mathiasandClaude Opus 4.8
240c3ec081
Additive: gitea-mcp now validates JWTs from a LIST of issuers — the existing Authentik issuer (DEX_ISSUER_URL) AND, when K8S_ISSUER_URL is set, the in-cluster k8s OIDC issuer for audience-bound ServiceAccount tokens. Lets in-cluster pods authenticate with kubelet-rotated projected SA tokens instead of a static bearer. - config: K8S_ISSUER_URL + K8S_MCP_AUDIENCE. - cmd/gitea-mcp/k8soidc.go: HTTP client that fetches the k8s OIDC discovery/JWKS with the cluster CA + this pod's SA bearer (k3s requires an authed fetch; anonymous is 401). - main.go: build the issuer list; switch NewJWTValidator -> NewMultiJWTValidator. The k8s issuer is best-effort — if its client can't be built (not in a pod) or its discovery is unreachable at startup, it is DROPPED and we fall back so Authentik/static auth is never taken down. Smoke-tested: off-pod it logs the skip and starts static-only; static-bearer /mcp returns 400 (auth passed), not 401. - bump mcp-chassis v0.3.0 -> v0.5.0 (multi-issuer + per-issuer HTTPClient). Refs infra ADR-0011; enables retiring the in-cluster static bearer. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
27 lines
862 B
AMPL
27 lines
862 B
AMPL
module git.d-ma.be/mathias/gitea-mcp
|
|
|
|
go 1.26.2
|
|
|
|
require (
|
|
git.d-ma.be/mathias/mcp-chassis v0.5.0
|
|
github.com/hashicorp/golang-lru/v2 v2.0.7
|
|
github.com/stretchr/testify v1.11.1
|
|
)
|
|
|
|
require (
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
|
|
github.com/goccy/go-json v0.10.3 // indirect
|
|
github.com/lestrrat-go/blackmagic v1.0.3 // indirect
|
|
github.com/lestrrat-go/httpcc v1.0.1 // indirect
|
|
github.com/lestrrat-go/httprc v1.0.6 // indirect
|
|
github.com/lestrrat-go/iter v1.0.2 // indirect
|
|
github.com/lestrrat-go/jwx/v2 v2.1.6 // indirect
|
|
github.com/lestrrat-go/option v1.0.1 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/segmentio/asm v1.2.0 // indirect
|
|
golang.org/x/crypto v0.32.0 // indirect
|
|
golang.org/x/sys v0.31.0 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|