feat(substrate): the compiled ActorTemplate carries the revision's egress policy as its default - #2942
Draft
QuentinBisson wants to merge 1 commit into
Conversation
…ress policy as its default ActorTemplateForRevision sets default_egress_policy from the revision's egress destinations and credentials, the same allowlist the AgentInstance workflow creates for each actor. Substrate copies it onto every actor it creates from the template, including the golden actor the template reconciler creates, which no client call could give a policy before it boots: without one the golden boot is denied all egress (403) and a workload that fetches skills or plugins before readyz never gets its snapshot. The policy builder moves to the substrate package so both callers share it; the workflow's EnsureActorEgressPolicy stays as the idempotent check. The revision digest carries an actorTemplateFormat marker so templates compiled before this change are re-created instead of conflicting. Depends on ActorTemplate.default_egress_policy in agent-substrate/substrate (agent-substrate/substrate#1324). Fixes kagent-dev#2604 Signed-off-by: QuentinBisson <quentin@giantswarm.io>
Contributor
Author
|
One gap this does not close: Substrate's credential provider resolves Secrets per atespace, and the golden Actor boots in the reconciler's atespace ( |
github-actions
Bot
added
enhancement
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A golden Actor is created by Substrate's template reconciler, so the AgentInstance workflow never gets to create its EgressPolicy before it boots. atenet denies every request of an Actor without a policy: a template whose harness fetches Git, OCI or S3 skills or plugins during the golden boot fails with 403 and never gets its snapshot (#2604).
Change
ActorTemplateForRevisionsetsdefault_egress_policyon the compiled ActorTemplate from the revision's egress destinations and credentials, the same allowlist the workflow creates per actor; Substrate copies it onto every Actor of the template, the golden one included. The policy builder moves to thesubstratepackage so both callers share it, and the revision digest carries anactorTemplateFormatmarker so templates compiled before this change are re-created rather than conflicting. Draft until agent-substrate/substrate shipsActorTemplate.default_egress_policy(agent-substrate/substrate#1868, design agent-substrate/substrate#1324); the build fails on that field until then.