Fix field names in external-auth examples

examples/operator/external-auth/complete_example.yaml

@@ -28,22 +28,24 @@ spec:
   type: tokenExchange
   tokenExchange:
     # Keycloak token endpoint
-    token_url: https://keycloak.example.com/realms/myrealm/protocol/openid-connect/token
+    tokenUrl: https://keycloak.example.com/realms/myrealm/protocol/openid-connect/token
 
     # OAuth2 client credentials
-    client_id: toolhive-client
-    client_secret_ref:
+    clientId: toolhive-client
+    clientSecretRef:
       name: oauth-client-secret
       key: client-secret
 
     # Target audience for the exchanged token
     audience: mcp-backend
 
     # OAuth2 scopes
-    scope: "openid profile"
+    scopes:
+      - openid
+      - profile
 
     # Extract external token from custom header
-    external_token_header_name: "X-Upstream-Authorization"
+    externalTokenHeaderName: "X-Upstream-Authorization"
 
 ---
 # MCP Server with external authentication

examples/operator/external-auth/mcpexternalauthconfig_basic.yaml

@@ -6,28 +6,31 @@ metadata:
   name: oauth-token-exchange
   namespace: default
 spec:
-  # Type of external authentication (currently only "tokenExchange" is supported)
+  # This example uses tokenExchange. Supported types depend on the consuming
+  # resource; see the MCPExternalAuthConfig CRD reference for the full matrix.
   type: tokenExchange
 
   # Token exchange configuration for OAuth2 token exchange flow
   tokenExchange:
     # OAuth2 token endpoint URL
-    token_url: https://oauth.example.com/token
+    tokenUrl: https://oauth.example.com/token
 
     # OAuth2 client ID
-    client_id: my-client-id
+    clientId: my-client-id
 
     # Reference to Kubernetes Secret containing the client secret
-    client_secret_ref:
+    clientSecretRef:
       name: oauth-client-secret
       key: client-secret
 
     # Target audience for the exchanged token
     audience: backend-service
 
     # Optional: OAuth2 scopes to request
-    scope: "read write"
+    scopes:
+      - read
+      - write
 
     # Optional: Custom header name for extracting external token from incoming requests
     # If not specified, defaults to "Authorization" header
-    # external_token_header_name: "X-Upstream-Token"
+    # externalTokenHeaderName: "X-Upstream-Token"

examples/operator/external-auth/mcpexternalauthconfig_minimal.yaml

@@ -8,9 +8,9 @@ metadata:
 spec:
   type: tokenExchange
   tokenExchange:
-    token_url: https://oauth.example.com/token
-    client_id: my-client
-    client_secret_ref:
+    tokenUrl: https://oauth.example.com/token
+    clientId: my-client
+    clientSecretRef:
       name: oauth-secret
       key: client-secret
     audience: my-audience