Commit Graph

22 Commits

Author SHA1 Message Date
Matthias Wessendorf
49afbad502 feat(http): add custom CA certificate support for OIDC providers 2025-10-20 17:16:52 +02:00
Calum Murray
a2d16e9f41 feat: Multi Cluster Support (#348)
* feat: add cluster provider for kubeconfig

Signed-off-by: Calum Murray <cmurray@redhat.com>

* feat: move server to use ClusterProvider interface

Signed-off-by: Calum Murray <cmurray@redhat.com>

* feat: authentication middleware works with cluster provider

Signed-off-by: Calum Murray <cmurray@redhat.com>

* fix: unit tests work after cluster provider changes

Signed-off-by: Calum Murray <cmurray@redhat.com>

* feat: add tool mutator to add cluster parameter

Signed-off-by: Calum Murray <cmurray@redhat.com>

* test: handle cluster parameter

Signed-off-by: Calum Murray <cmurray@redhat.com>

* fix: handle lazy init correctly

Signed-off-by: Calum Murray <cmurray@redhat.com>

* refactor: move to using multi-strategy ManagerProvider

Signed-off-by: Calum Murray <cmurray@redhat.com>

* feat: add contexts_list tool

Signed-off-by: Calum Murray <cmurray@redhat.com>

* refactor: make tool mutator generic between cluster/context naming

Signed-off-by: Calum Murray <cmurray@redhat.com>

* feat: introduce tool filter

Signed-off-by: Calum Murray <cmurray@redhat.com>

* refactor: use new ManagerProvider/mutator/filter within mcp server

Signed-off-by: Calum Murray <cmurray@redhat.com>

* fix(test): tests expect context parameter in tool defs

Signed-off-by: Calum Murray <cmurray@redhat.com>

* feat: auth handles multi-cluster case correctly

Signed-off-by: Calum Murray <cmurray@redhat.com>

* fix: small changes from local testing

Signed-off-by: Calum Murray <cmurray@redhat.com>

* chore: fix enum test

Signed-off-by: Calum Murray <cmurray@redhat.com>

* review: Multi Cluster support (#1)

* nit: rename contexts_list to configuration_contexts_list

Besides the conventional naming, it helps LLMs understand the context of the tool by providing a certain level of hierarchy.

Signed-off-by: Marc Nuri <marc@marcnuri.com>

* fix(mcp): ToolMutator doesn't rely on magic strings

Signed-off-by: Marc Nuri <marc@marcnuri.com>

* refactor(api): don't expose ManagerProvider to toolsets

Signed-off-by: Marc Nuri <marc@marcnuri.com>

* test(mcp): configuration_contexts_list basic tests

Signed-off-by: Marc Nuri <marc@marcnuri.com>

* test(toolsets): revert edge-case test

This test should not be touched.

Signed-off-by: Marc Nuri <marc@marcnuri.com>

* test(toolsets): add specific metadata tests for multi-cluster

Signed-off-by: Marc Nuri <marc@marcnuri.com>

* fix(mcp): ToolFilter doesn't rely on magic strings (partially)

Signed-off-by: Marc Nuri <marc@marcnuri.com>

* test(api): IsClusterAware and IsTargetListProvider default values

Signed-off-by: Marc Nuri <marc@marcnuri.com>

* test(mcp): revert unneeded changes in mcp_tools_test.go

Signed-off-by: Marc Nuri <marc@marcnuri.com>

---------

Signed-off-by: Marc Nuri <marc@marcnuri.com>

* fix: always include configuration_contexts_list if contexts > 1

Signed-off-by: Calum Murray <cmurray@redhat.com>

* feat: include server urls in configuration_contexts_list

Signed-off-by: Calum Murray <cmurray@redhat.com>

---------

Signed-off-by: Calum Murray <cmurray@redhat.com>
Signed-off-by: Marc Nuri <marc@marcnuri.com>
Co-authored-by: Marc Nuri <marc@marcnuri.com>
2025-10-06 12:01:16 +02:00
Marc Nuri
d9d35b9834 test(toolsets): toolset specific metadata tests (#326)
- Refactor tests to use testify (more clarity+composability for complex tests)
- Tests for default toolsets
- Tests for configured, granular toolsets

Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-09-17 11:06:17 +02:00
Marc Nuri
48cf204a89 feat(toolsets): add support for multiple toolsets in configuration (#323)
Users can now enable or disable different toolsets either by providing
a command-line flag or by setting the toolsets array field in the TOML
configuration.

