Repository navigation
Conversation
|
a65ec41 to
76279f5
Compare
46692e8 to
eb2db3f
Compare
politerealism
left a comment
politerealism
left a comment
There was a problem hiding this comment.
Summary
The design is sound and directly addresses both #3781 (Podman TLS-trust regression) and #3295 (general additional-destination-CA feature): trust material is scoped to the supervisor container only, root-store construction is fixed for both the bundled-ca-roots and native-store variants, validation is fail-closed end-to-end, and the gateway-mTLS trust boundary is provably untouched (new destination_ca_cannot_authenticate_gateway regression test). However, the branch as submitted (eb2db3f65) doesn't compile its own test suite, so CI can't pass yet.
Blocking
cargo test -p openshell-driver-podman -p openshell-driver-docker -p openshell-server (and mise run pre-commit's rust:lint step) fail to compile, all four attributable to this PR's own commits:
crates/openshell-driver-podman/src/container.rs:1833— new testadditional_destination_trust_is_delivered_only_to_supervisor_with_digestis missing the pre-existing required fieldrootlessonIsolationSpecInput.crates/openshell-driver-podman/src/container.rs:2020— existingrootful_specs = build_isolation_specs(...)wasn't updated with the new required fieldnetwork_trust.crates/openshell-driver-docker/src/tests.rs:135— setsdaemon_version: "28.0.0".to_string(), butDockerDriverRuntimeConfighas no such field.crates/openshell-server/src/compute/mod.rs:13576— new teststart_sandbox_request_uses_optional_wire_field_six_for_durable_snapshotis missing the pre-existing required fieldexpected_runtime_identityonStartSandboxRequest.
openshell-driver-kubernetes, openshell-driver-vm, and openshell-gateway build and test cleanly in isolation, so this is localized to four struct literals, not systemic.
Non-blocking notes
deploy/helm/openshell/templates/clusterrole.yaml:82-97/role.yaml:65-70: RBAC grants unscopedgeton ConfigMaps (in addition tocreate), sinceresourceNamescan't restrict dynamically digest-named generations. That lets the gateway service account read any ConfigMap in the bound scope, not just its own CA generations. Reasoning is documented in-line and in thedebug-openshell-clusterskill update, but worth a second look given it's a real (if bounded) privilege widening.crates/openshell-supervisor-network/src/run.rs:212-219: the additional-CA load path fails closed correctly but doesn't emit aConfigStateChangeBuilderOCSF event the way the adjacent TLS-termination code does atrun.rs:401-429. Not required by AGENTS.md's OCSF scope (that'sopenshell-sandbox-specific), but would be a nice consistency improvement for operator visibility.
Testing
cargo fmt --all -- --check passes. cargo test -p openshell-supervisor-network -p openshell-core -p openshell-supervisor passes (1344/1345, one pre-existing unrelated flake). Docker/Kubernetes/VM e2e lanes haven't been run (not available in my review environment) and remain genuinely unverified — recommend running those before merge, in addition to fixing the compile errors above.
