Skip to content

Commit 267e2b0

Browse files
alexghralexghr
authored
feat: add web3signer to rc-1 deployments (#16432)
Adds a web3signer deployment for rc-1 style deployments
2 parents 84c9faa + 5f49a23 commit 267e2b0

File tree

6 files changed

+148
-4
lines changed

6 files changed

+148
-4
lines changed

‎spartan/aztec-network/files/config/get-private-key.sh‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,23 +10,33 @@ KEY_INDEX=$((POD_INDEX * VALIDATORS_PER_NODE))
1010
# Add the index to the start index to get the private key index
1111
PRIVATE_KEY_INDEX=$((KEY_INDEX_START + KEY_INDEX))
1212

13+
WEB3_SIGNER_ENABLED=${WEB3_SIGNER_ENABLED:-false}
14+
1315
echo "POD_INDEX: $POD_INDEX"
1416
echo "KEY_INDEX: $KEY_INDEX"
1517
echo "KEY_INDEX_START: $KEY_INDEX_START"
1618
echo "PRIVATE_KEY_INDEX: $PRIVATE_KEY_INDEX"
19+
echo "WEB3_SIGNER_ENABLED: ${WEB3_SIGNER_ENABLED}"
1720
# Specific for validators that can hold multiple keys on one node
1821
echo "VALIDATORS_PER_NODE: ${VALIDATORS_PER_NODE}"
1922
echo "MNEMONIC: $(echo $MNEMONIC | cut -d' ' -f1-2)..."
2023

2124
private_keys=()
25+
addresses=()
26+
2227
for ((i = 0; i < VALIDATORS_PER_NODE; i++)); do
2328
current_index=$((PRIVATE_KEY_INDEX + i))
2429
private_key=$(cast wallet private-key "$MNEMONIC" --mnemonic-index $current_index)
25-
private_keys+=("$private_key")
30+
address=$(cast wallet address --private-key $private_key)
31+
32+
if [ "$WEB3_SIGNER_ENABLED" == "false" ]; then
33+
private_keys+=("$private_key")
34+
fi
35+
addresses+=("$address")
2636
done
2737

2838
# Other services will use the first key
29-
private_key=${private_keys[0]}
39+
private_key=$(cast wallet private-key "$MNEMONIC" --mnemonic-index $PRIVATE_KEY_INDEX)
3040
address=$(cast wallet address "$private_key")
3141

3242
# combine keys
@@ -35,6 +45,11 @@ validator_private_keys=$(
3545
echo "${private_keys[*]}"
3646
)
3747

48+
validator_addresses=$(
49+
IFS=,
50+
echo "${addresses[*]}"
51+
)
52+
3853
# Compute slasher private key if SLASHER_KEY_INDEX_START is set
3954
slasher_private_key=""
4055
if [[ -n "${SLASHER_KEY_INDEX_START:-}" ]]; then
@@ -47,6 +62,7 @@ fi
4762
# Note, currently writing keys for all services for convenience
4863
cat <<EOF >/shared/config/keys.env
4964
export VALIDATOR_PRIVATE_KEYS=$validator_private_keys
65+
export WEB3_SIGNER_ADDRESSES=$validator_addresses
5066
export L1_PRIVATE_KEY=$private_key
5167
export SEQ_PUBLISHER_PRIVATE_KEY=$private_key
5268
export PROVER_PUBLISHER_PRIVATE_KEY=$private_key

‎spartan/aztec-network/templates/validator.yaml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,8 @@ spec:
9696
value: {{ .Values.validator.keysPerNode | quote }}
9797
- name: MNEMONIC
9898
value: {{ .Values.aztec.l1DeploymentMnemonic }}
99-
99+
- name: WEB3_SIGNER_ENABLED
100+
value: {{ .Values.web3signer.enabled | quote }}
100101
- name: K8S_POD_UID
101102
valueFrom:
102103
fieldRef:
@@ -220,6 +221,10 @@ spec:
220221
value: {{ .Values.aztec.slash.invalidBlockMaxPenalty | quote }}
221222
- name: SENTINEL_ENABLED
222223
value: "{{ .Values.validator.sentinelEnabled }}"
224+
{{- if .Values.web3signer.enabled }}
225+
- name: WEB3_SIGNER_URL
226+
value: "http://{{ include "aztec-network.fullname" . }}-web3signer.{{ .Release.Namespace }}.svc.cluster.local:9000/"
227+
{{- end }}
223228
ports:
224229
- containerPort: {{ .Values.validator.service.nodePort }}
225230
- containerPort: {{ .Values.validator.service.p2pPort }}

