Reconcile fork features with upstream

Author: EItanya

charts/substrate-crds/templates/ate.dev_actortemplates.yaml

@@ -199,6 +199,26 @@ spec:
                           required:
                           - port
                           type: object
+                        timeoutSeconds:
+                          default: 30
+                          description: |-
+                            TimeoutSeconds is how long to keep polling HTTPGet before giving up.
+                            Exceeding it fails the actor start rather than proceeding with a
+                            container that never reported ready.
+
+                            How long a workload takes to become ready is a property of that workload,
+                            which is why this is set per template rather than cluster-wide: a heavy
+                            runtime that needs minutes should not force every other template to wait
+                            as long before its failures surface.
+
+                            Unset defaults to 30, applied by the API server so the effective value is
+                            visible on the stored object rather than only in the ateom. A manifest
+                            asking for 0 is rejected: unlike a warmup delay, a zero deadline could
+                            never be met, so it is never what a template author means.
+                          format: int32
+                          maximum: 3600
+                          minimum: 1
+                          type: integer
                       required:
                       - httpGet
                       type: object
@@ -305,6 +325,25 @@ spec:
                     - Full
                     - Data
                     type: string
+                  onResume:
+                    default: {}
+                    description: |-
+                      OnResume specifies, per snapshot situation, what supplies the guest
+                      state at resume (see OnResumeConfig). "fromData: Golden" requires
+                      sandboxClass "microvm".
+                    properties:
+                      fromData:
+                        default: ColdBoot
+                        description: |-
+                          FromData applies when the resume uses a Data-scope snapshot (from
+                          onPause or onCommit): "ColdBoot" starts fresh from the OCI image with
+                          the durable data restored; "Golden" combines the durable data with the
+                          template's golden snapshot. Defaults to "ColdBoot".
+                        enum:
+                        - ColdBoot
+                        - Golden
+                        type: string
+                    type: object
                 required:
                 - location
                 type: object
@@ -420,13 +459,17 @@ spec:
             x-kubernetes-validations:
             - message: Spec is immutable
               rule: self == oldSelf
-            - message: At most one DurableDir-typed volume is supported per ActorTemplate
-              rule: '!has(self.volumes) || self.volumes.filter(v, has(v.durableDir)).size()
-                <= 1'
-            - message: A container may mount at most one DurableDir-typed volume
-              rule: '!has(self.containers) || self.containers.all(c, !has(c.volumeMounts)
+            - message: Only one DurableDir-typed volume is supported when sandboxClass
+                is 'gvisor'
+              rule: (has(self.sandboxClass) && self.sandboxClass == 'microvm') ||
+                !has(self.volumes) || self.volumes.filter(v, has(v.durableDir)).size()
+                <= 1
+            - message: A container may mount only one DurableDir-typed volume when
+                sandboxClass is 'gvisor'
+              rule: (has(self.sandboxClass) && self.sandboxClass == 'microvm') ||
+                !has(self.containers) || self.containers.all(c, !has(c.volumeMounts)
                 || c.volumeMounts.filter(vm, has(self.volumes) && self.volumes.exists(v,
-                v.name == vm.name && has(v.durableDir))).size() <= 1)'
+                v.name == vm.name && has(v.durableDir))).size() <= 1)
             - message: All volumes defined in spec.volumes must be mounted by at least
                 one container
               rule: '!has(self.volumes) || self.volumes.all(v, has(self.containers)
@@ -435,6 +478,11 @@ spec:
             - message: ExternalVolumes are not supported when sandboxClass is 'microvm'
               rule: '!has(self.sandboxClass) || self.sandboxClass != ''microvm'' ||
                 !has(self.volumes) || !self.volumes.exists(v, has(v.externalVolumeTemplate))'
+            - message: 'onResume.fromData: Golden is not supported when sandboxClass
+                is ''gvisor'''
+              rule: '(has(self.sandboxClass) && self.sandboxClass == ''microvm'')
+                || !has(self.snapshotsConfig.onResume) || (has(self.snapshotsConfig.onResume.fromData)
+                ? self.snapshotsConfig.onResume.fromData : ''ColdBoot'') != ''Golden'''
           status:
             description: status is the observed state of ActorTemplate
             properties:

