fix: fail when discover of auth creds fail

instead of falling back to unauthenticated, make the process fail when there is a problem in discovering auth config

Author: taskbot

pkg/vmcp/workloads/k8s.go

@@ -98,6 +98,12 @@ func (d *k8sDiscoverer) GetWorkloadAsVMCPBackend(ctx context.Context, workloadNa
 // Convert MCPServer to Backend
 backend := d.mcpServerToBackend(ctx, mcpServer)
 
+// If auth discovery failed, mcpServerToBackend returns nil
+if backend == nil {
+logger.Warnf("Skipping workload %s due to auth discovery failure", workloadName)
+return nil, nil
+}
+
 // Skip workloads without a URL (not accessible)
 if backend.BaseURL == "" {
 logger.Debugf("Skipping workload %s without URL", workloadName)
@@ -182,8 +188,11 @@ func (d *k8sDiscoverer) mcpServerToBackend(ctx context.Context, mcpServer *mcpv1
 
 // Discover and populate authentication configuration from MCPServer
 if err := d.discoverAuthConfig(ctx, mcpServer, backend); err != nil {
-// Log warning but don't fail - backend can still be used without auth
-logger.Warnf("Failed to discover auth config for MCPServer %s: %v", mcpServer.Name, err)
+// If auth discovery fails, we must fail - don't silently allow unauthorized access
+// This is a security-critical operation: if auth is configured but fails to load,
+// we should not proceed without it
+logger.Errorf("Failed to discover auth config for MCPServer %s: %v", mcpServer.Name, err)
+return nil
 }
 
 return backend

pkg/vmcp/workloads/k8s_test.go

@@ -255,11 +255,10 @@ func TestDiscoverAuth_AuthConfigNotFound(t *testing.T) {
 ctx := context.Background()
 backend, err := discoverer.GetWorkloadAsVMCPBackend(ctx, "test-server")
 
-// Should still return the backend but without auth (logs warning)
+// Should return nil backend when auth config is referenced but not found
+// This is security-critical: fail closed rather than allowing unauthorized access
 require.NoError(t, err)
-require.NotNil(t, backend)
-assert.Empty(t, backend.AuthStrategy)
-assert.Nil(t, backend.AuthMetadata)
+require.Nil(t, backend, "Should return nil backend when auth config is missing")
 }
 
 func TestDiscoverAuth_SecretNotFound(t *testing.T) {
@@ -312,11 +311,10 @@ func TestDiscoverAuth_SecretNotFound(t *testing.T) {
 ctx := context.Background()
 backend, err := discoverer.GetWorkloadAsVMCPBackend(ctx, "test-server")
 
-// Should still return the backend but without auth (logs warning)
+// Should return nil backend when secret is missing
+// This is security-critical: fail closed rather than allowing unauthorized access
 require.NoError(t, err)
-require.NotNil(t, backend)
-assert.Empty(t, backend.AuthStrategy)
-assert.Nil(t, backend.AuthMetadata)
+require.Nil(t, backend, "Should return nil backend when secret is missing")
 }
 
 func TestMCPServerToBackend_BasicFields(t *testing.T) {