fix(helm): scope OIDC CA trust to the OIDC client

[grs]

Summary

Scope private OIDC CA trust to discovery and JWKS requests instead of configuring it process-wide. This preserves platform trust roots for unrelated gateway HTTPS clients and avoids unnecessarily broad trust
in the issuer CA.

Related Issue

Fixes #3672

Changes

• Add an optional OIDC CA bundle to gateway TOML, CLI, and environment configuration
• Build the OIDC HTTP client with native roots augmented by the configured certificates
• Fail startup with clear errors for unreadable, malformed, or empty CA bundles
• Render the mounted OIDC CA path under [openshell.gateway.oidc]
• Remove the Helm workload’s process-wide SSL_CERT_FILE
• Add gateway and Helm regression coverage
• Update gateway, Kubernetes, Helm, architecture, and agent-skill documentation

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[drew]

gator-agent

PR Review Status

This is a project-valid fix for #3672, and the OIDC trust scoping and accompanying documentation are directionally sound. One blocking startup-safety issue remains in the newly supported CA bundle path.

Action required: @grs, please make the CA bundle read bounded and reject non-regular files, with regression coverage for both cases.

Blocking findings:

• GATOR-83d0be75-01: the configured bundle path can block startup or exhaust gateway memory.

Carried findings:

• None

Non-blocking suggestions:

• None

Gator metadata

• Validation: Implements the reproducible, linked OIDC CA trust-boundary bug in #3672.
• Docs: Relevant Fern, Helm, architecture, and operator guidance is updated; navigation already contains the affected reference page.
• Checks: DCO and vouch pass; required branch and Helm checks have not run yet.
• E2E: Test-label decision deferred until blocking review feedback is resolved.
• Head SHA: 83d0be759092e5e82ac7336c94dd7c061008a011
• Base SHA: 6c864ec9ab5953f16fa0119ba18f2324ad53f7c1
• Merge base SHA: 6af5520f37a66c13b9ebfdc98af9481b94004a7d
• Patch ID: 11fd7b069074a907ce6dcff596a7be084e6aad9b
• Gator payload: 10
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:in-review

[github-actions]

Label test:e2e applied, but pull-request/3673 does not exist yet. A maintainer needs to comment /ok to test ca72b74d462c30516dd021298556013d26be8b38 to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[drew]

/ok to test ca72b74

[github-actions]

Label test:e2e applied for ca72b74. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[drew]

gator-agent

PR Review Status

The follow-up fixes the bounded-read startup-safety issue: OIDC CA bundles are now read off the async executor with regular-file and 1 MiB limits, and the delta adds coverage for oversized files, FIFOs, and devices. No blocking findings remain.

Blocking findings:

• No blocking findings remain

Carried findings:

• GATOR-83d0be75-01: resolved by the current bounded regular-file reader and regression coverage

Gator metadata

• Validation: Implements the reproducible, linked OIDC CA trust-boundary bug in #3672.
• Docs: Fern, Helm, architecture, and operator guidance document the scoped trust behavior and new file constraints.
• Checks: Current-head Branch Checks and Helm Lint are queued; DCO passes.
• E2E: test:e2e is applied and the current-head Branch E2E Checks run is queued.
• Head SHA: ca72b74d462c30516dd021298556013d26be8b38
• Base SHA: 6c864ec9ab5953f16fa0119ba18f2324ad53f7c1
• Merge base SHA: 6af5520f37a66c13b9ebfdc98af9481b94004a7d
• Patch ID: 9f15af3fcda3d7b8a13148c3c49066ddb0172810
• Gator payload: 10
• Review mode: follow_up
• Previous reviewed SHA: 83d0be759092e5e82ac7336c94dd7c061008a011
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline

[drew]

/ok to test 6588c76

[drew]

gator-agent

PR Review Status

The rebased author series preserves the previously reviewed bounded OIDC CA bundle handling and adapts the documentation to the repository's renamed gateway configuration page. No blocking findings remain.

Blocking findings:

• No blocking findings remain

Carried findings:

• GATOR-83d0be75-01: remains resolved; the current head retains regular-file and 1 MiB limits with regression coverage

Gator metadata

• Validation: Implements the reproducible, linked OIDC CA trust-boundary bug in #3672.
• Docs: The scoped trust behavior and file constraints are documented on the current Fern gateway configuration page; navigation includes that page.
• Checks: Current-head Branch Checks and Helm Lint are queued; DCO passes.
• E2E: test:e2e is applied, the copy-pr mirror matches the current head, and Branch E2E Checks is queued.
• Head SHA: 6588c7601ab21663ede66f479dc43effb36337f9
• Base SHA: 496ebba293f5cc2bb2753444dddd534f0b4aeb6a
• Merge base SHA: 73a181d32f42c1fa2782c4e5514fdbbc81ad8f38
• Patch ID: 7a29ce059367eb88c1659c1b1df088cbda494baa
• Gator payload: 10
• Review mode: follow_up
• Previous reviewed SHA: ca72b74d462c30516dd021298556013d26be8b38
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline