mathiasandClaude Opus 4.8
240c3ec081
Additive: gitea-mcp now validates JWTs from a LIST of issuers — the existing Authentik issuer (DEX_ISSUER_URL) AND, when K8S_ISSUER_URL is set, the in-cluster k8s OIDC issuer for audience-bound ServiceAccount tokens. Lets in-cluster pods authenticate with kubelet-rotated projected SA tokens instead of a static bearer. - config: K8S_ISSUER_URL + K8S_MCP_AUDIENCE. - cmd/gitea-mcp/k8soidc.go: HTTP client that fetches the k8s OIDC discovery/JWKS with the cluster CA + this pod's SA bearer (k3s requires an authed fetch; anonymous is 401). - main.go: build the issuer list; switch NewJWTValidator -> NewMultiJWTValidator. The k8s issuer is best-effort — if its client can't be built (not in a pod) or its discovery is unreachable at startup, it is DROPPED and we fall back so Authentik/static auth is never taken down. Smoke-tested: off-pod it logs the skip and starts static-only; static-bearer /mcp returns 400 (auth passed), not 401. - bump mcp-chassis v0.3.0 -> v0.5.0 (multi-issuer + per-issuer HTTPClient). Refs infra ADR-0011; enables retiring the in-cluster static bearer. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>