Add Entra ID version of the Infra vMCP addon#152
Merged
Conversation
Signed-off-by: Dan Barr <6922515+danbarr@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds a new vmcp-infra-entra addon that mirrors the existing authenticated infra vMCP gateway pattern, but uses ToolHive’s embedded OAuth authorization server delegating upstream authentication to Microsoft Entra ID and exposes the gateway externally via a Cloudflare tunnel.
Changes:
- Adds a new Entra ID–backed
VirtualMCPServer+MCPOIDCConfigwith tiered Cedar authorization driven by Entra app-role claims. - Adds deploy/teardown automation to create required Kubernetes secrets and deploy a Cloudflare tunnel.
- Adds end-user documentation and an
.env.exampledescribing required Entra ID + Cloudflare configuration.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| addons/vmcp-infra-entra/vmcp.yaml | Defines the embedded auth server, incoming OIDC validation, Cedar policies, and aggregated tool configuration for the Entra-authenticated vMCP. |
| addons/vmcp-infra-entra/deploy.sh | Automates namespace creation, secret creation, applying the vMCP config, and deploying the Cloudflare tunnel. |
| addons/vmcp-infra-entra/teardown.sh | Removes tunnel deployment, vMCP resources, secrets, and the addon namespace. |
| addons/vmcp-infra-entra/cloudflared.yaml | Kubernetes Deployment that runs cloudflared to expose the vMCP service externally. |
| addons/vmcp-infra-entra/README.md | Documents purpose, tier model, Entra app registration setup, Cloudflare tunnel setup, and verification steps. |
| addons/vmcp-infra-entra/.env.example | Provides environment variable template for Entra issuer/client credentials and Cloudflare tunnel configuration. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Signed-off-by: Dan Barr <6922515+danbarr@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an Entra ID variant of the vmcp-infra-okta addon.
Signed-off-by: Dan Barr 6922515+danbarr@users.noreply.github.com