Repository navigation
[EPIC] Make repository Provider Neutral #3161
Description
Tracks Provider-Neutral Core workstream
Goal
The core repository carries no code, manifests, settings, documentation guidance, or tooling specific to GCP or GKE and supports extension mechanisms for any provider and the default install works on any conformant Kubernetes cluster without any provider-specific CRDs or services.
General Requirements
- Delete the GKE provisioning and teardown tools and the GCS staging scripts from core, after substrate-gke carries current copies.
- Done:
tools/setup-gcpandhack/teardown.shwere removed in tools: remove setup-gcp and hack/teardown.sh #3505, and the README points to substrate-gke (Point the README GKE quickstart at the GKE installation guide #3642). - The GCS staging scripts were deleted in ate-setup: port microvm-deps installation from shell to Go #2092, but the staging moved into
ate-setup([FEATURE] ate-setup: stop staging micro-VM assets to GCS #3671).
- Done:
- Move GKE defaults out of core manifests:
- the Google Managed Prometheus monitor ([Bug]: Default install requires GKE
PodMonitoringCRD #2589); - the GKE ComputeClass toleration on atelet (Move atelet's GKE ComputeClass toleration into the GKE install overlay #2760);
- the GKE OpenTelemetry endpoint ([FEATURE] agentgateway router reads its OTLP address from ate-otel-config #3666, then Default OTLP endpoint points at an addon namespace that usually does not exist #1258);
- the GCS storage default ([FEATURE] objectstore-plugin requires an explicit ATE_STORAGE_BACKEND #3668).
- the Google Managed Prometheus monitor ([Bug]: Default install requires GKE
- Decide atelet's default credential-provider configuration and make it a documented setting either way ([Bug]: atelet credential-provider configuration is hard-coded to GKE host paths #2669, [FEATURE] atelet image credential provider becomes a documented install setting #3667).
- Remove GCP and Cloud SQL logic from ate-setup: settings, gcloud credential fetching, GKE token-issuer derivation, Google registry keychain ([FEATURE] ate-setup: remove GCP and Cloud SQL logic #3670). Ship deprecation warnings a release ahead ([FEATURE] ate-setup: deprecation warnings for GCP and Cloud SQL settings #3669), and safeguards that stop an external-database install from switching to bundled Postgres (done: ate-setup: refuse to point an external-database install at the bundled one #2588).
- Replace atelet's anonymous GCS asset download with a generic HTTPS fetch ([FEATURE] atelet fetches public sandbox assets over HTTPS #3672).
- Replace GCE detection in the workers with a log-format setting ([FEATURE] Worker log-format setting replaces GCE detection #3673).
- Remove GCP guidance from CRD and API documentation ([FEATURE] Remove GCP guidance from CRD, proto and API documentation #3674).
- Move the GCS object-store backend ([FEATURE] Move the GCS object-store backend out of core #3675) and the GCP Secret Manager plugin (done: The GCP Secret Manager credential provider moved to agent-substrate-plugins/credprovider-gcp-secret-manager #3365) to repositories outside core.
Sequencing
The removals that change what a GKE install deploys (#2589, #2760, #1258, the second steps of #3668 and #3673, and #3670) ship together in one release after the GKE parity release (ai-on-gke/substrate-gke#151), so a GKE install never loses some defaults but not others.
Parent Issue: #3158
Reacted by zerosnacks
Activity
The GCP Secret Manager credential provider moved to agent-substrate-p…
MushuEE commentedon Oct 28, 2026
Cross-linking the issues and PRs already in flight for this epic. Several were filed or opened on their own before this epic existed, so this comment maps each one to a requirement and lists what nothing covers yet. State checked against
mainon 2026-10-28.Umbrella / related: #2304 (migrate
tools/setup-gcpto substrate-gke), ai-on-gke/substrate-gke#82 (GKE content landing in substrate-gke), #3189 (ate-setupprovider interface), #3188 (stable object names for provider patches), #1782 / #1830 (generic-cluster install profile and docs).Requirement → tracking
tools/setup-gcpandhack/teardown.sh)hack/microvm-assets/stage-to-gcs.shPodMonitoringout of coreate-otel-config); #2426 (preflight check,--otlp-endpoint=none)ate-storage-config, still GCS in base)ATE_STORAGE_BACKEND: "gcs"is still the base default inatelet.yamlandate-api-server.yaml, and #3197 keeps itatelet.yamlstill mounts/home/kubernetes/binand/etc/srv/kubernetes/cri_auth_config.yaml. #2799 is additive, and no decision on the default has been recordedcmd/ate-setup/internal/config/credentials.gostill runsgcloud container clusters get-credentials--cluster-namestill "derive[s] the JWT issuer" (config/setting.go,config/config.go)cmd/ate-setup/internal/images/digest.gostill usesauthn.NewMultiKeychain(authn.DefaultKeychain, google.Keychain)ATE_API_POSTGRES_CLOUDSQL_*into a hard error in the same change, with no warning release firstgs://URLs (cmd/atelet/sandbox_assets.go). The bundledsandboxconfig-gvisor.yamlpoints atgs://gvisor, and #2649 / #2657 only make that location overridable. No issue covers a generic HTTPS fetchateworker-gvisorandateworker-microvmstill callmetadata.OnGCE()to pick the actor log label keyapi/infra/k8s/ate/v1/sandboxconfig_types.go,api/objectstore/v1/objectstore.protoanddocs/api-guide.mdstill usegs://examples and GCS-specific fallback textagent-substrate-plugins/credprovider-gcp-secret-manager)pkg/objectstore/actorauthzfor out-of-tree providers), #3138, #3150internal/objectstore/gcs.go,internal/objectstoreplugin/gcs*andpkg/objectstorage/gcs*.go, and no issue tracks moving it. #3381 / #2595 (Azure) go the other way and add a backend in-tree, which this epic should settleGaps with no issue yet
hack/microvm-assets/stage-to-gcs.sh(and update its README) once substrate-gke has a copy.gcloud get-credentials, GKE JWT-issuer derivation from--cluster-name, andgoogle.Keychain.gs://fallback, and a neutral default for the bundled gVisorSandboxConfig(ties in with Design: how should object-store plugins signal that atelet may read a public sandbox asset anonymously? #2630).metadata.OnGCE()with an explicit log-format setting.docs/api-guide.md.Coordination notes
PodMonitoring. Pick one.gcr.io/pkg.devcredential logic ininternal/imagecacheonmain, so it may already be fixed. Can someone confirm and close it?Say the micro-VM assets are not GKE-specific, only their GCS staging
Say the micro-VM assets are not GKE-specific, only their GCS staging
PodMonitoringCRD #2589tools/setup-gcptoai-on-gke/substrate-gke#2304