Method validate_tls_config

crates/openshell-driver-podman/src/config.rs:154–180

Validate TLS configuration consistency. Returns `Ok(())` when either all three TLS paths are set (full mTLS) or none are set (plaintext). Returns an error naming the missing fields when only a subset is provided — this prevents silent fallback to plaintext when an operator partially configures mTLS.

(&self)

    /// fields when only a subset is provided — this prevents silent
    /// fallback to plaintext when an operator partially configures mTLS.
    pub fn validate_tls_config(&self) -> Result<(), crate::client::PodmanApiError> {
        let has_ca = self.guest_tls_ca.is_some();
        let has_cert = self.guest_tls_cert.is_some();
        let has_key = self.guest_tls_key.is_some();

        // All set or none set — both are valid.
        if (has_ca && has_cert && has_key) || (!has_ca && !has_cert && !has_key) {
            return Ok(());
        }

        let mut missing = Vec::new();
        if !has_ca {
            missing.push("--podman-tls-ca / OPENSHELL_PODMAN_TLS_CA");
        }
        if !has_cert {
            missing.push("--podman-tls-cert / OPENSHELL_PODMAN_TLS_CERT");
        }
        if !has_key {
            missing.push("--podman-tls-key / OPENSHELL_PODMAN_TLS_KEY");
        }

        Err(crate::client::PodmanApiError::InvalidInput(format!(
            "Partial TLS configuration: all three TLS paths must be provided together. \
             Missing: {}",
            missing.join(", ")
        )))
    }

    /// Validate runtime resource-limit configuration.
    pub fn validate_runtime_limits(&self) -> Result<(), crate::client::PodmanApiError> {