charts/substrate-crds/templates/ate.dev_workerpools.yaml

@@ -411,6 +411,17 @@ spec:
                     type: array
                     x-kubernetes-list-type: atomic
                 type: object
+              terminationGracePeriodSeconds:
+                default: 300
+                description: |-
+                  TerminationGracePeriodSeconds is the termination grace period applied to
+                  this pool's worker pods. On eviction, ateom traps SIGTERM and forwards it
+                  to the actor so it can save state and exit cleanly before the kubelet
+                  sends SIGKILL. Tune this to the maximum time your actors need to shut
+                  down gracefully. Defaults to 300 (5 minutes).
+                format: int32
+                minimum: 1
+                type: integer
             required:
             - ateomImage
             - replicas

charts/substrate/README.md

@@ -6,7 +6,7 @@ Helm chart for installing Agent Substrate.
 
 | Mode | Default? | Cluster requirements | Trade-off |
 |------|----------|----------------------|-----------|
-| `jwt`  | yes | none beyond stock K8s | Server certs and session signing pools are generated by the chart; clients authenticate via projected ServiceAccount tokens. Valkey runs plaintext intra-cluster. |
+| `jwt`  | yes | none beyond stock K8s | Server certs and actor signing pools are generated by the chart; clients authenticate via projected ServiceAccount tokens. Valkey runs plaintext intra-cluster. |
 | `mtls` |     | feature gates `ClusterTrustBundle`, `ClusterTrustBundleProjection`, `PodCertificateRequest` + `certificates.k8s.io/v1beta1` API | Full in-cluster mTLS via the bundled `podcertcontroller`. |
 
 ```bash
@@ -31,8 +31,8 @@ JWT mode is standalone by default. The chart generates:
 
 - `Secret/ateapi-tls`
 - `ConfigMap/ateapi-ca`
-- `Secret/session-id-jwt-pool`
-- `Secret/session-id-ca-pool`
+- `Secret/actor-id-jwt-pool`
+- `Secret/actor-id-ca-pool`
 
 Existing generated data is reused on upgrade so key material does not rotate
 during normal chart upgrades. Set `auth.jwt.bootstrap.enabled=false` to bring
@@ -58,7 +58,7 @@ See `values.yaml` for the full set; the important keys:
 | `auth.mode` | `jwt` | `jwt` or `mtls` |
 | `auth.jwt.issuer` | `https://kubernetes.default.svc.cluster.local` | Override for managed clusters with provider-specific issuers |
 | `auth.jwt.audience` | `api.ate-system.svc` | SA token audience |
-| `auth.jwt.bootstrap.enabled` | `true` | Generate JWT TLS and session signing material |
+| `auth.jwt.bootstrap.enabled` | `true` | Generate JWT TLS and actor signing material |
 | `auth.jwt.serverCertSecret` | `ateapi-tls` | Secret name |
 | `auth.jwt.caBundleConfigMap` | `ateapi-ca` | ConfigMap name |
 | `valkey.enabled` | `true` | Set false if you bring your own Redis/Valkey |

charts/substrate/templates/NOTES.txt

@@ -15,7 +15,7 @@ JWT bootstrap resources are managed by this chart. Existing key material is
 reused on upgrade.
 {{- else }}
 JWT bootstrap is disabled. Provide {{ .Values.auth.jwt.serverCertSecret }},
-{{ .Values.auth.jwt.caBundleConfigMap }}, session-id-jwt-pool, and
-session-id-ca-pool before pods become healthy.
+{{ .Values.auth.jwt.caBundleConfigMap }}, actor-id-jwt-pool, and
+actor-id-ca-pool before pods become healthy.
 {{- end }}
 {{- end }}

charts/substrate/templates/ate-api-server.yaml

@@ -100,8 +100,8 @@ spec:
         - "--redis-client-cert=@env"
         - "--client-jwt-issuer=@env"
         - "--client-jwt-audience={{ .Values.auth.jwt.audience }}"
-        - "--session-id-jwt-pool=/run/session-id-jwt-pool/pool.json"
-        - "--session-id-ca-pool=/run/session-id-ca-pool/pool.json"
+        - "--actor-id-jwt-pool=/run/actor-id-jwt-pool/pool.json"
+        - "--actor-id-ca-pool=/run/actor-id-ca-pool/pool.json"
         - "--atelet-client-cred-bundle=/run/podidentity.podcert.ate.dev/credential-bundle.pem"
         - "--pod-identity-ca-certs=/run/podidentity.podcert.ate.dev/trust-bundle.pem"
 {{- else }}
@@ -112,8 +112,8 @@ spec:
         - "--redis-use-iam-auth=@env"
         - "--client-jwt-issuer={{ .Values.auth.jwt.issuer }}"
         - "--client-jwt-audience={{ .Values.auth.jwt.audience }}"
-        - "--session-id-jwt-pool=/run/session-id-jwt-pool/pool.json"
-        - "--session-id-ca-pool=/run/session-id-ca-pool/pool.json"
+        - "--actor-id-jwt-pool=/run/actor-id-jwt-pool/pool.json"
+        - "--actor-id-ca-pool=/run/actor-id-ca-pool/pool.json"
         - "--client-jwt-ca-cert=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
 {{- end }}
         - "--drain-delay=13s"
@@ -144,14 +144,14 @@ spec:
         volumeMounts:
 {{- if eq .Values.auth.mode "mtls" }}
         - { name: servicedns,          mountPath: /run/servicedns.podcert.ate.dev }
-        - { name: session-id-jwt-pool, mountPath: /run/session-id-jwt-pool }
+        - { name: actor-id-jwt-pool,   mountPath: /run/actor-id-jwt-pool }
         - { name: valkey-ca-certs,     mountPath: /etc/valkey-ca, readOnly: true }
-        - { name: session-id-ca-pool,  mountPath: /run/session-id-ca-pool, readOnly: true }
+        - { name: actor-id-ca-pool,    mountPath: /run/actor-id-ca-pool, readOnly: true }
         - { name: podidentity,         mountPath: /run/podidentity.podcert.ate.dev, readOnly: true }
 {{- else }}
         - { name: ateapi-tls,          mountPath: /run/ateapi-tls, readOnly: true }
-        - { name: session-id-jwt-pool, mountPath: /run/session-id-jwt-pool }
-        - { name: session-id-ca-pool,  mountPath: /run/session-id-ca-pool, readOnly: true }
+        - { name: actor-id-jwt-pool,   mountPath: /run/actor-id-jwt-pool }
+        - { name: actor-id-ca-pool,    mountPath: /run/actor-id-ca-pool, readOnly: true }
 {{- end }}
         ports:
         - containerPort: 443
@@ -179,11 +179,11 @@ spec:
               signerName: servicedns.podcert.ate.dev/identity
               keyType: ECDSAP256
               credentialBundlePath: credential-bundle.pem
-      - name: session-id-jwt-pool
+      - name: actor-id-jwt-pool
         projected:
           sources:
           - secret:
-              name: session-id-jwt-pool
+              name: actor-id-jwt-pool
               items:
               - { key: pool, path: pool.json }
       - name: valkey-ca-certs
@@ -193,11 +193,11 @@ spec:
               name: valkey-ca-certs
               items:
               - { key: ca.crt, path: ca.crt }
-      - name: session-id-ca-pool
+      - name: actor-id-ca-pool
         projected:
           sources:
           - secret:
-              name: session-id-ca-pool
+              name: actor-id-ca-pool
               items:
               - { key: pool, path: pool.json }
       - name: podidentity
@@ -219,18 +219,18 @@ spec:
           secretName: {{ .Values.auth.jwt.serverCertSecret }}
       - name: ateapi-tls
         emptyDir: {}
-      - name: session-id-jwt-pool
+      - name: actor-id-jwt-pool
         projected:
           sources:
           - secret:
-              name: session-id-jwt-pool
+              name: actor-id-jwt-pool
               items:
               - { key: pool, path: pool.json }
-      - name: session-id-ca-pool
+      - name: actor-id-ca-pool
         projected:
           sources:
           - secret:
-              name: session-id-ca-pool
+              name: actor-id-ca-pool
               items:
               - { key: pool, path: pool.json }
 {{- end }}

charts/substrate/templates/ate-controller.yaml

@@ -85,6 +85,11 @@ spec:
         - "--ateapi-ca-file=/run/ateapi-ca/ca.crt"
         - "--ateapi-server-name={{ include "substrate.fullname" (list "api" .) }}.{{ .Release.Namespace }}.svc"
         - "--ateapi-token-file=/var/run/secrets/tokens/ateapi/token"
+{{- end }}
+{{- if .Values.otel.endpoint }}
+        env:
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: {{ .Values.otel.endpoint | quote }}
 {{- end }}
         ports:
         - name: metrics