From 27957bf840b75bc82658912643aa980a21f6b5a5 Mon Sep 17 00:00:00 2001 From: Shivkumar Ople Date: Fri, 26 Jun 2026 15:02:21 +0530 Subject: [PATCH] [vgpu-manager] support custom CA certificate injection at build time Add an opt-in CUSTOM_CA_CERTS_DIR build arg to all four vGPU Manager Dockerfiles (rhel8, rhel9, ubuntu22.04, ubuntu24.04) and wire it through the Makefile build-vgpuhost-% target. Users behind a TLS-intercepting corporate proxy can drop *.crt files into vgpu-manager//certs/ and rebuild without editing the Dockerfile. The directory is empty by default, so out-of-the-box builds are unchanged. Signed-off-by: Shivkumar Ople --- Makefile | 6 ++++++ vgpu-manager/README.md | 28 +++++++++++++++++++++++++ vgpu-manager/rhel8/Dockerfile | 9 ++++++++ vgpu-manager/rhel8/certs/.gitkeep | 0 vgpu-manager/rhel9/Dockerfile | 9 ++++++++ vgpu-manager/rhel9/certs/.gitkeep | 0 vgpu-manager/ubuntu22.04/Dockerfile | 9 ++++++++ vgpu-manager/ubuntu22.04/certs/.gitkeep | 0 vgpu-manager/ubuntu24.04/Dockerfile | 9 ++++++++ vgpu-manager/ubuntu24.04/certs/.gitkeep | 0 10 files changed, 70 insertions(+) create mode 100644 vgpu-manager/rhel8/certs/.gitkeep create mode 100644 vgpu-manager/rhel9/certs/.gitkeep create mode 100644 vgpu-manager/ubuntu22.04/certs/.gitkeep create mode 100644 vgpu-manager/ubuntu24.04/certs/.gitkeep diff --git a/Makefile b/Makefile index 8c27ccc51..769762a2d 100644 --- a/Makefile +++ b/Makefile @@ -288,6 +288,11 @@ push-vgpuguest-%: DIST = $(word 3,$(subst -, ,$@)) # The vGPU host driver .run file is assumed to be present in the $SUBDIR/drivers/ directory. # VGPU_HOST_DRIVER_VERSION must be defined in the environment when invoking this target. VGPU_HOST_DRIVER_VERSION ?= "" +# CUSTOM_CA_CERTS_DIR is the path (relative to the build context +# vgpu-manager/$(SUBDIR)) of a directory containing custom CA certificates to +# trust at build time. Default is "certs", an empty directory shipped in the +# repo so the COPY in the Dockerfile is a no-op out of the box. +CUSTOM_CA_CERTS_DIR ?= certs build-vgpuhost-%: $(if $(VGPU_HOST_DRIVER_VERSION),,$(error "VGPU_HOST_DRIVER_VERSION is not set")) build-vgpuhost-%: DRIVER_VERSION := $(VGPU_HOST_DRIVER_VERSION) build-vgpuhost-%: DRIVER_BRANCH = $(word 1,$(subst ., ,${DRIVER_VERSION})) @@ -310,6 +315,7 @@ $(VGPU_HOST_DRIVER_BUILD_TARGETS): --build-arg GOLANG_VERSION="$(GOLANG_VERSION)" \ --build-arg CVE_UPDATES="$(CVE_UPDATES)" \ --build-arg CUDA_VERSION="$(CUDA_VERSION)" \ + --build-arg CUSTOM_CA_CERTS_DIR="$(CUSTOM_CA_CERTS_DIR)" \ $(DOCKER_BUILD_ARGS) \ --file $(DOCKERFILE) \ $(CURDIR)/vgpu-manager/$(SUBDIR) diff --git a/vgpu-manager/README.md b/vgpu-manager/README.md index 4d01a426f..230ecd65d 100644 --- a/vgpu-manager/README.md +++ b/vgpu-manager/README.md @@ -56,3 +56,31 @@ $ docker build \ --build-arg CUDA_VERSION=${CUDA_VERSION} \ -t ${PRIVATE_REGISTRY}/vgpu-manager:${VERSION}-${OS_TAG} . ``` + +### Building behind a TLS-intercepting (MITM) proxy + +If your build environment sits behind a corporate proxy that intercepts TLS +connections with a private CA, package manager steps (``dnf``/``yum`` on RHEL, +``apt`` on Ubuntu) will fail with SSL certificate verification errors. + +To trust additional CAs at build time, drop one or more PEM-encoded +``*.crt`` files into the ``certs/`` directory inside the OS-specific build +context (``vgpu-manager//certs/``) and rebuild — no Dockerfile edits +required. The directory is empty by default, so the trust update is a no-op +when no certificates are provided. + +Example: + +``` +$ cp /path/to/CorporateRootCA.crt vgpu-manager//certs/ +$ docker build \ + --build-arg DRIVER_VERSION=${VERSION} \ + --build-arg CUDA_VERSION=${CUDA_VERSION} \ + -t ${PRIVATE_REGISTRY}/vgpu-manager:${VERSION}-${OS_TAG} \ + vgpu-manager/ +``` + +To use a directory other than ``certs/``, override the ``CUSTOM_CA_CERTS_DIR`` +build arg with a path relative to the build context. When invoking the +top-level ``Makefile`` ``build-vgpuhost-`` target, set the +``CUSTOM_CA_CERTS_DIR`` make variable to the same effect. diff --git a/vgpu-manager/rhel8/Dockerfile b/vgpu-manager/rhel8/Dockerfile index 34e5c0f9a..8131a230d 100644 --- a/vgpu-manager/rhel8/Dockerfile +++ b/vgpu-manager/rhel8/Dockerfile @@ -6,6 +6,15 @@ ARG DRIVER_ARCH=x86_64 ENV DRIVER_ARCH=$DRIVER_ARCH ARG GIT_COMMIT="" +# Optional: inject custom CA certificates so package managers (dnf/yum) can +# verify TLS when building behind a corporate MITM proxy. Drop one or more +# *.crt files into the build context's "certs/" directory (the default), or +# override CUSTOM_CA_CERTS_DIR with a path to a different directory inside +# the build context. When the directory is empty, this is a no-op. +ARG CUSTOM_CA_CERTS_DIR=certs +COPY ${CUSTOM_CA_CERTS_DIR}/ /etc/pki/ca-trust/source/anchors/ +RUN update-ca-trust + RUN mkdir -p /driver WORKDIR /driver COPY NVIDIA-Linux-${DRIVER_ARCH}-${DRIVER_VERSION}-vgpu-kvm.run . diff --git a/vgpu-manager/rhel8/certs/.gitkeep b/vgpu-manager/rhel8/certs/.gitkeep new file mode 100644 index 000000000..e69de29bb diff --git a/vgpu-manager/rhel9/Dockerfile b/vgpu-manager/rhel9/Dockerfile index 5b59b73e0..de5d38052 100644 --- a/vgpu-manager/rhel9/Dockerfile +++ b/vgpu-manager/rhel9/Dockerfile @@ -19,6 +19,15 @@ ARG DRIVER_ARCH=x86_64 ENV DRIVER_ARCH=$DRIVER_ARCH ARG GIT_COMMIT="" +# Optional: inject custom CA certificates so package managers (dnf/yum) can +# verify TLS when building behind a corporate MITM proxy. Drop one or more +# *.crt files into the build context's "certs/" directory (the default), or +# override CUSTOM_CA_CERTS_DIR with a path to a different directory inside +# the build context. When the directory is empty, this is a no-op. +ARG CUSTOM_CA_CERTS_DIR=certs +COPY ${CUSTOM_CA_CERTS_DIR}/ /etc/pki/ca-trust/source/anchors/ +RUN update-ca-trust + RUN mkdir -p /driver WORKDIR /driver COPY NVIDIA-Linux-${DRIVER_ARCH}-${DRIVER_VERSION}-vgpu-kvm.run . diff --git a/vgpu-manager/rhel9/certs/.gitkeep b/vgpu-manager/rhel9/certs/.gitkeep new file mode 100644 index 000000000..e69de29bb diff --git a/vgpu-manager/ubuntu22.04/Dockerfile b/vgpu-manager/ubuntu22.04/Dockerfile index 0127e3bcb..5b1abb861 100644 --- a/vgpu-manager/ubuntu22.04/Dockerfile +++ b/vgpu-manager/ubuntu22.04/Dockerfile @@ -6,6 +6,15 @@ ARG DRIVER_ARCH=x86_64 ENV DRIVER_ARCH=$DRIVER_ARCH ARG GIT_COMMIT="" +# Optional: inject custom CA certificates so apt can verify TLS when building +# behind a corporate MITM proxy. Drop one or more *.crt files into the build +# context's "certs/" directory (the default), or override CUSTOM_CA_CERTS_DIR +# with a path to a different directory inside the build context. When the +# directory is empty, this is a no-op. +ARG CUSTOM_CA_CERTS_DIR=certs +COPY ${CUSTOM_CA_CERTS_DIR}/ /usr/local/share/ca-certificates/ +RUN update-ca-certificates + # Remove cuda repository to avoid GPG errors RUN rm /etc/apt/sources.list.d/cuda*.list diff --git a/vgpu-manager/ubuntu22.04/certs/.gitkeep b/vgpu-manager/ubuntu22.04/certs/.gitkeep new file mode 100644 index 000000000..e69de29bb diff --git a/vgpu-manager/ubuntu24.04/Dockerfile b/vgpu-manager/ubuntu24.04/Dockerfile index 42c5596f9..020d0c404 100644 --- a/vgpu-manager/ubuntu24.04/Dockerfile +++ b/vgpu-manager/ubuntu24.04/Dockerfile @@ -6,6 +6,15 @@ ARG DRIVER_ARCH=x86_64 ENV DRIVER_ARCH=$DRIVER_ARCH ARG GIT_COMMIT="" +# Optional: inject custom CA certificates so apt can verify TLS when building +# behind a corporate MITM proxy. Drop one or more *.crt files into the build +# context's "certs/" directory (the default), or override CUSTOM_CA_CERTS_DIR +# with a path to a different directory inside the build context. When the +# directory is empty, this is a no-op. +ARG CUSTOM_CA_CERTS_DIR=certs +COPY ${CUSTOM_CA_CERTS_DIR}/ /usr/local/share/ca-certificates/ +RUN update-ca-certificates + # Remove cuda repository to avoid GPG errors RUN rm /etc/apt/sources.list.d/cuda*.list diff --git a/vgpu-manager/ubuntu24.04/certs/.gitkeep b/vgpu-manager/ubuntu24.04/certs/.gitkeep new file mode 100644 index 000000000..e69de29bb