OCPMCP-9: add acm cluster provider #58

Cali0707 · 2025-10-15T14:11:46Z

This PR adds a cluster provider that uses ACM and the cluster proxy addon to communicate with all the clusters managed by the hub cluster. This allows users to configure the connection in two ways:

acm-kubeconfig - this uses a specified context from the users kubeconfig to connect to a remote hub cluster, and uses the route to the cluster proxy addon to connect to any managed clusters
acm - this assumes that the mcp server is deployed within the hub cluster, and uses the cluster proxy addon service (instead of route) to talk to managed clusters

An example configuration for the acm-kubeconfig strategy which verifies TLS is as follows:

# ACM config rules
cluster_provider_strategy = "acm-kubeconfig"
[cluster_provider_configs.acm-kubeconfig]
context_name = "acm"
cluster_proxy_addon_host = "<cluster proxy route>"
cluster_proxy_addon_ca_file = "openshift-ca.crt"

An example configuration for the acm strategy which does not verify TLS is as follows:

cluster_provider_strategy = "acm"
[cluster_provider_configs.acm-kubeconfig]
cluster_proxy_addon_host = "<cluster proxy route>"
cluster_proxy_addon_skip_tls_verify = true

Signed-off-by: Calum Murray <[email protected]>

Cali0707 · 2025-10-15T19:08:24Z

/hold

Let's wait to get containers#377 merged upstream first, and then I will rebase this PR on top of those changes

Signed-off-by: Calum Murray <[email protected]>

Cali0707 · 2025-10-27T13:27:50Z

/unhold

Signed-off-by: Calum Murray <[email protected]>

matzew · 2025-10-27T16:22:54Z

Thanks for the rebase and updating the PR.

I will take a look here tomorrow!

matzew · 2025-10-27T16:23:00Z

/assign @matzew

matzew · 2025-10-28T09:05:07Z

pkg/kubernetes/provider_acm_hub.go

+	err := c.ACMProviderConfig.Validate()
+
+	if c.ContextName == "" {
+		err = errors.Join(err, fmt.Errorf("context_name is required is acm-kubeconfig strategy is used"))


if acm-kubeconfig strategy is used

matzew · 2025-10-28T09:05:21Z

LGTM

✅ Tested the acm-kubeconfig with a local running binary.

matzew

/lgtm
/approve

matzew

/lgtm
/approve

openshift-ci · 2025-10-28T14:14:09Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Cali0707, matzew

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Cali0707,matzew]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

matzew · 2025-10-28T14:54:02Z

Fixes: https://issues.redhat.com/browse/OCPMCP-9

matzew · 2025-10-29T15:55:26Z

@ardaguclu I guess the invalid JIRA reference, is that there is no colon (:) after the OCPMCP-9 ?
Are you able to edit the PR title?

ardaguclu · 2025-10-30T06:35:19Z

/retitle OCPMCP-9: add acm cluster provide

openshift-ci-robot · 2025-10-30T06:35:25Z

@Cali0707: This pull request references OCPMCP-9 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set.

In response to this:

This PR adds a cluster provider that uses ACM and the cluster proxy addon to communicate with all the clusters managed by the hub cluster. This allows users to configure the connection in two ways:

acm-kubeconfig - this uses a specified context from the users kubeconfig to connect to a remote hub cluster, and uses the route to the cluster proxy addon to connect to any managed clusters

acm - this assumes that the mcp server is deployed within the hub cluster, and uses the cluster proxy addon service (instead of route) to talk to managed clusters

An example configuration for the acm-kubeconfig strategy which verifies TLS is as follows:
# ACM config rules
cluster_provider_strategy = "acm-kubeconfig"
[cluster_provider_configs.acm-kubeconfig]
context_name = "acm"
cluster_proxy_addon_host = "<cluster proxy route>"
cluster_proxy_addon_ca_file = "openshift-ca.crt"
An example configuration for the acm strategy which does not verify TLS is as follows:
cluster_provider_strategy = "acm"
[cluster_provider_configs.acm-kubeconfig]
cluster_proxy_addon_host = "<cluster proxy route>"
cluster_proxy_addon_skip_tls_verify = true

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ardaguclu · 2025-10-30T06:35:58Z

@ardaguclu I guess the invalid JIRA reference, is that there is no colon (:) after the OCPMCP-9 ?

@matzew /retitle command should work for such cases.

openshift-ci-robot · 2025-10-30T06:57:04Z

/retest-required

Remaining retests: 0 against base HEAD 3720f23 and 2 for PR HEAD 1bccb73 in total

matzew · 2025-10-30T07:10:34Z

/retest

Signed-off-by: Calum Murray <[email protected]>

Cali0707 · 2025-10-30T13:04:21Z

/cc @matzew can you re-review?

