Fix VirtualMCPServer OIDC configuration by implementing OIDCConfigurable interface (#2821)

* Add mockgen directive for OIDC Resolver interface Add go:generate directive to generate gomock mock for the oidc.Resolver interface. This enables proper unit testing of components that depend on OIDC resolution without requiring a real Kubernetes client. * Add OIDCConfigurable interface implementation to VirtualMCPServer Implement GetOIDCConfig() and GetProxyPort() methods on VirtualMCPServer to satisfy the oidc.OIDCConfigurable interface. This allows the OIDC resolver to resolve Kubernetes and ConfigMap OIDC configurations for VirtualMCPServer resources. GetProxyPort returns 4483, the default vMCP server port. * Refactor Converter to require OIDC resolver for all OIDC types Previously, the Converter only handled inline OIDC configuration directly and had a TODO for kubernetes and configMap types. This change: - Makes oidcResolver a required parameter for NewConverter (returns error if nil) - Uses the resolver for all OIDC types (kubernetes, configMap, inline) - Adds mapResolvedOIDCToVmcpConfig() to map resolver output to vmcp config - Handles ClientSecretEnv for all OIDC types that may have client secrets - Updates controller to pass OIDC resolver to converter - Adds comprehensive tests using gomock for OIDC resolution - Adds compile-time interface assertion for VirtualMCPServer This ensures fail-closed behavior: if OIDC is configured but resolution fails, the converter returns an error rather than silently deploying without authentication.

Author: jhrozek

cmd/thv-operator/api/v1alpha1/virtualmcpserver_types.go

@@ -566,6 +566,23 @@ type VirtualMCPServerList struct {
 Items []VirtualMCPServer `json:"items"`
 }
 
+// GetOIDCConfig returns the OIDC configuration reference for incoming auth.
+// This implements the OIDCConfigurable interface to allow the OIDC resolver
+// to resolve Kubernetes and ConfigMap OIDC configurations.
+func (v *VirtualMCPServer) GetOIDCConfig() *OIDCConfigRef {
+if v.Spec.IncomingAuth == nil {
+return nil
+}
+return v.Spec.IncomingAuth.OIDCConfig
+}
+
+// GetProxyPort returns the proxy port for the VirtualMCPServer.
+// This implements the OIDCConfigurable interface.
+// vMCP uses port 4483 by default.
+func (*VirtualMCPServer) GetProxyPort() int32 {
+return 4483
+}
+
 func init() {
 SchemeBuilder.Register(&VirtualMCPServer{}, &VirtualMCPServerList{})
 }

cmd/thv-operator/controllers/virtualmcpserver_vmcpconfig.go

@@ -13,6 +13,7 @@ import (
 "sigs.k8s.io/controller-runtime/pkg/log"
 
 mcpv1alpha1 "github.com/stacklok/toolhive/cmd/thv-operator/api/v1alpha1"
+"github.com/stacklok/toolhive/cmd/thv-operator/pkg/oidc"
 "github.com/stacklok/toolhive/cmd/thv-operator/pkg/runconfig/configmap/checksum"
 "github.com/stacklok/toolhive/cmd/thv-operator/pkg/vmcpconfig"
 "github.com/stacklok/toolhive/pkg/vmcp/workloads"
@@ -25,8 +26,14 @@ func (r *VirtualMCPServerReconciler) ensureVmcpConfigConfigMap(
 ) error {
 ctxLogger := log.FromContext(ctx)
 
-// Convert CRD to vmcp config using converter
-converter := vmcpconfig.NewConverter()
+// Create OIDC resolver to handle all OIDC types (kubernetes, configMap, inline)
+oidcResolver := oidc.NewResolver(r.Client)
+
+// Convert CRD to vmcp config using converter with OIDC resolver
+converter, err := vmcpconfig.NewConverter(oidcResolver)
+if err != nil {
+return fmt.Errorf("failed to create vmcp converter: %w", err)
+}
 config, err := converter.Convert(ctx, vmcp)
 if err != nil {
 return fmt.Errorf("failed to create vmcp Config from VirtualMCPServer: %w", err)

