What needs documentation?
How to configure webhook-based tool-call authorization (MCPWebhookConfig + MCPServer.spec.webhookConfigRef) in Kubernetes. guides-k8s/authorization-k8s.mdx only documents Cedar authorization (ConfigMap/inline/shared MCPAuthzConfig); it never mentions webhooks. reference/crds/mcpwebhookconfig.mdx is just the auto-generated schema table, not a usage guide. There's no walkthrough covering creating an MCPWebhookConfig, referencing it from an MCPServer, testing validating/mutating behavior, or troubleshooting via the WebhookConfigValidated status condition.
Context and references
guides-cli/webhooks.mdx already asserts K8s parity: "configure webhook middleware declaratively with the MCPWebhookConfig custom resource... reference it from an MCPServer via spec.webhookConfigRef. The runtime semantics... are identical" — but the linked K8s-side docs don't back that up. guides-k8s/run-mcp-k8s.mdx documents the WebhookConfigValidated condition, confirming the feature is implemented and reconciled, just undocumented.
Note: webhook authorization is not implemented for VirtualMCPServer or MCPRemoteProxy (only MCPServer has webhookConfigRef wired up in the operator), so no vMCP doc coverage is expected here.
Use case
As a K8s operator user, I want to delegate tool-call authorization to an external webhook service (same capability the CLI offers via --webhook-config), and I need a guide showing how to do it declaratively with CRDs.
Additional context
Affected/related pages: guides-k8s/authorization-k8s.mdx (candidate for new webhook coverage or a sibling page), guides-cli/webhooks.mdx, reference/crds/mcpwebhookconfig.mdx.
What needs documentation?
How to configure webhook-based tool-call authorization (
MCPWebhookConfig+MCPServer.spec.webhookConfigRef) in Kubernetes.guides-k8s/authorization-k8s.mdxonly documents Cedar authorization (ConfigMap/inline/sharedMCPAuthzConfig); it never mentions webhooks.reference/crds/mcpwebhookconfig.mdxis just the auto-generated schema table, not a usage guide. There's no walkthrough covering creating anMCPWebhookConfig, referencing it from anMCPServer, testing validating/mutating behavior, or troubleshooting via theWebhookConfigValidatedstatus condition.Context and references
guides-cli/webhooks.mdxalready asserts K8s parity: "configure webhook middleware declaratively with theMCPWebhookConfigcustom resource... reference it from anMCPServerviaspec.webhookConfigRef. The runtime semantics... are identical" — but the linked K8s-side docs don't back that up.guides-k8s/run-mcp-k8s.mdxdocuments theWebhookConfigValidatedcondition, confirming the feature is implemented and reconciled, just undocumented.Note: webhook authorization is not implemented for
VirtualMCPServerorMCPRemoteProxy(onlyMCPServerhaswebhookConfigRefwired up in the operator), so no vMCP doc coverage is expected here.Use case
As a K8s operator user, I want to delegate tool-call authorization to an external webhook service (same capability the CLI offers via
--webhook-config), and I need a guide showing how to do it declaratively with CRDs.Additional context
Affected/related pages:
guides-k8s/authorization-k8s.mdx(candidate for new webhook coverage or a sibling page),guides-cli/webhooks.mdx,reference/crds/mcpwebhookconfig.mdx.