mirror of
https://github.com/agent-substrate/substrate.git
synced 2026-11-13 10:43:28 +08:00
Chuang Wang
d909d69053
Envoy honors watched_directory only on SDS-delivered secrets; on the egress gateway's inline file-based certs it was silently ignored, so kubelet's projected-certificate rotation never reached Envoy and the gateway eventually served an expired certificate. Move the serving cert (both egress manifests) and the spliced extproc cluster's client cert and trust bundle (Go and shell emitters) to filesystem SDS, with the flag-derived SAN pin kept inline via a combined validation context. Fix the csi-deployment doc example that showed the same broken pattern, and add tests for the emitters.
ate-setup
Installs and tears down Agent Substrate on a Kubernetes cluster.
go run ./cmd/ate-setup [global flags] <command> [flags]
make build-ate-setup # builds bin/ate-setup
ate-setup is a Go port of hack/install-ate.sh and the scripts it sources.
Both work today and can be used against the same cluster.
commands.md— every command with itshack/install-ate.shequivalent.differences.md— where the port deliberately behaves differently, and what was reproduced exactly.