Run `Claude Code Multiplex Demo`, the `/api/actors` response `missing bearer token`

[dk-lockdown]

Expected Behavior

Get actors

Actual Behavior

ateClient.ListActors(ctx, &ateapipb.ListActorsRequest{}) needs jwtToken

Steps to Reproduce the Problem

1. kubectl port-forward svc/api 8080:443 -n ate-system
2. ANTHROPIC_API_KEY=sk-3f0b77ee277645e29b6471eb1f328282 \ BUCKET_NAME=ate-snapshots \ ./hack/install-ate.sh --deploy-demo-claude-code-multiplex
3. cd demos/claude-code-multiplex/ui PORT=8090 ATEAPI_ADDR=localhost:8080 go run .

Specifications

• Version:
• Platform:

[maxsmythe]

It looks like we've updated the API to require authorization.

substrate/internal/ateclient/builder.go

Lines 234 to 250 in 3a2d0c1

	func bearerTokenDialOption(ctx context.Context, clientset *kubernetes.Clientset) (grpc.DialOption, error) {
	expirationSeconds := int64(3600)
	tokenRequest := &authv1.TokenRequest{
	Spec: authv1.TokenRequestSpec{
	Audiences: []string{apiServerName},
	ExpirationSeconds: &expirationSeconds,
	},
	}
	token, err := clientset.CoreV1().ServiceAccounts("ate-system").CreateToken(ctx, "ate-client", tokenRequest, metav1.CreateOptions{})
	if err != nil {
	return nil, fmt.Errorf("failed to request ateapi bearer token: %w", err)
	}
	if token.Status.Token == "" {
	return nil, fmt.Errorf("failed to request ateapi bearer token: token response was empty")
	}
	return grpc.WithPerRPCCredentials(bearerTokenCreds(token.Status.Token)), nil
	}

Seems like the demo's dialer

substrate/demos/claude-code-multiplex/ui/server.go

Lines 166 to 177 in 3a2d0c1

	// dialAteAPI opens a gRPC client to the substrate ateapi service.
	// Mirrors demos/sandbox/client/main.go: TLS with InsecureSkipVerify
	// (ateapi serves a self-signed cert; the demo trusts whichever
	// instance the port-forward / in-cluster DNS resolves to).
	func dialAteAPI(endpoint string) (ateapipb.ControlClient, *grpc.ClientConn, error) {
	creds := credentials.NewTLS(&tls.Config{InsecureSkipVerify: true})
	conn, err := grpc.NewClient(endpoint, grpc.WithTransportCredentials(creds))
	if err != nil {
	return nil, nil, err
	}
	return ateapipb.NewControlClient(conn), conn, nil
	}

could be updated to use the standard dialer to avoid this in the future?

substrate/internal/ateclient/builder.go

Lines 103 to 139 in 3a2d0c1

	func dialDirect(ctx context.Context, kubeconfigPath, k8sContext, endpoint string, traceEnabled bool) (*Client, error) {
	clientset, err := NewK8sClientset(kubeconfigPath, k8sContext)
	if err != nil {
	return nil, fmt.Errorf("failed to create k8s client: %w", err)
	}
	// Verify the server before attaching the bearer token below: the token
	// must never be sent over an unauthenticated channel.
	tlsCfg, err := serverTLSConfig(ctx, clientset)
	if err != nil {
	return nil, err
	}
	var opts []grpc.DialOption
	opts = append(opts, grpc.WithTransportCredentials(credentials.NewTLS(tlsCfg)))
	opts = append(opts, grpc.WithStatsHandler(otelgrpc.NewClientHandler()))
	tokenOpt, err := bearerTokenDialOption(ctx, clientset)
	if err != nil {
	return nil, err
	}
	opts = append(opts, tokenOpt)
	if traceEnabled {
	opts = append(opts, grpc.WithUnaryInterceptor(newTraceInterceptor()))
	}
	conn, err := grpc.NewClient(endpoint, opts...)
	if err != nil {
	return nil, fmt.Errorf("failed to dial manual endpoint: %w", err)
	}
	return &Client{
	ControlClient: ateapipb.NewControlClient(conn),
	DebugClient: ateapipb.NewDebugClient(conn),
	conn: conn,
	cancel: func() {},
	}, nil
	}

Maya Wang (@mayawang) know anyone with free cycles?

[a4-a4s1]

Thanks Max Smythe (@maxsmythe) — that's exactly it. The demo was carrying its own dialAteAPI (InsecureSkipVerify TLS, no bearer token), so it broke the moment ateapi started requiring authorization.

Fix up in #875: demos/claude-code-multiplex/ui/server.go now dials through internal/ateclient.NewClient — the standard authorized path you pointed at (SA-token mint + ClusterTrustBundle serving-cert verification). Empty ATEAPI_ADDR auto-port-forwards to svc/api in ate-system; setting it targets an already-forwarded endpoint, still authenticated. Dropped the now-dead crypto/tls/grpc/credentials imports. go build + go vet clean on the demo package.

[🤖a4s1]