Expose SPIFFE client-auth registration through the operator CRDs

The SPIFFE client-authentication runtime model (trust domains + static
workload-to-client associations) already exists in pkg/authserver, but
was only reachable by hand-authoring an auth-server RunConfig file --
there was no way to declare it through VirtualMCPServer or
MCPExternalAuthConfig.

Add SPIFFETrustDomains and InboundGrants.SPIFFEClientAuth to the shared
EmbeddedAuthServerConfig CRD type, with CEL admission validation for
everything derivable from the object's own spec (paired configuration,
no duplicate names/trust domains/client IDs/principal patterns, full
cross-referencing between domains and clients, method-subset
enforcement, principal/trust-domain consistency, and client-ID
hygiene). Wire the new fields through to authserver.RunConfig via the
same converter pattern used for DelegateClients/TrustedIssuers, and
extend the existing reconcile-time revalidation
(validateDelegateClientsAndTrustedIssuers) to cover SPIFFE trust
domains too.

Cross-field checks that need reconcile-time-derived values
(AllowedAudiences, ScopesSupported -- neither is CRD-exposed) are left
to that reconcile-time path rather than a premature admission-time Go
check: an earlier attempt at that check passed nil for both, which the
runtime validator treats as "validate against nothing" rather than
"skip", silently rejecting any resources or custom scopes entry.

A syntactically valid SPIFFE config is admitted by CEL but still fails
reconciliation with a terminal error until RunConfig's
"not yet enforced" placeholder gate is lifted by a future PR -- no
live SVID verification exists yet, so this is expected, not a
regression.

Signed-off-by: Jakub Hrozek <jakub@stacklok.com>

Author: jhrozek

cmd/thv-operator/api/v1beta1/mcpexternalauthconfig_types.go

@@ -779,6 +779,59 @@ func TestMCPExternalAuthConfig_validateEmbeddedAuthServer(t *testing.T) {
 			expectErr: true,
 			errMsg:    "actor_matcher",
 		},
+		{
+			// validateEmbeddedAuthServer deliberately runs no Go-level SPIFFE
+			// pre-check at this layer — same precedent as DelegateClients: a
+			// meaningful resources/scopes check needs AllowedAudiences/
+			// ScopesSupported, which only exist once derived at reconcile
+			// time. A resources entry and a non-default scope must therefore
+			// pass here even though they'd need revalidating once those
+			// derived values are known (see
+			// TestBuildAuthServerRunConfigInvalidSPIFFEIsTypedAndNotYetEnforced
+			// in controllerutil for the reconcile-time revalidation this
+			// relies on). CEL (spiffe_cel_test.go) covers structural
+			// correctness (trust-domain refs, method subsets, etc.) at
+			// admission.
+			name: "spiffe client with resources and custom scope - valid at this layer",
+			config: &MCPExternalAuthConfig{
+				Spec: MCPExternalAuthConfigSpec{
+					Type: ExternalAuthTypeEmbeddedAuthServer,
+					EmbeddedAuthServer: &EmbeddedAuthServerConfig{
+						Issuer: "https://auth.example.com",
+						UpstreamProviders: []UpstreamProviderConfig{{
+							Name:       "github",
+							Type:       UpstreamProviderTypeOIDC,
+							OIDCConfig: &OIDCUpstreamConfig{IssuerURL: "https://github.com", ClientID: "client-id"},
+						}},
+						SPIFFETrustDomains: []SPIFFETrustDomainConfig{{
+							Name: "example", TrustDomain: "example.org",
+							Methods: []SPIFFEAuthenticationMethod{SPIFFEAuthenticationMethodX509},
+							BundleSource: SPIFFEBundleSourceConfig{
+								Type:        SPIFFEBundleSourceTypeWorkloadAPI,
+								WorkloadAPI: &SPIFFEWorkloadAPIBundleSourceConfig{},
+							},
+						}},
+						InboundGrants: &InboundGrantsConfig{
+							SPIFFEClientAuth: []SPIFFEClientConfig{{
+								TrustDomainRef:   "example",
+								PrincipalPattern: "spiffe://example.org/ns/default/agent",
+								ClientID:         "spiffe-client",
+								Methods:          []SPIFFEAuthenticationMethod{SPIFFEAuthenticationMethodX509},
+								// Not in allowed_audiences and not a default
+								// scope — would be rejected if the removed
+								// admission-time pre-check fabricated a nil
+								// allowlist/default-scopes set instead of
+								// deferring to reconcile time.
+								Resources: []string{"https://backend.example.com"},
+								Audiences: []string{"https://mcp.example.com"},
+								Scopes:    []string{"custom:scope"},
+							}},
+						},
+					},
+				},
+			},
+			expectErr: false,
+		},
 	}
 
