didericis
0ddaa95c14
prd-number-check / require-numbered-prds (pull_request) Successful in 6s
tracker-policy-pr / check-pr (pull_request) Successful in 7s
lint / lint (push) Successful in 55s
test / unit (pull_request) Successful in 47s
test / integration-docker (pull_request) Failing after 2m24s
test / coverage (pull_request) Has been skipped
The #450 CA-persistence fix was only implemented for the docker backend (the host_gateway_ca_dir bind-mount). The firecracker gateway booted with no persistent volume, so its mitmproxy CA lived only in the ephemeral per-boot rootfs — every rebuild/restart minted a fresh CA that every already-running bottle distrusted, failing egress TLS with "SSL certificate verification failed". Give the gateway VM a persistent CA volume, mirroring the orchestrator's registry volume: boot with a small ext4 data_drive (_ensure_ca_volume) and mount it at mitmproxy's confdir in the gateway guest init, before the data plane starts, so mitmproxy reuses the on-disk CA instead of regenerating it. Closes #510 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>