Add agentgateway to CI & rename dataplane flag

.github/workflows/pr-workflow.yaml

@@ -56,8 +56,20 @@ jobs:
   # One kind cluster exercises BOTH runtimes. Free x86-64 ubuntu-latest runners
   # expose /dev/kvm (with a udev rule), so create-kind-cluster.sh mounts it and the
   # micro-VM (kata + cloud-hypervisor) sandbox class works alongside gVisor.
-  e2e-test:
+  e2e-test-matrix:
+    name: E2E (${{ matrix.dataplane }})
     runs-on: ubuntu-latest
+    continue-on-error: ${{ matrix.experimental }} # TODO: Make AgentGateway required once tests show stability
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - dataplane: envoy
+          experimental: false
+        - dataplane: agentgateway
+          experimental: true
+    env:
+      E2E_ATENET_DATAPLANE: ${{ matrix.dataplane }}
     steps:
     - name: Checkout
       uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
@@ -86,8 +98,10 @@ jobs:
         sudo udevadm trigger --name-match=kvm
     - name: Create cluster
       run: hack/create-kind-cluster.sh
-    - name: Install Agent Substrate
-      run: hack/install-ate-kind.sh --deploy-ate-system
+    - name: Install Agent Substrate (${{ matrix.dataplane }})
+      # The dataplane selection applies to both the ingress router and egress
+      # gateway.
+      run: hack/install-ate-kind.sh --deploy-ate-system --atenet-dataplane=${{ matrix.dataplane }}
     - name: Enable NFS
       # Load NFS kernel modules so in-cluster NFS server and CSI driver can run.
       run: |
@@ -97,7 +111,10 @@ jobs:
       run: hack/install-ate-kind.sh --setup-csi=nfs
     - name: Deploy micro-VM counter demo
       # Stages the (cached) assets into the cluster's rustfs and deploys the
-      # counter-microvm demo onto the control plane installed above.
+      # counter-microvm demo onto the control plane installed above. The demo
+      # redeploys the control plane, so retain the selected dataplane.
+      env:
+        ATE_ATENET_DATAPLANE: ${{ matrix.dataplane }}
       run: hack/run-microvm-demo-kind.sh
     - name: Deploy gVisor counter demo
       run: hack/install-ate-kind.sh --deploy-demo-counter
@@ -127,7 +144,7 @@ jobs:
       # Cluster-wide, so it must come AFTER the standard lanes: once egress
       # TLS is intercepted, their passthrough assumptions
       # (TestActorEgressHTTPS's end-to-end TLS with the origin) no longer hold.
-      run: hack/install-ate-kind.sh --deploy-atenet --experimental-use-sdsmint
+      run: hack/install-ate-kind.sh --deploy-atenet --atenet-dataplane=${{ matrix.dataplane }} --experimental-use-sdsmint
     - name: Run E2E tests (egress MITM trust)
       # The consumption half of the trust-bundle chain: an actor does TLS with
       # the MITM gateway's minted leaf using ONLY the projected bundle, plus a
@@ -178,3 +195,15 @@ jobs:
         kubectl --context kind-kind get pods -A -l ate.dev/worker-pool \
           -o 'custom-columns=:.metadata.namespace,:.metadata.name' --no-headers 2>/dev/null \
           | while read -r ns name; do dump "$ns" "$name"; done
+  # Preserve the required-check name while the concrete Envoy and AgentGateway
+  # executions run as entries in the shared matrix above.
+  e2e-test:
+    name: e2e-test
+    needs: e2e-test-matrix
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+    - name: Require E2E matrix success
+      env:
+        MATRIX_RESULT: ${{ needs.e2e-test-matrix.result }}
+      run: test "$MATRIX_RESULT" = success

benchmarking/automation/tests.yaml

@@ -43,7 +43,7 @@
 #                  outrun the default.
 #   ateArgs        Optional. List of strings appended verbatim to
 #                  `hack/install-ate.sh --deploy-ate-system` when this
-#                  test's substrate is deployed (e.g. ["--atenet-router=agentgateway"]
+#                  test's substrate is deployed (e.g. ["--atenet-dataplane=agentgateway"]
 #                  or ["--experimental-use-sdsmint"]).
 #
 # ---- type: locust -----------------------------------------------------------

cmd/ate-setup/commands.md

@@ -22,7 +22,7 @@ a pre-scan pass, so they may appear anywhere on its command line.
 | `ate-setup` | `hack/install-ate.sh` | Notes |
 |---|---|---|
 | `--kind` | `hack/install-ate-kind.sh`, or `ATE_INSTALL_KIND=true` | Kind overlays, the local registry, and host-architecture image builds |
-| `--atenet-router envoy\|agentgateway` | `--atenet-router envoy\|agentgateway` | atenet router dataplane (default `envoy`) |
+| `--atenet-dataplane envoy\|agentgateway` | `--atenet-dataplane envoy\|agentgateway` | atenet ingress and egress dataplane (default `envoy`) |
 | `--rollout-timeout DURATION` | `--rollout-timeout DURATION` | Readiness timeout for workloads (default `60s`). Unlike the shell flag it also governs the podcertificate-controller and CSI waits, which stay at their 120s default until it is passed |
 | `--podcert-workers-per-signer N` | `--podcert-workers-per-signer N` | Concurrent workers per podcertificate-controller signer |
 | `--experimental-use-sdsmint` | `--experimental-use-sdsmint` | Mint TLS certificates on-demand via SDS in atenet egress gateway |

cmd/ate-setup/differences.md

@@ -48,14 +48,14 @@ These were treated as contracts and reproduced exactly:
 | Actions per run | many, one per flag, in command-line order | exactly one subcommand |
 | Argument errors | detected when the dispatch loop reaches the flag, after earlier actions already ran | rejected by cobra before anything runs |
 | Value flags | pre-scanned so they could appear anywhere | positional, per-command, standard flag parsing |
-| Configuration | env vars (`ATE_INSTALL_KIND`, `ATE_ATENET_ROUTER`, `KUBECTL_CONTEXT`, …) | flags, with the env vars still honored as defaults |
+| Configuration | env vars (`ATE_INSTALL_KIND`, `ATE_ATENET_DATAPLANE`, `KUBECTL_CONTEXT`, …) | flags, with the env vars still honored as defaults |
 | Repository root | `git rev-parse --show-toplevel`, then `cd` | walk up for `go.mod`; no `chdir`, all paths absolute |
 
 The one-action-per-run change is the most visible: a line that passed
 `--deploy-ate-system --deploy-demo-counter` becomes two `ate-setup` calls.
 `hack/install-ate.sh` still accepts the combined form.
 
-Invalid input now fails before any cluster mutation. `--atenet-router=nginx`
+Invalid input now fails before any cluster mutation. `--atenet-dataplane=nginx`
 used to be caught by a pre-scan validation pass; `--worker-count 0` was not
 caught at all and surfaced from inside `deploy_locust.sh` after the microvm
 dependencies had already been installed.

cmd/ate-setup/internal/cmd/deploy.go

@@ -43,7 +43,7 @@ not supported here — the ATE_API_POSTGRES_CLOUDSQL_* variables are ignored, so
 use hack/install-ate.sh for a Cloud SQL install (see
 cmd/ate-setup/differences.md).
 
-Shape the install with the global --atenet-router flag.`,
+Shape the install with the global --atenet-dataplane flag.`,
 	Args: cobra.NoArgs,
 	RunE: func(cmd *cobra.Command, _ []string) error {
 		return env.DeployAteSystem(cmd.Context(), deployOpts)

cmd/ate-setup/internal/cmd/root.go

@@ -88,7 +88,7 @@ func init() {
 		"Target a local Kind cluster: use the kind overlays, the local registry, and host-architecture builds")
 	f.StringVar(&opts.Kubeconfig, "kubeconfig", "", "Path to the kubeconfig file")
 	f.StringVar(&opts.Context, "context", "", "Name of the kubeconfig context to use (defaults to KUBECTL_CONTEXT)")
-	f.StringVar(&opts.Router, "atenet-router", "", "atenet router dataplane: envoy or agentgateway (default envoy)")
+	f.StringVar(&opts.Router, "atenet-dataplane", "", "Atenet ingress and egress dataplane: envoy or agentgateway (default envoy)")
 	f.StringVar(&opts.RolloutTimeout, "rollout-timeout", "", "Timeout for workload rollouts as a duration string (e.g. 60s, 5m)")
 	f.IntVar(&opts.PodcertWorkersPerSigner, "podcert-workers-per-signer", 0, "Number of worker goroutines per signer in podcertificate-controller")
 	f.BoolVar(&opts.ExperimentalUseSDSMint, "experimental-use-sdsmint", false, "Deploy egress gateway with dynamic per-SNI certificate minting")

cmd/ate-setup/internal/config/config.go

@@ -237,7 +237,7 @@ func Load(opts Options) (*Config, error) {
 		applyKindDefaults(cfg)
 	}
 
-	cfg.Router = firstNonEmpty(opts.Router, env["ATE_ATENET_ROUTER"], RouterEnvoy)
+	cfg.Router = firstNonEmpty(opts.Router, env["ATE_ATENET_DATAPLANE"], RouterEnvoy)
 
 	if err := validate(cfg); err != nil {
 		return nil, err
@@ -283,7 +283,7 @@ func validate(cfg *Config) error {
 			return fmt.Errorf("--experimental-additional-egress-extproc-service requires --experimental-use-sdsmint")
 		}
 		if cfg.Router != RouterEnvoy {
-			return fmt.Errorf("--experimental-additional-egress-extproc-service requires --atenet-router=envoy")
+			return fmt.Errorf("--experimental-additional-egress-extproc-service requires --atenet-dataplane=envoy")
 		}
 	}
 	return nil

cmd/ate-setup/internal/config/config_test.go

@@ -30,7 +30,7 @@ import (
 //
 // Load deliberately reads the developer's environment, so a test that sets only
 // what it cares about is at the mercy of whatever the shell or CI job happens
-// to export: an ambient PROJECT_ID or ATE_ATENET_ROUTER quietly changes the
+// to export: an ambient PROJECT_ID or ATE_ATENET_DATAPLANE quietly changes the
 // result. Every variable Load consults is blanked here -- empty reads as unset,
 // which is what these tests mean by "not configured" -- and NO_DEV_ENV keeps
 // .ate-dev-env.sh out of it. Tests then set back only what they exercise.
@@ -42,7 +42,7 @@ func loadEnv(t *testing.T) {
 		"ATE_ADDITIONAL_EGRESS_EXTPROC_SERVICE",
 		"ATE_API_POSTGRES_CONNECTION_STRING",
 		"ATE_API_POSTGRES_SCHEMA",
-		"ATE_ATENET_ROUTER",
+		"ATE_ATENET_DATAPLANE",
 		"ATE_EXPERIMENTAL_USE_SDSMINT",
 		"ATE_IMAGE_REPO",
 		"ATE_IMAGE_TAG",
@@ -85,7 +85,7 @@ func TestLoadDefaults(t *testing.T) {
 
 func TestLoadFlagsBeatEnvironment(t *testing.T) {
 	loadEnv(t)
-	t.Setenv("ATE_ATENET_ROUTER", RouterEnvoy)
+	t.Setenv("ATE_ATENET_DATAPLANE", RouterEnvoy)
 	t.Setenv("ATE_INSTALL_ROLLOUT_TIMEOUT", "30s")
 
 	cfg, err := Load(Options{Router: RouterAgentgateway, RolloutTimeout: "120s"})

cmd/ate-setup/internal/steps/overlay.go

@@ -75,7 +75,7 @@ func (e *Env) atenetEgressManifestPath() string {
 func (e *Env) renderAtenetEgressManifest(ctx context.Context) ([]byte, error) {
 	if e.Cfg.Router == config.RouterAgentgateway {
 		if e.Cfg.AdditionalEgressExtprocService != "" {
-			return nil, fmt.Errorf("--experimental-additional-egress-extproc-service requires --atenet-router=envoy")
+			return nil, fmt.Errorf("--experimental-additional-egress-extproc-service requires --atenet-dataplane=envoy")
 		}
 		return e.KustomizeResolve(ctx, installDir+"/agentgateway-egress")
 	}

cmd/atenet/internal/router/README.md

@@ -2,8 +2,8 @@
 
 Router has several responsibilities:
 
-* Serves Envoy xDS configuration when `--atenet-router=envoy` (the default).
-  With `--atenet-router=agentgateway`, the sidecar uses a static ConfigMap and
+* Serves Envoy xDS configuration when `--atenet-dataplane=envoy` (the default).
+  With `--atenet-dataplane=agentgateway`, the sidecar uses a static ConfigMap and
   atenet does not start an xDS server.
 * ext_proc server for the dataplane. To make the deployment and debugging easier, we will run this component together
   with the router, but this will be split later into its own component.
@@ -185,7 +185,7 @@ Ingress and egress are deployed separately today — `atenet-router` fronts the
 ingress dataplane, `atenet-egress` the egress gateway — because the two scale
 independently, not because they need separate binaries.
 
-`--atenet-router` selects the dataplane for both Deployments. Each gateway has
+`--atenet-dataplane` selects the dataplane for both Deployments. Each gateway has
 its own static configuration because ingress and egress scale independently.
 
 ## status page

cmd/atenet/internal/router/cmd.go

@@ -45,7 +45,7 @@ func NewRouterCmd() *cobra.Command {
 	cmd.Flags().StringVar((*string)(&cfg.Mode), "mode", string(ModeAll), fmt.Sprintf("Traffic direction this instance serves: %q (also runs the ingress control plane — the xDS server — for an Envoy dataplane), %q (ext_proc only, needs no Kubernetes access), or %q for both. The ext_proc mux refuses a direction this instance was not started to serve rather than falling back to the other one", ModeIngress, ModeEgress, ModeAll))
 	cmd.Flags().StringVar(&cfg.LogLevel, "log-level", "info", "Log level: debug, info, warn, error")
 	cmd.Flags().StringVar(&cfg.MetricsAddr, "metrics-listen-addr", ":9090", "Address and port the prometheus metrics server should listen on.")
-	cmd.Flags().StringVar(&cfg.AtenetRouter, "atenet-router", string(atenetRouterEnvoy), "Router dataplane: envoy or agentgateway")
+	cmd.Flags().StringVar(&cfg.AtenetRouter, "atenet-dataplane", string(atenetRouterEnvoy), "Atenet ingress and egress dataplane: envoy or agentgateway")
 	cmd.Flags().StringVar(&cfg.Namespace, "namespace", "default", "Target operations namespace")
 	cmd.Flags().StringVar(&cfg.Kubeconfig, "kubeconfig", "", "Absolute path to the kubeconfig configuration file")
 	cmd.Flags().StringVar(&cfg.AteapiAddr, "ateapi-address", "k8s:///api.ate-system.svc:443", "gRPC dial target for the cluster ateapi Control instance.")
@@ -84,7 +84,7 @@ func NewRouterCmd() *cobra.Command {
 	// must propagate to the Service endpoints before the drain starts.
 	cmd.Flags().DurationVar(&cfg.DrainDelay, "drain-delay", 13*time.Second, "How long to keep serving after SIGTERM before starting the drain, covering readiness-probe detection and Service endpoint propagation")
 	cmd.Flags().DurationVar(&cfg.DrainTimeout, "drain-timeout", 0, "Deadline for the ext_proc drain on shutdown; streams still open past it (parked requests included) are forcefully cancelled. 0 (the default) derives --parked-request-budget + the actor route timeout + margin so parked requests always finish normally. Explicit values must be >= --parked-request-budget")
-	cmd.Flags().StringVar(&cfg.EnvoyAdminAddr, "envoy-admin-address", "localhost:9901", "Envoy admin interface the shutdown sequence drives to drain the sidecar (healthcheck/fail, drain_listeners, stats polling). Ignored with --atenet-router=agentgateway")
+	cmd.Flags().StringVar(&cfg.EnvoyAdminAddr, "envoy-admin-address", "localhost:9901", "Envoy admin interface the shutdown sequence drives to drain the sidecar (healthcheck/fail, drain_listeners, stats polling). Ignored with --atenet-dataplane=agentgateway")
 	cmd.Flags().StringVar(&cfg.DrainCompleteFile, "drain-complete-file", defaultDrainCompleteFile, "Marker file created (on a pod-shared emptyDir) once the shutdown drain completes; the dataplane container's preStop hook polls for it so the proxy exits as soon as — and no sooner than — the drain is done. Removed at startup to defuse stale markers. Empty disables the handshake")
 
 	return cmd

cmd/atenet/internal/router/config.go

@@ -216,7 +216,7 @@ func (c routerConfig) validate() error {
 	switch c.atenetRouter() {
 	case atenetRouterEnvoy, atenetRouterAgentgateway:
 	default:
-		return fmt.Errorf("--atenet-router must be %q or %q, got %q", atenetRouterEnvoy, atenetRouterAgentgateway, c.AtenetRouter)
+		return fmt.Errorf("--atenet-dataplane must be %q or %q, got %q", atenetRouterEnvoy, atenetRouterAgentgateway, c.AtenetRouter)
 	}
 	switch c.Mode {
 	case "", ModeIngress, ModeEgress, ModeAll:

cmd/atenet/internal/router/config_test.go

@@ -43,7 +43,7 @@ func TestRouterConfigValidate(t *testing.T) {
 		{
 			name:    "unknown router rejected",
 			cfg:     routerConfig{AtenetRouter: "blah"},
-			wantErr: "--atenet-router must be",
+			wantErr: "--atenet-dataplane must be",
 		},
 		{
 			name:    "negative extproc-max-requests rejected",

demos/egress/README.md

@@ -61,12 +61,12 @@ ActorTemplate, worker pool, test, and manual walkthrough are otherwise the same.
 ./hack/install-ate-kind.sh --deploy-ate-system
 
