Promote MCPRegistry feature (#2136)

dmartinol · web-flow · commit 22428ff50ded · 2025-10-10T12:06:18.000+02:00
* docs for MCP registry CRD

Signed-off-by: Daniele Martinoli &lt;dmartino@redhat.com&gt;

* integrated comments

Signed-off-by: Daniele Martinoli &lt;dmartino@redhat.com&gt;

* rebased

Signed-off-by: Daniele Martinoli &lt;dmartino@redhat.com&gt;

* promoted mcpregistry feature

Signed-off-by: Daniele Martinoli &lt;dmartino@redhat.com&gt;

* bump chart version (operator and crds)

Signed-off-by: Daniele Martinoli &lt;dmartino@redhat.com&gt;

* lint fix

Signed-off-by: Daniele Martinoli &lt;dmartino@redhat.com&gt;

* rebased

* bump chart version (operator and crds)

Signed-off-by: Daniele Martinoli &lt;dmartino@redhat.com&gt;

* lint issues

Signed-off-by: Daniele Martinoli &lt;dmartino@redhat.com&gt;

---------

Signed-off-by: Daniele Martinoli &lt;dmartino@redhat.com&gt;
diff --git a/README.md b/README.md
@@ -66,15 +66,15 @@ ToolHive includes a Kubernetes Operator for enterprise and production deployment
 ### Features
 
 - **MCPServer CRD**: Deploy and manage MCP servers as Kubernetes resources
-- **MCPRegistry CRD** *(Experimental)*: Centralized registry management with automated sync
+- **MCPRegistry CRD** Centralized registry management with automated sync
 - **Secure isolation**: Container-based server execution with permission profiles
 - **Protocol proxying**: Stdio servers exposed via HTTP/SSE networking protocols
 - **Service discovery**: Automatic service creation and DNS integration
 
 ### Documentation
 
 - [Operator Guide](cmd/thv-operator/README.md) - Complete operator documentation
-- [MCPRegistry Reference](cmd/thv-operator/REGISTRY.md) - Registry management (experimental)
+- [MCPRegistry Reference](cmd/thv-operator/REGISTRY.md) - Registry management
 - [CRD API Reference](docs/operator/crd-api.md) - Auto-generated API documentation
 - [Deployment Guide](docs/kind/deploying-toolhive-operator.md) - Step-by-step installation
 - [Examples](examples/operator/) - Sample configurations
diff --git a/cmd/thv-operator/CLAUDE.md b/cmd/thv-operator/CLAUDE.md
@@ -13,9 +13,9 @@ After modifying the CRDs, the following needs to be run:
 
 When committing a change that changes CRDs, it is important to bump the chart version as described in the [CLAUDE.md](../../deploy/charts/operator-crds/CLAUDE.md#bumping-crd-chart) doc for the CRD Helm Chart.
 
-## MCPRegistry CRD (Experimental)
+## MCPRegistry CRD
 
-The MCPRegistry CRD enables centralized management of MCP server registries. Requires `operator.features.experimental=true`.
+The MCPRegistry CRD enables centralized management of MCP server registries.
 
 ### Key Components
 
diff --git a/cmd/thv-operator/README.md b/cmd/thv-operator/README.md
@@ -16,9 +16,7 @@ Represents an MCP server in Kubernetes. When you create an `MCPServer` resource,
 3. Configures the appropriate permissions and settings
 4. Manages the lifecycle of the MCP server
 
-### MCPRegistry (Experimental)
-
-> ⚠️ **Experimental Feature**: MCPRegistry requires `ENABLE_EXPERIMENTAL_FEATURES=true`
+### MCPRegistry
 
 Represents an MCP server registry in Kubernetes. When you create an `MCPRegistry` resource, the operator automatically:
 
@@ -125,9 +123,6 @@ helm upgrade -i toolhive-operator-crds oci://ghcr.io/stacklok/toolhive/toolhive-
 ```bash
 # Standard installation
 helm upgrade -i <release_name> oci://ghcr.io/stacklok/toolhive/toolhive-operator --version=<version> -n toolhive-system --create-namespace
-
-# OR with experimental features (for MCPRegistry support)
-helm upgrade -i <release_name> oci://ghcr.io/stacklok/toolhive/toolhive-operator --version=<version> -n toolhive-system --create-namespace --set operator.features.experimental=true
 ```
 
 ## Usage
@@ -252,9 +247,7 @@ permissionProfile:
 The ConfigMap should contain a JSON permission profile.
 -->
 
-### Creating an MCP Registry (Experimental)
-
-> ⚠️ **Requires**: `operator.features.experimental=true`
+### Creating an MCP Registry
 
