Align Helm routing and validation with current upstream

Use the current agentgateway image and route configuration in Helm, mirror the sandbox pause-image validation, and retain manifest credential-provider coverage in the upstream setup tests. Save the fork E2E Go cache for its agentgateway lane.

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Author: EItanya

.github/workflows/pr-workflow.yaml

@@ -257,7 +257,7 @@ jobs:
     - name: Save Go build cache
       # Main only, so PRs restore the latest main build rather than each
       # storing its own copy.
-      if: ${{ !cancelled() && github.ref == 'refs/heads/main' && matrix.dataplane == 'envoy' }}
+      if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
       uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: |

charts/substrate-crds/templates/ate.dev_sandboxconfigs.yaml

@@ -106,7 +106,8 @@ spec:
                   PauseImage is the container image used as the root sandbox container.
                   It holds the sandbox's namespaces and runs no workload code, so it is an
                   implementation detail of the sandbox rather than something actor authors
-                  choose. It is captured in the snapshot manifest alongside the sandbox
+                  choose. Required for gvisor; not allowed for microvm, which runs no pause
+                  container. It is captured in the snapshot manifest alongside the sandbox
                   binaries, so a restore always re-creates the sandbox from the same image
                   the snapshot was taken with.
 
@@ -129,9 +130,12 @@ spec:
                 - microvm
                 type: string
             required:
-            - pauseImage
             - sandboxClass
             type: object
+            x-kubernetes-validations:
+            - message: pauseImage is required for gvisor and not allowed for other
+                sandbox classes
+              rule: 'self.sandboxClass == ''gvisor'' ? has(self.pauseImage) : !has(self.pauseImage)'
         required:
         - spec
         type: object

charts/substrate/templates/atenet-egress.yaml

@@ -83,11 +83,6 @@ data:
                       cert: /run/podidentity.podcert.ate.dev/credential-bundle.pem
                       key: /run/podidentity.podcert.ate.dev/credential-bundle.pem
                       root: /run/servicedns.podcert.ate.dev/trust-bundle.pem
-      - protocol: TLS
-        hostname: "*"
-        tcpRoutes:
-        - backends:
-          - dynamic: {}
       - protocol: HTTP
         routes:
         - backends:
@@ -110,11 +105,10 @@ data:
                       cert: /run/podidentity.podcert.ate.dev/credential-bundle.pem
                       key: /run/podidentity.podcert.ate.dev/credential-bundle.pem
                       root: /run/servicedns.podcert.ate.dev/trust-bundle.pem
-      - protocol: TCP
+      - protocol: TLS
         tcpRoutes:
         - backends:
-          - dynamic:
-              target: source.connectHeaders["host"]
+          - dynamic: {}
 ---
 apiVersion: apps/v1
 kind: Deployment

charts/substrate/templates/atenet-router.yaml

@@ -62,6 +62,8 @@ data:
     - name: dynamic
       dynamic: {}
       policies:
+        http:
+          version: HTTP/1.1
         backendTunnel:
           proxy:
             backend: /dynamic
@@ -85,20 +87,17 @@ data:
           key: /run/servicedns.podcert.ate.dev/credential-bundle.pem
 
     routes:
-    - name: substrate-actors-grpc
+    - name: substrate-actors
       gateways:
       - http
       - https
       matches:
-      - headers:
-        - name: content-type
-          value:
-            regex: '(?i)^application/grpc(?:\+[^;]+)?(?:;.*)?$'
-        path:
+      - path:
           pathPrefix: /
-      policies:
+      policies: &substrate-ingress
         substrateIngress:
           host: {{ include "substrate.fullname" (list "api" .) }}.{{ .Release.Namespace }}.svc:443
+          # AgentGateway only uses atunnel's CONNECT listener.
           connectTargetPort: 8443
           policies:
             backendTLS:
@@ -107,31 +106,24 @@ data:
               root: /run/servicedns-ca/trust-bundle.pem
       backends:
       - backend: /dynamic
-        policies:
-          http:
-            version: HTTP/2.0
-    - name: substrate-actors
+    - name: substrate-actors-grpc
       gateways:
       - http
       - https
-      matches:
-      - path:
-          pathPrefix: /
-      policies:
-        substrateIngress:
-          host: {{ include "substrate.fullname" (list "api" .) }}.{{ .Release.Namespace }}.svc:443
-          connectTargetPort: 8443
-          policies:
-            backendTLS:
-              cert: /run/podidentity.podcert.ate.dev/credential-bundle.pem
-              key: /run/podidentity.podcert.ate.dev/credential-bundle.pem
-              root: /run/servicedns-ca/trust-bundle.pem
-      backends:
+      matches: &grpc-matches
+      - method: POST
+        headers:
+        - name: content-type
+          value:
+            regex: '(?i)^application/grpc([+;].*)?$'
+      policies: *substrate-ingress
+      backends: &grpc-backends
       - backend: /dynamic
         policies:
           http:
-            version: HTTP/1.1
+            version: HTTP/2.0
 
