mirror of https://github.com/agent-substrate/substrate.git synced 2026-11-10 10:13:50 +08:00

Files

T

Lior Lieberman b748aa2a5e graduate credential injection from experimental (#2101 )

Graduates egress credential injection out of experimental: removes
`--experimental-egress-credential-injection` and
`ATE_CREDENTIAL_INJECTION_ENABLED`.

#### Breaking change

- `deploy ate-system` and `deploy atenet` now require
`--credential-provider` (or `ATE_CREDENTIAL_PROVIDER`). It's a JSON
value that replaces `--credential-provider-name` and
`--credential-provider-address`:
- `{"name":"k8s.io"}` deploys the bundled Kubernetes Secrets provider,
plus a NetworkPolicy that only lets atenet-egress connect. `address` is
optional.
  - `{"enabled":false}` turns injection off.
- `{"name":"<provider-name>","address":"<host>:<port>"}` uses a provider
you deploy yourself.

#### More
- Provider names are bare DNS names; credential URIs keep
`ate-secret://`.
- The gateway now fails closed (500) when a rule needs a credential but
no provider is configured.
- Added a network policy with the k8s secret provider to allow only
access from atenet-egress
- The agentgateway dataplane refuses a provider for now (@EItanya will
follow up).
- Docs and scripts use `{"name":"k8s.io"}`.
- Related to above, we took a deliberate decision to install k8s.io
credential provider deployment when k8s.io provider is specified. For
this provider, namespace-policy ConfigMap is created only when absent.


- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR

2026-10-02 23:04:51 +00:00

gcp-secret-manager

graduate credential injection from experimental (#2101 )

2026-10-02 23:04:51 +00:00

README.md

Add gcp secret manager as a credential provider in its own go module (#1991 )

2026-09-30 22:56:13 +00:00

README.md

Plugins

Each directory here is a self-contained plugin: a Go module of its own that plugs into substrate through its public APIs.

This is a temporary location. Each plugin will move to a repository of its own, and its path here goes away when it does. Until then:

Do not depend on these paths. Nothing else in the repository should build on, script against or link into a plugin's directory. The only references from outside a plugin are its own CI steps and pointers from the docs.
Do not import these packages. Code outside a plugin must not import it. Go already refuses most such imports, since a plugin's packages sit under its own internal/ or are main packages.
A plugin imports only substrate's public pkg/ packages, so it can move out as it is. Its go.mod replaces the substrate module with this checkout, so it builds against the current tree.