Skip to content

Commit 671bd5d

Browse files
piizamapiizama
committed
feat(mpc-operator-check): adapt the check to aws-kms key for txsender
1 parent 2c78157 commit 671bd5d

7 files changed

Lines changed: 266 additions & 107 deletions

File tree

‎charts/mpc-operator-check/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@ apiVersion: v2
22
name: mpc-operator-check
33
description: A Helm chart to execute the MPC-Operator check Job
44
type: application
5-
version: 1.2.0
5+
version: 1.3.0

‎charts/mpc-operator-check/templates/NOTES.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
Successfully executed mpc-operator-check, job logs will be available for {{ .Values.job.ttlSecondsAfterFinished }}s by executing:
22

3-
kubectl logs -n {{ .Release.Namespace }} jobs/mpc-operator-check --all-containers
3+
kubectl logs -n {{ .Release.Namespace }} -l app=mpc-operator-check --all-containers --tail=-1

charts/mpc-operator-check/templates/mpc-operator-check-job.yaml renamed to charts/mpc-operator-check/templates/mpc-operator-check-job-kms-core.yaml

Lines changed: 11 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
1+
{{- if .Values.mpcOperatorCheck.kmsCore.enabled }}
12
apiVersion: batch/v1
23
kind: Job
34
metadata:
4-
name: mpc-operator-check
5+
name: mpc-operator-check-kms-core
56
annotations:
67
"helm.sh/hook": "pre-install,pre-upgrade"
78
"helm.sh/hook-weight": "-1"
@@ -13,6 +14,9 @@ spec:
1314
maxFailedIndexes: 1
1415
ttlSecondsAfterFinished: {{ .Values.job.ttlSecondsAfterFinished | int }}
1516
template:
17+
metadata:
18+
labels:
19+
app: mpc-operator-check
1620
spec:
1721
serviceAccountName: {{ .Values.serviceAccount.name }}
1822
{{- with .Values.podSecurityContext }}
@@ -38,41 +42,6 @@ spec:
3842
- configMapRef:
3943
name: {{ .Values.configmap.name }}
4044
{{- end }}
41-
{{- if .Values.gatewayNode.enabled }}
42-
- name: gateway-node-check
43-
image: {{ .Values.gatewayNode.image.repository }}:{{ .Values.gatewayNode.image.tag }}
44-
imagePullPolicy: Always
45-
command:
46-
- /bin/sh
47-
- -c
48-
- |
49-
echo "=================================================="
50-
{{- .Values.gatewayNode.script | nindent 14 }}
51-
envFrom:
52-
- configMapRef:
53-
name: {{ .Values.configmap.name }}
54-
{{- end }}
55-
{{- if .Values.ethWallet.enabled }}
56-
- name: eth-wallet-check
57-
image: {{ .Values.ethWallet.image.repository }}:{{ .Values.ethWallet.image.tag }}
58-
imagePullPolicy: Always
59-
command:
60-
- /bin/sh
61-
- -c
62-
- |
63-
cast wallet address --private-key $KMS_CONNECTOR_PRIVATE_KEY > /config/connector-wallet-address
64-
echo "=================================================="
65-
{{- .Values.ethWallet.script | nindent 14 }}
66-
env:
67-
- name: KMS_CONNECTOR_PRIVATE_KEY
68-
valueFrom:
69-
secretKeyRef:
70-
name: {{ .Values.ethWallet.secret.name }}
71-
key: {{ .Values.ethWallet.secret.key }}
72-
volumeMounts:
73-
- name: config
74-
mountPath: /config
75-
{{- end }}
7645
{{- if .Values.kubectl.enabled }}
7746
- name: kubernetes-namespace-check
7847
image: {{ .Values.kubectl.image.repository }}:{{ .Values.kubectl.image.tag }}
@@ -83,35 +52,12 @@ spec:
8352
- |
8453
echo "=================================================="
8554
{{- .Values.kubectl.script | nindent 14 }}
