From 7ac9870535431ed1fce3ce5c68f10f6818ffb5ad Mon Sep 17 00:00:00 2001 From: bussyjd Date: Tue, 7 Oct 2025 15:45:20 +0400 Subject: [PATCH 01/27] feat: init aztec-node --- charts/aztec-node/Chart.yaml | 6 + charts/aztec-node/README.md | 405 ++++++++++++++++++ charts/aztec-node/templates/_helpers.tpl | 142 ++++++ charts/aztec-node/templates/clusterrole.yaml | 10 + .../templates/clusterrolebinding.yaml | 16 + charts/aztec-node/templates/role.yaml | 10 + charts/aztec-node/templates/rolebinding.yaml | 15 + charts/aztec-node/templates/secret.yaml | 19 + .../templates/service-prover-agent.yaml | 26 ++ .../templates/service-prover-broker.yaml | 26 ++ .../templates/service-prover-node.yaml | 36 ++ .../aztec-node/templates/serviceaccount.yaml | 13 + .../templates/statefulset-prover-agent.yaml | 139 ++++++ .../templates/statefulset-prover-broker.yaml | 155 +++++++ .../templates/statefulset-prover-node.yaml | 191 +++++++++ charts/aztec-node/templates/statefulset.yaml | 283 ++++++++++++ charts/aztec-node/templates/svc.headless.yaml | 33 ++ charts/aztec-node/templates/svc.nodeport.yaml | 31 ++ charts/aztec-node/templates/svc.yaml | 35 ++ charts/aztec-node/values-examples/README.md | 159 +++++++ .../aztec-node/values-examples/fullnode.yaml | 62 +++ charts/aztec-node/values-examples/prover.yaml | 116 +++++ .../aztec-node/values-examples/sequencer.yaml | 86 ++++ charts/aztec-node/values.yaml | 311 ++++++++++++++ 24 files changed, 2325 insertions(+) create mode 100644 charts/aztec-node/Chart.yaml create mode 100644 charts/aztec-node/README.md create mode 100644 charts/aztec-node/templates/_helpers.tpl create mode 100644 charts/aztec-node/templates/clusterrole.yaml create mode 100644 charts/aztec-node/templates/clusterrolebinding.yaml create mode 100644 charts/aztec-node/templates/role.yaml create mode 100644 charts/aztec-node/templates/rolebinding.yaml create mode 100644 charts/aztec-node/templates/secret.yaml create mode 100644 charts/aztec-node/templates/service-prover-agent.yaml create mode 100644 charts/aztec-node/templates/service-prover-broker.yaml create mode 100644 charts/aztec-node/templates/service-prover-node.yaml create mode 100644 charts/aztec-node/templates/serviceaccount.yaml create mode 100644 charts/aztec-node/templates/statefulset-prover-agent.yaml create mode 100644 charts/aztec-node/templates/statefulset-prover-broker.yaml create mode 100644 charts/aztec-node/templates/statefulset-prover-node.yaml create mode 100644 charts/aztec-node/templates/statefulset.yaml create mode 100644 charts/aztec-node/templates/svc.headless.yaml create mode 100644 charts/aztec-node/templates/svc.nodeport.yaml create mode 100644 charts/aztec-node/templates/svc.yaml create mode 100644 charts/aztec-node/values-examples/README.md create mode 100644 charts/aztec-node/values-examples/fullnode.yaml create mode 100644 charts/aztec-node/values-examples/prover.yaml create mode 100644 charts/aztec-node/values-examples/sequencer.yaml create mode 100644 charts/aztec-node/values.yaml diff --git a/charts/aztec-node/Chart.yaml b/charts/aztec-node/Chart.yaml new file mode 100644 index 00000000..0158cd51 --- /dev/null +++ b/charts/aztec-node/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: aztec-node +description: A Helm chart for deploying an Aztec node +type: application +version: 0.1.0 +appVersion: "2.0.2" diff --git a/charts/aztec-node/README.md b/charts/aztec-node/README.md new file mode 100644 index 00000000..68a74f01 --- /dev/null +++ b/charts/aztec-node/README.md @@ -0,0 +1,405 @@ +# Aztec Node Helm Chart + +A Kubernetes Helm chart for deploying Aztec network nodes in different roles: Full Node, Sequencer, or Prover. + +## Overview + +This chart deploys Aztec nodes using a role-based architecture. A single chart handles three distinct deployment types: + +- **Full Node** - Participates in the network by syncing and validating blocks +- **Sequencer** - Produces blocks and participates in consensus +- **Prover** - Generates zero-knowledge proofs for the network + +## Quick Start + +### Prerequisites + +- Kubernetes cluster (v1.19+) +- Helm 3.0+ +- L1 Ethereum RPC access (execution + consensus layers) + +### Install a Full Node + +```bash +helm install aztec-fullnode ./charts/aztec-node \ + -f charts/aztec-node/values-examples/fullnode.yaml \ + -n aztec --create-namespace +``` + +### Install a Sequencer + +```bash +helm install aztec-sequencer ./charts/aztec-node \ + -f charts/aztec-node/values-examples/sequencer.yaml \ + --set sequencer.attesterPrivateKey="0xYOUR_PRIVATE_KEY" \ + -n aztec --create-namespace +``` + +**Requirements:** +- Ethereum private key with minimum 0.1 ETH on L1 (Sepolia for testnet) + +### Install a Prover + +```bash +helm install aztec-prover ./charts/aztec-node \ + -f charts/aztec-node/values-examples/prover.yaml \ + --set prover.node.publisherPrivateKey="0xYOUR_PRIVATE_KEY" \ + -n aztec --create-namespace +``` + +**Note:** The prover role creates 3 StatefulSets: +- `prover-broker` - Manages the job queue +- `prover-node` - Creates jobs and publishes proofs to L1 +- `prover-agent` - Executes proof generation (can scale replicas) + +## Architecture + +### Role-Based Deployment + +The chart uses a `role` field to determine the deployment type: + +```yaml +role: fullnode # Options: fullnode | sequencer | prover +``` + +Each role automatically configures the appropriate: +- Container command and flags +- Resource requirements +- Storage configuration +- Service endpoints +- Required secrets + +### Storage Requirements + +All storage sizes match [Aztec's official specifications](https://docs.aztec.network/the_aztec_network): + +| Role/Component | Storage | Type | +|----------------|---------|------| +| Full Node | 1TB | NVMe SSD | +| Sequencer | 1TB | NVMe SSD | +| Prover Node | 1TB | NVMe SSD | +| Prover Broker | 10GB | SSD | +| Prover Agent | 10GB | SSD | + +## Configuration + +### Networks + +Connect to predefined Aztec networks: + +```yaml +network: testnet # Options: testnet | devnet +``` + +Or configure a custom network: + +```yaml +network: null # Disable predefined network +customNetwork: + l1ChainId: "11155111" + registryContractAddress: "0x..." + slashFactoryAddress: "0x..." + feeAssetHandlerContractAddress: "0x..." +``` + +### L1 Ethereum Configuration + +All roles require L1 Ethereum RPC access: + +```yaml +node: + l1ExecutionUrls: + - "http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545" + l1ConsensusUrls: + - "http://l1-full-node-sepolia-beacon.l1.svc.cluster.local:5052" +``` + +### Persistence + +Persistence is enabled by default and uses the cluster's default storage class: + +```yaml +persistence: + enabled: true + size: 1000Gi # Automatically set per role + # storageClassName: local-path # Optional: specify storage class + accessModes: + - ReadWriteOnce +``` + +**Component-Specific Sizes (Prover Role):** + +The prover role allows per-component storage configuration: + +```yaml +prover: + node: + persistence: + size: 1000Gi # Prover node (archiver data) + broker: + persistence: + size: 10Gi # Broker (job queue) + agent: + persistence: + size: 10Gi # Agent (CRS files) +``` + +### Networking + +**P2P Configuration:** + +```yaml +service: + p2p: + enabled: true + nodePortEnabled: false # Set true for external P2P + port: 40400 +``` + +**Host Networking (Optional):** + +```yaml +hostNetwork: true # Use host network for better P2P performance +``` + +**Note:** When using `hostNetwork: true`, ensure pod affinity is set to distribute pods across different nodes if running multiple replicas. + +### Resource Allocation + +Example resource configuration: + +```yaml +node: + resources: + requests: + cpu: "4" + memory: "16Gi" + limits: + cpu: "8" + memory: "32Gi" +``` + +**Prover-Specific Resources:** + +```yaml +prover: + broker: + resources: + requests: + cpu: "1" + memory: "4Gi" + node: + resources: + requests: + cpu: "2" + memory: "8Gi" + agent: + replicas: 2 # Scale prover agents + resources: + requests: + cpu: "16" # High CPU for proof generation + memory: "64Gi" +``` + +## Examples + +See detailed configuration examples in [`values-examples/`](./values-examples/): + +- [`fullnode.yaml`](./values-examples/fullnode.yaml) - Full node configuration +- [`sequencer.yaml`](./values-examples/sequencer.yaml) - Sequencer configuration +- [`prover.yaml`](./values-examples/prover.yaml) - Prover configuration +- [`README.md`](./values-examples/README.md) - Detailed deployment guide + +## Monitoring + +Access node endpoints: + +```bash +# HTTP RPC endpoint +kubectl port-forward -n aztec svc/aztec-node 8080:8080 + +# Admin endpoint +kubectl port-forward -n aztec svc/aztec-node 8081:8081 +``` + +### Verify Node is Running Properly + +**1. Check node sync status:** + +```bash +curl -X POST http://localhost:8080 --data '{"method": "node_getL2Tips"}' +``` + +You should see JSON response with the latest block number. If the block number is increasing, your node is syncing correctly. + +**2. Check P2P connectivity (TCP):** + +```bash +# Get the external IP or node port +kubectl get svc -n aztec + +# Test TCP connectivity (replace with your IP/port) +nc -vz 40400 +``` + +Expected: "Connection succeeded" + +**3. Check P2P connectivity (UDP):** + +```bash +nc -vu 40400 +``` + +Expected: "Connection succeeded" + +**4. View logs:** + +```bash +kubectl logs -n aztec -l app.kubernetes.io/name=aztec-node --tail=100 -f +``` + +Look for messages indicating: +- Block synchronization progress +- P2P peer connections +- No error messages + +## Upgrading + +### Upgrade a Release + +```bash +helm upgrade aztec-node ./charts/aztec-node \ + -f your-values.yaml \ + -n aztec +``` + +### Auto-Updates + +Enable automatic image updates by setting the image pull policy: + +```yaml +image: + repository: aztecprotocol/aztec + tag: latest + pullPolicy: Always # Pull latest image on every pod restart +``` + +**Important Notes:** +- Using `pullPolicy: Always` with `tag: latest` ensures you get the newest version when pods restart +- This is recommended for testnet/devnet deployments to stay up-to-date +- For production, pin to specific versions (e.g., `tag: "2.0.2"`) and use `pullPolicy: IfNotPresent` +- Sequencers should use `pullPolicy: Always` to maintain network compatibility + +**Trigger an update manually:** + +```bash +# Force pod restart to pull latest image +kubectl rollout restart statefulset/aztec-node -n aztec + +# For prover components +kubectl rollout restart statefulset/aztec-prover-broker -n aztec +kubectl rollout restart statefulset/aztec-prover-node -n aztec +kubectl rollout restart statefulset/aztec-prover-agent -n aztec +``` + +### Scale Prover Agents + +```bash +helm upgrade aztec-prover ./charts/aztec-node \ + -f charts/aztec-node/values-examples/prover.yaml \ + --set prover.agent.replicas=4 \ + -n aztec +``` + +## Uninstalling + +```bash +helm uninstall aztec-node -n aztec +``` + +**Note:** PersistentVolumeClaims are not automatically deleted. Remove manually if needed: + +```bash +kubectl delete pvc -n aztec -l app.kubernetes.io/name=aztec-node +``` + +## Security + +**⚠️ Important Security Notes:** + +1. **Private Keys:** Never commit private keys to version control +2. **Sequencer:** Use `--set sequencer.attesterPrivateKey="0x..."` when deploying +3. **Prover:** Use `--set prover.node.publisherPrivateKey="0x..."` when deploying +4. **Secrets Management:** Consider using external secret managers (Vault, Sealed Secrets, etc.) + +## Troubleshooting + +### Pod Not Starting + +Check startup probe timeout (sequencers may need longer): + +```yaml +node: + startupProbe: + periodSeconds: 60 + failureThreshold: 30 # 30 minutes max +``` + +### Storage Issues + +Verify PVC creation: + +```bash +kubectl get pvc -n aztec +``` + +Check storage class availability: + +```bash +kubectl get storageclass +``` + +### P2P Connectivity + +For external P2P access, enable NodePort: + +```yaml +service: + p2p: + nodePortEnabled: true +``` + +Or use host networking: + +```yaml +hostNetwork: true +``` + +### Prover Components Not Communicating + +Verify all 3 StatefulSets are running: + +```bash +kubectl get statefulsets -n aztec +``` + +Check service DNS resolution: + +```bash +kubectl get svc -n aztec | grep prover +``` + +## Resources + +- [Aztec Documentation](https://docs.aztec.network) +- [Aztec Network Guide](https://docs.aztec.network/the_aztec_network) +- [Running an Aztec Node](https://docs.aztec.network/the_aztec_network/guides/run_nodes) +- [Chart Values Reference](./values.yaml) + +## License + +Apache 2.0 + +## Contributing + +Contributions welcome! Please submit issues and pull requests to the repository. diff --git a/charts/aztec-node/templates/_helpers.tpl b/charts/aztec-node/templates/_helpers.tpl new file mode 100644 index 00000000..d98736f3 --- /dev/null +++ b/charts/aztec-node/templates/_helpers.tpl @@ -0,0 +1,142 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "chart.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "chart.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "chart.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "chart.labels" -}} +helm.sh/chart: {{ include "chart.chart" . }} +{{ include "chart.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "chart.selectorLabels" -}} +app.kubernetes.io/name: {{ include "chart.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + + +{{/* +Create the name of the service account to use +*/}} +{{- define "chart.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "chart.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{/* +Create the name of the cluster role. +It needs to be namespace prefixed to avoid naming conflicts when using the same deployment name across namespaces. +*/}} +{{- define "chart.clusterRoleName" -}} +{{ .Release.Namespace }}-{{ include "chart.fullname" . }} +{{- end }} + +{{/* +Validate that the role is one of the allowed values +*/}} +{{- define "chart.validateRole" -}} +{{- $validRoles := list "fullnode" "sequencer" "prover" -}} +{{- if not (has .Values.role $validRoles) -}} +{{- fail (printf "Invalid role '%s'. Must be one of: %s" .Values.role (join ", " $validRoles)) -}} +{{- end -}} +{{- end -}} + +{{/* +Validate sequencer configuration +*/}} +{{- define "chart.validateSequencer" -}} +{{- if eq .Values.role "sequencer" -}} +{{- if not .Values.sequencer.attesterPrivateKey -}} +{{- fail "sequencer.attesterPrivateKey is REQUIRED when role is 'sequencer'" -}} +{{- end -}} +{{- if not (hasPrefix "0x" .Values.sequencer.attesterPrivateKey) -}} +{{- fail "sequencer.attesterPrivateKey must start with '0x'" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Validate prover configuration +*/}} +{{- define "chart.validateProver" -}} +{{- if eq .Values.role "prover" -}} +{{- if not .Values.prover.node.publisherPrivateKey -}} +{{- fail "prover.node.publisherPrivateKey is REQUIRED when role is 'prover'" -}} +{{- end -}} +{{- if not (hasPrefix "0x" .Values.prover.node.publisherPrivateKey) -}} +{{- fail "prover.node.publisherPrivateKey must start with '0x'" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Generate startCmd based on role (if not overridden) +Only used for fullnode and sequencer roles +Prover role uses separate component-specific commands +*/}} +{{- define "chart.startCmd" -}} +{{- if .Values.node.startCmd -}} +{{- .Values.node.startCmd | toYaml -}} +{{- else -}} +{{- if eq .Values.role "fullnode" }} +- --node +- --archiver +{{- else if eq .Values.role "sequencer" }} +- --node +- --archiver +- --sequencer +{{- end }} +{{- if .Values.network }} +- --network +- {{ .Values.network }} +{{- end }} +{{- end -}} +{{- end -}} + +{{/* +Run all validations +*/}} +{{- define "chart.validate" -}} +{{- include "chart.validateRole" . -}} +{{- include "chart.validateSequencer" . -}} +{{- include "chart.validateProver" . -}} +{{- end -}} diff --git a/charts/aztec-node/templates/clusterrole.yaml b/charts/aztec-node/templates/clusterrole.yaml new file mode 100644 index 00000000..fc07c5eb --- /dev/null +++ b/charts/aztec-node/templates/clusterrole.yaml @@ -0,0 +1,10 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "chart.clusterRoleName" . }} + labels: + {{- include "chart.labels" . | nindent 4 }} +rules: +{{- toYaml .Values.rbac.clusterRules | nindent 0 }} +{{- end }} diff --git a/charts/aztec-node/templates/clusterrolebinding.yaml b/charts/aztec-node/templates/clusterrolebinding.yaml new file mode 100644 index 00000000..7b0bfd3a --- /dev/null +++ b/charts/aztec-node/templates/clusterrolebinding.yaml @@ -0,0 +1,16 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "chart.clusterRoleName" . }} + labels: + {{- include "chart.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "chart.clusterRoleName" . }} +subjects: + - kind: ServiceAccount + name: {{ include "chart.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/charts/aztec-node/templates/role.yaml b/charts/aztec-node/templates/role.yaml new file mode 100644 index 00000000..10d5acb6 --- /dev/null +++ b/charts/aztec-node/templates/role.yaml @@ -0,0 +1,10 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "chart.serviceAccountName" . }} + labels: + {{- include "chart.labels" . | nindent 4 }} +rules: +{{- toYaml .Values.rbac.rules | nindent 0 }} +{{- end }} diff --git a/charts/aztec-node/templates/rolebinding.yaml b/charts/aztec-node/templates/rolebinding.yaml new file mode 100644 index 00000000..32d7a79c --- /dev/null +++ b/charts/aztec-node/templates/rolebinding.yaml @@ -0,0 +1,15 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "chart.serviceAccountName" . }} + labels: + {{- include "chart.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "chart.serviceAccountName" . }} +subjects: + - kind: ServiceAccount + name: {{ include "chart.serviceAccountName" . }} +{{- end }} diff --git a/charts/aztec-node/templates/secret.yaml b/charts/aztec-node/templates/secret.yaml new file mode 100644 index 00000000..abc0b264 --- /dev/null +++ b/charts/aztec-node/templates/secret.yaml @@ -0,0 +1,19 @@ +{{- if eq .Values.role "sequencer" }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "chart.fullname" . }}-keystore + labels: + {{- include "chart.labels" . | nindent 4 }} +stringData: + keystore.json: | + { + "schemaVersion": 1, + "validators": [ + { + "attester": ["{{ .Values.sequencer.attesterPrivateKey }}"], + "feeRecipient": "{{ .Values.sequencer.feeRecipient }}" + } + ] + } +{{- end }} diff --git a/charts/aztec-node/templates/service-prover-agent.yaml b/charts/aztec-node/templates/service-prover-agent.yaml new file mode 100644 index 00000000..db83ffe4 --- /dev/null +++ b/charts/aztec-node/templates/service-prover-agent.yaml @@ -0,0 +1,26 @@ +{{- if eq .Values.role "prover" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "chart.fullname" . }}-prover-agent + labels: + {{- include "chart.labels" . | nindent 4 }} + aztec.network/role: prover + aztec.network/component: prover-agent +spec: + clusterIP: None + selector: + {{- include "chart.selectorLabels" . | nindent 4 }} + app: prover-agent + ports: + - port: {{ .Values.service.httpPort }} + name: http-rpc + protocol: TCP + targetPort: http-rpc + {{- if .Values.service.admin.enabled }} + - port: {{ .Values.service.admin.port }} + name: admin + protocol: TCP + targetPort: admin + {{- end }} +{{- end }} diff --git a/charts/aztec-node/templates/service-prover-broker.yaml