bug(e2e): OpenShift wrapper rejects valid certificate-less TLS connections #5064

User Story

I use OpenShell on OpenShift and want to use its Kubernetes E2E harness to reproduce and investigate individual test results. Currently, when I do this the wrapper as-is aborts during gateway authentication checks, before it can execute the selected command.

Problem Statement

The OpenShift path in e2e/with-kube-gateway.sh assumes that a connection without a client certificate must fail during the TLS handshake. It treats a successful certificate-less curl request to / as a security failure and exits. PR #3110 intentionally permits certificate-less TLS connections so sandbox clients can authenticate RPCs using bearer tokens, so this security check doesn't align with current behaviour.

Impact / Why This Matters

The wrapper exits before running the supplied command, blocking use of the Kubernetes E2E harness through this wrapper on OpenShift. The workaround requires identifying the problem and maintaining a local patch, so contributors cannot use the upstream wrapper as provided.

Acceptance Criteria

• The OpenShift wrapper permits certificate-less TLS handshakes and checks application authentication using an authenticated user RPC.
• A request with neither a client certificate nor a bearer token must return UNAUTHENTICATED when application authentication is required.
• Valid mTLS CLI access and execution of the supplied command still work.
• Transport failures and unexpected RPC responses fail the check.
• Vanilla Kubernetes behavior remains unchanged.

Reproduction Steps

Observed using upstream source commit 4d4c15c133d40a50234ce9d2d198e5ba79b9553e. Log into an OpenShift cluster with oc, kubectl, helm, curl, and OpenShell CLI available. Run from the checkout root. The harness installs test prerequisites and uses the openshell namespace, use a test cluster without an overlapping OpenShell deployment in the namespace. The optional test command also requires Rust/Cargo and cargo-nextest.

Set the kubeconfig path for your cluster, the current context, and create the authentication-required overlay (This overlay requires application authentication so the reproduction isolates the incorrect TLS-handshake assertion.):

export KUBECONFIG=/absolute/path/to/your/kubeconfig
export OPENSHELL_E2E_KUBE_CONTEXT="$(oc config current-context)"
export OPENSHELL_BIN="$(command -v openshell)"
oc whoami
"$OPENSHELL_BIN" --version

export OPENSHELL_E2E_KUBE_EXTRA_VALUES="$(mktemp /tmp/openshell-require-auth.XXXXXX)"
cat > "$OPENSHELL_E2E_KUBE_EXTRA_VALUES" <<'YAML'
gatewayConfig:
  openshell.gateway.auth:
    allow_unauthenticated_users: false
YAML

Use pinned upstream images:

export OPENSHELL_E2E_KUBE_BUILD_IMAGES=0
export GATEWAY_IMAGE=ghcr.io/nvidia/openshell/gateway@sha256:4d4939f041b20224a3f39a371bb6f90220af6d580ce7ea836c7bb2e8eac1bd79
export SUPERVISOR_IMAGE=ghcr.io/nvidia/openshell/supervisor@sha256:069f127e189b4d76c1c38da4034e5974a2ebf631ad042bbff13683f84e4c1abc
export SANDBOX_IMAGE=ghcr.io/nvidia/openshell/sandbox@sha256:155ef2d34c59f3478ca4c305da128b52c72498cba60fb3381e74ee6fb6d0f1ef

Run a minimal command through the wrapper:

e2e/with-kube-gateway.sh bash -c 'echo WRAPPER_COMMAND_REACHED'

Or run a test:

TEST=sandbox_exec_large_output_is_complete

e2e/with-kube-gateway.sh cargo nextest run \
  --manifest-path e2e/rust/Cargo.toml \
  --target-dir e2e/rust/target \
  --features e2e-kubernetes \
  --test sandbox_lifecycle \
  --config-file "$PWD/.config/nextest.toml" \
  --profile e2e-kubernetes \
  --no-tests fail \
  -E "test(=$TEST)"

Expected: the gateway requires application authentication, the authentication check passes, and WRAPPER_COMMAND_REACHED appears, or Nextest starts running.

Actual: the gateway becomes Ready, but the wrapper exits 1 with:

ERROR: SECURITY HOLE — gateway accepted a certless request over the Route

Suggested UX (if applicable)

No response

Environment

• Date: October 29, 2026 (UTC).
• Upstream source: 4d4c15c133d40a50234ce9d2d198e5ba79b9553e.
• OpenShift: 4.22.21; cluster node: Linux amd64.
• Client: macOS arm64; official upstream OpenShell CLI v0.1.6, verified against
  its published release checksum.
• Gateway transport: passthrough OpenShift Route.
• Gateway Linux amd64 platform-manifest digest:
  sha256:1ff1d03f69c27195b906b39475f077b918526a1d6b1c80400ace55a4313a1217.
• Gateway pod SCC: restricted-v2; namespace MCS annotation present.
• The pinned supervisor and sandbox images were configured but not exercised by the minimal reproduction.

Logs

ERROR: SECURITY HOLE — gateway accepted a certless request over the Route