ateom/actor ID split: Ateom uses MintAteomActorCertificate by ahmedtd · Pull Request #1809 · agent-substrate/substrate

Taahir Ahmed (ahmedtd) · 2026-09-22T22:01:19Z

Update atelet/ateom/atunnel to use the new MintAteomActorCertificate, and correct anything that was coded to expect the old actor SPIFFE URI.

Max Thompson (thompsonmax) · 2026-09-24T22:02:28Z

 		return nil
 	}
-	actor, err := resources.ActorRefFromSPIFFEID(actorSpiffeID)
+	actor, err := resources.ActorRefFromActorSPIFFEID(actorSpiffeID)


Does this need to use ActorRefFromAteomForActorSPIFFEID? My understanding is that the actorSpiffeID here is the one we constructed with AteomForActorSPIFFEID in egress/credentials.go and passed to FetchSecret.

Hmmmm. I think this field logically should be the actor SPIFFE ID, not the ateom-for-actor SPIFFE ID. This might mean we need to rewrite the URI in the egress gateway: once we authenticate the incoming ateom-for-actor certificate, construct the correct actor SPIFFE ID.

I've made the necessary adjustments.

Egress parses the ateom-for-actor SPIFFE ID from the incoming connection into an ActorRef, then flattens it back to a plain actor SPIFFE ID when calling plugins (because they care about the actor identity, not the ateom identity).

Max Thompson (thompsonmax) · 2026-09-24T22:14:47Z

+func ActorRefFromActorSPIFFEID(id string) (ActorRef, error) {
+	u, err := url.Parse(id)
+	if err != nil {
+		return ActorRef{}, fmt.Errorf("invalid actor SPIFFE ID %q: %w", id, err)
+	}
+	return ActorRefFromActorSPIFFEURL(u)
+}
+
+func ActorRefFromActorSPIFFEURL(u *url.URL) (ActorRef, error) {
+	if u.Scheme != "spiffe" || u.Host != ActorSPIFFETrustDomain || u.User != nil || u.RawQuery != "" || u.Fragment != "" {
+		return ActorRef{}, fmt.Errorf("%q does not have format spiffe://<trust.domain>/actor/<atespace>/<name>", u.String())
+	}
+	segments := strings.Split(strings.TrimPrefix(u.Path, "/"), "/")
+	if len(segments) != 3 || segments[0] != "actor" {
+		return ActorRef{}, fmt.Errorf("%q does not have format spiffe://<trust.domain>/actor/<atespace>/<name>", u.String())
+	}
+	atespace, name := segments[1], segments[2]
+	if !IsValidResourceName(atespace) {
+		return ActorRef{}, fmt.Errorf("%q is not a valid atespace", atespace)
+	}
+	if !IsValidResourceName(name) {
+		return ActorRef{}, fmt.Errorf("%q is not a valid actor name", name)
+	}
+	return ActorRef{Atespace: atespace, Name: name}, nil
+}


Should we add tests for these?

Max Thompson (thompsonmax) · 2026-09-24T22:19:24Z

 			Scheme: "spiffe",
 			Host:   "substrate-actor.local",
-			Path:   path.Join("atespace", identity.Atespace, "actor", identity.ActorName),
+			Path:   path.Join("ateom", "actor", atespace, actorName),


IIUC the new ateom for actor cert identifier format is "ateom-for-actor/Atespace/Name", do we need to update that here?

Also not sure how the tests are passing here while the "wrong" format is being used.

Yup, let me investigate why they are passing.

The SPIFFE ID is only used in a context where it is supposed to point at an invalid actor.

Max Thompson (thompsonmax) · 2026-09-25T19:34:34Z

+				if !strings.Contains(line.text, actorName) {
+					t.Logf("Log line does not contain %s, discarding", actorName)
+					continue
+				}
+				t.Logf("Considering log line: %s", line.text)
 				authority, ok := accessLogField(line.text, "authority")
-				if ok && strings.HasSuffix(authority, ":"+port) && strings.Contains(line.text, "/actor/"+actorName) {
-					t.Logf("egress gateway tunneled the request: %s", line.text)
-					return true
+				if !ok {
+					t.Logf("Log line does not have an authority field, discarding")
+					continue
+				}
+				if !strings.HasSuffix(authority, ":"+port) {
+					t.Logf("Authority does not contain %s, discarding", ":"+port)
+					continue
+				}
+				spiffeSlug := "/ateom-for-actor/" + atespace + "/" + actorName
+				if !strings.Contains(line.text, spiffeSlug) {
+					t.Logf("Log line does not contain %q, discarding", spiffeSlug)
+					continue
 				}
+				t.Logf("Log line matches")


Looks like some of these logs might be for debugging tests, are they all useful or should we trim them down?

