Repository navigation
docs: Document that atespace names must not be reused - #3450
Merged
Dmitry Berkovich (dberkov) merged 2 commits intoNov 3, 2026
Merged
Dmitry Berkovich (dberkov) merged 2 commits into
Dmitry Berkovich (dberkov) merged 2 commits into
Conversation
Signed-off-by: Shruti Nair <[email protected]>
Shruti Nair (SHRUTI6991)
changed the title
Shruti Nair (SHRUTI6991)
requested review from
Benjamin Elder (BenTheElder) and
Dmitry Berkovich (dberkov)
October 29, 2026 19:29
Comment on lines
+344
to
+345
| Nothing enforces unique names. Pick names with enough randomness that | ||
| separate admins and automation don't collide. |
Collaborator
There was a problem hiding this comment.
🤖 should-fix 🟡 – Randomness guards against accidental collisions, but the race needs the same name recreated on purpose, which is the normal case for deterministic or GitOps-managed names (your own note on #3255 says the 26-character rule doesn't cover this). Say what actually avoids it: once an atespace is deleted, don't create another one under that name; use a fresh name instead.
Collaborator
Author
There was a problem hiding this comment.
Done. Replaced the randomness advice with: don't recreate a deleted atespace's name; use a fresh one.
Comment on lines
+342
to
+343
| and recreated under the same name, a request a previous owner sent before | ||
| the delete can grant itself access to the new atespace, or delete it. |
Collaborator
There was a problem hiding this comment.
🤖 nit 🟢 – "sent before the delete" is looser than the bullet above, which correctly says the request must still be in flight across the delete and recreate. Align the two. Also, per #3255 every atespace-scoped write is affected, not only policy grants and delete; "can land on the new atespace, including granting access to it or deleting it" would cover that.
Collaborator
Author
There was a problem hiding this comment.
Done. Both bullets now say the request must still be in flight across the delete and recreate, and the limitation covers any write landing on the new atespace.
…ght wording Signed-off-by: Shruti Nair <[email protected]>
Tim Hockin (thockin)
approved these changes
Nov 3, 2026
Collaborator
|
Docs only change, still needs another +1 as per rules Dmitry Berkovich (@dberkov) Eitan Yarmush (@EItanya) Benjamin Elder (@BenTheElder) Julian Gutierrez Oschmann (@juli4n) |
Dmitry Berkovich (dberkov)
approved these changes
Nov 3, 2026
Eitan Yarmush (EItanya)
pushed a commit
to kagent-dev/substrate
that referenced
this pull request
Nov 3, 2026
…e#3450) Concurrency tests in agent-substrate#3255 showed that a request authorized against a deleted atespace can apply to a new atespace with the same name. A previous owner can regain `owner` on it or delete it. We decided not to fix this in code. Atespace names must not be reused, and nothing enforces it. This documents the limitation in the authorization guide and qualifies the claim that a recreated atespace starts with no policy. I used an AI assistant to analyze the issue and draft the doc text, and reviewed the result. --------- Signed-off-by: Shruti Nair <[email protected]> (cherry picked from commit 9d16b69) Signed-off-by: Eitan Yarmush <[email protected]>
1 of 2 tasks
Dmitry Berkovich (dberkov)
pushed a commit
that referenced
this pull request
Nov 3, 2026
Bring `release-1.0` up to `main` at 5a5b192 with the 19 changes merged since the previous batch in #3536. The final tree matches that commit exactly. **Please use Rebase and merge to preserve the individual commits and author attribution.** All 19 applied cleanly in upstream order. Original authors, author dates, co-author and sign-off trailers, and `-x` source references are retained. Upgrade notes: - #3533: old gVisor MEMORY snapshots, including goldens, no longer restore. Recreate them after upgrading. MicroVM MEMORY snapshots still resume with their old mounts until recreated. `/tmp` is now always tmpfs; ROOTFS snapshots no longer preserve its contents, and image-provided files there are hidden. MicroVM `/tmp` counts against actor memory and is capped at half the guest's memory. gVisor `/dev/shm` is now a 64 MiB tmpfs. Mount a `durableDir` at either path when persistence or more space is needed. `/run` now comes from the image rootfs. - #3447: remove `--actor-jwt-jwks-file` from custom credential-exchange sidecar configs. Set `--actor-jwt-issuer-ca-file` only when the issuer uses a private CA other than the service DNS CA. - #3450: do not reuse a deleted atespace name. See the updated atespace name-reuse guidance. Includes #3505, which overlaps the open backport in #3547. GKE provisioning and teardown now live in [substrate-gke](https://github.com/ai-on-gke/substrate-gke) rather than this repository. <details> <summary>Included PRs, in cherry-pick order</summary> 1. #3500: demos/{sandbox,jupyter,multi-template}: fix tutorial prerequisites, walkthroughs, and counter volume 2. #3498: demos/counter: inline gVisor walkthrough and fix setup commands 3. #3511: e2e tests: Extend the existing tests to cover tag actor. 4. #2775: Generate API reference documentation and publish it on Substrate website 5. #3119: Document how people, pods and CI jobs should authenticate to ate-api 6. #3505: tools: remove setup-gcp and hack/teardown.sh 7. #3147: e2e: resume fidelity after SandboxConfig version edits 8. #3370: ate-setup: reconcile ate-api-server ConfigMaps and roll out on config changes 9. #1607: hack: reject breaking proto changes across each proto package 10. #3415: docs: update and add security diagrams 11. #3485: Resuming a microVM actor on the same node no longer reads its rootfs upper back from disk 12. #3447: Verify actor JWTs in the credential exchange through OIDC discovery 13. #3533: ocispec: mount tmpfs at /dev/shm, and /tmp on both runtimes 14. #3450: docs: Document that atespace names must not be reused 15. #3410: Document using more than one egress credential provider 16. #3486: atelet: register the device plugin on a new socket each time 17. #3553: ate-setup: wait for the demo namespace in delete demo 18. #3560: Fix multiple issues in claude-code-multiplex demo 19. #3517: docs: remove inaccurate early-stage architecture documentation </details> Validation: every intermediate tree matches its upstream source commit, all 19 authorship records and original attribution trailers are preserved, and `git diff --check` passes. The original 18 backport commits are unchanged. AI use: AI-assisted cherry-picking, attribution checks, and review. - [ ] Tests pass - [x] Docs updated --------- Signed-off-by: Mofi Rahman <[email protected]> Signed-off-by: Eitan Yarmush <[email protected]> Signed-off-by: Nayana Bidari <[email protected]> Signed-off-by: Julian Gutierrez Oschmann <[email protected]> Signed-off-by: Max Thompson <[email protected]> Signed-off-by: Steven Shriver <[email protected]> Signed-off-by: Grant McCloskey <[email protected]> Signed-off-by: Shrutiya <[email protected]> Signed-off-by: Haiyan Meng <[email protected]> Signed-off-by: Greg Castle <[email protected]> Signed-off-by: Benjamin Elder <[email protected]> Signed-off-by: Anish Ramasekar <[email protected]> Signed-off-by: Shruti Nair <[email protected]> Signed-off-by: Haven Xia <[email protected]> Co-authored-by: Mofi Rahman <[email protected]> Co-authored-by: nybidari <[email protected]> Co-authored-by: Julian Gutierrez Oschmann <[email protected]> Co-authored-by: Max Thompson <[email protected]> Co-authored-by: Grant McCloskey <[email protected]> Co-authored-by: Steven Shriver <[email protected]> Co-authored-by: shrutiyam-glitch <[email protected]> Co-authored-by: haiyanmeng <[email protected]> Co-authored-by: Greg Castle <[email protected]> Co-authored-by: Benjamin Elder <[email protected]> Co-authored-by: Anish Ramasekar <[email protected]> Co-authored-by: Shruti Nair <[email protected]> Co-authored-by: Haven Xia <[email protected]> Co-authored-by: Adam Wathieu <[email protected]>
1 of 2 tasks
Dmitry Berkovich (dberkov)
pushed a commit
that referenced
this pull request
Nov 3, 2026
Concurrency tests in #3255 showed that a request authorized against a deleted atespace can apply to a new atespace with the same name. A previous owner can regain `owner` on it or delete it. We decided not to fix this in code. Atespace names must not be reused, and nothing enforces it. This documents the limitation in the authorization guide and qualifies the claim that a recreated atespace starts with no policy. I used an AI assistant to analyze the issue and draft the doc text, and reviewed the result. --------- Signed-off-by: Shruti Nair <[email protected]> (cherry picked from commit 9d16b69) Signed-off-by: Eitan Yarmush <[email protected]>
1 of 2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Concurrency tests in #3255 showed that a request authorized against a deleted
atespace can apply to a new atespace with the same name. A previous owner can
regain
owneron it or delete it.We decided not to fix this in code. Atespace names must not be reused, and
nothing enforces it. This documents the limitation in the authorization guide
and qualifies the claim that a recreated atespace starts with no policy.
I used an AI assistant to analyze the issue and draft the doc text, and
reviewed the result.