feat: support customized TLS configuration to mcpserver

[DahuK]

I tried to deploy an MCPServer. During deployment, the kagent controller attempts to list tools from the MCP backend over HTTPS, but it fails with the following error:

"reconcileID":"c77f3b32-f68a-443d-8a1f-b56a1fe7d3a9","error":"failed to upsert tool server for remote mcp server default/dahu-mcp: failed to fetch tools for toolServer default/dahu-mcp: failed to initialize client for toolServer default/dahu-mcp: transport error: request failed with status 400: Client sent an HTTP request to an HTTPS server.\n"

At the moment, MCPServer seems to only support calling the backend server over plain HTTP.

Therefore, I think we should allow users to configure a Secret reference in the MCPServer CRD for the certificates used to connect to the MCP server (I have already opened PR #114 in the kmcp project). The controller reconciler could then use the client certificate specified in the CRD when list tools. An example is shown below:

apiVersion: kagent.dev/v1alpha1
kind: MCPServer
metadata:
  name: test-mcp
spec:
  transportType: http
  httpTransport:
    targetPort: 8443
    path: /
    tls:
      secretRef: test-tls-client   # Custom client certificate used to access the MCP server

  deployment:
    image: ghcr.io/test/test-mcp:v0.1.0
    port: 8443
    args:
      - --http-addr
      - :8443
      - --tls-cert
      - /etc/tls/tls.crt
      - --tls-key
      - /etc/tls/tls.key

    # Explicitly create the volume
    volumes:
      - name: tls-certs
        secret:
          secretName: test-tls-server
    volumeMounts:
      - name: tls-certs
        mountPath: /etc/tls
        readOnly: true

These initial changes using a local go.mod replace of the kmcp package from #114. The final implementation will depend on the finalized definition in kmcp’s mcpserver_types.

[EItanya]

Some initial changes necessary, can review more after these changes are made.

[EItanya]

This PR does not change the certs which the actual agents use to connect to the MCP server. You will need to update this translator to do that as well. You can see how it's done for the ModelConfig.

[DahuK]

Yes, I've already added some client certificate configuration logic for the interaction between ADK and MCP, and built an app image to complete preliminary validation of the MCP server configured with HTTPS in my test cluster.

[EItanya]

Where is this field coming from? Did you change kmcp?

[DahuK]

Yes, the changes were previously submitted in #114, please help review them, Thanks a lot!