feat: make DPU bootstrap CA configurable

bluefield/charts/nico-dpu-agent/templates/daemonset.yaml

@@ -1,3 +1,41 @@
+{{- $bootstrapCa := default (dict) .Values.bootstrapCa -}}
+{{- $bootstrapCaSource := default "legacy_download" (get $bootstrapCa "source") -}}
+{{- $bootstrapCaUrl := default "" (get $bootstrapCa "url") -}}
+{{- $bootstrapCaObject := default (dict) (get $bootstrapCa "object") -}}
+{{- $bootstrapCaObjectKind := default "" (get $bootstrapCaObject "kind") -}}
+{{- $bootstrapCaObjectName := default "" (get $bootstrapCaObject "name") -}}
+{{- $bootstrapCaObjectKey := "ca.crt" -}}
+{{- if hasKey $bootstrapCaObject "key" -}}
+{{- $bootstrapCaObjectKey = get $bootstrapCaObject "key" -}}
+{{- end -}}
+{{- $certsDir := .Values.certsDir | default "/opt/nico" -}}
+{{- if not (has $bootstrapCaSource (list "legacy_download" "mounted")) -}}
+{{- fail (printf "bootstrapCa.source must be one of legacy_download or mounted; got %q" $bootstrapCaSource) -}}
+{{- end -}}
+{{- if eq $bootstrapCaSource "legacy_download" -}}
+  {{- if not (empty $bootstrapCaObject) -}}
+  {{- fail "bootstrapCa.object is only valid when bootstrapCa.source is mounted" -}}
+  {{- end -}}
+{{- else -}}
+  {{- if not (empty $bootstrapCaUrl) -}}
+  {{- fail "bootstrapCa.url is only valid when bootstrapCa.source is legacy_download" -}}
+  {{- end -}}
+  {{- if not (has $bootstrapCaObjectKind (list "Secret" "ConfigMap")) -}}
+  {{- fail "bootstrapCa.object.kind must be Secret or ConfigMap when bootstrapCa.source is mounted" -}}
+  {{- end -}}
+  {{- if empty $bootstrapCaObjectName -}}
+  {{- fail "bootstrapCa.object.name is required when bootstrapCa.source is mounted" -}}
+  {{- end -}}
+  {{- if empty $bootstrapCaObjectKey -}}
+  {{- fail "bootstrapCa.object.key must not be empty when bootstrapCa.source is mounted" -}}
+  {{- end -}}
+  {{- /* The init container installs the validated bundle at its fixed
+         /opt/forge/forge_root.pem path, so the shared nico-certs hostPath must
+         be mounted there. */ -}}
+  {{- if ne $certsDir "/opt/forge" -}}
+  {{- fail "bootstrapCa.source mounted requires certsDir=/opt/forge because the init container installs /opt/forge/forge_root.pem there" -}}
+  {{- end -}}
+{{- end -}}
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
@@ -51,6 +89,11 @@ spec:
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           args:
             - init-container
+            {{- if eq $bootstrapCaSource "mounted" }}
+            - "--bootstrap-ca-source=mounted"
+            {{- else if not (empty $bootstrapCaUrl) }}
+            - {{ printf "--bootstrap-ca-url=%s" $bootstrapCaUrl | quote }}
+            {{- end }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           env:
             - name: RUST_BACKTRACE
@@ -77,6 +120,11 @@ spec:
             - name: host-resolv-conf
               mountPath: /host-resolv.conf
               readOnly: true
+            {{- if eq $bootstrapCaSource "mounted" }}
+            - name: bootstrap-ca-source
+              mountPath: /var/run/secrets/nico-bootstrap-ca
+              readOnly: true
+            {{- end }}
       containers:
         - name: nico-dpu-agent
           securityContext:
@@ -165,6 +213,22 @@ spec:
           hostPath:
             path: /etc/resolv.conf
             type: File
+        {{- if eq $bootstrapCaSource "mounted" }}
+        - name: bootstrap-ca-source
+          {{- if eq $bootstrapCaObjectKind "Secret" }}
+          secret:
+            secretName: {{ $bootstrapCaObjectName | quote }}
+            items:
+              - key: {{ $bootstrapCaObjectKey | quote }}
+                path: ca.pem
+          {{- else }}
+          configMap:
+            name: {{ $bootstrapCaObjectName | quote }}
+            items:
+              - key: {{ $bootstrapCaObjectKey | quote }}
+                path: ca.pem
+          {{- end }}
+        {{- end }}
       {{- with .Values.tolerations }}
       tolerations:
         {{- toYaml . | nindent 8 }}

bluefield/charts/nico-dpu-agent/tests/bootstrap_ca_test.yaml

@@ -0,0 +1,201 @@
+suite: bootstrap CA configuration
+templates:
+  - daemonset.yaml
+tests:
+  - it: preserves the historical bare init-container invocation by default
+    set:
+      image:
+        repository: test
+        tag: test
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[0].args
+          value:
+            - init-container
+      - notContains:
+          path: spec.template.spec.initContainers[0].volumeMounts
+          content:
+            name: bootstrap-ca-source
+      - notContains:
+          path: spec.template.spec.volumes
+          content:
+            name: bootstrap-ca-source
+
+  - it: passes a custom URL only for legacy download mode
+    set:
+      image:
+        repository: test
+        tag: test
+      bootstrapCa:
+        source: legacy_download
+        url: http://pxe.example.test/custom/ca.pem
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[0].args
+          value:
+            - init-container
+            - --bootstrap-ca-url=http://pxe.example.test/custom/ca.pem
+      - notContains:
+          path: spec.template.spec.initContainers[0].volumeMounts
+          content:
+            name: bootstrap-ca-source
+      - notContains:
+          path: spec.template.spec.volumes
+          content:
+            name: bootstrap-ca-source
+
+  - it: safely quotes a custom URL containing YAML-sensitive characters
+    set:
+      image:
+        repository: test
+        tag: test
+      bootstrapCa:
+        source: legacy_download
+        url: 'https://pxe.example.test/custom/ca.pem?site="east"&path=trust\anchors'
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[0].args
+          value:
+            - init-container
+            - '--bootstrap-ca-url=https://pxe.example.test/custom/ca.pem?site="east"&path=trust\anchors'
+
+  - it: projects a Secret CA read-only at the fixed mounted-source path
+    set:
+      image:
+        repository: test
+        tag: test
+      bootstrapCa:
+        source: mounted
+        object:
+          kind: Secret
+          name: site-bootstrap-ca
+          key: trust-anchor.pem
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[0].args
+          value:
+            - init-container
+            - --bootstrap-ca-source=mounted
+      - contains:
+          path: spec.template.spec.initContainers[0].volumeMounts
+          content:
+            name: bootstrap-ca-source
+            mountPath: /var/run/secrets/nico-bootstrap-ca
+            readOnly: true
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: bootstrap-ca-source
+            secret:
+              secretName: site-bootstrap-ca
+              items:
+                - key: trust-anchor.pem
+                  path: ca.pem
+
+  - it: projects a ConfigMap CA using ca.crt by default
+    set:
+      image:
+        repository: test
+        tag: test
+      bootstrapCa:
+        source: mounted
+        object:
+          kind: ConfigMap
+          name: site-bootstrap-ca
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[0].args
+          value:
+            - init-container
+            - --bootstrap-ca-source=mounted
+      - contains:
+          path: spec.template.spec.initContainers[0].volumeMounts
+          content:
+            name: bootstrap-ca-source
+            mountPath: /var/run/secrets/nico-bootstrap-ca
+            readOnly: true
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: bootstrap-ca-source
+            configMap:
+              name: site-bootstrap-ca
+              items:
+                - key: ca.crt
+                  path: ca.pem
+
+  - it: rejects an unknown source
+    set:
+      bootstrapCa:
+        source: something_else
+    asserts:
+      - failedTemplate:
+          errorMessage: bootstrapCa.source must be one of legacy_download or mounted; got "something_else"
+
+  - it: rejects a mounted object in legacy download mode
+    set:
+      bootstrapCa:
+        source: legacy_download
+        object:
+          kind: Secret
+          name: site-bootstrap-ca
+    asserts:
+      - failedTemplate:
+          errorMessage: bootstrapCa.object is only valid when bootstrapCa.source is mounted
+
+  - it: rejects a URL in mounted mode
+    set:
+      bootstrapCa:
+        source: mounted
+        url: http://pxe.example.test/custom/ca.pem
+        object:
+          kind: Secret
+          name: site-bootstrap-ca
+    asserts:
+      - failedTemplate:
+          errorMessage: bootstrapCa.url is only valid when bootstrapCa.source is legacy_download
+
+  - it: rejects a non-default certificate directory in mounted mode
+    set:
+      certsDir: /custom/cert/dir
+      bootstrapCa:
+        source: mounted
+        object:
+          kind: Secret
+          name: site-bootstrap-ca
+    asserts:
+      - failedTemplate:
+          errorMessage: bootstrapCa.source mounted requires certsDir=/opt/forge because the init container installs /opt/forge/forge_root.pem there
+
+  - it: requires a Secret or ConfigMap kind in mounted mode
+    set:
+      bootstrapCa:
+        source: mounted
+        object:
+          kind: PersistentVolumeClaim
+          name: site-bootstrap-ca
+    asserts:
+      - failedTemplate:
+          errorMessage: bootstrapCa.object.kind must be Secret or ConfigMap when bootstrapCa.source is mounted
+
+  - it: requires an object name in mounted mode
+    set:
+      bootstrapCa:
+        source: mounted
+        object:
+          kind: Secret
+    asserts:
+      - failedTemplate:
+          errorMessage: bootstrapCa.object.name is required when bootstrapCa.source is mounted
+
+  - it: rejects an explicitly empty object key in mounted mode
+    set:
+      bootstrapCa:
+        source: mounted
+        object:
+          kind: Secret
+          name: site-bootstrap-ca
+          key: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: bootstrapCa.object.key must not be empty when bootstrapCa.source is mounted

bluefield/charts/nico-dpu-agent/values.yaml

@@ -12,6 +12,29 @@ exposedPorts:
 ### Cert directory on the host (also used as the container mountPath).
 certsDir: /opt/forge
 
+### Bootstrap CA source. The default preserves the legacy PXE download and
+### renders the historical bare `init-container` invocation.
+bootstrapCa:
+  source: legacy_download
+  # Empty uses the agent's historical built-in URL. Set only to override it in
+  # legacy_download mode.
+  url: ""
+  # Required only for mounted mode. kind must be Secret or ConfigMap. The
+  # selected key is projected as /var/run/secrets/nico-bootstrap-ca/ca.pem.
+  # Mounted mode requires certsDir=/opt/forge, the dpu-agent's CA output path.
+  # Use a new, versioned object name for CA rotation. Updating data under the
+  # same name does not change the pod template or rerun the init container.
+  object: {}
+  # object:
+  #   kind: Secret
+  #   name: nico-bootstrap-ca-v1
+  #   key: ca.crt
+  # ConfigMap example:
+  # object:
+  #   kind: ConfigMap
+  #   name: nico-bootstrap-ca-v1
+  #   key: ca.crt
+
 ### Service specific values ###
 image:
   repository: ""

crates/agent/Cargo.toml

@@ -104,6 +104,7 @@ regex = { workspace = true }
 resolv-conf = { workspace = true }
 rtnetlink = { workspace = true }
 rustls = { workspace = true }
+rustls-pemfile = { workspace = true }
 serde = { features = ["derive"], workspace = true }
 serde_json = { workspace = true }
 serde_yaml = { workspace = true }
@@ -138,7 +139,6 @@ tonic-prost-build = { workspace = true }
 carbide-test-support = { path = "../test-support" }
 ctor = { workspace = true }
 prost = { workspace = true }
-rustls-pemfile = { workspace = true }
 rustls-pki-types = { workspace = true }
 
 [lints]