ateapi: bracket IPv6 atelet addresses when dialing

cmd/ateapi/internal/controlapi/dialer.go

@@ -19,8 +19,11 @@ import (
 	"crypto/x509"
 	"errors"
 	"fmt"
+	"net"
 	"slices"
+	"strconv"
 
+	"github.com/agent-substrate/substrate/internal/ateletport"
 	"github.com/agent-substrate/substrate/internal/credbundle"
 	"github.com/agent-substrate/substrate/internal/substratex509"
 	"github.com/spiffe/go-spiffe/v2/bundle/x509bundle"
@@ -118,7 +121,7 @@ func (d *AteletDialer) DialForWorker(workerPodNamespace, workerPodName string) (
 	}
 
 	ateletConn, err := grpc.NewClient(
-		selectedAtelet.Status.PodIPs[0].IP+":8085",
+		net.JoinHostPort(selectedAtelet.Status.PodIPs[0].IP, strconv.Itoa(ateletport.Default)),
 		grpc.WithTransportCredentials(creds),
 		grpc.WithStatsHandler(otelgrpc.NewClientHandler()),
 	)

cmd/ateapi/internal/controlapi/dialer_test.go

@@ -21,6 +21,7 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
+	"errors"
 	"math/big"
 	"net/url"
 	"testing"
@@ -29,6 +30,12 @@ import (
 	"github.com/agent-substrate/substrate/internal/substratex509"
 	"github.com/spiffe/go-spiffe/v2/bundle/x509bundle"
 	"github.com/spiffe/go-spiffe/v2/spiffeid"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/credentials/insecure"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/tools/cache"
+	"k8s.io/utils/lru"
 )
 
 const testAteletSPIFFEID = "spiffe://cluster.local/ns/ate-system/sa/atelet"
@@ -126,6 +133,120 @@ func makeLeafCert(t *testing.T, ca *x509.Certificate, caKey *ecdsa.PrivateKey, o
 	return cert
 }
 
+// newDialerForPods builds an AteletDialer over static indexers holding the
+// given worker and atelet pods, with mTLS replaced by insecure credentials.
+func newDialerForPods(t *testing.T, workerPod, ateletPod *corev1.Pod) *AteletDialer {
+	t.Helper()
+
+	workerIndexer := cache.NewIndexer(cache.MetaNamespaceKeyFunc, cache.Indexers{
+		byNamespaceAndName: func(obj any) ([]string, error) {
+			pod := obj.(*corev1.Pod)
+			return []string{pod.ObjectMeta.Namespace + "/" + pod.ObjectMeta.Name}, nil
+		},
+	})
+	if err := workerIndexer.Add(workerPod); err != nil {
+		t.Fatalf("adding worker pod to indexer: %v", err)
+	}
+
+	ateletIndexer := cache.NewIndexer(cache.MetaNamespaceKeyFunc, cache.Indexers{
+		byNode: func(obj any) ([]string, error) {
+			pod := obj.(*corev1.Pod)
+			return []string{pod.Spec.NodeName}, nil
+		},
+	})
+	if err := ateletIndexer.Add(ateletPod); err != nil {
+		t.Fatalf("adding atelet pod to indexer: %v", err)
+	}
+
+	return &AteletDialer{
+		workerIndexer: workerIndexer,
+		ateletIndexer: ateletIndexer,
+		ateletConns:   lru.New(16),
+		dialCredentials: func(string) (credentials.TransportCredentials, error) {
+			return insecure.NewCredentials(), nil
+		},
+	}
+}
+
+func TestDialForWorkerTarget(t *testing.T) {
+	tests := []struct {
+		name       string
+		ateletIP   string
+		wantTarget string
+	}{
+		{
+			name:       "IPv4 atelet",
+			ateletIP:   "10.244.1.7",
+			wantTarget: "10.244.1.7:8085",
+		},
+		{
+			name:       "IPv6 atelet is bracketed",
+			ateletIP:   "fd00:10:244::7",
+			wantTarget: "[fd00:10:244::7]:8085",
+		},
+		{
+			name:       "IPv6 loopback is bracketed",
+			ateletIP:   "::1",
+			wantTarget: "[::1]:8085",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			workerPod := &corev1.Pod{
+				ObjectMeta: metav1.ObjectMeta{Namespace: "team-a", Name: "worker-1", UID: "worker-uid"},
+				Spec:       corev1.PodSpec{NodeName: "node-1"},
+			}
+			ateletPod := &corev1.Pod{
+				ObjectMeta: metav1.ObjectMeta{Namespace: ateletNamespace, Name: "atelet-abc", UID: "atelet-uid"},
+				Spec:       corev1.PodSpec{NodeName: "node-1"},
+				Status:     corev1.PodStatus{PodIPs: []corev1.PodIP{{IP: tc.ateletIP}}},
+			}
+
+			d := newDialerForPods(t, workerPod, ateletPod)
+			conn, err := d.DialForWorker("team-a", "worker-1")
+			if err != nil {
+				t.Fatalf("DialForWorker returned error: %v", err)
+			}
+			t.Cleanup(func() { conn.Close() })
+
+			if got := conn.Target(); got != tc.wantTarget {
+				t.Errorf("dial target = %q, want %q", got, tc.wantTarget)
+			}
+		})
+	}
+}
+
+func TestDialForWorkerErrors(t *testing.T) {
+	workerPod := &corev1.Pod{
+		ObjectMeta: metav1.ObjectMeta{Namespace: "team-a", Name: "worker-1", UID: "worker-uid"},
+		Spec:       corev1.PodSpec{NodeName: "node-1"},
+	}
+
+	t.Run("unknown worker pod", func(t *testing.T) {
+		ateletPod := &corev1.Pod{
+			ObjectMeta: metav1.ObjectMeta{Namespace: ateletNamespace, Name: "atelet-abc", UID: "atelet-uid"},
+			Spec:       corev1.PodSpec{NodeName: "node-1"},
+			Status:     corev1.PodStatus{PodIPs: []corev1.PodIP{{IP: "10.244.1.7"}}},
+		}
+		d := newDialerForPods(t, workerPod, ateletPod)
+		if _, err := d.DialForWorker("team-a", "no-such-worker"); !errors.Is(err, ErrWorkerPodNotFound) {
+			t.Fatalf("DialForWorker error = %v, want ErrWorkerPodNotFound", err)
+		}
+	})
+
+	t.Run("atelet without assigned IPs", func(t *testing.T) {
+		ateletPod := &corev1.Pod{
+			ObjectMeta: metav1.ObjectMeta{Namespace: ateletNamespace, Name: "atelet-abc", UID: "atelet-uid"},
+			Spec:       corev1.PodSpec{NodeName: "node-1"},
+		}
+		d := newDialerForPods(t, workerPod, ateletPod)
+		if _, err := d.DialForWorker("team-a", "worker-1"); err == nil {
+			t.Fatal("DialForWorker succeeded, want error for atelet with no IPs")
+		}
+	})
+}
+
 func TestVerifyAteletServerCert(t *testing.T) {
 	ca, caKey, bundle := makeTestCA(t)
 	otherCA, otherCAKey, _ := makeTestCA(t)

