Skip to content

fix(substrate): pin the line's egress-while-resuming build and run the WorkerPool on the pinned worker image - #147

Merged
teemow merged 2 commits into
mainfrom
fix/substrate-egress-boot
Sep 10, 2026
Merged

teemow merged 2 commits into
mainfrom
fix/substrate-egress-boot

Conversation

@teemow

@teemow teemow commented Sep 10, 2026

Copy link
Copy Markdown
Member

Problem

agentlab skills-test (#137, #145) was red: a Go ADK AgentTemplate with a git skill never got its golden snapshot because Substrate denied the actor's egress before readyz. The Substrate line now carries the fix (giantswarm/substrate#4, dev build 0.0.27-dev.giantswarm.2026-09-10.22-37-39.h1817627: the worker arms an actor's tunneled egress before its first container starts; atenet admits a RESUMING actor; both hops log a refusal).

The fix lives in the worker image (ateom-gvisor), and the WorkerPool the dev channel's kagent creates named the meta chart's default worker image — a Substrate other than the one the lab installs, so bumping substrateVersion alone would have left the workers on the old runtime.

Change

  • substrateVersion → 0.0.27-dev.giantswarm.2026-09-10.22-37-39.h1817627.
  • The lab's meta chart values name kagent.substrateWorkerPool.workerImage from the same pin (ateomGVisorImage), dev channel only — the released chart has no WorkerPool and its schema no such key (TestKagentWorkerImageFollowsSubstratePin). Control plane and workers are one Substrate; a bump of the pin rolls the pool on the next agentlab platform.
  • Docs: the dev-channel step, and the skills proof's outcome — the three gates on a booting actor's egress, which the line fixes, which remains (the egress dataplane's own RUNNING check, agentgateway's), and the run that passed.

Verification (isolated lab agentlab-dev2, dev channel poc/kagent-main)

  • agentlab platform with this binary: ate-system rolled to …h1817627, WorkerPool kagent-default spec.workerImage and all four workers on ateom-gvisor:…h1817627.
  • skills-test on the chart's egress dataplane (agentgateway:c0f5597c7cb8): red at the third gate, with the new evidence (atunnel failed to open egress tunnel … 403 Forbidden: actor is not running in the worker's log; ate-api logs the dataplane's GetActor) — the first two gates are open.
  • skills-test with upstream agentgateway v1.5.0 swapped into atenet-egress (no RUNNING check): PASS on both halves — Ready after 20s, the turn answered Skills: agent-self-awareness … klaus-gateway, nothing left behind. agents-test green under the same dataplane.
  • platform-test and agents-test after restoring the chart's dataplane: see the CI/comment below.

…e WorkerPool on the pinned worker image

Substrate 0.0.27-dev.giantswarm.2026-09-10.22-37-39.h1817627 (giantswarm/substrate#4): the worker
arms an actor's tunneled egress before its first container starts and atenet admits a RESUMING
actor, so a Go ADK AgentTemplate with a git skill can fetch it during the golden boot.

The worker image is where that change lives, and the WorkerPool the dev channel's kagent creates
named the meta chart's default — a Substrate other than the one the lab installs. The lab's meta
chart values now name `kagent.substrateWorkerPool.workerImage` from the same pin (dev channel
only; the released chart has no WorkerPool), so control plane and workers are one Substrate and a
bump of the pin rolls the pool on the next `agentlab platform`.

docs: the dev channel step and the skills proof's outcome — the three gates on a booting actor's
egress, which the line fixes, which remains in the egress dataplane, and the run that passed.
@teemow
teemow merged commit e813b83 into main Sep 10, 2026
5 checks passed
@teemow
teemow deleted the fix/substrate-egress-boot branch September 10, 2026 23:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant