Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

claude-code-multiplex demo: agents cannot reach the Anthropic API (egress denied by default)

Aperta Adatta ai principianti
  • Qualcosa non va?
#2,487 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
1/5
Tempo stimato
1-3 ore
Idoneità per principianti
76/100
Tipo di issue
Documentazione
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
go, kubernetes
Ambito
devops, documentation

Direzione di ricerca

Trova la guida del README per la demo claude-code-multiplex e confrontane i passaggi con l’esempio egress-policy nella issue. Documenta la policy minima che consente api.anthropic.com prima di creare o riprendere l’agente. Il lavoro è completo quando la guida del README include il comando richiesto e le chiamate Claude della demo possono raggiungere l’API.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

area/demos area/network kind/bug
What happened?

The claude-code-multiplex demo's agents cannot reach the Anthropic API: the egress gateway denies every outbound request the workload makes, so claude --print fails on every tick and the demo cannot be run as the README documents.

Steps to Reproduce

  1. Install substrate and deploy the demo as the README describes: 
    ANTHROPIC_API_KEY=sk-ant-... BUCKET_NAME=... \
  ./hack/install-ate.sh --deploy-demo-claude-code-multiplex
  2. Create and resume an actor: 
    kubectl ate create actor agent-luna -a claude-multiplex-demo --template agent-luna
kubectl ate resume actor agent-luna -a claude-multiplex-demo
  3. Watch the worker pod logs (the ateom container's atunnel warnings), or the actor container output.

Actual Behavior

atunnel: egress gateway rejected CONNECT with 403 Forbidden: egress denied

and on the actor side:

[demo-actor:luna] running: Tell me one short, surprising fact about the Moon. One sentence.
Failed to authenticate. API Error: 403 egress denied
[demo-actor:luna] claude exited non-zero

The actor runs, the workload loop ticks, but every Claude call is rejected before it leaves the cluster.

Root Cause

Every Actor starts with no egress policy, and the gateway treats "no policy" the same as "empty policy": deny (cmd/atenet/internal/router/egress/egress.go, lookupPolicy). Neither the demo's deploy step (cmd/ate-setup/internal/demos/claudemultiplex) nor kubectl ate create actor provisions one, and the README's walkthrough has no create egress-policy step. So the agent actors are created into a default-deny posture the demo never opens — on any cluster, GKE included: api.anthropic.com is a public destination that no rule allows.

I verified the causal chain on a kind cluster by toggling one actor's policy:

  • delete the policy → the next tick fails (claude exited non-zero)
  • re-create the policy → the very next tick succeeds (same actor, same pod, same task)
cat <<'EOF' | kubectl ate create egress-policy agent-luna -a claude-multiplex-demo -f -
rules:
- https:
    hostnames: ["api.anthropic.com"]
EOF

is enough to make the demo work. (Where the API is reached through a plain-HTTP proxy instead, an http rule is needed; note that an http and an https rule with the same pattern on the same ports are rejected as a tie, so a wildcard both-protocol allow-all is not expressible as two rules.)

Expected Behavior

One of:

  1. The README documents the missing step, with a minimal api.anthropic.com rule for the agents — the documentation fix this issue asks for.
  2. The demo's deploy step provisions the agents' egress policies, so the walkthrough runs with no manual step. The demo already substitutes ANTHROPIC_API_KEY into the templates and could substitute the allow rule the same way.
  3. #1324 (default egress policy in ActorTemplate) lands and the templates carry their rule — the platform-level fix; the demo step then disappears again.

Additional context

  • #1324 tracks the template-level default policy; this issue is the concrete demo walkthrough that breaks without something like it.
  • #820 / #875 were the same class of problem for this demo (walkthrough broken by a control-plane hardening), fixed by updating the demo rather than the platform.
  • The egress default-deny posture landed in f980a57d (2026-09-14); the README's current walkthrough predates or missed accounting for it.
Lingua principale
Go
Stelle
5k
Fork
563
Merge medio
2g 15h
PR unite (30g)
422

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di agent-substrate/substrate

Tutte le issue di agent-substrate/substrate

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.