mirror of
https://github.com/agent-substrate/substrate.git
synced 2026-10-26 07:23:59 +08:00
Lior Lieberman
b748aa2a5e
Graduates egress credential injection out of experimental: removes
`--experimental-egress-credential-injection` and
`ATE_CREDENTIAL_INJECTION_ENABLED`.
#### Breaking change
- `deploy ate-system` and `deploy atenet` now require
`--credential-provider` (or `ATE_CREDENTIAL_PROVIDER`). It's a JSON
value that replaces `--credential-provider-name` and
`--credential-provider-address`:
- `{"name":"k8s.io"}` deploys the bundled Kubernetes Secrets provider,
plus a NetworkPolicy that only lets atenet-egress connect. `address` is
optional.
- `{"enabled":false}` turns injection off.
- `{"name":"<provider-name>","address":"<host>:<port>"}` uses a provider
you deploy yourself.
#### More
- Provider names are bare DNS names; credential URIs keep
`ate-secret://`.
- The gateway now fails closed (500) when a rule needs a credential but
no provider is configured.
- Added a network policy with the k8s secret provider to allow only
access from atenet-egress
- The agentgateway dataplane refuses a provider for now (@EItanya will
follow up).
- Docs and scripts use `{"name":"k8s.io"}`.
- Related to above, we took a deliberate decision to install k8s.io
credential provider deployment when k8s.io provider is specified. For
this provider, namespace-policy ConfigMap is created only when absent.
- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR
61 lines
2.6 KiB
Plaintext
61 lines
2.6 KiB
Plaintext
# Copyright 2026 Google LLC
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
# Example environment variables for Substrate development.
|
|
# Copy this file to .ate-dev-env.sh and customize it for your environment.
|
|
|
|
export PROJECT_ID=${USER}-gke-dev
|
|
export PROJECT_NUMBER=$(gcloud projects describe ${PROJECT_ID} --format="value(projectNumber)")
|
|
|
|
export GCE_REGION=us-west1
|
|
export CLUSTER_LOCATION=us-west1-c
|
|
|
|
export NETWORK=default
|
|
export SUBNETWORK=default
|
|
|
|
export CLUSTER_NAME=substrate-poc
|
|
# Supported: 1.36 (needs the beta APIs enabled at cluster creation, which
|
|
# setup-gcp does) or 1.37+ (APIs served by default). Anything below 1.36 does
|
|
# not work. GKE retires patch versions over time — if cluster creation rejects
|
|
# this pin, pick a current one from:
|
|
# gcloud container get-server-config --zone ${CLUSTER_LOCATION} --format="value(defaultClusterVersion)"
|
|
# See tools/setup-gcp/README.md ("Create Cluster") for the full constraint.
|
|
export CLUSTER_VERSION=1.36.3-gke.1767000
|
|
export NODE_POOL_NAME=gvisor-pool
|
|
export NODE_POOL_VERSION=1.36.3-gke.1767000
|
|
export NODE_MACHINE_TYPE=c3-standard-4
|
|
# Enable nested virtualization (required for microVMs)
|
|
export ENABLE_NESTED_VIRTUALIZATION=true
|
|
# Boot disk customizations (optional; defaults to GKE's default boot disk)
|
|
# export BOOT_DISK_SIZE_GB=500
|
|
# export BOOT_DISK_TYPE=hyperdisk-balanced
|
|
|
|
# Set this if you are using an existing cluster with a different context name.
|
|
export KUBECTL_CONTEXT=
|
|
|
|
export BUCKET_NAME=snapshot-substrate-test-${PROJECT_ID}
|
|
|
|
export KO_DOCKER_REPO="gcr.io/${PROJECT_ID}/ate-images"
|
|
|
|
# Credential provider the egress gateway injects credentials from, as JSON; the
|
|
# install requires a choice. {"name":"k8s.io"} deploys the bundled Kubernetes
|
|
# Secrets provider, with a NetworkPolicy that admits only the egress gateway;
|
|
# {"enabled":false} turns egress credential injection off, and is the only choice
|
|
# on the agentgateway dataplane; {"name":"<provider>","address":"<host>:<port>"}
|
|
# uses a provider you deploy yourself. See docs/egress-credential-injection.md.
|
|
export ATE_CREDENTIAL_PROVIDER='{"name":"k8s.io"}'
|
|
|
|
# Set this if you want to override the default build platforms
|
|
export KO_DEFAULTPLATFORMS=linux/amd64
|