Fix Helm authentication issuer detection

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Author: EItanya

.github/workflows/helm-e2e.yaml

@@ -31,6 +31,8 @@ jobs:
         go-version-file: go.mod
     - name: Setup Helm
       uses: azure/setup-helm@v4
+    - name: Verify authentication chart render
+      run: hack/verify-helm-authentication.sh
     - name: Cache micro-VM assets
       uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
@@ -74,13 +76,18 @@ jobs:
         hack/install-ate-kind.sh --create-jwt-authority-pool-secret
         hack/install-ate-kind.sh --create-actor-id-ca-pool-secret
         hack/install-ate-kind.sh --create-actor-id-ca-certs-secret
-        hack/install-ate-kind.sh --create-api-authentication-config
     - name: Wait for Helm install
       run: |
         helm upgrade substrate charts/substrate \
           --namespace ate-system \
           --reuse-values \
           --wait --timeout=10m
+    - name: Verify ServiceAccount bearer authentication
+      run: |
+        make build-atectl
+        export PATH="${PWD}/bin:${PATH}"
+        kubectl -n ate-system create token ate-client --audience=api.ate-system.svc \
+          | kubectl-ate --token-file - get actors -A
     - name: Deploy micro-VM counter demo
       run: hack/run-microvm-demo-kind.sh --skip-control-plane
     - name: Deploy gVisor counter demo

charts/substrate/README.md

@@ -15,6 +15,14 @@ helm upgrade --install substrate-crds ./charts/substrate-crds
 helm upgrade --install substrate ./charts/substrate
 ```
 
+The chart derives the ServiceAccount token issuer from ateapi's projected
+token. To override it explicitly:
+
+```bash
+helm upgrade --install substrate ./charts/substrate \
+  --set-string auth.jwt.issuer="$(kubectl get --raw /.well-known/openid-configuration | jq -r .issuer)"
+```
+
 By default, component images are pulled from `ghcr.io/kagent-dev/substrate`
 using the chart `appVersion` as the tag. Override `image.registry` and
 `image.tag` to install from a different image repository or tag.
@@ -35,6 +43,8 @@ See `values.yaml` for the full set; the important keys:
 
 | Key | Default | Notes |
 |-----|---------|-------|
+| `auth.jwt.issuer` | `""` (detected) | Explicit ServiceAccount token issuer override |
+| `auth.jwt.audience` | `api.ate-system.svc` | Expected ServiceAccount token audience |
 | `postgres.connectionString` | `""` (in-cluster) | Override to use external PostgreSQL |
 | `postgres.storageSize` | `1Gi` | In-cluster PostgreSQL PVC size |
 | `rustfs.enabled` | `true` | Deploy an in-cluster S3-compatible RustFS bucket for snapshots |

charts/substrate/templates/ate-api-authentication.yaml

@@ -0,0 +1,34 @@
+{{/*
+Copyright 2026 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ate-api-authentication
+  namespace: {{ .Release.Namespace }}
+data:
+  authentication.yaml: |
+    actorIdentityJWTProvider: kubernetes
+    jwtProviders:
+    - name: kubernetes
+{{- if .Values.auth.jwt.issuer }}
+      issuer: {{ .Values.auth.jwt.issuer | quote }}
+{{- end }}
+      audiences: [{{ .Values.auth.jwt.audience | quote }}]
+{{- if or (not .Values.auth.jwt.issuer) (has .Values.auth.jwt.issuer (list "https://kubernetes.default.svc" "https://kubernetes.default.svc.cluster.local")) }}
+      certificateAuthorityFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      discoveryTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+{{- end }}

charts/substrate/values.yaml

@@ -23,6 +23,12 @@
 # manifests/ate-install/ install path (kubectl apply).
 createNamespace: false
 
+auth:
+  jwt:
+    # ServiceAccount token issuer. Empty derives it from the projected token.
+    issuer: ""
+    audience: api.ate-system.svc
+
 postgres:
   storageSize: 1Gi
   connectionString: ""

docs/authentication.md

@@ -7,7 +7,6 @@ configured with the file passed to `--authentication-config`:
 actorIdentityJWTProvider: kubernetes
 jwtProviders:
 - name: kubernetes
-  issuer: https://kubernetes.default.svc.cluster.local
   audiences:
   - api.ate-system.svc
   certificateAuthorityFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
@@ -22,6 +21,8 @@ Provider names and issuers must be unique. `issuer` must be an HTTPS URL and
 `audiences` must be non-empty; a token is accepted when any configured audience
 matches. `certificateAuthorityFile` and `discoveryTokenFile` are optional and
 are needed for OIDC discovery against some private Kubernetes API servers.
+When `issuer` is omitted, ate-api derives it from the trusted JWT at
+`discoveryTokenFile`.
 
 `actorIdentityJWTProvider` identifies the provider allowed to call
 `ActorIdentity.MintJWT`. Other authenticated providers can call every RPC.

hack/verify-helm-authentication.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit -o nounset -o pipefail
+
+ROOT="$(git rev-parse --show-toplevel)"
+cd "${ROOT}"
+
+rendered="$(helm template substrate charts/substrate \
+  --namespace ate-system \
+  --show-only templates/ate-api-authentication.yaml \
+  --set-string auth.jwt.issuer=https://issuer.example)"
+
+rg -q '^      issuer: "https://issuer\.example"$' <<<"${rendered}"
+if rg -q 'certificateAuthorityFile|discoveryTokenFile' <<<"${rendered}"; then
+  echo "external issuers must not use in-cluster discovery credentials" >&2
+  exit 1
+fi
+
+rendered="$(helm template substrate charts/substrate \
+  --namespace ate-system \
+  --show-only templates/ate-api-authentication.yaml)"
+if rg -q '^      issuer:' <<<"${rendered}"; then
+  echo "default authentication config must omit the issuer" >&2
+  exit 1
+fi
+rg -q '^      discoveryTokenFile: /var/run/secrets/kubernetes\.io/serviceaccount/token$' <<<"${rendered}"

internal/ateapiauth/config.go

@@ -47,6 +47,21 @@ func LoadAuthenticationConfig(path string) (*AuthenticationConfig, error) {
 	if err := yaml.UnmarshalStrict(b, &cfg); err != nil {
 		return nil, fmt.Errorf("parse authentication config: %w", err)
 	}
+	for i := range cfg.JWTProviders {
+		provider := &cfg.JWTProviders[i]
+		if provider.Issuer == "" && provider.DiscoveryTokenFile != "" {
+			// discoveryTokenFile is trusted local configuration; client tokens are
+			// still verified against the issuer derived from it.
+			token, readErr := os.ReadFile(provider.DiscoveryTokenFile)
+			if readErr != nil {
+				return nil, fmt.Errorf("derive jwtProviders[%d].issuer: read discovery token file: %w", i, readErr)
+			}
+			provider.Issuer, err = unverifiedIssuer(string(token))
+			if err != nil {
+				return nil, fmt.Errorf("derive jwtProviders[%d].issuer: %w", i, err)
+			}
+		}
+	}
 	if err := ValidateAuthenticationConfig(&cfg); err != nil {
 		return nil, err
 	}

internal/ateapiauth/config_test.go

@@ -15,12 +15,57 @@
 package ateapiauth
 
 import (
+	"encoding/base64"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 
+func TestLoadAuthenticationConfigDerivesIssuer(t *testing.T) {
+	dir := t.TempDir()
+	tokenPath := filepath.Join(dir, "token")
+	payload := base64.RawURLEncoding.EncodeToString([]byte(`{"iss":"https://kubernetes.default.svc.cluster.local"}`))
+	if err := os.WriteFile(tokenPath, []byte("header."+payload+".signature"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	configPath := filepath.Join(dir, "authentication.yaml")
+	config := "actorIdentityJWTProvider: kubernetes\njwtProviders:\n- name: kubernetes\n  audiences: [api.ate-system.svc]\n  discoveryTokenFile: " + tokenPath + "\n"
+	if err := os.WriteFile(configPath, []byte(config), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg, err := LoadAuthenticationConfig(configPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := cfg.JWTProviders[0].Issuer, "https://kubernetes.default.svc.cluster.local"; got != want {
+		t.Fatalf("Issuer = %q, want %q", got, want)
+	}
+}
+
+func TestLoadAuthenticationConfigKeepsExplicitIssuer(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "authentication.yaml")
+	if err := os.WriteFile(path, []byte(`
+actorIdentityJWTProvider: explicit
+jwtProviders:
+- name: explicit
+  issuer: https://issuer.example
+  audiences: [audience]
+  certificateAuthorityFile: /does/not/exist
+  discoveryTokenFile: /does/not/exist
+`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	cfg, err := LoadAuthenticationConfig(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := cfg.JWTProviders[0].Issuer; got != "https://issuer.example" {
+		t.Fatalf("Issuer = %q, want explicit issuer", got)
+	}
+}
+
 func TestLoadAuthenticationConfig(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "authentication.yaml")
 	if err := os.WriteFile(path, []byte(`