Lior Lieberman b748aa2a5e graduate credential injection from experimental (#2101) ...

Graduates egress credential injection out of experimental: removes
`--experimental-egress-credential-injection` and
`ATE_CREDENTIAL_INJECTION_ENABLED`.

#### Breaking change

- `deploy ate-system` and `deploy atenet` now require
`--credential-provider` (or `ATE_CREDENTIAL_PROVIDER`). It's a JSON
value that replaces `--credential-provider-name` and
`--credential-provider-address`:
- `{"name":"k8s.io"}` deploys the bundled Kubernetes Secrets provider,
plus a NetworkPolicy that only lets atenet-egress connect. `address` is
optional.
  - `{"enabled":false}` turns injection off.
- `{"name":"<provider-name>","address":"<host>:<port>"}` uses a provider
you deploy yourself.

#### More
- Provider names are bare DNS names; credential URIs keep
`ate-secret://`.
- The gateway now fails closed (500) when a rule needs a credential but
no provider is configured.
- Added a network policy with the k8s secret provider to allow only
access from atenet-egress
- The agentgateway dataplane refuses a provider for now (@EItanya will
follow up).
- Docs and scripts use `{"name":"k8s.io"}`.
- Related to above, we took a deliberate decision to install k8s.io
credential provider deployment when k8s.io provider is specified. For
this provider, namespace-policy ConfigMap is created only when absent.


- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR

2026-10-02 23:04:51 +00:00

..

govulncheck.yaml

Add gcp secret manager as a credential provider in its own go module (#1991)

2026-09-30 22:56:13 +00:00

pr-workflow.yaml

graduate credential injection from experimental (#2101)

2026-10-02 23:04:51 +00:00

release.yaml

ci: add automated release notes generation (#2018)

2026-10-01 20:42:12 +00:00