cmd/thv-operator/controllers/virtualmcpserver_vmcpconfig_test.go

@@ -20,6 +20,7 @@ import (
 
 "github.com/stretchr/testify/assert"
 "github.com/stretchr/testify/require"
+"go.uber.org/mock/gomock"
 "gopkg.in/yaml.v3"
 corev1 "k8s.io/api/core/v1"
 metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -28,10 +29,29 @@ import (
 "sigs.k8s.io/controller-runtime/pkg/client/fake"
 
 mcpv1alpha1 "github.com/stacklok/toolhive/cmd/thv-operator/api/v1alpha1"
+oidcmocks "github.com/stacklok/toolhive/cmd/thv-operator/pkg/oidc/mocks"
 "github.com/stacklok/toolhive/cmd/thv-operator/pkg/vmcpconfig"
 "github.com/stacklok/toolhive/pkg/vmcp"
 )
 
+// newNoOpMockResolver creates a mock resolver that returns (nil, nil) for all calls.
+// Use this in tests that don't care about OIDC configuration.
+func newNoOpMockResolver(t *testing.T) *oidcmocks.MockResolver {
+t.Helper()
+ctrl := gomock.NewController(t)
+mockResolver := oidcmocks.NewMockResolver(ctrl)
+mockResolver.EXPECT().Resolve(gomock.Any(), gomock.Any()).Return(nil, nil).AnyTimes()
+return mockResolver
+}
+
+// newTestConverter creates a Converter with the given resolver, failing the test if creation fails.
+func newTestConverter(t *testing.T, resolver *oidcmocks.MockResolver) *vmcpconfig.Converter {
+t.Helper()
+converter, err := vmcpconfig.NewConverter(resolver)
+require.NoError(t, err)
+return converter
+}
+
 // TestCreateVmcpConfigFromVirtualMCPServer tests vmcp config generation
 func TestCreateVmcpConfigFromVirtualMCPServer(t *testing.T) {
 t.Parallel()
@@ -65,7 +85,7 @@ func TestCreateVmcpConfigFromVirtualMCPServer(t *testing.T) {
 t.Run(tt.name, func(t *testing.T) {
 t.Parallel()
 
-converter := vmcpconfig.NewConverter()
+converter := newTestConverter(t, newNoOpMockResolver(t))
 config, err := converter.Convert(context.Background(), tt.vmcp)
 
 require.NoError(t, err)
@@ -138,7 +158,7 @@ func TestConvertOutgoingAuth(t *testing.T) {
 },
 }
 
-converter := vmcpconfig.NewConverter()
+converter := newTestConverter(t, newNoOpMockResolver(t))
 config, err := converter.Convert(context.Background(), vmcpServer)
 require.NoError(t, err)
 
@@ -198,7 +218,7 @@ func TestConvertBackendAuthConfig(t *testing.T) {
 },
 }
 
-converter := vmcpconfig.NewConverter()
+converter := newTestConverter(t, newNoOpMockResolver(t))
 config, err := converter.Convert(context.Background(), vmcpServer)
 require.NoError(t, err)
 
@@ -292,7 +312,7 @@ func TestConvertAggregation(t *testing.T) {
 },
 }
 
-converter := vmcpconfig.NewConverter()
+converter := newTestConverter(t, newNoOpMockResolver(t))
 config, err := converter.Convert(context.Background(), vmcpServer)
 require.NoError(t, err)
 
@@ -385,7 +405,7 @@ func TestConvertCompositeTools(t *testing.T) {
 },
 }
 
-converter := vmcpconfig.NewConverter()
+converter := newTestConverter(t, newNoOpMockResolver(t))
 config, err := converter.Convert(context.Background(), vmcpServer)
 require.NoError(t, err)
 
@@ -564,7 +584,7 @@ func TestYAMLMarshalingDeterminism(t *testing.T) {
 },
 }
 
-converter := vmcpconfig.NewConverter()
+converter := newTestConverter(t, newNoOpMockResolver(t))
 
 // Marshal the config 10 times to ensure deterministic output
 const iterations = 10

cmd/thv-operator/pkg/oidc/mocks/mock_resolver.go

@@ -47,6 +47,8 @@ type OIDCConfigurable interface {
 GetProxyPort() int32
 }
 
+//go:generate mockgen -destination=mocks/mock_resolver.go -package=mocks -source=resolver.go Resolver
+
 // Resolver is the interface for resolving OIDC configuration from various sources
 type Resolver interface {
 // Resolve takes any resource implementing OIDCConfigurable and resolves its OIDC config