OSDOCS-19753: adds Vault integration MCP gateway by ShaunaDiaz · Pull Request #111554 · openshift/openshift-docs

ShaunaDiaz · 2026-05-12T16:14:40Z

Version(s):
rhcl-docs-1.3
rhcl-docs-1.4

Issue:
OSDOCS-19753

Link to docs preview:
https://111554--ocpdocs-pr.netlify.app/rhcl/latest/mcp_gateway_config/mcp-gateway-vault.html

QE review:

QE has approved this change.

openshift-ci-robot · 2026-05-12T16:14:45Z

@ShaunaDiaz: This pull request references OSDOCS-19753 which is a valid jira issue.

Details

In response to this:

Version(s):
rhcl-docs-1.3
rhcl-docs-1.4

Issue:
OSDOCS-19753

Link to docs preview:

QE review:

QE has approved this change.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ocpdocs-previewbot · 2026-05-12T16:21:03Z

🤖 Wed May 13 11:33:05 - Prow CI generated the docs preview:

https://111554--ocpdocs-pr.netlify.app/rhcl/latest/mcp_gateway_config/mcp-gateway-vault.html

openshift-ci-robot · 2026-05-12T16:52:26Z

@ShaunaDiaz: This pull request references OSDOCS-19753 which is a valid jira issue.

Details

In response to this:

Version(s):
rhcl-docs-1.3
rhcl-docs-1.4

Issue:
OSDOCS-19753

Link to docs preview:
https://111554--ocpdocs-pr.netlify.app/rhcl/latest/mcp_gateway_config/mcp-gateway-vault.html

QE review:

QE has approved this change.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-05-13T11:54:44Z

@ShaunaDiaz: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

guicassolato · 2026-05-13T14:32:04Z

+  --data '{
+    "policy": "path \_<"secret/data/mcp-gateway/*\">_ {\n  capabilities = [\"read\", \"list\"]\n}"
+  }' \
+  _<http://vault.vault-namespace.svc.cluster.local:8200>_/v1/sys/policies/acl/authorino


This is curling from outside the cluster, so http://vault.vault-namespace.svc.cluster.local can be a misleading example. Maybe use a more obvious placeholder such as <your-vault-service-hostname>?

guicassolato · 2026-05-13T14:32:22Z

+    "user_claim": "sub",
+    "policies": ["authorino"],
+    "ttl": "1h"
+  }'


Missing the URL.

guicassolato · 2026-05-13T14:38:18Z

+      "vault":
+        http:
+          urlExpression: |
+            _<"https://vault.vault.svc.cluster.local:8200/v1/secret/data/mcp-gateway/" + auth.identity.sub>_


Suggested change

_<"https://vault.vault.svc.cluster.local:8200/v1/secret/data/mcp-gateway/" + auth.identity.sub>_

"https://vault.vault.svc.cluster.local:8200/v1/secret/data/mcp-gateway/" + auth.identity.sub

Using vault.vault.svc.cluster.local is probably here, since Authorino calls Vault within the cluster. Users only need to be called attention to:

whether a vault service indeed exists in the vault namespace

whether the service listens on port 8200

whether it's indeed https and not http.

Also, let's be careful with how we communicate a placeholder within a CEL expression. In this example, we want to convey that the Vault base URL may be different, but auth.identity.sub is a variable defined in the AuthPolicy that Authorino will always resolve and append to the URL.

guicassolato · 2026-05-13T14:38:56Z

+        - predicate: auth.metadata.exists(p, p == "vault-login") && has(auth.metadata["vault-login"].auth ) && has(auth.metadata["vault-login"].auth.client_token)
+        https:
+          urlExpression: |
+            _<"http://vault.vault.svc.cluster.local:8200/v1/secret/data/mcp-gateway/"_+_auth.identity.sub>_


Same as https://github.com/openshift/openshift-docs/pull/111554/changes#r3235128372

guicassolato · 2026-05-13T14:40:48Z

+|The issuer URL of your OpenId Connect SSO provider. You can also use `.jwksUrl` instead of `.issuerUrl:` for authentication servers that do not implement OIDC. This is the primary authentication step that validates who the user is.
+
+|`spec.metadata."oauth-token".https.url`
+|the token endpoint of your OAuth provider. Typically, this URL ends with `/token`. This parameter specifies the call to the provider.


Suggested change

|the token endpoint of your OAuth provider. Typically, this URL ends with `/token`. This parameter specifies the call to the provider.

|The token endpoint of the OAuth provider used to authenticate to Vault. Typically, this URL ends with `/token`.

guicassolato · 2026-05-13T14:43:41Z

+|the token endpoint of your OAuth provider. Typically, this URL ends with `/token`. This parameter specifies the call to the provider.
+
+|`spec.rules.metadata.cache.ttl`
+|Your required time in seconds. The example value is 30 minutes.


Suggested change

|Your required time in seconds. The example value is 30 minutes.

|Time in seconds that Authorino will cache and reuse the metadata once returned by the external service (OAuth token or Vault client token). The example value is 30 minutes.

guicassolato · 2026-05-13T14:44:43Z

+|Your required time in seconds. The example value is 30 minutes.
+
+|`spec.metadata."vault-login".https.url`
+|Your the JWT login endpoint. This value typically ends in `/v1/auth/jwt/login`. This step performs the JWT authentication against Vault.


nit:

Suggested change

|Your the JWT login endpoint. This value typically ends in `/v1/auth/jwt/login`. This step performs the JWT authentication against Vault.

|The Vault JWT login endpoint. This value typically ends in `/v1/auth/jwt/login`. This step performs the JWT authentication against Vault.

guicassolato · 2026-05-13T14:46:20Z

+|These parameter values specify the secret retrieval from Vault.
+
+|`spec.rules.metadata."vault".https.urlExpression`
+|Your Vault server URL and secret path. Adapt the `auth-identity` according to how your claims uniquely identify an MCP gateway user. The Vault path in the expression must match the KV Secrets Engine version.


Suggested change

|Your Vault server URL and secret path. Adapt the `auth-identity` according to how your claims uniquely identify an MCP gateway user. The Vault path in the expression must match the KV Secrets Engine version.

|Your Vault server URL and secret path. Replaced the `auth.identity.sub` variable according to how your claims uniquely identify an MCP gateway user if needed. The Vault path in the expression must match the KV Secrets Engine version.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label May 12, 2026

ShaunaDiaz added rhcl-docs-1.3 Red Hat Connectivity Link docs, version 1.3 rhcl-docs-1.4 Red Hat Connectivity Link docs, version 1.4 and removed jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. labels May 12, 2026

ShaunaDiaz added this to the Continuous Release milestone May 12, 2026

ShaunaDiaz changed the title ~~OSDOCS-19753: adds Vault integration MCP gateway~~ [WIP]OSDOCS-19753: adds Vault integration MCP gateway May 12, 2026

openshift-ci Bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels May 12, 2026

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label May 12, 2026

ShaunaDiaz force-pushed the OSDOCS-19753 branch 2 times, most recently from ff20aa9 to b956dfc Compare May 12, 2026 18:21

ShaunaDiaz removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 12, 2026

ShaunaDiaz changed the title ~~[WIP]OSDOCS-19753: adds Vault integration MCP gateway~~ OSDOCS-19753: adds Vault integration MCP gateway May 12, 2026

ShaunaDiaz force-pushed the OSDOCS-19753 branch from b956dfc to e99972e Compare May 12, 2026 18:34

OSDOCS-19753: adds Vault integration MCP gateway

310b8f3

ShaunaDiaz force-pushed the OSDOCS-19753 branch from e99972e to 310b8f3 Compare May 13, 2026 11:11

guicassolato reviewed May 13, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OSDOCS-19753: adds Vault integration MCP gateway#111554

OSDOCS-19753: adds Vault integration MCP gateway#111554
ShaunaDiaz wants to merge 1 commit into
openshift:rhcl-docs-mainfrom
ShaunaDiaz:OSDOCS-19753

ShaunaDiaz commented May 12, 2026 •

edited

Loading

Uh oh!

openshift-ci-robot commented May 12, 2026 •

edited by openshift-ci Bot

Loading

Uh oh!

ocpdocs-previewbot commented May 12, 2026 •

edited

Loading

Uh oh!

openshift-ci-robot commented May 12, 2026 •

edited by openshift-ci Bot

Loading

Uh oh!

openshift-ci Bot commented May 13, 2026

Uh oh!

guicassolato May 13, 2026

Uh oh!

guicassolato May 13, 2026

Uh oh!

guicassolato May 13, 2026

Uh oh!

guicassolato May 13, 2026

Uh oh!

guicassolato May 13, 2026

Uh oh!

guicassolato May 13, 2026

Uh oh!

guicassolato May 13, 2026

Uh oh!

guicassolato May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	_<"https://vault.vault.svc.cluster.local:8200/v1/secret/data/mcp-gateway/" + auth.identity.sub>_
	"https://vault.vault.svc.cluster.local:8200/v1/secret/data/mcp-gateway/" + auth.identity.sub

	\|the token endpoint of your OAuth provider. Typically, this URL ends with `/token`. This parameter specifies the call to the provider.
	\|The token endpoint of the OAuth provider used to authenticate to Vault. Typically, this URL ends with `/token`.

	\|Your required time in seconds. The example value is 30 minutes.
	\|Time in seconds that Authorino will cache and reuse the metadata once returned by the external service (OAuth token or Vault client token). The example value is 30 minutes.

	\|Your the JWT login endpoint. This value typically ends in `/v1/auth/jwt/login`. This step performs the JWT authentication against Vault.
	\|The Vault JWT login endpoint. This value typically ends in `/v1/auth/jwt/login`. This step performs the JWT authentication against Vault.

	\|Your Vault server URL and secret path. Adapt the `auth-identity` according to how your claims uniquely identify an MCP gateway user. The Vault path in the expression must match the KV Secrets Engine version.
	\|Your Vault server URL and secret path. Replaced the `auth.identity.sub` variable according to how your claims uniquely identify an MCP gateway user if needed. The Vault path in the expression must match the KV Secrets Engine version.

Conversation

ShaunaDiaz commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented May 12, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ocpdocs-previewbot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented May 12, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci Bot commented May 13, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ShaunaDiaz commented May 12, 2026 •

edited

Loading

openshift-ci-robot commented May 12, 2026 •

edited by openshift-ci Bot

Loading

ocpdocs-previewbot commented May 12, 2026 •

edited

Loading

openshift-ci-robot commented May 12, 2026 •

edited by openshift-ci Bot

Loading