[EPIC] Make repository Provider Neutral #3161

Activity

1. Steven Shriver (stshrive)

   added the

   Feature

   issue type on Oct 23, 2026
2. Steven Shriver (stshrive)

   added

   kind/featureAn enhancement / feature request or implementationAn enhancement / feature request or implementation

   area/dev-infra

   on Oct 23, 2026
3. Steven Shriver (stshrive)

   added a parent issue on Oct 23, 2026

   • [PROJECT] Extensible Install w/ Kustomize & Helm #3158
4. Steven Shriver (stshrive)

   added this to the v1.0.x milestone on Oct 27, 2026
5. Julian Gutierrez Oschmann (juli4n)

   added a commit that references this issue on Oct 28, 2026

   The GCP Secret Manager credential provider moved to agent-substrate-p…

   ...

   8f02374
6. Steven Shriver (stshrive)

   added a sub-issue on Oct 28, 2026

   • Remove tools/setup-gcp and point docs to ai-on-gke/substrate-gke #3390
7. MushuEE commented on Oct 28, 2026

   

   Grant McCloskey (MushuEE)

   on Oct 28, 2026

   Collaborator

   More actions

   Cross-linking the issues and PRs already in flight for this epic. Several were filed or opened on their own before this epic existed, so this comment maps each one to a requirement and lists what nothing covers yet. State checked against main on 2026-10-28.

   Umbrella / related: #2304 (migrate tools/setup-gcp to substrate-gke), ai-on-gke/substrate-gke#82 (GKE content landing in substrate-gke), #3189 (ate-setup provider interface), #3188 (stable object names for provider patches), #1782 / #1830 (generic-cluster install profile and docs).

   Requirement → tracking

   Requirement	Issues	PRs	Status
   Delete GKE provisioning/teardown tools from core	#2304, #3390, #2341	#3396 (removes tools/setup-gcp and hack/teardown.sh)	Open; blocked on ai-on-gke/substrate-gke#82
   Delete GCS staging scripts	none	none	Gap. #3396/#3399 only edit a comment in hack/microvm-assets/stage-to-gcs.sh
   Move the GMP PodMonitoring out of core	#2589	#3399 (removes it); #2604 (skips it when the CRD is missing)	Open. #2604 and #3399 overlap, so one should close
   Move the GKE ComputeClass toleration on atelet	#2760 (follow-up to #2679)	#3399	Open
   Move the GKE OTel endpoint	(#1258)	#3399 (empties ate-otel-config); #2426 (preflight check, --otlp-endpoint=none)	Open
   Move the GCS storage default	#2378	#3197 (ate-storage-config, still GCS in base)	Gap. ATE_STORAGE_BACKEND: "gcs" is still the base default in atelet.yaml and ate-api-server.yaml, and #3197 keeps it
   Decide atelet's default credential-provider config and document it	#2669	#2799 (opt-in Secret-based provider)	Partial. Base atelet.yaml still mounts /home/kubernetes/bin and /etc/srv/kubernetes/cri_auth_config.yaml. #2799 is additive, and no decision on the default has been recorded
   Remove Cloud SQL logic from ate-setup	#2825, #2875	#3399 (removes the Cloud SQL settings, proxy sidecar and WI annotation); #2960 (PSC docs)	Open. See the deprecation gap below
   Safeguard against an external-DB install switching to bundled Postgres	—	#2588 ✅ merged	Done
   Remove gcloud credential fetching from ate-setup	none	none	Gap. cmd/ate-setup/internal/config/credentials.go still runs gcloud container clusters get-credentials
   Remove GKE token-issuer derivation	none	none	Gap. --cluster-name still "derive[s] the JWT issuer" (config/setting.go, config/config.go)
   Remove the Google registry keychain	none	none	Gap. cmd/ate-setup/internal/images/digest.go still uses authn.NewMultiKeychain(authn.DefaultKeychain, google.Keychain)
   Deprecation warnings a release ahead	none	none	Gap. #3399 turns a set ATE_API_POSTGRES_CLOUDSQL_* into a hard error in the same change, with no warning release first
   Replace atelet's anonymous GCS asset download with generic HTTPS	#2063 (closed), #2385 (closed), #2613 (closed), #2630 (design, open)	#2439 ✅, #2614 ✅	Partial. Private assets now go through the object-store plugin, but atelet still falls back to an anonymous GCS client for gs:// URLs (cmd/atelet/sandbox_assets.go). The bundled sandboxconfig-gvisor.yaml points at gs://gvisor, and #2649 / #2657 only make that location overridable. No issue covers a generic HTTPS fetch
   Replace GCE detection in the workers with a log-format setting	(#3306 is related)	none	Gap. ateworker-gvisor and ateworker-microvm still call metadata.OnGCE() to pick the actor log label key
   Remove GCP guidance from CRD and API docs	none	none	Gap. api/infra/k8s/ate/v1/sandboxconfig_types.go, api/objectstore/v1/objectstore.proto and docs/api-guide.md still use gs:// examples and GCS-specific fallback text
   Move the GCP Secret Manager plugin out of core	#2032	#1991 (original), #3365 ✅ merged (moved to agent-substrate-plugins/credprovider-gcp-secret-manager)	Done
   Move the GCS object-store backend out of core	#3095 (what out-of-tree providers need), #3156	#2398 ✅ (ate-api-server stops linking GCS/S3 SDKs), #3358 (pkg/objectstore/actorauthz for out-of-tree providers), #3138, #3150	Partial. GCS still lives in internal/objectstore/gcs.go, internal/objectstoreplugin/gcs* and pkg/objectstorage/gcs*.go, and no issue tracks moving it. #3381 / #2595 (Azure) go the other way and add a backend in-tree, which this epic should settle

