Repository navigation
Fix Substrate egress after the ateom/actor identity split - #3677
Merged
Merged
Conversation
Signed-off-by: Eitan Yarmush <[email protected]>
Contributor
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
The identity and authorization changes warrant final human review.
Review effort: Lite
Findings: None
What changed in this PR
Updates Substrate egress authorization for the ateom/actor identity split.
Changes:
- Parses actor identity from SPIFFE URI SANs.
- Validates actors via
GetActorand uses their UID for logging. - Sends translated actor SPIFFE IDs to credential providers.
- Updates integration tests.
| File | Description |
|---|---|
crates/agentgateway/tests/tests/substrate.rs |
Updates egress and credential-provider coverage. |
crates/agentgateway/src/proxy/gateway.rs |
Adjusts optional actor UID logging. |
crates/agentgateway/src/http/substrate/egress.rs |
Updates credential-provider identity handling. |
crates/agentgateway/src/http/substrate/egress_actor_resolution.rs |
Parses and validates new certificate identities. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
howardjohn
approved these changes
Sep 26, 2026
1 of 2 tasks
dims
pushed a commit
to dims/substrate
that referenced
this pull request
Sep 26, 2026
…rate#1923) Update the router and egress image to `cr.agentgateway.dev/agentgateway:v0.0.0-alpha.9e78d1da` from [this nightly](https://github.com/agentgateway/agentgateway/actions/runs/36271360584), pinned to its multi-architecture digest. This includes [agentgateway/agentgateway#3677](agentgateway/agentgateway#3677), which reads the `ateom-for-actor` SPIFFE URI from the certificate and sends the actor SPIFFE identity to credential providers. The currently pinned image still expects the removed `ActorIdentity` extension, so it rejects egress after the ateom/actor identity split. Validation: all five agentgateway Kustomize overlays render with the expected registry and digest. Fetching the tag and digest from `cr.agentgateway.dev` returns the same image index as GHCR. Before the registry-only change, `hack/verify-all.sh` and [upstream PR CI](https://github.com/agent-substrate/substrate/actions/runs/36275291752) passed, including both E2E dataplanes and the race tests. CI for the registry change is pending. Local `make verify` is blocked by `TestCAPoolCache_HitAndFileChange`: it rewrites identical bytes and expects the file timestamp to advance, which is not reliable on this machine's temporary filesystem. The first run also hit a temporary-directory cleanup failure in `TestSandboxAssetPrewarmDownloads`; that test passed on retry. Both tests are unchanged from upstream. - [ ] Tests pass (waiting for CI on the registry change; previous revision passed) - [x] Appropriate changes to documentation are included in the PR (none needed) --------- Signed-off-by: Eitan Yarmush <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Substrate's ateom/actor identity split in agent-substrate/substrate#1809 removed the certificate extension that agentgateway used to authorize egress. It also changed the actor SPIFFE URI expected by credential providers, so both CONNECT authorization and credential injection broke.
This PR reads the single
spiffe://substrate-actor.local/ateom-for-actor/<atespace>/<actor>URI from the authenticated certificate and keeps theGetActorcheck that the actor exists and is running. The UID now comes fromGetActorfor logging. Credential providers receivespiffe://substrate-actor.local/actor/<atespace>/<actor>.AI assistance: Codex prepared the implementation, tests, code comments, and this draft description.