Documentation
¶
Overview ¶
Package endpoint serves the read-only MCP endpoint as the mcp connect subresource of mcpservers (designs-and-proposals storage-mcp-endpoint.md):
POST /apis/spdx.softwarecomposition.kubescape.io/v1beta1/namespaces/{ns}/mcpservers/default/mcp
kube-apiserver authenticates the caller and checks RBAC create on mcpservers/mcp before it forwards the call. The endpoint accepts only calls forwarded by kube-apiserver and checks every read a tool does against the caller's RBAC.
Index ¶
Constants ¶
const Name = "default"
Name is the only mcpservers name served.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// RequestHeader is storage's front-proxy configuration: the CA and the
// names of the client certificate kube-apiserver forwards requests with.
RequestHeader *authenticatorfactory.RequestHeaderConfig
// Authorizer checks each read for the caller (see apiauth.NewAuthorizer).
Authorizer authorizer.Authorizer
// Scheme converts what the REST storage returns to v1beta1.
Scheme *runtime.Scheme
// VulnerabilityManifests is the vulnerabilitymanifests REST storage.
VulnerabilityManifests rest.Storage
// SBOMSyfts is the sbomsyfts REST storage.
SBOMSyfts rest.Storage
// WorkloadConfigurationScans is the workloadconfigurationscans REST storage.
WorkloadConfigurationScans rest.Storage
// ContainerProfiles is the containerprofiles REST storage.
ContainerProfiles rest.Storage
// CallTimeout bounds the work of one tool call.
CallTimeout time.Duration
// MaxResponseBytes caps the text of one tool result.
MaxResponseBytes int
}
type Endpoint ¶
type Endpoint struct {
// contains filtered or unexported fields
}
func (*Endpoint) ServeHTTP ¶
func (e *Endpoint) ServeHTTP(w http.ResponseWriter, r *http.Request)
ServeHTTP refuses anonymous calls and calls that did not come through kube-apiserver. Storage's authenticator also accepts bearer tokens sent straight to it and anonymous calls, so a user in the request context is not enough on its own.