Skip to content

Build http.client to avoid rest.TransportFor in toolset#35

Open
saswatamcode wants to merge 3 commits intorhobs:mainfrom
saswatamcode:toolsetauth
Open

Build http.client to avoid rest.TransportFor in toolset#35
saswatamcode wants to merge 3 commits intorhobs:mainfrom
saswatamcode:toolsetauth

Conversation

@saswatamcode
Copy link
Member

No description provided.

Signed-off-by: Saswata Mukherjee <saswataminsta@yahoo.com>
@saswatamcode saswatamcode requested a review from a team February 25, 2026 13:05
@openshift-ci openshift-ci bot requested review from iNecas and rexagod February 25, 2026 13:05
// which would inherit the AccessControlRoundTripper.
func createAPIConfigWithToken(restConfig *rest.Config, prometheusURL, token string, insecure bool) (promapi.Config, error) {
apiConfig := promapi.Config{
Address: prometheusURL,

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure if this will work in the multi cluster case. In general, the idea is that the params passed into each tool call will be configured to communicate to any target cluster transparently, see how that gets set up for ACM (which uses the cluster proxy addon to communicate to the target cluster) here: https://github.com/openshift/openshift-mcp-server/blob/c8655b776aa11143bcf37d0a61a6ecc445d952f3/pkg/kubernetes/provider_acm_hub.go#L549

If the idea is that these tools should not be able to target multiple clusters you would need to set cluster aware to false: https://github.com/openshift/openshift-mcp-server/blob/c8655b776aa11143bcf37d0a61a6ecc445d952f3/pkg/toolsets/config/configuration.go#L31

Otherwise we would probably need to figure out how to make sure that the prometheus url actually goes to the target cluster

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So this is a question I had as well. In ACM case, ideally, this toolset wouldn't be going cluster by cluster but rather just switch to the ACM hub Thanos instance.

I'd need to figure out how to coordinate that when creating these clients

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm going to handle this in next PR

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if you set cluster aware to false it should go to the hub cluster, as far as I know

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've set it to false 43cddc4.

But my point was more that the ACM Hub Thanos actually relies on mTLS auth + custom rbac logic. So would need a way to define the behavior here.

Signed-off-by: Saswata Mukherjee <saswataminsta@yahoo.com>
Signed-off-by: Saswata Mukherjee <saswataminsta@yahoo.com>
Copy link
Contributor

@iNecas iNecas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Needs rebase, but LGTM

@openshift-ci
Copy link

openshift-ci bot commented Mar 4, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: iNecas, saswatamcode

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:
  • OWNERS [iNecas,saswatamcode]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants