trending/substrate
1
0
Fork 0
mirror of https://github.com/agent-substrate/substrate.git synced 2026-11-11 10:23:17 +08:00
Code Issues Packages Projects Releases Wiki Activity
390 Commits 8 Branches 11 Tags
5bf19fcae82cfa0251c9debece8b98cd0802ebac
Commit Graph
71 Commits
Author SHA1 Message Date
Luiz Oliveira 9490650566 Add autoscaled-workerpool demo using HPA and prometheus-adapter on Kind (#576) 
This introduces a new demo (`demos/autoscaled-workerpool`) demonstrating
how to dynamically autoscale a WorkerPool using HPA +
`prometheus-adapter` on a local Kind cluster.

As mentioned in https://github.com/agent-substrate/substrate/issues/198,
this approach may be too slow for some use cases, but this is a good
first milestone.

Plus, there are some limitations with scaling workerpools that still
need to be addressed, for example:

- Scale-down can strand paused actors. When a worker pod is removed, a
local-snapshot paused actor keeps its node pin pointing at a node that
may no longer have (free) worker pods.
- Scale-up gives no locality guarantee: If there are multiple
local-snapshot paused actors that can't resume because no worker pods
are available on their node, upscaling will not unblock them: the added
capacity can land anywhere, so the pool can grow without ever placing a
worker where a stranded actor needs it.
- Scale-down picks victims blind to actor assignment (can kill busy
pods).

- [x] Tests pass: n/a
- [x] Appropriate changes to documentation are included in the PR
 2026-07-29 14:48:22 -04:00
Haven Xia dc88f9a32f Fix the issue that run-e2e.sh doesn't work on bash 3.2 macos. (#571) 
run-e2e.sh always fail on my mac with ` line 106: go_test_args[@]:
unbound variable,exit`, asked Claude code and fix related Bash 3.2
problem in scripts.

- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR
 2026-07-29 14:04:59 -04:00
Omer Yahud 8f64f67f82 Add request-parking demo 
An oversubscribed WorkerPool (2 workers, several actors) that exercises the router parking path: requests to a saturated pool park and retry instead of failing fast, and are served once capacity frees up. Includes load.sh and --deploy-demo-parking / --delete-demo-parking wiring in hack/install-ate.sh.
 2026-07-28 23:55:51 -07:00
Julian Gutierrez Oschmann 40da2c9a96 Prefactoring: Delete agent-secret demo. 
This demo is broken now that we require authn to ate-apiserver. The
fix is not trivial as it requires the actor to be able to authenticate, plus
it doesn't really adds much.
 2026-07-28 08:27:13 -07:00
Chuang Wang 474f3d2252 Wait on the correct Deployment name when deploying atenet-dns (#542) 
The Deployment in `atenet-dns.yaml` is named `dns`; every other resource
in that file is `atenet-dns`. The installer waited on the filename
rather than the actual Deployment, so this step failed with NotFound on
every otherwise-successful deploy.
 2026-07-27 12:04:08 -04:00
Zoe Zhao 9890219151 Added mTLS between ate system components (#237) 
Part of [#170](https://github.com/agent-substrate/substrate/issues/170)
Establishes mutual TLS between all ate system components, and updates
the certificate plumbing it depends on.

Main changes:
1. The atenet router now verifies ate apiserver' serving certificate,
and presents its client cert to ate apiserver. Previously the connection
used `InsecureSkipVerify`.
2. AteApi server verifies atelet's serving cert.

Minor bug fixes:
1. Prevent `servicednssigner` from signing a cert with no DNS SANs. Also
updated valkey cluster's cert configuration, because it was relying on
the cert with empty DNS.

- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR
 2026-07-24 15:43:03 -07:00
Michelle Au 9300387fef Add basic per-actor external volume flow (#405) 
Initial part of #232.

Extends the ActorTemplate API to add support for per-actor external
volumes and adds control plane and atelet hooks following the Actor
lifecycle.

Callouts to volume operations are abstracted with a Volume interface.
Right now, only a mock volume plugin for testing has been implemented,
but we will add CSI support next.

- [x] Tests pass
- [ ] Appropriate changes to documentation are included in the PR - Not
going to update documentation until we add CSI support.
 2026-07-24 14:40:26 -07:00
Haven Xia 5f6f14c5c8 Generalize rootful test execution via internal/roottest discovery (#507) 
Fix #501

Tests that need root (overlay mounts, mknod, `trusted.*` xattrs, ...)
call `roottest.Require(t, ...)` from
[internal/roottest](internal/roottest) as their first statement. They
skip in a plain `go test ./...`; CI reruns every package whose tests
import that package under `sudo`.

- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR
 2026-07-23 18:39:39 -07:00
Benjamin Elder f7f8727ae8 microvm: bump runtime assets to kata 4.0.0 + virtiofsd v1.14.0 (#506) 
- We no longer need to compile virtiofsd when installing for amd64, we
still need to for arm64 (no upstream release)
- Drop-in compatible, only updating the scripts that manage obtaining
the binaries, and the versions / hashes in the config.

- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR
 2026-07-23 18:45:08 -04:00
dependabot[bot] 9e2a669e33 build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 in /hack/tools/ko (#497) 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from
1.81.1 to 1.82.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's
releases</a>.</em></p>
<blockquote>
<h2>Release 1.82.1</h2>
<h1>Security</h1>
<ul>
<li>server: Stop reading from the connection when flooded by HTTP/2
frames. The default value for this limit is 100 frames, excluding DATA
and HEADERS, and may be changed by setting environment variable
<code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li>
<li>xds/rbac: Support <code>Metadata</code> and
<code>RequestedServerName</code> permissions matcher fields. If present
in a DENY rule, previously these would be ignored and fail-open.</li>
<li>xds/rbac: Fix panic when parsing unsupported fields in
<code>NotRule</code>/<code>NotId</code> permissions.</li>
<li>xds/rbac: Support the deprecated <code>source_ip</code> principal
identifier by treating it as equivalent to
<code>direct_remote_ip</code>.</li>
</ul>
<h2>Release 1.82.0</h2>
<h1>Behavior Changes</h1>
<ul>
<li>server: Remove support for
<code>GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING</code>
environment varibale. Strict incoming RPC path validation (which has
been the default since <code>v1.79.3</code>) can no longer be disabled.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9112">#9112</a>)</li>
<li>transport: Add environment variable to change the default max header
list size from <code>16MB</code> to <code>8KB</code>. This may be
enabled by setting
<code>GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true</code>.
This will be enabled by default in a subsequent release. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9019">#9019</a>)</li>
<li>balancer: Load Balancing policy registry is now case-sensitive. Set
<code>GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false</code>
(and file an issue) to revert to case-insensitive behavior. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9017">#9017</a>)</li>
</ul>
<h1>New Features</h1>
<ul>
<li>experimental/stats: Expose a new API,
<code>NewContextWithLabelCallback</code>, to register a callback that is
invoked when telemetry labels are added. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8877">#8877</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/seth-epps"><code>@​seth-epps</code></a></li>
</ul>
</li>
<li>client: Return a portion of the response body in the error message,
when the client receives an unexpected non-gRPC HTTP response, to make
debugging easier. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/chengxilo"><code>@​chengxilo</code></a></li>
</ul>
</li>
<li>server: Add environment variable
<code>GRPC_GO_SERVER_GOROUTINE_LABELS</code> that controls setting
<code>runtime/pprof.Labels</code> on goroutines spawned by the server.
Set <code>GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true</code> to add
the <code>grpc.method</code> label on goroutines spawned to handle
incoming requests. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/dfinkel"><code>@​dfinkel</code></a></li>
</ul>
</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>xds/server: Fix a memory leak of HTTP filter instances occurring
when route configurations are updated in-place during a Route Discovery
Service (RDS) update. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9138">#9138</a>)</li>
<li>grpc: In the deprecated <code>gzip</code> Compressor (used via the
deprecated <code>WithCompressor</code> dial option), enforce the
<code>MaxRecvMsgSize</code> limit on the decompressed message buffer,
preventing excessive memory allocation from highly compressed payloads.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9114">#9114</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/evilgensec"><code>@​evilgensec</code></a></li>
</ul>
</li>
<li>stats/opentelemetry: Record retry attempts,
<code>grpc.previous-rpc-attempts</code>, at the call level and not the
attempt level. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8923">#8923</a>)</li>
<li>encoding: Ensure <code>Close()</code> is always called on readers
returned from <code>Compressor.Decompress</code> if possible. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9135">#9135</a>)</li>
<li>channelz: Fix the <code>LastMessageSentTimestamp</code> and
<code>LastMessageReceivedTimestamp</code> fields in
<code>SocketMetrics</code> to ensure they contain correct timestamp
values. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9109">#9109</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/grpc/grpc-go/commit/ebd8f06a09426fbece97157c95c3917abff28f4e"><code>ebd8f06</code></a>
Change version to 1.82.1 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9238">#9238</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935"><code>4ea465d</code></a>
Cherry-pick commits (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9236">#9236</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/9494a2cf32a0ec9d35420af401445ef3c9f66f05"><code>9494a2c</code></a>
Change version to 1.82.1-dev (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9171">#9171</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/bd239854f0ab7f1ee63457d47f7c1d2675e1f736"><code>bd23985</code></a>
Change version to 1.82.0 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9170">#9170</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/0f3086db7a755b6af83a90809471dd7f645b345a"><code>0f3086d</code></a>
Fix minor issues not covered by PR <a
href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a>
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9147">#9147</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/fef07fbb2b94b668e8daca1f6b70433dcd36c1c8"><code>fef07fb</code></a>
internal: Split v3procservicepb import into pb and grpc for extproc (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9163">#9163</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/91dd64f4b83cb5134e279d1126ebb1ccf47d4d31"><code>91dd64f</code></a>
transport: surface subsequent data when receiving non-gRPC header (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/adc97de9521a9f377dab5e911039842dc4de23e5"><code>adc97de</code></a>
test/kokoro: add config for regional-td test (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9158">#9158</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/57c9ff14e05b535ee6995ba49bc882b287a175de"><code>57c9ff1</code></a>
xds: ensure full-string matching for RBAC Filter rules (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9148">#9148</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/b58f32d9ff07c612d64e677bd826bcbec88af9bd"><code>b58f32d</code></a>
server: Set a pprof label on new stream goroutines (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.81.1&new-version=1.82.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/agent-substrate/substrate/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-22 18:42:56 -04:00
Jaana Dogan 45f20f6571 Remove the Bash 4 requirement (#486) 
On macOS, bash default has Bash 3.2 compatibility. mapfile isn't
available and the mapfile command is breaking the install-ate.sh. Use a
while loop to implement the exact behavior.
 2026-07-21 20:54:24 -04:00
Julian Gutierrez Oschmann a2d55e99e0 Update Actor ID -> Actor Name references (#455) 
Update all old references to actor id to refer to actor name.

