Skip to content

Commit 971d345

Browse files
authored
Update agentgateway implementation (#28)
1 parent 595af99 commit 971d345

9 files changed

Lines changed: 109 additions & 43 deletions

File tree

.github/workflows/helm-e2e.yaml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,9 @@ jobs:
9292
- name: Install CSI NFS driver
9393
run: hack/install-ate-kind.sh --setup-csi=nfs
9494
- name: Deploy micro-VM counter demo
95+
# The deploy creates the substrate ActorTemplate and waits for its golden
96+
# snapshot internally; the ActorTemplate CRD (and its Ready condition)
97+
# no longer exists to wait on.
9598
run: hack/run-microvm-demo-kind.sh --skip-control-plane
9699
- name: Deploy gVisor counter demo
97100
run: hack/install-ate-kind.sh --deploy-demo-counter
@@ -101,9 +104,7 @@ jobs:
101104
run: hack/run-e2e-kind.sh -v -args --no-color
102105
- name: Run E2E tests (micro-VM)
103106
env:
104-
E2E_TEMPLATE_NAMESPACE: ate-demo-counter-microvm
105-
E2E_TEMPLATE_NAME: counter-microvm
106-
E2E_TEMPLATE_READY_TIMEOUT: 600s
107+
E2E_SANDBOX_CLASS: microvm
107108
run: hack/run-e2e-kind.sh ./internal/e2e/suites/demo -v -args --no-color
108109
- name: Dump diagnostics on failure
109110
if: failure()

.github/workflows/pr-workflow.yaml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,11 @@ jobs:
8787
- name: Create cluster
8888
run: hack/create-kind-cluster.sh
8989
- name: Install Agent Substrate
90-
run: hack/install-ate-kind.sh --deploy-ate-system --atenet-router=agentgateway
90+
# The default 60s per-workload rollout wait assumes warm image caches; on a
91+
# fresh runner every image (postgres, the agentgateway proxy for router and
92+
# egress, ...) is cold-pulled from public registries concurrently, and the
93+
# first wait in line regularly exceeds 60s on pull latency alone.
94+
run: hack/install-ate-kind.sh --deploy-ate-system --atenet-router=agentgateway --rollout-timeout=300s
9195
- name: Enable NFS
9296
# Load NFS kernel modules so in-cluster NFS server and CSI driver can run.
9397
run: |

charts/substrate/templates/atenet-egress.yaml

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,16 @@ data:
3232
accessLog:
3333
add:
3434
substrate.connect.authority: source.connectHeaders["host"]
35+
# Authorize the actor identity at CONNECT-accept, before any tunnel
36+
# (HTTP, TLS, or opaque TCP) is terminated. Fails closed when the
37+
# control plane is unreachable.
38+
substrateEgressActorResolution:
39+
host: {{ include "substrate.fullname" (list "api" .) }}.{{ .Release.Namespace }}.svc:443
40+
policies:
41+
backendTLS:
42+
cert: /run/podidentity.podcert.ate.dev/credential-bundle.pem
43+
key: /run/podidentity.podcert.ate.dev/credential-bundle.pem
44+
root: /run/servicedns.podcert.ate.dev/trust-bundle.pem
3545
3646
binds:
3747
- port: 8443
@@ -54,15 +64,7 @@ data:
5464
target: source.connectHeaders["host"]
5565
- protocol: HTTP
5666
routes:
57-
- policies:
58-
substrateEgress:
59-
host: {{ include "substrate.fullname" (list "api" .) }}.{{ .Release.Namespace }}.svc:443
60-
policies:
61-
backendTLS:
62-
cert: /run/podidentity.podcert.ate.dev/credential-bundle.pem
63-
key: /run/podidentity.podcert.ate.dev/credential-bundle.pem
64-
root: /run/servicedns.podcert.ate.dev/trust-bundle.pem
65-
backends:
67+
- backends:
6668
- dynamic:
6769
target: source.connectHeaders["host"]
6870
- protocol: TCP

charts/substrate/values.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,6 @@ images:
7070
postgres: postgres:18-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15
7171
rustfs: rustfs/rustfs:1.0.0-beta.3@sha256:378642b05b7dcb4849fb77ebe6aca4ced1c3f66e7e504247df95a5c9018d3358
7272
awsCli: amazon/aws-cli:2.17.0@sha256:643507c10ada7964ca6157b3d799f030b90577643da9955d319a77399ed80d73
73-
agentgateway: ghcr.io/kagent-dev/substrate/agentgateway:c0f5597c7cb8
73+
agentgateway: ghcr.io/agentgateway/agentgateway:v0.0.0-alpha.988ac151
7474
coredns: coredns/coredns:1.11.1
7575
busybox: busybox:1.36

internal/e2e/dataplane.go

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
// Copyright 2026 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package e2e
16+
17+
import (
18+
"context"
19+
"sync"
20+
"testing"
21+
22+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
23+
)
24+
25+
var (
26+
routerDataplaneOnce sync.Once
27+
routerIsAgentgateway bool
28+
routerDataplaneErr error
29+
)
30+
31+
// RouterIsAgentgateway reports whether the atenet-router Deployment runs the
32+
// agentgateway dataplane. In that mode the pod has no Envoy and no
33+
// atenet-router ext_proc process, so router-internal surfaces — the statusz
34+
// page, atenet_router_* metrics, and Envoy's protocol mirroring to atunnel —
35+
// do not exist. Suites gate assertions on those surfaces with this instead of
36+
// a per-lane env knob: the deployed containers are the source of truth.
37+
func RouterIsAgentgateway(ctx context.Context, t *testing.T) bool {
38+
t.Helper()
39+
routerDataplaneOnce.Do(func() {
40+
deploy, err := GetClients().K8s.AppsV1().Deployments(routerNamespace).Get(ctx, routerService, metav1.GetOptions{})
41+
if err != nil {
42+
routerDataplaneErr = err
43+
return
44+
}
45+
for _, c := range deploy.Spec.Template.Spec.Containers {
46+
if c.Name == "agentgateway" {
47+
routerIsAgentgateway = true
48+
return
49+
}
50+
}
51+
})
52+
if routerDataplaneErr != nil {
53+
t.Fatalf("detecting the router dataplane: %v", routerDataplaneErr)
54+
}
55+
return routerIsAgentgateway
56+
}

internal/e2e/suites/networking/grpcingress_test.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,9 @@ var grpcEchoFixtureManifests = e2e.SubstrateFixtureManifests{
5656
// actor that really does speak gRPC.
5757
func TestIngressProtocolDowngrade(t *testing.T) {
5858
ctx := context.Background()
59+
if e2e.RouterIsAgentgateway(ctx, t) {
60+
t.Skip("the downgrade contract is Envoy's protocol mirroring to atunnel (xds.go); agentgateway does not implement it")
61+
}
5962
actorName, _ := createAndResumeSubstrateActor(t, ctx, "protodowngrade", e2e.SubstrateCounterFixture())
6063
actorRef := resources.ActorRef{Atespace: networkingAtespace, Name: actorName}
6164

