egress: add credential injector by yufan-su · Pull Request #1360 · agent-substrate/substrate

Yufan Su (yufan-su) · 2026-09-01T04:18:45Z

Adds egress credential injection: on the sdsmint egress gateway's decrypted MITM leg, when an actor's EgressPolicy rule matches and carries an inject_static_headers effect, the gateway resolves the referenced credential from a credential provider and sets it as a request header (e.g. Authorization: Bearer <token>) before re-originating upstream.

This implements the applyEffects in the egress handler. Injector runs as part of the existing egress ext_proc handler that already fetches/caches/evaluates each actor's EgressPolicy, so the MITM leg gains injection without a second ext_proc hop.

How it works

New CredentialProvider.FetchSecret plugin API (pkg/proto/credproviderpb): the gateway calls it with the credential URI and the actor's attested SPIFFE identity; the provider authenticates the gateway (mTLS) and resolves the secret.
The egress handler dials the provider over mTLS (egress.DialProvider) and injects on matched, allowed requests (egress.applyEffects).
Behavior:
- TLS MITM leg + provider configured → inject the credential (overwriting any actor-set header).
- Cleartext leg, or no provider configured → skip injection and pass the request through (never put a secret on a cleartext wire; don't block allowed egress).
- Attempted but failed (unfetchable secret, empty/malformed secret, credential URI of an unserved provider class) → fail closed.

Installation

One flag stands up and wires the whole stack:

hack/install-ate.sh --deploy-ate-system --experimental-egress-credential-injection

--experimental-egress-credential-injection deploys credprovider and the injector, then re-wires the sdsmint egress gateway to route through the injector. It implies --experimental-use-sdsmint

New install flags

Two flags configure which credential provider the injector targets:

Flag	Purpose	Default
`--credential-provider-name`	Provider class, as a `ate-secret://` prefix; a policy URI of any other class is refused	`ate-secret://kubernetes.io`
`--credential-provider-address`	Where the injector dials the provider	`credprovider.ate-system.svc:50051`

Eitan Yarmush (EItanya)

🤖 AI-assisted transfer of my actor-identity concern from #1335, since this PR is planned to merge first.

…can't reach it via pod network

…rovider client

…ut TLS

…in various places

…` everywhere

…t uri and interpreted in the provider.

Lior Lieberman (LiorLieberman) · 2026-09-16T22:55:45Z

+  // The SPIFFE ID of the actor on whose behalf the secret is fetched, as
+  // verified by the egress gateway. This field always contains a SPIFFE ID.


Instead of "this field always contains a SPIFFE ID" maybe just say the format?

Lior Lieberman (LiorLieberman)

LGTM

Upgrade to the new codified protobuf contract: agent-substrate/substrate#1360. - [x] As required by the [Code of Conduct](https://github.com/agentgateway/agentgateway/blob/main/CODE_OF_CONDUCT.md#generative-ai-policy), the description, docs, and comments (words meant for humans) are written by a human, not by an LLM. Signed-off-by: Eitan Yarmush <[email protected]>

Yufan Su (yufan-su) mentioned this pull request Sep 1, 2026

egress: add an example credential provider which reads from k8s secret #1335

Merged

Yufan Su (yufan-su) force-pushed the egress-cred-injector branch 8 times, most recently from a6aa602 to 649b2d3 Compare September 9, 2026 00:17

Max Thompson (thompsonmax) reviewed Sep 10, 2026

View reviewed changes

Comment thread cmd/atenet/internal/router/egressinject/policy.go Resolved

Comment thread cmd/atenet/internal/router/egressinject/handler.go Resolved

Comment thread cmd/atenet/internal/router/egressinject/run.go Resolved

Comment thread cmd/atenet/internal/router/egressinject/run.go Resolved

Max Thompson (thompsonmax) reviewed Sep 10, 2026

View reviewed changes

Comment thread pkg/proto/credproviderpb/credprovider.proto Resolved

Eitan Yarmush (EItanya) reviewed Sep 14, 2026

View reviewed changes

Comment thread pkg/proto/credproviderpb/credprovider.proto Resolved

Taahir Ahmed (ahmedtd) reviewed Sep 14, 2026

View reviewed changes

Comment thread cmd/atenet/internal/router/egressinject/cmd.go Resolved

Taahir Ahmed (ahmedtd) reviewed Sep 14, 2026

View reviewed changes

Comment thread pkg/proto/credproviderpb/credprovider.proto Resolved

Comment thread pkg/proto/credproviderpb/credprovider.proto Resolved

Comment thread pkg/proto/credproviderpb/credprovider.proto Resolved

Comment thread cmd/atenet/internal/router/egressinject/handler.go Resolved

Taahir Ahmed (ahmedtd) reviewed Sep 14, 2026

View reviewed changes

Comment thread cmd/atenet/internal/router/egressinject/handler.go Resolved

Yufan Su (yufan-su) force-pushed the egress-cred-injector branch 3 times, most recently from 401b4f5 to 9a7e250 Compare September 15, 2026 05:14

Yufan Su (yufan-su) requested review from Eitan Yarmush (EItanya) and Taahir Ahmed (ahmedtd) September 15, 2026 16:28

This was referenced Sep 15, 2026

Credential Injection - Support Actor JWT #1660

Closed

Credential Injection - Support RFC 8693 token exchange of the Actor JWT #1661

Open

Yufan Su (yufan-su) added 2 commits September 15, 2026 11:35

Add egress credential injector

b0f4ed8

bind extproc server to 127.0.0.1:50051 (loopback) so that other pods …

1ede701

…can't reach it via pod network

Yufan Su (yufan-su) force-pushed the egress-cred-injector branch from 80922b2 to 1ede701 Compare September 15, 2026 18:57

Eitan Yarmush (EItanya) reviewed Sep 15, 2026

View reviewed changes

Comment thread cmd/atenet/internal/router/egress/egress.go Resolved

Max Thompson (thompsonmax) reviewed Sep 15, 2026

View reviewed changes

Comment thread cmd/atenet/internal/router/egress/credentials.go Resolved

Comment thread cmd/atenet/internal/router/egress/provider.go Resolved

Comment thread cmd/atenet/internal/router/egress/provider.go Resolved

Comment thread cmd/atenet/internal/router/egress/credentials.go Resolved

Yufan Su (yufan-su) added 2 commits September 15, 2026 13:45

remove oneof in proto and update the constructor to take credential p…

7dc9b56

…rovider client

add --credential-provider-insecure for explicit opt-in for dial witho…

7eef999

…ut TLS

Lior Lieberman (LiorLieberman) reviewed Sep 15, 2026

View reviewed changes

Comment thread pkg/proto/credproviderpb/credprovider.proto Resolved

Update credprovider proto; also rename ProviderClass to ProviderName …

b936228

…in various places

Tim Hockin (thockin) reviewed Sep 15, 2026

View reviewed changes

Comment thread pkg/proto/credproviderpb/credprovider.proto Resolved

Taahir Ahmed (ahmedtd) reviewed Sep 15, 2026

View reviewed changes

Comment thread pkg/proto/credproviderpb/credprovider.proto Resolved

Taahir Ahmed (ahmedtd) reviewed Sep 15, 2026

View reviewed changes

Comment thread pkg/proto/credproviderpb/credprovider.proto Resolved

Comment thread pkg/proto/credproviderpb/credprovider.proto Resolved

Yufan Su (yufan-su) added 3 commits September 15, 2026 20:14

update proto

a1fad6e

rename secret uri prefix from substrate-secret:// to `ate-secret://…

95b1dbb

…` everywhere

drop RequestContext, any option request metadata will be in the secre…

8474cff

…t uri and interpreted in the provider.

Yufan Su (yufan-su) requested review from Eitan Yarmush (EItanya), Lior Lieberman (LiorLieberman), Taahir Ahmed (ahmedtd) and Tim Hockin (thockin) September 16, 2026 20:47

Lior Lieberman (LiorLieberman) reviewed Sep 16, 2026

View reviewed changes

Comment thread pkg/proto/credproviderpb/credprovider.proto Resolved

Lior Lieberman (LiorLieberman) reviewed Sep 16, 2026

View reviewed changes

Comment thread pkg/proto/credproviderpb/credprovider.proto Resolved

update comments in proto

5aeb092

Yufan Su (yufan-su) force-pushed the egress-cred-injector branch from f68af4d to 15a5594 Compare September 16, 2026 21:52

Yufan Su (yufan-su) requested a review from Lior Lieberman (LiorLieberman) September 16, 2026 21:55

Yufan Su (yufan-su) force-pushed the egress-cred-injector branch 2 times, most recently from 389904c to 24d88cf Compare September 16, 2026 22:15

Update pkg/proto/credproviderpb/credprovider.proto

8b7f975

Yufan Su (yufan-su) force-pushed the egress-cred-injector branch from 24d88cf to 8b7f975 Compare September 16, 2026 22:16

Lior Lieberman (LiorLieberman) reviewed Sep 16, 2026

View reviewed changes

Lior Lieberman (LiorLieberman) approved these changes Sep 16, 2026

View reviewed changes

Eitan Yarmush (EItanya) approved these changes Sep 16, 2026

View reviewed changes

Eitan Yarmush (EItanya) merged commit 85ce8ed into agent-substrate:main Sep 16, 2026
11 checks passed

Eitan Yarmush (EItanya) mentioned this pull request Sep 17, 2026

substrate: align credential injection with provider contract agentgateway/agentgateway#3524

Merged

1 task done

github-actions Bot mentioned this pull request Oct 2, 2026

[Automated] Draft docs (agentgateway): substrate: align credential injection with provider contract agentgateway/website#1174

Closed

		// The SPIFFE ID of the actor on whose behalf the secret is fetched, as
		// verified by the egress gateway. This field always contains a SPIFFE ID.

Conversation

Yufan Su (yufan-su) commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

How it works

Installation

New install flags

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Eitan Yarmush (EItanya) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Lior Lieberman (LiorLieberman) Sep 16, 2026

Choose a reason for hiding this comment

Uh oh!

Lior Lieberman (LiorLieberman) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Yufan Su (yufan-su) commented Sep 1, 2026 •

edited

Loading