Repository navigation
feat(chart): further credential providers for the egress gateway - #248
Merged
Merged
Conversation
credentialProvider.additionalProviders adds providers to the egress gateway's credentialProviders list beside the bundled kubernetes.io one, on both the HTTPS and the HTTP listener. The gateway dials each with its pod identity and verifies a servicedns.podcert.ate.dev serving certificate. An entry needs uriAuthority and host, cannot replace kubernetes.io and cannot name an authority twice. The default render is unchanged. (cherry picked from commit dbdb520)
(cherry picked from commit ac0ab28)
uriAuthority must be a lowercase DNS name and host must be <service>.<namespace>.svc:<port>, the name a servicedns serving certificate carries, so a value can neither inject YAML into the gateway config nor name a provider the gateway can never match or verify. The values and README say which client identity the provider must require. (cherry picked from commit 9b4f838)
This was referenced Oct 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The egress gateway resolves
ate-secret://URIs through a list of credential providers keyed by URI authority, but the chart renders only the bundledk8s.ioone. kagent needs further providers, such as one that answers with the credential of the turn's caller, so a credential is injected at egress and never enters the actor.Change
QuentinBisson's #104, carried onto the line after its re-pin onto v0.4.0-alpha1, with his authorship kept on all three commits (
cherry-pick -x). #104 conflicted with its base, so it couldn't be rebased at merge.credentialProvider.additionalProvidersadds providers on both egress listeners, rendered by the helpersubstrate.egressCredentialProvidersnext to the bundledk8s.ioone.uriAuthoritymust be a lowercase DNS name, andhostmust be<service>.<namespace>.svc:<port>, the name the provider'sservicedns.podcert.ate.devserving certificate carries. The gateway presents its pod identity, which the provider must require.Replaces #104.
Testing
helm unittest charts/substratepasses (90 tests, includingatenet_egress_credential_providers_test.yaml).helm templaterenders the bundled provider alone by default, andk8s.iopluskagent.devon both listeners with one additional provider set.Written by an agent.