Description
The toolhive-webhook should inject client-registration and spiffy-helper containers into pods that require SPIFFE identity and Keycloak client registration. This replaces the previous pattern of using initContainer, which is incompatible with the long running nature of spiffy-helper process.
Background
Previously, MCP Server CR used initContainer to handle client registrations with Keycloak as part of identity setup. However, this approach has fundamental limitation:
- initContainers run sequentially and must terminate before main container can start
- spiffy-helper is a long-running process that manages SPIFFY identities and certificate rotation.
- client-registration depends on spiffy-helper being available to obtain SPIFFY credentials.
These requirements are incompatible with the initContainer model, which expects containers to complete and exit.
Solution
The toolhive-webhook should automatically inject sidecar containers into MCP Server pod:
- spiffy-helper
- client-registration
Both containers run as sidecar containers alongside the main MCP Server application container
Description
The toolhive-webhook should inject
client-registrationandspiffy-helpercontainers into pods that require SPIFFE identity and Keycloak client registration. This replaces the previous pattern of using initContainer, which is incompatible with the long running nature of spiffy-helper process.Background
Previously, MCP Server CR used initContainer to handle client registrations with Keycloak as part of identity setup. However, this approach has fundamental limitation:
These requirements are incompatible with the initContainer model, which expects containers to complete and exit.
Solution
The toolhive-webhook should automatically inject sidecar containers into MCP Server pod:
Both containers run as sidecar containers alongside the main MCP Server application container