test(e2e): cover Podman token exchange grants

Signed-off-by: Gordon Sim <gsim@redhat.com>

Author: grs

crates/openshell-core/src/driver_utils.rs

@@ -72,6 +72,9 @@ pub const TLS_KEY_MOUNT_PATH: &str = "/etc/openshell/tls/client/tls.key";
 /// Container-side mount path for the per-sandbox JWT token.
 pub const SANDBOX_TOKEN_MOUNT_PATH: &str = "/etc/openshell/auth/sandbox.jwt";
 
+/// Container-side directory where the provider SPIFFE Workload API socket is mounted.
+pub const PROVIDER_SPIFFE_WORKLOAD_API_SOCKET_MOUNT_DIR: &str = "/spiffe-workload-api";
+
 /// Return the XDG state path for a driver's sandbox JWT token file.
 ///
 /// The resulting path is `$XDG_STATE_HOME/openshell/<driver_subdir>[/<namespace>]/<sandbox_id>/sandbox.jwt`.

crates/openshell-driver-podman/src/config.rs

@@ -126,6 +126,9 @@ pub struct PodmanComputeConfig {
     /// `template.driver_config`.
     #[serde(default)]
     pub enable_bind_mounts: bool,
+    /// Host path to a SPIFFE Workload API Unix socket exposed to sandbox
+    /// supervisors for provider token exchange client assertions.
+    pub provider_spiffe_workload_api_socket: Option<PathBuf>,
     /// Health check interval in seconds for sandbox containers.
     ///
     /// Podman runs the health check command at this interval to determine
@@ -261,6 +264,7 @@ impl Default for PodmanComputeConfig {
             guest_tls_key: None,
             sandbox_pids_limit: DEFAULT_SANDBOX_PIDS_LIMIT,
             enable_bind_mounts: false,
+            provider_spiffe_workload_api_socket: None,
             health_check_interval_secs: DEFAULT_HEALTH_CHECK_INTERVAL_SECS,
         }
     }
@@ -284,6 +288,10 @@ impl std::fmt::Debug for PodmanComputeConfig {
             .field("guest_tls_key", &self.guest_tls_key)
             .field("sandbox_pids_limit", &self.sandbox_pids_limit)
             .field("enable_bind_mounts", &self.enable_bind_mounts)
+            .field(
+                "provider_spiffe_workload_api_socket",
+                &self.provider_spiffe_workload_api_socket,
+            )
             .field(
                 "health_check_interval_secs",
                 &self.health_check_interval_secs,

crates/openshell-driver-podman/src/container.rs

@@ -56,6 +56,8 @@ const TLS_CA_MOUNT_PATH: &str = openshell_core::driver_utils::TLS_CA_MOUNT_PATH;
 const TLS_CERT_MOUNT_PATH: &str = openshell_core::driver_utils::TLS_CERT_MOUNT_PATH;
 const TLS_KEY_MOUNT_PATH: &str = openshell_core::driver_utils::TLS_KEY_MOUNT_PATH;
 const SANDBOX_TOKEN_MOUNT_PATH: &str = openshell_core::driver_utils::SANDBOX_TOKEN_MOUNT_PATH;
+const PROVIDER_SPIFFE_WORKLOAD_API_SOCKET_MOUNT_DIR: &str =
+    openshell_core::driver_utils::PROVIDER_SPIFFE_WORKLOAD_API_SOCKET_MOUNT_DIR;
 
 /// Directory inside sandbox containers where the supervisor binary is mounted.
 const SUPERVISOR_MOUNT_DIR: &str = openshell_core::driver_utils::SUPERVISOR_CONTAINER_DIR;
@@ -406,6 +408,13 @@ fn build_env(
         );
     }
 
+    if let Some(socket_path) = provider_spiffe_workload_api_socket_env_value(config) {
+        env.insert(
+            openshell_core::sandbox_env::PROVIDER_SPIFFE_WORKLOAD_API_SOCKET.into(),
+            socket_path,
+        );
+    }
+
     env.remove(openshell_core::sandbox_env::SANDBOX_TOKEN);
     env.remove(openshell_core::sandbox_env::SANDBOX_TOKEN_FILE);
 
@@ -1013,6 +1022,18 @@ pub fn build_container_spec_with_token_and_gpu_devices(
                     options: ro,
                 });
             }
+            if let Some(path) = provider_spiffe_workload_api_socket_mount_source(config) {
+                let mut ro = vec!["ro".into(), "rbind".into()];
+                if is_selinux_enabled() {
+                    ro.push("z".into());
+                }
+                m.push(Mount {
+                    kind: "bind".into(),
+                    source: path.display().to_string(),
+                    destination: PROVIDER_SPIFFE_WORKLOAD_API_SOCKET_MOUNT_DIR.into(),
+                    options: ro,
+                });
+            }
             m.extend(user_mounts.mounts);
             m
         },
@@ -1029,6 +1050,33 @@ pub fn build_container_spec_with_token_and_gpu_devices(
     Ok(serde_json::to_value(container_spec).expect("ContainerSpec serialization cannot fail"))
 }
 
+fn provider_spiffe_workload_api_socket_env_value(config: &PodmanComputeConfig) -> Option<String> {
+    let host_path = config.provider_spiffe_workload_api_socket.as_ref()?;
+    let raw = host_path.to_str()?;
+    if raw.starts_with("tcp:") {
+        return Some(raw.to_string());
+    }
+    let host_path = raw
+        .strip_prefix("unix:")
+        .map_or(host_path.as_path(), Path::new);
+    let file_name = host_path.file_name()?.to_str()?;
+    Some(format!(
+        "{PROVIDER_SPIFFE_WORKLOAD_API_SOCKET_MOUNT_DIR}/{file_name}"
+    ))
+}
+
+fn provider_spiffe_workload_api_socket_mount_source(config: &PodmanComputeConfig) -> Option<&Path> {
+    let host_path = config.provider_spiffe_workload_api_socket.as_ref()?;
+    let raw = host_path.to_str()?;
+    if raw.starts_with("tcp:") {
+        return None;
+    }
+    let host_path = raw
+        .strip_prefix("unix:")
+        .map_or(host_path.as_path(), Path::new);
+    host_path.parent()
+}
+
 fn hostadd_entries(config: &PodmanComputeConfig) -> Vec<String> {
     let host_gateway_ip = config.host_gateway_ip.trim();
     if host_gateway_ip.is_empty() {
@@ -2234,6 +2282,33 @@ mod tests {
         }));
     }
 
+    #[test]
+    fn container_spec_includes_provider_spiffe_socket_when_configured() {
+        let sandbox = test_sandbox("spiffe-id", "spiffe-name");
+        let mut config = test_config();
+        config.provider_spiffe_workload_api_socket =
+            Some(std::path::PathBuf::from("/host/spire-agent.sock"));
+
+        let spec = build_container_spec(&sandbox, &config);
+
+        let env_map = spec["env"].as_object().expect("env should be an object");
+        assert_eq!(
+            env_map
+                .get(openshell_core::sandbox_env::PROVIDER_SPIFFE_WORKLOAD_API_SOCKET)
+                .and_then(|v| v.as_str()),
+            Some("/spiffe-workload-api/spire-agent.sock"),
+        );
+
+        let mounts = spec["mounts"]
+            .as_array()
+            .expect("mounts should be an array");
+        assert!(mounts.iter().any(|m| {
+            m["type"].as_str() == Some("bind")
+                && m["source"].as_str() == Some("/host")
+                && m["destination"].as_str() == Some(PROVIDER_SPIFFE_WORKLOAD_API_SOCKET_MOUNT_DIR)
+        }));
+    }
+
     #[test]
     fn container_spec_omits_tls_without_config() {
         let sandbox = test_sandbox("notls-id", "notls-name");