 First, create a ConfigMap containing ToolHive registry data. The ConfigMap must be user-defined and is not managed by the operator:
 
diff --git a/cmd/thv-operator/REGISTRY.md b/cmd/thv-operator/REGISTRY.md
@@ -1,7 +1,5 @@
 # MCPRegistry Reference
 
-> ⚠️ **Experimental Feature**: MCPRegistry requires enabling experimental features with `--set operator.features.experimental=true` during Helm installation.
-
 ## Overview
 
 MCPRegistry is a Kubernetes Custom Resource that manages MCP (Model Context Protocol) server registries. It provides centralized server discovery, automated synchronization, content filtering, and image validation for MCP servers in your cluster.
diff --git a/cmd/thv-operator/Taskfile.yml b/cmd/thv-operator/Taskfile.yml
@@ -136,28 +136,20 @@ tasks:
       TOOLHIVE_IMAGE:
         sh: KO_DOCKER_REPO=kind.local ko build --local -B ./cmd/thv-proxyrunner | tail -n 1
       REGISTRY_API_IMAGE:
-        sh: |
-          if [ "{{.ENABLE_EXPERIMENTAL_FEATURES}}" = "true" ]; then
-            KO_DOCKER_REPO=kind.local ko build --local -B ./cmd/thv-registry-api | tail -n 1
-          else
-            echo ""
-          fi
+        sh: KO_DOCKER_REPO=kind.local ko build --local -B ./cmd/thv-registry-api | tail -n 1
     cmds:
       - echo "Loading toolhive operator image {{.OPERATOR_IMAGE}} into kind..."
       - kind load docker-image --name toolhive {{.OPERATOR_IMAGE}}
       - echo "Loading toolhive image {{.TOOLHIVE_IMAGE}} into kind..."
       - kind load docker-image --name toolhive {{.TOOLHIVE_IMAGE}}
-      - |
-        if [ "{{.ENABLE_EXPERIMENTAL_FEATURES}}" = "true" ]; then
-          echo "Loading registry API image {{.REGISTRY_API_IMAGE}} into kind..."
-          kind load docker-image --name toolhive {{.REGISTRY_API_IMAGE}}
-        fi
+      - echo "Loading registry API image {{.REGISTRY_API_IMAGE}} into kind..."
+      - kind load docker-image --name toolhive {{.REGISTRY_API_IMAGE}}
       - |
         helm upgrade --install toolhive-operator deploy/charts/operator \
         --set operator.image={{.OPERATOR_IMAGE}} \
         --set operator.toolhiveRunnerImage={{.TOOLHIVE_IMAGE}} \
         --set operator.features.experimental={{.ENABLE_EXPERIMENTAL_FEATURES}} \
-        {{if eq .ENABLE_EXPERIMENTAL_FEATURES "true"}}--set registryAPI.image={{.REGISTRY_API_IMAGE}}{{end}} \
+        --set registryAPI.image={{.REGISTRY_API_IMAGE}} \
         --namespace toolhive-system \
         --create-namespace \
         --kubeconfig kconfig.yaml \
diff --git a/cmd/thv-operator/api/v1alpha1/mcpregistry_types.go b/cmd/thv-operator/api/v1alpha1/mcpregistry_types.go
@@ -356,7 +356,6 @@ const (
 //+kubebuilder:validation:XValidation:rule="self.spec.source.type == 'configmap' ? has(self.spec.source.configmap) : (self.spec.source.type == 'git' ? has(self.spec.source.git) : true)",message="configMap field is required when source type is 'configmap', git field is required when source type is 'git'"
 
 // MCPRegistry is the Schema for the mcpregistries API
-// ⚠️ Experimental API (v1alpha1) — subject to change.
 type MCPRegistry struct {
 	metav1.TypeMeta   `json:",inline"` // nolint:revive
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/cmd/thv-operator/main.go b/cmd/thv-operator/main.go
@@ -87,13 +87,11 @@ func main() {
 	}
 
 	// Only register MCPRegistry controller if feature flag is enabled
-	if os.Getenv("ENABLE_EXPERIMENTAL_FEATURES") == "true" {
-		rec.ImageValidation = validation.ImageValidationRegistryEnforcing
+	rec.ImageValidation = validation.ImageValidationRegistryEnforcing
 
