MCP Registry — TLS and Credential Hardening (issue 13 of 29)

Labels: ready-to-code
Depends on: Issue 1 (#4039 shared infra), Issue 7 (#4045 mirror endpoint)
RHIDP Stories: RHIDP-15318
Feature: RHDHPLAN-1510 — Epic RHIDP-15313
Cross-feature dependency: RHIDP-15318 depends on RHIDP-15655 (Implement MCP Registry entity provider, RHDHPLAN-393). The upstream community provider must exist as the integration target for TLS/credential wrapping.

Integrate shared CA bundle utility (loadCaBundle()) from @red-hat-developer-hub/backstage-plugin-boost-connector-utils, implement K8s Secret-based authentication (Basic Auth and Bearer token), Secret data caching with 5-minute TTL and invalidation on 401, and per-connector TLS configuration isolation.

Tasks

From openspec/changes/mcp-registry-connector/tasks.md group 2 (RHIDP-15318):

• 2.1 Integrate shared CA bundle utility from RHIDP-15316
• 2.2 Add ai-catalog.providers.mcpRegistry.tls.ca config schema
• 2.3 Implement custom CA bundle loading from file path
• 2.4 Add graceful degradation: invalid CA bundle falls back to system CA
• 2.5 Add warning logging for invalid CA bundle files
• 2.6 Implement HTTPS agent configuration with custom CA bundle
• 2.7 Enforce TLS certificate validation (rejectUnauthorized: true)
• 2.8 Add ai-catalog.providers.mcpRegistry.auth.secretRef config schema
• 2.9 Implement K8s Secret reading
• 2.10 Implement credential extraction from Secret
• 2.11 Implement HTTP Basic Auth for username/password
• 2.12 Implement Bearer token authentication
• 2.13 Implement Secret data caching with 5-minute TTL
• 2.14 Implement cache invalidation on HTTP 401
• 2.15 Add error handling: missing Secret, missing credential keys, invalid Secret data
• 2.16 Add per-connector TLS configuration isolation
• 2.17–2.18 Prometheus metrics for TLS and auth
• 2.19–2.26 Integration tests for CA bundle, K8s Secret, cache invalidation, per-connector isolation
• 2.27–2.29 Documentation: CA bundle config, K8s Secret auth, Secret rotation

Specifications

• openspec/changes/mcp-registry-connector/specs/auth-tls-hardening/spec.md

Start with openspec/changes/mcp-registry-connector/tasks.md group 2 and specs/auth-tls-hardening/spec.md. Confirm the shared CA utility, mirror endpoint, and upstream MCP Registry entity provider dependencies before working through the TLS, Secret authentication, caching, metrics, integration tests, and documentation tasks. Done means all listed behavior is covered, including 401 invalidation and per-connector isolation.