ActorIdentity: protos, cert issuance, actorIdentity x509 extension

benchmarking/locust/codegen/requirements.txt

@@ -0,0 +1,29 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Build-time dependencies for generate_protos.sh. Kept apart from the load
+# test's runtime requirements.txt so that regenerating the protos does not pull
+# in locust, the opentelemetry exporters and google-cloud-storage.
+#
+# grpcio-tools bundles protoc along with the Python and gRPC codegen plugins.
+# It is pinned because the version stamped into the generated files
+# ("Protobuf Python Version" in *_pb2.py, GRPC_GENERATED_VERSION in
+# *_pb2_grpc.py) is whatever the generating machine happened to install: left
+# unpinned, the checked-in gencode changes depending on who ran the script.
+#
+# Bumping this pin is a deliberate act: raise it, regenerate, and keep the
+# floors in ../requirements.txt at or above the versions the new gencode
+# reports, since the protobuf runtime refuses to load gencode newer than
+# itself.
+grpcio-tools==1.81.1

benchmarking/locust/common/ateapi_pb2_grpc.py

@@ -19,7 +19,7 @@
 
 from . import ateapi_pb2 as ateapi__pb2
 
-GRPC_GENERATED_VERSION = '1.82.1'
+GRPC_GENERATED_VERSION = '1.81.1'
 GRPC_VERSION = grpc.__version__
 _version_not_supported = False
 
@@ -1011,8 +1011,18 @@ def MintJWT(self, request, context):
         raise NotImplementedError('Method not implemented!')
 
     def MintCert(self, request, context):
-        """Request an Actor Identity Certificate. To call this RPC, you must have
-        authenticated with a client certificate, not a bearer token.
+        """Request an Actor Identity Certificate for an actor.
+
+        Actors do not call this RPC themselves. The atelet hosting the actor calls
+        it on the actor's behalf, authenticating with its own client certificate
+        rather than a bearer token.
+
+        Authorization is decided on that client certificate: it must identify the
+        atelet running on the same node as the worker Pod that currently hosts the
+        requested actor, and the actor must still be running. Any other caller is
+        rejected with PERMISSION_DENIED.
+
+        The certificate in the response is the actor's identity, not the atelet's.
         """
         context.set_code(grpc.StatusCode.UNIMPLEMENTED)
         context.set_details('Method not implemented!')

benchmarking/locust/generate_protos.sh

@@ -26,7 +26,12 @@ fi
 
 OUT_DIR="benchmarking/locust/common"
 
-VENV_DIR="benchmarking/locust/venv"
+# Codegen has its own venv and requirements, separate from the load test's
+# runtime ones: the only thing needed to compile a .proto is grpcio-tools, and
+# installing the runtime list here would drag in locust, the opentelemetry
+# exporters and google-cloud-storage for nothing.
+CODEGEN_DIR="benchmarking/locust/codegen"
+VENV_DIR="${CODEGEN_DIR}/venv"
 if [ ! -d "$VENV_DIR" ]; then
   echo "Creating virtual environment in $VENV_DIR..."
   python3 -m venv "$VENV_DIR"
@@ -63,8 +68,13 @@ generate_proto() {
 
   # protoc emits `import foo_pb2 as foo__pb2`, which doesn't resolve under our
   # `common` package; rewrite to a relative import.
+  #
+  # Written through a temp file rather than `sed -i`, whose spelling differs
+  # between GNU sed (`-i`) and the BSD sed on macOS (`-i ''`).
   if [ -f "${grpc_file}" ]; then
-    sed -i "s/^import ${proto_base}_pb2 as ${proto_base}__pb2/from . import ${proto_base}_pb2 as ${proto_base}__pb2/" "${grpc_file}"
+    sed "s/^import ${proto_base}_pb2 as ${proto_base}__pb2/from . import ${proto_base}_pb2 as ${proto_base}__pb2/" \
+      "${grpc_file}" > "${grpc_file}.tmp"
+    mv "${grpc_file}.tmp" "${grpc_file}"
   fi
 }
 
@@ -74,9 +84,13 @@ generate_proto() {
 (
   echo "Activating virtual environment..."
   source "$VENV_DIR/bin/activate"
-  echo "Installing dependencies from benchmarking/locust/requirements.txt..."
+  echo "Installing dependencies from ${CODEGEN_DIR}/requirements.txt..."
   pip install --upgrade pip
-  pip install -r benchmarking/locust/requirements.txt
+  # The requirement is pinned, so an existing venv already holding that exact
+  # version is left alone and a venv holding any other version is corrected.
+  # (An unpinned requirement would instead be satisfied by whatever is already
+  # installed, which is how the generated files came to drift.)
+  pip install -r "${CODEGEN_DIR}/requirements.txt"
 
   generate_proto "pkg/proto/ateapipb" "ateapi"
   generate_proto "internal/proto/glutton" "glutton"

benchmarking/locust/requirements.txt

@@ -13,13 +13,13 @@
 # limitations under the License.
 
 locust==2.32.7
-grpcio
 prometheus-client
 opentelemetry-api
 opentelemetry-sdk
 opentelemetry-exporter-prometheus
-protobuf
-grpcio-tools
+protobuf>=6.33.5
+grpcio>=1.81.1
+
 opentelemetry-exporter-otlp
 opentelemetry-instrumentation-grpc
 opentelemetry-instrumentation-requests