Inject BackendReplicas and Redis session config into MCPServer RunConfig

Populates ScalingConfig in the MCPServer RunConfig ConfigMap from
spec.backendReplicas and spec.sessionStorage. Adds SessionRedisConfig
(address, db, keyPrefix) to runner.ScalingConfig; the Redis password
is intentionally excluded and injected as a pod env var instead.
Both fields use nil-passthrough so unset specs leave the RunConfig
fields absent (HPA/external controllers remain authoritative).

Closes: #4218

Author: taskbot

cmd/thv-operator/controllers/mcpserver_runconfig.go

@@ -242,9 +242,41 @@ func (r *MCPServerReconciler) createRunConfigFromMCPServer(m *mcpv1alpha1.MCPSer
 		return nil, fmt.Errorf("failed to populate middleware configs: %w", err)
 	}
 
+	// Populate scaling config (BackendReplicas and Redis session storage).
+	// Both fields use nil-passthrough: only set when explicitly configured in the spec.
+	populateScalingConfig(runConfig, m)
+
 	return runConfig, nil
 }
 
+// populateScalingConfig sets BackendReplicas and SessionRedis on the RunConfig from the MCPServer spec.
+// Fields are only set when present in the spec; nil means "not configured" and is left as-is.
+func populateScalingConfig(runConfig *runner.RunConfig, m *mcpv1alpha1.MCPServer) {
+	hasBackendReplicas := m.Spec.BackendReplicas != nil
+	hasRedis := m.Spec.SessionStorage != nil && m.Spec.SessionStorage.Provider == "redis"
+
+	if !hasBackendReplicas && !hasRedis {
+		return
+	}
+
+	if runConfig.ScalingConfig == nil {
+		runConfig.ScalingConfig = &runner.ScalingConfig{}
+	}
+
+	if hasBackendReplicas {
+		val := *m.Spec.BackendReplicas
+		runConfig.ScalingConfig.BackendReplicas = &val
+	}
+
+	if hasRedis {
+		runConfig.ScalingConfig.SessionRedis = &runner.SessionRedisConfig{
+			Address:   m.Spec.SessionStorage.Address,
+			DB:        m.Spec.SessionStorage.DB,
+			KeyPrefix: m.Spec.SessionStorage.KeyPrefix,
+		}
+	}
+}
+
 // labelsForRunConfig returns labels for run config ConfigMap
 func labelsForRunConfig(mcpServerName string) map[string]string {
 	return map[string]string{

