Delete hack/install-ate.sh and hack/install-ate-kind.sh

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -47,7 +47,7 @@ body:
       label: Steps to Reproduce
       description: How can the issue be reproduced? Provide commands, scripts, or manifests (e.g., ActorTemplate).
       placeholder: |
-        1. Deploy Substrate with `hack/install-ate-kind.sh ...`
+        1. Deploy Substrate with `go run ./cmd/ate-setup --kind ...`
         2. Apply manifest `kubectl apply -f ...`
         3. Run command `...`
         4. See error

.github/workflows/pr-workflow.yaml

@@ -267,27 +267,14 @@ jobs:
       # gateway. ATE_PREVIEW above selects the preview features.
       env:
         ATE_ATENET_DATAPLANE: ${{ matrix.dataplane }}
-        NO_DEV_ENV: "true"
-        KO_DOCKER_REPO: "localhost:5001"
-        ATE_INSTALL_KIND: "true"
-        BUCKET_NAME: "ate-snapshot"
-        KIND_CLUSTER_NAME: "kind"
-        KUBECTL_CONTEXT: "kind-kind"
-      run: go run ./cmd/ate-setup deploy ate-system
+      run: go run ./cmd/ate-setup --kind deploy ate-system
     - name: Enable NFS
       # Load NFS kernel modules so in-cluster NFS server and CSI driver can run.
       run: |
         sudo modprobe nfs || true
         sudo modprobe nfsd || true
     - name: Install CSI NFS driver
-      env:
-        NO_DEV_ENV: "true"
-        KO_DOCKER_REPO: "localhost:5001"
-        ATE_INSTALL_KIND: "true"
-        BUCKET_NAME: "ate-snapshot"
-        KIND_CLUSTER_NAME: "kind"
-        KUBECTL_CONTEXT: "kind-kind"
-      run: go run ./cmd/ate-setup setup csi nfs
+      run: go run ./cmd/ate-setup --kind setup csi nfs
     - name: Deploy micro-VM counter demo
       # Stages the (cached) assets into the cluster's rustfs and deploys the
       # counter-microvm demo onto the control plane installed above. The demo
@@ -296,29 +283,15 @@ jobs:
         ATE_ATENET_DATAPLANE: ${{ matrix.dataplane }}
       run: hack/run-microvm-demo-kind.sh
     - name: Deploy gVisor counter demo
-      env:
-        NO_DEV_ENV: "true"
-        KO_DOCKER_REPO: "localhost:5001"
-        ATE_INSTALL_KIND: "true"
-        BUCKET_NAME: "ate-snapshot"
-        KIND_CLUSTER_NAME: "kind"
-        KUBECTL_CONTEXT: "kind-kind"
-      run: go run ./cmd/ate-setup deploy demo counter
+      run: go run ./cmd/ate-setup --kind deploy demo counter
     - name: Deploy egress demos
       # TestActorEgress in the networking suite builds its Actor from the egress
       # ActorTemplate for the class under test, so both fixtures have to exist
       # before their respective lane runs. The demo's actors trust the CA the
       # gateway mints its leaves from.
-      env:
-        NO_DEV_ENV: "true"
-        KO_DOCKER_REPO: "localhost:5001"
-        ATE_INSTALL_KIND: "true"
-        BUCKET_NAME: "ate-snapshot"
-        KIND_CLUSTER_NAME: "kind"
-        KUBECTL_CONTEXT: "kind-kind"
       run: |
-        go run ./cmd/ate-setup deploy demo egress
-        go run ./cmd/ate-setup deploy demo egress-microvm
+        go run ./cmd/ate-setup --kind deploy demo egress
+        go run ./cmd/ate-setup --kind deploy demo egress-microvm
     - name: Trust local TLS origins in egress gateway
       run: hack/setup-e2e-egress-tls-kind.sh
     # scale the idle sandbox class's demo pools to zero so each lane has the node

AGENTS.md

@@ -66,7 +66,7 @@ It takes the Kubernetes control-plane out of the critical path to achieve lower
 Agent Substrate relies on the fact that agent-like applications tend to be idle most of the time to achieve heavy multiplexing.
 
 For development, it's recommended to read the `README.md` and `CONTRIBUTING.md` in the root folder.
-See `hack/install-ate.sh` and `tools/setup-gcp` for provisioning and deploying clusters and GCP resources.
+See `cmd/ate-setup` and `tools/setup-gcp` for provisioning and deploying clusters and GCP resources.
 
