Quickstart: deploy ate-system hard-requires an ingress SPIFFE allowlist the Quickstart never sets #3194

Summary

Both Quickstarts tell a new user to run

hack/install-ate-kind.sh deploy ate-system --credential-provider='{"name":"k8s.io"}'

and on current main that command fails before it touches the cluster:

Error: at least one of ATE_INGRESS_ALLOWED_SPIFFE_IDS, config.ingressAllowedSPIFFEIDs
or --ingress-allowed-spiffe-ids must be set, got none

So step 2 of the documented getting-started flow cannot be completed as written.

Reproduction

Clean VM, clean cluster, nothing but the README:

1. hack/create-kind-cluster.sh — succeeds
2. hack/install-ate-kind.sh deploy ate-system --credential-provider='{"name":"k8s.io"}' — fails as above

Reproduced on four consecutive days against main, and on the GKE path too: a
clean GKE Standard cluster on 1.36.3-gke.1767000 with setup-gcp bootstrap
succeeding and ate-setup deploy ate-system then failing identically. So this
is not Kind-specific — it is both front doors.

Where it comes from

deploy ate-system calls RequireIngressAllowedSPIFFEIDs() before applying
anything (cmd/ate-setup/internal/steps/deploy.go). The reason is sound and
documented in cmd/ate-setup/internal/config/config.go: the Envoy ingress
router authenticates clients on its TLS listeners and refuses to start with no
SPIFFE ID to match them against. Envoy is the default dataplane.

The requirement is documented nearly everywhere — cmd/ate-setup/commands.md
marks it Required, docs/operator-install.md lists it, every
benchmarking/**/README.md invocation passes it, and the repo's own CI sets
ATE_INGRESS_ALLOWED_SPIFFE_IDS. The two Quickstart blocks in README.md are
what the sweep missed.

Why this may not be a pure docs fix

The Quickstart's own traffic path is a host-side curl through
kubectl port-forward … svc/atenet-router 8000:80 — plaintext, port 80. It
never reaches a TLS listener, so no client in the documented flow has a SPIFFE
ID that would be meaningful to allowlist. The install now hard-fails on a
setting the documented happy path cannot populate for a real reason.

That suggests two resolutions, and which one is right looks like a product
call rather than a transcription:

1. Relax — skip the requirement when no TLS ingress listener will be
   served, or default to empty with a warning.
2. Document — add a placeholder to both Quickstart blocks; CI already uses
   spiffe://cluster.local/ns/ate-e2e-router-client/sa/router-client.

Happy to send a PR for whichever you prefer.