feat: allow running with vanilla k8s by yuval-k · Pull Request #3 · kagent-dev/substrate

yuval-k · 2026-06-01T14:23:55Z

add a helm chart
allow JWT auth instead of mTLS

Signed-off-by: Peter Jausovec <peter.jausovec@solo.io> Co-authored-by: Peter Jausovec <peter.jausovec@solo.io>

- add a helm chart - allow JWT auth instead of mTLS

… on some k8s distributions that not expose the JWKS

* enable websockets (#4) Signed-off-by: Peter Jausovec <peter.jausovec@solo.io> Co-authored-by: Peter Jausovec <peter.jausovec@solo.io> * feat: allow running with vanilla k8s - add a helm chart - allow JWT auth instead of mTLS * update helm chart images * fix rbac. note that JWT verification is not cached and might not work on some k8s distributions that not expose the JWKS * fix: add chart boilerplate headers * fix: support jwt helm install on plain kind * feat: add substrate crds helm chart * feat: make jwt helm installs standalone * fix: make helm defaults cloud-neutral * fix: sync crd chart templates * fix: use agentgateway in helm chart * fix: update agentgateway install overlays * fix: project agentgateway tls key separately --------- Signed-off-by: Peter Jausovec <peter.jausovec@solo.io> Co-authored-by: Eitan Yarmush <eitan.yarmush@solo.io> Co-authored-by: Peter Jausovec <peter.jausovec@solo.io>

* enable websockets (kagent-dev#4) Signed-off-by: Peter Jausovec <peter.jausovec@solo.io> Co-authored-by: Peter Jausovec <peter.jausovec@solo.io> * feat: allow running with vanilla k8s - add a helm chart - allow JWT auth instead of mTLS * update helm chart images * fix rbac. note that JWT verification is not cached and might not work on some k8s distributions that not expose the JWKS * fix: add chart boilerplate headers * fix: support jwt helm install on plain kind * feat: add substrate crds helm chart * feat: make jwt helm installs standalone * fix: make helm defaults cloud-neutral * fix: sync crd chart templates * fix: use agentgateway in helm chart * fix: update agentgateway install overlays * fix: project agentgateway tls key separately --------- Signed-off-by: Peter Jausovec <peter.jausovec@solo.io> Co-authored-by: Eitan Yarmush <eitan.yarmush@solo.io> Co-authored-by: Peter Jausovec <peter.jausovec@solo.io>

* enable websockets (#4) Signed-off-by: Peter Jausovec <peter.jausovec@solo.io> Co-authored-by: Peter Jausovec <peter.jausovec@solo.io> * feat: allow running with vanilla k8s - add a helm chart - allow JWT auth instead of mTLS * update helm chart images * fix rbac. note that JWT verification is not cached and might not work on some k8s distributions that not expose the JWKS * fix: add chart boilerplate headers * fix: support jwt helm install on plain kind * feat: add substrate crds helm chart * feat: make jwt helm installs standalone * fix: make helm defaults cloud-neutral * fix: sync crd chart templates * fix: use agentgateway in helm chart * fix: update agentgateway install overlays * fix: project agentgateway tls key separately --------- Signed-off-by: Peter Jausovec <peter.jausovec@solo.io> Co-authored-by: Eitan Yarmush <eitan.yarmush@solo.io> Co-authored-by: Peter Jausovec <peter.jausovec@solo.io>

…-substrate#1002) Fixes agent-substrate#1001 `TestK8sResolverEndpointSliceUpdates` intermittently fails at `resolver_test.go:215` — 8 of the 30 most recent failed `pr-workflow` runs (~27%): ``` updated state.Addresses = [{Addr: "10.0.0.1:443", ServerName: "", }], want [{Addr: "10.0.0.1:443", ServerName: "", } {Addr: "10.0.0.2:443", ServerName: "", }] ``` `Build` starts a goroutine that calls `updateState` once `WaitForCacheSync` returns. That report is deliberate: a service with no EndpointSlices never fires `AddFunc`, so without it the resolver would stay silent instead of telling gRPC the answer is an empty set. But `WaitForCacheSync` polls at `syncedPollPeriod = 100ms`, so it fires roughly 100ms after Build — and if the test has not yet created the second slice by then, that update still carries only `10.0.0.1` and sits in the channel ahead of the real one. The second `select` took whatever came next, so it asserted against the stale update. Locally Build-to-Create is 0.6ms, well ahead of the timer, which is why this only shows up on loaded runners. The resolver is not at fault — it promises eventual convergence, not that the first update after a change is final, and a duplicate update costs gRPC nothing. So both waits now go through one `waitForAddrs` helper that consumes updates until the set matches, with a timeout so a genuinely broken resolver still fails and reports the last set it saw. Note this changes the first wait as well: it asserted the *first* update equals `[10.0.0.1]`, and now waits for that set instead. The same argument applies there — nothing promises the first update is final. ## Verification `-count=N` proves nothing here: the unfixed test passes locally at any count because the window is never hit. A/B with the Build→Create delay as the only variable: | delay | old assertion | new assertion | |---|---|---| | 0ms | 5/5 pass | 5/5 pass | | 150ms | **0/5 pass** | **5/5 pass** | Measured timeline with the 150ms stall in place: ``` [ 0.5ms] update #1: [10.0.0.1] <- AddFunc for slice1 first select takes it ... 150ms stall ... [101.1ms] update #2: [10.0.0.1] <- the WaitForCacheSync goroutine test creates slice2 [151.4ms] update #3: [10.0.0.1, 10.0.0.2] ``` The probe tests used for this are not included. Rebased over agent-substrate#1013. That fixes a different bug — concurrent `updateState` calls letting an older address set win — and does not close this one: the two updates here are ~100ms apart, so the queue has nothing to coalesce. Re-measured on top of it, unchanged: at a 150ms delay the old assertion is 0/5 and the new one 5/5.

* enable websockets (#4) Signed-off-by: Peter Jausovec <peter.jausovec@solo.io> Co-authored-by: Peter Jausovec <peter.jausovec@solo.io> * feat: allow running with vanilla k8s - add a helm chart - allow JWT auth instead of mTLS * update helm chart images * fix rbac. note that JWT verification is not cached and might not work on some k8s distributions that not expose the JWKS * fix: add chart boilerplate headers * fix: support jwt helm install on plain kind * feat: add substrate crds helm chart * feat: make jwt helm installs standalone * fix: make helm defaults cloud-neutral * fix: sync crd chart templates * fix: use agentgateway in helm chart * fix: update agentgateway install overlays * fix: project agentgateway tls key separately --------- Signed-off-by: Peter Jausovec <peter.jausovec@solo.io> Co-authored-by: Eitan Yarmush <eitan.yarmush@solo.io> Co-authored-by: Peter Jausovec <peter.jausovec@solo.io>

EItanya force-pushed the main branch 4 times, most recently from 63ea2b0 to 3c8f321 Compare June 9, 2026 12:13

EItanya force-pushed the yuval-k/helm+jwt branch from 8234a91 to 0b800a3 Compare June 9, 2026 13:13

EItanya force-pushed the main branch from ef1159f to e9ec19d Compare June 9, 2026 19:23

EItanya force-pushed the yuval-k/helm+jwt branch 2 times, most recently from 52d2b0d to 16f5078 Compare June 10, 2026 14:29

EItanya force-pushed the main branch from f6738ed to 05b8cb3 Compare June 10, 2026 16:14

EItanya force-pushed the yuval-k/helm+jwt branch from 0761f10 to 18c9eb4 Compare June 10, 2026 16:18

EItanya force-pushed the main branch from 05b8cb3 to b33bf43 Compare June 10, 2026 16:35

EItanya force-pushed the yuval-k/helm+jwt branch from 18c9eb4 to 34ca279 Compare June 10, 2026 16:39

EItanya force-pushed the main branch from b33bf43 to 3e950a0 Compare June 10, 2026 16:53

EItanya and others added 13 commits June 10, 2026 16:54

enable websockets (#4)

54bac39

Signed-off-by: Peter Jausovec <peter.jausovec@solo.io> Co-authored-by: Peter Jausovec <peter.jausovec@solo.io>

feat: allow running with vanilla k8s

298d621

- add a helm chart - allow JWT auth instead of mTLS

update helm chart images

1b5549a

fix rbac. note that JWT verification is not cached and might not work…

393acf5

… on some k8s distributions that not expose the JWKS

fix: add chart boilerplate headers

ab7575a

fix: support jwt helm install on plain kind

c03eab0

feat: add substrate crds helm chart

84c51de

feat: make jwt helm installs standalone

8b99057

fix: make helm defaults cloud-neutral

ddc796a

fix: sync crd chart templates

79294aa

fix: use agentgateway in helm chart

e1388dc

fix: update agentgateway install overlays

96145db

fix: project agentgateway tls key separately

5e9bf9b

EItanya force-pushed the yuval-k/helm+jwt branch from 34ca279 to 5e9bf9b Compare June 10, 2026 16:55

EItanya merged commit b0c5d50 into main Jun 10, 2026
2 checks passed

Navigation Menu

Uh oh!

feat: allow running with vanilla k8s - #3

feat: allow running with vanilla k8s#3
EItanya merged 13 commits into
mainfrom
yuval-k/helm+jwt

yuval-k commented Jun 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

yuval-k commented Jun 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants