Configure Helm identities for renamed deployments

Pass the resolved atelet and router ServiceAccounts to the control plane, expose the controller pod namespace, and configure router Service discovery. Cover canonical and custom Helm releases in manifest tests.

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Author: EItanya

charts/substrate/templates/ate-api-server.yaml

@@ -90,6 +90,7 @@ spec:
         - "--actor-id-jwt-pool=/run/actor-id-jwt-pool/pool.json"
         - "--actor-id-ca-pool=/run/actor-id-ca-pool/pool.json"
         - "--egress-gateway-address={{ include "substrate.fullname" (list "atenet-egress" .) }}.{{ .Release.Namespace }}.svc:443"
+        - '--atelet-service-account={{ include "substrate.fullname" (list "atelet" .) }}'
         - "--atelet-client-cred-bundle=/run/podidentity.podcert.ate.dev/credential-bundle.pem"
         - "--pod-identity-ca-certs=/run/podidentity.podcert.ate.dev/trust-bundle.pem"
         - "--drain-delay=13s"

charts/substrate/templates/ate-controller.yaml

@@ -78,10 +78,16 @@ spec:
         # "ate-system"). Pass the chart-resolved Service so the controller
         # dials the right backend when substrate is installed as a subchart.
         - "--ateapi-conn-spec=dns:///{{ include "substrate.fullname" (list "api" .) }}.{{ .Release.Namespace }}.svc:443"
+        - '--atelet-service-account={{ include "substrate.fullname" (list "atelet" .) }}'
+        - '--router-service-account={{ include "substrate.fullname" (list "atenet-router" .) }}'
         - "--ateapi-ca-file=/run/servicedns-ca/trust-bundle.pem"
         - "--ateapi-client-cert=/run/podidentity.podcert.ate.dev/credential-bundle.pem"
-{{- with include "substrate.otel.env" . }}
         env:
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+{{- with include "substrate.otel.env" . }}
 {{- . | trim | nindent 8 }}
 {{- end }}
         ports:

charts/substrate/templates/atenet-router.yaml

@@ -221,6 +221,7 @@ spec:
         - "--mode=ingress"
         - "--atenet-dataplane=agentgateway"
         - "--namespace={{ .Release.Namespace }}"
+        - '--router-service-name={{ include "substrate.fullname" (list "atenet-router" .) }}'
         - "--port-http=8080"
         - "--port-extproc=50051"
         - "--extproc-address=127.0.0.1"

cmd/credential-provider/kubernetes-secrets/manifests_test.go

@@ -79,6 +79,33 @@ func TestProviderManifests(t *testing.T) {
 				} else if err != nil {
 					t.Fatal(err)
 				}
+				if tc.tool == "helm" && doc.Kind == "Deployment" {
+					for _, container := range doc.Spec.Template.Spec.Containers {
+						var required []string
+						switch container.Name {
+						case "ate-api-server":
+							required = []string{"--atelet-service-account=" + tc.prefix + "atelet"}
+						case "ate-controller":
+							required = []string{
+								"--atelet-service-account=" + tc.prefix + "atelet",
+								"--router-service-account=" + tc.prefix + "atenet-router",
+							}
+							if !slices.ContainsFunc(container.Env, func(env corev1.EnvVar) bool {
+								return env.Name == "POD_NAMESPACE" && env.ValueFrom != nil &&
+									env.ValueFrom.FieldRef != nil && env.ValueFrom.FieldRef.FieldPath == "metadata.namespace"
+							}) {
+								t.Error("controller must resolve worker identities from its pod namespace")
+							}
+						case "atenet-router":
+							required = []string{"--router-service-name=" + tc.prefix + "atenet-router"}
+						}
+						for _, arg := range required {
+							if !slices.Contains(container.Args, arg) {
+								t.Errorf("%s missing %s", container.Name, arg)
+							}
+						}
+					}
+				}
 				switch doc.Kind {
 				case "ServiceAccount":
 					if doc.Metadata.Name == tc.prefix+"k8s-credential-provider" {