mathiasandClaude Opus 4.8
240c3ec081
Additive: gitea-mcp now validates JWTs from a LIST of issuers — the existing Authentik issuer (DEX_ISSUER_URL) AND, when K8S_ISSUER_URL is set, the in-cluster k8s OIDC issuer for audience-bound ServiceAccount tokens. Lets in-cluster pods authenticate with kubelet-rotated projected SA tokens instead of a static bearer. - config: K8S_ISSUER_URL + K8S_MCP_AUDIENCE. - cmd/gitea-mcp/k8soidc.go: HTTP client that fetches the k8s OIDC discovery/JWKS with the cluster CA + this pod's SA bearer (k3s requires an authed fetch; anonymous is 401). - main.go: build the issuer list; switch NewJWTValidator -> NewMultiJWTValidator. The k8s issuer is best-effort — if its client can't be built (not in a pod) or its discovery is unreachable at startup, it is DROPPED and we fall back so Authentik/static auth is never taken down. Smoke-tested: off-pod it logs the skip and starts static-only; static-bearer /mcp returns 400 (auth passed), not 401. - bump mcp-chassis v0.3.0 -> v0.5.0 (multi-issuer + per-issuer HTTPClient). Refs infra ADR-0011; enables retiring the in-cluster static bearer. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
59 lines
2.0 KiB
Go
59 lines
2.0 KiB
Go
package config
|
|
|
|
import (
|
|
"os"
|
|
"strings"
|
|
)
|
|
|
|
type Config struct {
|
|
Port string // GITEA_MCP_PORT, default 8080
|
|
GiteaBaseURL string // GITEA_BASE_URL, e.g. https://gitea.d-ma.be
|
|
DefaultToken string // GITEA_MCP_DEFAULT_TOKEN, service PAT; used by Gitea client for all upstream calls
|
|
StaticToken string // GITEA_MCP_STATIC_TOKEN, optional static bearer for service-to-service auth
|
|
AllowedOwners []string // GITEA_MCP_ALLOWED_OWNERS, comma-separated, default "mathias"
|
|
OriginAllowlist []string // GITEA_MCP_ORIGIN_ALLOWLIST, comma-separated
|
|
DexIssuerURL string // DEX_ISSUER_URL, e.g. https://auth.d-ma.be; empty disables JWT auth
|
|
MCPAudience string // MCP_AUDIENCE, JWT audience claim to validate, e.g. claude-ai
|
|
MCPResourceURL string // MCP_RESOURCE_URL, this server's public URL for /.well-known metadata
|
|
K8sIssuerURL string // K8S_ISSUER_URL, in-cluster OIDC issuer for ServiceAccount-token auth (ADR-0011 D1); empty disables
|
|
K8sAudience string // K8S_MCP_AUDIENCE, required audience claim for k8s SA tokens
|
|
}
|
|
|
|
func Load() (Config, error) {
|
|
cfg := Config{
|
|
Port: envOr("GITEA_MCP_PORT", "8080"),
|
|
GiteaBaseURL: os.Getenv("GITEA_BASE_URL"),
|
|
DefaultToken: os.Getenv("GITEA_MCP_DEFAULT_TOKEN"),
|
|
StaticToken: os.Getenv("GITEA_MCP_STATIC_TOKEN"),
|
|
AllowedOwners: splitCSV(envOr("GITEA_MCP_ALLOWED_OWNERS", "mathias")),
|
|
OriginAllowlist: splitCSV(os.Getenv("GITEA_MCP_ORIGIN_ALLOWLIST")),
|
|
DexIssuerURL: os.Getenv("DEX_ISSUER_URL"),
|
|
MCPAudience: os.Getenv("MCP_AUDIENCE"),
|
|
MCPResourceURL: os.Getenv("MCP_RESOURCE_URL"),
|
|
K8sIssuerURL: os.Getenv("K8S_ISSUER_URL"),
|
|
K8sAudience: os.Getenv("K8S_MCP_AUDIENCE"),
|
|
}
|
|
return cfg, nil
|
|
}
|
|
|
|
func envOr(key, def string) string {
|
|
if v := os.Getenv(key); v != "" {
|
|
return v
|
|
}
|
|
return def
|
|
}
|
|
|
|
func splitCSV(s string) []string {
|
|
if s == "" {
|
|
return nil
|
|
}
|
|
parts := strings.Split(s, ",")
|
|
out := make([]string, 0, len(parts))
|
|
for _, p := range parts {
|
|
if p = strings.TrimSpace(p); p != "" {
|
|
out = append(out, p)
|
|
}
|
|
}
|
|
return out
|
|
}
|