Summary

In dynamic mode (outgoingAuth.source: discovered), remove backend discovery from the operator. The operator should read status from the vMCP-reported status instead of discovering backends itself.

Background

Part of the vMCP K8s-aware refactor (THV-2884). Currently, backend discovery happens twice:

1. Operator's discoverBackends() for CRD status
2. vMCP's runtime discovery for routing

In dynamic mode, the vMCP server owns backend discovery and reports status via StatusReporter. The operator should simply observe this status.

Current Flow (Dynamic Mode - Before)

Operator reconcile:
  1. Validate GroupRef
  2. Ensure RBAC, ConfigMap, Deployment, Service
  3. discoverBackends() → status.DiscoveredBackends  ← REMOVE THIS
  4. Update CRD status

Target Flow (Dynamic Mode - After)

Operator reconcile:
  1. Validate GroupRef
  2. Ensure RBAC, ConfigMap, Deployment, Service
  3. Observe vMCP-reported status from CRD  ← vMCP writes this
  4. Set infrastructure-only conditions

Code to Remove (Dynamic Mode Path)

• discoverBackends() function call in virtualmcpserver_controller.go
• buildOutgoingAuthConfig() function call
• Complex OutgoingAuth.Backends resolution in vmcpconfig/converter.go

Static Mode Unchanged

In static mode (outgoingAuth.source: inline), the operator continues:

• Discovering backends from MCPGroup
• Building OutgoingAuthConfig from inline spec
• Populating status.DiscoveredBackends

Files to Modify

• cmd/thv-operator/controllers/virtualmcpserver_controller.go
  • Skip discoverBackends() in dynamic mode
  • Read status from vMCP-reported status instead
  • Keep static mode behavior unchanged

Dependencies

• Depends on: Mode-aware ConfigMap and RBAC (Mode-aware ConfigMap and RBAC generation in operator #3003)
• Depends on: StatusReporter (Add StatusReporter abstraction for vMCP runtime status reporting #2854) must be working

Acceptance Criteria

• discoverBackends() skipped in dynamic mode
• Status reads from vMCP-reported status instead
• Static mode continues using operator discovery
• Clean separation between dynamic and static code paths

Notes

• This completes the responsibility shift from operator to vMCP runtime
• Operator becomes "dumb" - only manages K8s resources
• vMCP becomes "smart" - owns all runtime discovery logic