Documentation
¶
Overview ¶
Package endpoint serves the read-only MCP endpoint as the mcp connect subresource of mcpservers (designs-and-proposals storage-mcp-endpoint.md):
POST /apis/spdx.softwarecomposition.kubescape.io/v1beta1/namespaces/{ns}/mcpservers/default/mcp
kube-apiserver authenticates the caller and checks RBAC create on mcpservers/mcp before it forwards the call. The endpoint accepts only calls forwarded by kube-apiserver and checks every read a tool does against the caller's RBAC.
Index ¶
Constants ¶
const ( RejectNotFrontProxy = "not_front_proxy" RejectQueueFull = "queue_full" RejectWaitTimeout = "wait_timeout" RejectCallerGone = "caller_gone" )
Reasons an MCP call is refused by the admission limit, as in the storage_mcp_admission_rejected_total metric.
const Name = "default"
Name is the only mcpservers name served.
Variables ¶
This section is empty.
Functions ¶
func NewAdmission ¶ added in v0.0.398
NewAdmission returns a handler that sends MCP calls to mcp, within the admission limit, and every other request to others. mcp is the handler chain without storage's global limiter; others is the same chain with it.
Types ¶
type AdmissionConfig ¶ added in v0.0.398
type AdmissionConfig struct {
// RequestHeader is kube-apiserver's front-proxy (request-header) config.
RequestHeader *authenticatorfactory.RequestHeaderConfig
// RequestInfoResolver tells MCP calls from every other request.
RequestInfoResolver genericapirequest.RequestInfoResolver
// MaxRunning is how many MCP calls run at once.
MaxRunning int
// MaxWaiting is how many more MCP calls wait for a free slot.
MaxWaiting int
// MaxWait is how long a call waits for a free slot before it gets 429.
MaxWait time.Duration
}
AdmissionConfig configures the admission limit of MCP calls.
type Config ¶
type Config struct {
// RequestHeader is storage's front-proxy configuration: the CA and the
// names of the client certificate kube-apiserver forwards requests with.
RequestHeader *authenticatorfactory.RequestHeaderConfig
// Authorizer checks each read for the caller (see apiauth.NewAuthorizer).
Authorizer authorizer.Authorizer
// Scheme converts what the REST storage returns to v1beta1.
Scheme *runtime.Scheme
// VulnerabilityManifests is the vulnerabilitymanifests REST storage.
VulnerabilityManifests rest.Storage
// SBOMSyfts is the sbomsyfts REST storage.
SBOMSyfts rest.Storage
// WorkloadConfigurationScans is the workloadconfigurationscans REST storage.
WorkloadConfigurationScans rest.Storage
// ContainerProfiles is the containerprofiles REST storage.
ContainerProfiles rest.Storage
// CallTimeout bounds the work of one tool call.
CallTimeout time.Duration
// MaxResponseBytes caps the text of one tool result.
MaxResponseBytes int
}
type Endpoint ¶
type Endpoint struct {
// contains filtered or unexported fields
}
func (*Endpoint) ServeHTTP ¶
func (e *Endpoint) ServeHTTP(w http.ResponseWriter, r *http.Request)
ServeHTTP refuses anonymous calls and calls that did not come through kube-apiserver. Storage's authenticator also accepts bearer tokens sent straight to it and anonymous calls, so a user in the request context is not enough on its own.
Source Files