Repository navigation
ate-system now denies ingress by default; in-cluster API clients must label their namespace ate.dev/api-access=true - #2522
Merged
Conversation
Greg Castle (destijl)
force-pushed
the
ate-system-netpol
branch
2 times, most recently
from
October 13, 2026 16:59
fc58cbd to
917c689
Compare
Bowei Du (bowei)
left a comment
Bowei Du (bowei)
left a comment
Collaborator
There was a problem hiding this comment.
LG, some comments on the comments
Greg Castle (destijl)
force-pushed
the
ate-system-netpol
branch
from
October 13, 2026 17:37
917c689 to
b904fbf
Compare
…ate API with ate.dev/api-access=true Add default-deny ingress NetworkPolicies for the ate-system control plane, with allow rules for the flows it needs: - ate-api-server :443 from ate-controller, atelet, atenet-router, atenet-egress, and namespaces labeled ate.dev/api-access=true - postgres :5432 and atelet gRPC :8085 from ate-api-server only - atenet-egress https from worker pods (ate.dev/worker-pool) in any namespace - atenet-router data ports (http, https, connect, connect-tls) from any source - metrics and health ports from any source (probes, scrapers) - kind: rustfs S3 API from ate-api-server, atelet and the bucket-init Job The router's /statusz port (4040), the rustfs console, and every other port are reachable only through kubectl port-forward. Breaking change: in-cluster clients of the Substrate API outside ate-system must label their namespace ate.dev/api-access=true. GKE Gateway health checks pointed at the router's status port (4040, /statusz) must move to the metrics port (9090, /readyz). The benchmarking namespace is labeled. Fixes agent-substrate#2278
Collaborator
|
Mark comments as resolved when they have been addressed. |
Greg Castle (destijl)
force-pushed
the
ate-system-netpol
branch
from
October 13, 2026 18:16
b904fbf to
2967851
Compare
Bowei Du (bowei)
approved these changes
Oct 13, 2026
Bowei Du (bowei)
enabled auto-merge
October 13, 2026 18:26
2 tasks done
Haven Xia (HavenXia)
pushed a commit
to HavenXia/substrate
that referenced
this pull request
Oct 14, 2026
…-system's default-deny ingress (agent-substrate#2637) Since agent-substrate#2522, ate-system denies ingress by default and admits API clients only from namespaces labeled `ate.dev/api-access=true`. The `benchmarking` namespace that the automation's runner Job templates create had no labels, so on a fresh cluster the runner could not dial ate-api-server. The boomer worker died ensuring its atespace (`CreateAtespace ... dial tcp ...:443: i/o timeout`), and the locust master waited for a worker that never connected until the Job timed out. This labels the namespace in both runner Job templates (`runner-job.yaml.tmpl` and `nighthawk-ingress-runner-job.yaml.tmpl`), as `benchmarking/locust/deploy.sh` already does for manual runs. `RunnerNamespaceTest` reads the label that the `ate-api-server` NetworkPolicy selects on and checks both templates against it, so the two can't drift apart. It fails on both templates without the change. - [x] Tests pass - [x] Appropriate changes to documentation are included in the PR (none needed)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add default-deny ingress NetworkPolicies for the ate-system control plane, with allow rules for the flows it needs:
The router's /statusz port (4040), the rustfs console, and every other port are reachable only through kubectl port-forward.
Breaking change: in-cluster clients of the Substrate API outside ate-system must label their namespace ate.dev/api-access=true. GKE Gateway health checks pointed at the router's status port (4040, /statusz) must move to the metrics port (9090, /readyz). The benchmarking namespace is labeled.
I want to get this in for M3 because all exposed APIs become customer dependencies unless we restrict them.
Fixes #2278