Reconcile fork features with PostgreSQL-only upstream

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Author: EItanya

charts/substrate-crds/templates/ate.dev_actortemplates.yaml

@@ -185,6 +185,40 @@ spec:
                       required:
                       - httpGet
                       type: object
+                    resources:
+                      description: |-
+                        Resources are the compute limits for this container, enforced inside the
+                        actor's sandbox. Only cpu and memory are supported, and only on micro-VM
+                        actors: gVisor applies cgroup limits at the sandbox level, so a
+                        per-container cgroup there is created but stays empty.
+                      properties:
+                        limits:
+                          additionalProperties:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                            x-kubernetes-int-or-string: true
+                          description: |-
+                            Limits is the maximum amount of compute resources allowed. Only cpu and
+                            memory are supported, and each must be greater than zero.
+
+                            A cpu limit below 10m is raised to 10m: the kernel rejects a CFS quota
+                            under 1ms, and the quota is expressed against a 100ms period.
+                          maxProperties: 2
+                          type: object
+                      type: object
+                      x-kubernetes-validations:
+                      - message: only cpu and memory limits are supported
+                        rule: '!has(self.limits) || self.limits.all(k, k == ''cpu''
+                          || k == ''memory'')'
+                      - message: memory limit must be greater than zero
+                        rule: '!has(self.limits) || !(''memory'' in self.limits) ||
+                          quantity(string(self.limits[''memory''])).isGreaterThan(quantity(''0''))'
+                      - message: cpu limit must be greater than zero
+                        rule: '!has(self.limits) || !(''cpu'' in self.limits) || quantity(string(self.limits[''cpu''])).isGreaterThan(quantity(''0''))'
+                      - message: cpu limit must be less than 1000 cores
+                        rule: '!has(self.limits) || !(''cpu'' in self.limits) || quantity(string(self.limits[''cpu''])).isLessThan(quantity(''1k''))'
                     securityContext:
                       description: |-
                         securityContext holds security settings for this container. Unset leaves
@@ -497,9 +531,9 @@ spec:
                             DataSources is the list of data sources to place within the SystemInfo
                             volume.
 
-                            At most one actorMetadata entry may appear; this is what keeps file
-                            paths unique across the whole volume (uniqueness within the entry is
-                            enforced on its items).
+                            At most one actorMetadata entry may appear, and file paths must be
+                            unique across all entries (uniqueness within actorMetadata is enforced
+                            on its items).
                           items:
                             description: |-
                               SystemInfoDataSource is a container allowing you to pick a particular
@@ -534,17 +568,18 @@ spec:
                                         path:
                                           description: |-
                                             Relative path from the root of the SystemInfo volume at which the
-                                            field's value is written. Must be a clean relative Unix path: must not
-                                            start or end with '/', and contain no ':', '..', '.', '//', or control
-                                            characters.
+                                            field's value is written. Must be a clean relative Unix path: it must
+                                            not start or end with '/' and must not contain ':', '//', '.' or '..'
+                                            segments, or control characters.
                                           maxLength: 255
                                           minLength: 1
                                           type: string
                                           x-kubernetes-validations:
                                           - message: 'path must be a clean relative
-                                              Unix path: must not start or end with
-                                              ''/'', and contain no '':'', ''..'',
-                                              ''.'', ''//'', or control characters'
+                                              Unix path: it must not start or end
+                                              with ''/'' and must not contain '':'',
+                                              ''//'', ''.'' or ''..'' segments, or
+                                              control characters'
                                             rule: '!self.startsWith(''/'') && !self.endsWith(''/'')
                                               && !self.contains(''//'') && !self.contains('':'')
                                               && !self.matches(''[\x00-\x1f\x7f]'')
@@ -567,18 +602,76 @@ spec:
                                 required:
                                 - items
                                 type: object
+                              trustBundle:
+                                description: |-
+                                  TrustBundleDataSource is a SystemInfo volume data source that projects the
+                                  trust anchors of a named trust bundle to a single PEM file — inspired by
+                                  the Kubernetes clusterTrustBundle projected volume source, but
+                                  source-neutral: the name selects a bundle substrate knows how to fetch,
+                                  and where it is fetched from is a substrate deployment concern, not part
+                                  of this API (atelet enforces the supported set and resolves the backend).
+
+                                  Supported names are allowlisted in atelet. Initially the only supported
+                                  bundle is "egress-mitm.ate.dev" (the egress gateway CA bundle), resolved
+                                  from the Kubernetes ClusterTrustBundle (certificates.k8s.io/v1beta1) that
+                                  atecontroller derives from the egress-mitm-ca-pool; a configurable backend
+                                  registry may widen this later.
+
+                                  The bundle is resolved and sanitized on the node when the actor starts:
+                                  atelet reads the backing object through a cluster-wide watch and keeps
+                                  only CERTIFICATE PEM blocks, deduplicated and deliberately shuffled (order
+                                  carries no meaning); the actor itself never talks to any bundle backend.
+                                  Starting the actor fails if the named bundle is not on the allowlist, its
+                                  backend is unavailable in this deployment, or the resolved bundle is
+                                  missing, empty, or unparseable.
+                                properties:
+                                  name:
+                                    description: |-
+                                      Name of the trust bundle to project. Must be a bundle name supported
+                                      by this deployment (currently only "egress-mitm.ate.dev").
+                                    maxLength: 253
+                                    minLength: 1
+                                    type: string
+                                  path:
+                                    description: |-
+                                      Relative path from the root of the SystemInfo volume at which the PEM
+                                      bundle is written. Must be a clean relative Unix path: it must not
+                                      start or end with '/' and must not contain ':', '//', '.' or '..'
+                                      segments, or control characters.
+                                    maxLength: 255
+                                    minLength: 1
+                                    type: string
+                                    x-kubernetes-validations:
+                                    - message: 'path must be a clean relative Unix
+                                        path: it must not start or end with ''/''
+                                        and must not contain '':'', ''//'', ''.''
+                                        or ''..'' segments, or control characters'
+                                      rule: '!self.startsWith(''/'') && !self.endsWith(''/'')
+                                        && !self.contains(''//'') && !self.contains('':'')
+                                        && !self.matches(''[\x00-\x1f\x7f]'') && !self.matches(''(^|/)[.][.]?(/|$)'')'
+                                required:
+                                - name
+                                - path
+                                type: object
                             type: object
                             x-kubernetes-validations:
-                            - message: exactly one of the fields in [actorMetadata]
-                                must be set
-                              rule: '[has(self.actorMetadata)].filter(x,x==true).size()
+                            - message: exactly one of the fields in [actorMetadata
+                                trustBundle] must be set
+                              rule: '[has(self.actorMetadata),has(self.trustBundle)].filter(x,x==true).size()
                                 == 1'
-                          maxItems: 32
+                          maxItems: 8
                           type: array
                           x-kubernetes-validations:
                           - message: dataSources must contain at most one actorMetadata
                               entry
                             rule: self.filter(x, has(x.actorMetadata)).size() <= 1
+                          - message: dataSources must not contain duplicate paths
+                            rule: self.all(x, !has(x.trustBundle) || self.exists_one(y,
+                              has(y.trustBundle) && y.trustBundle.path == x.trustBundle.path))
+                          - message: dataSources must not contain duplicate paths
+                            rule: '!self.exists(x, has(x.trustBundle) && self.exists(y,
+                              has(y.actorMetadata) && y.actorMetadata.items.exists(i,
+                              i.path == x.trustBundle.path)))'
                       type: object
                   required:
                   - name
@@ -675,6 +768,10 @@ spec:
               rule: '!has(self.containers) || self.containers.all(c, !has(c.volumeMounts)
                 || c.volumeMounts.all(vm, has(self.volumes) && self.volumes.exists(v,
                 v.name == vm.name)))'
+            - message: container resources are only supported when sandboxClass is
+                'microvm'
+              rule: '!has(self.containers) || !self.containers.exists(c, has(c.resources))
+                || (has(self.sandboxClass) && self.sandboxClass == ''microvm'')'
           status:
             description: status is the observed state of ActorTemplate
             properties:

charts/substrate-crds/templates/ate.dev_csidriverconfigs.yaml

@@ -81,6 +81,26 @@ spec:
                   on the worker nodes. If empty, ATE defaults to unix:///var/lib/kubelet/plugins/[DriverName]/csi.sock.
                 pattern: ^unix://.+$
                 type: string
+              tls:
+                description: TLS configures TLS/mTLS for the connection to the ControllerEndpoint.
+                properties:
+                  enabled:
+                    description: Enabled controls whether TLS is used.
+                    type: boolean
+                  serverName:
+                    description: ServerName override for TLS verification.
+                    type: string
+                  usePodIdentity:
+                    description: UsePodIdentity indicates whether to reuse Substrate's
+                      Pod Identity (SPIFFE) certificates.
+                    type: boolean
+                required:
+                - enabled
+                type: object
+                x-kubernetes-validations:
+                - message: tls.usePodIdentity must be true when tls.enabled is true;
+                    manual certificates are not yet supported
+                  rule: '!self.enabled || (has(self.usePodIdentity) && self.usePodIdentity)'
             required:
             - controllerEndpoint
             - driverName

charts/substrate/templates/ate-api-server-envvars.yaml

@@ -20,5 +20,4 @@ metadata:
   name: {{ .Values.ateApiServerEnvVarsConfigMap }}
   namespace: {{ .Release.Namespace }}
 data:
-  ATE_API_STORE_BACKEND: "postgres"
   ATE_API_POSTGRES_CONNECTION_STRING: {{ .Values.postgres.connectionString | default (printf "postgresql://postgres@%s.%s.svc:5432/atepg?sslmode=verify-full&sslrootcert=/run/servicedns.podcert.ate.dev/trust-bundle.pem&sslcert=/run/podidentity.podcert.ate.dev/credential-bundle.pem&sslkey=/run/podidentity.podcert.ate.dev/credential-bundle.pem" (include "substrate.fullname" (list "postgres" .)) .Release.Namespace) | quote }}

charts/substrate/templates/ate-api-server.yaml

@@ -84,7 +84,6 @@ spec:
         - "--grpc-listen-addr=0.0.0.0:443"
         - "--grpc-server-cred-bundle=/run/servicedns.podcert.ate.dev/credential-bundle.pem"
         - "--authentication-config=/etc/ateapi/authentication/authentication.yaml"
-        - "--store-backend=@env"
         - "--postgres-connection-string=@env"
         - "--actor-id-jwt-pool=/run/actor-id-jwt-pool/pool.json"
         - "--actor-id-ca-pool=/run/actor-id-ca-pool/pool.json"

charts/substrate/templates/atelet.yaml

@@ -32,6 +32,12 @@ rules:
 - apiGroups: ["ate.dev"]
   resources: ["csidriverconfigs"]
   verbs: ["get", "watch", "list"]
+# ClusterTrustBundles referenced by SystemInfo trustBundle data sources are
+# resolved on the node: atelet reads them through an informer and projects
+# the sanitized PEM into actors (see cmd/atelet/trustbundle.go).
+- apiGroups: ["certificates.k8s.io"]
+  resources: ["clustertrustbundles"]
+  verbs: ["get", "watch", "list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

charts/substrate/templates/atenet-egress.yaml

@@ -132,7 +132,7 @@ spec:
         - --ateapi-client-cert=/run/podidentity.podcert.ate.dev/credential-bundle.pem
         - --actor-identity-ca-file=/run/actor-id-ca-certs/ca.crt
         - --otlp-collector-address=
-        - --envoy-admin-address=127.0.0.1:15000
+        - --envoy-admin-address=localhost:15000
         - --atenet-router=agentgateway
         env:
         - name: POD_NAME
@@ -205,6 +205,7 @@ metadata:
   namespace: {{ .Release.Namespace }}
 spec:
   type: ClusterIP
+  ipFamilyPolicy: PreferDualStack
   selector:
     app: atenet-egress
   ports:

charts/substrate/templates/atenet-router.yaml

@@ -316,6 +316,7 @@ metadata:
   namespace: {{ .Release.Namespace }}
 spec:
   type: ClusterIP
+  ipFamilyPolicy: PreferDualStack
   selector:
     app: atenet-router
   ports: