network-egress.md describes actor certificate checks the egress gateway doesn't make
维护者通常 1 天内回复
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 74/100
- Issue 类型
- 文档
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- go
调研方向
将 docs/guides/network-egress.md 与 cmd/atenet/internal/router/egress/egress.go 一起阅读，重点关注 verifyActorCertificate 和 validateActor。检查 #3347 中的决定以及 #2208 跟踪的限制。更新指南，描述 Envoy 路径当前执行的检查，并链接到名称重用限制。
由索引模型根据 Issue 内容生成。
描述
The "Client Authorization" section of docs/guides/network-egress.md describes checks the egress gateway doesn't make. It says the PEP MUST:
- require exactly one valid
ActorIdentityextension with atespace, actor name, actor UID, and purpose - require the purpose to be
atunnel, and the URI SAN to match the extension - confirm with ate-api-server that the actor's current UID matches the certificate
The Envoy path in cmd/atenet/internal/router/egress/egress.go does none of these:
verifyActorCertificatechecks validity, the chain, client auth usage, and non-CA, then takes the actor from the single URI SAN. It doesn't read the extension.validateActorcallsGetActorby atespace and name, and checks only forRUNNINGorRESUMING. It doesn't compare UIDs.
So a certificate from a deleted actor passes these checks for a new actor with the same name until it expires. Using it needs the private key held in atunnel.
#3347 was closed with a decision to document that correctness isn't guaranteed when names are reused. #2208 tracks putting the UID in the SPIFFE ID.
The guide should describe the current checks and link to that limitation. I can send a docs PR if that's the right fix.
I found this with an AI agent and checked it against main at 94e0a26a. I read the Envoy path only and didn't test it on a cluster.
- 主要语言
- Go
- 星标
- 6.1k
- 派生
- 676
- 平均合并
- 2 天
- 30 天内合并 PR
- 456
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
agent-substrate/substrate 的其他 Issue
-
Clean up the ko retry tests可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭area/dev-infra area/reliability area/tests kind/cleanup
难度 2/5 1-3 小时 新手友好度 66/100
agent-substrate/substrate#3461 ·
维护者通常 1 天内回复
-
egress: drop the empty-provider check in providerCredential可能已有人在做 @cloudonly 于 9 天前认领。 未关闭area/network kind/cleanup
难度 2/5 1-3 小时 新手友好度 68/100
agent-substrate/substrate#3428 ·
维护者通常 1 天内回复
-
kubectl-ate create actor-template -f <file> fails with useless error可能已有人在做 @cloudonly 于 11 天前认领。 未关闭area/cli kind/bug
难度 2/5 1-3 小时 新手友好度 70/100
agent-substrate/substrate#3406 ·
维护者通常 1 天内回复
-
k8s-credential-provider manifest is missing ate-otel-config envFrom, failing OTLP metric exports to [::1]:4317 / 127.0.0.1:4317 every 60s可能已有人在做 @ericcurtin 于 12 天前认领。 未关闭area/dev-infra area/observability area/security kind/bug
难度 2/5 1-3 小时 新手友好度 82/100
agent-substrate/substrate#3282 ·
维护者通常 1 天内回复
-
filecachegc.runPass suppresses eviction logs when FreedBytes < target and consecutiveShortfalls > 3可能已有人在做 @ericcurtin 于 11 天前认领。 未关闭area/node area/observability area/storage kind/bug
难度 2/5 1-3 小时 新手友好度 78/100
agent-substrate/substrate#3281 ·
维护者通常 1 天内回复
查看 agent-substrate/substrate 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 76/100
-
难度 2/5 1-3 小时 新手友好度 78/100
koordinator-sh/koordinator#3257 ·
维护者通常 6 天内回复
-
难度 2/5 1-3 小时 新手友好度 67/100
-
Component: Backup and Restore Type: Bug
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
-
needs-acceptance wg/router-models-inference-runtime
难度 2/5 1-3 小时 新手友好度 88/100
vllm-project/semantic-router#6018 ·
维护者通常 2 天内回复