-		if err = (controllers.NewMCPRegistryReconciler(mgr.GetClient(), mgr.GetScheme())).SetupWithManager(mgr); err != nil {
-			setupLog.Error(err, "unable to create controller", "controller", "MCPRegistry")
-			os.Exit(1)
-		}
+	if err = (controllers.NewMCPRegistryReconciler(mgr.GetClient(), mgr.GetScheme())).SetupWithManager(mgr); err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", "MCPRegistry")
+		os.Exit(1)
 	}
 	//+kubebuilder:scaffold:builder
 
diff --git a/cmd/thv-operator/pkg/validation/image_validation_test.go b/cmd/thv-operator/pkg/validation/image_validation_test.go
@@ -3,7 +3,6 @@ package validation
 import (
 	"context"
 	"fmt"
-	"os"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -95,18 +94,6 @@ func TestNewImageValidator(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
-			// Save original env value
-			originalValue := os.Getenv("TOOLHIVE_EXPERIMENTAL_REGISTRY_ENFORCEMENT")
-			defer func() {
-				os.Setenv("TOOLHIVE_EXPERIMENTAL_REGISTRY_ENFORCEMENT", originalValue)
-			}()
-
-			// Set test env value
-			if tt.setupEnv {
-				os.Setenv("TOOLHIVE_EXPERIMENTAL_REGISTRY_ENFORCEMENT", tt.envValue)
-			} else {
-				os.Unsetenv("TOOLHIVE_EXPERIMENTAL_REGISTRY_ENFORCEMENT")
-			}
 
 			var validationType ImageValidation
 			if tt.envValue == "true" {
diff --git a/cmd/thv-operator/test-integration/mcp-registry/suite_test.go b/cmd/thv-operator/test-integration/mcp-registry/suite_test.go
@@ -13,7 +13,6 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes/scheme"
-	"k8s.io/client-go/rest"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/envtest"
@@ -26,7 +25,6 @@ import (
 )
 
 var (
-	cfg       *rest.Config
 	k8sClient client.Client
 	testEnv   *envtest.Environment
 	testMgr   ctrl.Manager
@@ -44,11 +42,6 @@ var _ = BeforeSuite(func() {
 
 	ctx, cancel = context.WithCancel(context.TODO())
 
-	// Enable experimental features for MCPRegistry controller
-	By("enabling experimental features")
-	err := os.Setenv("ENABLE_EXPERIMENTAL_FEATURES", "true")
-	Expect(err).NotTo(HaveOccurred())
-
 	By("bootstrapping test environment")
 
 	// Check if we should use an existing cluster (for CI/CD)
@@ -73,7 +66,7 @@ var _ = BeforeSuite(func() {
 		BinaryAssetsDirectory: kubebuilderAssets,
 	}
 
-	cfg, err = testEnv.Start()
+	cfg, err := testEnv.Start()
 	Expect(err).NotTo(HaveOccurred())
 	Expect(cfg).NotTo(BeNil())
 
diff --git a/deploy/charts/operator-crds/Chart.yaml b/deploy/charts/operator-crds/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: toolhive-operator-crds
 description: A Helm chart for installing the ToolHive Operator CRDs into Kubernetes.
 type: application
-version: 0.0.33
+version: 0.0.34
 appVersion: "0.0.1"
diff --git a/deploy/charts/operator-crds/README.md b/deploy/charts/operator-crds/README.md
@@ -1,7 +1,7 @@
 
 # ToolHive Operator CRDs Helm Chart
 
-![Version: 0.0.33](https://img.shields.io/badge/Version-0.0.33-informational?style=flat-square)
+![Version: 0.0.34](https://img.shields.io/badge/Version-0.0.34-informational?style=flat-square)
 ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 A Helm chart for installing the ToolHive Operator CRDs into Kubernetes.
diff --git a/deploy/charts/operator-crds/crds/toolhive.stacklok.dev_mcpregistries.yaml b/deploy/charts/operator-crds/crds/toolhive.stacklok.dev_mcpregistries.yaml
@@ -38,9 +38,7 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
-        description: |-
-          MCPRegistry is the Schema for the mcpregistries API
-          ⚠️ Experimental API (v1alpha1) — subject to change.
+        description: MCPRegistry is the Schema for the mcpregistries API
         properties:
           apiVersion:
             description: |-
diff --git a/deploy/charts/operator/Chart.yaml b/deploy/charts/operator/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: toolhive-operator
 description: A Helm chart for deploying the ToolHive Operator into Kubernetes.
 type: application
-version: 0.2.20
+version: 0.2.21
 appVersion: "0.3.7"
diff --git a/deploy/charts/operator/README.md b/deploy/charts/operator/README.md
@@ -1,7 +1,7 @@
 
