Repository navigation
[FEATURE] Establish cluster-side install setting records #3172
Description
Every value an operator supplies lives in exactly one named object and key, so ate-setup flags, kustomize patches, Helm values, and provider Components all write the same place.
Owner: kustomize release workstream (#3169). Consumers: all workstreams.
Working Specification:
| Setting | Object | Key or field | Format and default |
|---|---|---|---|
| Service-account token issuer | ConfigMap ate-api-authentication | authentication.yaml | YAML: actorIdentityJWTProvider: kubernetes, jwtProviders[] with issuer and audiences: [api.ate-system.svc]; in-cluster issuers add certificateAuthorityFile, discoveryTokenFile |
| ate-api-server configuration | ConfigMap ate-api-config | apiconfig.textproto | Prototext APIConfig, default logging { level: "info" } |
| ate-api-server environment | ConfigMap ate-api-server-envvars | ATE_API_POSTGRES_READ_WRITE_ROLE, ATE_API_POSTGRES_OWNER_ROLE, ATE_API_ACTOR_JWT_ISSUER, optional ATE_API_POSTGRES_POOL_MAX_CONNS | Strings; issuer default https://idp.ate-system.svc |
| Postgres connection | Secret ate-api-server-secret-envvars | ATE_API_POSTGRES_READ_WRITE_CONNECTION_STRING, ATE_API_POSTGRES_OWNER_CONNECTION_STRING, ATE_API_POSTGRES_SCHEMA | libpq DSNs; bundled defaults point at postgres.ate-system.svc with certificate authentication |
| Postgres server CA | Secret postgres-server-ca | server-ca.pem | PEM; optional, external databases only |
| Actor JWT issuer | ConfigMap key read by ate-idp-server as --issuer=$(ATE_ACTOR_JWT_ISSUER) | ATE_ACTOR_JWT_ISSUER (Proposed home; set in memory by ate-setup today) | https://, no path |
| OpenTelemetry endpoint | ConfigMap ate-otel-config | OTEL_EXPORTER_OTLP_ENDPOINT | URL; neutral default to be decided (empty, or an in-namespace collector; #1258). The agentgateway router reads it per #3666 |
| OpenTelemetry tuning | ConfigMap ate-otel-config | Standard OTEL_* variables | Optional |
| Worker telemetry exporters | ConfigMap ate-otel-config | ATE_WORKER_OTEL_LOGS_EXPORTER, ATE_WORKER_OTEL_TRACES_EXPORTER, ATE_WORKER_OTEL_METRICS_EXPORTER | Exporter names; workers skip exporting without an endpoint |
| Object-store backend | objectstore-plugin initContainer on DaemonSet atelet and Deployment ate-api-server | ATE_STORAGE_BACKEND, plugin image | s3 or gcs today, where any other value means GCS; after cleanup, unset is an error (#3668) |
| S3 settings | Same initContainers | AWS_S3_USE_PATH_STYLE and standard AWS SDK variables | Kind sets region, endpoint, and credentials |
| Image credential provider | DaemonSet atelet | Volumes image-credential-provider-bin and image-credential-provider-config; flags --image-credential-provider-config and --image-credential-provider-bin-dir | Mounted at /run/image-credential-provider/{bin,config.yaml}; default to be decided (#2669, #3667) |
| Worker log format | Controller-propagated worker setting (Proposed: ate-otel-config key ATE_WORKER_LOG_FORMAT) | text or json | Defaults to today's GCE detection, then a neutral format (#3673) |
| Credential-provider policy | ConfigMap k8s-credential-provider-namespace-policy | namespace-policy.yaml | YAML policies: []; created only if absent, so operator edits survive |
| Workload identity | ServiceAccounts | metadata.annotations | Provider-specific annotations, set by provider Components |
| Sandbox assets | SandboxConfig gvisor-default | Asset url and sha256 per runtime version | HTTPS URLs by default |
| Component sizing | See #3168 | Replicas, resources, disruption budgets |
Settings that are JSON flags in ate-setup today, such as --credential-provider='{"name":"k8s.io"}' (a JSON object or array since #3409), become manifest settings with defaults. A default install passes no JSON.
Stability. Object names and keys are a compatibility surface: renaming or removing one is a breaking change.
Enforcement. A machine-readable copy of this table is checked against ate-setup render output (#3240): every listed object and key must exist.
IMPORTANT The working spec is non-exhaustive. It is a point-in-time analysis. Review the current status of settable fields.
Parent Issue: #3160
Activity