+    # Terminate client CONNECT before internal HTTP routing.
     binds:
     - port: 8081
       tunnelProtocol: connect
@@ -150,46 +142,17 @@ data:
       listeners:
       - protocol: HTTP
         routes:
-        - name: substrate-actors-tunneled-grpc
-          matches:
-          - headers:
-            - name: content-type
-              value:
-                regex: '(?i)^application/grpc(?:\+[^;]+)?(?:;.*)?$'
-            path:
-              pathPrefix: /
-          policies:
-            substrateIngress:
-              host: {{ include "substrate.fullname" (list "api" .) }}.{{ .Release.Namespace }}.svc:443
-              connectTargetPort: 8443
-              policies:
-                backendTLS:
-                  cert: /run/podidentity.podcert.ate.dev/credential-bundle.pem
-                  key: /run/podidentity.podcert.ate.dev/credential-bundle.pem
-                  root: /run/servicedns-ca/trust-bundle.pem
-          backends:
-          - backend: /dynamic
-            policies:
-              http:
-                version: HTTP/2.0
         - name: substrate-actors-tunneled
           matches:
           - path:
               pathPrefix: /
-          policies:
-            substrateIngress:
-              host: {{ include "substrate.fullname" (list "api" .) }}.{{ .Release.Namespace }}.svc:443
-              connectTargetPort: 8443
-              policies:
-                backendTLS:
-                  cert: /run/podidentity.podcert.ate.dev/credential-bundle.pem
-                  key: /run/podidentity.podcert.ate.dev/credential-bundle.pem
-                  root: /run/servicedns-ca/trust-bundle.pem
+          policies: *substrate-ingress
           backends:
           - backend: /dynamic
-            policies:
-              http:
-                version: HTTP/1.1
+        - name: substrate-actors-tunneled-grpc
+          matches: *grpc-matches
+          policies: *substrate-ingress
+          backends: *grpc-backends
 ---
 apiVersion: apps/v1
 kind: Deployment

charts/substrate/values.yaml

@@ -133,5 +133,5 @@ images:
   postgres: postgres:18-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15
   rustfs: rustfs/rustfs:1.0.0-beta.3@sha256:378642b05b7dcb4849fb77ebe6aca4ced1c3f66e7e504247df95a5c9018d3358
   awsCli: amazon/aws-cli:2.17.0@sha256:643507c10ada7964ca6157b3d799f030b90577643da9955d319a77399ed80d73
-  agentgateway: cr.agentgateway.dev/agentgateway:v0.0.0-alpha.9e78d1da@sha256:8177311eb0444df2829cc00410147e960a3bd7261492f2c8d52b48be6d693a45
+  agentgateway: cr.agentgateway.dev/agentgateway:v0.0.0-alpha.168b05d6@sha256:5e8384d1fcfdc443a3ad5155ea6a64dc7953bde162df7f5f8e131a5c19ae08a3
   busybox: busybox:1.36

cmd/credential-provider/kubernetes-secrets/manifests_test.go

@@ -236,7 +236,7 @@ func TestProviderManifests(t *testing.T) {
 	}
 }
 
-func TestAgentgatewayCredentialConfiguration(t *testing.T) {
+func TestHelmAgentgatewayCredentialConfiguration(t *testing.T) {
 	for _, tc := range []struct {
 		name, tool, host, roots string
 		args                    []string
@@ -245,8 +245,6 @@ func TestAgentgatewayCredentialConfiguration(t *testing.T) {
 			args: []string{"template", "substrate", "../../../charts/substrate", "-n", "ate-system"}},
 		{name: "custom release", tool: "helm", host: "test-k8s-credential-provider.custom.svc:50051", roots: "/run/servicedns.podcert.ate.dev/trust-bundle.pem",
 			args: []string{"template", "test", "../../../charts/substrate", "-n", "custom"}},
-		{name: "kustomize", tool: "kubectl", host: "k8s-credential-provider.ate-system.svc:50051", roots: "/run/servicedns-ca/trust-bundle.pem",
-			args: []string{"kustomize", "--load-restrictor=LoadRestrictionsNone", "../../../manifests/ate-install/agentgateway-egress"}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			if _, err := exec.LookPath(tc.tool); err != nil {