cmd/thv-operator/controllers/mcpserver_runconfig_test.go

@@ -1703,3 +1703,154 @@ func TestEnsureRunConfigConfigMap_WithVaultInjection(t *testing.T) {
 		})
 	}
 }
+
+// TestPopulateScalingConfig tests BackendReplicas and SessionRedis injection into RunConfig.
+func TestPopulateScalingConfig(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		spec     mcpv1alpha1.MCPServerSpec
+		expected func(t *testing.T, sc *runner.ScalingConfig)
+	}{
+		{
+			name: "nil backendReplicas and nil sessionStorage — ScalingConfig stays nil",
+			spec: mcpv1alpha1.MCPServerSpec{
+				Image:     testImage,
+				Transport: stdioTransport,
+				ProxyPort: 8080,
+			},
+			expected: func(t *testing.T, sc *runner.ScalingConfig) {
+				t.Helper()
+				assert.Nil(t, sc)
+			},
+		},
+		{
+			name: "backendReplicas set — written to ScalingConfig",
+			spec: mcpv1alpha1.MCPServerSpec{
+				Image:           testImage,
+				Transport:       stdioTransport,
+				ProxyPort:       8080,
+				BackendReplicas: int32Ptr(3),
+			},
+			expected: func(t *testing.T, sc *runner.ScalingConfig) {
+				t.Helper()
+				require.NotNil(t, sc)
+				require.NotNil(t, sc.BackendReplicas)
+				assert.Equal(t, int32(3), *sc.BackendReplicas)
+			},
+		},
+		{
+			name: "backendReplicas zero — written (not nil) to ScalingConfig",
+			spec: mcpv1alpha1.MCPServerSpec{
+				Image:           testImage,
+				Transport:       stdioTransport,
+				ProxyPort:       8080,
+				BackendReplicas: int32Ptr(0),
+			},
+			expected: func(t *testing.T, sc *runner.ScalingConfig) {
+				t.Helper()
+				require.NotNil(t, sc)
+				require.NotNil(t, sc.BackendReplicas)
+				assert.Equal(t, int32(0), *sc.BackendReplicas)
+			},
+		},
+		{
+			name: "sessionStorage nil — SessionRedis stays nil",
+			spec: mcpv1alpha1.MCPServerSpec{
+				Image:           testImage,
+				Transport:       stdioTransport,
+				ProxyPort:       8080,
+				BackendReplicas: int32Ptr(2),
+			},
+			expected: func(t *testing.T, sc *runner.ScalingConfig) {
+				t.Helper()
+				require.NotNil(t, sc)
+				assert.Nil(t, sc.SessionRedis)
+			},
+		},
+		{
+			name: "sessionStorage memory — SessionRedis stays nil",
+			spec: mcpv1alpha1.MCPServerSpec{
+				Image:     testImage,
+				Transport: stdioTransport,
+				ProxyPort: 8080,
+				SessionStorage: &mcpv1alpha1.SessionStorageConfig{
+					Provider: "memory",
+				},
+			},
+			expected: func(t *testing.T, sc *runner.ScalingConfig) {
+				t.Helper()
+				assert.Nil(t, sc)
+			},
+		},
+		{
+			name: "sessionStorage redis — address/db/keyPrefix written to SessionRedis",
+			spec: mcpv1alpha1.MCPServerSpec{
+				Image:     testImage,
+				Transport: stdioTransport,
+				ProxyPort: 8080,
+				SessionStorage: &mcpv1alpha1.SessionStorageConfig{
+					Provider:  "redis",
+					Address:   "redis.default.svc:6379",
+					DB:        2,
+					KeyPrefix: "thv:",
+				},
+			},
+			expected: func(t *testing.T, sc *runner.ScalingConfig) {
+				t.Helper()
+				require.NotNil(t, sc)
+				require.NotNil(t, sc.SessionRedis)
+				assert.Equal(t, "redis.default.svc:6379", sc.SessionRedis.Address)
+				assert.Equal(t, int32(2), sc.SessionRedis.DB)
+				assert.Equal(t, "thv:", sc.SessionRedis.KeyPrefix)
+			},
+		},
+		{
+			name: "sessionStorage redis with passwordRef — password NOT in SessionRedis",
+			spec: mcpv1alpha1.MCPServerSpec{
+				Image:     testImage,
+				Transport: stdioTransport,
+				ProxyPort: 8080,
+				SessionStorage: &mcpv1alpha1.SessionStorageConfig{
+					Provider: "redis",
+					Address:  "redis:6379",
+					PasswordRef: &mcpv1alpha1.SecretKeyRef{
+						Name: "redis-secret",
+						Key:  "password",
+					},
+				},
+			},
+			expected: func(t *testing.T, sc *runner.ScalingConfig) {
+				t.Helper()
+				require.NotNil(t, sc)
+				require.NotNil(t, sc.SessionRedis)
+				assert.Equal(t, "redis:6379", sc.SessionRedis.Address)
+				// Password must NOT be stored in the RunConfig (it's a pod env var)
+				assert.Empty(t, sc.SessionRedis.KeyPrefix)
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			m := &mcpv1alpha1.MCPServer{
+				ObjectMeta: metav1.ObjectMeta{Name: "test", Namespace: "default"},
+				Spec:       tt.spec,
+			}
+
+			r := &MCPServerReconciler{
+				Client: fake.NewClientBuilder().
+					WithScheme(createRunConfigTestScheme()).
+					WithObjects(m).
+					Build(),
+			}
+
+			runConfig, err := r.createRunConfigFromMCPServer(m)
+			require.NoError(t, err)
+			tt.expected(t, runConfig.ScalingConfig)
+		})
+	}
+}

docs/server/docs.go

@@ -233,6 +233,26 @@ type ScalingConfig struct {
 	// When nil, replicas are unmanaged (preserving HPA or manual kubectl control).
 	// When set (including 0), the value is an explicit replica count.
 	BackendReplicas *int32 `json:"backend_replicas,omitempty" yaml:"backend_replicas,omitempty"`
+
+	// SessionRedis holds non-sensitive Redis connection parameters for distributed session storage.
+	// Populated only when MCPServer.spec.sessionStorage.provider == "redis".
+	// The Redis password is not included — it is injected as env var THV_SESSION_REDIS_PASSWORD.
+	// +optional
+	SessionRedis *SessionRedisConfig `json:"session_redis,omitempty" yaml:"session_redis,omitempty"`
+}
+
+// SessionRedisConfig contains non-sensitive Redis connection parameters used for distributed
+// session storage when the operator is configured with sessionStorage.provider == "redis".
+// The Redis password is excluded and injected separately as env var THV_SESSION_REDIS_PASSWORD.
+type SessionRedisConfig struct {
+	// Address is the Redis server address (host:port).
+	Address string `json:"address,omitempty" yaml:"address,omitempty"`
+
+	// DB is the Redis database number.
+	DB int32 `json:"db,omitempty" yaml:"db,omitempty"`
+
+	// KeyPrefix is an optional prefix applied to all Redis keys used by ToolHive.
+	KeyPrefix string `json:"key_prefix,omitempty" yaml:"key_prefix,omitempty"`
 }
 
 // WriteJSON serializes the RunConfig to JSON and writes it to the provided writer