Downstream Kubernetes API developers can declare toolsets for their
APIs by creating a new nested package in pkg/toolsets and registering
it in pkg/mcp/modules.go

Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-09-17 10:53:56 +02:00
Marc Nuri
209e8434d5 feat(mcp): toolset definitions completely agnostic from underlying MCP impl (#322)
Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-09-12 11:56:22 +02:00
Marc Nuri
2b6c886d95 refactor(mcp): toolset Tools definition is agnostic of MCP impl (#319)
Initial PR to make the toolsets agnostic of the usd MCP implementation (migration to go-sdk).
The decoupling will also be needed to move the different toolsets to separate nested packages (toolsets).

Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-09-12 09:58:54 +02:00
Marc Nuri
10c82f7bff refactor(toolsets): renamed Profile to Toolset (#309)
As a prior step to providing support for toolsets
this change repurposes the current work in profiles
which partially aligns with the toolsets expected features

Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-09-11 09:25:09 +02:00
Marc Nuri
0ec2599bd8 fix:test: prevent usage of real cluster in tests (#282)
Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-08-26 14:52:27 +02:00
Marc Nuri
19a92418e4 feat(auth): support for VSCode auth flow (#258)
Adds DisableDynamicClientRegistration and OAuthScopes to be able to override
the values proxied from the configured authorization server.

DisableDynamicClientRegistration removes the registration_endpoint field from
the well-known authorization resource metadata.
This forces VSCode to show a for to input the Client ID and Client Secret since
these can't be discovered.

The OAuthScopes allows to override the scopes_supported field.
VSCode automatically makes an auth request for all of the
supported scopes.
In many cases, this is not supported by the auth server.
By providing this configuration, the user (MCP Server administrator)
is able to set which scopes are effectively supported and
force VSCode to only request these.

Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-08-11 14:39:27 +03:00
Marc Nuri
90d4bb03f3 feat(auth): token exchange auth workflow (#255)
Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-08-08 15:30:33 +03:00
Marc Nuri
fde4b1dc0f test(auth): complete test cases for token validation (#253)
Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-08-08 10:31:50 +03:00
Marc Nuri
dfcecd5089 feat(auth): configurable Kubernetes API token validation (#252)
Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-08-08 10:23:12 +03:00
Marc Nuri
7b11c1667a feat(auth): configurable audience validation (#251)
Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-08-08 08:50:50 +03:00
Marc Nuri
cfc42b3bd3 test(auth): complete test scenarios for raw token and oidc (#248)
Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-08-07 16:04:12 +03:00
Marc Nuri
9ec5c829db feat(auth): .well-known endpoints delegated to auth server (#246)
Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-08-07 10:49:21 +03:00
Marc Nuri
aba5f548d8 feat(auth): implement proxied /.well-known/oauth-authorization-server (#244)
Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-08-06 15:51:45 +03:00
Marc Nuri
4dcede178b refactor(auth): consolidate JWT validation into single method (#238)
Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-08-06 13:17:44 +03:00
Marc Nuri
1f670ebec6 test(auth): complete test suite for unauthorized scenarios (#220)
Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-07-29 13:32:31 +02:00
Marc Nuri
cad863ff22 fix(migration): rebranded from manusa/kubernetes-mcp-server to containers/kubernetes-mcp-server (#202)
Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-07-25 09:53:04 +02:00
Marc Nuri
a3e8818ffe test(http): logging middleware verifications
Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-07-22 14:21:39 +02:00
Arda Güçlü
73e9e845c4 refactor(auth): carry oidc provider directly instead of mcpServer 2025-07-18 12:52:51 +02:00
Marc Nuri
bfa699049e test(http): bootstrap tests for HTTP server (177)
test(http): bootstrap tests for HTTP server

Contains tests for the main endpoints (proxied and handled)
- /sse
- /message
- /mcp
- /healthz
- /.well-known/oauth-protected-resource

Verifies graceful shutdown works as expected

Signed-off-by: Marc Nuri <marc@marcnuri.com>
---
fix: empty config for CI

Signed-off-by: Marc Nuri <marc@marcnuri.com>
2025-07-16 14:46:11 +02:00