mirror of
https://github.com/agent-substrate/substrate.git
synced 2026-11-10 10:13:50 +08:00
Haiyan Meng
d4c68d7968
Envoy now terminates the TLS session inside an actor's CONNECT tunnel with a leaf minted on demand for the SNI the client asked for, instead of forwarding the tunneled bytes opaquely. That puts the plaintext request on a filter chain where policy can be applied later. A new atenet sdsmint subcommand serves those leaves over DELTA_GRPC SDS on a unix socket. Opt-in: --experimental-use-sdsmint selects atenet-egress-with-sdsmint.yaml and creates the egress-mitm-ca-pool secret. The default egress manifest and install path are unchanged. Also: localca gains CA.Validate, GenerateCA options and a crypto.Signer SigningKey; kubectl-ate admin make-ca-pool gains --key-type and --common-name; atunnel returns ErrGatewayHandshake and ConnectRejectedError instead of formatted strings. The sdsmint e2e suite is skipped for now.