[Yufan Su (yufan-su)]

egress-credential-injection.md

• Injection also works on cleartext http rules.
• Credential URIs: list the form the API accepts and what admission rejects.
• The provider setting can also come from ATE_CREDENTIAL_PROVIDER or from atenet.egress.credentialProvider in the --config file.
• The ext-proc log command works on the Envoy dataplane only.
• Use replaceHeaders throughout, to match the examples.

egress-trust-bundle.md

• The example was a CRD-shaped manifest that kubectl ate create actor-template -f rejects, and its trailing-slash mountPath fails validation. It is now a protojson excerpt.
• The unusable contents error does not exist. The doc now shows the error atelet returns when the egress ClusterTrustBundle is missing.
• The wrapper script now reads the same path as the example.
• System roots come from atelet's distroless/base-debian13 image.

egress-traffic.md

• HTTPS whose SNI matches no rule is closed during the TLS handshake, without an HTTP response.
• Add a row for tls_passthrough. It relays whatever runs inside the TLS without inspecting it.
• A client that sends non-HTTP bytes first gets 400 Bad Request. A client that waits for the server is closed after about 1 second. atunnel does not log either case.

AI use: I used Claude Code to audit the egress docs against the code, run a test for all the outdated statement. I reviewed every change.

• Tests pass
• Docs updated

[Lior Lieberman (LiorLieberman)]

Max Thompson (@thompsonmax) can you check for correctness after your recent change?

[Yufan Su (yufan-su)]

I see Max already have the doc change in #3410 so just reverted here

[Max Thompson (thompsonmax)]

Ah, forgot to move that out of draft earlier. Just sent it for review. Remaining changes here LGTM.