github agent-substrate/substrate v1.0.0
v1.0.0 - "Fully armed and operational"
on GitHub

5 hours ago
image of yolo the octopus, our logo, yolo is bright green has 8 arms and a few of them are holding colorful pastel toy robots, representing agents. this version of yolo is dressed up in a black cloak as palpatine, from star wars

Now witness the power of this fully armed and operational ... system for managing agents and agent-like workloads securely at scale.

Thank you to our MANY contributors who helped get us here! We couldn't have done it without you. ❤️

What's Changed

⚠️ Breaking Changes

  • Envoy moves to v1.39.5, micro-VM assets to kata 4.3.1, kind and CSI images pinned by digest by @dims in #3181
  • WorkerPools with similar long names no longer share a NetworkPolicy by @yufan-su in #3130
  • MicroVM guests get their whole memory limit, and placement books each actor's runtime overhead by @BenTheElder in #3104
  • Rename --cordon-control-plane to --cordon-system-infra-components and its node pool label to ate-system-infra by @haiyanmeng in #3210
  • A microVM actor using more host memory than it booked no longer takes down its worker by @BenTheElder in #3429
  • Remove the unused public MintActorCertificate API by @EItanya in #3427
  • [release-1.0] Cherry-pick #2392: Run containers as the image's USER and WORKDIR, with layer file owners kept by @BenTheElder in #3473
  • [release-1.0] Cherry-pick #3487: Unknown Linux capability names in an ActorTemplate are rejected at admission by @BenTheElder in #3514
  • [release-1.0] Cherry-pick 23 main changes through 4488a66 by @EItanya in #3536
  • [release-1.0] Cherry-pick 19 main changes through 5a5b192 by @EItanya in #3571
  • [release-1.0] Cherry-pick 21 main changes through fc931c4 by @EItanya in #3596
  • [release-1.0] Cherry-pick #3580: Restrict actor capabilities.add and make mounts nodev by @dberkov in #3611
  • [release-1.0] Cherry-pick 5 main changes through 2289ade by @dberkov in #3645

Bug Fixes

  • atelet: detach Checkpoint from caller cancellation once underway by @chw120 in #2602
  • Actors can reach the network while they boot, before their wakeup probe passes by @QuentinBisson in #2117
  • atenet: classify a 403 route outcome as denied, not resume_error by @teemow in #2534
  • A gVisor actor going over its memory limit no longer takes down every actor on its worker by @BenTheElder in #3106
  • benchmarking/nighthawk-egress: create namespaces in both deploy scripts by @ygao-g in #3315
  • microvm: forward sysctls and lift the guest's privileged-port limit to match gVisor by @dims in #1904
  • Releases publish the envoy-dataplane image by @MushuEE in #3252
  • atelet, ateworker: finish a checkpoint retry after atelet restarts by @chw120 in #3218
  • ateworker: reuse a completed checkpoint only on the same boot by @chw120 in #3213
  • atelet: keep the worker's Unavailable when a checkpoint fails by @aditya-shantanu in #3123
  • fix atelet deviceplugin wedge by @BenTheElder in #3323
  • [release-1.0] Cherry-pick #3476: leave page cache out of the memory guard's overshoot check by @BenTheElder in #3513

Features: Networking and Egress

  • e2e: use a port-forward per router CONNECT tunnel by @BenTheElder in #3051
  • envoy: cross compile instead of compiling under slow emulation by @BenTheElder in #3152
  • actornet: pin the sysctls a sandbox namespace inherits from the node by @BenTheElder in #3310
  • Add kubectl ate proxy actor command. by @juli4n in #3191
  • Allow the egress gateway to use more than one credential provider by @thompsonmax in #3409

Features: Security and Identity

  • manifests: Run control plane containers as non-root by @mikedickey in #3028
  • Enable runsc core tagging when supported by the kernel by @fvoznika in #2887

Features: Workers and Actors

  • require workers to run in their own cgroup namespace by @BenTheElder in #3110
  • Update gVisor to release 20261026.0 by @nybidari in #3364
  • Update a deleting tag returns FAILED_PRECONDITION by @laoj2 in #3340
  • Suspending actors no longer OOM-kills tight worker pods by @BenTheElder in #3353
  • ateapi: carry the golden actor's crash message into the template status by @dims in #2644
  • [release-1.0] Cherry-pick #3456: microvm: skip software bounce buffer (SWIOTLB) by default by @jiayimeow in #3515