Also fix benchmarking framework to use the latest version of the API.
 2026-07-17 16:49:19 -07:00
John Howard a814761b6a Avoid redundant object naming suffixes (#441) 
Best practices is not to put a -deployment deployment, -role role, etc;
the kind already declares the kind we don't need it in the name as well.
Additionally we did not do it consistently anyways.

- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR
 2026-07-15 16:31:06 -07:00
Luiz Oliveira c1bd202dab fix(scripts): correct jq JSON path selector in delete_demo_actors 
Update the actor listing query in `hack/install-ate.sh` to extract `metadata.atespace` and `metadata.name` instead of the legacy root fields `atespace` and `actorId`.

`metadata` was introduced in https://github.com/agent-substrate/substrate/commit/af1f00522c63d24efed30ecb691676ce6fde847a
 2026-07-15 14:23:05 -07:00
Tim Hockin 5ea52d90c3 Add {update/verify}/proto-fmt.sh via clang-format 
Next commit runs the tool.
 2026-07-10 11:23:14 -04:00
dependabot[bot] d858ef8013 build(deps): bump golang.org/x/net in /hack/tools/go-licenses 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.43.0 to 0.55.0.
- [Commits](https://github.com/golang/net/compare/v0.43.0...v0.55.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.55.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-08 16:43:23 -07:00
haoqixu a813175b56 fix InvalidImageName in claude code multiplex demo 2026-07-08 16:42:11 -07:00
Tim Hockin fd353e5662 Set version via ldflags in ko 2026-07-08 13:26:26 -07:00
Tim Hockin b3e7b5bdf1 Bump ko version 2026-07-08 13:26:26 -07:00
dependabot[bot] e43d99bb9a build(deps): bump golang.org/x/crypto in /hack/tools/ko 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.51.0 to 0.52.0.
- [Commits](https://github.com/golang/crypto/compare/v0.51.0...v0.52.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.52.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-08 12:55:03 -07:00
dependabot[bot] 59d89fea60 build(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.6 to 2.1.0 in /hack/tools/ko (#366) 
Bumps
[github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority)
from 2.0.6 to 2.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sigstore/timestamp-authority/releases">github.com/sigstore/timestamp-authority/v2's
releases</a>.</em></p>
<blockquote>
<h2>v2.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bound path and HTTP method metric label cardinality to prevent OOM
in <a
href="https://redirect.github.com/sigstore/timestamp-authority/pull/1374">sigstore/timestamp-authority#1374</a></li>
<li>Fix spec violations in policy, EKU, and hash verification in <a
href="https://redirect.github.com/sigstore/timestamp-authority/pull/1375">sigstore/timestamp-authority#1375</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/sigstore/timestamp-authority/compare/v2.0.6...v2.1.0">https://github.com/sigstore/timestamp-authority/compare/v2.0.6...v2.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/58ae149676e193d2dd7e7ee53f231b83fdd10fad"><code>58ae149</code></a>
Fix spec violations in policy, EKU, and hash verification (<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1375">#1375</a>)</li>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/506ec57b6ac2ea1e4739322e47453469425b69b5"><code>506ec57</code></a>
Bound path and HTTP method metric label cardinality to prevent OOM (<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1374">#1374</a>)</li>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/ee10addd351dc6ee98cce8ff8fd371d7c46da954"><code>ee10add</code></a>
chore(deps): bump the actions group with 2 updates (<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1370">#1370</a>)</li>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/5238ec7a129fdb30696877cc72566273b5cda5ed"><code>5238ec7</code></a>
chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 (<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1369">#1369</a>)</li>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/0ff73b8db18044af0cc8e1ae7e0745fe322377e1"><code>0ff73b8</code></a>
chore(deps): bump goreleaser/goreleaser-action in the actions group (<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1367">#1367</a>)</li>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/97813ca20ffde2ee48100f276de8b63a6aabcaf1"><code>97813ca</code></a>
chore(deps): bump the actions group with 2 updates (<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1366">#1366</a>)</li>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/ece88f8b7ed97d7018a26e393044de2b8301ab2e"><code>ece88f8</code></a>
chore(deps): bump github.com/go-openapi/runtime from 0.30.0 to 0.31.0
(<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1365">#1365</a>)</li>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/77e0ee5cddc2629879814cff1eedce8eae716a0d"><code>77e0ee5</code></a>
chore(deps): bump github.com/tink-crypto/tink-go-awskms/v2 to v3 (<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1364">#1364</a>)</li>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/6ea07dfd04b97429be00e98360b819b277398843"><code>6ea07df</code></a>
chore(deps): bump go.step.sm/crypto from 0.80.0 to 0.81.0 (<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1363">#1363</a>)</li>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/f1dc03b146f2e1ea2c668a8f5849456e7cf0bc5a"><code>f1dc03b</code></a>
chore(deps): bump github.com/tink-crypto/tink-go-hcvault/v2 (<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1362">#1362</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/sigstore/timestamp-authority/compare/v2.0.6...v2.1.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/timestamp-authority/v2&package-manager=go_modules&previous-version=2.0.6&new-version=2.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/agent-substrate/substrate/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-08 02:00:25 -07:00
dependabot[bot] 4f29aaf321 build(deps): bump golang.org/x/net in /hack/tools/controller-gen 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.48.0 to 0.55.0.
- [Commits](https://github.com/golang/net/compare/v0.48.0...v0.55.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.55.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-07 10:23:52 -07:00
Haven Xia 7f87f0c1e1 Update README.md and scripts to adopt atespaces for existing demos. (#355) 
Update README.md and scripts to adopt atespaces for existing demos.

It's intentional to let user choose atespace in demos since actors are
also created by them.


- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR
 2026-07-06 13:27:38 -04:00
Michael TaufenVikas KumarOleg Mitrofanov
 		8631ae3465 Add initial threat model for substrate (#303) 
This adds an initial threat model for Substrate. The threat model was
originally authored in this Google Doc and shared on the mailing list.

-
https://docs.google.com/document/d/1UAuJzfgkXe6Qa9TTp4wwG0zuHFIGIxEXqafveGq8f9s/edit?resourcekey=0-J-c0L_AJFNjXBX_8TjMbMA&tab=t.0#heading=h.j4pfitmou99h
- https://groups.google.com/g/ate-dev/c/xEPg4RKv-Uk/m/hMoatPvEAAAJ

Note that access to the doc is gated by mailing list membership, you
must join the list to view it and and individual access requests can't
be granted due to a policy restriction. But please comment on this PR at
this point if you have feedback :).

---------

Co-authored-by: Vikas Kumar <skvikas@google.com>
Co-authored-by: Oleg Mitrofanov <gooleg@google.com>
 2026-07-01 10:31:39 -07:00
Max Smythe 86e138f628 Activate python virtual environments for scripts that operate within them (#364) 
This makes sure the environment is more insulated from idiosyncratic
local machine configurations.
 2026-06-30 17:22:15 -07:00
Eitan Yarmush 3400f7fb82 feat: add jwt authentication mode for ateapi (#248) 
## Description

  Closes agent-substrate/substrate#222.

