Skip to content

Commit 85f3bc7

Browse files
jpraynaudjpraynaud
authored
Merge pull request #2433 from input-output-hk/jpraynaud/2362-ancillary-signature-infra
Feat: support GCP KMS ancillary signature in infrastructure
2 parents e7358f2 + 8a9abc8 commit 85f3bc7

File tree

18 files changed

+163
-64
lines changed

18 files changed

+163
-64
lines changed

‎.github/workflows/actions/deploy-terraform-infrastructure/action.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,21 @@ inputs:
149149
description: Mithril aggregator leader aggregator endpoint to follow.
150150
required: false
151151
default: ""
152+
mithril_aggregator_ancillary_signer_type:
153+
description: Mithril aggregator ancillary signer type ('secret-key' or 'gcp-kms').
154+
required: true
155+
mithril_aggregator_ancillary_signer_secret_key:
156+
description: Mithril aggregator ancillary signer secret key used to sign ancillary files (used with mithril_aggregator_ancillary_signer_type='secret-key').
157+
required: false
158+
default: ""
159+
mithril_aggregator_ancillary_signer_gcp_kms_resource_name:
160+
description: Mithril aggregator ancillary signer GCP KMS resource name used to sign ancillary files (used with mithril_aggregator_ancillary_signer_type='gcp-kms').
161+
required: false
162+
default: ""
163+
mithril_aggregator_ancillary_signer_gcp_kms_credentials:
164+
description: Mithril aggregator ancillary signer JSON credentials to access GCP KMS (used with mithril_aggregator_ancillary_signer_type='gcp-kms').
165+
required: false
166+
default: ""
152167
prometheus_auth_username:
153168
description: Prometheus metrics endpoint username.
154169
required: false
@@ -199,6 +214,14 @@ runs:
199214
chmod u+x ./assets/tools/utils/google-credentials-public-key.sh
200215
./assets/tools/utils/google-credentials-public-key.sh ./google-application-credentials.json ./assets/ssh_keys-${{ inputs.google_compute_instance_ssh_keys_environment }} curry
201216
217+
- name: Prepare variables
218+
shell: bash
219+
id: prepare
220+
run: |
221+
MITHRIL_AGGREGATOR_ANCILLARY_SIGNER_GCP_KMS_CREDENTIALS_BASE64=$(echo '${{ inputs.mithril_aggregator_ancillary_signer_gcp_kms_credentials }}' | base64 -w 0)
222+
echo "::add-mask::$MITHRIL_AGGREGATOR_ANCILLARY_SIGNER_GCP_KMS_CREDENTIALS_BASE64"
223+
echo "mithril_aggregator_ancillary_signer_gcp_kms_credentials_base64=$MITHRIL_AGGREGATOR_ANCILLARY_SIGNER_GCP_KMS_CREDENTIALS_BASE64" >> $GITHUB_OUTPUT
224+
202225
- name: Prepare terraform variables
203226
shell: bash
204227
working-directory: mithril-infra
@@ -246,6 +269,10 @@ runs:
246269
mithril_aggregator_cardano_transactions_signing_config_security_parameter = "${{ inputs.mithril_aggregator_cardano_transactions_signing_config_security_parameter }}"
247270
mithril_aggregator_cardano_transactions_signing_config_step = "${{ inputs.mithril_aggregator_cardano_transactions_signing_config_step }}"
248271
mithril_aggregator_leader_aggregator_endpoint = "${{ inputs.mithril_aggregator_leader_aggregator_endpoint }}"
272+
mithril_aggregator_ancillary_signer_type = "${{ inputs.mithril_aggregator_ancillary_signer_type }}"
273+
mithril_aggregator_ancillary_signer_secret_key = "${{ inputs.mithril_aggregator_ancillary_signer_secret_key }}"
274+
mithril_aggregator_ancillary_signer_gcp_kms_resource_name = "${{ inputs.mithril_aggregator_ancillary_signer_gcp_kms_resource_name }}"
275+
mithril_aggregator_ancillary_signer_gcp_kms_credentials = "${{ steps.prepare.outputs.mithril_aggregator_ancillary_signer_gcp_kms_credentials_base64 }}"
249276
prometheus_auth_username = "${{ inputs.prometheus_auth_username }}"
250277
prometheus_auth_password = "${{ inputs.prometheus_auth_password }}"
251278
prometheus_ingest_host = "${{ inputs.prometheus_ingest_host }}"

