feat(helm): configure the router request parking budget

charts/substrate/README.md

@@ -60,6 +60,7 @@ See `values.yaml` for the full set; the important keys:
 | `postgres.schema` | `substrate` | Store the Substrate tables in this PostgreSQL schema |
 | `postgres.clientCertificates.enabled` | `false` | Project separate owner and runtime login certificates into the API server |
 | `<component>.resources` | see `values.yaml` | Requests and limits for each container, e.g. `ateApi.resources` and `atenetRouter.agentgateway.resources` |
+| `atenetRouter.requestParking.budget` | `5s` | Maximum wait for a suspended actor to become routable, e.g. `30s` for slower cold starts |
 | `rustfs.enabled` | `true` | Deploy an in-cluster S3-compatible RustFS bucket for snapshots |
 | `ateApi.snapshotLocation` | `""` | Cluster-wide snapshot URI; defaults to `gs://<rustfs.bucket>/` with bundled RustFS |
 | `atelet.storageBackend` | `s3` | Default snapshot backend, wired to RustFS when `rustfs.enabled=true` |

charts/substrate/templates/atenet-router.yaml

@@ -109,6 +109,8 @@ data:
             body: Invalid ate-target-actor header
         substrateIngress:
           host: {{ include "substrate.fullname" (list "api" .) }}.{{ .Release.Namespace }}.svc:443
+          requestParking:
+            budget: {{ .Values.atenetRouter.requestParking.budget | quote }}
           # AgentGateway only uses atunnel's CONNECT listener.
           connectTargetPort: 8443
           policies:

charts/substrate/tests/control_plane_test.yaml

@@ -374,3 +374,23 @@ tests:
   - matchRegex:
       path: data["config.yaml"]
       pattern: 'source.spiffeId in \["spiffe://cluster.local/ns/client/sa/router-client"\]'
+- it: keeps the router request parking budget at five seconds by default
+  template: atenet-router.yaml
+  documentSelector:
+    path: kind
+    value: ConfigMap
+  asserts:
+  - matchRegex:
+      path: data["config.yaml"]
+      pattern: 'requestParking:\n\s+budget: "5s"'
+- it: configures the router request parking budget
+  template: atenet-router.yaml
+  set:
+    atenetRouter.requestParking.budget: 30s
+  documentSelector:
+    path: kind
+    value: ConfigMap
+  asserts:
+  - matchRegex:
+      path: data["config.yaml"]
+      pattern: 'requestParking:\n\s+budget: "30s"'

charts/substrate/values.yaml

@@ -143,6 +143,9 @@ ateController:
       memory: 512Mi
 
 atenetRouter:
+  requestParking:
+    # Maximum time to wait for a suspended actor to become routable.
+    budget: 5s
   # mTLS client identities allowed to reach actors. Empty denies all ingress.
   ingressAllowedSPIFFEIDs: []
   agentgateway: