test(conformance): port the credential gating e2e tests

TESTING.md

@@ -424,11 +424,12 @@ Suites:
 
 - Common suite (`--features e2e`) - driver-neutral CLI behavior, sandbox lifecycle, sync, port forwarding, policy, and provider tests.
 - Conformance (`tests/suites/conformance`) - the testkit `conformance` crate:
-  lifecycle, the CLI, persistent workspaces, file transfer, and the policy
-  advisor. Driver E2E runs it with `openshell-conformance` against the lane's
-  gateway and writes a JUnit report under `results/`; set
-  `OPENSHELL_CONFORMANCE_BIN` to use a prebuilt program, as Branch E2E does
-  with the static build it makes once per architecture. The
+  lifecycle, the CLI, persistent workspaces, file transfer, the policy
+  advisor, and credential gating. Driver E2E runs it with
+  `openshell-conformance` against the lane's gateway and writes a JUnit report
+  under `results/`; set `OPENSHELL_CONFORMANCE_BIN` to use a prebuilt program,
+  as Branch E2E does with the static build it makes once per architecture.
+  The
   installed-artifact conformance lanes run the same crate through
   `openshell-test-runner` (see above).
 - Driver suites (`--features e2e-docker`, `e2e-podman`, `e2e-kubernetes`, or
@@ -656,6 +657,8 @@ explains the isolation backend separation behind the capability-free runtime.
 On a **remote** cluster, drop the `e2e-host-gateway` feature. Those tests rely
 on the sandbox-side `host.openshell.internal` alias reaching the machine running
 the tests, which is unreachable from pods on a remote cluster, so they fail.
+The conformance suite requires the alias to reach that machine too, for its
+`credential_gating` tests; the feature selection doesn't skip them.
 Left enabled, the `host_gateway_alias` suite fails because
 `host.openshell.internal` does not resolve inside the pod, so the gateway
 SSRF-denies the request (`DNS resolution failed` / `ssrf_denied`) — a networking

e2e/helm-plugins/openshell-external-compute-driver/host-gateway/driver-env-patch.yaml

@@ -0,0 +1,15 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: openshell
+spec:
+  template:
+    spec:
+      containers:
+        - name: kubernetes-compute-driver
+          env:
+            - name: OPENSHELL_HOST_GATEWAY_IP
+              value: replaced-by-kustomize

e2e/helm-plugins/openshell-external-compute-driver/host-gateway/kustomization.yaml

@@ -0,0 +1,30 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# The in-process driver reads server.hostGatewayIP from the rendered gateway
+# TOML. The external driver reads it from its own environment, so copy the
+# chart's rendered value into that container.
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+patches:
+  - path: driver-env-patch.yaml
+    target:
+      group: apps
+      version: v1
+      kind: StatefulSet
+      name: openshell
+replacements:
+  - source:
+      group: apps
+      version: v1
+      kind: StatefulSet
+      name: openshell
+      fieldPath: spec.template.spec.hostAliases.0.ip
+    targets:
+      - select:
+          group: apps
+          version: v1
+          kind: StatefulSet
+          name: openshell
+        fieldPaths:
+          - spec.template.spec.containers.[name=kubernetes-compute-driver].env.[name=OPENSHELL_HOST_GATEWAY_IP].value

e2e/helm-plugins/openshell-external-compute-driver/post-renderer.sh

@@ -16,4 +16,12 @@ cp "${plugin_dir}/kustomization.yaml" "${work_dir}/kustomization.yaml"
 cp "${plugin_dir}/workload-patch.yaml" "${work_dir}/workload-patch.yaml"
 tee "${work_dir}/rendered.yaml" >/dev/null
 
+# server.hostGatewayIP renders the gateway pod's only hostAliases entry
+# (deploy/helm/openshell/templates/_gateway-workload.tpl), which the
+# host-gateway component copies from hostAliases.0.ip.
+if grep -q '^ *hostAliases:' "${work_dir}/rendered.yaml"; then
+  cp -R "${plugin_dir}/host-gateway" "${work_dir}/host-gateway"
+  printf 'components:\n  - host-gateway\n' >>"${work_dir}/kustomization.yaml"
+fi
+
 kubectl kustomize "${work_dir}"

e2e/rust/Cargo.toml

@@ -204,11 +204,6 @@ name = "websocket_conformance"
 path = "tests/websocket_conformance.rs"
 required-features = ["e2e-host-gateway"]
 
-[[test]]
-name = "credential_gating"
-path = "tests/credential_gating.rs"
-required-features = ["e2e-host-gateway"]
-
 [[test]]
 name = "user_namespaces"
 path = "tests/user_namespaces.rs"

e2e/rust/e2e-podman.sh

@@ -25,7 +25,6 @@ PODMAN_CI_TESTS=(
   bypass_detection
   ephemeral_cleanup
   core_dump_hardening
-  credential_gating
   default_image
   driver_config_volume
   edge_tunnel_e2e