helm: atelet mounts /var/lib/kubelet/plugins with HostToContainer propagation - #39

Resolve atelet discovery and identity from the pod namespace, centralize install defaults, and allow explicitly selected local clusters to run without Pod Certificates. Keep authenticated transport as the default.

Signed-off-by: Eitan Yarmush <[email protected]>

Add a configurable end-to-end workflow deadline and propagate it through lease acquisition. Apply released worker assignments to the cache immediately so subsequent scheduling sees the completed pause.

Signed-off-by: Eitan Yarmush <[email protected]>

Parse PKCS1 RSA and SEC1 EC keys alongside PKCS8 keys, including regression coverage for RSA bundles.

Signed-off-by: Eitan Yarmush <[email protected]>

Require the agentgateway E2E lane, reuse the installed control plane for microVM demos, wait for asset storage initialization, and accommodate runtime startup and counter persistence behavior in E2E checks.

Signed-off-by: Eitan Yarmush <[email protected]>

Package the control plane, workers, PostgreSQL, RustFS, and CRDs as Helm charts. Keep manifests and generated RBAC aligned, add Helm E2E checks, and include current scheduling, sandbox permissions, and agentgateway configuration.

Co-authored-by: Jet Chiang <[email protected]>
Co-authored-by: Keith Mattix II <[email protected]>
Signed-off-by: Jet Chiang <[email protected]>
Signed-off-by: Eitan Yarmush <[email protected]>

Allow an external PostgreSQL instance and a configurable schema, validate connection settings, and pass the schema to the API server.

Signed-off-by: Eitan Yarmush <[email protected]>

Wire the API server snapshot backend and S3 settings to the chart storage configuration.

Signed-off-by: Eitan Yarmush <[email protected]>

Configure trace, metric, and log endpoints independently, expose trace sampling, and route agentgateway access logs through the collector logs pipeline.

Signed-off-by: Eitan Yarmush <[email protected]>

Isolate sandbox asset download tests from pause image pulls, explicitly advance the CA file timestamp, and disable VCS stamping for license checks in temporary verification worktrees.

Signed-off-by: Eitan Yarmush <[email protected]>

Delete application containers before the pause container so their shared sandbox remains available throughout teardown. Cover the deletion order with a regression test.

Signed-off-by: Eitan Yarmush <[email protected]>

Rebuild the fork on upstream while preserving features, require agentgateway runtime validation, and use a guarded push. Delete task-owned clusters and disposable assets before finishing while preserving shared resources and recovery data.

Signed-off-by: Eitan Yarmush <[email protected]>

Select agentgateway expectations in the Helm test job, align the chart sandbox assets with the canonical manifest, and enable the CONNECT tunnel logging used by egress validation. This retains upstream gVisor checkpoint and restore fixes and closes configuration gaps between Helm and manifest installations.

Signed-off-by: Eitan Yarmush <[email protected]>

Expose ateApi.extraArgs so installations can configure API flags such as the template resync interval without editing the deployment template.

Signed-off-by: Eitan Yarmush <[email protected]>

A layer pull can share a singleflight call with retirement and return without unpacking the removed layer. Distinguish pull results from retirement results and retry after retirement completes. Cover the interleaving with a deterministic concurrency test.

Signed-off-by: Eitan Yarmush <[email protected]>

The egress ext_proc server listens on loopback. Probe the metrics readiness endpoint so Kubernetes can observe readiness through the pod IP, matching the upstream manifests.

Signed-off-by: Eitan Yarmush <[email protected]>

global.imageRegistry redirects every image at once for air-gapped
mirrors. Component images now resolve through the same
registry/repository split every kagent-family chart uses:
image.registry was one string carrying its path
(ghcr.io/kagent-dev/substrate) and is now the registry host only,
joined onto image.repository, so one global value (which overrides
image.registry) redirects the whole family. This is a breaking change
for values files that put a full prefix in image.registry: rendered
silently they would produce a doubled prefix failing only at pod start,
so the render fails instead, naming the split. A default render is
byte-identical to main.

Single-string images.* references (postgres, rustfs, aws-cli,
agentgateway) have their registry segment replaced by the containerd
rule (first path segment with a dot or colon), preserving repository
paths either way. global.imagePullSecrets merges (union) into every pod
spec, which previously had no pull-secret surface at all.
global.imagePullPolicy replaces the hardcoded IfNotPresent values as a
fallback, via substrate.imagePullPolicy.

Verified: a default render is byte-identical to main; the mirror knob
redirects all 9 images with paths preserved; the old-shape registry
fails loudly at template time; pull secrets land on all 9 pod specs;
the pullPolicy fallback fires.

Signed-off-by: Jonathan Jamroga <[email protected]>
Signed-off-by: Eitan Yarmush <[email protected]>

Retain upstream secret URI syntax and client CA rotation while adding Helm deployment, configurable injector identity, strict default-deny authorization, and credential injection coverage.

Signed-off-by: Eitan Yarmush <[email protected]>

Build the nested provider package with the release images and publish it under the kubernetes-secrets basename expected by the Helm chart.

Signed-off-by: Eitan Yarmush <[email protected]>

Pass the resolved atelet and router ServiceAccounts to the control plane, expose the controller pod namespace, and configure router Service discovery. Cover canonical and custom Helm releases in manifest tests.

Signed-off-by: Eitan Yarmush <[email protected]>