MCPAuthzConfig
toolhive.stacklok.dev / v1alpha1
apiVersion: toolhive.stacklok.dev/v1alpha1
kind: MCPAuthzConfig
metadata:
name: example
apiVersion
string
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind
string
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata
object
spec object
MCPAuthzConfigSpec defines the desired state of MCPAuthzConfig.
MCPAuthzConfig resources are namespace-scoped and can only be referenced by
MCPServer, MCPRemoteProxy, or VirtualMCPServer resources in the same namespace.
config
object required
Config contains the backend-specific authorization configuration.
The structure depends on the Type field:
- cedarv1: policies ([]string), entities_json (string), primary_upstream_provider (string), group_claim_name (string)
- httpv1: http ({url, timeout, insecure_skip_verify}), context ({include_args, include_operation}), claim_mapping (string)
type
string required
Type identifies the authorizer backend (e.g., "cedarv1", "httpv1").
Must match a registered authorizer type in the factory registry.
minLength:
1status object
MCPAuthzConfigStatus defines the observed state of MCPAuthzConfig
conditions []object
Conditions represent the latest available observations of the MCPAuthzConfig's state
lastTransitionTime
string required
lastTransitionTime is the last time the condition transitioned from one status to another.
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
format:
date-time
message
string required
message is a human readable message indicating details about the transition.
This may be an empty string.
maxLength:
32768
observedGeneration
integer
observedGeneration represents the .metadata.generation that the condition was set based upon.
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
with respect to the current state of the instance.
format:
int64minimum:
0
reason
string required
reason contains a programmatic identifier indicating the reason for the condition's last transition.
Producers of specific condition types may define expected values and meanings for this field,
and whether the values are considered a guaranteed API.
The value should be a CamelCase string.
This field may not be empty.
pattern:
^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$minLength:
1maxLength:
1024
status
string required
status of the condition, one of True, False, Unknown.
enum:
True, False, Unknown
type
string required
type of condition in CamelCase or in foo.example.com/CamelCase.
pattern:
^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$maxLength:
316
configHash
string
ConfigHash is a hash of the current configuration for change detection
observedGeneration
integer
ObservedGeneration is the most recent generation observed for this MCPAuthzConfig.
format:
int64
referenceCount
integer
ReferenceCount is the number of workloads referencing this config.
format:
int32referencingWorkloads []object
ReferencingWorkloads is a list of workload resources that reference this MCPAuthzConfig.
Each entry identifies the workload by kind and name. The map key is the
(kind, name) pair so two workloads of different kinds that share a name
(e.g., an MCPServer "foo" and a VirtualMCPServer "foo") are distinct
entries rather than colliding under merge-patch semantics.
kind
string required
Kind is the type of workload resource
enum:
MCPServer, VirtualMCPServer, MCPRemoteProxy
name
string required
Name is the name of the workload resource
minLength:
1No matches. Try .spec.config for an exact path