   Gaps with no issue yet

   1. Delete hack/microvm-assets/stage-to-gcs.sh (and update its README) once substrate-gke has a copy.
   2. Remove the GCS storage default from base manifests, and decide what the neutral default is (none / required setting / rustfs).
   3. Record the atelet credential-provider default decision ([Bug]: atelet credential-provider configuration is hard-coded to GKE host paths #2669 is a bug report, not a decision) and remove the GKE host paths from base.
   4. ate-setup: remove gcloud get-credentials, GKE JWT-issuer derivation from --cluster-name, and google.Keychain.
   5. A deprecation-warning release before Cloud SQL and the other ate-setup GCP settings become hard errors. This conflicts with manifests: remove the GKE-specific install content #3399 as written.
   6. A generic HTTPS asset fetch in atelet to replace the anonymous gs:// fallback, and a neutral default for the bundled gVisor SandboxConfig (ties in with Design: how should object-store plugins signal that atelet may read a public sandbox asset anonymously? #2630).
   7. Workers: replace metadata.OnGCE() with an explicit log-format setting.
   8. Remove GCP guidance from CRD/proto docs and docs/api-guide.md.
   9. Move the GCS object-store backend out of core, and decide in-tree vs out-of-tree for new backends (objectstore-plugin: Azure Blob Storage backend #3381 / Add an Azure Blob Storage object-store plugin #2595).

   Coordination notes

   • ate-setup no longer requires the GKE PodMonitoring CRD #2604 and manifests: remove the GKE-specific install content #3399 both address the PodMonitoring. Pick one.
   • tools: remove setup-gcp and hack/teardown.sh #3396 says it covers Remove tools/setup-gcp and point docs to ai-on-gke/substrate-gke #3390, and manifests: remove the GKE-specific install content #3399 is stacked on tools: remove setup-gcp and hack/teardown.sh #3396.
   • Support per-atespace image pull credentials and cache authorization in atelet #2080 (node GCP credentials for tenant image pulls): I couldn't find the gcr.io / pkg.dev credential logic in internal/imagecache on main, so it may already be fixed. Can someone confirm and close it?
   • Suggest assigning an owner to this epic and converting the gaps above into sub-issues so new work stops landing without a home.
8. Grant McCloskey (MushuEE)

   added a commit that references this issue on Oct 29, 2026

   Say the micro-VM assets are not GKE-specific, only their GCS staging

   ...

   c0d2eda