Repository navigation
Document injecting actor JWTs with egress policies - #2596
Merged
Max Smythe (maxsmythe) merged 2 commits intoOct 19, 2026
Merged
Conversation
Max Thompson (thompsonmax)
requested review from
Eitan Yarmush (EItanya),
Taahir Ahmed (ahmedtd) and
Yufan Su (yufan-su)
October 13, 2026 20:44
Max Thompson (thompsonmax)
marked this pull request as ready for review
October 13, 2026 20:44
2 tasks
Bowei Du (bowei)
added
area/identity
area/network
area/security
Yufan Su (yufan-su)
approved these changes
Oct 14, 2026
Yufan Su (yufan-su)
left a comment
Yufan Su (yufan-su)
left a comment
Collaborator
There was a problem hiding this comment.
LGTM,
nit: maybe also update the digram to highlight that path? right now it is embedded in text
2 tasks
Collaborator
Author
done |
The egress credential injection guide now covers actorJwt entries: the policy fields and their limits, the claims a minted token carries, how long the gateway reuses a token, the outcome of each mint failure, and that tokens follow the actor's name until they refresh.
The diagram showed only the credential provider path, so the ateapi mint for actorJwt entries was described only in the text below it. Add ateapi and label each of the gateway's outbound calls with the field that selects it.
Max Thompson (thompsonmax)
force-pushed
the
actor-jwt-docs
branch
from
October 19, 2026 22:09
5e1b7a7 to
929b085
Compare
jiayimeow
pushed a commit
to jiayimeow/substrate
that referenced
this pull request
Oct 19, 2026
…#2256) Part of agent-substrate#1660. - The `egresscredinject` suite's echo-origin rules, http and https, now also replace `X-Actor-Token` with an actor JWT. The test decodes the token the in-cluster echo server sends back and checks `sub`, `aud`, the lifetime (`exp - iat`) and the `actor.ate.dev` claim, including the actor's UID. It also fails if the token is the `worker-for-actor` kind. - A fetch without the header must reach the echo server without `X-Actor-Token`, matching the existing check for `Authorization`. - `assertEchoedAuthorization` is now `assertEchoedHeaders`, so one fetch checks both headers. The test doesn't check the JWT's signature. That needs the published key set, which the OIDC discovery e2e (agent-substrate#2606) covers. Testing: lint and vet pass. The previous head passed e2e in CI on both sandbox classes; this rebase only changes an import path for the module rename. - [ ] Tests pass - [ ] Appropriate changes to documentation are included in the PR (the user guide is agent-substrate#2596)
Max Smythe (maxsmythe)
enabled auto-merge
October 19, 2026 22:30
Haven Xia (HavenXia)
approved these changes
Oct 19, 2026
1 of 2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #1660.
docs/egress-credential-injection.mdgains an Actor JWTs section: theactorJwtpolicy fields and their limits, the claims a minted token carries, and how long the gateway reuses a token before minting another.The metrics from #2317 aren't mentioned, since they aren't on main yet.
Testing: docs only. The YAML example parses with
kubectl ate's policy parser, and each documented limit matches ateapi's validation, both checked with throwaway tests.