[jglogan]

Summary

Vminitd connects to the guest agent by wrapping an already-connected vsock with HTTP2ClientTransport.WrappedChannel.wrapping(...). There is no target address to derive an :authority from and Config.http2.authority defaults to nil, so the client sends requests with no :authority header.

This sets http2.authority explicitly, keeping the existing connection.maxIdleTime = nil setting. The configuration is factored into Vminitd.transportConfig() so it can be tested.

This is precautionary, not a bug fix

The guest agent is served by grpc-swift, which does not reject requests without an :authority, so nothing is broken today. The reason to do this is that grpc-go v1.82.2, v1.83.2 and v1.84.0 and later do reject them with Internal: "no host or :authority header present" (grpc/grpc-go#9365). A client that wraps a pre-connected socket the way this one does stops working against any server that enforces it. apple/container hit this with its builder shim, which is a grpc-go server (apple/container#2428 sets an authority there). Sending one here keeps this client compatible if the server stack changes, and the tests stop the configuration from silently returning to the defaults.

The authority value is not significant: the agent does not route on it and there is no TLS. "vminitd" is a valid host name.

Testing

Added VminitdTransportConfigTests:

• the transport configuration carries a non-empty :authority;
• the idle timeout stays disabled (the connection to the guest agent is long-lived), since it shares the configuration that changed.

Both pass with swift test --filter VminitdTransportConfigTests. I have not run a full container workload through the changed client, so the effect on a live vminitd connection is untested; grpc-swift servers do not validate the header, so I expect none.