Point an actor's TLS client at the MITM trust bundle by default

[haiyanmeng]

Currently, if MITM is enabled on a Substrate cluster, the users need to point the actor's TLS client at the MITM trust bundle by setting relative environment variables for every container in an ActorTemplate, see https://github.com/agent-substrate/substrate/blob/main/docs/egress-trust-bundle.md#point-the-runtime-at-it. This is tedious.

Should we by default inject a list of common environment variables into every container if MITM is enabled and offer users a way to opt-out this default behavior?

Note: currently, the users need to mount the MITM trust bundle manually. Max Thompson (@thompsonmax) is working on auto-inject the egress trust volume into every actor.

Max Thompson (@thompsonmax) Taahir Ahmed (@ahmedtd) Eitan Yarmush (@EItanya) Bowei Du (@bowei)

[EItanya]

Keith Mattix II (@keithmattix) and John Howard (@howardjohn) as well for context.

I 100% agree that we should try and make this simpler. Part of the issue is that it can be language/framework specific so we need to decide what level of abstraction is responsible for this.

[howardjohn]

+1, there is prior art here in other projects of the (very long list) of env vars that various things read from

[haiyanmeng]

John Howard (@howardjohn) , Eitan Yarmush (@EItanya) , any opinions on whether we should offer users a way to opt-out this default behavior? If yes, how should we support this? Maybe a knob in the EgressPolicy?

[bowei]

I think this will be an actor property vs egress policy -- it's similar to the envvar decl in PodSpec vs a policy applied to the workload.