Description
stargate-k8s-router accepts --upstream-tls-cert-path, but currently rejects it when the tunnel protocol is Raw QUIC. Raw QUIC instead reuses the router serving certificate PEM as its outbound trust bundle.
That couples two separate TLS responsibilities:
- the worker-facing router server identity
- the trust bundle used when the router connects to an upstream Stargate pod
Extend the existing upstream trust option to Raw QUIC so operators can mount and configure a dedicated CA bundle. The explicit upstream bundle must take precedence over the serving certificate fallback and continue to enforce hostname verification. Existing configurations without the option should remain compatible until chart and deployment configuration can migrate.
Acceptance criteria
- Raw QUIC accepts
--upstream-tls-cert-path and STARGATE_UPSTREAM_TLS_CERT_PATH.
- The configured PEM bundle is used for upstream QUIC certificate verification.
- The router serving certificate and key remain the worker-facing server identity.
- Invalid or unreadable upstream bundles fail startup.
- WebTransport behavior remains unchanged.
- Unit tests cover explicit Raw QUIC trust, fallback compatibility, and invalid input.
By submitting this issue, you acknowledge that you are an assigned member of the NVCF development team and agree to follow the project code of conduct and contributing guidelines.
Description
stargate-k8s-routeraccepts--upstream-tls-cert-path, but currently rejects it when the tunnel protocol is Raw QUIC. Raw QUIC instead reuses the router serving certificate PEM as its outbound trust bundle.That couples two separate TLS responsibilities:
Extend the existing upstream trust option to Raw QUIC so operators can mount and configure a dedicated CA bundle. The explicit upstream bundle must take precedence over the serving certificate fallback and continue to enforce hostname verification. Existing configurations without the option should remain compatible until chart and deployment configuration can migrate.
Acceptance criteria
--upstream-tls-cert-pathandSTARGATE_UPSTREAM_TLS_CERT_PATH.By submitting this issue, you acknowledge that you are an assigned member of the NVCF development team and agree to follow the project code of conduct and contributing guidelines.