Issues

• Support replacing built-in egress policy enforcement with an external ext_proc

  agent-substrate/substrate#3040 · Filter by author sambhav opened on Oct 21, 2026

• [Medium] Restrict Tag creation, publishing, and cloning in OpenFGA to prevent cross-actor secret exfiltration by atespace editors

  area/api-machineryarea/securitykind/feature
  agent-substrate/substrate#3035 · Filter by author destijl opened on Oct 21, 2026
  1

  

• [Low] Guard MaxExpirationSeconds nil pointer and minimum lifetime in podidentitysigner and servicednssigner

  area/securitykind/bug
  agent-substrate/substrate#3034 · Filter by author destijl opened on Oct 21, 2026
  

• [Low] Bind k8s-credential-provider /statusz to 127.0.0.1:4040 by default

  area/networkarea/securitykind/bug
  agent-substrate/substrate#3033 · Filter by author destijl opened on Oct 21, 2026
  

• [Medium] Reload actor-identity CA bundle (actor-id-ca-certs) on rotation in atenet-egress and atenet-router

  area/networkarea/securitykind/bug
  agent-substrate/substrate#3032 · Filter by author destijl opened on Oct 21, 2026
  

• [Medium] Bind WorkerSupport.GetActorEgressPolicy to the hosting worker and node

  area/nodearea/securitykind/bug
  agent-substrate/substrate#3031 · Filter by author destijl opened on Oct 21, 2026
  1

  

• [Security] imagecache serves any cached image by digest alone: a template can run another tenant's image under any repository name with no pull authorization

  area/nodearea/securitykind/bug
  agent-substrate/substrate#3017 · Filter by author aditya-shantanu opened on Oct 20, 2026
  1

• [CI] - Automate Go toolchain updates

  agent-substrate/substrate#3013 · Filter by author MushuEE opened on Oct 20, 2026
  5

• api: report worker runtimes per sandbox class (WorkerSandboxClass, WorkerSandboxRuntime, ActorSandboxRuntime)

  area/apiarea/api-machinery
  agent-substrate/substrate#3008 · Filter by author shrutiyam-glitch opened on Oct 20, 2026
  1

  

• Worker drain cancels an in-flight gVisor restore and crashes the actor: runsc restore dies with 'signal: killed' and is reported as Internal

  area/api-machineryarea/gvisorarea/nodearea/reliabilitykind/bug
  agent-substrate/substrate#3001 · Filter by author aditya-shantanu opened on Oct 20, 2026

• Per-actor named netns in /run/netns serialize gVisor activations on dense nodes

  agent-substrate/substrate#2997 · Filter by author pmandewalkar opened on Oct 20, 2026

• A bundled PostgreSQL pod restart leaves ate-api-server NotReady and failing for 2 minutes: pgx dials the stale pod IP with no connect timeout

  area/api-machineryarea/reliabilitykind/bug
  agent-substrate/substrate#2995 · Filter by author aditya-shantanu opened on Oct 20, 2026
  1

• Concurrent 1 GiB sync suspends saturate the node boot disk: suspend p95 64 s, atelet cleanup phase 30 to 60 s, kubelet image pulls stall for minutes

  area/gvisorarea/nodearea/reliabilityarea/storagekind/bug
  agent-substrate/substrate#2994 · Filter by author aditya-shantanu opened on Oct 20, 2026

• atelet: let the shared snapshot cache live on a dedicated snapshot disk

  agent-substrate/substrate#2992 · Filter by author roycaihw opened on Oct 20, 2026

• Design and publish authz KPI metrics in ATE API server

  agent-substrate/substrate#2990 · Filter by author SHRUTI6991 opened on Oct 20, 2026

• atelet: one eviction coordinator over the node's disk for the image, asset and snapshot caches (M4 of the cache design, for discussion)

  agent-substrate/substrate#2987 · Filter by author dberkov opened on Oct 20, 2026

• ResumeActor: restore with the workload held until released

  kind/feature
  agent-substrate/substrate#2986 · Filter by author mayawang opened on Oct 20, 2026

• Egress: present a client certificate when originating TLS to a destination

  kind/feature
  agent-substrate/substrate#2985 · Filter by author mayawang opened on Oct 20, 2026

• [Bug]: RevertActor discards local/PENDING snapshots from async SuspendActor and behaves inconsistently on SUSPENDED actors

  kind/bug
  agent-substrate/substrate#2983 · Filter by author zoez7 opened on Oct 20, 2026

• [Bug]: benchmarking: orchestrator.py does not set ATE_INGRESS_ALLOWED_SPIFFE_IDS

  area/benchmarkingkind/bug
  agent-substrate/substrate#2975 · Filter by author sairajp-rewind opened on Oct 20, 2026

• atelet: keep shared snapshot images resident outside any actor's cgroup so golden resumes skip the disk read

  area/gvisorarea/nodearea/storagekind/feature
  agent-substrate/substrate#2974 · Filter by author dberkov opened on Oct 20, 2026
  1

• [Bug]: An actor stays RUNNING after its only container exits

  area/microVMarea/nodearea/reliabilitykind/bug
  agent-substrate/substrate#2972 · Filter by author mayawang opened on Oct 20, 2026

• ateapi, atelet: retried actor delete gets EBUSY when volumes were deleted after a failed Terminate

  area/api-machineryarea/nodearea/storagekind/bug
  agent-substrate/substrate#2971 · Filter by author roycaihw opened on Oct 20, 2026

• e2e: TestIngressAuthentication/https is flaky

  area/networkarea/testskind/bug
  agent-substrate/substrate#2968 · Filter by author zoez7 opened on Oct 20, 2026
  2

• UnmountAllUnder reads all of /proc/self/mountinfo on every call, which contends with mounts on dense gVisor nodes

  area/gvisorarea/nodekind/bug
  agent-substrate/substrate#2950 · Filter by author pmandewalkar opened on Oct 20, 2026
  1