86-
{{- end }}
87-
{{- if .Values.postgres.enabled }}
88-
- name: postgres-check
89-
image: {{ .Values.postgres.image.repository }}:{{ .Values.postgres.image.tag }}
90-
imagePullPolicy: Always
91-
command:
92-
- /bin/sh
93-
- -c
94-
- |
9555
echo "=================================================="
96-
{{- .Values.postgres.script | nindent 14 }}
97-
env:
98-
- name: DATABASE_ENDPOINT
99-
valueFrom:
100-
secretKeyRef:
101-
name: connector-database
102-
key: endpoint
103-
- name: DATABASE_USERNAME
104-
valueFrom:
105-
secretKeyRef:
106-
name: connector-database
107-
key: username
108-
- name: DATABASE_PASSWORD
109-
valueFrom:
110-
secretKeyRef:
111-
name: connector-database
112-
key: password
113-
- name: DATABASE_URL
114-
value: "postgresql://$(DATABASE_USERNAME):$(DATABASE_PASSWORD)@$(DATABASE_ENDPOINT)/kmsconnector"
56+
echo "Kubernetes enclave nodes check"
57+
kubectl describe node -l node.kubernetes.io/enclave-enabled=true
58+
echo "=================================================="
59+
echo "Check kms-core logs"
60+
kubectl logs -l app=kms-core --prefix -c kms-core-enclave-logger
11561
{{- end }}
11662
{{- if .Values.netcat.enabled }}
11763
- name: netcat-check
@@ -135,8 +81,6 @@ spec:
13581
# Substitute env vars into kms-server.toml
13682
envsubst < /chart-config/kms-server.toml > /config/kms-server.toml
13783
envsubst < /chart-config/vaults.toml >> /config/kms-server.toml
138-
# Fetch KMS Signer address from KMS Public bucket
139-
curl -sS "${CORE_CLIENT__S3_ENDPOINT}${KMS_CORE__PRIVATE_VAULT__STORAGE__S3__PREFIX}/PUB-p${KMS_CORE__THRESHOLD__MY_ID}/VerfAddress/60b7070add74be3827160aa635fb255eeeeb88586c4debf7ab1134ddceb4beee" > /config/kms-signer-address
14084
# Copy enclave config to config workdir
14185
cp /chart-config/enclave.json /config/enclave.json
14286
envFrom:
@@ -160,22 +104,6 @@ spec:
160104
echo "Executing {{ .Chart.Name }}:{{ .Chart.Version }}"
161105
echo "=================================================="
162106
{{- .Values.kmsCoreClient.script | nindent 14 }}
163-
if [[ ! $KMS_CORE__THRESHOLD__MY_ID =~ ^-?[0-9]+$ ]]; then
164-
echo "Error: $KMS_CORE__THRESHOLD__MY_ID must be an integer, got: '$KMS_CORE__THRESHOLD__MY_ID'"
165-
exit 1
166-
fi
167-
if [[ -z "connector-wallet-address" ]]; then
168-
echo "Error: cannot get connector wallet address, ensure it is created in the secret: {{ .Values.ethWallet.secret.name }}, key: {{ .Values.ethWallet.secret.key }}"
169-
exit 1
170-
fi
171-
if [[ -z "kms-signer-address" ]]; then
172-
echo "Error: cannot get KMS signer address, ensure it is created in the public bucket VerfAddress folder"
173-
exit 1
174-
fi
175-
echo "Gateway Contract Configuration for Party #${KMS_CORE__THRESHOLD__MY_ID} (to share with Zama Governance)"
176-
echo "KMS_NODE_STORAGE_URL_${KMS_CORE__THRESHOLD__MY_ID}=${CORE_CLIENT__S3_ENDPOINT}"
177-
echo "KMS_TX_SENDER_ADDRESS_${KMS_CORE__THRESHOLD__MY_ID}=$(cat /config/connector-wallet-address)"
178-
echo "KMS_SIGNER_ADDRESS_${KMS_CORE__THRESHOLD__MY_ID}=$(cat /config/kms-signer-address)"
179107
envFrom:
180108
- configMapRef:
181109
name: {{ .Values.configmap.name }}
@@ -220,3 +148,4 @@ spec:
220148
tolerations:
221149
{{- toYaml . | nindent 8 }}
222150
{{- end }}
151+
{{- end }}

‎charts/mpc-operator-check/templates/mpc-operator-check-kms-connector-job.yaml‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
{{- if .Values.mpcOperatorCheck.kmsConnector.enabled }}
2+
apiVersion: batch/v1
3+
kind: Job
4+
metadata:
5+
name: mpc-operator-check-kms-connector
6+
annotations:
7+
"helm.sh/hook": "pre-install,pre-upgrade"
8+
"helm.sh/hook-weight": "-1"
9+
"helm.sh/hook-delete-policy": before-hook-creation
10+
spec:
11+
backoffLimit: 0
12+
completionMode: Indexed
13+
backoffLimitPerIndex: 1
14+
maxFailedIndexes: 1
15+
ttlSecondsAfterFinished: {{ .Values.job.ttlSecondsAfterFinished | int }}
16+
template:
17+
metadata:
18+
labels:
19+
app: mpc-operator-check
20+
spec:
21+
serviceAccountName: {{ .Values.serviceAccount.name }}-connector
22+
{{- with .Values.podSecurityContext }}
23+
securityContext:
24+
{{- toYaml . | nindent 8 }}
25+
{{- end }}
26+
{{- with .Values.imagePullSecrets }}
27+
imagePullSecrets:
28+
{{- toYaml . | nindent 8 }}
29+
{{- end }}
30+
initContainers:
31+
{{- if .Values.gatewayNode.enabled }}
32+
- name: gateway-node-check
33+
image: {{ .Values.gatewayNode.image.repository }}:{{ .Values.gatewayNode.image.tag }}
34+
imagePullPolicy: Always
35+
command:
36+
- /bin/sh
37+
- -c
38+
- |
39+
echo "=================================================="
40+
{{- .Values.gatewayNode.script | nindent 14 }}
41+
envFrom:
42+
- configMapRef:
43+
name: {{ .Values.configmap.name }}
44+
{{- end }}
45+
{{- if .Values.postgres.enabled }}
46+
- name: postgres-check
47+
image: {{ .Values.postgres.image.repository }}:{{ .Values.postgres.image.tag }}
48+
imagePullPolicy: Always
49+
command:
50+
- /bin/sh
51+
- -c
52+
- |
53+
echo "=================================================="
54+
{{- .Values.postgres.script | nindent 14 }}
55+
env:
56+
- name: DATABASE_ENDPOINT
57+
valueFrom:
58+
secretKeyRef:
59+
name: connector-database
60+
key: endpoint
61+
- name: DATABASE_USERNAME
62+
valueFrom:
63+
secretKeyRef:
64+
name: connector-database
65+
key: username
66+
- name: DATABASE_PASSWORD
67+
valueFrom:
68+
secretKeyRef:
69+
name: connector-database
70+
key: password
71+
- name: DATABASE_URL
72+
value: "postgresql://$(DATABASE_USERNAME):$(DATABASE_PASSWORD)@$(DATABASE_ENDPOINT)/kmsconnector"
73+
{{- end }}
74+
containers:
75+
- name: kube-utils
76+
image: {{ .Values.ethWallet.image.repository }}:{{ .Values.ethWallet.image.tag }}
77+
imagePullPolicy: Always
78+
command:
79+
- /bin/sh
80+
- -c
81+
- |
82+
echo "=================================================="
83+
echo "Check kms-connector services /healthz endpoint"
84+
curl kms-connector-gw-listener:9100/healtz
85+
curl kms-connector-kms-worker:9100/healtz
86+
curl kms-connector-tx-sender:9100/healtz
87+
echo "=================================================="
88+
echo "Check kms-connector logs"
89+
kubectl logs -l app=kms-connector-gw-listener --prefix
90+
kubectl logs -l app=kms-connector-kms-worker --prefix
91+
kubectl logs -l app=kms-connector-tx-sender --prefix
92+
93+
restartPolicy: Never
94+
{{- with .Values.nodeSelector }}
95+
nodeSelector:
96+
{{- toYaml . | nindent 8 }}
97+
{{- end }}
98+
{{- with .Values.affinity }}
99+
affinity:
100+
{{- toYaml . | nindent 8 }}
101+
{{- end }}
102+
{{- with .Values.tolerations }}
103+
tolerations:
104+
{{- toYaml . | nindent 8 }}
105+
{{- end }}
106+
{{- end }}

