feat(e2e): enable mTLS for Podman compute driver#1430
Merged
TaylorMutch merged 3 commits intoMay 18, 2026
Conversation
The Podman driver already supported mTLS certificate injection into sandbox containers, but the e2e test harness explicitly blocked HTTPS and ran plaintext-only gateways. Generate ephemeral PKI (CA, server, client certs) with host.containers.internal in the server SANs, wire guest_tls_* paths into the TOML config, replace --disable-tls with --tls-cert/--tls-key/--tls-client-ca, and switch to mTLS gateway registration. The health check remains on the plaintext health port. Closes NVIDIA#1428
The Docker and Podman e2e scripts had near-identical 35-line PKI generation blocks differing only in the host-gateway SAN. Extract into e2e_generate_pki(pki_dir, host_alias) in gateway-common.sh, which also eliminates the cd/cd pattern by using absolute paths throughout.
russellb
requested review from
a team,
derekwaynecarr,
maxamillion and
mrunalp
as code owners
TaylorMutch
reviewed
May 18, 2026
Replace the hand-rolled openssl PKI generation in e2e_generate_pki()
with the gateway's built-in generate-certs --output-dir command. This
uses the same PKI generation as production deployments (Helm and RPM).
The helper now takes the gateway binary path and passes extra SANs
via --server-san (host.openshell.internal always, plus the driver's
host alias for Podman). The default SAN list already includes
host.docker.internal and localhost.
Update all cert path references to match the generate-certs output
layout (server/tls.{crt,key}, client/tls.{crt,key}) and remove the
openssl preflight checks from both gateway scripts.
|
Label |
Collaborator
|
/ok to test 99170b5 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enable mTLS in the Podman e2e test harness. The Podman driver already had full mTLS support in its Rust code (cert bind-mounts, env vars, config validation, unit tests) — the gap was entirely in the e2e harness, which explicitly blocked HTTPS and ran plaintext-only gateways. This PR wires up ephemeral PKI generation, TLS gateway flags, and mTLS registration, then extracts the shared PKI logic into
gateway-common.shto eliminate duplication with the Docker script.Related Issue
Closes #1428
Changes
e2e/with-podman-gateway.sh: Add openssl preflight, generate ephemeral PKI withhost.containers.internalSAN, addguest_tls_*to TOML config, replace--disable-tlswith--tls-cert/--tls-key/--tls-client-ca, switch tohttps://ande2e_register_mtls_gateway, update error messages to match Docker wordinge2e/support/gateway-common.sh: Extracte2e_generate_pki(pki_dir, host_alias)shared helper — parameterizes the host-gateway SAN and uses absolute paths (eliminates thecd/cdpattern)e2e/with-docker-gateway.sh: Replace inline PKI generation withe2e_generate_pkicalle2e/rust/e2e-podman.sh: Remove "plaintext" from commentTesting
mise run pre-commitpasses (pre-existing markdown lint failure in unrelated gitignored file)mise run test:rust— all unit tests passmise run e2e:podman— all 57 e2e tests pass over mTLS (run twice: once after initial implementation, once after PKI extraction refactor)mise run e2e:docker— not run locally (Docker script change is a pure refactor extracting existing code into a shared function; no behavioral change)Checklist