Move to substrate v0.6 APIs, dial the atenet router over mTLS

clients/go/client_test.go

@@ -32,7 +32,7 @@ import (
 	"github.com/agent-substrate/env/internal/internaltest/fakerouter"
 	"github.com/agent-substrate/env/internal/mcp"
 	ateenvv1alpha "github.com/agent-substrate/env/proto/ateenv/v1alpha"
-	"go.ate.dev/substrate/pkg/proto/ateapipb"
+	ateapipb "go.ate.dev/substrate/api/ateapi/v1"
 	"google.golang.org/grpc"
 )
 

cmd/ate-env-api/main.go

@@ -31,13 +31,16 @@ import (
 	"github.com/agent-substrate/env/internal/mcp"
 	ateenvv1alpha "github.com/agent-substrate/env/proto/ateenv/v1alpha"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
 )
 
 func main() {
 	var (
 		listen            = flag.String("listen", "0.0.0.0:7777", "address to serve the API on")
 		ateapi            = flag.String("ateapi", ate.DefaultControlAddr, "address of the ateapi gRPC control plane")
 		atenet            = flag.String("atenet", ate.DefaultRouterAddr, "address of the atenet HTTP router")
+		atenetCredBundle  = flag.String("atenet-credential-bundle", "", "PEM credential bundle (cert+key) presented as the client certificate to the atenet router; empty dials the router in plaintext")
+		atenetCAFile      = flag.String("atenet-ca-file", "", "PEM trust bundle for the atenet router's serving certificate; required with -atenet-credential-bundle")
 		hostSuffix        = flag.String("host-suffix", ate.DefaultHostSuffix, "atenet router host suffix for actor routing")
 		skipVerify        = flag.Bool("skip-verify", true, "skip TLS certificate verification on the control plane connection")
 		tokenFile         = flag.String("ateapi-token-file", "", "file with a bearer token for the control plane, e.g. a projected ServiceAccount token with the ateapi audience")
@@ -46,9 +49,18 @@ func main() {
 	)
 	flag.Parse()
 
+	var routerCreds credentials.TransportCredentials
+	if *atenetCredBundle != "" {
+		var err error
+		if routerCreds, err = ate.RouterTLSCredentials(*atenetCredBundle, *atenetCAFile); err != nil {
+			log.Fatalf("loading atenet router credentials: %v", err)
+		}
+	}
+
 	client, err := ate.New(ate.Options{
 		ControlAddr:     *ateapi,
 		RouterAddr:      *atenet,
+		RouterCreds:     routerCreds,
 		HostSuffix:      *hostSuffix,
 		SkipVerify:      *skipVerify,
 		BearerTokenFile: *tokenFile,

cmd/ate-env/manifest.go

@@ -21,16 +21,18 @@ import (
 	"io"
 
 	"github.com/agent-substrate/env/internal/apiservice"
+	"github.com/agent-substrate/env/internal/ate"
 	"github.com/spf13/cobra"
-	atev1alpha1 "go.ate.dev/substrate/pkg/api/v1alpha1"
-	"go.ate.dev/substrate/pkg/proto/ateapipb"
+	ateapipb "go.ate.dev/substrate/api/ateapi/v1"
+	atev1 "go.ate.dev/substrate/api/infra/k8s/ate/v1"
 	"google.golang.org/protobuf/encoding/protojson"
 	"google.golang.org/protobuf/proto"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/utils/ptr"
 	"sigs.k8s.io/yaml"
 )
 
@@ -42,6 +44,10 @@ const apiName = "ate-env-api"
 // one, so a pool declared with it is schedulable on a stock install.
 const sandboxConfigName = "gvisor-default"
 
+// workerPoolLabels label the WorkerPool, and the ActorTemplate's
+// workerSelector matches them so actors only land on this pool's workers.
+var workerPoolLabels = map[string]string{"workload": "ate-env"}
+
 // Default compute limits for each actor. Substrate requires both on every
 // ActorTemplate since substrate#2285: the scheduler books them against worker
 // capacity. Two CPUs and 4 GiB match the Python client's ResourceLimits
@@ -361,27 +367,28 @@ func buildNamespace(cfg manifestConfig) *corev1.Namespace {
 	}
 }
 