 # agentgateway
-./hack/install-ate-kind.sh --deploy-ate-system --atenet-router=agentgateway
+./hack/install-ate-kind.sh --deploy-ate-system --atenet-dataplane=agentgateway
 ```
 
 | | Envoy | agentgateway |
 | --- | --- | --- |
-| Select with | `--atenet-router=envoy` (default) | `--atenet-router=agentgateway` |
+| Select with | `--atenet-dataplane=envoy` (default) | `--atenet-dataplane=agentgateway` |
 | Egress routing | Dynamic forward proxy | Dynamic backend from CONNECT authority |
 | Actor authentication | Co-located atenet `ext_proc` | Built-in `substrateEgress` policy |
 | Configuration | Envoy bootstrap in `atenet-egress.yaml` | Static agentgateway ConfigMap overlay |

hack/install-ate.sh

@@ -77,7 +77,7 @@ function usage() {
   echo "                                         a bare --setup-csi means nfs; hostpath is Kind only)"
   echo "  --delete-ate-system                    Delete core system"
   echo "  --delete-all                           Delete core system and all registered demos"
-  echo "  --atenet-router=envoy|agentgateway     Select the ingress and egress dataplane (default: envoy)"
+  echo "  --atenet-dataplane=envoy|agentgateway  Select the atenet ingress and egress dataplane (default: envoy)"
   echo "  --podcert-workers-per-signer N         Concurrent workers per podcertificate-controller signer (default: 1)"
   echo "  --rollout-timeout DURATION             Per-workload readiness wait timeout, kubectl-style Go duration (default: 60s)"
   echo "  --otlp-endpoint URL                    Send all control plane telemetry to URL, not to the cluster default (see benchmarking/telemetry/README.md)"
@@ -218,12 +218,12 @@ run_ko() {
 }
 
 atenet_router() {
-  case "${ATE_ATENET_ROUTER:-envoy}" in
+  case "${ATE_ATENET_DATAPLANE:-envoy}" in
     envoy|agentgateway)
-      echo "${ATE_ATENET_ROUTER:-envoy}"
+      echo "${ATE_ATENET_DATAPLANE:-envoy}"
       ;;
     *)
-      echo "Error: --atenet-router must be envoy or agentgateway, got '${ATE_ATENET_ROUTER}'" >&2
+      echo "Error: --atenet-dataplane must be envoy or agentgateway, got '${ATE_ATENET_DATAPLANE}'" >&2
       exit 1
       ;;
   esac
@@ -362,7 +362,7 @@ render_atenet_egress_manifest() {
     # refuses a non-sdsmint manifest: ignoring the flag would report a
     # successful install of a gateway that has no additional checkpoint on it.
     if additional_egress_extproc_enabled; then
-      echo "Error: --experimental-additional-egress-extproc-service requires --atenet-router=envoy" >&2
+      echo "Error: --experimental-additional-egress-extproc-service requires --atenet-dataplane=envoy" >&2
       return 1
     fi
     local agentgateway_egress="manifests/ate-install/agentgateway-egress"
@@ -1432,13 +1432,13 @@ BENCHMARK_ACTOR_MEMORY=""
 prescan_args=("$@")
 for ((i = 0; i < ${#prescan_args[@]}; i++)); do
   case "${prescan_args[i]}" in
-    --atenet-router=*) ATE_ATENET_ROUTER="${prescan_args[i]#*=}" ;;
-    --atenet-router)
+    --atenet-dataplane=*) ATE_ATENET_DATAPLANE="${prescan_args[i]#*=}" ;;
+    --atenet-dataplane)
       if (( i + 1 >= ${#prescan_args[@]} )); then
-        echo "Error: --atenet-router requires envoy or agentgateway" >&2
+        echo "Error: --atenet-dataplane requires envoy or agentgateway" >&2
         exit 1
       fi
-      ATE_ATENET_ROUTER="${prescan_args[$((i + 1))]}"
+      ATE_ATENET_DATAPLANE="${prescan_args[$((i + 1))]}"
       ;;
     --experimental-use-sdsmint) ATE_EXPERIMENTAL_USE_SDSMINT=true ;;
     --experimental-additional-egress-extproc-service=*)
@@ -1540,14 +1540,14 @@ while [[ "$#" -gt 0 ]]; do
   fi
 
   case $1 in
-    --atenet-router=*) ATE_ATENET_ROUTER="${1#*=}" ;;
-    --atenet-router)
+    --atenet-dataplane=*) ATE_ATENET_DATAPLANE="${1#*=}" ;;
+    --atenet-dataplane)
       shift
       if [[ "$#" -eq 0 ]]; then
-        echo "Error: --atenet-router requires envoy or agentgateway" >&2
+        echo "Error: --atenet-dataplane requires envoy or agentgateway" >&2
         exit 1
       fi
-      ATE_ATENET_ROUTER="$1"
+      ATE_ATENET_DATAPLANE="$1"
       ;;
     # Captured in the pre-scan above; matched here only so the `*)` branch does
     # not reject it as an unknown option.