Repository navigation
Update agentgateway for split actor and ateom identities - #1923
Merged
Keith Mattix II (keithmattix) merged 2 commits intoSep 26, 2026
Merged
Keith Mattix II (keithmattix) merged 2 commits into
Keith Mattix II (keithmattix) merged 2 commits into
Conversation
Use the nightly that reads ateom-for-actor certificate URIs and supplies actor identities to credential providers. Pin ingress and egress to the same multi-architecture image digest. Signed-off-by: Eitan Yarmush <[email protected]>
Davanum Srinivas (dims)
approved these changes
Sep 26, 2026
2 tasks done
John Howard (howardjohn)
approved these changes
Sep 26, 2026
Pull ingress and egress from cr.agentgateway.dev while retaining the validated nightly version and multi-architecture digest. Signed-off-by: Eitan Yarmush <[email protected]>
Keith Mattix II (keithmattix)
approved these changes
Sep 26, 2026
Bowei Du (bowei)
added
area/identity
area/network
kind/bug
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update the router and egress image to
cr.agentgateway.dev/agentgateway:v0.0.0-alpha.9e78d1dafrom this nightly, pinned to its multi-architecture digest.This includes agentgateway/agentgateway#3677, which reads the
ateom-for-actorSPIFFE URI from the certificate and sends the actor SPIFFE identity to credential providers. The currently pinned image still expects the removedActorIdentityextension, so it rejects egress after the ateom/actor identity split.Validation: all five agentgateway Kustomize overlays render with the expected registry and digest. Fetching the tag and digest from
cr.agentgateway.devreturns the same image index as GHCR. Before the registry-only change,hack/verify-all.shand upstream PR CI passed, including both E2E dataplanes and the race tests. CI for the registry change is pending.Local
make verifyis blocked byTestCAPoolCache_HitAndFileChange: it rewrites identical bytes and expects the file timestamp to advance, which is not reliable on this machine's temporary filesystem. The first run also hit a temporary-directory cleanup failure inTestSandboxAssetPrewarmDownloads; that test passed on retry. Both tests are unchanged from upstream.