 ## Repository Layout
 
@@ -104,7 +104,7 @@ See `docs/dev/code-layout.md` for the full rationale and per-directory details.
 The dev entry points are the scripts under `hack/` and the `cmd/ate-setup` installer.
 
 ### Building and Installing
-- **Install from source**: `go run ./cmd/ate-setup deploy ate-system` (or the `hack/install-ate.sh` shim) builds every image with ko as part of the install; see `cmd/ate-setup/README.md`
+- **Install from source**: `go run ./cmd/ate-setup deploy ate-system` builds every image with ko as part of the install; see `cmd/ate-setup/README.md`
 - **Binaries**: `go build -o bin/kubectl-ate ./cmd/kubectl-ate`, `go build -o bin/ate-setup ./cmd/ate-setup`
 - **Release images**: `VERSION=TAG go run ./cmd/ate-setup publish release-images --ko-docker-repo REPO` (the release set, `images.ReleaseComponents`, all tagged `TAG`; see `docs/dev/releasing.md`)
 - **Release binaries**: `VERSION=TAG go run ./cmd/ate-setup publish release-binaries --out DIR` (`kubectl-ate` for linux and darwin, amd64 and arm64, with `.sha256` files)

README.md

@@ -118,12 +118,16 @@ To quickly set up the complete environment:
 # create cluster and local registry
 hack/create-kind-cluster.sh
 
+# make ate-setup target the kind cluster; set this in every shell that runs
+# ate-setup, including for the demo walkthroughs
+export ATE_INSTALL_KIND=true
+
 # install Substrate
-hack/install-ate-kind.sh deploy ate-system --credential-provider='{"name":"k8s.io"}' \
+go run ./cmd/ate-setup deploy ate-system --credential-provider='{"name":"k8s.io"}' \
   --ingress-allowed-spiffe-ids=spiffe://cluster.local/ns/ate-system/sa/atenet-client
 
 # install counter demo
-hack/install-ate-kind.sh deploy demo counter
+go run ./cmd/ate-setup deploy demo counter
 
 # install kubectl-ate
 go install ./cmd/kubectl-ate
@@ -215,8 +219,8 @@ go run ./tools/setup-gcp create bucket
 To run the PostgreSQL store backend on Cloud SQL — with IAM database
 authentication and no passwords — see [tools/setup-gcp/cloud-sql.md](tools/setup-gcp/cloud-sql.md).
 
-Similarly, you can deploy or cleanup specific Agent Substrate components using
-the installation script. See `go run ./cmd/ate-setup` for all options.
+Similarly, you can deploy or clean up specific Agent Substrate components with
+`ate-setup`. See `go run ./cmd/ate-setup --help` for all options.
 ```bash
 # Re-deploy only ate-apiserver of the ATE system
 go run ./cmd/ate-setup deploy apiserver

benchmarking/README.md

@@ -30,7 +30,7 @@ scenario ladder, read [observability.md](observability.md).
 > ```bash
 > ATE_API_AUTHZ_BOOTSTRAP_OWNERS=system:serviceaccount:ate-system:ate-client,spiffe://cluster.local/ns/benchmarking/sa/default \
 > ATE_INGRESS_ALLOWED_SPIFFE_IDS=spiffe://cluster.local/ns/benchmarking/sa/default \
->   ./hack/install-ate.sh deploy ate-system
+>   go run ./cmd/ate-setup deploy ate-system
 > ```
 > The nightly automation sets both itself; see
 > [automation/README.md](automation/README.md).
@@ -154,7 +154,7 @@ and state restoration latency when a durable directory is attached to the actor.
   * `glutton-storage`: Attaches an external CSI volume instead of a durable
     directory. `deploy_locust.sh` and `workloads/deploy.sh` deploy it only
     when `--storage-class-name` names an existing StorageClass. To run it on
-    NFS, install with `hack/install-ate.sh setup csi nfs` and pass
+    NFS, install with `go run ./cmd/ate-setup setup csi nfs` and pass
     `--storage-class-name csi-nfs-sc`, the class the e2e tests also use.
 
 #### DurDir Reported Metrics
@@ -628,7 +628,7 @@ limits of ate-api-server and Postgres. Isolate mode takes the nodes out by
 installing substrate with a fake data plane:
 
 ```bash
-hack/install-ate.sh deploy ate-system --fake-data-plane
+go run ./cmd/ate-setup deploy ate-system --fake-data-plane
 ./benchmarking/workloads/deploy.sh --deploy --worker-count 200 \
   --fake-atelet-env FAKE_ATELET_DELAY=500ms
 ```
@@ -674,7 +674,7 @@ Fake actors need neither. fake-atelet takes the storage settings of atelet's
 objectstore-plugin sidecar, whose writes it takes over, so its snapshot
 placeholders go to the storage the install points atelet at. The install
 refuses a cluster whose WorkerPools still have worker pods, which would
-outlive ate-controller. A normal `hack/install-ate.sh deploy ate-system`
+outlive ate-controller. A normal `ate-setup deploy ate-system`
 puts the real data plane back, and `delete ate-system` removes the fakes
 either way. Never use the mode on a
 cluster that serves real actors: actors placed on fake Workers do not exist.

benchmarking/automation/README.md

@@ -18,7 +18,7 @@ the router capacity benchmark — see
 4. `docker build && docker push` builds the runner image for each test type
    in use, tagged with the commit hash: `${KO_DOCKER_REPO}/locust-test:<commit>`
    and/or `${KO_DOCKER_REPO}/nighthawk-ingress-test:<commit>`.
-5. `hack/install-ate.sh deploy ate-system` (with `ATE_CREDENTIAL_PROVIDER`
+5. `go run ./cmd/ate-setup deploy ate-system` (with `ATE_CREDENTIAL_PROVIDER`
    in `.ate-dev-env.sh`, or `--credential-provider` in the test's
    `ateArgs`) + `benchmarking/workloads/deploy.sh
    --deploy --sandbox-class <class>` (these build & push substrate / workload
@@ -147,7 +147,7 @@ principal://iam.googleapis.com/projects/<PROJECT_NUMBER>/locations/global/worklo
 
 - `roles/container.admin` on the test cluster's project — required to manage
   cluster-scoped resources (CRDs, ClusterRoles, ClusterRoleBindings,
-  Namespaces) that `hack/install-ate.sh deploy ate-system` creates.
+  Namespaces) that `ate-setup deploy ate-system` creates.
   `container.developer` is not enough — it intentionally omits the
   `container.clusterRoles.*` and `container.customResourceDefinitions.*`
   permissions.

benchmarking/automation/orchestrator.py

@@ -126,7 +126,7 @@ def apply_target_cluster(
     target_cluster: str, target_cluster_dir: str = TARGET_CLUSTER_DIR
 ) -> None:
     """Copy target_cluster_dir/<name>.sh into the cloned
-    substrate repo as .ate-dev-env.sh (so install-ate.sh / deploy.sh source
+    substrate repo as .ate-dev-env.sh (so ate-setup / deploy.sh source
     it) and merge it into this process's env (so the orchestrator's own
     gcloud / docker / kubectl calls see the same values). Resets os.environ
     to the startup baseline first so vars defined by a previous target
@@ -390,7 +390,7 @@ def validate_and_normalize_tests(tests: list[dict[str, Any]]) -> None:
 
 
 def substrate_args(test: dict[str, Any]) -> list[str]:
-    """Return the hack/install-ate.sh deploy ate-system arguments for a
+    """Return the ate-setup deploy ate-system arguments for a
     tests.yaml entry: its ateArgs, then the fake data plane flag its isolate
     block asks for. The teardown needs no matching flag: delete ate-system
     removes the fake data plane whether or not it was installed."""
@@ -413,11 +413,11 @@ def deploy_substrate(ate_args: Iterable[str] = ()) -> None:
         "ATE_API_AUTHZ_BOOTSTRAP_OWNERS": f"{CLIENT_PRINCIPAL},{BENCHMARK_RUNNER_PRINCIPAL}",
         "ATE_INGRESS_ALLOWED_SPIFFE_IDS": BENCHMARK_RUNNER_PRINCIPAL,
     }
-    run(["hack/install-ate.sh", "deploy", "ate-system", *(str(a) for a in ate_args)], env=env)
+    run(["go", "run", "./cmd/ate-setup", "deploy", "ate-system", *(str(a) for a in ate_args)], env=env)
 
 
 def teardown_substrate() -> None:
-    run_no_check(["hack/install-ate.sh", "delete", "ate-system"])
+    run_no_check(["go", "run", "./cmd/ate-setup", "delete", "ate-system"])
 
 
 def install_microvm_deps() -> None:
@@ -595,7 +595,7 @@ def main() -> None:
     # Per-target-cluster caches: re-running setup for the same target
     # cluster is wasted work, so we track what was last set up and only
     # redo it when the target cluster name changes (substrate images get
-    # rebuilt by install-ate.sh each test anyway via ko apply). Runner
+    # rebuilt by ate-setup each test anyway via ko). Runner
     # images are built lazily per test type, so a locust-only tests.yaml
     # never builds the nighthawk image and vice versa.
     last_target = None

benchmarking/automation/test_orchestrator.py

