From 9a29b6f1cad8ceb5ec021e486285dabde0a026d9 Mon Sep 17 00:00:00 2001 From: QuentinBisson Date: Mon, 19 Oct 2026 12:50:11 +0200 Subject: [PATCH] docs(fork): ledger facts as of 2026-10-19 Signed-off-by: QuentinBisson --- FORK.md | 8 ++++---- fork/actor-containers-keep-rlimit-nofile-1024.md | 2 +- fork/actors-run-as-their-images-user-workdir.md | 2 +- fork/ate-idp-server-serves-actor-jwt-issuer.md | 2 +- ...t-daemonset-takes-nodeselector-tolerations-affinity.md | 2 +- fork/egress-gateway-mints-and-injects-actor-jwts.md | 2 +- fork/egress-gateway-takes-further-credential-providers.md | 2 +- fork/egress-gateway-tells-actor-why-credential-was.md | 2 +- fork/go-components-honor-otel-traces-exporter-none.md | 2 +- fork/let-actors-egress-through-while-resumes.md | 2 +- fork/read-ate-api-servers-postgresql-connection-string.md | 2 +- ...rkerpools-ateom-exports-nothing-when-ate-controller.md | 2 +- 12 files changed, 15 insertions(+), 15 deletions(-) diff --git a/FORK.md b/FORK.md index a5dcb22036..9b79b8e516 100644 --- a/FORK.md +++ b/FORK.md @@ -6,7 +6,7 @@ Agent Platform's kagent (API v2) runs every agent as a Substrate actor; this for Substrate is pinned, built, scanned and published. It answers one question from one place: **which Substrate are we running, and why does it differ from upstream?** -Tracking: both upstream repositories have issues disabled, so each carried patch is a ledger file in `fork/` that +Tracking: each carried patch is a ledger file in `fork/` that names its pull request here and its upstream pull request or issue; the line's own work is tracked in this repository's public issues. The kagent line is built the same way ([giantswarm/kagent-upstream](https://github.com/giantswarm/kagent-upstream)). Giant Swarm's internal planning stays out of this public file: where a row once cited an internal issue, it states the @@ -78,8 +78,8 @@ a workload that exits at start-up is re-booted forever and its cause never repor the egress MITM CA cannot be rotated without failing actor TLS, and the image-layer owners, without which an actor run as its image's `USER` cannot write what its image gave it, and the migration of the golden snapshot status a release before golden tags recorded, without which every template created on 1.0.x refuses its actors as not resumable after the upgrade, and the egress-policy contract check, without which a `kubectl-ate` of another line stores a policy with another meaning, and the template delete that takes the row first, without which a refused delete leaves a template whose golden is gone, and the fencing token on Pause, Suspend and Resume, without which a lease holder frozen past its lease pauses an actor its successor left running, and the lease-free durable-pause commit with the holder-naming lease, without which a client's pause or suspend right after a resume is Aborted by background work on a loaded database, and the denial's own gRPC code for a denied gRPC call, without which a gRPC caller of a held actor reads Unavailable and cannot tell it from an unavailable control plane, and the re-take of a golden written in an older snapshot layout, without which every new conversation on every agent fails after a release that changes the layout until the goldens are reset by hand; all twenty-four are written for upstream and leave at the first release that carries them. Two more are the line's own and stay: the read of a 1.8 actor's local-snapshot node and assigned node, without which a paused 1.8 actor cannot resume on v0.5.0-alpha2 and a running one crashes on its first pause, and the chart's own shape on the v0.5.0-alpha2 base, without which an upgrade loses the bundled database and the certificate controller. The image-identity patches are upstream's open -agent-substrate/substrate#1918 and #1906 with the merged #1910. The Postgres Secret patch is upstream's own pull -request, a draft since 2026-09-29. Everything else is what upstream has already merged; the `x/net` v0.61.0 requirement changes versions only and leaves when upstream requires it (see its row). Giant Swarm specific wiring +agent-substrate/substrate#1918 with the merged #1906 (2026-10-16) and #1910. The Postgres Secret patch is upstream's own pull +request, merged 2026-10-08 and in the v0.5.0-alpha2 pin, beside which the line keeps its own value key. Everything else is what upstream has already merged; the `x/net` v0.61.0 requirement changes versions only and leaves when upstream requires it (see its row). Giant Swarm specific wiring lives elsewhere: the CA/JWT pool bootstrap (`kubectl-ate admin make-ca-pool`/`make-jwt-pool` and the `ate-api-authentication` ConfigMap) is created by [agentlab](https://github.com/giantswarm/agentlab) and by meta chart 4.0; the `WorkerPool` the platform's Harnesses run on comes with the kagent chart @@ -155,7 +155,7 @@ The fork commits above are the replayed SHAs. ## Upstream items prepared without a carried patch Items the platform needs from Substrate whose fix is not yet written. The text below is the upstream-facing -proposal (upstream has issues disabled, so it becomes a kagent-dev/substrate pull request when the patch +proposal (it becomes an agent-substrate/substrate issue, a kagent-dev/substrate pull request when the patch exists, or a kagent-dev/kagent issue); a human decides whether and when it goes upstream. ### Place an actor's restore only on a worker whose CPU covers the snapshot's feature set diff --git a/fork/actor-containers-keep-rlimit-nofile-1024.md b/fork/actor-containers-keep-rlimit-nofile-1024.md index c82d24ef1f..c1615f2af1 100644 --- a/fork/actor-containers-keep-rlimit-nofile-1024.md +++ b/fork/actor-containers-keep-rlimit-nofile-1024.md @@ -1,7 +1,7 @@ # Actor containers keep RLIMIT_NOFILE at 1024 - **Status:** carried -- **Upstream:** [agent-substrate/substrate#2530](https://github.com/agent-substrate/substrate/issues/2530) (open): restore each checkpoint under its own limit; this commit is dropped once a release carries that +- **Upstream:** [agent-substrate/substrate#2530](https://github.com/agent-substrate/substrate/issues/2530) (closed 2026-10-13 by BenTheElder: "There's no compatibility guarantee right now … NOT supporting backwards compat right now"); upstream writes no restore under the checkpoint's own limit, so this commit stays on the line - **Our commit:** [#353](https://github.com/giantswarm/substrate/pull/353) (`fix(ocispec): keep RLIMIT_NOFILE at 1024 so earlier checkpoints restore`) ## Change diff --git a/fork/actors-run-as-their-images-user-workdir.md b/fork/actors-run-as-their-images-user-workdir.md index 3de44c1e39..f6c834f5c5 100644 --- a/fork/actors-run-as-their-images-user-workdir.md +++ b/fork/actors-run-as-their-images-user-workdir.md @@ -1,7 +1,7 @@ # Actors run as their image's `USER` in its `WORKDIR` - **Status:** carried -- **Upstream:** not ours: [agent-substrate/substrate#1918](https://github.com/agent-substrate/substrate/pull/1918) (author dims, open, five commits, rebased on 2026-10-01) and [#1906](https://github.com/agent-substrate/substrate/pull/1906) (open), which #1918 asks to merge first; #1910 is merged. All fall away at the re-pin onto the first release that carries #1918. **The upgrade onto this line breaks every gVisor snapshot**: `runsc restore` checks each container's `Process.User` and `Process.Cwd` against the checkpoint and the pause image sets `USER 65535`, so delete every gVisor actor before the roll and recreate every gVisor template after it (`docs/upgrade.md`, step 4); micro-VM snapshots resume as they were. The harness images must declare their identity (`USER 0:0`, `WORKDIR /`, kagent-upstream#125) before the roll, or the harness itself starts as 65532 +- **Upstream:** not ours: [agent-substrate/substrate#1918](https://github.com/agent-substrate/substrate/pull/1918) (author dims, open on 2026-10-19) and [#1906](https://github.com/agent-substrate/substrate/pull/1906) (merged 2026-10-16, `97de17b1`, in kagent-dev/substrate v0.6.0-alpha3, not in the v0.5.0-alpha2 pin), which #1918 asked to merge first; #1910 is merged. All fall away at the re-pin onto the first release that carries #1918. **The upgrade onto this line breaks every gVisor snapshot**: `runsc restore` checks each container's `Process.User` and `Process.Cwd` against the checkpoint and the pause image sets `USER 65535`, so delete every gVisor actor before the roll and recreate every gVisor template after it (`docs/upgrade.md`, step 4); micro-VM snapshots resume as they were. The harness images must declare their identity (`USER 0:0`, `WORKDIR /`, kagent-upstream#125) before the roll, or the harness itself starts as 65532 - **Our commit:** `git cherry-pick -x` of the whole stack, in upstream's order: `f55a4de4` (upstream's `8f7eb07d`, rootfs root), with the fork-only test of a restored bundle `f4a98eb1`; `1f43f481` (`895ec3ce`, #1906); `12670632`, `3da2115b`, `136337e7`, `ab5c083e` (`1e0466df`, `fa8578de`, `5925173f`, `d41a2fc2`, #1918). `afb62e18` (agent-substrate/substrate#1910, the manifest's `CAP_DAC_OVERRIDE`) is in the pin. Adapted to the line: `ocispec.Options` keeps its `ActorUID`/`ContainerName` shape and gains only `User` and `Cwd`, paths stay in `ateompath`, and the fork's `TestPrepareOCIDirectory_RegistryRejectionIsTerminal` passes the bundle path; also [#103](https://github.com/giantswarm/substrate/pull/103) (`feat(atelet): carry the image USER and WORKDIR stack of agent-substrate/substrate#1918`), [#101](https://github.com/giantswarm/substrate/pull/101) (`fix(imagecache): carry the rootfs root fix of agent-substrate/substrate#1918`) ## Change diff --git a/fork/ate-idp-server-serves-actor-jwt-issuer.md b/fork/ate-idp-server-serves-actor-jwt-issuer.md index 333c0de61c..6a29c3705a 100644 --- a/fork/ate-idp-server-serves-actor-jwt-issuer.md +++ b/fork/ate-idp-server-serves-actor-jwt-issuer.md @@ -1,7 +1,7 @@ # ate-idp-server serves the actor-JWT issuer - **Status:** carried -- **Upstream:** the server is upstream's `08779062` ([agent-substrate/substrate#2099](https://github.com/agent-substrate/substrate/pull/2099), merged on `main` after v0.5.0-alpha2) and leaves at the first re-pin that contains it; the chart's Deployment and `idp` Service: to file — prepared in the fork: branch `upstream/helm-ate-idp-server` +- **Upstream:** the server is upstream's `08779062` ([agent-substrate/substrate#2099](https://github.com/agent-substrate/substrate/pull/2099), merged 2026-10-16, in kagent-dev/substrate v0.6.0-alpha3, not in v0.5.0-alpha4) and leaves at the first re-pin that contains it; the chart's Deployment and `idp` Service: kagent-dev/substrate `main` renders `charts/substrate/templates/ate-idp-server.yaml` since `8cdb6963` (2026-10-18, in v0.6.0-alpha3), so the branch prepared in the fork, `upstream/helm-ate-idp-server`, is superseded and the chart half leaves at the same re-pin - **Our commit:** [#472](https://github.com/giantswarm/substrate/pull/472): `git cherry-pick -x` of `08779062` (the module path adapted, only its ate-idp-server entry of `docs/metrics/substrate.yaml`), the chart's `ate-idp-server` and the line's image of it ## Change diff --git a/fork/atelet-daemonset-takes-nodeselector-tolerations-affinity.md b/fork/atelet-daemonset-takes-nodeselector-tolerations-affinity.md index 278c263d6e..1194b91487 100644 --- a/fork/atelet-daemonset-takes-nodeselector-tolerations-affinity.md +++ b/fork/atelet-daemonset-takes-nodeselector-tolerations-affinity.md @@ -1,7 +1,7 @@ # The atelet DaemonSet takes `nodeSelector`, `tolerations` and `affinity` - **Status:** carried -- **Upstream:** to file: the upstream-shaped patch is branch [`upstream/atelet-scheduling`](https://github.com/giantswarm/substrate/tree/upstream/atelet-scheduling) here (`b34c1690`, on the mirror `main`); [kagent-dev/substrate#16](https://github.com/kagent-dev/substrate/pull/16) touches the same knob (`atelet.nodeSelector`, no tolerations or affinity) inside a fork-wide 92-file pull request that has conflicted since July — align with the maintainers there; re-checked beside agent-substrate/substrate#1874 (tolerations for workload types, merged 2026-09-25, in v0.3.0-alpha1) and alpha1's fixed `ate.dev/sandboxClass` toleration (`80f37cf6`) at the re-pin; a team member opens the kagent-dev/substrate pull request with DCO sign-off once the team has reviewed it +- **Upstream:** to file: the upstream-shaped patch is branch [`upstream/atelet-scheduling`](https://github.com/giantswarm/substrate/tree/upstream/atelet-scheduling) here (`b34c1690`, on the mirror `main`); [kagent-dev/substrate#16](https://github.com/kagent-dev/substrate/pull/16) touched the same knob (`atelet.nodeSelector`, no tolerations or affinity) inside a fork-wide 92-file pull request, closed unmerged on 2026-10-06; re-checked beside agent-substrate/substrate#1874 (tolerations for workload types, merged 2026-09-25, in v0.3.0-alpha1) and alpha1's fixed `ate.dev/sandboxClass` toleration (`80f37cf6`) at the re-pin; a team member opens the kagent-dev/substrate pull request with DCO sign-off once the team has reviewed it - **Our commit:** `931f9ed4`, [#8](https://github.com/giantswarm/substrate/pull/8) ## Change diff --git a/fork/egress-gateway-mints-and-injects-actor-jwts.md b/fork/egress-gateway-mints-and-injects-actor-jwts.md index 21b47054ab..420e9691f0 100644 --- a/fork/egress-gateway-mints-and-injects-actor-jwts.md +++ b/fork/egress-gateway-mints-and-injects-actor-jwts.md @@ -1,7 +1,7 @@ # The egress gateway mints and injects actor JWTs - **Status:** carried -- **Upstream:** merged on agent-substrate/substrate `main`: [agent-substrate/substrate#2135](https://github.com/agent-substrate/substrate/pull/2135) (`66f8a888`), [#2141](https://github.com/agent-substrate/substrate/pull/2141) (`d966c8e8`), [#2421](https://github.com/agent-substrate/substrate/pull/2421) (`55b6e00e`); in no release tag yet. Leaves at the first re-pin onto a tag that contains all three. +- **Upstream:** merged on agent-substrate/substrate `main`: [agent-substrate/substrate#2135](https://github.com/agent-substrate/substrate/pull/2135) (`66f8a888`), [#2141](https://github.com/agent-substrate/substrate/pull/2141) (`d966c8e8`), [#2421](https://github.com/agent-substrate/substrate/pull/2421) (`55b6e00e`); all three in agent-substrate/substrate v0.5.0 (2026-10-14) and kagent-dev/substrate v0.5.0-alpha4 (2026-10-14), not in the v0.5.0-alpha2 pin. Leaves at the first re-pin onto a tag that contains them. - **Our commit:** [#421](https://github.com/giantswarm/substrate/pull/421): the `git cherry-pick -x` of the three upstream commits, with the agentgateway line's `2.4.0-rc.2` as the agentgateway dataplane; [#429](https://github.com/giantswarm/substrate/pull/429) moves the dataplane to the stable `2.4.0` ## Change diff --git a/fork/egress-gateway-takes-further-credential-providers.md b/fork/egress-gateway-takes-further-credential-providers.md index 8f5f451421..08f2cdc393 100644 --- a/fork/egress-gateway-takes-further-credential-providers.md +++ b/fork/egress-gateway-takes-further-credential-providers.md @@ -1,7 +1,7 @@ # The egress gateway takes further credential providers - **Status:** carried -- **Upstream:** to file for kagent-dev/substrate (chart only) +- **Upstream:** [kagent-dev/substrate#90](https://github.com/kagent-dev/substrate/pull/90) (open, 2026-10-18, the chart); [agent-substrate/substrate#2829](https://github.com/agent-substrate/substrate/issues/2829) (open, 2026-10-18) and [#2830](https://github.com/agent-substrate/substrate/pull/2830) (draft, 2026-10-18) for ate-setup - **Our commit:** [#248](https://github.com/giantswarm/substrate/pull/248) (carries [#104](https://github.com/giantswarm/substrate/pull/104) onto the v0.4.0-alpha1 line) ## Change diff --git a/fork/egress-gateway-tells-actor-why-credential-was.md b/fork/egress-gateway-tells-actor-why-credential-was.md index 733ccd8c16..17773c0b21 100644 --- a/fork/egress-gateway-tells-actor-why-credential-was.md +++ b/fork/egress-gateway-tells-actor-why-credential-was.md @@ -1,7 +1,7 @@ # The egress gateway tells the actor why a credential was refused - **Status:** carried -- **Upstream:** to file, with the agentgateway half: the 502 for unexpected answers needs upstream's agreement +- **Upstream:** [agent-substrate/substrate#2555](https://github.com/agent-substrate/substrate/issues/2555) (open, 2026-10-13) asks upstream for the classes; ericcurtin took the Substrate side on 2026-10-15 (`credentials.go`, tests, doc table, the `FetchSecret` contract; the config-error row waits until 500 vs 502 is settled); the agentgateway half is agentgateway/agentgateway#3875 (draft) - **Our commit:** `feat/credential-provider-errors`; merged as [#112](https://github.com/giantswarm/substrate/pull/112) (`feat(atenet): tell the actor why a credential was refused`) ## Change diff --git a/fork/go-components-honor-otel-traces-exporter-none.md b/fork/go-components-honor-otel-traces-exporter-none.md index 371f519c57..674e529cf0 100644 --- a/fork/go-components-honor-otel-traces-exporter-none.md +++ b/fork/go-components-honor-otel-traces-exporter-none.md @@ -1,7 +1,7 @@ # The Go components honor `OTEL_TRACES_EXPORTER=none` - **Status:** carried -- **Upstream:** [agent-substrate/substrate#2189](https://github.com/agent-substrate/substrate/pull/2189) (draft, with the #1878 follow-up and the ateom row below; the upstream version also warns on an unsupported value), carried until it merges. At the 2026-10-08 re-pin onto v0.4.0-alpha1: rewritten on upstream's `metricsPushEnabled` shape as `tracesPushEnabled(ctx)` (`otlp`, the default, or `none`; an unrecognized value keeps the export and warns), so the line and agent-substrate/substrate#2189 now agree. At the 2026-10-12 re-pin onto v0.5.0-alpha2: the `serverboot` half is upstream's (agent-substrate/substrate#2193), and the line keeps only the chart's values and README rows. +- **Upstream:** [agent-substrate/substrate#2189](https://github.com/agent-substrate/substrate/pull/2189) (open, not a draft, reviewed by JeffLuoo on 2026-10-13; with the #1878 follow-up and the ateom row below; the upstream version also warns on an unsupported value), carried until it merges; the components' own `OTEL_TRACES_EXPORTER=none` handling is upstream's [#2190](https://github.com/agent-substrate/substrate/pull/2190) (merged 2026-10-08, `2f9b30df`, in kagent-dev/substrate v0.5.0-alpha4, not in the v0.5.0-alpha2 pin). At the 2026-10-08 re-pin onto v0.4.0-alpha1: rewritten on upstream's `metricsPushEnabled` shape as `tracesPushEnabled(ctx)` (`otlp`, the default, or `none`; an unrecognized value keeps the export and warns), so the line and agent-substrate/substrate#2189 now agree. At the 2026-10-12 re-pin onto v0.5.0-alpha2: the `serverboot` half is upstream's (agent-substrate/substrate#2193), and the line keeps only the chart's values and README rows. - **Our commit:** `48560a41` ([#107](https://github.com/giantswarm/substrate/pull/107)) ## Change diff --git a/fork/let-actors-egress-through-while-resumes.md b/fork/let-actors-egress-through-while-resumes.md index 7a25cf6230..d007dad6d1 100644 --- a/fork/let-actors-egress-through-while-resumes.md +++ b/fork/let-actors-egress-through-while-resumes.md @@ -1,7 +1,7 @@ # Let an actor's egress through while it resumes - **Status:** carried -- **Upstream:** to file: the upstream-shaped patch is branch [`upstream/atenet-egress-during-resume`](https://github.com/giantswarm/substrate/tree/upstream/atenet-egress-during-resume) here (`3a95d7cf`, on the mirror `main`); agent-substrate/substrate#1543 (open issue, 2026-09-08) reports the same problem, egress activated only after readyz, so the evidence and the patch go there; a team member opens the kagent-dev/substrate pull request with DCO sign-off once the team has reviewed it. **Complete with the egress dataplane this pull request pins:** the chart's `images.agentgateway` is the check in the request path (the egress config carries the `substrateEgress` policy and no `ext_proc`, so atenet's handler is not consulted); kagent-dev's `c0f5597c7cb8` (a pre-merge build of agentgateway#3237) authorized every CONNECT against ate-api itself — UID, then `RUNNING` — and refused the golden boot (`atunnel failed to open egress tunnel … 403 Forbidden: actor is not running`, agentlab 2026-09-11); upstream agentgateway v1.5.0 has no such check at all (its `substrateEgress` derives the actor from the SPIFFE id and checks nothing else — `agentlab skills-test` green on both halves with it swapped into `atenet-egress`, 2026-09-11, the run that proved the Substrate half). The line runs the agentgateway line's release (`v1.5.1-gs.2` on the v0.0.26 pin, `v1.5.1-gs.4` since the v0.0.29 pin), which keeps #3237's UID and state check and admits `RESUMING` (giantswarm/agentgateway-upstream#4; upstream-facing branch [`upstream/substrate-egress-resuming`](https://github.com/giantswarm/agentgateway-upstream/tree/upstream/substrate-egress-resuming)). Acceptance test of the combined fix: `agentlab skills-test` on the first build of this merge, recorded on agentlab#137. At the 2026-10-08 re-pin onto v0.4.0-alpha1: upstream moved the tunnel wiring of both ateoms into `internal/ateomtunnel` (agent-substrate/substrate#1959) with one `Tunnel.Activate` arming ingress and egress together; the patch splits it into `Tunnel.ActivateEgress`, called before the first container starts, and `Tunnel.ActivateIngress`, called after readyz. +- **Upstream:** [agent-substrate/substrate#2117](https://github.com/agent-substrate/substrate/pull/2117) (open since 2026-10-02, from branch [`upstream/atenet-egress-during-resume`](https://github.com/giantswarm/substrate/tree/upstream/atenet-egress-during-resume), `3a95d7cf` on the mirror `main`; EItanya on 2026-10-06: it does nothing without #2159 allowing policies on goldens; on 2026-10-09: the maintainers are doing their best to get it done for GA); agent-substrate/substrate#1543 (open issue, 2026-09-08) reports the same problem, egress activated only after readyz. **Complete with the egress dataplane this pull request pins:** the chart's `images.agentgateway` is the check in the request path (the egress config carries the `substrateEgress` policy and no `ext_proc`, so atenet's handler is not consulted); kagent-dev's `c0f5597c7cb8` (a pre-merge build of agentgateway#3237) authorized every CONNECT against ate-api itself — UID, then `RUNNING` — and refused the golden boot (`atunnel failed to open egress tunnel … 403 Forbidden: actor is not running`, agentlab 2026-09-11); upstream agentgateway v1.5.0 has no such check at all (its `substrateEgress` derives the actor from the SPIFFE id and checks nothing else — `agentlab skills-test` green on both halves with it swapped into `atenet-egress`, 2026-09-11, the run that proved the Substrate half). The line runs the agentgateway line's release (`v1.5.1-gs.2` on the v0.0.26 pin, `v1.5.1-gs.4` since the v0.0.29 pin), which keeps #3237's UID and state check and admits `RESUMING` (giantswarm/agentgateway-upstream#4; upstream-facing branch [`upstream/substrate-egress-resuming`](https://github.com/giantswarm/agentgateway-upstream/tree/upstream/substrate-egress-resuming)). Acceptance test of the combined fix: `agentlab skills-test` on the first build of this merge, recorded on agentlab#137. At the 2026-10-08 re-pin onto v0.4.0-alpha1: upstream moved the tunnel wiring of both ateoms into `internal/ateomtunnel` (agent-substrate/substrate#1959) with one `Tunnel.Activate` arming ingress and egress together; the patch splits it into `Tunnel.ActivateEgress`, called before the first container starts, and `Tunnel.ActivateIngress`, called after readyz. - **Our commit:** `6be3d50c` ([#4](https://github.com/giantswarm/substrate/pull/4); first published as `0.0.27-dev.giantswarm.2026-09-10.22-37-39.h1817627`) ## Change diff --git a/fork/read-ate-api-servers-postgresql-connection-string.md b/fork/read-ate-api-servers-postgresql-connection-string.md index d32e0f51b5..eee1dcd659 100644 --- a/fork/read-ate-api-servers-postgresql-connection-string.md +++ b/fork/read-ate-api-servers-postgresql-connection-string.md @@ -1,7 +1,7 @@ # Read ate-api-server's PostgreSQL connection string from a Secret - **Status:** carried -- **Upstream:** [kagent-dev/substrate#32](https://github.com/kagent-dev/substrate/pull/32), a draft since 2026-09-29, not ours; agent-substrate/substrate#1979 (open draft, 2026-09-29: PostgreSQL credentials from Secret files, a `@file:` DSN with reload) is the server-side successor, reviewed instead of a filing of ours — falls away at the re-pin onto the first release that carries either. At the 2026-10-08 re-pin onto v0.4.0-alpha1: upstream split the DSN into `postgres.readWriteConnectionString` and `postgres.ownerConnectionString` (separate roles for runtime and migrations); the Secret feeds `ATE_API_POSTGRES_READ_WRITE_CONNECTION_STRING` and, unless `postgres.ownerConnectionString` is set, `ATE_API_POSTGRES_OWNER_CONNECTION_STRING` from the same key, so the value name the meta chart sets is unchanged. +- **Upstream:** [kagent-dev/substrate#32](https://github.com/kagent-dev/substrate/pull/32), not ours, merged 2026-10-08 (`60368e95`) and in the v0.5.0-alpha2 pin, where the chart reads `postgres.readWriteConnectionStringSecretRef` and `postgres.ownerConnectionStringSecretRef` (keys `readWriteConnectionString` and `ownerConnectionString`); the line keeps its own `postgres.connectionStringSecretRef` (key `connectionString`) beside them for the value name the meta chart sets. agent-substrate/substrate#1979 (draft, 2026-09-29: PostgreSQL credentials from Secret files, a `@file:` DSN with reload) was closed by its author on 2026-10-02 as not necessary for GA. Falls away when the meta chart sets upstream's keys. At the 2026-10-08 re-pin onto v0.4.0-alpha1: upstream split the DSN into `postgres.readWriteConnectionString` and `postgres.ownerConnectionString` (separate roles for runtime and migrations); the Secret feeds `ATE_API_POSTGRES_READ_WRITE_CONNECTION_STRING` and, unless `postgres.ownerConnectionString` is set, `ATE_API_POSTGRES_OWNER_CONNECTION_STRING` from the same key, so the value name the meta chart sets is unchanged. - **Our commit:** `b2623ebf` (`git cherry-pick -x 1872249e`) and `917660f1` (`git cherry-pick -x 41097da7`, the `helm plugin install --verify=false` of the same pull request), [#8](https://github.com/giantswarm/substrate/pull/8) ## Change diff --git a/fork/workerpools-ateom-exports-nothing-when-ate-controller.md b/fork/workerpools-ateom-exports-nothing-when-ate-controller.md index 082af9c106..077bcb3f34 100644 --- a/fork/workerpools-ateom-exports-nothing-when-ate-controller.md +++ b/fork/workerpools-ateom-exports-nothing-when-ate-controller.md @@ -1,7 +1,7 @@ # A WorkerPool's ateom exports nothing when ate-controller has no OTLP endpoint - **Status:** carried -- **Upstream:** [agent-substrate/substrate#2189](https://github.com/agent-substrate/substrate/pull/2189) (draft, with the row above), carried until it merges +- **Upstream:** [agent-substrate/substrate#2189](https://github.com/agent-substrate/substrate/pull/2189) (open, not a draft, reviewed by JeffLuoo on 2026-10-13; with the row above), carried until it merges - **Our commit:** `fb79b373` ([#108](https://github.com/giantswarm/substrate/pull/108)) ## Change