manifests/ate-install/components/agentgateway-egress-mitm/kustomization.yaml

Lines changed: 16 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,15 @@ patches:
3333
accessLog:
3434
add:
3535
substrate.connect.authority: source.connectHeaders["host"]
36+
# Authorize the actor identity at CONNECT-accept, before any tunnel
37+
# is terminated. Fails closed when the control plane is unreachable.
38+
substrateEgressActorResolution:
39+
host: api.ate-system.svc:443
40+
policies:
41+
backendTLS:
42+
cert: /run/podidentity.podcert.ate.dev/credential-bundle.pem
43+
key: /run/podidentity.podcert.ate.dev/credential-bundle.pem
44+
root: /run/servicedns-ca/trust-bundle.pem
3645
3746
binds:
3847
- port: 8443
@@ -53,29 +62,18 @@ patches:
5362
cert: /run/egress-mitm/tls.crt
5463
key: /run/egress-mitm/tls.key
5564
routes:
56-
- policies:
57-
substrateEgress:
58-
host: api.ate-system.svc:443
59-
policies:
60-
backendTLS:
61-
cert: /run/podidentity.podcert.ate.dev/credential-bundle.pem
62-
key: /run/podidentity.podcert.ate.dev/credential-bundle.pem
63-
root: /run/servicedns-ca/trust-bundle.pem
64-
backends:
65+
- backends:
6566
- dynamic: {}
6667
policies:
6768
backendTLS: {}
6869
- protocol: HTTP
6970
routes:
70-
- policies:
71-
substrateEgress:
72-
host: api.ate-system.svc:443
73-
policies:
74-
backendTLS:
75-
cert: /run/podidentity.podcert.ate.dev/credential-bundle.pem
76-
key: /run/podidentity.podcert.ate.dev/credential-bundle.pem
77-
root: /run/servicedns-ca/trust-bundle.pem
78-
backends:
71+
- backends:
72+
- dynamic:
73+
target: source.connectHeaders["host"]
74+
- protocol: TCP
75+
tcpRoutes:
76+
- backends:
7977
- dynamic:
8078
target: source.connectHeaders["host"]
8179
- protocol: TCP

manifests/ate-install/components/agentgateway/configmap.yaml

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,16 @@ data:
181181
accessLog:
182182
add:
183183
substrate.connect.authority: source.connectHeaders["host"]
184+
# Authorize the actor identity at CONNECT-accept, before any tunnel
185+
# (HTTP, TLS, or opaque TCP) is terminated. Fails closed when the
186+
# control plane is unreachable.
187+
substrateEgressActorResolution:
188+
host: api.ate-system.svc:443
189+
policies:
190+
backendTLS:
191+
cert: /run/podidentity.podcert.ate.dev/credential-bundle.pem
192+
key: /run/podidentity.podcert.ate.dev/credential-bundle.pem
193+
root: /run/servicedns-ca/trust-bundle.pem
184194
185195
binds:
186196
# Authenticate the actor before accepting CONNECT.
@@ -207,15 +217,7 @@ data:
207217
target: source.connectHeaders["host"]
208218
- protocol: HTTP
209219
routes:
210-
- policies:
211-
substrateEgress:
212-
host: api.ate-system.svc:443
213-
policies:
214-
backendTLS:
215-
cert: /run/podidentity.podcert.ate.dev/credential-bundle.pem
216-
key: /run/podidentity.podcert.ate.dev/credential-bundle.pem
217-
root: /run/servicedns-ca/trust-bundle.pem
218-
backends:
220+
- backends:
219221
- dynamic:
220222
target: source.connectHeaders["host"]
221223
- protocol: TCP

manifests/ate-install/components/agentgateway/kustomization.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ patches:
4242
path: /spec/template/spec/containers/0
4343
value:
4444
name: agentgateway
45-
image: ghcr.io/kagent-dev/substrate/agentgateway:c0f5597c7cb8
45+
image: ghcr.io/agentgateway/agentgateway:v0.0.0-alpha.988ac151
4646
args:
4747
- -f
4848
- /etc/agentgateway/config.yaml
@@ -115,7 +115,7 @@ patches:
115115
path: /spec/template/spec/containers/0
116116
value:
117117
name: agentgateway
118-
image: ghcr.io/kagent-dev/substrate/agentgateway:c0f5597c7cb8
118+
image: ghcr.io/agentgateway/agentgateway:v0.0.0-alpha.988ac151
119119
args:
120120
- -f
121121
- /etc/agentgateway/config.yaml

0 commit comments

Comments
 (0)