Repository navigation
Clean up client authentication story #1464
Description
Right now I think most clients are falling into the port-forwarding / token minting path [1]
This is convenient for local development, but I don't think it should be the default authentication mode. We shouldn't assume that a user or service who is interacting with the Substrate API has any particular permissions on the Kubernetes cluster where Substrate is installed.
-
We should migrate all integration / e2e tests so that the calling code gets a JWT (or client certificate) that will work against the Substrate API from the execution environment. This could be a Kubernetes JWT with the correct audience for connecting to Substrate (via projected volume) if the calling code runs inside a pod. Or if the calling code is running inside of Github actions, there's a Github-issued JWT we can use.
-
We should document what you should be doing in common scenarios:
a) You are authenticating to the Substrate API from a service running inside a pod in a Kubernetes cluster (same cluster or different cluster). Configure Substrate so that it trusts JWTs issued by that cluster.
b) You are authenticating to the Substrate API as a human running kubectl ate. Set the --endpoint flag to aim at your Substrate install, and tell us how to invoke a command that will return a JWT (like how gcloud is integrated into kubectl) (this isn't built yet)
[1]
substrate/internal/ateclient/builder.go
Line 241 in 1ec75f9
Activity
destijl commentedon Oct 15, 2026
My read is:
EItanya commentedon Oct 21, 2026
Can we create a new docs issue so it doesn’t seem to be blocking code freeze?
bootsieh commentedon Oct 21, 2026
What is making it block the code freeze, Eitan?
EItanya commentedon Oct 21, 2026
I think the complex thing is that we're working with M3 as the GA milestone, and ALSO we want to do a feature freeze ASAP. So the lack of sub-issues make it unclear what's actually left here. The remaining work is just docs, not any code chnges, right?
bootsieh commentedon Oct 21, 2026
The docs are the only part that is M3 blocking, but it's not cut blocking
thompsonmax commentedon Oct 22, 2026
I have #2851 out to improve the authn UX by supporting credential plugins, but it seems that missed the code slush deadline for M3.
Sent out #3119 to improve the docs around authn in the meantime.
EItanya commentedon Oct 22, 2026
Ok thanks for clarifying, closing this
Document how people, pods and CI jobs should authenticate to ate-api (a…
Document how people, pods and CI jobs should authenticate to ate-api (#…