Skip to content

fix(dv-pod): mount ENR private key at non-nested path in DKG sidecar#278

Open
nickh-obol wants to merge 2 commits into
mainfrom
nick/dv-pod-fix-enr-nested-mount
Open

fix(dv-pod): mount ENR private key at non-nested path in DKG sidecar#278
nickh-obol wants to merge 2 commits into
mainfrom
nick/dv-pod-fix-enr-nested-mount

Conversation

@nickh-obol
Copy link
Copy Markdown
Contributor

Summary

The dkg-sidecar init container mounts the `charon-enr-private-key` secret as a subPath file at `/charon-data/charon-enr-private-key`, nested inside the `/charon-data` PVC mount. On k3d / Docker Desktop on macOS this triggers a runc `outside of rootfs` error at pod creation, blocking deployment entirely.

The same secret is already mounted non-nested at `/enr-from-job`, so the nested mount is redundant. This PR removes it and points `CHARON_PRIVATE_KEY_FILE` at the existing path. The dkg-sidecar honors the env var (source), so no sidecar code change is required.

Changes

  • `charts/dv-pod/templates/statefulset.yaml`: drop the nested `/charon-data/charon-enr-private-key` volumeMount on the dkg-sidecar; repoint `CHARON_PRIVATE_KEY_FILE` to `/enr-from-job/{{ include "dv-pod.enrSecretDataKey" . }}`.
  • `charts/dv-pod/Chart.yaml`: bump chart version 0.18.1 → 0.18.2.
  • `charts/dv-pod/README.md`: regenerated by helm-docs.

The cluster-lock configMap mount under `/charon-data` was left as-is; it can be addressed separately if needed.

Test plan

Static

  • `helm template` diff vs main: only the two intended substantive lines change (env var + dropped mount), rest is chart-version label bump.
  • `helm lint` passes.

Live hoodi cluster (linux, local-path SC)

Upgraded all 4 `my-dv-pod-{0..3}` releases in the `dv-pod` namespace to `0.18.2` and brought the two scaled-down replicas back up.

  • All 4 pods reach `2/2 Running` within ~75s.
  • Pod events: no `FailedMount`, no `outside of rootfs`.
  • `CHARON_PRIVATE_KEY_FILE` resolves to `/enr-from-job/charon-enr-private-key` on all 4 pods.
  • dkg-sidecar volumeMounts list contains only `/enr-from-job` and `/charon-data` (no nested entry).
  • ENR private-key sha256 unchanged across upgrade for all 4 secrets.
  • dkg-sidecar logs: `Cluster lock file already exists. DKG is complete.` (early-exit path).
  • Charon JSON logs: 0 errors across all 4 pods. Only benign warnings.
  • All 4 nodes connected as peers via relay (`p2p_peer_connection_total` = 1 between every pair).

macOS / k3d

  • Reproduced the original `outside of rootfs` error against current released chart.
  • Same values against this branch: pod reaches `Running`, dkg-sidecar starts cleanly.

Related

PR #163 addresses a similar but distinct issue (`cluster-definition.json` write under `/charon-data` causing `EACCES` on `local-path`). Both stem from piling files under the `/charon-data` PVC. Scoping this fix narrowly to the ENR mount; #163 can be picked up separately.

Signed-off-by: nickh-obol <nick_h@obol.tech>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant