Merge branch 'main' into google-oauth

Author: ChrisJBurns

.claude/settings.json

@@ -12,7 +12,18 @@
       "Bash(pre-commit install:*)",
       "Bash(pre-commit autoupdate:*)",
       "Bash(helm-docs:*)",
-      "Bash(codespell:*)"
+      "Bash(codespell:*)",
+      "Bash(task operator-install-crds)",
+      "Bash(task operator-uninstall-crds)",
+      "Bash(task operator-deploy-latest)",
+      "Bash(task operator-deploy-local)",
+      "Bash(task operator-undeploy)",
+      "Bash(task operator-generate)",
+      "Bash(task operator-manifests)",
+      "Bash(task operator-test)",
+      "Bash(task operator-e2e-test)",
+      "Bash(task crdref-install)",
+      "Bash(task crdref-gen)"
     ],
     "deny": []
   }

.github/workflows/issue-triage.yml

@@ -79,6 +79,7 @@ jobs:
              - Be specific but comprehensive
              - Consider platform labels (kubernetes) if applicable
              - If you find similar issues using mcp__github__search_issues, consider using a "duplicate" label if appropriate. Only do so if the issue is a duplicate of another OPEN issue.
+             - DO NOT add labels that pertain to priority, such as p0, p1, p2, etc.
 
           5. Apply the selected labels:
              - Use mcp__github__update_issue to apply your selected labels

.github/workflows/test.yml

@@ -19,11 +19,28 @@ jobs:
           go-version-file: 'go.mod'
           cache: true
 
+      - name: Set up gotestfmt
+        uses: gotesttools/gotestfmt-action@v2
+        # Optional: pass GITHUB_TOKEN to avoid rate limiting.
+        # with:  
+        #   token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Install Task
         uses: arduino/setup-task@v2
         with:
           version: 3.x
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Run tests
-        run: task test
+      - name: Run tests with coverage
+        run: task test-coverage
+
+      - name: Upload coverage reports to Codecov with GitHub Action
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          slug: stacklok/toolhive
+
+      - name: Upload coverage to Coveralls
+        uses: coverallsapp/github-action@v2
+        with:
+          file: coverage/coverage.out

README.md

@@ -12,6 +12,7 @@
 </p>
 
 [![Release][release-img]][release] [![Build status][ci-img]][ci]
+[![Coverage Status][coveralls-img]][coveralls]
 [![License: Apache 2.0][license-img]][license]
 [![Star on GitHub][stars-img]][stars] [![Discord][discord-img]][discord]
 
@@ -104,6 +105,8 @@ This project is licensed under the [Apache 2.0 License](./LICENSE).
 [release]: https://github.com/stacklok/toolhive/releases/latest
 [ci-img]: https://img.shields.io/github/actions/workflow/status/stacklok/toolhive/run-on-main.yml?style=flat&logo=github&label=Build
 [ci]: https://github.com/stacklok/toolhive/actions/workflows/run-on-main.yml
+[coveralls-img]: https://coveralls.io/repos/github/stacklok/toolhive/badge.svg?branch=main
+[coveralls]: https://coveralls.io/github/stacklok/toolhive?branch=main
 [license-img]: https://img.shields.io/badge/License-Apache2.0-blue.svg?style=flat
 [license]: https://opensource.org/licenses/Apache-2.0
 [stars-img]: https://img.shields.io/github/stars/stacklok/toolhive.svg?style=flat&logo=github&label=Stars

Taskfile.yml

@@ -46,7 +46,10 @@ tasks:
     platforms: [linux, darwin]
     internal: true
     cmds:
-      - go test -v -race $(go list ./... | grep -v '/test/e2e')
+      - go install github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt@latest
+      # we have to use ldflags to avoid the LC_DYSYMTAB linker error. 
+      # https://github.com/stacklok/toolhive/issues/1687
+      - go test -ldflags=-extldflags=-Wl,-w -v -json -race $(go list ./... | grep -v '/test/e2e') | gotestfmt
 
   test-windows:
     desc: Run unit tests (excluding e2e tests) on Windows with race detection
@@ -74,7 +77,10 @@ tasks:
     cmds:
       - cmd: mkdir -p coverage
         platforms: [linux, darwin]
-      - go test -race -coverprofile=coverage/coverage.out $(go list ./... | grep -v '/test/e2e')
+      - go install github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt@latest
+      # we have to use ldflags to avoid the LC_DYSYMTAB linker error. 
+      # https://github.com/stacklok/toolhive/issues/1687
+      - go test -ldflags=-extldflags=-Wl,-w -json -race -coverprofile=coverage/coverage.out $(go list ./... | grep -v '/test/e2e') | gotestfmt
       - go tool cover -func=coverage/coverage.out
       - echo "Generating HTML coverage report in coverage/coverage.html"
       - go tool cover -html=coverage/coverage.out -o coverage/coverage.html

cmd/thv-operator/CLAUDE.md

@@ -1,8 +1,24 @@
-- CRDs are in cmd/thv-operator/api/v1alpha1/mcpserver_types.go
-- After modifying the CRDs, the following changes need to be done:
-    - `task operator-generate`, `task operator-manifests` and `task crdref-gen`.
-    - it is important to run `task crdref-gen` inside cmd/thv-operator as the current directory
-- When committing a change that changes CRDs, it is important to bump the chart version in deploy/charts/operator-crds/Chart.yaml and deploy/charts/operator-crds/README.md
+# Claude.md
+
+This document will explain all necessary information for Claude to understand the ToolHive Operator.
+
+## CustomResourceDefinitions
+
+The CRD's are in `cmd/thv-operator/api/v1alpha1/`
+
+After modifying the CRDs, the following needs to be run:
+    - `task operator-generate`
+    - `task operator-manifests`
+    - `task crdref-gen` (it is important to run this command inside `cmd/thv-operator` as the current directory)
+
+When committing a change that changes CRDs, it is important to bump the chart version as described in the [CLAUDE.md](../../deploy/charts/operator-crds/CLAUDE.md#bumping-crd-chart) doc for the CRD Helm Chart.
+
+## OpenTelemetry (OTEL) Stack for Testing
+
+When you have been asked to stand up an OTEL stack to test ToolHives integration inside of Kubernetes, you will need to perform the following tasks inside of the cluster that you have been instructed to use.
+
+- Install the [`kube-prometheus-stack`](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack) using Helm
+- Install the [OTEL Collector](https://opentelemetry.io/docs/platforms/kubernetes/helm/collector/) using Helm
 
 ## Keycloak Development Setup
 

cmd/thv-operator/api/v1alpha1/mcpserver_types.go

@@ -79,6 +79,10 @@ type MCPServerSpec struct {
 	// ToolsFilter is the filter on tools applied to the MCP server
 	// +optional
 	ToolsFilter []string `json:"tools,omitempty"`
+
+	// Telemetry defines observability configuration for the MCP server
+	// +optional
+	Telemetry *TelemetryConfig `json:"telemetry,omitempty"`
 }
 
 // ResourceOverrides defines overrides for annotations and labels on created resources
@@ -436,6 +440,64 @@ type InlineAuthzConfig struct {
 	EntitiesJSON string `json:"entitiesJson,omitempty"`
 }
 
+// TelemetryConfig defines observability configuration for the MCP server
+type TelemetryConfig struct {
+	// OpenTelemetry defines OpenTelemetry configuration
+	// +optional
+	OpenTelemetry *OpenTelemetryConfig `json:"openTelemetry,omitempty"`
+
+	// Prometheus defines Prometheus-specific configuration
+	// +optional
+	Prometheus *PrometheusConfig `json:"prometheus,omitempty"`
+}
+
+// OpenTelemetryConfig defines pure OpenTelemetry configuration
+type OpenTelemetryConfig struct {
+	// Enabled controls whether OpenTelemetry is enabled
+	// +kubebuilder:default=false
+	// +optional
+	Enabled bool `json:"enabled,omitempty"`
+
+	// Endpoint is the OTLP endpoint URL for tracing and metrics
+	// +optional
+	Endpoint string `json:"endpoint,omitempty"`
+
+	// ServiceName is the service name for telemetry
+	// If not specified, defaults to the MCPServer name
+	// +optional
+	ServiceName string `json:"serviceName,omitempty"`
+
+	// Headers contains authentication headers for the OTLP endpoint
+	// Specified as key=value pairs
+	// +optional
+	Headers []string `json:"headers,omitempty"`
+
+	// Insecure indicates whether to use HTTP instead of HTTPS for the OTLP endpoint
+	// +kubebuilder:default=false
+	// +optional
+	Insecure bool `json:"insecure,omitempty"`
+
+	// Metrics defines OpenTelemetry metrics-specific configuration
+	// +optional
+	Metrics *OpenTelemetryMetricsConfig `json:"metrics,omitempty"`
+}
+
+// PrometheusConfig defines Prometheus-specific configuration
+type PrometheusConfig struct {
+	// Enabled controls whether Prometheus metrics endpoint is exposed
+	// +kubebuilder:default=false
+	// +optional
+	Enabled bool `json:"enabled,omitempty"`
+}
+
+// OpenTelemetryMetricsConfig defines OpenTelemetry metrics configuration
+type OpenTelemetryMetricsConfig struct {
+	// Enabled controls whether OTLP metrics are sent
+	// +kubebuilder:default=true
+	// +optional
+	Enabled bool `json:"enabled,omitempty"`
+}
+
 // MCPServerStatus defines the observed state of MCPServer
 type MCPServerStatus struct {
 	// Conditions represent the latest available observations of the MCPServer's state