Adding noop-with-token to allow k8 authentication for MCP servers

[blublinsky]

Description

Type of change

• Refactor
• New feature
• Bug fix
• CVE fix
• Optimization
• Documentation Update
• Configuration Update
• Bump-up service version
• Bump-up dependent library
• Bump-up library or tool used for development (does not change the final image)
• CI configuration change
• Konflux configuration change
• Unit tests improvement
• Integration tests improvement
• End to end tests improvement

Tools used to create PR

Identify any AI code assistants used in this PR (for transparency and review context)

• Assisted-by: (e.g., Claude, CodeRabbit, Ollama, etc., N/A if not used)
• Generated by: (e.g., tool name and version; N/A if not used)

Related Tickets & Documents

• Related Issue #
• Closes #

Checklist before requesting a review

• I have performed a self-review of my code.
• PR has passed all pre-merge test jobs.
• If it is a core feature, I have added thorough tests.

Testing

• Please provide detailed steps to perform tests related to this code change.
• How were the fix/results from this change verified? Please provide relevant screenshots or results.

Summary by CodeRabbit

• Bug Fixes

  • Expanded MCP authorization header validation to support "noop-with-token" authentication module for Kubernetes-specific headers, in addition to "k8s" module.
  • Improved validation messages for clarity on accepted authentication module and header value pairings.

• Documentation

  • Added clarification that "noop-with-token" is intended for testing and development; Kubernetes tokens must be provided in headers when using Kubernetes authorization headers.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

This PR refactors MCP authentication-related code by extracting hard-coded string literals ("kubernetes" and "client") into constants, and updates validation logic to recognize the "noop-with-token" authentication module alongside "k8s" for Kubernetes headers.

Changes

Cohort / File(s)	Summary
Constants Definition src/constants.py	Added two new public constants: MCP_AUTH_KUBERNETES = "kubernetes" and MCP_AUTH_CLIENT = "client"
MCP Auth Header Utilities src/utils/mcp_auth_headers.py	Replaced hard-coded string checks for "kubernetes" and "client" with constant references
Endpoint Logic src/app/endpoints/mcp_auth.py, src/app/endpoints/query_v2.py	Updated MCP header-value checks to use constants.MCP_AUTH_KUBERNETES and constants.MCP_AUTH_CLIENT instead of string literals
MCP Authorization Validation src/models/config.py	Expanded validation to accept "noop-with-token" as an allowed authentication module for Kubernetes-header authorization, alongside existing "k8s" support; updated error/warning messages and added explanatory note for development/testing context
Type Annotation tests/e2e/mock_jwks_server/server.py	Added Any type hint to *args parameter in log_message method signature

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• Add configuration for MCP servers, updated documentation, created man… #972 — Refactors the same MCP auth header constants and validation logic to support "noop-with-token" module alongside existing "k8s" authorization.

Suggested labels

enhancement, ok-to-test

Suggested reviewers

• tisnik

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title accurately describes the main change: adding noop-with-token support to enable Kubernetes authentication for MCP servers, which is reflected in the code changes to constants, config validation, and auth headers.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[jrobertboos]

LGTM. I like replacing everything with constants :)