feat(tls): add HTTPS support for in-cluster fixtures - #95
Open
dwmkerr wants to merge 3 commits into
Open
Conversation
The MCP 2025-06-18 spec + RFC 8414 / RFC 9728 require HTTPS issuer and
resource metadata URLs. The Go MCP SDK (and other strict clients) reject
non-HTTPS, non-loopback URLs at fetch time with no escape hatch. A mock-llm
running as a Kubernetes fixture needs real TLS for those clients to exercise
the full wire protocol.
mock-llm does not generate or discover certificates. It reads cert + key
paths from config (or MOCK_LLM_TLS_CERT / MOCK_LLM_TLS_KEY env vars, which
take precedence) and calls https.createServer. Same pattern as nginx, caddy,
etcd, kubelet.
The Helm chart generates a self-signed cert via genSelfSignedCert and emits:
- Secret {fullname}-tls mounted into the pod (type kubernetes.io/tls)
- ConfigMap {fullname}-ca for consumers to mount as a trust bundle
Liveness / readiness / startup probes switch to scheme: HTTPS when
tls.enabled. Bring-your-own-cert via tls.existingSecret + tls.existingCAConfigMap.
Spins up an isolated mock-llm on port 6557 with a self-signed cert in a tmpdir, then verifies: - /health returns 200 over HTTPS with the CA pinned - Plain HTTP is rejected on the TLS port - TLS verification rejects the cert without --cacert Runs as part of npm run test:samples alongside the existing OAuth samples.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #95 +/- ##
==========================================
+ Coverage 92.77% 93.94% +1.17%
==========================================
Files 20 21 +1
Lines 609 628 +19
Branches 110 117 +7
==========================================
+ Hits 565 590 +25
+ Misses 30 24 -6
Partials 14 14
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
…ader - main.ts: cover partial env override (enabled via env, paths fall back to config file) and the enabled=false disables branch. - config.spec.ts: cover loadConfig non-existent path + YAML file containing a tls block (config.ts coverage 57% -> 100%).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Test plan