router authn/z part 4: Remove deprecated-insecure mode by ahmedtd · Pull Request #2977 · agent-substrate/substrate

Taahir Ahmed (ahmedtd) · 2026-10-20T17:38:18Z

We have now cut over all e2e tests so that they work in static-mtls mode.

Remove deprecated-insecure mode from the atenet ingress router.

Agent-gateway's config is still left supporting insecure ports, for followup from Solo.

Lior Lieberman (LiorLieberman)

generally looks good but question on agentgateway support here. (cc: Eitan Yarmush (@EItanya) Keith Mattix II (@keithmattix) )

Also, have we documented how to do port-forward/obtain cert for local testing etc?

Lior Lieberman (LiorLieberman) · 2026-10-20T19:48:41Z

+func (agentGatewayAtenetDataplane) AuthenticatesIngressClients() bool { return false }
+


why is that? I think agw supports static-mtls? no?

if we do leave it, I dont see any distinction in the CI then for agw or not

Taahir Ahmed (ahmedtd) · 2026-10-20T19:58:54Z

Also, have we documented how to do port-forward/obtain cert for local testing etc?

I'll have Claude whip up a summary of what's done in the e2e tests.

Lior Lieberman (LiorLieberman) · 2026-10-20T20:00:14Z

Also, have we documented how to do port-forward/obtain cert for local testing etc?

I'll have Claude whip up a summary of what's done in the e2e tests.

sg. into this pr?

Lior Lieberman (LiorLieberman)

talked with keith offline, good to go.

Taahir Ahmed (ahmedtd) · 2026-10-20T20:39:10Z

Also, have we documented how to do port-forward/obtain cert for local testing etc?

I'll have Claude whip up a summary of what's done in the e2e tests.

sg. into this pr?

Yes, it's in cmd/atenet/internal/router/README.md now. I've reviewed it for accuracy but not style.

…substrate#3089) ## What this PR does and why we need it ? Following agent-substrate#2977 (`5d5dd7ae`), `atenet-router` no longer exposes plaintext HTTP on `:80` and requires SPIFFE mTLS on `:443` (`https://atenet-router.ate-system.svc`), verifying the server leaf against `/run/servicedns-ca/ca.crt` (SAN `atenet-router.ate-system.svc`) and presenting `/run/podidentity.podcert.ate.dev/credential-bundle.pem`. This PR updates all benchmark data-plane clients to dial `atenet-router` over SPIFFE mTLS on `:443`: - **`internal/benchmarking/boomer/boomerutil`**: - Add `DefaultRouterURL = "https://atenet-router.ate-system.svc"` and `RouterTLSConfig()`, cached with `sync.OnceValues` and returning a `Clone()` configured with `RootCAs` from `credbundle.ParsePool("/run/servicedns-ca/ca.crt")`, `GetClientCertificate` from `credbundle.ClientLoader("/run/podidentity.podcert.ate.dev/credential-bundle.pem")`, and `ServerName: "atenet-router.ate-system.svc"`. - Add unit tests in `client_test.go` covering mTLS handshake success, mismatched `ServerName` rejection, and missing credential files. - **`cmd/benchmarking/boomer-worker`**: - Default `--router-url` to `boomerutil.DefaultRouterURL` and fail fast on startup if `--router-url` does not start with `https://`. - Configure `http.Transport.TLSClientConfig` via `boomerutil.RouterTLSConfig()` and keep `ForceAttemptHTTP2 = false` so Go does not implicitly enable HTTP/2 ALPN when `TLSClientConfig` is non-nil (preserving HTTP/1.1 connection-pool semantics for `glutton` and `durdir`). - **`internal/benchmarking/boomer/ateenv`**: - Update `routerGRPCTarget` to require `https://` and default to `:443`. - Dial `atenet-router` with `credentials.NewTLS(tlsCfg)` from `boomerutil.RouterTLSConfig()`. - **`benchmarking/nighthawk-ingress` & `benchmarking/nighthawk-egress`**: - Update `DEFAULT_ROUTER_URL` to `https://atenet-router.ate-system.svc:443` and configure `_warm_actor` `requests.Session` with `verify = "/run/servicedns-ca/ca.crt"` and `cert = "/run/podidentity.podcert.ate.dev/credential-bundle.pem"`. - Reject non-`https://` URIs in `build_spec_dict` and populate `tls_context` (`sni: "atenet-router.ate-system.svc"`, `tls_certificates` client cert + key from `/run/podidentity.podcert.ate.dev/credential-bundle.pem`, `trusted_ca` from `/run/servicedns-ca/ca.crt`, and `match_typed_subject_alt_names` exact `DNS` match on `atenet-router.ate-system.svc`). - **`benchmarking/locust/tests/counter_demo.py`**: - Switch `ROUTER_URL` to `https://atenet-router.ate-system.svc` and configure `http_session.verify` and `http_session.cert`. ## Testing - Unit tests: `go test -race -count=1 ./cmd/benchmarking/... ./internal/benchmarking/... ./benchmarking/...`, `benchmarking/automation` unit tests, and Nighthawk proto round-trip & URI validation tests (`test_spec_round_trips_through_real_protos`, `test_rejects_non_https_uri`). - Live GKE cluster smoke tests (`glutton`, `durdir`, and `ate-env` on gVisor): 0 failures across all runs; verified `atenet-router` Envoy metrics (`ssl_handshake > 0`, `ssl_fail_verify_* == 0`, HTTP/1.1 connections for `glutton`/`durdir`, and HTTP/2 connections for `ate-env`). Fixes agent-substrate#3088 - [x] Tests pass - [x] Docs updated

…substrate#3089) Following agent-substrate#2977 (`5d5dd7ae`), `atenet-router` no longer exposes plaintext HTTP on `:80` and requires SPIFFE mTLS on `:443` (`https://atenet-router.ate-system.svc`), verifying the server leaf against `/run/servicedns-ca/ca.crt` (SAN `atenet-router.ate-system.svc`) and presenting `/run/podidentity.podcert.ate.dev/credential-bundle.pem`. This PR updates all benchmark data-plane clients to dial `atenet-router` over SPIFFE mTLS on `:443`: - **`internal/benchmarking/boomer/boomerutil`**: - Add `DefaultRouterURL = "https://atenet-router.ate-system.svc"` and `RouterTLSConfig()`, cached with `sync.OnceValues` and returning a `Clone()` configured with `RootCAs` from `credbundle.ParsePool("/run/servicedns-ca/ca.crt")`, `GetClientCertificate` from `credbundle.ClientLoader("/run/podidentity.podcert.ate.dev/credential-bundle.pem")`, and `ServerName: "atenet-router.ate-system.svc"`. - Add unit tests in `client_test.go` covering mTLS handshake success, mismatched `ServerName` rejection, and missing credential files. - **`cmd/benchmarking/boomer-worker`**: - Default `--router-url` to `boomerutil.DefaultRouterURL` and fail fast on startup if `--router-url` does not start with `https://`. - Configure `http.Transport.TLSClientConfig` via `boomerutil.RouterTLSConfig()` and keep `ForceAttemptHTTP2 = false` so Go does not implicitly enable HTTP/2 ALPN when `TLSClientConfig` is non-nil (preserving HTTP/1.1 connection-pool semantics for `glutton` and `durdir`). - **`internal/benchmarking/boomer/ateenv`**: - Update `routerGRPCTarget` to require `https://` and default to `:443`. - Dial `atenet-router` with `credentials.NewTLS(tlsCfg)` from `boomerutil.RouterTLSConfig()`. - **`benchmarking/nighthawk-ingress` & `benchmarking/nighthawk-egress`**: - Update `DEFAULT_ROUTER_URL` to `https://atenet-router.ate-system.svc:443` and configure `_warm_actor` `requests.Session` with `verify = "/run/servicedns-ca/ca.crt"` and `cert = "/run/podidentity.podcert.ate.dev/credential-bundle.pem"`. - Reject non-`https://` URIs in `build_spec_dict` and populate `tls_context` (`sni: "atenet-router.ate-system.svc"`, `tls_certificates` client cert + key from `/run/podidentity.podcert.ate.dev/credential-bundle.pem`, `trusted_ca` from `/run/servicedns-ca/ca.crt`, and `match_typed_subject_alt_names` exact `DNS` match on `atenet-router.ate-system.svc`). - **`benchmarking/locust/tests/counter_demo.py`**: - Switch `ROUTER_URL` to `https://atenet-router.ate-system.svc` and configure `http_session.verify` and `http_session.cert`. - Unit tests: `go test -race -count=1 ./cmd/benchmarking/... ./internal/benchmarking/... ./benchmarking/...`, `benchmarking/automation` unit tests, and Nighthawk proto round-trip & URI validation tests (`test_spec_round_trips_through_real_protos`, `test_rejects_non_https_uri`). - Live GKE cluster smoke tests (`glutton`, `durdir`, and `ate-env` on gVisor): 0 failures across all runs; verified `atenet-router` Envoy metrics (`ssl_handshake > 0`, `ssl_fail_verify_* == 0`, HTTP/1.1 connections for `glutton`/`durdir`, and HTTP/2 connections for `ate-env`). Fixes agent-substrate#3088 - [x] Tests pass - [x] Docs updated

Taahir Ahmed (ahmedtd) requested review from Eitan Yarmush (EItanya) and Lior Lieberman (LiorLieberman) October 20, 2026 17:39

Lior Lieberman (LiorLieberman) reviewed Oct 20, 2026

View reviewed changes

Lior Lieberman (LiorLieberman) previously approved these changes Oct 20, 2026

View reviewed changes

Taahir Ahmed (ahmedtd) dismissed Lior Lieberman (LiorLieberman)’s stale review via 0aa74a1 October 20, 2026 20:38

Taahir Ahmed (ahmedtd) force-pushed the router-authnz-4 branch from 1178c5c to 0aa74a1 Compare October 20, 2026 20:38

Taahir Ahmed (ahmedtd) requested a review from Lior Lieberman (LiorLieberman) October 20, 2026 20:39

Lior Lieberman (LiorLieberman) previously approved these changes Oct 20, 2026

View reviewed changes

Taahir Ahmed (ahmedtd) enabled auto-merge October 20, 2026 20:46

Taahir Ahmed (ahmedtd) added this pull request to the merge queue Oct 20, 2026

github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Oct 20, 2026

router authn/z part 4: Remove deprecated-insecure mode

ed4e232

Taahir Ahmed (ahmedtd) dismissed Lior Lieberman (LiorLieberman)’s stale review via ed4e232 October 21, 2026 00:31

Taahir Ahmed (ahmedtd) force-pushed the router-authnz-4 branch from 0aa74a1 to ed4e232 Compare October 21, 2026 00:31

Zoe Zhao (zoez7) enabled auto-merge October 21, 2026 00:39

Zoe Zhao (zoez7) approved these changes Oct 21, 2026

View reviewed changes

Benjamin Elder (BenTheElder) approved these changes Oct 21, 2026

View reviewed changes

Benjamin Elder (BenTheElder) added the area/security Security related issue/pr label Oct 21, 2026

Zoe Zhao (zoez7) added this pull request to the merge queue Oct 21, 2026

Merged via the queue into agent-substrate:main with commit 5d5dd7a Oct 21, 2026
15 checks passed

This was referenced Oct 21, 2026

[Bug]: Benchmarks dial removed plaintext port 80 on atenet-router #3088

Closed

benchmarking: dial atenet-router over SPIFFE mTLS on port 443 #3089

Merged

Igor Racic (iracic82) mentioned this pull request Oct 22, 2026

docs: use the mTLS router client in the kind quickstart and counter demo #3113

Closed

ajaysundar.k (ajaysundark) mentioned this pull request Oct 29, 2026

demos/sandbox: use ateclient.NewClient for authenticated ate-api access #1580

Open

2 tasks done

Gari Singh (mastersingh24) mentioned this pull request Oct 31, 2026

feat(mtls,client): file-backed PKI credentials, pod-certificate bundles, rotating roots go-steer/purser#35

Merged

Gari Singh (mastersingh24) mentioned this pull request Oct 31, 2026

feat(watch): reach Substrate v1.0's router over mTLS and speak the v1.0 ax fork's API go-steer/k8s-lookout#810

Merged

Navigation Menu

Repository navigation

router authn/z part 4: Remove deprecated-insecure mode - #2977

router authn/z part 4: Remove deprecated-insecure mode#2977
Zoe Zhao (zoez7) merged 1 commit into
agent-substrate:mainfrom
ahmedtd:router-authnz-4

Taahir Ahmed (ahmedtd) commented Oct 20, 2026 •

edited

Loading

Uh oh!

Lior Lieberman (LiorLieberman) left a comment

Uh oh!

Lior Lieberman (LiorLieberman) Oct 20, 2026

Uh oh!

Taahir Ahmed (ahmedtd) commented Oct 20, 2026

Uh oh!

Lior Lieberman (LiorLieberman) commented Oct 20, 2026

Uh oh!

Lior Lieberman (LiorLieberman) left a comment

Uh oh!

Taahir Ahmed (ahmedtd) commented Oct 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		func (agentGatewayAtenetDataplane) AuthenticatesIngressClients() bool { return false }

Conversation

Taahir Ahmed (ahmedtd) commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Lior Lieberman (LiorLieberman) left a comment

Choose a reason for hiding this comment

Uh oh!

Lior Lieberman (LiorLieberman) Oct 20, 2026

Choose a reason for hiding this comment

Uh oh!

Taahir Ahmed (ahmedtd) commented Oct 20, 2026

Uh oh!

Lior Lieberman (LiorLieberman) commented Oct 20, 2026

Uh oh!

Lior Lieberman (LiorLieberman) left a comment

Choose a reason for hiding this comment

Uh oh!

Taahir Ahmed (ahmedtd) commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Taahir Ahmed (ahmedtd) commented Oct 20, 2026 •

edited

Loading

Taahir Ahmed (ahmedtd) commented Oct 20, 2026 •

edited

Loading