Update agentgateway implementation - #28
Open
keithmattix wants to merge 4 commits into
Open
Conversation
keithmattix
commented
Sep 1, 2026
keithmattix
force-pushed
the
wire-up-agw-e2es
branch
from
September 1, 2026 23:03
ea4c4c9 to
bf3fbff
Compare
keithmattix
commented
Sep 1, 2026
| // actor that really does speak gRPC. | ||
| func TestIngressProtocolDowngrade(t *testing.T) { | ||
| ctx := context.Background() | ||
| if e2e.RouterIsAgentgateway(ctx, t) { |
Collaborator
Author
There was a problem hiding this comment.
I think this only exists because Envoy isn't exclusively using CONNECT. We are so don't need to worry about the version negotiation; we skip the test because we don't implement it
keithmattix
changed the title
EItanya
force-pushed
the
main
branch
4 times, most recently
from
September 2, 2026 17:46
07b8a46 to
243ec3e
Compare
keithmattix
force-pushed
the
wire-up-agw-e2es
branch
2 times, most recently
from
September 3, 2026 12:58
1949b14 to
4d476b2
Compare
keithmattix
commented
Sep 3, 2026
| E2E_TEMPLATE_NAMESPACE: ate-demo-counter-microvm | ||
| E2E_TEMPLATE_NAME: counter-microvm | ||
| E2E_TEMPLATE_READY_TIMEOUT: 600s | ||
| E2E_SANDBOX_CLASS: microvm |
Collaborator
Author
There was a problem hiding this comment.
I think this was changed in a rebase; it should probably be changed back
Collaborator
Author
There was a problem hiding this comment.
Codex says this is needed to fix the helm e2e; @EItanya can you confirm?
Add e2e.RouterIsAgentgateway, detected from the atenet-router Deployment's containers, and gate the Envoy-only assertions on it: the h2-to-h1 downgrade contract is Envoy's protocol mirroring to atunnel, which agentgateway does not implement.
Bump agentgateway to a nightly that authorizes the actor identity before terminating any CONNECT tunnel and retries stale worker assignments on the CONNECT leg by evicting and re-resolving through ResumeActor. substrateEgress accordingly moves from a policy on the internal HTTP route to frontendPolicies in the egress ConfigMaps (manifests component, MITM overlay, and the Helm chart): the frontend check covers HTTP, TLS, and opaque TCP tunnels alike, where the old route policy silently exempted the TLS and TCP passthrough routes. This closes the hole where a certificate for an unknown actor could open a tunnel, and makes suspended actors resumable through the router again.
The e2e-test job's install step waits for each ate-system workload with the script's default 60s rollout timeout. That default assumes warm image caches; on a fresh CI runner every image (postgres, the agentgateway proxy for both router and egress, ...) is cold-pulled from public registries concurrently, and the first wait in line regularly exceeds 60s on pull latency alone. Give the install a 300s per-workload budget, matching the tolerance the helm-e2e workflow already has.
helm-e2e waited for condition=Ready on the counter-microvm ActorTemplate CRD after deploying the demo. The cutover to the substrate ActorTemplate proto removed the CRD golden flow and then the CRD itself, so the wait can never succeed. The demo deploy now creates the substrate template and waits for its golden snapshot internally, so drop the separate wait step and point the micro-VM test lane at the substrate fixtures with the E2E_SANDBOX_CLASS knob pr-workflow already uses.
keithmattix
force-pushed
the
wire-up-agw-e2es
branch
from
September 3, 2026 14:36
4167fa7 to
b06dc43
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update the substrate config with all of the agentgateway changes we've been making upstream