From c15539157695679f5ecc0640ae6e42568a427f07 Mon Sep 17 00:00:00 2001 From: Steve Linde Date: Fri, 16 Oct 2026 20:02:10 +0000 Subject: [PATCH 1/2] atelet: change default port from 8085 to 21998 atelet is the only Substrate component that binds a port on the node, via hostPort. Move it off 8085, a commonly used port, to 21998, an IANA-unassigned port, so it is less likely to conflict with other processes on the node. Co-authored-by: Hoda Mohammadi <173203200+hodaaaaaaaaaa@users.noreply.github.com> --- cmd/ateapi/internal/controlapi/dialer_test.go | 8 ++++---- .../internal/controlapi/functionaltest/main_test.go | 9 ++++++--- docs/metrics/registry/metrics.yaml | 2 +- internal/atelet/port.go | 2 +- manifests/ate-install/atelet.yaml | 4 ++-- .../components/fake-data-plane/kustomization.yaml | 2 +- 6 files changed, 15 insertions(+), 12 deletions(-) diff --git a/cmd/ateapi/internal/controlapi/dialer_test.go b/cmd/ateapi/internal/controlapi/dialer_test.go index 906106393a..2d96aa2eb5 100644 --- a/cmd/ateapi/internal/controlapi/dialer_test.go +++ b/cmd/ateapi/internal/controlapi/dialer_test.go @@ -156,17 +156,17 @@ func TestDialForAteletOnNodeTarget(t *testing.T) { { name: "IPv4 atelet", ateletIP: "10.244.1.7", - wantTarget: "10.244.1.7:8085", + wantTarget: "10.244.1.7:21998", }, { name: "IPv6 atelet is bracketed", ateletIP: "fd00:10:244::7", - wantTarget: "[fd00:10:244::7]:8085", + wantTarget: "[fd00:10:244::7]:21998", }, { name: "IPv6 loopback is bracketed", ateletIP: "::1", - wantTarget: "[::1]:8085", + wantTarget: "[::1]:21998", }, } @@ -387,7 +387,7 @@ func TestDialForAteletOnNode(t *testing.T) { if fresh == old { t.Fatal("DialForAteletOnNode returned the stale connection after the IP changed") } - if got, want := fresh.Target(), "10.0.0.9:8085"; got != want { + if got, want := fresh.Target(), "10.0.0.9:21998"; got != want { t.Errorf("dial target = %q, want %q", got, want) } if got := old.GetState(); got != connectivity.Shutdown { diff --git a/cmd/ateapi/internal/controlapi/functionaltest/main_test.go b/cmd/ateapi/internal/controlapi/functionaltest/main_test.go index 9ea0ae0df7..1e2afe2830 100644 --- a/cmd/ateapi/internal/controlapi/functionaltest/main_test.go +++ b/cmd/ateapi/internal/controlapi/functionaltest/main_test.go @@ -20,11 +20,13 @@ import ( "log" "net" "os" + "strconv" "sync" "testing" "time" "go.ate.dev/substrate/cmd/ateapi/internal/store/storetest" + "go.ate.dev/substrate/internal/atelet" "go.ate.dev/substrate/internal/objectstore/objectstoretest" "go.ate.dev/substrate/internal/proto/ateletpb" "go.ate.dev/substrate/internal/serverboot" @@ -85,12 +87,13 @@ func TestMain(m *testing.M) { log.Fatalf("%v", err) } - // Start Fake Atelet Server on port 8085 + // Start Fake Atelet Server on the port ateapi dials. ateletGrpcServer := grpc.NewServer() ateletpb.RegisterAteletServer(ateletGrpcServer, fakeAtelet) - ateletLis, err := net.Listen("tcp", "127.0.0.1:8085") + ateletAddr := net.JoinHostPort("127.0.0.1", strconv.Itoa(atelet.DefaultPort)) + ateletLis, err := net.Listen("tcp", ateletAddr) if err != nil { - log.Fatalf("listen on 127.0.0.1:8085: %v", err) + log.Fatalf("listen on %s: %v", ateletAddr, err) } go func() { if err := ateletGrpcServer.Serve(ateletLis); err != nil { diff --git a/docs/metrics/registry/metrics.yaml b/docs/metrics/registry/metrics.yaml index 850cb3d1e0..5696a5b91f 100644 --- a/docs/metrics/registry/metrics.yaml +++ b/docs/metrics/registry/metrics.yaml @@ -704,7 +704,7 @@ groups: stability: stable type: int brief: The TCP port of the server that a gRPC client called. - examples: [8085] + examples: [21998] # --------------------------------------------------------------------------- # Metrics. ateapi diff --git a/internal/atelet/port.go b/internal/atelet/port.go index d89ad3adf4..4a841b6827 100644 --- a/internal/atelet/port.go +++ b/internal/atelet/port.go @@ -16,5 +16,5 @@ package atelet const ( // DefaultPort is the port atelet's gRPC server listens on. - DefaultPort = 8085 + DefaultPort = 21998 ) diff --git a/manifests/ate-install/atelet.yaml b/manifests/ate-install/atelet.yaml index 7ff7371dd3..22581a3375 100644 --- a/manifests/ate-install/atelet.yaml +++ b/manifests/ate-install/atelet.yaml @@ -271,8 +271,8 @@ spec: name: ate-otel-config ports: - name: grpc - containerPort: 8085 - hostPort: 8085 + containerPort: 21998 + hostPort: 21998 - name: prometheus containerPort: 9090 protocol: TCP diff --git a/manifests/ate-install/components/fake-data-plane/kustomization.yaml b/manifests/ate-install/components/fake-data-plane/kustomization.yaml index dcd5f803eb..9039c816c1 100644 --- a/manifests/ate-install/components/fake-data-plane/kustomization.yaml +++ b/manifests/ate-install/components/fake-data-plane/kustomization.yaml @@ -71,7 +71,7 @@ patches: path: /spec/template/spec/containers/0/ports value: - name: grpc - containerPort: 8085 + containerPort: 21998 # fake-workersync's capacity reports, relayed to ate-api-server under # this pod's atelet identity; only fake-workersync's is admitted. - name: relay From ff70fc93db567950c5e547f9e1991e29a3af10fe Mon Sep 17 00:00:00 2001 From: Steve Linde Date: Fri, 16 Oct 2026 20:02:10 +0000 Subject: [PATCH 2/2] atelet: document DefaultPort choice and derive test targets from it Note on atelet.DefaultPort that it is also atelet's hostPort, so it is chosen to stay clear of common node ports, the NodePort range, and the ephemeral range. The dialer tests check host formatting, not the port value, so build their expected targets from atelet.DefaultPort instead of hardcoding it. Co-authored-by: Hoda Mohammadi <173203200+hodaaaaaaaaaa@users.noreply.github.com> --- cmd/ateapi/internal/controlapi/dialer_test.go | 13 +++++++++---- internal/atelet/port.go | 2 ++ 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/cmd/ateapi/internal/controlapi/dialer_test.go b/cmd/ateapi/internal/controlapi/dialer_test.go index 2d96aa2eb5..43215e7942 100644 --- a/cmd/ateapi/internal/controlapi/dialer_test.go +++ b/cmd/ateapi/internal/controlapi/dialer_test.go @@ -24,12 +24,14 @@ import ( "errors" "math/big" "net/url" + "strconv" "sync" "testing" "time" "github.com/spiffe/go-spiffe/v2/bundle/x509bundle" "github.com/spiffe/go-spiffe/v2/spiffeid" + "go.ate.dev/substrate/internal/atelet" "go.ate.dev/substrate/internal/installdefaults" "go.ate.dev/substrate/internal/substratex509" "google.golang.org/grpc" @@ -44,6 +46,9 @@ import ( const testAteletSPIFFEID = "spiffe://cluster.local/ns/ate-system/sa/atelet" +// ateletPort is the port every atelet dial target should carry. +var ateletPort = strconv.Itoa(atelet.DefaultPort) + // makeTestCA mints a self-signed CA and returns it along with an X.509 bundle // containing it as the sole authority for the cluster.local trust domain. func makeTestCA(t *testing.T) (*x509.Certificate, *ecdsa.PrivateKey, *x509bundle.Bundle) { @@ -156,17 +161,17 @@ func TestDialForAteletOnNodeTarget(t *testing.T) { { name: "IPv4 atelet", ateletIP: "10.244.1.7", - wantTarget: "10.244.1.7:21998", + wantTarget: "10.244.1.7:" + ateletPort, }, { name: "IPv6 atelet is bracketed", ateletIP: "fd00:10:244::7", - wantTarget: "[fd00:10:244::7]:21998", + wantTarget: "[fd00:10:244::7]:" + ateletPort, }, { name: "IPv6 loopback is bracketed", ateletIP: "::1", - wantTarget: "[::1]:21998", + wantTarget: "[::1]:" + ateletPort, }, } @@ -387,7 +392,7 @@ func TestDialForAteletOnNode(t *testing.T) { if fresh == old { t.Fatal("DialForAteletOnNode returned the stale connection after the IP changed") } - if got, want := fresh.Target(), "10.0.0.9:21998"; got != want { + if got, want := fresh.Target(), "10.0.0.9:"+ateletPort; got != want { t.Errorf("dial target = %q, want %q", got, want) } if got := old.GetState(); got != connectivity.Shutdown { diff --git a/internal/atelet/port.go b/internal/atelet/port.go index 4a841b6827..e2a1a2c13e 100644 --- a/internal/atelet/port.go +++ b/internal/atelet/port.go @@ -16,5 +16,7 @@ package atelet const ( // DefaultPort is the port atelet's gRPC server listens on. + // It is also atelet's hostPort, so it is chosen to avoid common node ports, + // the NodePort range, and the ephemeral range. DefaultPort = 21998 )