Skip to content

Commit f72b8a4

Browse files
roderikroderik
committed
feat(helm): support external artifact sourcing
1 parent 3ad607e commit f72b8a4

10 files changed

Lines changed: 435 additions & 5 deletions

File tree

‎README.md‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,130 @@ Generate node identities, configure consensus, and emit a Besu genesis.
66

77
The helm chart to run this on Kubernetes / OpenShift can be found [here](./charts/network-bootstrapper/README.md)
88

9+
### Deployment modes
10+
11+
Two deployment paths are supported: fully auto-generated artefacts or supplying your own genesis/static peers while sourcing node keys from an external secret store such as Conjur.
12+
13+
#### Auto-generated artefacts (bootstrapper job)
14+
15+
```bash
16+
cat <<'EOF' > values-generated.yaml
17+
network-bootstrapper:
18+
artifacts:
19+
source: generated
20+
settings:
21+
validators: 4
22+
23+
network-nodes:
24+
global:
25+
validatorReplicaCount: 4
26+
EOF
27+
28+
helm upgrade --install besu-network ./charts/network \
29+
--namespace besu \
30+
--create-namespace \
31+
--values values-generated.yaml
32+
```
33+
34+
The bootstrapper Job generates the genesis file, static-nodes list, validator keys, and faucet account and publishes them as ConfigMaps/Secrets consumed by the Besu StatefulSets.
35+
36+
#### External genesis/static peers with Conjur-managed keys
37+
38+
Genesis and static peer data can be committed to version control while validator and faucet private keys are injected at deployment time. The chart expects the validator count in `artifacts.external.validators` to match `global.validatorReplicaCount`.
39+
40+
Create a Summon manifest describing the Conjur variables and a templated values file that references the injected environment variables:
41+
42+
```bash
43+
cat <<'EOF' > conjur.env.yml
44+
BESU_NODE_VALIDATOR_0_PRIVATE_KEY: !var production/besu/validator0/private-key
45+
BESU_NODE_VALIDATOR_1_PRIVATE_KEY: !var production/besu/validator1/private-key
46+
BESU_FAUCET_PRIVATE_KEY: !var production/besu/faucet/private-key
47+
EOF
48+
49+
cat <<'EOF' > values-external.tpl.yaml
50+
network-bootstrapper:
51+
artifacts:
52+
source: external
53+
external:
54+
genesis:
55+
config:
56+
chainId: 12345
57+
alloc:
58+
"0xfund":
59+
balance: "0x56bc75e2d63100000"
60+
extraData: "0x"
61+
staticNodes:
62+
- enode://node1@validator-0.besu.svc.cluster.local:30303
63+
- enode://node2@validator-1.besu.svc.cluster.local:30303
64+
validators:
65+
- address: "0x111"
66+
publicKey: "0x222"
67+
privateKey: "${BESU_NODE_VALIDATOR_0_PRIVATE_KEY}"
68+
enode: enode://validator1@validator-0.besu.svc.cluster.local:30303
69+
- address: "0x333"
70+
publicKey: "0x444"
71+
privateKey: "${BESU_NODE_VALIDATOR_1_PRIVATE_KEY}"
72+
enode: enode://validator2@validator-1.besu.svc.cluster.local:30303
73+
faucet:
74+
address: "0xfaucet"
75+
publicKey: "0xfaucetpub"
76+
privateKey: "${BESU_FAUCET_PRIVATE_KEY}"
77+
78+
global:
79+
validatorReplicaCount: 2
80+
81+
network-nodes:
82+
validatorReplicaCount:
83+
global:
84+
validatorReplicaCount: 2
85+
EOF
86+
87+
summon -f conjur.env.yml envsubst < values-external.tpl.yaml > values-external.yaml
88+
89+
helm upgrade --install besu-network ./charts/network \
90+
--namespace besu \
91+
--create-namespace \
92+
--values values-external.yaml
93+
94+
rm values-external.yaml
95+
```
96+
97+
Summon resolves the secrets in memory, `envsubst` renders them into a transient values file, and Helm creates the ConfigMaps/Secrets required by the Besu nodes. The temporary file is removed once the release is installed.
98+
99+
### Local artefact generation with Docker
100+
101+
Run the bootstrapper container locally to capture all artefacts before loading them into Conjur or another secret manager.
102+
103+
```bash
104+
mkdir -p artifacts
105+
106+
docker run --rm \
107+
-v "$(pwd)/artifacts:/workspace" \
108+
ghcr.io/settlemint/network-bootstrapper:0.1.0 \
109+
generate \
110+
--validators=2 \
111+
--outputType=file \
112+
--chain-id=12345 \
113+
--seconds-per-block=2 \
114+
--gas-limit=9007199254740991 \
115+
--accept-defaults
116+
117+
LATEST_DIR=$(ls -t artifacts/out | head -n 1)
118+
119+
for ordinal in 0 1; do
120+
jq -r '.privateKey' "artifacts/out/${LATEST_DIR}/besu-node-validator-${ordinal}-private-key" \
121+
| conjur variable values add production/besu/validator${ordinal}/private-key -
122+
done
123+
124+
jq -r '.privateKey' "artifacts/out/${LATEST_DIR}/besu-faucet-private-key" \
125+
| conjur variable values add production/besu/faucet/private-key -
126+
127+
jq -r '.genesis.json' "artifacts/out/${LATEST_DIR}/besu-genesis" > genesis.json
128+
jq -r '."static-nodes.json"' "artifacts/out/${LATEST_DIR}/besu-static-nodes" > static-nodes.json
129+
```
130+
131+
The container writes artefacts beneath `/workspace/out/<timestamp>`; mounting a host directory captures the results. Each validator and faucet file is emitted as JSON for ease of parsing. After loading secrets into Conjur, reference the same variables in your Summon configuration and embed the exported `genesis.json` and `static-nodes.json` within the Helm values file.
132+
9133
## CLI usage
10134