 	for _, tt := range tests {

cmd/thv-operator/api/v1beta1/mcpexternalauthconfig_types_test.go

@@ -310,6 +310,73 @@ func buildJWTBearerGrantPolicy(config *mcpv1beta1.JWTBearerGrantConfig) *tokenex
 	return policy
 }
 
+// buildSPIFFETrustDomainRunConfigs converts CRD SPIFFETrustDomainConfig
+// entries to authserver.SPIFFETrustDomainRunConfig, the runtime type
+// authserver.RunConfig.SPIFFETrustDomains consumes directly. None of these
+// fields reference a Secret, so no env-var indirection is needed here.
+func buildSPIFFETrustDomainRunConfigs(
+	domains []mcpv1beta1.SPIFFETrustDomainConfig,
+) []authserver.SPIFFETrustDomainRunConfig {
+	configs := make([]authserver.SPIFFETrustDomainRunConfig, len(domains))
+	for i, domain := range domains {
+		methods := make([]authserver.SPIFFEAuthenticationMethod, len(domain.Methods))
+		for j, method := range domain.Methods {
+			methods[j] = authserver.SPIFFEAuthenticationMethod(method)
+		}
+		configs[i] = authserver.SPIFFETrustDomainRunConfig{
+			Name:         domain.Name,
+			TrustDomain:  domain.TrustDomain,
+			Methods:      methods,
+			BundleSource: buildSPIFFEBundleSourceRunConfig(domain.BundleSource),
+		}
+	}
+	return configs
+}
+
+// buildSPIFFEBundleSourceRunConfig converts the CRD's discriminated
+// bundle-source union to the runtime shape.
+func buildSPIFFEBundleSourceRunConfig(source mcpv1beta1.SPIFFEBundleSourceConfig) authserver.SPIFFEBundleSourceRunConfig {
+	converted := authserver.SPIFFEBundleSourceRunConfig{Type: authserver.SPIFFEBundleSourceType(source.Type)}
+	if source.Endpoint != nil {
+		converted.Endpoint = &authserver.SPIFFEBundleEndpointSourceRunConfig{
+			URL:     source.Endpoint.URL,
+			Profile: authserver.SPIFFEBundleEndpointProfile(source.Endpoint.Profile),
+		}
+	}
+	if source.WorkloadAPI != nil {
+		converted.WorkloadAPI = &authserver.SPIFFEWorkloadAPIBundleSourceRunConfig{}
+	}
+	return converted
+}
+
+// buildSPIFFEClientAuthRunConfigs converts CRD SPIFFEClientConfig entries to
+// authserver.SPIFFEClientAuthRunConfig. GrantTypes is not a CRD field: the
+// runtime only accepts exactly the RFC 8693 token-exchange grant for a
+// SPIFFE client (validateSPIFFEGrants in pkg/authserver/spiffe_trust.go), so
+// it is always supplied here rather than configured.
+func buildSPIFFEClientAuthRunConfigs(
+	clients []mcpv1beta1.SPIFFEClientConfig,
+) []authserver.SPIFFEClientAuthRunConfig {
+	configs := make([]authserver.SPIFFEClientAuthRunConfig, len(clients))
+	for i, spiffeClient := range clients {
+		methods := make([]authserver.SPIFFEAuthenticationMethod, len(spiffeClient.Methods))
+		for j, method := range spiffeClient.Methods {
+			methods[j] = authserver.SPIFFEAuthenticationMethod(method)
+		}
+		configs[i] = authserver.SPIFFEClientAuthRunConfig{
+			TrustDomainRef:   spiffeClient.TrustDomainRef,
+			PrincipalPattern: spiffeClient.PrincipalPattern,
+			ClientID:         spiffeClient.ClientID,
+			Methods:          methods,
+			Resources:        append([]string(nil), spiffeClient.Resources...),
+			Audiences:        append([]string(nil), spiffeClient.Audiences...),
+			Scopes:           append([]string(nil), spiffeClient.Scopes...),
+			GrantTypes:       []string{authserver.SPIFFEGrantTypeTokenExchange},
+		}
+	}
+	return configs
+}
+
 // EmbeddedAuthServerConfigName returns the config name that should be used for
 // embedded auth server volume/env generation, or empty string if neither ref applies.
 // AuthServerRef takes precedence; externalAuthConfigRef is used as a fallback.
@@ -827,7 +894,9 @@ func buildInboundGrantsRunConfig(
 	if config == nil {
 		return nil, nil
 	}
-	grants := &authserver.InboundGrantsRunConfig{}
+	grants := &authserver.InboundGrantsRunConfig{
+		SPIFFEClientAuth: buildSPIFFEClientAuthRunConfigs(config.SPIFFEClientAuth),
+	}
 	if config.TokenExchange != nil {
 		delegateClients, err := buildDelegateClientRunConfigs(config.TokenExchange.DelegateClients)
 		if err != nil {
@@ -912,6 +981,7 @@ func BuildAuthServerRunConfig(
 		ScopesSupported:              scopesSupported,
 		BaselineClientScopes:         authConfig.BaselineClientScopes,
 		InboundGrants:                inboundGrants,
+		SPIFFETrustDomains:           buildSPIFFETrustDomainRunConfigs(authConfig.SPIFFETrustDomains),
 	}
 
 	if len(authConfig.DelegateClients) > 0 {
@@ -1032,7 +1102,8 @@ func buildAuthServerSecretsConfig(config *authserver.RunConfig, authConfig *mcpv
 // or allow_may_act combined with the delegate-client wildcard) as a
 // reconcile error rather than a pod crash loop.
 func validateDelegateClientsAndTrustedIssuers(config *authserver.RunConfig) error {
-	if len(config.DelegateClients) == 0 && len(config.TrustedIssuers) == 0 && config.InboundGrants == nil {
+	if len(config.DelegateClients) == 0 && len(config.TrustedIssuers) == 0 && config.InboundGrants == nil &&
+		len(config.SPIFFETrustDomains) == 0 {
 		return nil
 	}
 
@@ -1043,9 +1114,10 @@ func validateDelegateClientsAndTrustedIssuers(config *authserver.RunConfig) erro
 		InsecureAllowHTTP:              config.InsecureAllowHTTP,
 		AllowPrivateKeyJWTRegistration: config.AllowPrivateKeyJWTRegistration,
 		InsecureAllowConfidentialOverLoopbackHTTP: config.InsecureAllowConfidentialOverLoopbackHTTP,
-		DelegateClients: config.DelegateClients,
-		TrustedIssuers:  config.TrustedIssuers,
-		InboundGrants:   config.InboundGrants,
+		DelegateClients:    config.DelegateClients,
+		TrustedIssuers:     config.TrustedIssuers,
+		InboundGrants:      config.InboundGrants,
+		SPIFFETrustDomains: config.SPIFFETrustDomains,
 	}
 	if err := validationConfig.Validate(); err != nil {
 		return fmt.Errorf("invalid embedded auth server delegate clients or trusted issuers: %w", err)