Adds a portable JWT authentication path for ateapi clients while keeping
the
  existing mTLS mode as the default.

  ### What changed

  - Added `internal/ateapiauth` with:
    - `mtls` and `jwt` auth modes
    - server-side JWT gRPC interceptors
    - client-side dial options for projected ServiceAccount tokens
  - Wired JWT auth into:
    - `ate-api-server`
    - `ate-controller`
    - `atenet router`
    - `kubectl-ate` port-forward client path
- Updated Kubernetes JWT verification to support custom HTTP clients for
  OIDC/JWKS discovery.
  - Added JWT install overlays:
    - `manifests/ate-install/jwt`
    - `manifests/ate-install/kind-jwt`
  - Updated `hack/install-ate.sh` to opt into JWT mode with:
    - `ATE_API_AUTH_MODE=jwt`
    - `--auth-mode=jwt`

  ### Notes

- Default install behavior remains `mtls`. I think this deserves a
second look as JWT will support more clusters.
- The JWT overlay projects short-lived ServiceAccount tokens with
audience
`api.ate-system.svc` and mounts the service-DNS trust bundle for ateapi
TLS
  verification.
- The current discovery mechanism for JWT mode involves reading the
deployment which I really don't like, but we don't have a "config file"
concept so that bit is a massive TODO.

  ### Validation

```bash
KIND_CLUSTER_NAME=substrate-jwt ./hack/create-kind-cluster.sh

KO_DOCKER_REPO=localhost:5001 \
ATE_INSTALL_KIND=true \
./hack/install-ate.sh --auth-mode=jwt --deploy-ate-system

Validation results:

kubectl config current-context
# kind-substrate-jwt

kubectl get pods -n ate-system
# all runtime pods Running; init jobs Completed

go run ./cmd/kubectl-ate --context kind-substrate-jwt get actors
# succeeded, empty actor list
```
 2026-06-30 17:20:56 -07:00
Zoe Zhao 680dbea475 Update default GKE cluster version and enable Managed OTel feature (#352) 
1) Always create a cluster with GKE Managed OpenTelemetry feature and
2) Update the default cluster version to 1.35.5-gke.1163012 which is the
current [regular channel default
version](https://docs.cloud.google.com/kubernetes-engine/docs/release-notes#current_versions)
to fix https://github.com/agent-substrate/substrate/issues/341

Tested:
* Successfully recreated GKE cluster, redeployed ate-system and ran
counter demo.
 2026-06-30 16:20:05 -07:00
Max Smythe 6527f56095 move benchmarking dependencies under a /benchmarking/ directory 2026-06-30 14:32:47 -07:00
Max Smythe 1ec8fd2d2c verify licenses of Python dependencies 2026-06-30 14:32:47 -07:00
Max Smythe 18ca637074 streamline locust install + fix performance bugs 2026-06-30 14:32:47 -07:00
Benjamin Elder 3d53de85eb microvm MVP cleanup: align rootfs behavior to gvisor, ... (#313) 
Follow-up to https://github.com/agent-substrate/substrate/pull/287 /
#123

- align snapshot behavior: use a tmpfs (for writes) on top of read-only
viritio-fs mount for the container image rootfs instead of ext4 images
- enable multiple container support
- cleanup stale comments

> It's a good idea to open an issue first for discussion.

- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR
 2026-06-26 20:02:11 -07:00
dependabot[bot] 50a68bc146 build(deps): bump github.com/sigstore/rekor in /hack/tools/ko 
Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.5.1 to 1.5.2.
- [Release notes](https://github.com/sigstore/rekor/releases)
- [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sigstore/rekor/compare/v1.5.1...v1.5.2)