Signed-off-by: Calum Murray <[email protected]>

matzew

/lgtm

Cali0707 · 2025-10-30T13:33:26Z

/hold

Signed-off-by: Calum Murray <[email protected]>

Cali0707 · 2025-10-30T13:41:01Z

/unhold

matzew · 2025-10-30T13:47:07Z

/lgtm

openshift-ci · 2025-10-30T13:48:07Z

@Cali0707: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

matzew · 2025-10-30T13:52:16Z

pkg/kubernetes/provider_acm_hub.go

+	manager, err := p.managerForCluster(target)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to get manager for cluster '%s', unable to verify token", target)
+	}
+	return manager.VerifyToken(ctx, token, audience)


Now verifies tokens against the correct target cluster (should)

Add detailed documentation for the ACM (Advanced Cluster Management) cluster provider feature, including: - Overview and architecture of ACM multi-cluster support - Configuration guide for both acm-kubeconfig and acm strategies - Step-by-step setup instructions with examples - Prerequisites and RBAC requirements - Troubleshooting guide for common issues - Security considerations and best practices - Production deployment examples This documentation complements the ACM cluster provider implementation merged in PR openshift#58. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

feat: add acm cluster provider

9c04e31

Signed-off-by: Calum Murray <[email protected]>

openshift-ci bot requested review from ardaguclu and matzew October 15, 2025 14:12

Cali0707 added 2 commits October 15, 2025 15:00

refactor(config): introduce provider-specific config registry

17c0ab9

Signed-off-by: Calum Murray <[email protected]>

refactor: use provider config registry for acm provider

7366d81

Signed-off-by: Calum Murray <[email protected]>

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 15, 2025

Cali0707 mentioned this pull request Oct 16, 2025

NO-JIRA: Sync downstream to include provider refactors #59

Merged

manusa mentioned this pull request Oct 17, 2025

refactor(kubernetes): Provider implementations deal with Manager instantiations containers/kubernetes-mcp-server#379

Merged

Cali0707 mentioned this pull request Oct 24, 2025

NO-JIRA: Sync downstream #60

Merged

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 26, 2025

Cali0707 added 2 commits October 27, 2025 08:59

fix merge conflicts

85ba743

Signed-off-by: Calum Murray <[email protected]>

fix: acm provider works with new provider/manager design

ef063b6

Signed-off-by: Calum Murray <[email protected]>

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 27, 2025

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 27, 2025

cleanup: move provider constants to provider specific file

1bccb73

Signed-off-by: Calum Murray <[email protected]>

Cali0707 force-pushed the acm-cluster-provider branch from 1b82cd1 to 1bccb73 Compare October 27, 2025 16:08

openshift-ci bot assigned matzew Oct 27, 2025

matzew reviewed Oct 28, 2025

View reviewed changes

matzew approved these changes Oct 28, 2025

View reviewed changes

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 28, 2025

matzew approved these changes Oct 28, 2025

View reviewed changes

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 28, 2025

openshift-ci bot changed the title ~~OCPMCP-9 add acm cluster provider~~ OCPMCP-9: add acm cluster provide Oct 30, 2025

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Oct 30, 2025

Cali0707 added 2 commits October 30, 2025 08:58

Merge remote-tracking branch 'downstream/main' into acm-cluster-provider

a0b63e5

feat: resolve ca file paths

e3658c0

Signed-off-by: Calum Murray <[email protected]>

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Oct 30, 2025

fix: typo

613ca77

Signed-off-by: Calum Murray <[email protected]>

matzew reviewed Oct 30, 2025

View reviewed changes

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 30, 2025

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 30, 2025

Cali0707 changed the title ~~OCPMCP-9: add acm cluster provide~~ OCPMCP-9: add acm cluster provider Oct 30, 2025

fix: use cluster manager for VerifyToken

a7cac28

Signed-off-by: Calum Murray <[email protected]>

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Oct 30, 2025

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 30, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 30, 2025

matzew reviewed Oct 30, 2025

View reviewed changes

openshift-merge-bot bot merged commit 5d43b9e into openshift:main Oct 30, 2025
8 checks passed

macayaven mentioned this pull request Oct 30, 2025

docs: add comprehensive ACM cluster provider documentation #65

Closed

OCPMCP-9: add acm cluster provider #58

OCPMCP-9: add acm cluster provider #58

Uh oh!

Conversation

Cali0707 commented Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Cali0707 commented Oct 15, 2025

Uh oh!

Cali0707 commented Oct 27, 2025

Uh oh!

matzew commented Oct 27, 2025

Uh oh!

matzew commented Oct 27, 2025

Uh oh!

matzew Oct 28, 2025

Choose a reason for hiding this comment

Uh oh!

matzew commented Oct 28, 2025

Uh oh!

matzew left a comment

Choose a reason for hiding this comment

Uh oh!

matzew left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Oct 28, 2025

Uh oh!

matzew commented Oct 28, 2025

Uh oh!

matzew commented Oct 29, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ardaguclu commented Oct 30, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Oct 30, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ardaguclu commented Oct 30, 2025

Uh oh!

openshift-ci-robot commented Oct 30, 2025

Uh oh!

matzew commented Oct 30, 2025

Uh oh!

Cali0707 commented Oct 30, 2025

Uh oh!

matzew left a comment

Choose a reason for hiding this comment

Uh oh!

Cali0707 commented Oct 30, 2025

Uh oh!

Cali0707 commented Oct 30, 2025

Uh oh!

matzew commented Oct 30, 2025

Uh oh!

openshift-ci bot commented Oct 30, 2025

Uh oh!

matzew Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Cali0707 commented Oct 15, 2025 •

edited

Loading

matzew commented Oct 29, 2025 •

edited by openshift-ci bot

Loading

ardaguclu commented Oct 30, 2025 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Oct 30, 2025 •

edited by openshift-ci bot

Loading

matzew Oct 30, 2025 •

edited

Loading