Repository navigation
Document using more than one egress credential provider - #3410
Open
Max Thompson (thompsonmax) wants to merge 1 commit into
Open
Max Thompson (thompsonmax) wants to merge 1 commit into
Max Thompson (thompsonmax) wants to merge 1 commit into
Conversation
2 tasks done
Max Thompson (thompsonmax)
force-pushed
the
multi-credential-providers-docs
branch
3 times, most recently
from
October 29, 2026 04:26
8853895 to
db6ee27
Compare
Yufan Su (yufan-su)
pushed a commit
to yufan-su/substrate
that referenced
this pull request
Oct 29, 2026
…ent-substrate#3409) Part of agent-substrate#1661. We plan an out-of-tree credential provider that exchanges an actor's JWT for a cloud access token (RFC 8693), so actors can call Google Cloud APIs as themselves. Clusters will also run Secret Manager or Kubernetes Secrets providers. Today the egress gateway dials one provider and refuses URIs naming any other, which prevents us from supporting multiple credential providers. - atenet's `--credential-provider-name`, `-address` and `-server-name` repeat once per provider. The gateway sends each `ate-secret://` URI to the provider its host names, and still fails closed on any other. - ate-setup's `--credential-provider` also takes a JSON array, rendered for both the Envoy and agentgateway dataplanes. The single-object JSON and single flags behave as before, except that atenet now rejects an empty `--credential-provider-address`, which used to turn injection off, and an address without a `--credential-provider-name` (ate-setup always passes both; `--credential-provider-name=` keeps the unchecked dev mode). Providers share one CA and client certificate, as they do today. Docs follow in agent-substrate#3410. Tested with unit tests. Not run: kind e2e with two providers, which is worth a follow-up, or agentgateway with more than one entry. AI use: AI-assisted, I reviewed and tested it. - [x] Tests pass - [x] Docs updated (in agent-substrate#3410) --------- Signed-off-by: Max Thompson <maxthomp@google.com>
Document --credential-provider's JSON array form, and that the egress gateway sends each credential URI to the provider its host names. Signed-off-by: Max Thompson <maxthomp@google.com>
Max Thompson (thompsonmax)
force-pushed
the
multi-credential-providers-docs
branch
from
October 30, 2026 19:16
db6ee27 to
7f7404a
Compare
1 of 2 tasks
Max Thompson (thompsonmax)
marked this pull request as ready for review
October 30, 2026 23:07
Max Thompson (thompsonmax)
requested review from
Lior Lieberman (LiorLieberman) and
Yufan Su (yufan-su)
October 30, 2026 23:08
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #1661.
--credential-providerindocs/guides/egress-credential-injection.mdandcmd/ate-setup/commands.md, and that the gateway sends eachate-secret://URI to the provider its host names.cmd/atenet/internal/router/egress/provider.go.Docs and comments only, so it can merge during the freeze.
AI use: AI-assisted draft, reviewed by me.