-func buildWorkerPool(cfg manifestConfig) *atev1alpha1.WorkerPool {
-	return &atev1alpha1.WorkerPool{
+func buildWorkerPool(cfg manifestConfig) *atev1.WorkerPool {
+	return &atev1.WorkerPool{
 		TypeMeta: metav1.TypeMeta{
-			APIVersion: atev1alpha1.GroupVersion.String(),
+			APIVersion: atev1.GroupVersion.String(),
 			Kind:       "WorkerPool",
 		},
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      cfg.workerPool,
 			Namespace: cfg.namespace,
+			Labels:    workerPoolLabels,
 		},
-		Spec: atev1alpha1.WorkerPoolSpec{
+		Spec: atev1.WorkerPoolSpec{
 			Replicas:    cfg.replicas,
 			WorkerImage: cfg.workerImage,
 			// The CRD requires exactly one sandbox class per pool, and
 			// actors only schedule onto workers of their template's class,
 			// so keep this in step with buildActorTemplate. The configRef is
 			// the SandboxConfig the workers run; the template names the same
 			// one in sandboxConfig.configName.
-			SandboxClasses: []atev1alpha1.WorkerPoolSandboxClass{{
-				Name:      atev1alpha1.SandboxClassGvisor, // the template's sandboxConfig.sandboxClass is the same string
-				ConfigRef: &atev1alpha1.SandboxConfigReference{Name: sandboxConfigName},
+			SandboxClasses: []atev1.WorkerPoolSandboxClass{{
+				Name:      atev1.SandboxClassGvisor, // the template's sandboxConfig.sandboxClass is the same string
+				ConfigRef: &atev1.SandboxConfigReference{Name: sandboxConfigName},
 			}},
 		},
 	}
@@ -419,17 +426,21 @@ func buildActorTemplate(cfg templateConfig) *ateapipb.ActorTemplate {
 			// schema marks the field required, so say it explicitly.
 			PreferredFidelity: ateapipb.SnapshotFidelity_SNAPSHOT_FIDELITY_MEMORY,
 		},
-		SandboxConfig: &ateapipb.SandboxConfig{
-			SandboxClass: string(atev1alpha1.SandboxClassGvisor),
-			ConfigName:   sandboxConfigName,
-		},
-		Resources: &ateapipb.Resources{Limits: []*ateapipb.Limits{
-			{Name: "cpu", Quantity: orDefault(cfg.cpu, defaultActorCPU)},
-			{Name: "memory", Quantity: orDefault(cfg.memory, defaultActorMemory)},
+		WorkerSelector: &ateapipb.Selector{MatchLabels: workerPoolLabels},
+		Resources: &ateapipb.ResourceRequirements{Limits: &ateapipb.Resources{
+			CpuMillicores: quantity(cfg.cpu, defaultActorCPU).MilliValue(),
+			MemoryBytes:   quantity(cfg.memory, defaultActorMemory).Value(),
 		}},
 	}
 }
 
+// quantity parses v, or def if v is empty. validateResources has already
+// checked v.
+func quantity(v, def string) *resource.Quantity {
+	q := resource.MustParse(orDefault(v, def))
+	return &q
+}
+
 func orDefault(v, def string) string {
 	if v == "" {
 		return def
@@ -476,17 +487,30 @@ func buildAPIDeployment(cfg manifestConfig) *appsv1.Deployment {
 					Containers: []corev1.Container{{
 						Name:  apiName,
 						Image: cfg.apiImage,
-						// ateapi/atenet default to the in-cluster
-						// Substrate service addresses.
+						// ateapi defaults to the in-cluster Substrate
+						// service address. The atenet router only admits
+						// mTLS clients with an allowed pod identity, so
+						// ate-env-api presents its pod certificate.
 						Args: []string{
 							"-listen", fmt.Sprintf("0.0.0.0:%d", cfg.apiPort),
 							"-ateapi-token-file=/var/run/secrets/ateapi/token",
+							"-atenet=" + ate.RouterServerName + ":443",
+							"-atenet-credential-bundle=/run/podidentity.podcert.ate.dev/credential-bundle.pem",
+							"-atenet-ca-file=/run/servicedns-ca/trust-bundle.pem",
 						},
 						Ports: []corev1.ContainerPort{{ContainerPort: cfg.apiPort}},
 						VolumeMounts: []corev1.VolumeMount{{
 							Name:      "ateapi-token",
 							MountPath: "/var/run/secrets/ateapi",
 							ReadOnly:  true,
+						}, {
+							Name:      "podidentity",
+							MountPath: "/run/podidentity.podcert.ate.dev",
+							ReadOnly:  true,
+						}, {
+							Name:      "servicedns-ca",
+							MountPath: "/run/servicedns-ca",
+							ReadOnly:  true,
 						}},
 						ReadinessProbe: &corev1.Probe{
 							ProbeHandler: corev1.ProbeHandler{
@@ -510,6 +534,32 @@ func buildAPIDeployment(cfg manifestConfig) *appsv1.Deployment {
 								}},
 							},
 						},
+					}, {
+						Name: "podidentity",
+						VolumeSource: corev1.VolumeSource{
+							Projected: &corev1.ProjectedVolumeSource{
+								Sources: []corev1.VolumeProjection{{
+									PodCertificate: &corev1.PodCertificateProjection{
+										SignerName:           "podidentity.podcert.ate.dev/identity",
+										KeyType:              "ECDSAP256",
+										CredentialBundlePath: "credential-bundle.pem",
+									},
+								}},
+							},
+						},
+					}, {
+						Name: "servicedns-ca",
+						VolumeSource: corev1.VolumeSource{
+							Projected: &corev1.ProjectedVolumeSource{
+								Sources: []corev1.VolumeProjection{{
+									ClusterTrustBundle: &corev1.ClusterTrustBundleProjection{
+										SignerName:    ptr.To("servicedns.podcert.ate.dev/identity"),
+										LabelSelector: &metav1.LabelSelector{MatchLabels: map[string]string{"podcert.ate.dev/canarying": "live"}},
+										Path:          "trust-bundle.pem",
+									},
+								}},
+							},
+						},
 					}},
 				},
 			},

cmd/ate-env/manifest_test.go

@@ -20,8 +20,8 @@ import (
 	"testing"
 
 	"github.com/agent-substrate/env/internal/apiservice"
-	atev1alpha1 "go.ate.dev/substrate/pkg/api/v1alpha1"
-	"go.ate.dev/substrate/pkg/proto/ateapipb"
+	ateapipb "go.ate.dev/substrate/api/ateapi/v1"
+	atev1 "go.ate.dev/substrate/api/infra/k8s/ate/v1"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 )
@@ -96,32 +96,33 @@ func TestBuildManifests(t *testing.T) {
 		t.Errorf("namespace label %s = %q, want \"true\" (ate-system admits API clients by it)", apiAccessLabel, got)
 	}
 
-	pool := objs[1].(*atev1alpha1.WorkerPool)
+	pool := objs[1].(*atev1.WorkerPool)
 	if pool.Namespace != cfg.namespace || pool.Name != "default-template-workerpool" {
 		t.Errorf("workerpool = %s/%s, want %s/default-template-workerpool", pool.Namespace, pool.Name, cfg.namespace)
 	}
 	if pool.Spec.Replicas != 3 || pool.Spec.WorkerImage != cfg.workerImage {
 		t.Errorf("workerpool spec = %+v, want replicas 3 and worker image %q", pool.Spec, cfg.workerImage)
 	}
-	if len(pool.Labels) != 0 {
-		t.Errorf("workerpool labels = %v, want empty", pool.Labels)
-	}
 	if pool.Spec.Template != nil {
 		t.Errorf("workerpool template = %v, want nil", pool.Spec.Template)
 	}
 	if len(pool.Spec.SandboxClasses) != 1 {
 		t.Fatalf("workerpool sandboxClasses = %+v, want exactly one", pool.Spec.SandboxClasses)
 	}
 	sc := pool.Spec.SandboxClasses[0]
-	if sc.Name != atev1alpha1.SandboxClassGvisor || sc.ConfigRef == nil || sc.ConfigRef.Name != sandboxConfigName {
+	if sc.Name != atev1.SandboxClassGvisor || sc.ConfigRef == nil || sc.ConfigRef.Name != sandboxConfigName {
 		t.Errorf("workerpool sandboxClasses[0] = %+v, want gvisor with configRef %q", sc, sandboxConfigName)
 	}
-	// The pool's class and the template's are the same string since
-	// substrate#2586 made the proto field a string. A pool of the wrong class
-	// never hosts the template's actors.
-	tmplClass := buildActorTemplate(testTemplateConfig()).GetSandboxConfig().GetSandboxClass()
-	if tmplClass != string(sc.Name) {
-		t.Errorf("workerpool sandbox class %q != template sandbox class %q", sc.Name, tmplClass)
+	// The template selects workers by the pool's labels; a pool it does not
+	// select never hosts its actors.
+	sel := buildActorTemplate(testTemplateConfig()).GetWorkerSelector().GetMatchLabels()
+	if len(sel) == 0 {
+		t.Error("template worker selector is empty, want the pool's labels")
+	}
+	for k, v := range sel {
+		if pool.Labels[k] != v {
+			t.Errorf("workerpool labels %v do not match template worker selector %v", pool.Labels, sel)
+		}
 	}
 
