feat: add tls configuration in mcpserver

[DahuK]

I tried to deploy an MCPServer. During the deployment, the kagent controller attempts to list tools from the MCP backend over HTTPS, but it fails with the following error:

"reconcileID":"c77f3b32-f68a-443d-8a1f-b56a1fe7d3a9","error":"failed to upsert tool server for remote mcp server default/dahu-mcp: failed to fetch tools for toolServer default/dahu-mcp: failed to initialize client for toolServer default/dahu-mcp: transport error: request failed with status 400: Client sent an HTTP request to an HTTPS server.\n"

To address this, I think we should enhance MCPServer by adding an HTTPTransportTLS field, so users can customize the TLS client configuration (e.g., client certificate/key and CA bundle) when connecting to the MCP server. An example:

apiVersion: kagent.dev/v1alpha1
kind: MCPServer
metadata:
  name: test-mcp
spec:
  transportType: http
  httpTransport:
    targetPort: 8443
    path: /
    tls:
      secretRef: test-tls-client   # Custom client certificate used to access the MCP server

  deployment:
    image: ghcr.io/test/test-mcp:v0.1.0
    port: 8443
    args:
      - --http-addr
      - :8443
      - --tls-cert
      - /etc/tls/tls.crt
      - --tls-key
      - /etc/tls/tls.key

    # Explicitly create the volume
    volumes:
      - name: tls-certs
        secret:
          secretName: test-tls-server
    volumeMounts:
      - name: tls-certs
        mountPath: /etc/tls
        readOnly: true

[EItanya]

So my main issue with this PR is actually the fact that this config is NOT used by the MCPServer at all, but only by the Agent which references it in kagent. I understand the reason for this as we want a consistent way to access this resource, but it feels a little bit strange. Let me think a little bit on this.

[DahuK]

So my main issue with this PR is actually the fact that this config is NOT used by the MCPServer at all, but only by the Agent which references it in kagent. I understand the reason for this as we want a consistent way to access this resource, but it feels a little bit strange. Let me think a little bit on this.

Agree. Perhaps defining the client certificate reference in the McpServerTool within agent types is also an option. Looking forward to your decision.