Skip to content

Draft: MCPRemoteProxy: Add remaining configuration validations#4037

Open
ChrisJBurns wants to merge 1 commit intomainfrom
cburns/2289-remaining-validations
Open

Draft: MCPRemoteProxy: Add remaining configuration validations#4037
ChrisJBurns wants to merge 1 commit intomainfrom
cburns/2289-remaining-validations

Conversation

@ChrisJBurns
Copy link
Collaborator

Summary

Extends #4024 with the four remaining MCPRemoteProxy configuration validations, each surfacing errors via Kubernetes Events and Status Conditions:

  • Remote URL format validation — rejects malformed URLs or unsupported schemes (ftp://, empty host)
  • JWKS URL scheme validation — JWKS endpoints must use HTTPS (key material transport)
  • Cedar authorization policy syntax — validates inline Cedar policies parse correctly before deployment
  • ConfigMap/Secret reference existence — verifies referenced authz ConfigMaps and header Secrets exist in the namespace

All validations follow the foundation pattern from #4024: fail-fast in validateSpec(), set ConfigurationValid=False condition with a specific reason, emit a Warning event, and move the proxy to Failed phase.

No network calls are made — URL validations are format/scheme checks only; ConfigMap/Secret checks are in-cluster reads.

Test plan

  • Unit tests for ValidateCedarPolicies (6 cases)
  • Unit tests for ValidateRemoteURL (6 cases) and ValidateJWKSURL (5 cases)
  • Unit tests for reconciler condition-setting (5 new cases in TestValidateSpecConfigurationConditions)
  • Integration tests for status conditions (remote URL, JWKS URL, Cedar syntax, missing ConfigMap, missing Secret)
  • Integration tests for event emission (Cedar syntax, missing ConfigMap, missing Secret)
  • go build ./cmd/thv-operator/... passes
  • golangci-lint passes on changed packages

🤖 Generated with Claude Code

Add four new validations to the MCPRemoteProxy controller, each
surfacing errors via Kubernetes Events and Status Conditions:

- Remote URL format validation (scheme and host)
- JWKS URL scheme validation (must use HTTPS)
- Cedar authorization policy syntax validation
- ConfigMap/Secret reference existence checks

Includes unit tests for all validation functions, reconciler condition
tests, and integration tests for both conditions and event emission.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@github-actions github-actions bot added the size/L Large PR: 600-999 lines changed label Mar 6, 2026
@codecov
Copy link

codecov bot commented Mar 6, 2026

Codecov Report

❌ Patch coverage is 89.56522% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 68.71%. Comparing base (bc9b534) to head (17d745b).

Files with missing lines Patch % Lines
...-operator/controllers/mcpremoteproxy_controller.go 90.58% 7 Missing and 1 partial ⚠️
cmd/thv-operator/pkg/validation/url_validation.go 81.81% 2 Missing and 2 partials ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4037      +/-   ##
==========================================
+ Coverage   68.66%   68.71%   +0.04%     
==========================================
  Files         445      447       +2     
  Lines       45343    45456     +113     
==========================================
+ Hits        31136    31236     +100     
- Misses      11802    11812      +10     
- Partials     2405     2408       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ChrisJBurns ChrisJBurns changed the title MCPRemoteProxy: Add remaining configuration validations Draft: MCPRemoteProxy: Add remaining configuration validations Mar 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size/L Large PR: 600-999 lines changed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant