mirror of
https://github.com/agent-substrate/substrate.git
synced 2026-11-11 10:23:17 +08:00
yufan-su
85ce8ed531
Adds **egress credential injection**: on the sdsmint egress gateway's decrypted MITM leg, when an actor's `EgressPolicy` rule matches and carries an `inject_static_headers` effect, the gateway resolves the referenced credential from a **credential provider** and sets it as a request header (e.g. `Authorization: Bearer <token>`) before re-originating upstream. This implements the `applyEffects` in the egress handler. Injector runs as part of the existing egress ext_proc handler that already fetches/caches/evaluates each actor's `EgressPolicy`, so the MITM leg gains injection without a second ext_proc hop. ### How it works - New `CredentialProvider.FetchSecret` plugin API (`pkg/proto/credproviderpb`): the gateway calls it with the credential URI and the actor's attested SPIFFE identity; the provider authenticates the gateway (mTLS) and resolves the secret. - The egress handler dials the provider over mTLS (`egress.DialProvider`) and injects on matched, allowed requests (`egress.applyEffects`). - Behavior: - **TLS MITM leg + provider configured** → inject the credential (overwriting any actor-set header). - **Cleartext leg, or no provider configured** → skip injection and pass the request through (never put a secret on a cleartext wire; don't block allowed egress). - **Attempted but failed** (unfetchable secret, empty/malformed secret, credential URI of an unserved provider class) → fail closed. ## Installation One flag stands up and wires the whole stack: ``` hack/install-ate.sh --deploy-ate-system --experimental-egress-credential-injection ``` `--experimental-egress-credential-injection` deploys credprovider and the injector, then re-wires the sdsmint egress gateway to route through the injector. It implies `--experimental-use-sdsmint` ### New install flags Two flags configure which credential provider the injector targets: | Flag | Purpose | Default | |---|---|---| | `--credential-provider-name` | Provider class, as a `ate-secret://` prefix; a policy URI of any other class is refused | `ate-secret://kubernetes.io` | | `--credential-provider-address` | Where the injector dials the provider | `credprovider.ate-system.svc:50051` |
ate-setup
Installs and tears down Agent Substrate on a Kubernetes cluster.
go run ./cmd/ate-setup [global flags] <command> [flags]
make build-ate-setup # builds bin/ate-setup
ate-setup is a Go port of hack/install-ate.sh and the scripts it sources.
Both work today and can be used against the same cluster.
Installing a release
By default every image is built from the checkout with ko, which is what a
developer wants and what the shell installer always did. To install published
images instead, name the registry they were pushed to:
ate-setup deploy ate-system \
--image-repo registry.example.com/substrate \
--image-tag v0.0.0
Nothing is built and no registry is pushed to; the manifests still come from the checkout. Each reference is pinned to the digest its tag names, so the registry has to be readable from here as well as from the cluster.
commands.md— every command with itshack/install-ate.shequivalent.differences.md— where the port deliberately behaves differently, and what was reproduced exactly.