[Gap]: Webhook authorization for the Kubernetes operator

What needs documentation?

How to configure webhook-based tool-call authorization (MCPWebhookConfig + MCPServer.spec.webhookConfigRef) in Kubernetes. guides-k8s/authorization-k8s.mdx only documents Cedar authorization (ConfigMap/inline/shared MCPAuthzConfig); it never mentions webhooks. reference/crds/mcpwebhookconfig.mdx is just the auto-generated schema table, not a usage guide. There's no walkthrough covering creating an MCPWebhookConfig, referencing it from an MCPServer, testing validating/mutating behavior, or troubleshooting via the WebhookConfigValidated status condition.

Context and references

guides-cli/webhooks.mdx already asserts K8s parity: "configure webhook middleware declaratively with the MCPWebhookConfig custom resource... reference it from an MCPServer via spec.webhookConfigRef. The runtime semantics... are identical" — but the linked K8s-side docs don't back that up. guides-k8s/run-mcp-k8s.mdx documents the WebhookConfigValidated condition, confirming the feature is implemented and reconciled, just undocumented.

Note: webhook authorization is not implemented for VirtualMCPServer or MCPRemoteProxy (only MCPServer has webhookConfigRef wired up in the operator), so no vMCP doc coverage is expected here.

Use case

As a K8s operator user, I want to delegate tool-call authorization to an external webhook service (same capability the CLI offers via --webhook-config), and I need a guide showing how to do it declaratively with CRDs.

Additional context

Affected/related pages: guides-k8s/authorization-k8s.mdx (candidate for new webhook coverage or a sibling page), guides-cli/webhooks.mdx, reference/crds/mcpwebhookconfig.mdx.

Start with guides-k8s/authorization-k8s.mdx and guides-k8s/run-mcp-k8s.mdx, then compare the existing guidance in guides-cli/webhooks.mdx and the schema in reference/crds/mcpwebhookconfig.mdx. Add a Kubernetes walkthrough for creating MCPWebhookConfig, referencing it from MCPServer, testing validating and mutating behavior, and troubleshooting the WebhookConfigValidated condition.