 # ToolHive Operator Helm Chart
 
-![Version: 0.2.20](https://img.shields.io/badge/Version-0.2.20-informational?style=flat-square)
+![Version: 0.2.21](https://img.shields.io/badge/Version-0.2.21-informational?style=flat-square)
 ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 A Helm chart for deploying the ToolHive Operator into Kubernetes.
@@ -92,9 +92,9 @@ The command removes all the Kubernetes components associated with the chart and
 | operator.toolhiveRunnerImage | string | `"ghcr.io/stacklok/toolhive/proxyrunner:v0.3.7"` | Image to use for Toolhive runners |
 | operator.volumeMounts | list | `[]` | Additional volume mounts on the operator container |
 | operator.volumes | list | `[]` | Additional volumes to mount on the operator pod |
-| registryAPI | object | `{"image":"ghcr.io/stacklok/toolhive/thv-registry-api:latest","serviceAccount":{"annotations":{},"automountServiceAccountToken":true,"labels":{},"name":"toolhive-registry-api"}}` | All values for the registry API deployment and associated resources NOTE: Registry API ServiceAccount and RBAC resources are only created when operator.features.experimental is enabled |
+| registryAPI | object | `{"image":"ghcr.io/stacklok/toolhive/thv-registry-api:latest","serviceAccount":{"annotations":{},"automountServiceAccountToken":true,"labels":{},"name":"toolhive-registry-api"}}` | All values for the registry API deployment and associated resources |
 | registryAPI.image | string | `"ghcr.io/stacklok/toolhive/thv-registry-api:latest"` | Container image for the registry API |
-| registryAPI.serviceAccount | object | `{"annotations":{},"automountServiceAccountToken":true,"labels":{},"name":"toolhive-registry-api"}` | Service account configuration for the registry API This ServiceAccount is only created when operator.features.experimental is true |
+| registryAPI.serviceAccount | object | `{"annotations":{},"automountServiceAccountToken":true,"labels":{},"name":"toolhive-registry-api"}` | Service account configuration for the registry API |
 | registryAPI.serviceAccount.annotations | object | `{}` | Annotations to add to the registry API service account |
 | registryAPI.serviceAccount.automountServiceAccountToken | bool | `true` | Automatically mount a ServiceAccount's API credentials |
 | registryAPI.serviceAccount.labels | object | `{}` | Labels to add to the registry API service account |
diff --git a/deploy/charts/operator/templates/registry-api-clusterrole.yaml b/deploy/charts/operator/templates/registry-api-clusterrole.yaml
@@ -1,4 +1,3 @@
-{{- if .Values.operator.features.experimental }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -16,4 +15,3 @@ rules:
   - get
   - list
   - watch
-{{- end }}
diff --git a/deploy/charts/operator/templates/registry-api-clusterrolebinding.yaml b/deploy/charts/operator/templates/registry-api-clusterrolebinding.yaml
@@ -1,4 +1,3 @@
-{{- if .Values.operator.features.experimental }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -15,4 +14,3 @@ subjects:
 - kind: ServiceAccount
   name: {{ .Values.registryAPI.serviceAccount.name }}
   namespace: {{ .Release.Namespace }}
-{{- end }}
diff --git a/deploy/charts/operator/templates/registry-api-serviceaccount.yaml b/deploy/charts/operator/templates/registry-api-serviceaccount.yaml
@@ -1,4 +1,3 @@
-{{- if .Values.operator.features.experimental }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -16,4 +15,3 @@ metadata:
     {{- toYaml .Values.registryAPI.serviceAccount.annotations | nindent 4 }}
   {{- end }}
 automountServiceAccountToken: {{ .Values.registryAPI.serviceAccount.automountServiceAccountToken }}
-{{- end }}
diff --git a/deploy/charts/operator/values.yaml b/deploy/charts/operator/values.yaml
@@ -180,13 +180,10 @@ operator:
   affinity: {}
 
 # -- All values for the registry API deployment and associated resources
-# NOTE: Registry API ServiceAccount and RBAC resources are only created when
-# operator.features.experimental is enabled
 registryAPI:
   # -- Container image for the registry API
   image: "ghcr.io/stacklok/toolhive/thv-registry-api:latest"
   # -- Service account configuration for the registry API
-  # This ServiceAccount is only created when operator.features.experimental is true
   serviceAccount:
     # -- Automatically mount a ServiceAccount's API credentials
     automountServiceAccountToken: true
diff --git a/docs/operator/crd-api.md b/docs/operator/crd-api.md
