Skip to content
Merged
Show file tree
Hide file tree
Changes from 10 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file modified build/debug_keybase/debug_keybase.bak
Binary file not shown.
46 changes: 30 additions & 16 deletions build/debug_keybase/main.go
Original file line number Diff line number Diff line change
@@ -1,8 +1,10 @@
package main

import (
"bytes"
"crypto/md5" // nolint:gosec // Weak hashing function only used to check if the file has been changed
"fmt"
"io"
"os"
"path/filepath"

Expand All @@ -26,6 +28,14 @@ const (
debugKeybaseImportConcurrencyLimit = 4
)

type K8sSecret struct {
ApiVersion string `yaml:"apiVersion"`
Kind string `yaml:"kind"`
MetaData map[string]string `yaml:"metadata"`
Type string `yaml:"type"`
StringData map[string]string `yaml:"stringData"`
}

func main() {
if len(os.Args) < 3 {
fmt.Println("Usage: go run main.go <source_yaml> <target_folder>")
Expand Down Expand Up @@ -55,7 +65,7 @@ func main() {
func dumpKeybase(privateKeysYamlBytes []byte, targetFilePath string) {
fmt.Println("⚙️ Initializing debug Keybase...")

validatorKeysPairMap, err := parseValidatorPrivateKeysFromEmbeddedYaml(privateKeysYamlBytes)
validatorKeysPairMap, err := parsePrivateKeysFromEmbeddedYaml(privateKeysYamlBytes)
if err != nil {
panic(err)
}
Expand Down Expand Up @@ -143,24 +153,28 @@ func dumpKeybase(privateKeysYamlBytes []byte, targetFilePath string) {
fmt.Printf("✅ Keybase dumped in %s\n", targetFilePath)
}

func parseValidatorPrivateKeysFromEmbeddedYaml(privateKeysYamlBytes []byte) (map[string]string, error) {
func parsePrivateKeysFromEmbeddedYaml(privateKeysYamlBytes []byte) ([]string, error) {
// Parse the YAML file and load into the config struct
var config struct {
ApiVersion string `yaml:"apiVersion"`
Kind string `yaml:"kind"`
MetaData map[string]string `yaml:"metadata"`
Type string `yaml:"type"`
StringData map[string]string `yaml:"stringData"`
}
if err := yaml.Unmarshal(privateKeysYamlBytes, &config); err != nil {
return nil, err
}
validatorKeysMap := make(map[string]string)
decoder := yaml.NewDecoder(bytes.NewReader(privateKeysYamlBytes))
keysList := make([]string, 0)

for {
var secret K8sSecret

if err := decoder.Decode(&secret); err != nil {
if err == io.EOF {
break
}
return nil, err
}

for _, privHexString := range secret.StringData {
keysList = append(keysList, privHexString)
}

for id, privHexString := range config.StringData {
validatorKeysMap[id] = privHexString
}
return validatorKeysMap, nil

return keysList, nil
}

func cleanupStaleFiles(targetFolderPath string) {
Expand Down
7 changes: 7 additions & 0 deletions build/docs/CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

## [0.0.0.42] - 2023-05-12

- Added private keys for all (except fisherman) actors
- Changed the debug_keybase package to support multiple yaml secrets in one yaml file
- Added full node (non-staked validator)

## [0.0.0.41] - 2023-05-08

- Updated Dockerfiles using outdated go version to 1.19

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here's a brief code review of the provided patch:

  1. The patch adds a new version (0.0.0.42) to the changelog with the date 2023-05-12.

  2. The changes include:

    • Adding private keys for all actors (except fisherman)
    • Changing the debug_keybase package to support multiple YAML secrets in one YAML file
    • Adding a full node (non-staked validator)

Potential issues and suggestions:

  1. Storing private keys directly in the code base can be a security risk. Consider using a secure key management system or environment variables to avoid exposing sensitive information.

  2. It is unclear if there are any access control mechanisms if the private keys are visible in the project. Make sure to implement proper access control to prevent unauthorized use of the keys.

  3. Regarding the debug_keybase change, ensure proper parsing and validation of the multiple YAML secrets. This can help minimize potential bugs or vulnerabilities when handling the new format.

  4. For the newly added full node, thoroughly test its integration with the existing architecture to confirm proper functioning and detect any compatibility issues or edge cases.



## [0.0.0.40] - 2023-05-04

- Added `network_id` parameter to the node config files

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall, the patch seems to be updating the changelog with developments made in the project. Below are some suggestions and potential risk factors:

  1. Bug Risk: Mention of "private keys for all (except fisherman) actors". Storing private keys in a repository or sharing them among multiple users is a significant security concern.

Improvement Suggestion: If these private keys are meant for testing purposes only, clarify this in the changelog or remove them entirely and use a more secure method for handling private keys, such as environment variables or secret management tools.

  1. Improvement Suggestion: Add more context about the introduced changes. Providing details on how the updated features function and interact within the system can help other developers understand the rationale and usage of the new code.

For example:

  • Explain the significance of excluding the 'fisherman' actor.
  • Describe how the debug_keybase package update will impact the system.
  • Clarify the role of the full node (non-staked validator), and its implications on the network.

It would be helpful to have access to the actual code changes to provide a more detailed review, but based on the information provided in the submitted patch, these are the primary concerns and suggestions.

Expand Down
36 changes: 31 additions & 5 deletions build/localnet/Tiltfile
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,10 @@ root_dir = os.path.dirname(tiltfile_dir + "/../..")
localnet_config_path = root_dir + "/localnet_config.yaml"

# Create localnet config file from defaults, and if some default configuration doesn't exist in it - populate with default values
localnet_config_defaults = {"validators": {"count": 4}}
localnet_config_defaults = {
"validators": {"count": 4},
"full_nodes": {"count": 1}
}

localnet_config_file = read_yaml(localnet_config_path, default=localnet_config_defaults)

Expand Down Expand Up @@ -93,9 +96,9 @@ local_resource(
labels=['watchers']
)

# Builds and maintains the validator container image after the binary is built on local machine, restarts a process on code change
# Builds and maintains the pocket container image after the binary is built on local machine, restarts a process on code change
docker_build_with_restart(
"validator-image",
"pocket-image",
root_dir,
dockerfile_contents="""FROM debian:bullseye
COPY bin/pocket-linux /usr/local/bin/pocket
Expand Down Expand Up @@ -141,7 +144,6 @@ COPY bin/client-linux /usr/local/bin/client
]
)

# TODO: https://github.com/tilt-dev/tilt/issues/3048
# Pushes localnet manifests to the cluster.
k8s_yaml(
[
Expand All @@ -160,6 +162,8 @@ k8s_yaml(['manifests/cluster-manager.yaml'])
k8s_resource('pocket-v1-cluster-manager', labels=['cluster-manager'])

check_helm_dependencies_for_chart(root_dir + "/charts/pocket")

# Provisions validators
for x in range(localnet_config["validators"]["count"]):
validator_number = x + 1
formatted_validator_number = local('printf "%03d" ' + str(validator_number))
Expand All @@ -169,13 +173,35 @@ for x in range(localnet_config["validators"]["count"]):
namespace="default",
set=[
"global.postgresql.auth.postgresPassword=LocalNetPassword",
"image.repository=validator-image",
"image.repository=pocket-image",
"privateKeySecretKeyRef.name=validators-private-keys",
"privateKeySecretKeyRef.key=%s" % formatted_validator_number,
"genesis.preProvisionedGenesis.enabled=false",
"genesis.externalConfigMap.name=v1-localnet-genesis",
"genesis.externalConfigMap.key=genesis.json",
"postgresql.primary.persistence.enabled=false",
"nodeType=validator",
]
))

# Provisions full nodes
for x in range(localnet_config["full_nodes"]["count"]):
node_number = x + 1
formatted_node_number = local('printf "%03d" ' + str(node_number))

k8s_yaml(helm(root_dir + "/charts/pocket",
name="full-node-%s" % formatted_node_number,
namespace="default",
set=[
"global.postgresql.auth.postgresPassword=LocalNetPassword",
"image.repository=pocket-image",
"privateKeySecretKeyRef.name=misc-private-keys",
"privateKeySecretKeyRef.key=%s" % formatted_node_number,
"genesis.preProvisionedGenesis.enabled=false",
"genesis.externalConfigMap.name=v1-localnet-genesis",
"genesis.externalConfigMap.key=genesis.json",
"postgresql.primary.persistence.enabled=false",
"nodeType=full",
]
))

Expand Down
2 changes: 1 addition & 1 deletion build/localnet/manifests/cli-client.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ spec:
value: validator1
# Any host that is visible and connected to the cluster can be arbitrarily selected as the RPC host
- name: RPC_HOST
value: pocket-validators
value: pocket-full-nodes
# TECHDEBT(#678): debug client requires hostname to participate
# in P2P networking.
- name: POCKET_P2P_HOSTNAME
Expand Down
2 changes: 1 addition & 1 deletion build/localnet/manifests/cluster-manager.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -20,5 +20,5 @@ spec:
- cluster-manager
env:
- name: RPC_HOST
value: pocket-validators
value: pocket-full-nodes
serviceAccountName: cluster-manager-account
18 changes: 18 additions & 0 deletions build/localnet/manifests/network.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -16,3 +16,21 @@ spec:
- port: 9000
targetPort: 9000
name: metrics
---
apiVersion: v1
kind: Service
metadata:
name: pocket-full-nodes
annotations:
prometheus.io/scrape: "false"
prometheus.io/port: "9000"
spec:
selector:
pokt.network/purpose: full
ports:
- port: 50832
targetPort: 50832
name: rpc
- port: 9000
targetPort: 9000
name: metrics
Loading