Features: Install and Operations

Documentation

  • document that PRs are squash-merged, only HEAD needs to build, optimize for reviews by @BenTheElder in #3109
  • correct the minimum kernel for the image cache: Linux 6.7, or 6.6.23 by @BenTheElder in #3128
  • docs: use kvm-arm.vgic_v3_group1_trap=1 for Lima microVM setup on arm64 by @BenTheElder in #3149
  • microvm consistency: standardize docs and agent instructions by @BenTheElder in #3105
  • atelet: say snapshot cache hits fall back to copies across mounts by @roycaihw in #3064
  • docs: require DCO sign-off instead of the Google CLA by @BenTheElder in #3237
  • docs: fix the README note on enabling beta APIs by @HavenXia in #3266
  • [bugbash] hack/teardown.sh: add --cluster-scoped to tear down one cluster by @HavenXia in #3296
  • benchmarking: what to set and watch before a dense run by @dims in #2499
  • docs: add extensibility guide for gateways by @destijl in #3317
  • AGENTS.md: add the version skew rules by @HavenXia in #3151
  • Document running the ate-api-server cold resume tests from a workstation by @haiyanmeng in #3394
  • Add Hugo Docsite by @moficodes in #1974

Other Changes

  • Prevent storing actors/tags with malformed durable snapshot URIs by @laoj2 in #3082
  • Remove outdated roadmap and update security vulnerability reporting guidelines by @destijl in #3122
  • glutton: run the RunScript timing tests on a synctest bubble by @maxsmythe in #3090
  • atecontroller: Limit the Secrets read to the egress MITM CA pool by @mikedickey in #3036
  • manifests: Give podcertificate-controller its own ServiceAccount by @mikedickey in #3059
  • atelet: return Canceled when Run or Restore fails to reset actor dirs by @zoez7 in #3063
  • Resume restores an uploaded snapshot when its node is gone by @igooch in #3094
  • Move public APIs under api/<api-name>/v1. by @juli4n in #2996
  • Fix statusz port in k8s credential provider by @yufan-su in #3067
  • benchmarking/locust: cap trial_summary actor density by live actors by @chw120 in #3140
  • ateapi: squash PostgreSQL migrations and lock them once merged by @iplay88keys in #2991
  • e2e: fix the TestKillMatching flake, wait for the child's command line by @dims in #3155
  • ateapi accepts snapshot report from atelet for actors in CRASHED state by @zoez7 in #3148
  • ateworker: reuse completed checkpoint when workload is already stopped by @chw120 in #3015
  • gVisor sandboxes move to release 20261019.0 from the 2026-10-17 nightly by @dims in #3177
  • Reject WorkerPool names longer than 63 characters by @haiyanmeng in #3136
  • atelet: verify microvm SandboxConfig assets before writing sandbox-runtimes.json by @shrutiyam-glitch in #3143
  • benchmarking: dial atenet-router over SPIFFE mTLS on port 443 by @sairajp-rewind in #3089
  • Base images drop the distrusted eMudhra roots and the kind Jaeger moves to v2.22.0 by @dims in #3196
  • UpdateActor fails with Aborted while another operation on the actor is in progress by @zoez7 in #3131
  • e2e: lower kind atelet snapshot upload delay and update revert tests by @msau42 in #3182
  • atelet: emit a Warning Event on worker pods when syncing sandbox runtimes fails by @shrutiyam-glitch in #3146
  • Generate the actor identity CA with ECDSA P-256 so external relying parties accept it by @destijl in #3251
  • Releases publish the Kubernetes Secrets credential provider image by @MushuEE in #3220
  • Fix flake: retry adding the kill container on a conflict by @HavenXia in #3183
  • ateapi: deny streaming RPCs that have no authorization rule by @SHRUTI6991 in #3262
  • Rename SnapshotStorage.status to state by @laoj2 in #3215
  • An actor's new egress connections no longer fail with 403 an hour after it starts by @chw120 in #3144
  • Update agentgateway version to fix drift and CI by @keithmattix in #2962
  • Document ReportActorCrashed in the WorkerService authz table by @SHRUTI6991 in #3324
  • ate-setup: separate e2e kustomize component from kind overlay by @msau42 in #3318
  • e2e: test RevertActor across multiple durable snapshot generations by @nybidari in #3338
  • Assert HTTP/2 in egress CONNECT access log and reduce /mux concurrency by @bochengchu in #3339
  • The GCP Secret Manager credential provider moved to agent-substrate-plugins/credprovider-gcp-secret-manager by @BenTheElder in #3365
  • Add full name of sfunkenhauser to MAINTAINERS.md by @sfunkenhauser in #3384
  • UpdateActor rejects Actors marked for deletion by @laoj2 in #3341
  • CreateActor fails if [golden] tag is marked for deletion by @laoj2 in #3382
  • doc: add details on how a DNS denial from egress policy looks inside the actor by @yufan-su in #3363
  • The template reconciler skips templates marked for deletion by @laoj2 in #3342
  • benchmarking: remove default ATE_ENV_IMAGE and stop deploying ate-env template by default by @sairajp-rewind in #3366
  • Delete hack/install-ate.sh and hack/install-ate-kind.sh by @HavenXia in #3354
  • atelet: clear node-local caches after a node reboot by @igooch in #3376
  • Reject snapshotConfig.storageLocation without its preview gate by @Sneha-at in #3357
  • ate-api-server's --egress-gateway-spiffe-id is repeatable, and ate-setup sets it from ATE_EGRESS_GATEWAY_EXTRA_SPIFFE_IDS by @thompsonmax in #3360
  • site: align footer with CNCF website guidelines and update navbar GitHub button by @moficodes in #3426
  • objectstore-plugin: move the credential exchange's actor checks into actorauthz by @aramase in #3138
  • docs: say "no escape" from the sandbox on the ate.dev home page and security overview by @destijl in #3440
  • [release-1.0 Cherry-pick #3507: docs: clone the repo before quickstarting by @rikatz in https://github.com//pull/3512
  • [release-1.0] Cherry-pick #3442: docs: fix outdated statements in the egress guides by @yufan-su in #3516
  • Revert "[release-1.0] Cherry-pick 19 main changes through 5a5b192 (#3571)" by @dberkov in #3593
  • [release-1.0] Cherry-pick #2605 and #2911: Document actor JWT verification, federation, and key rotation by @thompsonmax in #3605
  • [release-1.0] Cherry-pick #3644: Update Copyright for CNCF. All Code was donated, accept only "The Agent Substrate Authors" going forward by @BenTheElder in #3661
  • [release-1.0] cherry pick: combine collaborating.md and contributing.md into the standard CONTRI… by @BenTheElder in #3662
  • Extend CONTRIBUTING.md to discuss compatibility by @thockin in #3697
  • [release-1.0] Cherry-pick #3642: Point the README GKE quickstart at the GKE installation guide by @BenTheElder in #3699

