Update agentgateway implementation - #28
Open
keithmattix wants to merge 10 commits into
Open
Conversation
Build and publish versioned container images and kubectl-ate binaries for tagged releases. Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>
Keep the vanilla Kubernetes packaging, configurable resource names, actor lock heartbeat, PostgreSQL Helm E2E coverage, and release updates while omitting the removed ateapi JWT client mode. Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>
Pin the tested agentgateway release, route ingress and egress through its policies, and keep Helm, manifests, and live E2E fixtures consistent with the deployed dataplane. Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>
Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>
Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>
Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>
keithmattix
commented
Sep 1, 2026
Add e2e.RouterIsAgentgateway, detected from the atenet-router Deployment's containers, and gate the Envoy-only assertions on it: the h2-to-h1 downgrade contract is Envoy's protocol mirroring to atunnel, which agentgateway does not implement.
Bump agentgateway to a nightly that authorizes the actor identity before terminating any CONNECT tunnel and retries stale worker assignments on the CONNECT leg by evicting and re-resolving through ResumeActor. substrateEgress accordingly moves from a policy on the internal HTTP route to frontendPolicies in the egress ConfigMaps (manifests component, MITM overlay, and the Helm chart): the frontend check covers HTTP, TLS, and opaque TCP tunnels alike, where the old route policy silently exempted the TLS and TCP passthrough routes. This closes the hole where a certificate for an unknown actor could open a tunnel, and makes suspended actors resumable through the router again.
keithmattix
force-pushed
the
wire-up-agw-e2es
branch
from
September 1, 2026 23:03
ea4c4c9 to
bf3fbff
Compare
keithmattix
commented
Sep 1, 2026
| // actor that really does speak gRPC. | ||
| func TestIngressProtocolDowngrade(t *testing.T) { | ||
| ctx := context.Background() | ||
| if e2e.RouterIsAgentgateway(ctx, t) { |
Collaborator
Author
There was a problem hiding this comment.
I think this only exists because Envoy isn't exclusively using CONNECT. We are so don't need to worry about the version negotiation; we skip the test because we don't implement it
The e2e-test job's install step waits for each ate-system workload with the script's default 60s rollout timeout. That default assumes warm image caches; on a fresh CI runner every image (postgres, the agentgateway proxy for both router and egress, ...) is cold-pulled from public registries concurrently, and the first wait in line regularly exceeds 60s on pull latency alone. Give the install a 300s per-workload budget, matching the tolerance the helm-e2e workflow already has.
keithmattix
changed the title
helm-e2e still deployed the legacy CRD-based counter-microvm demo and waited for a Ready condition on the ActorTemplate CRD. The full cutover to the substrate ActorTemplate proto removed the CRD golden flow, so nothing sets that condition anymore and the wait times out after 600s on every run. Deploy the substrate variant instead, which waits for its golden snapshot internally, and point the micro-VM test lane at it with the E2E_SANDBOX_CLASS knob — the same shape pr-workflow already uses and passes with.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update the substrate config with all of the agentgateway changes we've been making upstream