From bf3abd5d29535569ed678392fde019dbaee949b8 Mon Sep 17 00:00:00 2001
From: Alex Novak <anovak@hioscar.com>
Date: Wed, 4 Nov 2026 08:48:30 -0500
Subject: [PATCH] feat(helm): Add support for additional containers in API
 server

---
 charts/substrate/README.md                    |  2 +
 .../substrate/templates/ate-api-server.yaml   |  6 +++
 .../substrate/tests/control_plane_test.yaml   | 45 +++++++++++++++++++
 charts/substrate/values.yaml                  |  3 ++
 4 files changed, 56 insertions(+)

diff --git a/charts/substrate/README.md b/charts/substrate/README.md
index 7a2e93c655..c8790e4cda 100644
--- a/charts/substrate/README.md
+++ b/charts/substrate/README.md
@@ -74,6 +74,8 @@ See `values.yaml` for the full set; the important keys:
 | `ateApi.logLevel` | `info` | API server log level in its mounted config; one of `debug`, `info`, `warn`, or `error` |
 | `ateApi.authorization.bootstrapOwners` | `[]` | Global owners; empty defaults to the release's shared `ate-client` ServiceAccount |
 | `ateApi.extraArgs` | `[]` | Additional command-line arguments appended to the ateapi defaults |
+| `ateApi.extraInitContainers` | `[]` | Additional init containers in the API server pods |
+| `ateApi.extraContainers` | `[]` | Additional containers in the API server pod |
 | `otel.endpoint` | `""` | Set to an OTLP endpoint to export traces, metrics, the actor lifecycle events and the router access log |
 | `otel.traces.enabled` | `true` | Set to `false` to export no traces from the router; the Go components do not honor this yet |
 | `otel.traces.endpoint` | `""` | OTLP endpoint for traces, overriding `otel.endpoint` |
diff --git a/charts/substrate/templates/ate-api-server.yaml b/charts/substrate/templates/ate-api-server.yaml
index 8089720d3e..d57ccac77b 100644
--- a/charts/substrate/templates/ate-api-server.yaml
+++ b/charts/substrate/templates/ate-api-server.yaml
@@ -139,6 +139,9 @@ spec:
         - { name: servicedns, mountPath: /run/servicedns.podcert.ate.dev, readOnly: true }
         - { name: podidentity, mountPath: /run/podidentity.podcert.ate.dev, readOnly: true }
         - { name: actor-id-jwt-jwks, mountPath: /run/actor-id-jwt-jwks, readOnly: true }
+{{- with .Values.ateApi.extraInitContainers }}
+{{ toYaml . | indent 6 }}
+{{- end }}
       containers:
       - name: ate-api-server
         securityContext:
@@ -249,6 +252,9 @@ spec:
             port: health
           initialDelaySeconds: 10
           periodSeconds: 10
+{{- with .Values.ateApi.extraContainers }}
+{{ toYaml . | indent 6 }}
+{{- end }}
       volumes:
       - name: objectstore-plugin
         emptyDir: {}
diff --git a/charts/substrate/tests/control_plane_test.yaml b/charts/substrate/tests/control_plane_test.yaml
index 126e2b729d..2b56304a01 100644
--- a/charts/substrate/tests/control_plane_test.yaml
+++ b/charts/substrate/tests/control_plane_test.yaml
@@ -394,3 +394,48 @@ tests:
   - matchRegex:
       path: data["config.yaml"]
       pattern: 'requestParking:\n\s+budget: "30s"'
+- it: runs only the built-in API server containers by default
+  template: ate-api-server.yaml
+  documentSelector:
+    path: kind
+    value: Deployment
+  asserts:
+  - lengthEqual:
+      path: spec.template.spec.initContainers
+      count: 1
+  - lengthEqual:
+      path: spec.template.spec.containers
+      count: 1
+- it: appends extra API server containers
+  template: ate-api-server.yaml
+  set:
+    ateApi.extraInitContainers:
+    - name: helper
+      image: example.com/helper:v1
+      restartPolicy: Always
+    ateApi.extraContainers:
+    - name: extra
+      image: example.com/extra:v1
+      args: [--port=5432]
+  documentSelector:
+    path: kind
+    value: Deployment
+  asserts:
+  - equal:
+      path: spec.template.spec.initContainers[0].name
+      value: objectstore-plugin
+  - equal:
+      path: spec.template.spec.initContainers[1]
+      value:
+        name: helper
+        image: example.com/helper:v1
+        restartPolicy: Always
+  - equal:
+      path: spec.template.spec.containers[0].name
+      value: ate-api-server
+  - equal:
+      path: spec.template.spec.containers[1]
+      value:
+        name: extra
+        image: example.com/extra:v1
+        args: [--port=5432]
diff --git a/charts/substrate/values.yaml b/charts/substrate/values.yaml
index c4628edde4..431a89432c 100644
--- a/charts/substrate/values.yaml
+++ b/charts/substrate/values.yaml
@@ -122,6 +122,9 @@ ateApi:
   # Defaults to the in-cluster IdP URL; set a stable issuer for external consumers.
   actorJWTIssuer: ""
   extraArgs: []
+  # Additional containers added to the API server pod.
+  extraInitContainers: []
+  extraContainers: []
   resources:
     requests:
       cpu: 100m