feat: add auth spec

api/v1alpha1/common_types.go

@@ -129,3 +129,46 @@ type RuntimeSpec struct {
 	// +optional
 	Port int32 `json:"port,omitempty"`
 }
+
+// HTTPHeaderSpec defines an HTTP header whose value is sourced from a Secret.
+// Used wherever arbitrary headers must be sent with outbound requests without
+// inlining credential values into the CR.
+type HTTPHeaderSpec struct {
+	// name is the HTTP header name (e.g. X-Api-Key, Authorization).
+	// +kubebuilder:validation:Required
+	Name string `json:"name"`
+
+	// valueFrom is the source for the header value — typically a secretKeyRef.
+	// +kubebuilder:validation:Required
+	ValueFrom corev1.EnvVarSource `json:"valueFrom"`
+}
+
+// AuthSpec describes authentication for a remote MCP server.
+// At most one primary mechanism (bearerTokenSecretRef or apiKeySecretRef) should be set.
+// headers may be combined with any primary mechanism.
+type AuthSpec struct {
+	// bearerTokenSecretRef references a Secret key holding a bearer token.
+	// Injected as Authorization: Bearer <token> on every request.
+	// +optional
+	BearerToken *corev1.SecretKeySelector `json:"bearerToken,omitempty"`
+
+	// apiKeySecretRef references a Secret key holding an API key and the header name to carry it in.
+	// +optional
+	APIKey *AuthAPIKey `json:"apiKey,omitempty"`
+
+	// headers are arbitrary HTTP headers sourced from Secrets.
+	// Use for providers requiring multiple credentials or non-standard auth schemes.
+	// +optional
+	Headers []HTTPHeaderSpec `json:"headers,omitempty"`
+}
+
+// AuthAPIKey references a Secret key holding an API key.
+type AuthAPIKey struct {
+	// secretRef references the Secret key holding the API key value.
+	// +kubebuilder:validation:Required
+	SecretRef corev1.SecretKeySelector `json:"secretRef"`
+
+	// headerName is the HTTP header used to carry the key.
+	// +optional
+	HeaderName string `json:"headerName,omitempty"`
+}