Skip to content

Sync upstream actor JWT discovery and sandbox asset updates #87

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
EItanya merged 7 commits into from
Oct 16, 2026
+3,787 −1,398
Merged

Sync upstream actor JWT discovery and sandbox asset updates #87

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
2f56f17
docs: say when to mark proto fields debug_redact and what it covers (…
git286 Oct 16, 2026
6885d0c
atelet: stage sandbox assets per actor from the node-local file cache…
dberkov Oct 16, 2026
e3a75a5
Send and require snapshot object storage URI on all checkpoints (#2752)
msau42 Oct 16, 2026
3a2ca62
Align volume and env message names across ateapi, atelet, and ateom p…
laoj2 Oct 16, 2026
0877906
Add ate-idp-server to serve the discovery document and key set for ac…
thompsonmax Oct 16, 2026
d22a4bb
kube-api-linter: fix API type docs and the sandboxClass default (#2461)
ericcurtin Oct 16, 2026
f451cfa
Merge upstream actor JWT discovery and sandbox asset updates
EItanya Oct 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ jobs:
run: |
set -o errexit -o nounset -o pipefail

for component in ateapi atecontroller atelet ateworker-gvisor ateworker-microvm podcertcontroller atenet objectstore-plugin credential-provider/kubernetes-secrets; do
for component in ateapi ate-idp-server atecontroller atelet ateworker-gvisor ateworker-microvm podcertcontroller atenet objectstore-plugin credential-provider/kubernetes-secrets; do
KO_DOCKER_REPO="${IMAGE_REPOSITORY}/${component##*/}" \
./hack/run-tool.sh ko build \
--tags "${IMAGE_TAGS}" \
Expand Down
17 changes: 1 addition & 16 deletions .golangci-kal.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,21 +73,6 @@ linters:

exclusions:
rules:
# TEMPORARY: every current commentstart, conditions, defaultorrequired,
# optionalorrequired and defaults finding, excluded file-wide so this
# PR only introduces the tool with no content changes, per review on
# #416. A follow-up PR removes these and fixes the findings by class.
- path: 'pkg/api/v1alpha1/.*_types\.go'
text: '^commentstart:'
- path: 'pkg/api/v1alpha1/.*_types\.go'
text: '^conditions:'
- path: 'pkg/api/v1alpha1/.*_types\.go'
text: '^defaultorrequired:'
- path: 'pkg/api/v1alpha1/.*_types\.go'
text: '^optionalorrequired:'
- path: 'pkg/api/v1alpha1/.*_types\.go'
text: '^defaults:'

# Pre-existing findings from rules that require Go API changes
# (pointer fields, omitempty/omitzero tags, map-to-list refactors)
# on the existing v1alpha1 types. Each rule names the fields it
Expand All @@ -110,7 +95,7 @@ linters:
- path: 'pkg/api/v1alpha1/csidriverconfig_types\.go'
text: '^optionalfields: .*\bCSIDriverTLSConfig\.(ServerName|UsePodIdentity)\b'
- path: 'pkg/api/v1alpha1/csidriverconfig_types\.go'
text: '^nonpointerstructs: .*\bCSIDriverConfig\.Spec\b'
text: '^(nonpointerstructs|requiredfields): .*\bCSIDriverConfig\.Spec\b'
- path: 'pkg/api/v1alpha1/workerpool_types\.go'
text: '^optionalfields: .*\bWorkerPoolPodTemplate\.PriorityClassName\b'
- path: 'pkg/api/v1alpha1/workerpool_types\.go'
Expand Down
16 changes: 8 additions & 8 deletions charts/substrate-crds/templates/ate.dev_csidriverconfigs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,41 +59,41 @@ spec:
metadata:
type: object
spec:
description: CSIDriverConfigSpec defines the desired state of CSIDriverConfig
description: spec defines the desired state of CSIDriverConfig
properties:
controllerEndpoint:
description: |-
ControllerEndpoint is the gRPC endpoint for the CSI Controller service.
controllerEndpoint is the gRPC endpoint for the CSI Controller service.
Must be a valid network URI (e.g. dns:///csi-service:9000 or tcp://127.0.0.1:9000).
pattern: ^(tcp|dns)://.+$
type: string
driverName:
description: |-
DriverName is the standard CSI driver name (e.g. "hostpath.csi.k8s.io").
driverName is the standard CSI driver name (e.g. "hostpath.csi.k8s.io").
Matches the StorageClass referenced in ActorTemplate volume definitions.
maxLength: 63
minLength: 1
pattern: ^(substrate\.io/)?([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)$
type: string
nodeSocketOverride:
description: |-
NodeSocketOverride is an optional override for the CSI Node service socket
nodeSocketOverride is an optional override for the CSI Node service socket
on the worker nodes. If empty, ATE defaults to unix:///var/lib/kubelet/plugins/[DriverName]/csi.sock.
pattern: ^unix://.+$
type: string
tls:
description: TLS configures TLS/mTLS for the connection to the ControllerEndpoint.
description: tls configures TLS/mTLS for the connection to the ControllerEndpoint.
properties:
enabled:
description: Enabled controls whether TLS is used.
description: enabled controls whether TLS is used.
type: boolean
serverName:
description: |-
ServerName specifies the expected server name (SAN) for TLS certificate verification.
serverName specifies the expected server name (SAN) for TLS certificate verification.
Required when TLS is enabled.
type: string
usePodIdentity:
description: UsePodIdentity indicates whether to reuse Substrate's
description: usePodIdentity indicates whether to reuse Substrate's
Pod Identity (SPIFFE) certificates.
type: boolean
required:
Expand Down
11 changes: 5 additions & 6 deletions charts/substrate-crds/templates/ate.dev_sandboxconfigs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@ spec:
sandboxClass:
default: gvisor
description: |-
SandboxClass is the sandbox runtime family this config applies to. An
sandboxClass is the sandbox runtime family this config applies to. An
ActorTemplate only uses SandboxConfigs whose SandboxClass matches its
sandbox_config.sandbox_class.
enum:
Expand All @@ -102,13 +102,13 @@ spec:
properties:
sha256:
description: |-
SHA256 is the lower-case hex SHA256 of the asset. It both names the cached
sha256 is the lower-case hex SHA256 of the asset. It both names the cached
file (preventing collisions) and verifies the download's integrity.
pattern: ^[a-f0-9]{64}$
type: string
url:
description: |-
URL is where to download the asset from (e.g. a gs:// URL). atelet
url is where to download the asset from (e.g. a gs:// URL). atelet
fetches every URL through the node's object-store plugin, with the
plugin's credentials. The plugin refuses URLs under a snapshot location.
The in-tree plugin serves only its storage backend's scheme: gs:// on
Expand All @@ -124,7 +124,7 @@ spec:
type: object
type: object
description: |-
Assets is the set of files atelet fetches for this runtime, keyed first by
assets is the set of files atelet fetches for this runtime, keyed first by
architecture (GOARCH, e.g. "amd64", "arm64") and then by asset name. The
asset names are interpreted by the sandbox backend: gVisor expects a
"gvisor" asset (the release's gvisor.tar.zstd, which atelet extracts so
Expand All @@ -144,7 +144,7 @@ spec:
type: string
pauseImage:
description: |-
PauseImage is the container image used as the root sandbox container.
pauseImage is the container image used as the root sandbox container.
It holds the sandbox's namespaces and runs no workload code, so it is an
implementation detail of the sandbox rather than something actor authors
choose. Required for gvisor; not allowed for microvm, which runs no pause
Expand Down Expand Up @@ -182,7 +182,6 @@ spec:
x-kubernetes-list-type: map
required:
- defaultVersion
- sandboxClass
- versions
type: object
x-kubernetes-validations:
Expand Down
50 changes: 25 additions & 25 deletions charts/substrate-crds/templates/ate.dev_workerpools.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,28 +74,28 @@ spec:
description: spec defines the desired state of WorkerPool
properties:
replicas:
description: Replicas is the number of worker pods to run.
description: replicas is the number of worker pods to run.
format: int32
minimum: 0
type: integer
sandboxClasses:
description: |-
SandboxClasses lists the sandbox runtime families this pool runs. Exactly
sandboxClasses lists the sandbox runtime families this pool runs. Exactly
one entry is allowed today. The names cannot change after creation.
items:
description: WorkerPoolSandboxClass is one sandbox runtime family
a WorkerPool runs.
properties:
configRef:
description: |-
ConfigRef names a cluster-scoped SandboxConfig for this sandbox class.
configRef names a cluster-scoped SandboxConfig for this sandbox class.
The referenced config's SandboxClass must match Name. When omitted, the
pool uses the newest SandboxConfig of this class annotated
sandboxconfig.ate.dev/is-class-default: "true". The controller reports
the resolved config in status.sandboxClasses.
properties:
name:
description: Name is the SandboxConfig's metadata.name.
description: name is the SandboxConfig's metadata.name.
maxLength: 253
minLength: 1
type: string
Expand All @@ -104,7 +104,7 @@ spec:
type: object
name:
description: |-
Name selects the sandbox runtime family, which drives the worker pod
name selects the sandbox runtime family, which drives the worker pod
shape (KVM/vhost device mounts and node placement). The concrete binary
is still selected by WorkerImage. The sandbox binaries themselves come
from the SandboxConfig each ActorTemplate names (required).
Expand All @@ -127,14 +127,14 @@ spec:
- message: sandboxClasses names are immutable
rule: self.map(c, c.name) == oldSelf.map(c, c.name)
template:
description: Template holds optional metadata, scheduling, and resource
description: template holds optional metadata, scheduling, and resource
settings for worker workloads.
properties:
annotations:
additionalProperties:
type: string
description: |-
Annotations are added to the generated Deployment and worker pods. Keys
annotations are added to the generated Deployment and worker pods. Keys
in the ate.dev domain and its subdomains are reserved for controllers.
maxProperties: 64
type: object
Expand All @@ -153,7 +153,7 @@ spec:
pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
type: string
description: |-
Labels are added to the generated Deployment and worker pods. Keys in
labels are added to the generated Deployment and worker pods. Keys in
the ate.dev domain and its subdomains are reserved for controllers.
maxProperties: 64
type: object
Expand All @@ -164,7 +164,7 @@ spec:
rule: self.all(key, !format.qualifiedName().validate(key).hasValue())
nodeAffinity:
description: |-
NodeAffinity scheduling rules for the worker pods. Mapped to
nodeAffinity scheduling rules for the worker pods. Mapped to
spec.affinity.nodeAffinity on the pod.
properties:
preferredDuringSchedulingIgnoredDuringExecution:
Expand Down Expand Up @@ -365,14 +365,14 @@ spec:
nodeSelector:
additionalProperties:
type: string
description: NodeSelector is a selector which must be true for
description: nodeSelector is a selector which must be true for
the pod to fit on a node.
type: object
priorityClassName:
description: PriorityClassName for the worker pods.
description: priorityClassName for the worker pods.
type: string
resources:
description: Resources are the compute resources allocated for
description: resources are the compute resources allocated for
each worker pod.
properties:
claims:
Expand Down Expand Up @@ -433,13 +433,13 @@ spec:
type: object
serviceAccountName:
description: |-
ServiceAccountName for the worker pods. The ServiceAccount must exist
serviceAccountName for the worker pods. The ServiceAccount must exist
in the WorkerPool's namespace. When omitted, the pods run as the
"ateworker" ServiceAccount, which the controller creates.
minLength: 1
type: string
tolerations:
description: Tolerations for the worker pods.
description: tolerations for the worker pods.
items:
description: |-
The pod this Toleration is attached to tolerates any taint that matches
Expand Down Expand Up @@ -482,7 +482,7 @@ spec:
x-kubernetes-list-type: atomic
type: object
workerImage:
description: WorkerImage is the worker container image to deploy as
description: workerImage is the worker container image to deploy as
workers.
minLength: 1
type: string
Expand All @@ -495,26 +495,26 @@ spec:
description: status is the observed state of WorkerPool
properties:
readyReplicas:
description: ReadyReplicas is the number of ready worker pods.
description: readyReplicas is the number of ready worker pods.
format: int32
minimum: 0
type: integer
replicas:
description: Replicas is the total number of worker pods.
description: replicas is the total number of worker pods.
format: int32
minimum: 0
type: integer
sandboxClasses:
description: |-
SandboxClasses reports the SandboxConfig each sandbox class of the pool
sandboxClasses reports the SandboxConfig each sandbox class of the pool
uses and whether the class's spec resolves.
items:
description: |-
WorkerPoolSandboxClassStatus reports the SandboxConfig and resolution state
of one sandbox class of a WorkerPool.
properties:
conditions:
description: Conditions describe the current state of this sandbox
description: conditions describe the current state of this sandbox
class.
items:
description: Condition contains details for one aspect of
Expand Down Expand Up @@ -577,34 +577,34 @@ spec:
x-kubernetes-list-type: map
configRef:
description: |-
ConfigRef names the cluster-scoped SandboxConfig in use. That is the
configRef names the cluster-scoped SandboxConfig in use. That is the
config spec.sandboxClasses[].configRef names, or the class default, or
the last resolved config while the spec does not resolve. Omitted when
the class has never resolved.
properties:
name:
description: Name is the SandboxConfig's metadata.name.
description: name is the SandboxConfig's metadata.name.
maxLength: 253
minLength: 1
type: string
required:
- name
type: object
name:
description: Name is the sandbox runtime family.
description: name is the sandbox runtime family.
enum:
- gvisor
- microvm
type: string
pendingConfigRef:
description: |-
PendingConfigRef names the SandboxConfig the class is switching to
pendingConfigRef names the SandboxConfig the class is switching to
while the controller confirms it against the API server. It protects
the config from deletion like configRef does. The same reconcile
clears it, and configRef either moves to it or stays where it was.
properties:
name:
description: Name is the SandboxConfig's metadata.name.
description: name is the SandboxConfig's metadata.name.
maxLength: 253
minLength: 1
type: string
Expand All @@ -620,7 +620,7 @@ spec:
- name
x-kubernetes-list-type: map
selector:
description: Selector is the label selector for the worker pods.
description: selector is the label selector for the worker pods.
type: string
type: object
required:
Expand Down
10 changes: 10 additions & 0 deletions charts/substrate/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,3 +187,13 @@ Upgrade clients and components together: upstream now uses the
`go.ate.dev/substrate` Go module, and the worker protocol includes dynamic
runtime registration and the unified suspend/pause workflow. Custom worker
images and integrations must use the matching API version.

Every checkpoint now requires an object-storage URI, including a pause that
keeps its snapshot local. Ensure actor templates have a usable
`snapshotConfig.storageLocation` before pausing them. Upgrade the API server,
atelet, and workers together for the checkpoint validation and per-actor
sandbox asset paths.

The `ate-idp-server` binary serves actor JWT discovery and public signing keys
over HTTPS. It is not deployed by this chart yet; upgrading the chart does not
expose a discovery endpoint.
Loading
Loading