removed additional mcp transport, streamlined MCP Auth resolution #2705

blublinsky · 2026-01-20T17:09:44Z

Description

Type of change

Related Tickets & Documents

Related Issue #
OLS-2275
Closes #

Checklist before requesting a review

I have performed a self-review of my code.
PR has passed all pre-merge test jobs.
If it is a core feature, I have added thorough tests.

Testing

Please provide detailed steps to perform tests related to this code change.
How were the fix/results from this change verified? Please provide relevant screenshots or results.

openshift-ci · 2026-01-20T17:10:07Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign onmete for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

blublinsky · 2026-01-22T08:49:15Z

/retest

onmete · 2026-01-22T09:40:24Z

ols/app/models/config.py

-    timeout: int = constants.SSE_TRANSPORT_DEFAULT_TIMEOUT
-    sse_read_timeout: int = constants.SSE_TRANSPORT_DEFAULT_READ_TIMEOUT
-    headers: dict[str, str] = Field(default_factory=dict)
+    authorization_headers: dict[str, str] = Field(


Can we rename this to just headers? I understand we use it for auth purposes now, but it can be any other arbitrary headers.

We can, but this was original name. To do this, we also need to change operator. So unless you absolutely want this, I would prefer to leave it

Where? I see you changed it in one of the lcore func in operator, but this service accepts only headers in the current head.

in the operator internal/controller/appserver/assets.go, line 783

I'm not sure if that is the right reference: https://github.com/openshift/lightspeed-operator/blob/main/internal/controller/appserver/assets.go#L783C7-L783C122
Currently it produces this config:

mcp_servers: - name: "openshift" transport: "streamable_http" streamable_http: url: "http://localhost:8080/mcp" timeout: 60 sse_read_timeout: 30 headers: Authorization: "kubernetes"

The authorization_headers is used for lcore config.

onmete · 2026-01-22T09:46:26Z

ols/app/models/config.py

+    """

+    name: str = Field(
+        ...,


The Field should work without the Ellipsis, eg. just

name: str = Field( title="MCP name", description="MCP server name that must be unique", )

It is required field. Thats Pydantic convention to use Elipsees

It is required for pydantic < 2

onmete · 2026-01-22T09:47:28Z

ols/app/models/config.py

+        """Resolved authorization headers (computed from authorization_headers)."""
+        return self._resolved_authorization_headers
+
+    timeout: Optional[int] = Field(


Please move up to the rest of the class attributes - before the private attr and property

onmete · 2026-01-22T09:49:44Z

ols/app/models/config.py

-    sse: Optional[SseTransportConfig] = None
-    streamable_http: Optional[StreamableHttpTransportConfig] = None
+    embed_model: str = Field(
+        default="sentence-transformers/all-mpnet-base-v2",


Have you tested other (smaller) models? Or we just use the same thing we already have available?

onmete · 2026-01-22T09:50:00Z

ols/app/models/config.py

-    sse_read_timeout: int = constants.STREAMABLE_HTTP_TRANSPORT_DEFAULT_READ_TIMEOUT
-    headers: dict[str, str] = Field(default_factory=dict)

+class ToolFilteringConfig(BaseModel):


This doesn't need to be in this PR, right?

I am synching operator with service. Its question of 4 PRs vs 2

onmete · 2026-01-22T09:51:14Z

ols/app/models/config.py


    proxy_config: Optional[ProxyConfig] = None

+    tool_filtering: Optional[ToolFilteringConfig] = None


Is it a feature of mcp servers or ols? Answer implies position in the config.

ols - tools filtering is an OLS property

Right, the lines were truncated in a way that it seems like it is under MCPConfig, my bad.

onmete · 2026-01-22T09:58:04Z

ols/utils/checks.py

+    resolved: dict[str, str] = {}
+
+    for header_name, header_value in authorization_headers.items():
+        match header_value.strip():


Should it also be case-insensitive for special values "kubernetes" and "client"?

Its using constants now

Would both of these work the same?

mcp_servers: - name: openshift url: "http://localhost:8989/mcp" headers: bla: "kubernetes"

and

mcp_servers: - name: openshift url: "http://localhost:8989/mcp" headers: bla: "KUBERNETES"

asamal4 · 2026-01-23T07:27:40Z

ols/app/models/config.py

-                    "config should not be provided"
-                )
-        return self
+    embed_model: str = Field(


Probably this should be a comment for operator changes.
is this going to be user facing ? We will probably end up using same embedding model what we package as part of RAG, considering on-prem scenario.

As far service is concerned, It is not aligned with the RAG embedding model property. This is in-consistent

This is a completely separate RAG. So technically here we can use a completely different model. In general I do not foresee users ever changing it, but just in case it is there. And of course it is aligned with the operator

I am specifically talking about on-prem scenario where we can not download the model from huggingface. Model has to be picked from file-system/volume. For RAG use-case we are handling this. So similar processing we need to do for tool rag also. In this case we will provide a path to the embedding model..

Regarding parameter name inconsistency in Service/API: Agree that this embedding model is for different purpose (and can be a different model), but IMO we should keep same parameter name in both places. For RAG the name is embeddings_model_path and here we are using embed_model. But this is not very critical. It's up to you.

blublinsky · 2026-01-23T21:59:15Z

/retest

…ined MCP Auth resolution

openshift-ci · 2026-01-24T09:38:10Z

@blublinsky: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-ols-cluster	`df28668`	link	true	`/test e2e-ols-cluster`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 20, 2026

openshift-ci bot requested review from raptorsun and tisnik January 20, 2026 17:10

blublinsky force-pushed the mcp-simplification branch from c00804a to d92f62a Compare January 20, 2026 17:23

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 20, 2026

blublinsky force-pushed the mcp-simplification branch 3 times, most recently from 19fcc14 to 65d866f Compare January 21, 2026 14:59

blublinsky changed the title ~~removed additional mcp transport, added MCP headers to query, streaml…~~ removed additional mcp transport, streamlined MCP Auth resolution Jan 21, 2026

blublinsky force-pushed the mcp-simplification branch from 65d866f to 525d1be Compare January 21, 2026 15:25

onmete reviewed Jan 22, 2026

View reviewed changes

blublinsky force-pushed the mcp-simplification branch 2 times, most recently from 0209b07 to 6ec8fa5 Compare January 22, 2026 13:19

xrajesh requested a review from asamal4 January 22, 2026 15:53

asamal4 reviewed Jan 23, 2026

View reviewed changes

blublinsky force-pushed the mcp-simplification branch 2 times, most recently from d670d7d to 012bebe Compare January 23, 2026 15:29

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 23, 2026

blublinsky added 2 commits January 23, 2026 22:04

removed additional mcp transport, added MCP headers to query, streaml…

aa272f5

…ined MCP Auth resolution

addressed review comments

df28668

blublinsky force-pushed the mcp-simplification branch from cec1910 to df28668 Compare January 23, 2026 22:06

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 23, 2026


		proxy_config: Optional[ProxyConfig] = None

		tool_filtering: Optional[ToolFilteringConfig] = None

removed additional mcp transport, streamlined MCP Auth resolution #2705

Are you sure you want to change the base?

removed additional mcp transport, streamlined MCP Auth resolution #2705

Conversation

blublinsky commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of change

Related Tickets & Documents

Checklist before requesting a review

Testing

Uh oh!

openshift-ci bot commented Jan 20, 2026

Uh oh!

blublinsky commented Jan 22, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

asamal4 Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

asamal4 Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

asamal4 Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

blublinsky commented Jan 23, 2026

Uh oh!

openshift-ci bot commented Jan 24, 2026

Uh oh!

blublinsky commented Jan 20, 2026 •

edited

Loading

asamal4 Jan 23, 2026 •

edited

Loading

asamal4 Jan 23, 2026 •

edited

Loading

asamal4 Jan 23, 2026 •

edited

Loading