ateapi: auto-inject the egress trust volume into every actor

.github/workflows/pr-workflow.yaml

@@ -120,14 +120,24 @@ jobs:
         E2E_SANDBOX_CLASS: microvm
       run: hack/run-e2e-kind.sh -v -args --no-color
     - name: Deploy MITM egress (sdsmint)
-      # Swap the passthrough egress gateway for the sdsmint variant, which
-      # mints per-SNI leaves from the egress-mitm-ca-pool (created here if
-      # missing). --deploy-atenet redeploys only the atenet components (the
-      # rest of the control plane is unchanged), keeping this step cheap.
-      # Cluster-wide, so it must come AFTER the standard lanes: once egress
-      # TLS is intercepted, their passthrough assumptions
-      # (TestActorEgressHTTPS's end-to-end TLS with the origin) no longer hold.
-      run: hack/install-ate-kind.sh --deploy-atenet --experimental-use-sdsmint
+      # Swap the passthrough egress gateway for the sdsmint variant (minting
+      # per-SNI leaves from the egress-mitm-ca-pool, created here if missing)
+      # and redeploy ate-api-server with --inject-egress-trust-bundle. The
+      # system deploy rather than --deploy-ate-apiserver: only it renders
+      # through the kind overlay that points ate-api-server at rustfs.
+      # Cluster-wide, so it must come AFTER the standard lanes: intercepted
+      # egress breaks their passthrough assumptions, and every actor started
+      # from here on needs the bundle.
+      run: hack/install-ate-kind.sh --deploy-ate-system --experimental-use-sdsmint
+    - name: Recreate counter demos under injection
+      # The pre-flip counter goldens no longer match the injected spec, and
+      # gVisor refuses mismatched restores (see docs/api-guide.md). The deploy
+      # keeps an existing template, so tear both demos down first. Demo-only
+      # steps on purpose: redeploying the control plane here would drop the
+      # sdsmint switch and the flag with it.
+      run: |
+        hack/install-ate-kind.sh --delete-demo-counter --delete-demo-counter-microvm
+        hack/install-ate-kind.sh --deploy-demo-counter --deploy-demo-counter-microvm
     - name: Run E2E tests (egress MITM trust)
       # The consumption half of the trust-bundle chain: an actor does TLS with
       # the MITM gateway's minted leaf using ONLY the projected bundle, plus a

.gitignore

@@ -1,5 +1,6 @@
 # Binaries
 /ateapi
+/probe
 /substratectl
 /kubectl-ate
 /atelet

cmd/ateapi/internal/controlapi/egresstrust.go

@@ -0,0 +1,112 @@
+//  Copyright 2026 Google LLC
+//
+//  Licensed under the Apache License, Version 2.0 (the "License");
+//  you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+//  Unless required by applicable law or agreed to in writing, software
+//  distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//  See the License for the specific language governing permissions and
+//  limitations under the License.
+
+package controlapi
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"strings"
+
+	"github.com/agent-substrate/substrate/internal/proto/ateletpb"
+	"github.com/agent-substrate/substrate/pkg/proto/ateapipb"
+)
+
+// The auto-injected egress trust volume: under --inject-egress-trust-bundle
+// every actor trusts the egress gateway's MITM CA with nothing declared in
+// its template.
+const (
+	// The '.' makes template collisions impossible: template volume names
+	// must be DNS labels, and ate.dev names belong to the platform.
+	egressTrustVolumeName = "trust.ate.dev"
+
+	// Must stay on atelet's allowlist (cmd/atelet/trustbundle.go), which
+	// resolves it at every Run/Restore and fails actor start without it.
+	egressTrustBundleName = "egress-mitm.ate.dev"
+
+	egressTrustMountPath  = "/run/substrate/certs"
+	egressTrustBundleFile = "egress-mitm.ate.dev.pem"
+)
+
+// injectEgressTrustVolume mounts the egress trust volume into every container
+// except those that own the path (ownsEgressTrustPath); if all opt out, no
+// volume is injected, so the actor is not gated on a bundle nothing reads.
+func injectEgressTrustVolume(ctx context.Context, actor *ateapipb.Actor, spec *ateletpb.WorkloadSpec) error {
+	for _, vol := range spec.GetVolumes() {
+		if vol.GetName() == egressTrustVolumeName {
+			return fmt.Errorf("volume name %q is reserved for the injected egress trust bundle", egressTrustVolumeName)
+		}
+	}
+	mounted := false
+	for _, ctr := range spec.GetContainers() {
+		if path, ok := ownsEgressTrustPath(spec, ctr); ok {
+			slog.InfoContext(ctx, "Not mounting the egress trust volume: the template owns the path",
+				slog.String("atespace", actor.GetMetadata().GetAtespace()),
+				slog.String("actor", actor.GetMetadata().GetName()),
+				slog.String("container", ctr.GetName()),
+				slog.String("mountPath", path))
+			continue
+		}
+		ctr.VolumeMounts = append(ctr.VolumeMounts, &ateletpb.VolumeMount{
+			Name:      egressTrustVolumeName,
+			MountPath: egressTrustMountPath,
+		})
+		mounted = true
+	}
+	if !mounted {
+		return nil
+	}
+	spec.Volumes = append(spec.Volumes, &ateletpb.Volume{
+		Name: egressTrustVolumeName,
+		Source: &ateletpb.Volume_SystemInfo{
+			SystemInfo: &ateletpb.SystemInfoVolume{
+				DataSources: []*ateletpb.SystemInfoDataSource{{
+					DataSource: &ateletpb.SystemInfoDataSource_TrustBundle{
+						TrustBundle: &ateletpb.TrustBundleDataSource{
+							Name: egressTrustBundleName,
+							Path: egressTrustBundleFile,
+						},
+					},
+				}},
+			},
+		},
+	})
+	return nil
+}
+
+// ownsEgressTrustPath returns the template mount that opts ctr out: at or
+// below the reserved path, or an image volume above it — micro-VM bind
+// ordering would shadow one mount with the other either way.
+func ownsEgressTrustPath(spec *ateletpb.WorkloadSpec, ctr *ateletpb.Container) (string, bool) {
+	for _, m := range ctr.GetVolumeMounts() {
+		mp := m.GetMountPath()
+		if mp == egressTrustMountPath || strings.HasPrefix(mp, egressTrustMountPath+"/") {
+			return mp, true
+		}
+		if strings.HasPrefix(egressTrustMountPath, mp+"/") && isImageVolume(spec, m.GetName()) {
+			return mp, true
+		}
+	}
+	return "", false
+}
+
+func isImageVolume(spec *ateletpb.WorkloadSpec, name string) bool {
+	for _, vol := range spec.GetVolumes() {
+		if vol.GetName() == name {
+			return vol.GetImage() != nil
+		}
+	}
+	return false
+}