refactor(gateway): remove pre-generated debug keys - #999
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR removes the legacy “pre-generated debug key / KMS-signed cert” path from dstack-gateway and updates the gateway’s test infrastructure to obtain RPC TLS keys exclusively via the Guest Agent GetTlsKey API, including adding a test-local guest-agent-simulator container for the certbot E2E docker stack.
Changes:
- Removed
gen_debug_key,debug.key_file, and Gateway-side KMS signing dependencies/configuration. - Switched gateway cert generation to always use Guest Agent
GetTlsKey. - Updated certbot E2E docker-compose to run against a local
dstack-guest-agent-simulatorvia a shared Unix socket volume.
Reviewed changes
Copilot reviewed 18 out of 19 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| tools/dev-stack.sh | Drops gateway kms_url and debug attestation-skip stanza from the generated dev config. |
| dstack/gateway/test-run/test_suite.sh | Removes kms_url="" from generated configs used by the legacy WaveKV harness. |
| dstack/gateway/test-run/test_certbot.sh | Removes kms_url="" from generated configs used by the legacy distributed certbot harness. |
| dstack/gateway/test-run/proxy/gwconfig.py | Removes kms_url="" from the proxy integration test config emitter. |
| dstack/gateway/test-run/e2e/Dockerfile.simulator.dockerignore | Adds a dockerignore for the new simulator Dockerfile build to keep contexts small. |
| dstack/gateway/test-run/e2e/Dockerfile.simulator | Adds an image build for dstack-guest-agent-simulator for local E2E runs. |
| dstack/gateway/test-run/e2e/docker-compose.yml | Adds simulator service + shared socket volume; points gateways at unix:/var/run/dstack/dstack.sock. |
| dstack/gateway/test-run/e2e/configs/simulator.toml | Adds simulator config binding the internal API to the shared Unix socket. |
| dstack/gateway/test-run/e2e/configs/gateway-{1,2,3}.toml | Removes kms_url="" from gateway E2E configs. |
| dstack/gateway/test-run/cluster.sh | Removes kms_url="" from generated configs used by the legacy cluster harness. |
| dstack/gateway/src/main.rs | Removes debug-key/KMS signing flow; always calls Guest Agent GetTlsKey for RPC TLS material. |
| dstack/gateway/src/gen_debug_key.rs | Deletes obsolete debug key generator utility. |
| dstack/gateway/src/config.rs | Removes kms_url and debug.key_file from config structs. |
| dstack/gateway/gateway.toml | Removes kms_url and debug.key_file from the default config template. |
| dstack/gateway/docs/cluster-deployment.md | Removes kms_url from config examples. |
| dstack/gateway/Cargo.toml | Drops KMS/base64 deps and the gen_debug_key bin; removes ra-rpc client feature. |
| dstack/Cargo.lock | Removes gateway’s transitive deps related to the deleted debug-key/KMS flow. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
kvinwang
force-pushed
the
codex/remove-gateway-debug-key
branch
from
August 5, 2026 00:46
5d4322c to
8120cab
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
gen_debug_keyutility anddebug.key_filecertificate pathGetTlsKeyAPIdstack-guest-agent-simulatorcontainer instead of a hard-coded external simulator endpointdebug.insecure_skip_attestationremains available because it is still used by existing Gateway RPC and WaveKV test authorization paths; this PR only removes the pre-generated key and quote mechanism.Rationale
The static
debug_key.jsonbundle predates the supported simulator workflow. Keeping a private key, quote, event log, and VM configuration synchronized in a generated file bypasses the normal Guest Agent integration and makes tests depend on implementation-specific debug behavior. The local simulator now exercises the sameGetTlsKeypath used by deployments.Verification
cargo fmt --manifest-path dstack/Cargo.toml --allcargo check --manifest-path dstack/Cargo.toml -p dstack-gatewaycargo test --manifest-path dstack/Cargo.toml -p dstack-gateway --no-rundocker compose -f dstack/gateway/test-run/e2e/docker-compose.yml config --quiethealthygit diff --check