secret",
757757
Key: "key",
758758
},

‎cmd/thv-operator/controllers/mcpremoteproxy_runconfig_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -273,7 +273,7 @@ func TestCreateRunConfigFromMCPRemoteProxy_WithTokenExchange(t *testing.T) {
273273
TokenExchange: &mcpv1alpha1.TokenExchangeConfig{
274274
TokenURL: "https://keycloak.company.com/token",
275275
ClientID: "exchange-client",
276-
ClientSecretRef: mcpv1alpha1.SecretKeyRef{
276+
ClientSecretRef: &mcpv1alpha1.SecretKeyRef{
277277
Name: "exchange-creds",
278278
Key: "client-secret",
279279
},

0 commit comments

Comments
 (0)