Assert the AI Gateway CA method, not its mount path

Andrew Dunnrequested to merge
fix/aigw-ca-drift into main

What

The drift check asserts the AI Gateway install doc's custom CA method instead of one container path.

Why

The scheduled drift check failed on one assertion. Upstream commit 467b5a87 (2026-10-16) rewrote the Docker CA section and moved the mount from /tmp/ca-certificates.crt to /etc/ai-gateway/certs/ca-certificates.crt. The method is unchanged: copy the image's bundle, append the private CA, mount it read-only, and set REQUESTS_CA_BUNDLE and SSL_CERT_FILE. aigw start already does exactly that, so the gateway setup needs no change.

How

gce/drift-check.sh replaces the single path assertion with three: a read-only mount of a bundle at any path ending in ca-certificates.crt, and the Docker -e form of both variables.

Verification

  • Against current upstream master: 155 passed, 0 failed.
  • With the mount pattern deliberately broken: 154 passed, 1 failed, naming the assertion.
  • just ci passes.

Merge request reports