‎.github/workflows/ci.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -728,6 +728,10 @@ jobs:
728728
mithril_aggregator_cardano_transactions_database_connection_pool_size: ${{ vars.AGGREGATOR_CARDANO_TRANSACTIONS_DATABASE_CONNECTION_POOL_SIZE }}
729729
mithril_aggregator_cardano_transactions_signing_config_security_parameter: ${{ vars.AGGREGATOR_CARDANO_TRANSACTIONS_SIGNING_CONFIG_SECURITY_PARAMETER }}
730730
mithril_aggregator_cardano_transactions_signing_config_step: ${{ vars.AGGREGATOR_CARDANO_TRANSACTIONS_SIGNING_CONFIG_STEP }}
731+
mithril_aggregator_ancillary_signer_type: ${{ vars.AGGREGATOR_ANCILLARY_SIGNER_TYPE }}
732+
mithril_aggregator_ancillary_signer_secret_key: ${{ secrets.AGGREGATOR_ANCILLARY_SIGNER_SECRET_KEY }}
733+
mithril_aggregator_ancillary_signer_gcp_kms_resource_name: ${{ secrets.AGGREGATOR_ANCILLARY_SIGNER_GCP_KMS_RESOURCE_NAME }}
734+
mithril_aggregator_ancillary_signer_gcp_kms_credentials: ${{ secrets.AGGREGATOR_ANCILLARY_SIGNER_GCP_KMS_CREDENTIALS }}
731735
prometheus_auth_username: ${{ secrets.PROMETHEUS_AUTH_USERNAME }}
732736
prometheus_auth_password: ${{ secrets.PROMETHEUS_AUTH_PASSWORD }}
733737
prometheus_ingest_host: ${{ vars.PROMETHEUS_INGEST_HOST }}

‎.github/workflows/pre-release.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -230,6 +230,10 @@ jobs:
230230
mithril_aggregator_cardano_transactions_database_connection_pool_size: ${{ vars.AGGREGATOR_CARDANO_TRANSACTIONS_DATABASE_CONNECTION_POOL_SIZE }}
231231
mithril_aggregator_cardano_transactions_signing_config_security_parameter: ${{ vars.AGGREGATOR_CARDANO_TRANSACTIONS_SIGNING_CONFIG_SECURITY_PARAMETER }}
232232
mithril_aggregator_cardano_transactions_signing_config_step: ${{ vars.AGGREGATOR_CARDANO_TRANSACTIONS_SIGNING_CONFIG_STEP }}
233+
mithril_aggregator_ancillary_signer_type: ${{ vars.AGGREGATOR_ANCILLARY_SIGNER_TYPE }}
234+
mithril_aggregator_ancillary_signer_secret_key: ${{ secrets.AGGREGATOR_ANCILLARY_SIGNER_SECRET_KEY }}
235+
mithril_aggregator_ancillary_signer_gcp_kms_resource_name: ${{ secrets.AGGREGATOR_ANCILLARY_SIGNER_GCP_KMS_RESOURCE_NAME }}
236+
mithril_aggregator_ancillary_signer_gcp_kms_credentials: ${{ secrets.AGGREGATOR_ANCILLARY_SIGNER_GCP_KMS_CREDENTIALS }}
233237
prometheus_auth_username: ${{ secrets.PROMETHEUS_AUTH_USERNAME }}
234238
prometheus_auth_password: ${{ secrets.PROMETHEUS_AUTH_PASSWORD }}
235239
prometheus_ingest_host: ${{ vars.PROMETHEUS_INGEST_HOST }}

‎.github/workflows/release.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,10 @@ jobs:
168168
mithril_aggregator_cardano_transactions_database_connection_pool_size: ${{ vars.AGGREGATOR_CARDANO_TRANSACTIONS_DATABASE_CONNECTION_POOL_SIZE }}
169169
mithril_aggregator_cardano_transactions_signing_config_security_parameter: ${{ vars.AGGREGATOR_CARDANO_TRANSACTIONS_SIGNING_CONFIG_SECURITY_PARAMETER }}
170170
mithril_aggregator_cardano_transactions_signing_config_step: ${{ vars.AGGREGATOR_CARDANO_TRANSACTIONS_SIGNING_CONFIG_STEP }}
171+
mithril_aggregator_ancillary_signer_type: ${{ vars.AGGREGATOR_ANCILLARY_SIGNER_TYPE }}
172+
mithril_aggregator_ancillary_signer_secret_key: ${{ secrets.AGGREGATOR_ANCILLARY_SIGNER_SECRET_KEY }}
173+
mithril_aggregator_ancillary_signer_gcp_kms_resource_name: ${{ secrets.AGGREGATOR_ANCILLARY_SIGNER_GCP_KMS_RESOURCE_NAME }}
174+
mithril_aggregator_ancillary_signer_gcp_kms_credentials: ${{ secrets.AGGREGATOR_ANCILLARY_SIGNER_GCP_KMS_CREDENTIALS }}
171175
prometheus_auth_username: ${{ secrets.PROMETHEUS_AUTH_USERNAME }}
172176
prometheus_auth_password: ${{ secrets.PROMETHEUS_AUTH_PASSWORD }}
173177
prometheus_ingest_host: ${{ vars.PROMETHEUS_INGEST_HOST }}

‎.github/workflows/test-deploy-network.yml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -77,10 +77,11 @@ jobs:
7777
mithril_p2p_signer_relay_signature_registration_mode: p2p
7878
mithril_api_domain: api.mithril.network
7979
mithril_era_reader_adapter_type: cardano-chain
80-
mithril_protocol_parameters: {
81-
k = 5
82-
m = 100
83-
phi_f = 0.65,
80+
mithril_protocol_parameters: |
81+
{
82+
k = 5
83+
m = 100
84+
phi_f = 0.65,
8485
}
8586
mithril_signers: |
8687
{
@@ -183,6 +184,10 @@ jobs:
183184
mithril_aggregator_cardano_transactions_signing_config_security_parameter: ${{ vars.AGGREGATOR_CARDANO_TRANSACTIONS_SIGNING_CONFIG_SECURITY_PARAMETER }}
184185
mithril_aggregator_cardano_transactions_signing_config_step: ${{ vars.AGGREGATOR_CARDANO_TRANSACTIONS_SIGNING_CONFIG_STEP }}
185186
mithril_aggregator_leader_aggregator_endpoint: ${{ matrix.mithril_leader_aggregator_endpoint }}
187+
mithril_aggregator_ancillary_signer_type: ${{ vars.AGGREGATOR_ANCILLARY_SIGNER_TYPE }}
188+
mithril_aggregator_ancillary_signer_secret_key: ${{ secrets.AGGREGATOR_ANCILLARY_SIGNER_SECRET_KEY }}
189+
mithril_aggregator_ancillary_signer_gcp_kms_resource_name: ${{ secrets.AGGREGATOR_ANCILLARY_SIGNER_GCP_KMS_RESOURCE_NAME }}
190+
mithril_aggregator_ancillary_signer_gcp_kms_credentials: ${{ secrets.AGGREGATOR_ANCILLARY_SIGNER_GCP_KMS_CREDENTIALS }}
186191
prometheus_auth_username: ${{ secrets.PROMETHEUS_AUTH_USERNAME }}
187192
prometheus_auth_password: ${{ secrets.PROMETHEUS_AUTH_PASSWORD }}
188193
prometheus_ingest_host: ${{ vars.PROMETHEUS_INGEST_HOST }}

‎CHANGELOG.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,14 @@ As a minor extension, we have adopted a slightly different versioning convention
99

1010
## Mithril Distribution [XXXX] - UNRELEASED
1111

12+
- **BREAKING** changes in Mithril client CLI:
13+
14+
- To fast bootstrap a Cardano node, the new `--include-ancillary` option has been added to the _Cardano node database_ command in the Mithril client CLI.
15+
- Without this option, only final immutable files are downloaded and the ledger state must be computed from the genesis block.
16+
- The `--include-ancillary` option requires the usage of an **ancillary verification key** (`--ancillary-verification-key` or `ANCILLARY_VERIFICATION_KEY`) which is specified in the [Networks configuration](https://mithril.network/doc/manual/getting-started/network-configurations) page.
17+
18+
- Support for ancillary files signature for _Cardano node database_ and _Cardano node database v2_ certification with IOG key.
19+
1220
- Add `with_origin_tag` function to the Mithril client library to record the origin of client requests.
1321

1422
- **UNSTABLE** implement support for leader/follower registration in the infrastructure.

0 commit comments

Comments
 (0)