‎charts/mpc-operator-check/templates/mpc-operator-check-kms-keys-job.yaml‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
{{- if .Values.mpcOperatorCheck.kmsKeys.enabled }}
2+
apiVersion: batch/v1
3+
kind: Job
4+
metadata:
5+
name: mpc-operator-check-kms-keys
6+
annotations:
7+
"helm.sh/hook": "pre-install,pre-upgrade"
8+
"helm.sh/hook-weight": "-1"
9+
"helm.sh/hook-delete-policy": before-hook-creation
10+
spec:
11+
backoffLimit: 0
12+
completionMode: Indexed
13+
backoffLimitPerIndex: 1
14+
maxFailedIndexes: 1
15+
ttlSecondsAfterFinished: {{ .Values.job.ttlSecondsAfterFinished | int }}
16+
template:
17+
metadata:
18+
labels:
19+
app: mpc-operator-check
20+
spec:
21+
serviceAccountName: {{ .Values.serviceAccount.name }}-connector
22+
{{- with .Values.podSecurityContext }}
23+
securityContext:
24+
{{- toYaml . | nindent 8 }}
25+
{{- end }}
26+
{{- with .Values.imagePullSecrets }}
27+
imagePullSecrets:
28+
{{- toYaml . | nindent 8 }}
29+
{{- end }}
30+
initContainers:
31+
- name: run-kms-cert-check
32+
image: {{ .Values.kmsCoreClient.image.repository }}:{{ .Values.kmsCoreClient.image.tag }}
33+
imagePullPolicy: Always
34+
workingDir: /config
35+
command:
36+
- /bin/sh
37+
- -c
38+
- |
39+
echo "=================================================="
40+
echo "Executing {{ .Chart.Name }}:{{ .Chart.Version }}"
41+
echo "=================================================="
42+
echo "Check KMS Core #${KMS_CORE__THRESHOLD__MY_ID} Certificate"
43+
echo "=================================================="
44+
wget -nv -O certificate.crt "${CORE_CLIENT__S3_ENDPOINT}${KMS_CORE__PRIVATE_VAULT__STORAGE__S3__PREFIX}/PUB-p${KMS_CORE__THRESHOLD__MY_ID}/CACert/60b7070add74be3827160aa635fb255eeeeb88586c4debf7ab1134ddceb4beee"
45+
openssl x509 -in certificate.crt -text -noout
46+
envFrom:
47+
- configMapRef:
48+
name: {{ .Values.configmap.name }}
49+
volumeMounts:
50+
- name: config
51+
mountPath: /config
52+
- name: eth-wallet-check
53+
image: {{ .Values.ethWallet.image.repository }}:{{ .Values.ethWallet.image.tag }}
54+
imagePullPolicy: Always
55+
command:
56+
- /bin/sh
57+
- -c
58+
- |
59+
echo "=================================================="
60+
cast wallet address --aws > /config/connector-wallet-address
61+
{{- .Values.ethWallet.script | nindent 14 }}
62+
env:
63+
- name: AWS_KMS_KEY_ID
64+
valueFrom:
65+
configMapKeyRef:
66+
name: {{ .Values.configmap.name }}
67+
key: KMS_CONNECTOR__TX_SENDER_AWS_KMS_KEY_ID
68+
volumeMounts:
69+
- name: config
70+
mountPath: /config
71+
containers:
72+
- name: kube-utils
73+
image: {{ .Values.ethWallet.image.repository }}:{{ .Values.ethWallet.image.tag }}
74+
imagePullPolicy: Always
75+
workingDir: /config
76+
command:
77+
- /bin/sh
78+
- -c
79+
- |
80+
echo "=================================================="
81+
if [[ ! $KMS_CORE__THRESHOLD__MY_ID =~ ^-?[0-9]+$ ]]; then
82+
echo "Error: ${KMS_CORE__THRESHOLD__MY_ID} must be an integer, got: '${KMS_CORE__THRESHOLD__MY_ID}'"
83+
exit 1
84+
fi
85+
if [[ -z "kms-signer-address" ]]; then
86+
echo "Error: cannot get KMS signer address, ensure it is created in the public bucket VerfAddress folder"
87+
exit 1
88+
fi
89+
echo "Gateway Contract Configuration for Party #${KMS_CORE__THRESHOLD__MY_ID} (to share with Zama Governance)"
90+
echo "KMS_NODE_STORAGE_URL_${KMS_CORE__THRESHOLD__MY_ID}=${CORE_CLIENT__S3_ENDPOINT}"
91+
# Fetch KMS Signer address from KMS Public bucket
92+
curl -sS "${CORE_CLIENT__S3_ENDPOINT}${KMS_CORE__PRIVATE_VAULT__STORAGE__S3__PREFIX}/PUB-p${KMS_CORE__THRESHOLD__MY_ID}/VerfAddress/60b7070add74be3827160aa635fb255eeeeb88586c4debf7ab1134ddceb4beee" > /config/kms-signer-address
93+
echo "KMS_SIGNER_ADDRESS_${KMS_CORE__THRESHOLD__MY_ID}=$(cat /config/kms-signer-address)"
94+
if [[ -z "connector-wallet-address" ]]; then
95+
echo "Error: cannot get connector wallet address, ensure the KMS-Connector Eth wallet is created in AWS KMS Key ID: ${KMS_CONNECTOR__TX_SENDER_AWS_KMS_KEY_ID}"
96+
exit 1
97+
fi
98+
echo "KMS_TX_SENDER_ADDRESS_${KMS_CORE__THRESHOLD__MY_ID}=$(cat /config/connector-wallet-address)"
99+
envFrom:
100+
- configMapRef:
101+
name: {{ .Values.configmap.name }}
102+
volumeMounts:
103+
- name: config
104+
mountPath: /config
105+
volumes:
106+
- name: config
107+
emptyDir: {}
108+
restartPolicy: Never
109+
{{- with .Values.nodeSelector }}
110+
nodeSelector:
111+
{{- toYaml . | nindent 8 }}
112+
{{- end }}
113+
{{- with .Values.affinity }}
114+
affinity:
115+
{{- toYaml . | nindent 8 }}
116+
{{- end }}
117+
{{- with .Values.tolerations }}
118+
tolerations:
119+
{{- toYaml . | nindent 8 }}
120+
{{- end }}
121+
{{- end }}

0 commit comments

Comments
 (0)