11135
```

‎README.tpl‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,128 @@ Generate node identities, configure consensus, and emit a Besu genesis.
66

77
The helm chart to run this on Kubernetes / OpenShift can be found [here](./charts/network-bootstrapper/README.md)
88

9+
### Deployment modes
10+
11+
Two deployment paths are supported: fully auto-generated artefacts or supplying your own genesis/static peers while sourcing node keys from an external secret store such as Conjur.
12+
13+
#### Auto-generated artefacts (bootstrapper job)
14+
15+
```bash
16+
cat <<'EOF' > values-generated.yaml
17+
network-bootstrapper:
18+
artifacts:
19+
source: generated
20+
settings:
21+
validators: 4
22+
23+
network-nodes:
24+
global:
25+
validatorReplicaCount: 4
26+
EOF
27+
28+
helm upgrade --install besu-network ./charts/network \
29+
--namespace besu \
30+
--create-namespace \
31+
--values values-generated.yaml
32+
```
33+
34+
The bootstrapper Job generates the genesis file, static-nodes list, validator keys, and faucet account and publishes them as ConfigMaps/Secrets consumed by the Besu StatefulSets.
35+
36+
#### External genesis/static peers with Conjur-managed keys
37+
38+
Genesis and static peer data can be committed to version control while validator and faucet private keys are injected at deployment time. The chart expects the validator count in `artifacts.external.validators` to match `global.validatorReplicaCount`.
39+
40+
Create a Summon manifest describing the Conjur variables and a templated values file that references the injected environment variables:
41+
42+
```bash
43+
cat <<'EOF' > conjur.env.yml
44+
BESU_NODE_VALIDATOR_0_PRIVATE_KEY: !var production/besu/validator0/private-key
45+
BESU_NODE_VALIDATOR_1_PRIVATE_KEY: !var production/besu/validator1/private-key
46+
BESU_FAUCET_PRIVATE_KEY: !var production/besu/faucet/private-key
47+
EOF
48+
49+
cat <<'EOF' > values-external.tpl.yaml
50+
network-bootstrapper:
51+
artifacts:
52+
source: external
53+
external:
54+
genesis:
55+
config:
56+
chainId: 12345
57+
alloc:
58+
"0xfund":
59+
balance: "0x56bc75e2d63100000"
60+
extraData: "0x"
61+
staticNodes:
62+
- enode://node1@validator-0.besu.svc.cluster.local:30303
63+
- enode://node2@validator-1.besu.svc.cluster.local:30303
64+
validators:
65+
- address: "0x111"
66+
publicKey: "0x222"
67+
privateKey: "${BESU_NODE_VALIDATOR_0_PRIVATE_KEY}"
68+
enode: enode://validator1@validator-0.besu.svc.cluster.local:30303
69+
- address: "0x333"
70+
publicKey: "0x444"
71+
privateKey: "${BESU_NODE_VALIDATOR_1_PRIVATE_KEY}"
72+
enode: enode://validator2@validator-1.besu.svc.cluster.local:30303
73+
faucet:
74+
address: "0xfaucet"
75+
publicKey: "0xfaucetpub"
76+
privateKey: "${BESU_FAUCET_PRIVATE_KEY}"
77+
78+
global:
79+
validatorReplicaCount: 2
80+
81+
network-nodes:
82+
validatorReplicaCount:
83+
global:
84+
validatorReplicaCount: 2
85+
EOF
86+
87+
summon -f conjur.env.yml envsubst < values-external.tpl.yaml > values-external.yaml
88+
89+
helm upgrade --install besu-network ./charts/network \
90+
--namespace besu \
91+
--create-namespace \
92+
--values values-external.yaml
93+
94+
rm values-external.yaml
95+
```
96+
97+
Summon resolves the secrets in memory, `envsubst` renders them into a transient values file, and Helm creates the ConfigMaps/Secrets required by the Besu nodes. The temporary file is removed once the release is installed.
98+
99+
### Local artefact generation with Docker
100+
101+
Run the bootstrapper container locally to capture all artefacts before loading them into Conjur or another secret manager.
102+
103+
```bash
104+
mkdir -p artifacts
105+
106+
docker run --rm \
107+
-v "$(pwd)/artifacts:/workspace" \
108+
ghcr.io/settlemint/network-bootstrapper:0.1.0 \
109+
generate \
110+
--validators=2 \
111+
--outputType=file \
112+
--chain-id=12345 \
113+
--seconds-per-block=2 \
114+
--gas-limit=9007199254740991 \
115+
--accept-defaults
116+
117+
LATEST_DIR=$(ls -t artifacts/out | head -n 1)
118+
119+
for ordinal in 0 1; do
120+
jq -r '.privateKey' "artifacts/out/${LATEST_DIR}/besu-node-validator-${ordinal}-private-key" \
121+
| conjur variable values add production/besu/validator${ordinal}/private-key -
122+
done
123+
124+
jq -r '.privateKey' "artifacts/out/${LATEST_DIR}/besu-faucet-private-key" \
125+
| conjur variable values add production/besu/faucet/private-key -
126+
127+
jq -r '.genesis.json' "artifacts/out/${LATEST_DIR}/besu-genesis" > genesis.json
128+
jq -r '."static-nodes.json"' "artifacts/out/${LATEST_DIR}/besu-static-nodes" > static-nodes.json
129+
```
130+
131+
The container writes artefacts beneath `/workspace/out/<timestamp>`; mounting a host directory captures the results. Each validator and faucet file is emitted as JSON for ease of parsing. After loading secrets into Conjur, reference the same variables in your Summon configuration and embed the exported `genesis.json` and `static-nodes.json` within the Helm values file.
132+
9133
## CLI usage

‎charts/network/charts/network-bootstrapper/README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,13 @@ A Helm chart for Kubernetes
1515
| Key | Type | Default | Description |
1616
|-----|------|---------|-------------|
1717
| affinity | object | `{}` | |
18+
| artifacts.external.faucet.address | string | `""` | Faucet account address stored in the `besu-faucet-address` ConfigMap when `source` equals `external`. |
19+
| artifacts.external.faucet.privateKey | string | `""` | Faucet private key stored in the `besu-faucet-private-key` Secret when `source` equals `external`. |
20+
| artifacts.external.faucet.publicKey | string | `""` | Faucet account public key stored in the `besu-faucet-pubkey` ConfigMap when `source` equals `external`. |
21+
| artifacts.external.genesis | object | `{}` | Besu genesis document rendered into the `besu-genesis` ConfigMap when `source` equals `external`. |
22+
| artifacts.external.staticNodes | list | `[]` | Collection of enode URIs persisted to the `besu-static-nodes` ConfigMap when `source` equals `external`. |
23+
| artifacts.external.validators | list | `[]` | Validator node definitions providing the data expected by the nodes chart. Each entry must include `address`, `publicKey`, `privateKey`, and `enode`. |
24+
| artifacts.source | string | `"generated"` | Determines how Besu network artifacts are populated. Use `generated` to run the job or `external` to supply values manually. |
1825
| fullnameOverride | string | `"bootstrapper"` | Override for the fully qualified resource name generated by helpers. |
1926
| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy controlling when Kubernetes fetches updated image layers. |
2027
| image.repository | string | `"ghcr.io/settlemint/network-bootstrapper"` | OCI registry path hosting the network bootstrapper image. |

0 commit comments

Comments
 (0)