---
updated-dependencies:
- dependency-name: github.com/sigstore/rekor
  dependency-version: 1.5.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-26 17:22:14 -07:00
Jet Chiang f01fbe20ef review comments 
Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
 2026-06-25 16:51:46 -07:00
Jet Chiang 1da2a48033 delete actors in demo scripts 
Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
 2026-06-25 16:51:46 -07:00
Mesut Oezdil 2560f931dc fix: misc doc fixes across multiple files (#310) 
- roadmap.md: remove empty bullet point
- hack/update/README.md: fix self-referential path (`../update` ->
`../update-all.sh`)
- hack/verify/README.md: fix self-referential path (`../verify` ->
`../verify-all.sh`)
- cmd/atenet/internal/dns/README.md: fix typo (`orchsterates` ->
`orchestrates`)
- docs/dev/valkey-direct-access.md: add context and warning about
destructive commands
 2026-06-25 15:25:20 -07:00
Benjamin Elder 21fed4ee78 address review: hack tooling cleanups 
- ateom-base Dockerfile: full apt cleanup (apt-get clean + rm tmp).
- stage-to-rustfs.sh: fail fast when the aws CLI is missing.
 2026-06-25 13:44:25 -07:00
Benjamin Elder 2c50d282e2 hack,demos,docs: micro-VM asset tooling, base image, demo runner, docs 
Assemble + stage the micro-VM runtime assets, an ateom-base image (debian-slim +
e2fsprogs for mkfs.ext4), and run-microvm-demo.sh to build + deploy the
counter-microvm demo end to end (overriding the worker base via KO_CONFIG_PATH so
no committed file is edited). Document the micro-VM sandbox class.
 2026-06-25 13:44:25 -07:00
Benjamin Elder 387acac541 hack/update/licenses.sh: mirror in-tree third_party licenses 
go-licenses only covers module dependencies and treats our own module —
including any copied-in / forked third-party SOURCE under in-tree
third_party/ dirs — as first-party, so those upstream LICENSE/NOTICE/
COPYING files are never collected.

Mirror them into LICENSES/third_party/, keyed by their path under
third_party/, the same way kubernetes' hack/update-vendor-licenses.sh
does. `git ls-files` is used so gitignored paths are skipped; vendor/ and
the output dir are excluded since they hold module deps / generated
output rather than forked source.

This is a no-op today (there is no in-tree third_party source yet) and
prepares the licenses tooling for forthcoming vendored third-party code.
 2026-06-23 14:56:58 -07:00
Benjamin Elder 00a90a8eda Decouple Sandbox Binaries / Config from ActorTemplate (#261) 
Fixes https://github.com/agent-substrate/substrate/issues/253

> It's a good idea to open an issue first for discussion.

- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR

Should make something like
https://github.com/agent-substrate/substrate/pull/239 less awkward, and
also https://github.com/agent-substrate/substrate/issues/255 (we don't
have to cram more fields into actortemplate for the shim binary and
update _all_ of the demo actortemplates to include them).
 2026-06-17 09:46:46 -07:00
Benjamin Elder eab74c9a7f hack: use toolchain-specific gofmt for formatting checks (#242) 
See: https://github.com/kubernetes/kubernetes/pull/139303

FYI @thockin
 2026-06-13 08:58:25 -07:00
Zoe Zhao fd9446ea3c Created a demo with 2 actortemplates in different namespaces sharing one workerpool (#210) 
Fixes #211 : Create a demo that shows any worker can run any
actortemplates. Workers and actortemplates live in different namespaces.

- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR

Tested:
Deployed the demo and tested create, suspend, resume, delete actors in
both namepsaces. https://paste.googleplex.com/4999545124683776
 2026-06-10 09:48:59 -07:00
Tim Hockin 2b7c2634b1 Use pflag instead of Go's flag lib (#152) 
Better to get ahead of this early.
 2026-06-09 11:03:03 -07:00
Benjamin Elder c0319415dd add e2e test script for kind, to avoid accidentally importing "real" cluster env 2026-06-05 18:12:50 -07:00
Benjamin Elder ba328dc712 Add readiness checks for demo-counter deployment 2026-06-05 18:06:03 -07:00
Benjamin Elder 6388be39dc upgrade kind to v0.32 (with default k8s 1.36.1) 2026-06-05 16:33:10 -07:00
Tim Hockin 1ac95ecb0a Tidy up the messages when deleting a kind cluster (#165) 
If the registry exists and was not created by us, say so, but if it did
not exist, don't waste our breath.
 2026-06-04 15:45:27 -07:00
Tim Hockin e10ae9cafb Update/verify dep vendoring (#132) 
This adds an update/verify script pair to check `go mod vendor` in the
main module. Should we do this in sub-modules too?

Fixes #19
 2026-06-02 20:02:51 -07:00
Tim Hockin 4b7372828c Remove trailing space from shell files 2026-05-31 19:45:36 -07:00
Tim Hockin ef2afd1262 Cleanup: remove redundant LOC in boilerplate python 2026-05-31 19:45:36 -07:00
Tim Hockin 4b537a02bb Fix boilerplate in python files 2026-05-31 19:45:36 -07:00