cmd/atelet/main.go

@@ -36,6 +36,7 @@ import (
 	"github.com/agent-substrate/substrate/cmd/atelet/internal/ategcs"
 	"github.com/agent-substrate/substrate/internal/ateerrors"
 	"github.com/agent-substrate/substrate/internal/ateinterceptors"
+	"github.com/agent-substrate/substrate/internal/ateletport"
 	"github.com/agent-substrate/substrate/internal/ateompath"
 	"github.com/agent-substrate/substrate/internal/credbundle"
 	"github.com/agent-substrate/substrate/internal/imagecache"
@@ -67,7 +68,7 @@ import (
 )
 
 var (
-	port              = pflag.Int("port", 8085, "The port to listen on")
+	port              = pflag.Int("port", ateletport.Default, "The port to listen on")
 	metricsListenAddr = pflag.String("metrics-listen-addr", ":9090", "Address and port the prometheus metrics server should listen on.")
 
 	grpcServerCredBundle = pflag.String("grpc-server-cred-bundle", "/run/podidentity.podcert.ate.dev/credential-bundle.pem", "Credential bundle atelet presents as its gRPC serving certificate.")

cmd/atelet/main_test.go

@@ -25,18 +25,21 @@ import (
 	"net"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"syscall"
 	"testing"
 	"time"
 
 	"github.com/agent-substrate/substrate/internal/ateerrors"
+	"github.com/agent-substrate/substrate/internal/ateletport"
 	"github.com/agent-substrate/substrate/internal/ateompath"
 	"github.com/agent-substrate/substrate/internal/proto/ateletpb"
 	"github.com/agent-substrate/substrate/internal/proto/ateompb"
 	"github.com/agent-substrate/substrate/internal/serverboot"
 	"github.com/google/go-cmp/cmp"
 	"github.com/klauspost/compress/zstd"
+	"github.com/spf13/pflag"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials/insecure"
@@ -45,6 +48,18 @@ import (
 	"google.golang.org/protobuf/types/known/emptypb"
 )
 
+// TestPortFlagDefault guards against the --port default drifting away from the
+// port ateapi dials (cmd/ateapi/internal/controlapi/dialer.go).
+func TestPortFlagDefault(t *testing.T) {
+	f := pflag.Lookup("port")
+	if f == nil {
+		t.Fatal("no --port flag registered")
+	}
+	if want := strconv.Itoa(ateletport.Default); f.DefValue != want {
+		t.Errorf("--port default = %q, want %q", f.DefValue, want)
+	}
+}
+
 func TestSnapshotManifestActorMetadata(t *testing.T) {
 	rec := sandboxAssetsRecord{
 		Atespace:               "team-a",

internal/ateletport/ateletport.go

@@ -0,0 +1,27 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package ateletport defines the port atelet's gRPC server listens on, which
+// ateapi and atelet have to agree on.
+package ateletport
+
+const (
+	// Default is the port atelet's gRPC server listens on: it is the default of
+	// atelet's --port flag (cmd/atelet/main.go) and the port ateapi dials when
+	// it connects to an atelet
+	// (cmd/ateapi/internal/controlapi/dialer.go). It is deliberately untyped so
+	// callers can use it as an int (the flag default) or convert it to a string
+	// (the dialed address) without a cast.
+	Default = 8085
+)