fix: correct CRD type mismatches and add omitempty to status fields

cmd/thv-operator/api/v1alpha1/mcpgroup_types.go

@@ -27,11 +27,11 @@ type MCPGroupStatus struct {
 
 	// Servers lists MCPServer names in this group
 	// +optional
-	Servers []string `json:"servers"`
+	Servers []string `json:"servers,omitempty"`
 
 	// ServerCount is the number of MCPServers
 	// +optional
-	ServerCount int `json:"serverCount"`
+	ServerCount int `json:"serverCount,omitempty"`
 
 	// RemoteProxies lists MCPRemoteProxy names in this group
 	// +optional

cmd/thv-operator/api/v1alpha1/mcpregistry_types.go

@@ -293,7 +293,7 @@ type MCPRegistryDatabaseConfig struct {
 	// +kubebuilder:validation:Minimum=1
 	// +kubebuilder:validation:Maximum=65535
 	// +optional
-	Port int `json:"port,omitempty"`
+	Port int32 `json:"port,omitempty"`
 
 	// User is the application user (limited privileges: SELECT, INSERT, UPDATE, DELETE)
 	// Credentials should be provided via pgpass file or environment variables
@@ -324,13 +324,13 @@ type MCPRegistryDatabaseConfig struct {
 	// +kubebuilder:default=10
 	// +kubebuilder:validation:Minimum=1
 	// +optional
-	MaxOpenConns int `json:"maxOpenConns,omitempty"`
+	MaxOpenConns int32 `json:"maxOpenConns,omitempty"`
 
 	// MaxIdleConns is the maximum number of idle connections in the pool
 	// +kubebuilder:default=2
 	// +kubebuilder:validation:Minimum=0
 	// +optional
-	MaxIdleConns int `json:"maxIdleConns,omitempty"`
+	MaxIdleConns int32 `json:"maxIdleConns,omitempty"`
 
 	// ConnMaxLifetime is the maximum amount of time a connection may be reused (Go duration format)
 	// Examples: "30m", "1h", "24h"
@@ -541,7 +541,7 @@ type SyncStatus struct {
 	// AttemptCount is the number of sync attempts since last success
 	// +optional
 	// +kubebuilder:validation:Minimum=0
-	AttemptCount int `json:"attemptCount,omitempty"`
+	AttemptCount int32 `json:"attemptCount,omitempty"`
 
 	// LastSyncTime is the timestamp of the last successful sync
 	// +optional
@@ -555,7 +555,7 @@ type SyncStatus struct {
 	// ServerCount is the total number of servers in the registry
 	// +optional
 	// +kubebuilder:validation:Minimum=0
-	ServerCount int `json:"serverCount,omitempty"`
+	ServerCount int32 `json:"serverCount,omitempty"`
 }
 
 // APIStatus provides detailed information about the API service
@@ -823,7 +823,7 @@ func (r *MCPRegistry) GetDatabaseConfig() *MCPRegistryDatabaseConfig {
 // If the port is not specified, it returns 5432.
 // We do this because its likely to be 5432 due to
 // it being the default port for PostgreSQL.
-func (r *MCPRegistry) GetDatabasePort() int {
+func (r *MCPRegistry) GetDatabasePort() int32 {
 	if r.Spec.DatabaseConfig == nil || r.Spec.DatabaseConfig.Port == 0 {
 		return 5432
 	}

cmd/thv-operator/api/v1alpha1/virtualmcpserver_types.go

@@ -220,7 +220,7 @@ type VirtualMCPServerStatus struct {
 	// BackendCount is the number of healthy/ready backends
 	// (excludes unavailable, degraded, and unknown backends)
 	// +optional
-	BackendCount int `json:"backendCount,omitempty"`
+	BackendCount int32 `json:"backendCount,omitempty"`
 
 	// OIDCConfigHash is the hash of the referenced MCPOIDCConfig spec for change detection.
 	// Only populated when IncomingAuth.OIDCConfigRef is set.

cmd/thv-operator/pkg/registryapi/config/config.go

@@ -593,7 +593,7 @@ func buildDatabaseConfig(dbConfig *mcpv1alpha1.MCPRegistryDatabaseConfig) *Datab
 		config.Host = dbConfig.Host
 	}
 	if dbConfig.Port != 0 {
-		config.Port = dbConfig.Port
+		config.Port = int(dbConfig.Port)
 	}
 	if dbConfig.User != "" {
 		config.User = dbConfig.User
@@ -608,10 +608,10 @@ func buildDatabaseConfig(dbConfig *mcpv1alpha1.MCPRegistryDatabaseConfig) *Datab
 		config.SSLMode = dbConfig.SSLMode
 	}
 	if dbConfig.MaxOpenConns != 0 {
-		config.MaxOpenConns = dbConfig.MaxOpenConns
+		config.MaxOpenConns = int(dbConfig.MaxOpenConns)
 	}
 	if dbConfig.MaxIdleConns != 0 {
-		config.MaxIdleConns = dbConfig.MaxIdleConns
+		config.MaxIdleConns = int(dbConfig.MaxIdleConns)
 	}
 	if dbConfig.ConnMaxLifetime != "" {
 		config.ConnMaxLifetime = dbConfig.ConnMaxLifetime