eb2db3f to
60826fb
Compare
Since v0.1.2 the Podman supervisor runs as its own container, separate from the workload image, so it can no longer inherit a private CA baked into the workload's system trust store. Policy-allowed, inspected HTTPS requests to destinations signed by that CA fail upstream TLS establishment, and the only workaround is rebuilding the supervisor image with the CA baked in. Add a Podman-only additional_ca_bundle setting, independent of the existing proxy_ca_bundle (which requires https_proxy), that bind-mounts an operator PEM into the supervisor container and folds it into the upstream trust store alongside the system CA bundle. Validated on the gateway host at sandbox-create time, matching the existing corporate proxy CA bundle's validation, so a misconfigured path or certificate-free bundle fails closed immediately rather than producing a failed sandbox once the supervisor container starts. Scoped to Podman only, reusing the existing additive-bundle mechanism without new gateway.toml schema, proto fields, or cross-driver plumbing -- a narrower alternative to the in-flight cross-driver implementation in NVIDIA#3292, which remains the intended long-term direction. Fixes NVIDIA#3781. Signed-off-by: politerealism <burdcat17@gmail.com>
|
This pull request has had no activity for 14 days and is now marked stale. |
github-actions
Bot
added
the
state:stale
5672597 to
309301d
Compare
…ss (NVIDIA#3996) * fix(podman): trust an operator-supplied additional CA for direct egress Since v0.1.2 the Podman supervisor runs as its own container, separate from the workload image, so it can no longer inherit a private CA baked into the workload's system trust store. Policy-allowed, inspected HTTPS requests to destinations signed by that CA fail upstream TLS establishment, and the only workaround is rebuilding the supervisor image with the CA baked in. Add a Podman-only additional_ca_bundle setting, independent of the existing proxy_ca_bundle (which requires https_proxy), that bind-mounts an operator PEM into the supervisor container and folds it into the upstream trust store alongside the system CA bundle. Validated on the gateway host at sandbox-create time, matching the existing corporate proxy CA bundle's validation, so a misconfigured path or certificate-free bundle fails closed immediately rather than producing a failed sandbox once the supervisor container starts. Scoped to Podman only, reusing the existing additive-bundle mechanism without new gateway.toml schema, proto fields, or cross-driver plumbing -- a narrower alternative to the in-flight cross-driver implementation in NVIDIA#3292, which remains the intended long-term direction. Fixes NVIDIA#3781. Signed-off-by: politerealism <burdcat17@gmail.com> * fix(podman): keep additional CA mount on the supervisor build_isolation_specs() keeps only trusted_mount() destinations on the supervisor, and the additional CA path was not in that list. The bind mount stayed on the workload while the supervisor received --additional-ca-bundle for a file it did not have, so startup failed. Add the path to trusted_mount() and cover the final supervisor and workload specs with a test. Correct the docs and a code comment to say the bundle is validated when the driver starts, and add Podman troubleshooting guidance to the debug-openshell-cluster skill. Signed-off-by: politerealism <burdcat17@gmail.com> --------- Signed-off-by: politerealism <burdcat17@gmail.com>
github-actions
Bot
removed
the
state:stale
309301d to
aaf328b
Compare
f3ee4cb to
5b8e8e4
Compare
BlockedIssue #3295 is accepted and remains Thanks @TaylorMutch for requesting test execution. I checked your latest command and the mirror; both target an older head. Thanks @jhjaggars for explaining the supervisor-only refresh and restored recovery behavior in response to @mrunalp's upgrade concerns. I checked your response and the review history and verified @mrunalp's maintainer authority; whether the implementation resolves those concerns still needs independent code review. Action required: a maintainer must post Gator metadata
|
5b8e8e4 to
14c2c1c
Compare
BlockedIssue #3295 is accepted and remains Thanks @TaylorMutch for requesting test execution. I checked your latest command and the mirror; both target an older head. Thanks @jhjaggars for explaining the supervisor-only refresh and restored recovery behavior in response to @mrunalp's upgrade concerns. I checked your response and the review history and verified @mrunalp's maintainer authority; whether the implementation resolves those concerns still needs independent code review. Action required: a maintainer must post Gator metadata
|
14c2c1c to
6369ae9
Compare
BlockedIssue #3295 is accepted and remains Thanks @TaylorMutch for requesting test execution. I checked your latest command and the mirror; both target an older head. Thanks @jhjaggars for explaining the supervisor-only refresh and restored recovery behavior in response to @mrunalp's upgrade concerns. I checked your response and the review history and verified @mrunalp's maintainer authority; whether the implementation resolves those concerns still needs independent code review. Action required: a maintainer must post Gator metadata