New Contributors

Full Changelog: v0.6.0...v1.0.0

Images

Container images for this release are published as ghcr.io/agent-substrate/substrate/<image>:v1.0.0 for linux/amd64 and linux/arm64. The images a release publishes are listed in Release images.

Install

From a checkout of v1.0.0, with Go, install the release images into the current kubectl context. On GKE, the default --sandbox-classes=gvisor,microvm downloads microVM guest assets from GitHub and uploads them with gcloud to gs://<bucket>-assets (created with atelet read access by tools/setup-gcp create bucket and create iam in https://github.com/ai-on-gke/substrate-gke). Add --kind for a kind cluster, or --sandbox-classes=gvisor to skip microVM staging. 

git clone --depth 1 --branch v1.0.0 https://github.com/agent-substrate/substrate.git
cd substrate
go run ./cmd/ate-setup deploy ate-system \
  --image-repo ghcr.io/agent-substrate/substrate --image-tag v1.0.0 \
  --storage-bucket-name=<bucket> \
  --credential-provider='{"name":"k8s.io"}' \
  --ingress-allowed-spiffe-ids=<SPIFFE IDs of your ingress clients>

See Installing pre-built images for the flags.

kubectl-ate

kubectl-ate is attached for Linux and macOS on amd64 and arm64. Download the binary for your platform and its .sha256 file, check it, and put it on your PATH as kubectl-ate: 

shasum -a 256 -c kubectl-ate-linux-amd64.sha256
install -m 0755 kubectl-ate-linux-amd64 ~/.local/bin/kubectl-ate

Committers in this release

Check out latest releases or
releases around agent-substrate/substrate v1.0.0

Don't miss a new substrate release

NewReleases is sending notifications on new releases.

Get notifications