From 008af727ce45a7091201e47889681fa093e7fa26 Mon Sep 17 00:00:00 2001 From: Vicente Ferrara Date: Wed, 14 Oct 2026 00:27:12 +0000 Subject: [PATCH] ate-env manifest: label the namespace ate.dev/api-access=true so ate-env-api passes Substrate's default-deny ingress policy --- cmd/ate-env/manifest.go | 13 +++++++++++-- cmd/ate-env/manifest_test.go | 4 ++++ 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/cmd/ate-env/manifest.go b/cmd/ate-env/manifest.go index c80c1f3..8fd3314 100644 --- a/cmd/ate-env/manifest.go +++ b/cmd/ate-env/manifest.go @@ -352,10 +352,19 @@ func prune(v any) any { } } +// apiAccessLabel is the namespace label Substrate's network policy requires of +// in-cluster API clients: ate-system denies ingress by default and admits +// non-worker pods from namespaces carrying it (substrate #2522). Without it +// ate-env-api cannot reach ateapi and crash-loops on its startup atespace check. +const apiAccessLabel = "ate.dev/api-access" + func buildNamespace(cfg manifestConfig) *corev1.Namespace { return &corev1.Namespace{ - TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Namespace"}, - ObjectMeta: metav1.ObjectMeta{Name: cfg.namespace}, + TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Namespace"}, + ObjectMeta: metav1.ObjectMeta{ + Name: cfg.namespace, + Labels: map[string]string{apiAccessLabel: "true"}, + }, } } diff --git a/cmd/ate-env/manifest_test.go b/cmd/ate-env/manifest_test.go index 0172091..2169d03 100644 --- a/cmd/ate-env/manifest_test.go +++ b/cmd/ate-env/manifest_test.go @@ -92,6 +92,9 @@ func TestBuildManifests(t *testing.T) { if ns.Name != "ate-env" { t.Errorf("namespace = %q, want ate-env", ns.Name) } + if got := ns.Labels[apiAccessLabel]; got != "true" { + t.Errorf("namespace label %s = %q, want \"true\" (ate-system admits API clients by it)", apiAccessLabel, got) + } pool := objs[1].(*atev1alpha1.WorkerPool) if pool.Namespace != cfg.namespace || pool.Name != "default-template-workerpool" { @@ -210,6 +213,7 @@ func TestWriteManifests(t *testing.T) { } for _, want := range []string{ "kind: Namespace", + "ate.dev/api-access: \"true\"", "kind: WorkerPool", "kind: Deployment", "kind: Service",