|
6369ae9 to
77187f3
Compare
BlockedIssue #3295 is accepted and remains Thanks @TaylorMutch for requesting test execution. I checked your latest command and the mirror; both target an older head. Thanks @jhjaggars for explaining the supervisor-only refresh and restored recovery behavior in response to @mrunalp's upgrade concerns. I checked your response and the review history and verified @mrunalp's maintainer authority; whether the implementation resolves those concerns still needs independent code review. Action required: a maintainer must post Gator metadata
|
77187f3 to
c87db10
Compare
BlockedIssue #3295 is accepted and remains Thanks @TaylorMutch for requesting test execution. I checked your latest command and the mirror; both target an older head. Thanks @jhjaggars for explaining the supervisor-only refresh and restored recovery behavior in response to @mrunalp's upgrade concerns. I checked your response and review history and verified @mrunalp's maintainer authority; whether the implementation resolves those concerns still needs independent code review. Action required: a maintainer must post Gator metadata
|
5578a05 to
093f38f
Compare
Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
Resolve rebase fallout against current upstream main after the series was rebased 214 commits forward: - follow upstream NVIDIA#3110: supervisor→gateway TLS is CA-only, so configure_gateway_tls and its isolation tests drop the client identity - follow upstream tls_secret_names reduction to [String; 1] in the Podman driver while keeping the network trust bundle delivery - port [openshell.supervisor.network] rendering into the openshell.gatewayConfigToml serializer in _toml.tpl - adapt tests to upstream struct/function changes (DriverStartupContext, SandboxRunConfig, IsolationSpecInput, supervisor_pod, VM bootstrap image) - drop conformance-artifact-prefix plumbing removed upstream Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
Unify the additional destination CA series on the mechanism merged to main in NVIDIA#3996: one operator pre-assembled PEM bundle, the --additional-ca-bundle supervisor flag, and the /etc/openshell/tls/additional/ca-bundle.pem staging path. - Replace the gateway-level additional_ca_cert_paths list with a single additional_ca_bundle file validated and staged at gateway startup. - Restore the upstream supervisor argument path and fold-into-roots behavior; drop the --network-additional-ca-bundle and --network-additional-ca-digest contracts. - Keep gateway normalization bounds, content-addressed staging, digest-based driver reconciliation, and stop/start rotation; the freshness check now runs at the gateway/driver boundary instead of the supervisor boundary. - Reject additional_ca_bundle in operator driver JSON config; standalone drivers self-source the bundle from --sandbox-additional-ca-bundle with the same validation. - Extend the Kubernetes ConfigMap name digest segment to keep the full 63-byte budget after the prefix rename. - Box the persisted-sandbox reconciliation futures so callers stay under the clippy::large_futures threshold. Updates Docker, Podman, Kubernetes, and VM delivery, Helm chart and tests, e2e wiring, gateway configuration docs, and the cluster debugging skill to the single mechanism. Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
… lockfile The network trust startup tests asserted on raw substrings of gateway diagnostics, but the CLI renderer wraps output at a fixed width with continuation markers and hard-breaks long paths. Compare assertions on whitespace- and continuation-squashed text so they hold regardless of wrap position. Format the e2e workspace (separate cargo workspace, not covered by the root cargo fmt run) and refresh examples/isolation-backend-v8/Cargo.lock for the libc dependency added to the network trust crate. Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
The additional CA e2e never ran in CI before the first maintainer test dispatch, and its local container inspection was broken in two ways: it located the supervisor container through e2e network membership (the supervisor is host-networked or runtime-bridged, so the filter matched the CI job container instead), and it required the gateway mTLS CA as a bind mount (Podman delivers it as a container secret when user namespaces remap UIDs). Select the supervisor by managed labels and accept the secret delivery form. The lifecycle leg then exposed a driver bug: stopped-pair trust replacement re-created the per-sandbox TLS CA secret, colliding with the secret still owned by the renamed stopped pair. Mirror the token and resolver secret handling: require and reuse the existing secret during replacement instead of creating it. Validated end-to-end with the Podman additional CA e2e lane. Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