‎spartan/aztec-network/templates/web3signer.yaml‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
{{- if .Values.web3signer.enabled }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: {{ include "aztec-network.fullname" . }}-web3signer-config
6+
namespace: {{ .Release.Namespace }}
7+
data:
8+
config.yaml: |
9+
data-path: "/data"
10+
http-host-allowlist: "{{ include "aztec-network.fullname" . }}-web3signer.{{ .Release.Namespace }}.svc.cluster.local"
11+
key-store-path: "/shared/key-store"
12+
eth1.chain-id: {{ .Values.ethereum.chainId }}
13+
---
14+
apiVersion: apps/v1
15+
kind: Deployment
16+
metadata:
17+
name: {{ include "aztec-network.fullname" . }}-web3signer
18+
namespace: {{ .Release.Namespace }}
19+
labels:
20+
app.kubernetes.io/name: web3signer
21+
app.kubernetes.io/instance: {{ .Release.Name }}
22+
spec:
23+
replicas: 1
24+
selector:
25+
matchLabels:
26+
app.kubernetes.io/name: web3signer
27+
app.kubernetes.io/instance: {{ .Release.Name }}
28+
template:
29+
metadata:
30+
labels:
31+
app.kubernetes.io/name: web3signer
32+
app.kubernetes.io/instance: {{ .Release.Name }}
33+
spec:
34+
containers:
35+
- name: web3signer
36+
image: {{ .Values.images.web3signer.image }}
37+
imagePullPolicy: {{ .Values.images.web3signer.pullPolicy }}
38+
command: ["/bin/bash","-c"]
39+
args: ["/opt/web3signer/bin/web3signer --config-file /data/config.yaml eth1"]
40+
ports:
41+
- name: http
42+
containerPort: 9000
43+
volumeMounts:
44+
- name: config
45+
mountPath: /data/config.yaml
46+
subPath: config.yaml
47+
- name: shared
48+
mountPath: /shared
49+
initContainers:
50+
- name: keys-from-mnemonic
51+
image: {{ .Values.images.aztec.image }}
52+
imagePullPolicy: {{ .Values.images.aztec.pullPolicy }}
53+
command: ["/bin/bash","-c"]
54+
args:
55+
- |
56+
set -euo pipefail
57+
KS_DIR=/shared/key-store
58+
KS_FILE=$KS_DIR/attesters.yaml
59+
mkdir -p "$KS_DIR"; : > "$KS_FILE"
60+
for ((i=0;i<VALIDATORS;i++)); do
61+
idx=$((KEY_INDEX_START + i))
62+
pk="$(cast wallet private-key "$MNEMONIC" --mnemonic-index "$idx")"
63+
[[ $i -gt 0 ]] && echo '---' >> "$KS_FILE"
64+
cat >> "$KS_FILE" <<EOF
65+
type: file-raw
66+
keyType: SECP256K1
67+
privateKey: "$pk"
68+
EOF
69+
done
70+
env:
71+
- name: MNEMONIC
72+
value: {{ .Values.aztec.l1DeploymentMnemonic | quote }}
73+
- name: VALIDATORS
74+
value: {{ mul .Values.validator.replicas .Values.validator.keysPerNode | toString | quote }}
75+
- name: KEY_INDEX_START
76+
value: {{ .Values.aztec.validatorKeyIndexStart | quote }}
77+
volumeMounts:
78+
- name: shared
79+
mountPath: /shared
80+
volumes:
81+
- name: config
82+
configMap:
83+
name: {{ include "aztec-network.fullname" . }}-web3signer-config
84+
- name: shared
85+
emptyDir: {}
86+
---
87+
apiVersion: v1
88+
kind: Service
89+
metadata:
90+
name: {{ include "aztec-network.fullname" . }}-web3signer
91+
namespace: {{ .Release.Namespace }}
92+
spec:
93+
type: ClusterIP
94+
selector:
95+
app.kubernetes.io/name: web3signer
96+
app.kubernetes.io/instance: {{ .Release.Name }}
97+
ports:
98+
- name: http
99+
port: 9000
100+
targetPort: http
101+
{{- end }}

‎spartan/aztec-network/values.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,24 @@ images:
5858
nethermind:
5959
image: nethermind/nethermind:1.32.2
6060
pullPolicy: IfNotPresent
61+
web3signer:
62+
image: consensys/web3signer:25.3.0
63+
pullPolicy: IfNotPresent
64+
65+
web3signer:
66+
enabled: false
67+
image:
68+
repository: consensys/web3signer
69+
tag: 25.3.0
70+
pullPolicy: IfNotPresent
71+
service:
72+
type: ClusterIP
73+
port: 9000
74+
init:
75+
image: aztecprotocol/aztec:latest
76+
addresses:
77+
validatorsCount: 0
78+
keyIndexStart: 2000
6179

6280
aztec:
6381
bootstrapENRs: ""
@@ -74,6 +92,7 @@ aztec:
7492
l1Salt: "" # leave empty for random salt
7593
testAccounts: true
7694
sponsoredFPC: false
95+
# WARNING: this is not a secure way to handle a mnemonic. This value will be stored in plain text in helm state. Instead opt to storing the mnemonic in a secret/external secret manager and mount into pods as needed
7796
l1DeploymentMnemonic: "test test test test test test test test test test test junk" # the mnemonic used when deploying contracts
7897
manaTarget: "" # use default value
7998

‎spartan/aztec-network/values/rc-1.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,3 +58,6 @@ bot:
5858
requests:
5959
memory: 15Gi
6060
cpu: 7
61+
62+
web3signer:
63+
enabled: true

‎spartan/terraform/deploy-release/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,7 @@ resource "helm_release" "aztec-gke-cluster" {
140140
}
141141

142142
# Setting timeout and wait conditions
143-
timeout = 1200 # 20 minutes in seconds
143+
timeout = 600
144144
wait = true
145145
wait_for_jobs = true
146146

0 commit comments

Comments
 (0)