fix(ssh): remove auto-generated SSH CA option

[minhtule]

Related Tickets & Documents

• Issue: Gateway SSH host identity changes on every restart #369

Changes

• Remove the auto-generated in-memory CA; ssh.ca (manual or vault) is now required when SSH is enabled
• Helm chart now fails rendering when ssh.enabled is true and ssh.ca is unset (previously only when replicaCount > 1)

Notes

The auto-generated CA lived only in memory, so its identity changed on every restart and
across replicas, causing host-key mismatch warnings. Requiring an explicit CA keeps it stable.

[codecov]

Codecov Report

❌ Patch coverage is 80.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 86.18%. Comparing base (87cec37) to head (fd5bb57).
⚠️ Report is 4 commits behind head on master.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
internal/config/config.go	33.33%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #371      +/-   ##
==========================================
+ Coverage   86.17%   86.18%   +0.01%     
==========================================
  Files          40       40              
  Lines        2828     2816      -12     
==========================================
- Hits         2437     2427      -10     
+ Misses        265      264       -1     
+ Partials      126      125       -1     

Flag	Coverage Δ
integration	55.28% <50.00%> (+0.27%)	⬆️
unit	78.51% <70.00%> (-0.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
internal/sshhandler/ca.go	78.68% <100.00%> (-0.73%)	⬇️
internal/sshhandler/config.go	80.95% <100.00%> (ø)
internal/config/config.go	88.88% <33.33%> (+0.08%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR removes the auto-generated in-memory SSH CA behavior and makes an explicitly configured SSH CA mandatory (manual key file or Vault) whenever SSH is enabled, ensuring stable SSH host identity across restarts/replicas.

Changes:

• Enforce “CA required” in Go config validation and in SSH CA construction (no more auto-generated fallback).
• Update Go unit tests to provide a manual CA config where needed and to assert missing-CA errors.
• Update Helm chart behavior/tests/snapshots to fail rendering when ssh.enabled: true without a configured CA, and refresh related documentation.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/sshhandler/proxy_test.go	Adds a manual CA config to keep SSH handler tests passing under the new requirement.
internal/sshhandler/config_test.go	Updates config creation test to include manual CA.
internal/sshhandler/ca.go	Removes auto-generated CA fallback; returns ErrMissingCAConfig when CA is unset.
internal/sshhandler/ca_test.go	Removes auto-generated CA test; updates expectations for missing CA config.
internal/proxy/proxy_test.go	Updates proxy tests to include a manual CA config.
internal/config/config.go	Updates SSH CA validation to require exactly one of manual/vault; introduces ErrMissingCAConfig.
internal/config/config_test.go	Updates validation tests to expect an error when CA config is missing.
deploy/gateway/values.yaml	Updates values documentation to state CA is required when SSH is enabled.
deploy/gateway/tests/snapshot_test.yaml	Adds manual CA values so snapshot rendering remains valid.
deploy/gateway/tests/gateway-configmap_test.yaml	Removes test that asserted SSH config could be rendered without a CA.
deploy/gateway/tests/deployment_test.yaml	Updates tests to assert render failure when SSH enabled without CA; adjusts other cases to include Vault config.
deploy/gateway/tests/snapshot/snapshot_test.yaml.snap	Updates rendered snapshot to include manual CA secret/mount/configmap content.
deploy/gateway/templates/deployment.yaml	Changes Helm rendering guard to fail when SSH is enabled and CA is missing.
CLAUDE.md	Updates SSH security documentation to remove auto-generated CA option.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

[clement0010]

Fix & merge!

[Copilot]

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated no new comments.