@@ -68,7 +68,7 @@ class DeploySubstrateTest(unittest.TestCase):
     def test_runner_and_client_are_bootstrap_owners(self, run):
         orchestrator.deploy_substrate(["--credential-provider={}"])
         cmd = run.call_args.args[0]
-        self.assertEqual(cmd, ["hack/install-ate.sh", "deploy", "ate-system", "--credential-provider={}"])
+        self.assertEqual(cmd, ["go", "run", "./cmd/ate-setup", "deploy", "ate-system", "--credential-provider={}"])
         env = run.call_args.kwargs["env"]
         owners = env["ATE_API_AUTHZ_BOOTSTRAP_OWNERS"].split(",")
         self.assertEqual(
@@ -92,7 +92,7 @@ def test_keeps_the_rest_of_the_environment(self, run):
     @mock.patch("orchestrator.run_no_check")
     def test_teardown_substrate(self, run_no_check):
         orchestrator.teardown_substrate()
-        run_no_check.assert_called_once_with(["hack/install-ate.sh", "delete", "ate-system"])
+        run_no_check.assert_called_once_with(["go", "run", "./cmd/ate-setup", "delete", "ate-system"])
 
 
 class DeployWorkloadsTest(unittest.TestCase):

benchmarking/automation/tests.yaml

@@ -52,14 +52,14 @@
 #                  large workerCount fleets whose image pulls or scheduling
 #                  outrun the default.
 #   ateArgs        Optional. List of strings appended verbatim to
-#                  `hack/install-ate.sh deploy ate-system` when this
+#                  `ate-setup deploy ate-system` when this
 #                  test's substrate is deployed (e.g. ["--atenet-dataplane=agentgateway"]).
 #                  The deploy requires --credential-provider; set it here
 #                  as one YAML string, '--credential-provider={"name":"k8s.io"}'
 #                  (no shell quoting: the args are passed without a shell),
 #                  or as ATE_CREDENTIAL_PROVIDER in .ate-dev-env.sh.
 #   isolate        Optional. Isolate mode: installs substrate with the fake
-#                  data plane (hack/install-ate.sh deploy ate-system --fake-data-plane), which
+#                  data plane (ate-setup deploy ate-system --fake-data-plane), which
 #                  serves the WorkerPool without worker pods: fake-atelet
 #                  takes atelet's place on every atelet node and answers each
 #                  lifecycle call after a delay, and fake-workersync honors

benchmarking/automation/util.py

@@ -114,7 +114,7 @@ def isolate_block(test: dict) -> dict | None:
 
 
 def isolate_install_args(test: dict) -> list[str]:
-    """Return the hack/install-ate.sh flags a tests.yaml entry's isolate block
+    """Return the ate-setup flags a tests.yaml entry's isolate block
     installs the fake data plane with, or none without a block. The installer
     only chooses the data plane; the block's tuning goes to deploy.sh."""
     return [] if isolate_block(test) is None else ["--fake-data-plane"]

benchmarking/nighthawk-egress/README.md

@@ -36,19 +36,19 @@ variable when deploying ATE.
 1. **Cluster with Agent Substrate deployed**:
    - **Existing cluster** (with `.ate-dev-env.sh` configured):
      ```bash
-     hack/install-ate.sh deploy ate-system \
+     go run ./cmd/ate-setup deploy ate-system \
        --credential-provider='{"name":"k8s.io"}' \
        --ingress-allowed-spiffe-ids=spiffe://cluster.local/ns/nighthawk/sa/default
      ```
    - **Local `kind` cluster**:
      ```bash
-     hack/install-ate-kind.sh deploy ate-system \
+     go run ./cmd/ate-setup --kind deploy ate-system \
        --credential-provider='{"enabled":false}' \
        --ingress-allowed-spiffe-ids=spiffe://cluster.local/ns/nighthawk/sa/default
      ```
    - To set the `atenet-egress` Envoy worker thread count (`--concurrency`), set `E2E_ATE_ENVOY_CONCURRENCY` when deploying:
      ```bash
-     E2E_ATE_ENVOY_CONCURRENCY=1 hack/install-ate-kind.sh deploy ate-system --credential-provider='{"name":"k8s.io"}' --ingress-allowed-spiffe-ids=spiffe://cluster.local/ns/nighthawk/sa/default
+     E2E_ATE_ENVOY_CONCURRENCY=1 go run ./cmd/ate-setup --kind deploy ate-system --credential-provider='{"name":"k8s.io"}' --ingress-allowed-spiffe-ids=spiffe://cluster.local/ns/nighthawk/sa/default
      ```
    - Provision CA bundle which includes cluster's trust bundle, so that egress gateway can trust nighhawk's test server cert, run:
      ```bash

benchmarking/nighthawk-ingress/README.md

@@ -120,7 +120,7 @@ requests 2×`envoyCpu` CPUs; the runner requests `clientConcurrency`+1).
 