Thanks, trimmed

…nt-substrate#1810) The purpose field in MintActorCertificate (and the certs it issues) is no longer needed. The distinction between actors and ateoms-for-actors is now built into the SPIFFE URI. Stacked over agent-substrate#1809

Substrate's ateom/actor identity split in agent-substrate/substrate#1809 removed the certificate extension that agentgateway used to authorize egress. It also changed the actor SPIFFE URI expected by credential providers, so both CONNECT authorization and credential injection broke. This PR reads the single `spiffe://substrate-actor.local/ateom-for-actor/<atespace>/<actor>` URI from the authenticated certificate and keeps the `GetActor` check that the actor exists and is running. The UID now comes from `GetActor` for logging. Credential providers receive `spiffe://substrate-actor.local/actor/<atespace>/<actor>`. AI assistance: Codex prepared the implementation, tests, code comments, and this draft description. - [x] As required by the [Code of Conduct](https://github.com/agentgateway/agentgateway/blob/main/CODE_OF_CONDUCT.md#generative-ai-policy), the description, docs, and comments (words meant for humans) are written by a human, not by an LLM. Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

…ess gateway The agentgateway line's 2.3.0 is its re-pin onto upstream v1.6.0 (ea560864): the egress gateway authorizes from the spiffe://substrate-actor.local/ateom-for-actor/<atespace>/<actor> URI that kagent-dev/substrate v0.3.0-alpha3's ateom presents (agent-substrate#1809, agentgateway#3677), which 2.2.2 refuses. Upstream's chart pins the same build as ghcr.io/kagent-dev/substrate/agentgateway:50999825cb55 (agentgateway#3689). The chart default and the CircleCI agentgateway-image parameter move together.

This was referenced Sep 22, 2026

ateom/actor ID split: Clean up purpose from MintActorCertificate #1810

Merged

ateom/actor ID split: Define MintAteomActorCertificate #1626

Merged

Taahir Ahmed (ahmedtd) requested review from Lior Lieberman (LiorLieberman) and Max Thompson (thompsonmax) September 22, 2026 22:09

Taahir Ahmed (ahmedtd) force-pushed the separate-certs-2 branch 9 times, most recently from 215fc57 to b913933 Compare September 23, 2026 22:22

John Howard (howardjohn) mentioned this pull request Sep 23, 2026

(WIP) ateom/actor ID split: Ateom uses MintAteomActorCertificate - Agentgateway support #1841

Draft

Max Thompson (thompsonmax) reviewed Sep 24, 2026

View reviewed changes

Taahir Ahmed (ahmedtd) added 8 commits September 25, 2026 11:23

ateom/actor ID split: Ateom uses MintAteomActorCertificate

2a29926

E2E Debug: Log anything resembling a SPIFFE ID

f05c7bb

fixup: Use the atespace of the actor that was created

7d2d566

fixup: Additional e2e logging

3c30157

fixup: credential provider tests

3eb97e8

fixup: Fix egress handling of SPIFFE ID

19a34f7

fixup: E2E Actor SPIFFE ID

3fe7fb2

fixup: tests

2737afd

Taahir Ahmed (ahmedtd) force-pushed the separate-certs-2 branch from 56938cb to 2737afd Compare September 25, 2026 18:23

fixup: tests

1da0f0f

Max Thompson (thompsonmax) approved these changes Sep 25, 2026

View reviewed changes

fixup: Trim e2e log lines

d5d34ef

Haven Xia (HavenXia) approved these changes Sep 25, 2026

View reviewed changes

Haven Xia (HavenXia) enabled auto-merge September 25, 2026 20:58

Haven Xia (HavenXia) added this pull request to the merge queue Sep 25, 2026

Merged via the queue into agent-substrate:main with commit 8d6be5f Sep 25, 2026
10 of 11 checks passed

Eitan Yarmush (EItanya) mentioned this pull request Sep 26, 2026

Fix Substrate egress after the ateom/actor identity split agentgateway/agentgateway#3677

Merged

1 task done

This was referenced Sep 26, 2026

ci probe: an unrelated test comment still fails the agentgateway e2e lane #1921

Closed

agentgateway e2e lane fails on main since #1809: ateom-for-actor certificates carry no ActorIdentity extension #1922

Closed

Bowei Du (bowei) added area/api-machinery area/identity area/network area/node area/security Security related issue/pr kind/feature An enhancement / feature request or implementation labels Sep 29, 2026

github-actions Bot mentioned this pull request Oct 2, 2026

docs: document 1.6 connection, backend, and Vertex fixes agentgateway/website#1191

Merged

Max Thompson (thompsonmax) mentioned this pull request Oct 5, 2026

Bind gateway-minted actor JWTs to the actor's UID through the ateom-for-actor certificate #2208

Open

Navigation Menu

Repository navigation

ateom/actor ID split: Ateom uses MintAteomActorCertificate - #1809

ateom/actor ID split: Ateom uses MintAteomActorCertificate#1809
Haven Xia (HavenXia) merged 10 commits into
agent-substrate:mainfrom
ahmedtd:separate-certs-2

Taahir Ahmed (ahmedtd) commented Sep 22, 2026 •

edited

Loading

Uh oh!

Max Thompson (thompsonmax) Sep 24, 2026

Uh oh!

Taahir Ahmed (ahmedtd) Sep 25, 2026

Uh oh!

Taahir Ahmed (ahmedtd) Sep 25, 2026

Uh oh!

Max Thompson (thompsonmax) Sep 24, 2026

Uh oh!

Taahir Ahmed (ahmedtd) Sep 25, 2026

Uh oh!

Max Thompson (thompsonmax) Sep 24, 2026

Uh oh!

Taahir Ahmed (ahmedtd) Sep 25, 2026

Uh oh!

Taahir Ahmed (ahmedtd) Sep 25, 2026

Uh oh!

Max Thompson (thompsonmax) Sep 25, 2026

Uh oh!

Taahir Ahmed (ahmedtd) Sep 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Taahir Ahmed (ahmedtd) commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Taahir Ahmed (ahmedtd) commented Sep 22, 2026 •

edited

Loading