 	deployment := objs[2].(*appsv1.Deployment)
@@ -165,38 +166,21 @@ func TestBuildActorTemplate(t *testing.T) {
 	if got := template.GetSnapshotConfig().GetGoldenSnapshotConfig(); got != nil {
 		t.Errorf("golden snapshot config = %v, want nil (omitted means enabled)", got)
 	}
-	if got := template.GetSandboxConfig().GetConfigName(); got != sandboxConfigName {
-		t.Errorf("sandbox config name = %q, want %q (must match the WorkerPool configRef)", got, sandboxConfigName)
-	}
-	if template.GetWorkerSelector() != nil {
-		t.Errorf("worker selector = %v, want nil", template.WorkerSelector)
-	}
 	probe := template.Containers[0].GetWakeupProbe()
 	if probe.GetHttpGet() == nil || probe.GetHttpGet().GetPath() != "/readyz" || probe.GetHttpGet().GetPort() != 80 {
 		t.Errorf("wakeupProbe = %+v, want HTTP GET /readyz on port 80", probe)
 	}
 	// Substrate rejects an ActorTemplate without both limits (substrate#2285).
-	if got := limits(template); got["cpu"] != defaultActorCPU || got["memory"] != defaultActorMemory || len(got) != 2 {
-		t.Errorf("resources.limits = %v, want cpu=%s memory=%s", got, defaultActorCPU, defaultActorMemory)
-	}
-	if got := template.GetSandboxConfig().GetSandboxClass(); got != "gvisor" {
-		t.Errorf("sandbox class = %q, want gvisor (Substrate accepts gvisor or microvm)", got)
-	}
-}
-
-func limits(tmpl *ateapipb.ActorTemplate) map[string]string {
-	m := map[string]string{}
-	for _, l := range tmpl.GetResources().GetLimits() {
-		m[l.GetName()] = l.GetQuantity()
+	if got := template.GetResources().GetLimits(); got.GetCpuMillicores() != 2000 || got.GetMemoryBytes() != 4<<30 {
+		t.Errorf("resources.limits = %v, want 2000 millicores and 4Gi", got)
 	}
-	return m
 }
 
 func TestBuildActorTemplateResources(t *testing.T) {
 	cfg := testTemplateConfig()
 	cfg.cpu, cfg.memory = "500m", "1Gi"
-	if got := limits(buildActorTemplate(cfg)); got["cpu"] != "500m" || got["memory"] != "1Gi" {
-		t.Errorf("resources.limits = %v, want cpu=500m memory=1Gi", got)
+	if got := buildActorTemplate(cfg).GetResources().GetLimits(); got.GetCpuMillicores() != 500 || got.GetMemoryBytes() != 1<<30 {
+		t.Errorf("resources.limits = %v, want 500 millicores and 1Gi", got)
 	}
 }
 
@@ -368,7 +352,7 @@ func TestManifestTemplateCommandExecution(t *testing.T) {
 	if !strings.Contains(out, "image: example.com/guest@sha256:aaaa") || !strings.Contains(out, "storageLocation: gs://bucket/prefix/") {
 		t.Errorf("expected guest image and storage location in output:\n%s", out)
 	}
-	for _, want := range []string{"sandboxClass: gvisor", "name: cpu\n    quantity: \"4\"", "name: memory\n    quantity: 8Gi"} {
+	for _, want := range []string{"workload: ate-env", "cpuMillicores: \"4000\"", "memoryBytes: \"8589934592\""} {
 		if !strings.Contains(out, want) {
 			t.Errorf("output lacks %q:\n%s", want, out)
 		}

go.mod

@@ -6,11 +6,12 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/modelcontextprotocol/go-sdk v1.8.0
 	github.com/spf13/cobra v1.10.2
-	go.ate.dev/substrate v0.5.1-0.20261016164544-3a2ca6235748
+	go.ate.dev/substrate v0.6.1-0.20261030223608-6ddb1934dd75
 	google.golang.org/grpc v1.84.0
 	google.golang.org/protobuf v1.36.12
-	k8s.io/api v0.37.1
-	k8s.io/apimachinery v0.37.1
+	k8s.io/api v0.37.0
+	k8s.io/apimachinery v0.37.0
+	k8s.io/utils v0.0.0-20260626114624-be93311217bd
 	sigs.k8s.io/yaml v1.6.0
 )
 
@@ -38,7 +39,6 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
 	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
-	k8s.io/utils v0.0.0-20260626114624-be93311217bd // indirect
 	sigs.k8s.io/controller-runtime v0.24.1 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect

go.sum

@@ -109,8 +109,8 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
 github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
-go.ate.dev/substrate v0.5.1-0.20261016164544-3a2ca6235748 h1:QrTauJhnfn0FL0t/GLzVo4bmeVUYMT6e4x8QSaQF8s0=
-go.ate.dev/substrate v0.5.1-0.20261016164544-3a2ca6235748/go.mod h1:EktaeScxg724tF4cjtLV8kdz2xN3FH8NOTk/A95jSBY=
+go.ate.dev/substrate v0.6.1-0.20261030223608-6ddb1934dd75 h1:tzl0PWr3PrzAts2HrKztaMK6q3xaDmzwQARl3JI80xU=
+go.ate.dev/substrate v0.6.1-0.20261030223608-6ddb1934dd75/go.mod h1:sS0tm65aYf+xIkkl7mTSQAS2P8tXM5xUOTnLXIE4tvc=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
@@ -147,12 +147,12 @@ gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnf
 gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-k8s.io/api v0.37.1 h1:l6N77U7tjwB5L056bgrBTJIEdevac/naBZ3iSvDNfpM=
-k8s.io/api v0.37.1/go.mod h1:zSlbB1YpJ1YQlFVQy20UYll81UJSJJUMLhkhvg6Z78M=
+k8s.io/api v0.37.0 h1:Z//Vj9N7RA/yS2sDmxyeo7h+RR4zbUrd2vrd3Z0TbB4=
+k8s.io/api v0.37.0/go.mod h1:LKXgcJWMc+f4OLbP5SFR8rulEg07zZhpi/zMULiBImk=
 k8s.io/apiextensions-apiserver v0.36.1 h1:6JfYmPUsuUIHuN+3QxutXYWj492RqF5fBSx67GYK5Ks=
 k8s.io/apiextensions-apiserver v0.36.1/go.mod h1:pLzZin90riwisdzKwv/GoTwENooytoIx5zWJb4Hkby8=
-k8s.io/apimachinery v0.37.1 h1:hGCYyvKHCwtwMitj2vU4vYx0Z16N9GyZk9BBnz0wDAE=
-k8s.io/apimachinery v0.37.1/go.mod h1:jF84AyUi/IRIXRot5f+lm6MpxoWI+F1XgjaMmwCdTFw=
+k8s.io/apimachinery v0.37.0 h1:Np2AbDtf8x6RDHiD8T9LbKJ9gaegeVNa8yNm5FuGKm0=
+k8s.io/apimachinery v0.37.0/go.mod h1:RN3nhprFSCxOi5Selxd7oMTXOe/c+ZbcE7Im+TS2zkE=
 k8s.io/client-go v0.37.0 h1:nsN31fy8wBySuZ+QRnKmrjRSQLOG2rvoGN0tKd12zhQ=
 k8s.io/client-go v0.37.0/go.mod h1:FcGqw+Ll/gNQiq+nPGY1Oyt9y7SgDh1d3MW3RFDEbn0=
 k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=

internal/apiservice/imagetemplate.go

@@ -21,7 +21,7 @@ import (
 	"regexp"
 	"strings"
 
-	"go.ate.dev/substrate/pkg/proto/ateapipb"
+	ateapipb "go.ate.dev/substrate/api/ateapi/v1"
 	"google.golang.org/protobuf/proto"
 )