Skip to content

Honor vMCP partial failure mode and timeouts - #6246

Open
lorenzozanee wants to merge 1 commit into
stacklok:mainfrom
lorenzozanee:fix/vmcp-wire-operational-config
Open

Honor vMCP partial failure mode and timeouts#6246
lorenzozanee wants to merge 1 commit into
stacklok:mainfrom
lorenzozanee:fix/vmcp-wire-operational-config

Conversation

@lorenzozanee

Copy link
Copy Markdown

Summary

operational.failureHandling.partialFailureMode and operational.timeouts
(default / perWorkload) on VirtualMCPServer have been declared, validated,
defaulted, present in the CRD schema and documented since the vMCP config model
landed, but no production code ever read them: capability aggregation was
hardcoded to best-effort behavior (a failing backend was logged and skipped,
and the query only failed when every backend failed), and backend queries had
no per-request deadline.

This PR wires the two settings into the default aggregator:

  • NewDefaultAggregator gains a WithOperationalConfig option (variadic, so
    existing callers are unaffected) that carries partialFailureMode and the
    timeout settings into the aggregator.
  • With partialFailureMode: fail, the first failing backend now fails the
    whole capability query and the remaining in-flight queries are cancelled.
    best_effort preserves the previous log-and-continue behavior.
  • timeouts.default and timeouts.perWorkload now bound each backend
    capability query with a per-backend context deadline (perWorkload entries
    keyed by workload name take precedence).
  • cli/serve.go passes the loaded operational config to the aggregator via a
    small newAggregator helper so the production wiring is directly testable.

Fixes #6164

Type of change

  • Bug fix
  • New feature
  • Refactoring (no behavior change)
  • Dependency update
  • Documentation
  • Other (describe):

Test plan

  • Unit tests (task test)
  • E2E tests (task test-e2e)
  • Linting (task lint-fix)
  • Manual testing (describe below)

Unit tests for the affected vmcp packages pass (go test ./pkg/vmcp/...),
including race detection on the new tests. The regression tests fail on the
pre-fix code (the aggregator ignored the setting) and pass after the fix.
go vet and gofmt are clean.

Does this introduce a user-facing change?

Yes. Three behavior changes deserve attention:

  1. Default failure mode is now effective. partialFailureMode defaults to
    fail (the CRD default and the documented default). Previously every
    deployment behaved as best-effort regardless of configuration; now a
    deployment that does not set the field fails capability queries when any
    backend's live capability query fails. Deployments that rely on the old
    best-effort behavior should set partialFailureMode: best_effort
    explicitly. Note that quick mode (thv vmcp serve --group) does not run
    the config defaulting step, so it keeps best-effort behavior.
  2. operational.timeouts currently bounds capability aggregation queries.
    The config field documents a default timeout for backend requests; this PR
    applies it to the capability queries in aggregation. Other backend request
    paths (session establishment, individual tool calls) are not yet bound by
    this setting and keep their existing fixed timeouts.
  3. ListBackends under the authorized view aggregates the full backend set
    without health filtering
    (health is a status, not a visibility filter).
    With fail mode, a single unreachable backend now fails that call, where
    previously it was skipped. This matches the documented "fail: Fail entire
    request if any backend is unavailable" contract.

Special notes for reviewers

The aggregator's QueryAllCapabilities doc comment, the Aggregator
interface contract and core.aggregateBackends were updated to describe the
mode-dependent failure behavior so the docs match the implementation.

Signed-off-by: lorenzozanee <wyz0707@proton.me>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

vmcp: operational.timeouts and partialFailureMode are validated and documented but never read

1 participant