Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

claude-code-multiplex demo: agents cannot reach the Anthropic API (egress denied by default)

Abierto Apto para principiantes
  • ¿Algo no está bien?
#2,487 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
1/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
76/100
Tipo de issue
Documentación
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
go, kubernetes
Área
devops, documentation

Línea de trabajo

Busca el tutorial del README para la demo claude-code-multiplex y compara sus pasos con el ejemplo de egress-policy del issue. Documenta la política mínima que permite api.anthropic.com antes de crear o reanudar el agente. Se considera terminado cuando el tutorial del README incluye el comando requerido y las llamadas de Claude de la demo pueden llegar a la API.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

area/demos area/network kind/bug
What happened?

The claude-code-multiplex demo's agents cannot reach the Anthropic API: the egress gateway denies every outbound request the workload makes, so claude --print fails on every tick and the demo cannot be run as the README documents.

Steps to Reproduce

  1. Install substrate and deploy the demo as the README describes: 
    ANTHROPIC_API_KEY=sk-ant-... BUCKET_NAME=... \
  ./hack/install-ate.sh --deploy-demo-claude-code-multiplex
  2. Create and resume an actor: 
    kubectl ate create actor agent-luna -a claude-multiplex-demo --template agent-luna
kubectl ate resume actor agent-luna -a claude-multiplex-demo
  3. Watch the worker pod logs (the ateom container's atunnel warnings), or the actor container output.

Actual Behavior

atunnel: egress gateway rejected CONNECT with 403 Forbidden: egress denied

and on the actor side:

[demo-actor:luna] running: Tell me one short, surprising fact about the Moon. One sentence.
Failed to authenticate. API Error: 403 egress denied
[demo-actor:luna] claude exited non-zero

The actor runs, the workload loop ticks, but every Claude call is rejected before it leaves the cluster.

Root Cause

Every Actor starts with no egress policy, and the gateway treats "no policy" the same as "empty policy": deny (cmd/atenet/internal/router/egress/egress.go, lookupPolicy). Neither the demo's deploy step (cmd/ate-setup/internal/demos/claudemultiplex) nor kubectl ate create actor provisions one, and the README's walkthrough has no create egress-policy step. So the agent actors are created into a default-deny posture the demo never opens — on any cluster, GKE included: api.anthropic.com is a public destination that no rule allows.

I verified the causal chain on a kind cluster by toggling one actor's policy:

  • delete the policy → the next tick fails (claude exited non-zero)
  • re-create the policy → the very next tick succeeds (same actor, same pod, same task)
cat <<'EOF' | kubectl ate create egress-policy agent-luna -a claude-multiplex-demo -f -
rules:
- https:
    hostnames: ["api.anthropic.com"]
EOF

is enough to make the demo work. (Where the API is reached through a plain-HTTP proxy instead, an http rule is needed; note that an http and an https rule with the same pattern on the same ports are rejected as a tie, so a wildcard both-protocol allow-all is not expressible as two rules.)

Expected Behavior

One of:

  1. The README documents the missing step, with a minimal api.anthropic.com rule for the agents — the documentation fix this issue asks for.
  2. The demo's deploy step provisions the agents' egress policies, so the walkthrough runs with no manual step. The demo already substitutes ANTHROPIC_API_KEY into the templates and could substitute the allow rule the same way.
  3. #1324 (default egress policy in ActorTemplate) lands and the templates carry their rule — the platform-level fix; the demo step then disappears again.

Additional context

  • #1324 tracks the template-level default policy; this issue is the concrete demo walkthrough that breaks without something like it.
  • #820 / #875 were the same class of problem for this demo (walkthrough broken by a control-plane hardening), fixed by updating the demo rather than the platform.
  • The egress default-deny posture landed in f980a57d (2026-09-14); the README's current walkthrough predates or missed accounting for it.
Lenguaje dominante
Go
Estrellas
5k
Forks
563
Merge medio
2 d 15 h
PR fusionados (30 d)
422

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de agent-substrate/substrate

Todos los issues de agent-substrate/substrate

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.