Automate HMAC secret management

[yrobla]

Automatically generate and manage HMAC secrets when SessionManagementV2 is enabled in VirtualMCPServer resources, eliminating manual secret creation.

Large PR Justification

This is an atomic PR that implements a single functionality and it's adding comprehensive tests. Cannot be split.

Related-to: #3867

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7df1246a58

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

This PR adds operator-managed HMAC secret generation and injection for vMCP Session Management V2, removing the need for users to manually create and wire a Kubernetes Secret when enabling session token binding.

Changes:

• Operator: create {vmcp-name}-hmac-secret when sessionManagementV2: true and mount it into the vMCP Deployment as VMCP_SESSION_HMAC_SECRET.
• Tests: add controller-level unit tests for secret generation and a new E2E suite validating secret creation/injection behavior.
• Docs: document automatic secret management behavior when deploying via the ToolHive operator.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
cmd/thv-operator/controllers/virtualmcpserver_controller.go	Ensures HMAC Secret exists (when SessionManagementV2 enabled) and adds generator helper.
cmd/thv-operator/controllers/virtualmcpserver_deployment.go	Injects VMCP_SESSION_HMAC_SECRET env var sourced from the generated Secret.
cmd/thv-operator/controllers/virtualmcpserver_hmac_secret_test.go	Unit tests for generateHMACSecret() output validity/uniqueness.
test/e2e/thv-operator/virtualmcp/virtualmcp_hmac_secret_test.go	E2E validation of Secret creation/shape/ownership and env var injection behavior.
cmd/vmcp/README.md	Adds operator-focused documentation for automatic secret management.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

❌ Patch coverage is 6.36364% with 103 lines in your changes missing coverage. Please review.
✅ Project coverage is 68.46%. Comparing base (e758073) to head (63551ba).

Files with missing lines	Patch %	Lines
...perator/controllers/virtualmcpserver_controller.go	7.29%	87 Missing and 2 partials ⚠️
...perator/controllers/virtualmcpserver_deployment.go	0.00%	13 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4008      +/-   ##
==========================================
- Coverage   68.60%   68.46%   -0.15%     
==========================================
  Files         444      444              
  Lines       45178    45288     +110     
==========================================
+ Hits        30995    31005      +10     
- Misses      11781    11882     +101     
+ Partials     2402     2401       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Large PR Detected

This PR exceeds 1000 lines of changes and requires justification before it can be reviewed.

How to unblock this PR:

Add a section to your PR description with the following format:

## Large PR Justification

[Explain why this PR must be large, such as:]
- Generated code that cannot be split
- Large refactoring that must be atomic
- Multiple related changes that would break if separated
- Migration or data transformation

Alternative:

Consider splitting this PR into smaller, focused changes (< 1000 lines each) for easier review and reduced risk.

See our Contributing Guidelines for more details.

---

This review will be automatically dismissed once you add the justification section.

Large PR justification has been provided. Thank you!

[github-actions]

✅ Large PR justification has been provided. The size review has been dismissed and this PR can now proceed with normal review.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.