mirror of
https://github.com/agent-substrate/substrate.git
synced 2026-11-10 10:13:50 +08:00
Lior Lieberman
b748aa2a5e
Graduates egress credential injection out of experimental: removes
`--experimental-egress-credential-injection` and
`ATE_CREDENTIAL_INJECTION_ENABLED`.
#### Breaking change
- `deploy ate-system` and `deploy atenet` now require
`--credential-provider` (or `ATE_CREDENTIAL_PROVIDER`). It's a JSON
value that replaces `--credential-provider-name` and
`--credential-provider-address`:
- `{"name":"k8s.io"}` deploys the bundled Kubernetes Secrets provider,
plus a NetworkPolicy that only lets atenet-egress connect. `address` is
optional.
- `{"enabled":false}` turns injection off.
- `{"name":"<provider-name>","address":"<host>:<port>"}` uses a provider
you deploy yourself.
#### More
- Provider names are bare DNS names; credential URIs keep
`ate-secret://`.
- The gateway now fails closed (500) when a rule needs a credential but
no provider is configured.
- Added a network policy with the k8s secret provider to allow only
access from atenet-egress
- The agentgateway dataplane refuses a provider for now (@EItanya will
follow up).
- Docs and scripts use `{"name":"k8s.io"}`.
- Related to above, we took a deliberate decision to install k8s.io
credential provider deployment when k8s.io provider is specified. For
this provider, namespace-policy ConfigMap is created only when absent.
- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR
ate-setup
Installs and tears down Agent Substrate on a Kubernetes cluster.
go run ./cmd/ate-setup [global flags] <command> [flags]
make build-ate-setup # builds bin/ate-setup
ate-setup is the installer. hack/install-ate.sh is a shim over it, kept so
that existing command lines and CI jobs keep working; it holds no install logic
of its own.
Installing a release
By default every image is built from the checkout with ko, which is what a
developer wants and what the shell installer always did. To install published
images instead, name the registry they were pushed to:
ate-setup deploy ate-system \
--credential-provider='{"name":"k8s.io"}' \
--image-repo registry.example.com/substrate \
--image-tag v0.0.0
Nothing is built and no registry is pushed to; the manifests still come from the checkout. Each reference is pinned to the digest its tag names, so the registry has to be readable from here as well as from the cluster.
commands.md— every command with itshack/install-ate.shequivalent.differences.md— where the Go port deliberately behaves differently from the shell scripts it replaced, and what was reproduced exactly.cli-diff.md— what ahack/install-ate.shuser can observe after the switch.