install: add --experimental-use-sdsmint to select the egress manifest

hack/install-ate.sh

@@ -70,6 +70,10 @@ function usage() {
   echo "  --atenet-router=envoy|agentgateway     Select the atenet router dataplane (default: envoy)"
   echo "  --store-backend=redis|postgres         Configure the ateapi store backend (default: redis)"
   echo ""
+  echo "Experiments:"
+  echo ""
+  echo "  --experimental-use-sdsmint             Deploy the egress gateway with per-SNI certificate minting (experimental)"
+  echo ""
   echo "Infrastructure components:"
   echo ""
   echo "  --deploy-atelet                        Deploy atelet only"
@@ -234,6 +238,20 @@ render_atenet_router_manifest() {
   fi
 }
 
+# atenet_egress_manifest echoes the path of the egress manifest to deploy:
+# the sdsmint variant under --experimental-use-sdsmint, the shipped one
+# otherwise. The two are whole files rather than a Kustomize overlay because
+# what differs between them is envoy.yaml, which lives as one inline string in
+# the atenet-egress ConfigMap; Kustomize can replace that string but cannot
+# patch into it, so an overlay would carry a full copy of it anyway.
+atenet_egress_manifest() {
+  if [[ "${ATE_EXPERIMENTAL_USE_SDSMINT:-false}" == "true" ]]; then
+    echo "manifests/ate-install/atenet-egress-with-sdsmint.yaml"
+  else
+    echo "manifests/ate-install/atenet-egress.yaml"
+  fi
+}
+
 # Apply the ate-otel-config ConfigMap that every control plane component reads
 # via envFrom. The full install gets it through render_ate_system_manifests, but
 # the targeted single-component redeploys below apply raw manifests with no
@@ -499,6 +517,11 @@ deploy_ate_system() {
   manifests="$(render_ate_system_manifests)"
   echo "${manifests}" | run_kubectl apply -f -
 
+  # Applied on its own rather than through the overlay above, so
+  # --experimental-use-sdsmint composes with every overlay instead of needing a
+  # variant of each.
+  run_ko apply -f "$(atenet_egress_manifest)"
+
   log_step "Waiting for ATE system components to be ready..."
   case "$(store_backend)" in
     redis)
@@ -586,7 +609,7 @@ deploy_atenet() {
   router_manifest="$(render_atenet_router_manifest)"
   echo "${router_manifest}" | run_kubectl apply -f -
 
-  run_ko apply -f manifests/ate-install/atenet-egress.yaml
+  run_ko apply -f "$(atenet_egress_manifest)"
   run_ko apply -f manifests/ate-install/atenet-dns.yaml
   run_kubectl rollout status deployment/atenet-router -n ate-system --timeout=120s
   run_kubectl rollout status deployment/atenet-egress -n ate-system --timeout=120s
@@ -710,7 +733,12 @@ delete_atenet() {
   run_kubectl delete --ignore-not-found -f manifests/ate-install/atenet-router.yaml
   run_kubectl delete --ignore-not-found \
     -f manifests/ate-install/components/agentgateway/configmap.yaml
+  # Both egress variants, not the selected one: teardown has to clean up an
+  # install made with --experimental-use-sdsmint whether or not this invocation
+  # passes it, and either file may declare resources the other does not.
   run_kubectl delete --ignore-not-found -f manifests/ate-install/atenet-egress.yaml
+  run_kubectl delete --ignore-not-found \
+    -f manifests/ate-install/atenet-egress-with-sdsmint.yaml
   run_kubectl delete --ignore-not-found -f manifests/ate-install/atenet-dns.yaml
 }
 
@@ -788,6 +816,7 @@ for ((i = 0; i < ${#prescan_args[@]}; i++)); do
       fi
       ATE_ATENET_ROUTER="${prescan_args[$((i + 1))]}"
       ;;
+    --experimental-use-sdsmint) ATE_EXPERIMENTAL_USE_SDSMINT=true ;;
     --store-backend=*) ATE_INSTALL_STORE_BACKEND="${prescan_args[i]#*=}" ;;
     --store-backend)
       if (( i + 1 >= ${#prescan_args[@]} )); then
@@ -859,6 +888,9 @@ while [[ "$#" -gt 0 ]]; do
       fi
       ATE_ATENET_ROUTER="$1"
       ;;
+    # Captured in the pre-scan above; matched here only so the `*)` branch does
+    # not reject it as an unknown option.
+    --experimental-use-sdsmint) ;;
     --store-backend=*) ATE_INSTALL_STORE_BACKEND="${1#*=}" ;;
     --store-backend)
       shift