chart: regenerate manifests/ate-install/ from current Helm chart

Re-runs `make helm-template` so the checked-in render matches the
chart. Brings in rustfs.yaml, the s3-backed atelet storage envvars,
the trimmed valkey manifest, and drops the no-longer-templated
sandboxconfig-gvisor and sandboxconfig-validation manifests.
`make verify-helm-template` now passes.

Author: jjamroga

manifests/ate-install/ate-api-server-envvars.yaml

@@ -25,4 +25,4 @@ data:
   ATE_API_REDIS_USE_IAM_AUTH: "false"
   ATE_API_REDIS_TLS_SERVER_NAME: ""
   ATE_API_REDIS_CLIENT_CERT: ""
-  ATE_API_K8SJWT_ISSUER: ""
+  ATE_API_K8SJWT_ISSUER: "https://kubernetes.default.svc.cluster.local"

manifests/ate-install/ate-api-server.yaml

@@ -32,9 +32,6 @@ rules:
 - apiGroups: ["ate.dev"]
   resources: ["actortemplates", "workerpools", "sandboxconfigs"]
   verbs: ["get", "watch", "list"]
-- apiGroups: ["ate.dev"]
-  resources: ["workerpools"]
-  verbs: ["get", "watch", "list"]
 # Secret reads for env source resolution are intentionally NOT granted
 # cluster-wide here. Each demo / tenant is responsible for granting
 # ate-api-server read access only to the specific Secrets referenced by its
@@ -104,6 +101,10 @@ spec:
         - "--session-id-jwt-pool=/run/session-id-jwt-pool/pool.json"
         - "--session-id-ca-pool=/run/session-id-ca-pool/pool.json"
         - "--workerpool-ca-certs=/run/workerpool-ca-certs/trust-bundle.pem"
+        # Pass the chart-resolved namespace so the atelet pod informer
+        # watches the correct namespace when substrate is installed as a
+        # subchart (the binary default is "ate-system").
+        - "--atelet-namespace=ate-system"
         env:
         - name: POD_NAME
           valueFrom:

manifests/ate-install/ate-controller.yaml

@@ -71,6 +71,13 @@ spec:
       containers:
       - name: ate-controller
         image: ko://github.com/agent-substrate/substrate/cmd/atecontroller
+        args:
+        # The atecontroller binary defaults --ateapi-conn-spec to
+        # dns:///api.ate-system.svc:443, which is correct only for the
+        # canonical render (release name "substrate" in namespace
+        # "ate-system"). Pass the chart-resolved Service so the controller
+        # dials the right backend when substrate is installed as a subchart.
+        - "--ateapi-conn-spec=dns:///api.ate-system.svc:443"
         ports:
         - name: metrics
           containerPort: 8080

manifests/ate-install/atelet.yaml

@@ -77,7 +77,17 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: ATE_STORAGE_BACKEND
-          value: "gcs"
+          value: "s3"
+        - name: AWS_REGION
+          value: us-east-1
+        - name: AWS_ENDPOINT_URL
+          value: http://rustfs.ate-system.svc:9000
+        - name: AWS_S3_USE_PATH_STYLE
+          value: "true"
+        - name: AWS_ACCESS_KEY_ID
+          value: "rustfsadmin"
+        - name: AWS_SECRET_ACCESS_KEY
+          value: "rustfsadmin"
         ports:
         - name: grpc
           containerPort: 8085

manifests/ate-install/atenet-dns.yaml

@@ -170,6 +170,11 @@ spec:
         - "--log-level=debug"
         - "--interval=10s"
         - "--corefile-path=/etc/coredns/Corefile"
+        # Pass the chart-resolved names/namespace so the controller looks up
+        # the correct Services when substrate is installed as a subchart.
+        - "--system-namespace=ate-system"
+        - "--router-service-name=atenet-router"
+        - "--dns-service-name=dns"
         volumeMounts:
         - name: dns-config-volume
           mountPath: /etc/coredns

manifests/ate-install/atenet-router.yaml

@@ -161,6 +161,9 @@ spec:
         - "--standalone"
         - "--networking-mode=agentgateway"
         - "--namespace=ate-system"
+        # Pass the chart-resolved router Service name so /statusz looks up the
+        # correct Service when substrate is installed as a subchart.
+        - "--router-service-name=atenet-router"
         - "--port-http=8080"
         - "--port-extproc=50051"
         - "--extproc-address=127.0.0.1"

manifests/ate-install/rustfs.yaml

@@ -0,0 +1,136 @@
+#  Copyright 2026 Google LLC
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+# DO NOT EDIT — generated from charts/substrate by hack/render-manifests.sh.
+# Run `make helm-template` to regenerate.
+
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: rustfs-data
+  namespace: ate-system
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: rustfs
+  namespace: ate-system
+spec:
+  selector:
+    app: rustfs
+  ports:
+  - name: api
+    port: 9000
+    targetPort: 9000
+  - name: console
+    port: 9001
+    targetPort: 9001
+  type: ClusterIP
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rustfs
+  namespace: ate-system
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: rustfs
+  template:
+    metadata:
+      labels:
+        app: rustfs
+    spec:
+      securityContext:
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+      containers:
+      - name: rustfs
+        image: rustfs/rustfs:1.0.0-beta.3@sha256:378642b05b7dcb4849fb77ebe6aca4ced1c3f66e7e504247df95a5c9018d3358
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 9000
+          name: api
+        - containerPort: 9001
+          name: console
+        env:
+        - name: RUSTFS_ADDRESS
+          value: ":9000"
+        - name: RUSTFS_CONSOLE_ADDRESS
+          value: ":9001"
+        - name: RUSTFS_CONSOLE_ENABLE
+          value: "true"
+        - name: RUSTFS_VOLUMES
+          value: "/data"
+        - name: RUSTFS_ACCESS_KEY
+          value: "rustfsadmin"
+        - name: RUSTFS_SECRET_KEY
+          value: "rustfsadmin"
+        volumeMounts:
+        - name: data
+          mountPath: /data
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: rustfs-data
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: rustfs-bucket-init
+  namespace: ate-system
+spec:
+  backoffLimit: 10
+  template:
+    spec:
+      restartPolicy: OnFailure
+      containers:
+      - name: create-bucket
+        image: amazon/aws-cli:2.17.0@sha256:643507c10ada7964ca6157b3d799f030b90577643da9955d319a77399ed80d73
+        env:
+        - name: AWS_ACCESS_KEY_ID
+          value: "rustfsadmin"
+        - name: AWS_SECRET_ACCESS_KEY
+          value: "rustfsadmin"
+        - name: AWS_REGION
+          value: us-east-1
+        - name: AWS_ENDPOINT_URL
+          value: http://rustfs.ate-system.svc:9000
+        command:
+        - /bin/sh
+        - -c
+        - |
+          set -e
+          for i in $(seq 1 60); do
+            if aws s3api head-bucket --bucket ate-snapshots 2>/dev/null; then
+              echo "bucket ate-snapshots already exists"
+              exit 0
+            fi
+            if aws s3api create-bucket --bucket ate-snapshots 2>/dev/null; then
+              echo "bucket ate-snapshots created"
+              exit 0
+            fi
+            echo "waiting for rustfs to become available... ($i/60)"
+            sleep 2
+          done
+          echo "timed out waiting for rustfs"
+          exit 1

manifests/ate-install/sandboxconfig-gvisor.yaml

@@ -33,8 +33,6 @@ data:
     tls-key-file /run/servicedns.podcert.ate.dev/credential-bundle.pem
     tls-ca-cert-file /etc/valkey-ca/ca.crt
     tls-auth-clients yes
-    # Reload the cert every 12h.
-    tls-auto-reload-interval 43200
 
     # Enable cluster mode
     cluster-enabled yes
@@ -92,21 +90,8 @@ spec:
     spec:
       containers:
       - name: valkey
-        image: valkey/valkey:9.1@sha256:4963247afc4cd33c7d3b2d2816b9f7f8eeebab148d29056c2ca4d7cbc966f2d9
-        command:
-        - /bin/sh
-        - -c
-        - |
-          set -e
-          POD_DNS="${HOSTNAME}.valkey-cluster-service.ate-system.svc"
-          cp /etc/valkey/valkey.conf /tmp/valkey.conf
-          {
-            echo "cluster-announce-hostname ${POD_DNS}"
-            echo "cluster-announce-tls-port 6379"
-            echo "cluster-announce-bus-port 16379"
-            echo "cluster-preferred-endpoint-type hostname"
-          } >> /tmp/valkey.conf
-          exec valkey-server /tmp/valkey.conf
+        image: valkey/valkey:8.0
+        command: ["valkey-server", "/etc/valkey/valkey.conf"]
         ports:
         - name: valkey
           containerPort: 6379
@@ -164,7 +149,7 @@ spec:
       restartPolicy: OnFailure
       containers:
       - name: init
-        image: valkey/valkey:9.1@sha256:4963247afc4cd33c7d3b2d2816b9f7f8eeebab148d29056c2ca4d7cbc966f2d9
+        image: valkey/valkey:8.0
         volumeMounts:
         - name: servicedns
           mountPath: /run/servicedns.podcert.ate.dev
@@ -184,10 +169,11 @@ spec:
             done
           done
 
-          echo "All pods resolved. Building stable node list..."
-          VALKEY_NODES=""
+          echo "All pods resolved. Getting IPs..."
+          POD_IPS=""
           for i in 0 1 2 3 4 5; do
-            VALKEY_NODES="${VALKEY_NODES} valkey-cluster-${i}.valkey-cluster-service.ate-system.svc:6379"
+            ip=$(getent hosts valkey-cluster-${i}.valkey-cluster-service.ate-system.svc | awk '{print $1}')
+            POD_IPS="${POD_IPS} ${ip}:6379"
           done
 
           echo "Checking if Valkey cluster is already initialized..."
@@ -204,7 +190,7 @@ spec:
               --cacert /etc/valkey-ca/ca.crt \
               --cert /run/servicedns.podcert.ate.dev/credential-bundle.pem \
               --key /run/servicedns.podcert.ate.dev/credential-bundle.pem \
-              --cluster create ${VALKEY_NODES} \
+              --cluster create ${POD_IPS} \
               --cluster-replicas 1 \
               --cluster-yes
             echo "Cluster initialization complete!"