MCP Registry — TLS and Credential Hardening (issue 13 of 29)

[gabemontero]

Labels: ready-to-code
Depends on: Issue 1 (#4039 shared infra), Issue 7 (#4045 mirror endpoint)
RHIDP Stories: RHIDP-15318
Feature: RHDHPLAN-1510 — Epic RHIDP-15313
Cross-feature dependency: RHIDP-15318 depends on RHIDP-15655 (Implement MCP Registry entity provider, RHDHPLAN-393). The upstream community provider must exist as the integration target for TLS/credential wrapping.

Integrate shared CA bundle utility (loadCaBundle()) from @red-hat-developer-hub/backstage-plugin-boost-connector-utils, implement K8s Secret-based authentication (Basic Auth and Bearer token), Secret data caching with 5-minute TTL and invalidation on 401, and per-connector TLS configuration isolation.

Tasks

From openspec/changes/mcp-registry-connector/tasks.md group 2 (RHIDP-15318):

• 2.1 Integrate shared CA bundle utility from RHIDP-15316
• 2.2 Add ai-catalog.providers.mcpRegistry.tls.ca config schema
• 2.3 Implement custom CA bundle loading from file path
• 2.4 Add graceful degradation: invalid CA bundle falls back to system CA
• 2.5 Add warning logging for invalid CA bundle files
• 2.6 Implement HTTPS agent configuration with custom CA bundle
• 2.7 Enforce TLS certificate validation (rejectUnauthorized: true)
• 2.8 Add ai-catalog.providers.mcpRegistry.auth.secretRef config schema
• 2.9 Implement K8s Secret reading
• 2.10 Implement credential extraction from Secret
• 2.11 Implement HTTP Basic Auth for username/password
• 2.12 Implement Bearer token authentication
• 2.13 Implement Secret data caching with 5-minute TTL
• 2.14 Implement cache invalidation on HTTP 401
• 2.15 Add error handling: missing Secret, missing credential keys, invalid Secret data
• 2.16 Add per-connector TLS configuration isolation
• 2.17–2.18 Prometheus metrics for TLS and auth
• 2.19–2.26 Integration tests for CA bundle, K8s Secret, cache invalidation, per-connector isolation
• 2.27–2.29 Documentation: CA bundle config, K8s Secret auth, Secret rotation

Specifications

• openspec/changes/mcp-registry-connector/specs/auth-tls-hardening/spec.md

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 8:01 PM UTC · Completed 8:04 PM UTC
Commit: e03b281 · View workflow run →

[fullsend-ai-triage]

Triage: Prerequisites Not Yet Resolved

This issue (issue 13 of 29 in the MCP Registry connector epic) has clear blocking dependencies that are still open:

1. Cross-Connector Shared Infrastructure Package (issue 1 of 29) #4039 — Cross-Connector Shared Infrastructure Package (OPEN): Provides the loadCaBundle() utility from @boost/connector-utils that task 2.1 directly depends on.
2. MCP Mirror Endpoint + RHOAI Version Normalization (issue 7 of 29) #4045 — MCP Mirror Endpoint + RHOAI Version Normalization (OPEN): Listed as a direct dependency in the issue description.

The issue also references a cross-feature dependency on RHIDP-15655 (MCP Registry entity provider, RHDHPLAN-393) — the upstream community provider that serves as the integration target for TLS/credential wrapping. No tracking issue was found for this in the backstage/community-plugins repository.

The issue itself is well-specified — it has a detailed task breakdown (2.1–2.29), references a spec document, and clearly describes the scope (CA bundle integration, K8s Secret auth, caching with TTL, per-connector TLS isolation). Once the prerequisites land, this should be ready for implementation without further clarification.

Blocked by:

• Cross-Connector Shared Infrastructure Package (issue 1 of 29) #4039
• MCP Mirror Endpoint + RHOAI Version Normalization (issue 7 of 29) #4045

[fullsend-ai-triage]

🤖 Finished Triage · ❌ Failure · Started 7:35 PM UTC · Completed 7:36 PM UTC
Commit: 1b270c9 · View workflow run →

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 7:59 PM UTC · Completed 8:01 PM UTC
Commit: 924cefe · View workflow run →

[fullsend-ai-triage]

Triage: Prerequisites Still Unresolved

This issue remains blocked on three open dependencies:

1. Cross-Connector Shared Infrastructure Package (issue 1 of 29) #4039 — Cross-Connector Shared Infrastructure Package (OPEN, triaged): Provides the loadCaBundle() utility from @red-hat-developer-hub/backstage-plugin-boost-connector-utils that task 2.1 directly depends on.
2. MCP Mirror Endpoint + RHOAI Version Normalization (issue 7 of 29) #4045 — MCP Mirror Endpoint + RHOAI Version Normalization (OPEN, itself blocked): Listed as a direct dependency in the issue description.
3. Implement upstream MCP Registry entity provider (RHIDP-15655 / RHDHPLAN-393) #4068 — Implement upstream MCP Registry entity provider (OPEN): Tracks the cross-feature dependency on RHIDP-15655 / RHDHPLAN-393 — the upstream community provider that serves as the integration target for TLS/credential wrapping.

The issue itself is well-specified with a detailed task breakdown (2.1–2.29), spec references, and clear scope (CA bundle integration, K8s Secret auth, caching with 5-min TTL, per-connector TLS isolation). No open PRs address this issue. Once the prerequisites land, this should be ready for implementation without further clarification.

Blocked by:

• Cross-Connector Shared Infrastructure Package (issue 1 of 29) #4039
• MCP Mirror Endpoint + RHOAI Version Normalization (issue 7 of 29) #4045
• Implement upstream MCP Registry entity provider (RHIDP-15655 / RHDHPLAN-393) #4068