cmd/thv-operator/pkg/registryapi/pgpass_test.go

@@ -277,7 +277,7 @@ func baseMCPRegistry(t *testing.T, opts ...func(*mcpv1alpha1.MCPRegistry)) *mcpv
 }
 
 func withPort(port int) func(*mcpv1alpha1.MCPRegistry) {
-	return func(r *mcpv1alpha1.MCPRegistry) { r.Spec.DatabaseConfig.Port = port }
+	return func(r *mcpv1alpha1.MCPRegistry) { r.Spec.DatabaseConfig.Port = int32(port) }
 }
 
 func withHost(host string) func(*mcpv1alpha1.MCPRegistry) {

cmd/thv-operator/pkg/virtualmcpserverstatus/collector.go

@@ -201,7 +201,7 @@ func (s *StatusCollector) UpdateStatus(ctx context.Context, vmcpStatus *mcpv1alp
 					readyCount++
 				}
 			}
-			vmcpStatus.BackendCount = readyCount
+			vmcpStatus.BackendCount = int32(readyCount)
 		}
 
 		ctxLogger.V(1).Info("Batched status update applied",

cmd/thv-operator/test-integration/mcp-registry/status_helpers.go

@@ -84,7 +84,7 @@ func (h *StatusTestHelper) WaitForServerCount(registryName string, expectedCount
 		if err != nil {
 			return -1
 		}
-		return status.SyncStatus.ServerCount
+		return int(status.SyncStatus.ServerCount)
 	}, timeout, time.Second).Should(gomega.Equal(expectedCount),
 		"MCPRegistry %s should have server count %d", registryName, expectedCount)
 }

deploy/charts/operator-crds/files/crds/toolhive.stacklok.dev_mcpregistries.yaml

@@ -336,12 +336,14 @@ spec:
                     default: 2
                     description: MaxIdleConns is the maximum number of idle connections
                       in the pool
+                    format: int32
                     minimum: 0
                     type: integer
                   maxOpenConns:
                     default: 10
                     description: MaxOpenConns is the maximum number of open connections
                       to the database
+                    format: int32
                     minimum: 1
                     type: integer
                   migrationUser:
@@ -354,6 +356,7 @@ spec:
                   port:
                     default: 5432
                     description: Port is the database server port
+                    format: int32
                     maximum: 65535
                     minimum: 1
                     type: integer
@@ -814,6 +817,7 @@ spec:
                   attemptCount:
                     description: AttemptCount is the number of sync attempts since
                       last success
+                    format: int32
                     minimum: 0
                     type: integer
                   lastAttempt:
@@ -849,6 +853,7 @@ spec:
                   serverCount:
                     description: ServerCount is the total number of servers in the
                       registry
+                    format: int32
                     minimum: 0
                     type: integer
                 required:

deploy/charts/operator-crds/files/crds/toolhive.stacklok.dev_virtualmcpservers.yaml

@@ -2257,6 +2257,7 @@ spec:
                 description: |-
                   BackendCount is the number of healthy/ready backends
                   (excludes unavailable, degraded, and unknown backends)
+                format: int32
                 type: integer
               conditions:
                 description: Conditions represent the latest available observations

deploy/charts/operator-crds/templates/toolhive.stacklok.dev_mcpregistries.yaml

@@ -339,12 +339,14 @@ spec:
                     default: 2
                     description: MaxIdleConns is the maximum number of idle connections
                       in the pool
+                    format: int32
                     minimum: 0
                     type: integer
                   maxOpenConns:
                     default: 10
                     description: MaxOpenConns is the maximum number of open connections
                       to the database
+                    format: int32
                     minimum: 1
                     type: integer
                   migrationUser:
@@ -357,6 +359,7 @@ spec:
                   port:
                     default: 5432
                     description: Port is the database server port
+                    format: int32
                     maximum: 65535
                     minimum: 1
                     type: integer
@@ -817,6 +820,7 @@ spec:
                   attemptCount:
                     description: AttemptCount is the number of sync attempts since
                       last success
+                    format: int32
                     minimum: 0
                     type: integer
                   lastAttempt:
@@ -852,6 +856,7 @@ spec:
                   serverCount:
                     description: ServerCount is the total number of servers in the
                       registry
+                    format: int32
                     minimum: 0
                     type: integer
                 required:

deploy/charts/operator-crds/templates/toolhive.stacklok.dev_virtualmcpservers.yaml

@@ -2260,6 +2260,7 @@ spec:
                 description: |-
                   BackendCount is the number of healthy/ready backends
                   (excludes unavailable, degraded, and unknown backends)
+                format: int32
                 type: integer
               conditions:
                 description: Conditions represent the latest available observations

pkg/vmcp/status/k8s_reporter.go

@@ -8,6 +8,7 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"math"
 
 	"k8s.io/apimachinery/pkg/api/meta"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -136,7 +137,12 @@ func (*K8sReporter) updateStatus(vmcpServer *mcpv1alpha1.VirtualMCPServer, statu
 	vmcpServer.Status.Message = status.Message
 
 	// Update backend count (only counts healthy/ready backends)
-	vmcpServer.Status.BackendCount = status.BackendCount
+	// Cap at MaxInt32 to prevent integer overflow (gosec G115)
+	backendCount := status.BackendCount
+	if backendCount > math.MaxInt32 {
+		backendCount = math.MaxInt32
+	}
+	vmcpServer.Status.BackendCount = int32(backendCount) //nolint:gosec // bounds checked above
 
 	// Update discovered backends
 	vmcpServer.Status.DiscoveredBackends = make([]mcpv1alpha1.DiscoveredBackend, 0, len(status.DiscoveredBackends))

pkg/vmcp/status/k8s_reporter_test.go

@@ -89,7 +89,7 @@ func TestK8sReporter_ReportStatus_Success(t *testing.T) {
 		name           string
 		phase          vmcptypes.Phase
 		expectedPhase  mcpv1alpha1.VirtualMCPServerPhase
-		backendCount   int
+		backendCount   int32
 		conditionCount int
 	}{
 		{
@@ -137,7 +137,7 @@ func TestK8sReporter_ReportStatus_Success(t *testing.T) {
 			}
 
 			// Add backends if specified
-			for i := 0; i < tt.backendCount; i++ {
+			for i := int32(0); i < tt.backendCount; i++ {
 				status.DiscoveredBackends = append(status.DiscoveredBackends, vmcptypes.DiscoveredBackend{
 					Name:            fmt.Sprintf("backend-%d", i+1),
 					URL:             "http://backend:8080",
@@ -146,7 +146,7 @@ func TestK8sReporter_ReportStatus_Success(t *testing.T) {
 				})
 			}
 			// Set backend count to match number of healthy backends
-			status.BackendCount = tt.backendCount
+			status.BackendCount = int(tt.backendCount)
 
 			// Add conditions if specified
 			for i := 0; i < tt.conditionCount; i++ {
@@ -179,7 +179,7 @@ func TestK8sReporter_ReportStatus_Success(t *testing.T) {
 
 			// Verify backend count
 			assert.Equal(t, tt.backendCount, updated.Status.BackendCount)
-			assert.Len(t, updated.Status.DiscoveredBackends, tt.backendCount)
+			assert.Len(t, updated.Status.DiscoveredBackends, int(tt.backendCount))
 
 			// Verify conditions
 			assert.Len(t, updated.Status.Conditions, tt.conditionCount)
@@ -312,7 +312,7 @@ func TestK8sReporter_ReportStatus_ConcurrentUpdates(t *testing.T) {
 	require.NoError(t, err)
 
 	assert.Equal(t, "Update 5", updated.Status.Message)
-	assert.Equal(t, 1, updated.Status.BackendCount)
+	assert.Equal(t, int32(1), updated.Status.BackendCount)
 	assert.Equal(t, "backend-5", updated.Status.DiscoveredBackends[0].Name)
 }
 

test/e2e/thv-operator/virtualmcp/virtualmcp_yardstick_base_test.go

@@ -366,7 +366,7 @@ var _ = Describe("VirtualMCPServer Yardstick Base", Ordered, func() {
 		It("should have two discovered backends initially", func() {
 			status, err := GetVirtualMCPServerStatus(ctx, k8sClient, vmcpServerName, testNamespace)
 			Expect(err).ToNot(HaveOccurred())
-			Expect(status.BackendCount).To(Equal(2), "Should have 2 initial backends")
+			Expect(status.BackendCount).To(BeEquivalentTo(2), "Should have 2 initial backends")
 			Expect(status.DiscoveredBackends).To(HaveLen(2), "Should have 2 discovered backends")
 
 			backendNames := make([]string, len(status.DiscoveredBackends))