mirror of
https://github.com/containers/kubernetes-mcp-server.git
synced 2025-10-23 01:22:57 +03:00
19a92418e4
Adds DisableDynamicClientRegistration and OAuthScopes to be able to override the values proxied from the configured authorization server. DisableDynamicClientRegistration removes the registration_endpoint field from the well-known authorization resource metadata. This forces VSCode to show a for to input the Client ID and Client Secret since these can't be discovered. The OAuthScopes allows to override the scopes_supported field. VSCode automatically makes an auth request for all of the supported scopes. In many cases, this is not supported by the auth server. By providing this configuration, the user (MCP Server administrator) is able to set which scopes are effectively supported and force VSCode to only request these. Signed-off-by: Marc Nuri <marc@marcnuri.com>
73 lines
3.1 KiB
Go
73 lines
3.1 KiB
Go
package config
|
|
|
|
import (
|
|
"os"
|
|
|
|
"github.com/BurntSushi/toml"
|
|
)
|
|
|
|
// StaticConfig is the configuration for the server.
|
|
// It allows to configure server specific settings and tools to be enabled or disabled.
|
|
type StaticConfig struct {
|
|
DeniedResources []GroupVersionKind `toml:"denied_resources"`
|
|
|
|
LogLevel int `toml:"log_level,omitempty"`
|
|
Port string `toml:"port,omitempty"`
|
|
SSEBaseURL string `toml:"sse_base_url,omitempty"`
|
|
KubeConfig string `toml:"kubeconfig,omitempty"`
|
|
ListOutput string `toml:"list_output,omitempty"`
|
|
// When true, expose only tools annotated with readOnlyHint=true
|
|
ReadOnly bool `toml:"read_only,omitempty"`
|
|
// When true, disable tools annotated with destructiveHint=true
|
|
DisableDestructive bool `toml:"disable_destructive,omitempty"`
|
|
EnabledTools []string `toml:"enabled_tools,omitempty"`
|
|
DisabledTools []string `toml:"disabled_tools,omitempty"`
|
|
|
|
// Authorization-related fields
|
|
// RequireOAuth indicates whether the server requires OAuth for authentication.
|
|
RequireOAuth bool `toml:"require_oauth,omitempty"`
|
|
// OAuthAudience is the valid audience for the OAuth tokens, used for offline JWT claim validation.
|
|
OAuthAudience string `toml:"oauth_audience,omitempty"`
|
|
// ValidateToken indicates whether the server should validate the token against the Kubernetes API Server using TokenReview.
|
|
ValidateToken bool `toml:"validate_token,omitempty"`
|
|
// AuthorizationURL is the URL of the OIDC authorization server.
|
|
// It is used for token validation and for STS token exchange.
|
|
AuthorizationURL string `toml:"authorization_url,omitempty"`
|
|
// DisableDynamicClientRegistration indicates whether dynamic client registration is disabled.
|
|
// If true, the .well-known endpoints will not expose the registration endpoint.
|
|
DisableDynamicClientRegistration bool `toml:"disable_dynamic_client_registration,omitempty"`
|
|
// OAuthScopes are the supported **client** scopes requested during the **client/frontend** OAuth flow.
|
|
OAuthScopes []string `toml:"oauth_scopes,omitempty"`
|
|
// StsClientId is the OAuth client ID used for backend token exchange
|
|
StsClientId string `toml:"sts_client_id,omitempty"`
|
|
// StsClientSecret is the OAuth client secret used for backend token exchange
|
|
StsClientSecret string `toml:"sts_client_secret,omitempty"`
|
|
// StsAudience is the audience for the STS token exchange.
|
|
StsAudience string `toml:"sts_audience,omitempty"`
|
|
// StsScopes is the scopes for the STS token exchange.
|
|
StsScopes []string `toml:"sts_scopes,omitempty"`
|
|
CertificateAuthority string `toml:"certificate_authority,omitempty"`
|
|
ServerURL string `toml:"server_url,omitempty"`
|
|
}
|
|
|
|
type GroupVersionKind struct {
|
|
Group string `toml:"group"`
|
|
Version string `toml:"version"`
|
|
Kind string `toml:"kind,omitempty"`
|
|
}
|
|
|
|
// ReadConfig reads the toml file and returns the StaticConfig.
|
|
func ReadConfig(configPath string) (*StaticConfig, error) {
|
|
configData, err := os.ReadFile(configPath)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
var config *StaticConfig
|
|
err = toml.Unmarshal(configData, &config)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return config, nil
|
|
}
|