 ```bash
 # .ate-dev-env.sh at the repo root, then:
-hack/install-ate.sh deploy ate-system \
+go run ./cmd/ate-setup deploy ate-system \
   --credential-provider='{"name":"k8s.io"}' \
   --ingress-allowed-spiffe-ids=spiffe://cluster.local/ns/benchmarking/sa/benchmark-runner
 benchmarking/workloads/deploy.sh --deploy --worker-count 50 --sandbox-class gvisor
@@ -149,7 +149,7 @@ Flags: `--envoy-cpu`, `--actors`, `--tail-latency-slo-ms`, `--atespace`,
 Notes:
 
 - The script does not redeploy substrate — if substrate code changed,
-  rerun `hack/install-ate.sh deploy ate-system` first.
+  rerun `go run ./cmd/ate-setup deploy ate-system` first.
 - `--atespace` isolates actor *fleets* between experiments sharing a
   cluster; capacity runs themselves still need the router exclusively
   (the cpu pin is global and the run saturates it).

benchmarking/nighthawk-ingress/run-dev.sh

@@ -80,7 +80,7 @@ docker info >/dev/null 2>&1 || {
 
 kubectl get deployment atenet-router -n ate-system >/dev/null 2>&1 || {
   echo "ERROR: substrate is not deployed on ${CLUSTER_NAME}. Run:" >&2
-  echo "  hack/install-ate.sh deploy ate-system --credential-provider='{\"name\":\"k8s.io\"}' --ingress-allowed-spiffe-ids=spiffe://cluster.local/ns/benchmarking/sa/benchmark-runner" >&2
+  echo "  go run ./cmd/ate-setup deploy ate-system --credential-provider='{\"name\":\"k8s.io\"}' --ingress-allowed-spiffe-ids=spiffe://cluster.local/ns/benchmarking/sa/benchmark-runner" >&2
   exit 1
 }
 

benchmarking/telemetry/README.md

@@ -73,7 +73,7 @@ holds the same count connector and gives the same two counts. A meter in front
 of it would add a hop and measure nothing new. The meter exists for GKE only,
 where the managed collector cannot hold a connector.
 
-`hack/install-ate.sh` installs the collector and a Prometheus with it, thus a
+`ate-setup --kind` installs the collector and a Prometheus with it, thus a
 kind cluster needs no other step:
 
 ```bash

cmd/ate-setup/README.md

@@ -7,10 +7,6 @@ go run ./cmd/ate-setup [global flags] <command> [flags]
 go build -o bin/ate-setup ./cmd/ate-setup
 ```
 
-`ate-setup` is the installer. `hack/install-ate.sh` is a shim over it, kept so
-that existing command lines and CI jobs keep working; it holds no install logic
-of its own.
-
 ## Installing pre-built images
 
 By default every image is built from the checkout with `ko`, which is what a
@@ -37,10 +33,7 @@ the checkout, which should be the tag being installed. Each reference is pinned
 to the digest its tag names, so the registry has to be readable from here as
 well as from the cluster.
 
-- [`commands.md`](commands.md) — every command with its `hack/install-ate.sh`
-  equivalent.
+- [`commands.md`](commands.md) — every command, and the common global flags.
 - [`differences.md`](differences.md) — where the Go port deliberately behaves
   differently from the shell scripts it replaced, and what was reproduced
   exactly.
-- [`cli-diff.md`](cli-diff.md) — what a `hack/install-ate.sh` user can observe
-  after the switch.