MCPRemoteProxy missing CA bundle volume mount and validation

[lorr1]

Bug description

The MCPRemoteProxy controller is missing two pieces of CA bundle handling that the MCPServer controller implements:

1. Missing volume mount: buildVolumesForProxy() in mcpremoteproxy_deployment.go never calls ctrlutil.AddOIDCCABundleVolumes(), so the CA bundle ConfigMap is never mounted into the pod. The OIDC resolver computes a path (e.g. /config/certs/my-ca-bundle/ca.crt) and stores it in the RunConfig, but the file doesn't exist at runtime because the ConfigMap was never mounted as a volume.

2. Missing validation: The MCPRemoteProxy reconciler does not call validateCABundleRef() during reconciliation, so there is no status condition warning the user when the referenced ConfigMap is missing or invalid.

Impact

If a user configures an MCPRemoteProxy with a caBundleRef in their OIDC config, TLS verification against the OIDC provider will fail silently at runtime because the CA certificate file is not present in the container.

Expected behavior

The MCPRemoteProxy controller should:

• Mount the CA bundle ConfigMap as a volume (matching MCPServer behavior in mcpserver_controller.go:1092-1097)
• Validate the CA bundle ConfigMap reference and set a CABundleRefValidated status condition (matching MCPServer behavior in mcpserver_controller.go:564-616)

Relevant code

• cmd/thv-operator/controllers/mcpremoteproxy_deployment.go — buildVolumesForProxy()
• cmd/thv-operator/controllers/mcpremoteproxy_controller.go — validateAndHandleConfigs()
• cmd/thv-operator/controllers/mcpserver_controller.go — reference implementation with AddOIDCCABundleVolumes() and validateCABundleRef()

[majiayu000]

Hi, I've been looking into this and traced the root cause.

Proposed approach: 1. In mcpremoteproxy_deployment.go: Add ctrlutil.AddOIDCCABundleVolumes() call inside buildVolumesForProxy(), mirroring MCPServer pattern. 2. In mcpremoteproxy_controller.go: Add validateCABundleRef() call in validateAndHandleConfigs(), setting CABundleRefValidated status condition on failure. 3. Add unit tests for both paths (volume mount present when caBundleRef configured, validation condition set when ConfigMap missing). 4. Reference mcpserver_controller.go lines 564-616 and 1092-1097 as the exact pattern to replicate.

I'll open a draft PR shortly. Happy to adjust based on your preference.