Add a standalone Kubernetes credential provider for AGW egress - #43
Merged
Merged
Conversation
Resolve ate-secret URIs from Kubernetes Secrets with injector-only mTLS and default-deny atespace-to-namespace grants. Deploy the provider alongside ateapi so it can reuse the existing Pod identity, certificate, and Service. Wire the provider into agentgateway's HTTPS interception route, with optional Helm and Kustomize configuration and namespace-scoped RBAC setup. Pin the nightly containing credential-provider configuration support; its RPC and URI scheme still need alignment before end-to-end injection works. Co-authored-by: Yufan Su <[email protected]> Signed-off-by: Eitan Yarmush <[email protected]>
Add an opt-in Docker integration test covering actor authentication, TLS interception, provider mTLS, namespace denial, and cleartext denial using the Helm egress configuration. Signed-off-by: Eitan Yarmush <[email protected]>
Use the published multi-architecture build supporting FetchSecret and ate-secret URIs. Document the tested integration and keep Docker pull diagnostics out of the integration test container ID. Signed-off-by: Eitan Yarmush <[email protected]>
Validate exact header injection and namespace, RBAC, and cleartext denials against a local HTTPS origin. Remove fixture workers before their namespace to avoid delayed namespace finalization. Signed-off-by: Eitan Yarmush <[email protected]>
Follow the upstream package and Deployment layout with a dedicated ServiceAccount and Service. Consolidate gateway integration coverage into the cluster E2E suite, including cache isolation across atespaces. Signed-off-by: Eitan Yarmush <[email protected]>
EItanya
changed the title
Signed-off-by: Eitan Yarmush <[email protected]>
EItanya
marked this pull request as ready for review
September 17, 2026 19:37
Install the provider's get-only Secret RBAC with the chart and standalone manifests. Enable injection on HTTP alongside HTTPS so the E2E can use the installed gateway configuration without modifying ConfigMaps or provisioning origin certificates. Signed-off-by: Eitan Yarmush <[email protected]>
Configure the provider and MITM gateway on every Helm install, and run credential and MITM E2E alongside the standard suites using the initial configuration. Signed-off-by: Eitan Yarmush <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Port the Kubernetes Secret credential provider from agent-substrate#1335 as a standalone Deployment, following upstream's source and manifest layout. AGW resolves
ate-secret://kubernetes.io/<namespace>/<secret>[/<key>]over mTLS and injects credentials into HTTP and intercepted HTTPS egress requests.The Helm chart always installs the provider and enables HTTPS MITM. Helm and Kustomize supply its ServiceAccount, Service, and get-only Secret ClusterRole/binding. The provider requires the trusted injector's SPIFFE identity and explicit atespace-to-namespace grants before reading Secrets. Namespace grants default to deny all access. Secret values are neither persisted nor logged; AGW caches successful credentials per actor and URI for five minutes.
HTTPS uses dynamic destinations, one MITM CA for actor-facing certificates, and system CA roots for upstream TLS. Public APIs need no per-backend certificates. AGW compatibility comes from agentgateway/agentgateway#3524 and https://github.com/agentgateway/agentgateway/actions/runs/35238449333. Both installers pin
ghcr.io/agentgateway/agentgateway:v0.0.0-alpha.8dba3989@sha256:fdde26d4b0ea11d3e740dc19905dfe9b26e88f40fa8b9985f94ed1d8420e389e.The Helm workflow installs the provider, namespace grants, and MITM configuration upfront and runs credential and MITM tests with the standard suites. The credential E2E uses real actors, Secrets, AGW, and the provider against a local HTTP origin. Four cases cover exact token injection, missing injection, namespace-policy denial, and cache isolation between atespaces. Tests use chart-managed RBAC and the installed gateway configuration. The existing MITM suite verifies actor trust against a public HTTPS origin.
Validation:
env -u NO_COLOR make verifypasses, including race tests and repository verifiers.make verify-helm-templatepass; provider/AGW rendering tests cover unconditional installation, custom releases, RBAC, and default public TLS trust.