Support secret references for MCP server headers and env

api/v1alpha1/agentconfig_types.go

@@ -88,10 +88,30 @@ type MCPServerSpec struct {
 	// +optional
 	Headers map[string]string `json:"headers,omitempty"`
 
+	// HeadersFrom references a Secret whose data keys are header names
+	// and values are header values. Only used when type is "http" or "sse".
+	// Values from HeadersFrom take precedence over inline Headers for
+	// overlapping keys.
+	// +optional
+	HeadersFrom *SecretValuesSource `json:"headersFrom,omitempty"`
+
 	// Env are environment variables for the server process.
 	// Only used when type is "stdio".
 	// +optional
 	Env map[string]string `json:"env,omitempty"`
+
+	// EnvFrom references a Secret whose data keys are environment variable
+	// names and values are environment variable values. Only used when
+	// type is "stdio". Values from EnvFrom take precedence over inline Env
+	// for overlapping keys.
+	// +optional
+	EnvFrom *SecretValuesSource `json:"envFrom,omitempty"`
+}
+
+// SecretValuesSource selects a Secret to populate values from.
+type SecretValuesSource struct {
+	// SecretRef references the Secret to read data from.
+	SecretRef SecretReference `json:"secretRef"`
 }
 
 // AgentConfigReference refers to an AgentConfig resource by name.

api/v1alpha1/taskspawner_types.go

@@ -75,6 +75,24 @@ type GitHubIssues struct {
 	// +kubebuilder:default=open
 	// +optional
 	State string `json:"state,omitempty"`
+
+	// TriggerComment enables comment-based discovery. When set, only issues
+	// that have a comment matching this string (e.g., "/axon pick-up") are
+	// included. This is useful for repos where you lack label permissions.
+	// If ExcludeComments is also set, TriggerComment doubles as a resume
+	// command — the most recent match between TriggerComment and
+	// ExcludeComments wins. Comments are scanned in reverse chronological
+	// order.
+	// +optional
+	TriggerComment string `json:"triggerComment,omitempty"`
+
+	// ExcludeComments enables comment-based exclusion. When set, issues that
+	// have a comment matching any of these strings (e.g., "/axon needs-input")
+	// are excluded unless a subsequent TriggerComment overrides it. Comments
+	// are scanned in reverse chronological order — the most recent matching
+	// command wins.
+	// +optional
+	ExcludeComments []string `json:"excludeComments,omitempty"`
 }
 
 // Jira discovers issues from a Jira project.

cmd/axon-spawner/main.go

@@ -342,14 +342,16 @@ func buildSource(ts *axonv1alpha1.TaskSpawner, owner, repo, apiBaseURL, tokenFil
 		}
 
 		return &source.GitHubSource{
-			Owner:         owner,
-			Repo:          repo,
-			Types:         gh.Types,
-			Labels:        gh.Labels,
-			ExcludeLabels: gh.ExcludeLabels,
-			State:         gh.State,
-			Token:         token,
-			BaseURL:       apiBaseURL,
+			Owner:           owner,
+			Repo:            repo,
+			Types:           gh.Types,
+			Labels:          gh.Labels,
+			ExcludeLabels:   gh.ExcludeLabels,
+			State:           gh.State,
+			Token:           token,
+			BaseURL:         apiBaseURL,
+			TriggerComment:  gh.TriggerComment,
+			ExcludeComments: gh.ExcludeComments,
 		}, nil
 	}
 

cmd/axon-spawner/main_test.go

@@ -859,3 +859,27 @@ func TestRunCycleWithSource_NotSuspendedConditionCleared(t *testing.T) {
 		}
 	}
 }
+
+func TestRunCycleWithSource_CommentFieldsPassedToSource(t *testing.T) {
+	ts := newTaskSpawner("spawner", "default", nil)
+	ts.Spec.When.GitHubIssues = &axonv1alpha1.GitHubIssues{
+		TriggerComment:  "/axon pick-up",
+		ExcludeComments: []string{"/axon needs-input"},
+	}
+
+	src, err := buildSource(ts, "owner", "repo", "", "", "", "", "")
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	ghSrc, ok := src.(*source.GitHubSource)
+	if !ok {
+		t.Fatalf("Expected *source.GitHubSource, got %T", src)
+	}
+	if ghSrc.TriggerComment != "/axon pick-up" {
+		t.Errorf("TriggerComment = %q, want %q", ghSrc.TriggerComment, "/axon pick-up")
+	}
+	if len(ghSrc.ExcludeComments) != 1 || ghSrc.ExcludeComments[0] != "/axon needs-input" {
+		t.Errorf("ExcludeComments = %v, want %v", ghSrc.ExcludeComments, []string{"/axon needs-input"})
+	}
+}

install-crd.yaml

@@ -72,13 +72,53 @@ spec:
                         Env are environment variables for the server process.
                         Only used when type is "stdio".
                       type: object
+                    envFrom:
+                      description: |-
+                        EnvFrom references a Secret whose data keys are environment variable
+                        names and values are environment variable values. Only used when
+                        type is "stdio". Values from EnvFrom take precedence over inline Env
+                        for overlapping keys.
+                      properties:
+                        secretRef:
+                          description: SecretRef references the Secret to read data
+                            from.
+                          properties:
+                            name:
+                              description: Name is the name of the secret.
+                              type: string
+                          required:
+                          - name
+                          type: object
+                      required:
+                      - secretRef
+                      type: object
                     headers:
                       additionalProperties:
                         type: string
                       description: |-
                         Headers are HTTP headers to include in requests.
                         Only used when type is "http" or "sse".
                       type: object
+                    headersFrom:
+                      description: |-
+                        HeadersFrom references a Secret whose data keys are header names
+                        and values are header values. Only used when type is "http" or "sse".
+                        Values from HeadersFrom take precedence over inline Headers for
+                        overlapping keys.
+                      properties:
+                        secretRef:
+                          description: SecretRef references the Secret to read data
+                            from.
+                          properties:
+                            name:
+                              description: Name is the name of the secret.
+                              type: string
+                          required:
+                          - name
+                          type: object
+                      required:
+                      - secretRef
+                      type: object
                     name:
                       description: |-
                         Name identifies this MCP server. Used as the key in the
@@ -1044,6 +1084,16 @@ spec:
                   githubIssues:
                     description: GitHubIssues discovers issues from a GitHub repository.
                     properties:
+                      excludeComments:
+                        description: |-
+                          ExcludeComments enables comment-based exclusion. When set, issues that
+                          have a comment matching any of these strings (e.g., "/axon needs-input")
+                          are excluded unless a subsequent TriggerComment overrides it. Comments
+                          are scanned in reverse chronological order — the most recent matching
+                          command wins.
+                        items:
+                          type: string
+                        type: array
                       excludeLabels:
                         description: ExcludeLabels filters out issues that have any
                           of these labels (client-side).
@@ -1072,6 +1122,16 @@ spec:
                         - closed
                         - all
                         type: string
+                      triggerComment:
+                        description: |-
+                          TriggerComment enables comment-based discovery. When set, only issues
+                          that have a comment matching this string (e.g., "/axon pick-up") are
+                          included. This is useful for repos where you lack label permissions.
+                          If ExcludeComments is also set, TriggerComment doubles as a resume
+                          command — the most recent match between TriggerComment and
+                          ExcludeComments wins. Comments are scanned in reverse chronological
+                          order.
+                        type: string
                       types:
                         default:
                         - issues