Repository navigation
ateapi: egress policy RPCs cannot distinguish a missing actor from an actor without a policy #1703
Description
Filed per the discussion #1659 (comment).
GetActorEgressPolicy maps every store miss to NotFound "EgressPolicy not found". The store query behind it is a single SELECT on actor_egress_policies by (atespace, actor_name) with no actor lookup, so the RPC answers identically whether the actor does not exist or exists and simply has no policy:
GetActorEgressPolicy{atespace: team-a, actor: no-such-actor} -> NotFound: EgressPolicy not found
GetActorEgressPolicy{atespace: team-a, actor: exists-no-policy} -> NotFound: EgressPolicy not found
UpdateActorEgressPolicy and DeleteActorEgressPolicy go through the same NotFound arm. CreateActorEgressPolicy already tells the two apart: a missing parent surfaces as FailedPrecondition "parent Actor does not exist".
Desired behavior, and where the CLI stands
The user must always learn which of the two happened. kubectl ate delivers that today, and this is the behavior to keep:
get egress-policy(kubectl-ate: add get and create egress-policy #1659, merged): a missing actor exits 1 withactor "c1" in atespace "team-a" not found; an actor without a policy printsactor "c1" in atespace "team-a" has no egress policyon stderr and exits 0, because no policy is a valid state.delete egress-policy(kubectl-ate: add delete egress-policy #1808): both cases exit 1, with the same two messages.update egress-policy(to follow): same as delete.
To get there the CLI issues a second GetActor whenever the policy RPC answers NotFound (get, delete). That is a workaround, not the end state: one extra round trip on every miss, repeated in every client that needs the distinction.
Behavior as of d277088.
Activity
[-]GetActorEgressPolicy returns the same NotFound for a missing actor and for an actor without a policy[/-][+]ateapi: egress policy RPCs cannot distinguish a missing actor from an actor without a policy[/+]ygao-g commentedon Sep 23, 2026
Proposed fix
Keep the
NotFoundcode for both cases so existing callers such as the atenet policy cache are unaffected, and make the server say which resource is missing:actors LEFT JOIN actor_egress_policiesfor Get and Update; an actor existence check after an emptyDELETE ... RETURNINGfor Delete) and returns a distinct parent-not-found error.google.rpc.ResourceInfodetail (resource_typeActororEgressPolicy,resource_name<atespace>/<name>) and names the actor in the message.GetActor. The CLI behavior above does not change.CreateActorEgressPolicykeepsFailedPreconditionfor a missing parent. A change covering all three RPCs is drafted as ygao-g#39 and will be filed here.ygao-g commentedon Sep 23, 2026
Discussed with Julian Gutierrez Oschmann (@juli4n) privately. Their concerns are that we make common cases more expensive (e.g. (actors LEFT JOIN actor_egress_policies, or a second query on the not found path), trading the performance just to avoid an extra read in one CLI tool, on the uncommon cases.
The suggestion is to have the workaround on the CLI side, e.g., try fetching the actor if encountering a NotFound error, as client CLI tools usually orchestrate calls like this, is fairly common.
Bowei Du (@bowei) , haiyanmeng WDYT?
haiyanmeng commentedon Sep 23, 2026
Did some digging, the issue was filed per the discussion #1659 (comment).
kubectl-ate: share the missing-actor check across egress-policy comma…