…ilures Recovery no longer marks sandboxes Error/InvalidPersistedSandbox when driver_start_request fails during the startup or lifecycle sweeps. Gateway configuration problems (for example a missing launch signer) must not permanently fail unrelated sandbox records; the sweep logs a warning and skips them, matching the behavior before the additional CA work. Sandbox-record failures surface through the normal start path. Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
Replace the stopped-pair trust reconciliation with supervisor-only recreation. The destination-trust generation label moves from the workload to the supervisor container, and start_sandbox recreates only the supervisor when its generation is missing or stale. The workload container, its volumes, its secrets, and its workspace data are never replaced: the additional CA bundle is mounted only into the supervisor. Running sandboxes are never gated on trust labels, and recovery without fresh launch credentials keeps the existing supervisor. The intentional -removal fence machinery in the watcher existed only for workload replacement and is removed with it. Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
…nges Delete the stopped-workload trust reconciliation path and all of its machinery: the trust-generation label on workload containers, the generation match check in the start fence, the stopped-sandbox replacement, the bounded workspace archive copy with its 512 MiB cap and regular-file-only validation, and the boundary-state rollback helpers. No replacement machinery is needed: the trusted supervisor container is already re-created from the gateway's current configuration on every start via ensure_control_process_for_container, so stop/start picks up the current additional CA bundle while the workload container, its volumes, and its workspace data are never replaced. Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
…ifecycle The stop/start lifecycle description already matches the supervisor-only refresh model; remove the two remaining references to restart reconciliation of workload containers. Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
Route the gateway TLS isolation test PKI, the destination CA source fixtures, and the gateway startup trust tests through openshell_crypto::pki now that rcgen access is centralized there: generate_keypair/self_signed/signed_by replace the direct rcgen calls and CertifiedKey field access follows the wrapper's shape. Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
093f38f to
d8df06b
Compare
BlockedIssue #3295 remains accepted and Action required: a maintainer must post Gator metadata
|
This branch has not been deployed
6 participants
Summary
Add a global network-supervisor configuration for additional destination CA certificates so sandbox egress can trust private PKI without replacing default roots or changing gateway control-plane trust.
This series adopts the mechanism merged to main in #3996 (from #3781) and extends it to every first-party compute driver: one operator pre-assembled PEM bundle, the
--additional-ca-bundlesupervisor flag, and the/etc/openshell/tls/additional/ca-bundle.pemstaging path.Related Issue
Fixes #3295
Changes
[openshell.supervisor.network].additional_ca_bundle(single pre-assembled PEM file) with strict, bounded startup validation and fail-closed capability-based driver handling.additional_ca_bundlein operator driver JSON config so the global gateway setting stays the single source; standalone drivers self-source the same bundle from--sandbox-additional-ca-bundlewith identical validation.Why lifecycle reconciliation is included
Additional CA sources are startup-only gateway configuration. Updating the source file or Helm source ConfigMap does not hot-reload running supervisors. To roll certificates, an operator updates the source, restarts or redeploys the gateway, and explicitly stop/starts each affected sandbox.
Each runtime records the immutable trust generation it was created with. Without reconciliation, ordinary stop/start cannot reliably move an existing sandbox to the new generation: Docker and Podman retain old container metadata, Kubernetes retains the old content-addressed ConfigMap mount, and VM retains the old writable overlay. Replacing only the staged file would conflict with the recorded digest and correctly fail closed.
The only existing manual alternative is to delete and recreate each affected sandbox, or create a replacement sandbox and move work to it. Sandbox deletion normally removes its driver-owned mutable filesystem storage—Docker/Podman workspace volumes, the Kubernetes sandbox PVC, or the VM writable overlay. Operators would therefore need to back up and restore required
/sandboxcontents, use external persistent storage, and re-establish any sandbox-specific state. The reconciliation implemented here avoids that migration by rebuilding stale runtime resources during stop/start while preserving the sandbox record and supported durable workspace data.This lifecycle work can be split into a follow-up only if destructive replacement plus explicit data migration is an acceptable interim certificate-rotation procedure.
Testing
mise run pre-commitpassesmise run testtask run as a single validation commandChecklist