b/charts/aztec-node/templates/service-prover-broker.yaml new file mode 100644 index 00000000..932607e0 --- /dev/null +++ b/charts/aztec-node/templates/service-prover-broker.yaml @@ -0,0 +1,26 @@ +{{- if eq .Values.role "prover" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "chart.fullname" . }}-prover-broker + labels: + {{- include "chart.labels" . | nindent 4 }} + aztec.network/role: prover + aztec.network/component: prover-broker +spec: + clusterIP: None + selector: + {{- include "chart.selectorLabels" . | nindent 4 }} + app: prover-broker + ports: + - port: {{ .Values.service.httpPort }} + name: http-rpc + protocol: TCP + targetPort: http-rpc + {{- if .Values.service.admin.enabled }} + - port: {{ .Values.service.admin.port }} + name: admin + protocol: TCP + targetPort: admin + {{- end }} +{{- end }} diff --git a/charts/aztec-node/templates/service-prover-node.yaml b/charts/aztec-node/templates/service-prover-node.yaml new file mode 100644 index 00000000..9ba9364d --- /dev/null +++ b/charts/aztec-node/templates/service-prover-node.yaml @@ -0,0 +1,36 @@ +{{- if eq .Values.role "prover" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "chart.fullname" . }}-prover-node + labels: + {{- include "chart.labels" . | nindent 4 }} + aztec.network/role: prover + aztec.network/component: prover-node +spec: + clusterIP: None + selector: + {{- include "chart.selectorLabels" . | nindent 4 }} + app: prover-node + ports: + - port: {{ .Values.service.httpPort }} + name: http-rpc + protocol: TCP + targetPort: http-rpc + {{- if .Values.service.admin.enabled }} + - port: {{ .Values.service.admin.port }} + name: admin + protocol: TCP + targetPort: admin + {{- end }} + {{- if .Values.service.p2p.enabled }} + - port: {{ .Values.service.p2p.port }} + name: p2p-tcp + protocol: TCP + targetPort: p2p-tcp + - port: {{ .Values.service.p2p.port }} + name: p2p-udp + protocol: UDP + targetPort: p2p-udp + {{- end }} +{{- end }} diff --git a/charts/aztec-node/templates/serviceaccount.yaml b/charts/aztec-node/templates/serviceaccount.yaml new file mode 100644 index 00000000..068ee504 --- /dev/null +++ b/charts/aztec-node/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "chart.serviceAccountName" . }} + labels: + {{- include "chart.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/charts/aztec-node/templates/statefulset-prover-agent.yaml b/charts/aztec-node/templates/statefulset-prover-agent.yaml new file mode 100644 index 00000000..b8596701 --- /dev/null +++ b/charts/aztec-node/templates/statefulset-prover-agent.yaml @@ -0,0 +1,139 @@ +{{- if eq .Values.role "prover" }} +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ include "chart.fullname" . }}-prover-agent + labels: + {{- include "chart.labels" . | nindent 4 }} + aztec.network/role: prover + aztec.network/component: prover-agent +spec: + serviceName: {{ include "chart.fullname" . }}-prover-agent + replicas: {{ .Values.prover.agent.replicas }} + podManagementPolicy: {{ .Values.podManagementPolicy }} + updateStrategy: + {{- toYaml .Values.node.updateStrategy | nindent 4 }} + selector: + matchLabels: + {{- include "chart.selectorLabels" . | nindent 6 }} + app: prover-agent + template: + metadata: + labels: + {{- include "chart.selectorLabels" . | nindent 8 }} + app: prover-agent + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + serviceAccountName: {{ include "chart.serviceAccountName" . }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.initContainers }} + initContainers: + {{- tpl (toYaml .Values.initContainers | nindent 8) $ }} + {{- end }} + containers: + - name: prover-agent + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: + - /bin/bash + - -c + - | + start_cmd=("node" "/usr/src/yarn-project/aztec/dest/bin/index.js" "start" "--prover-agent") + {{- if .Values.network }} + start_cmd+=("--network" "{{ .Values.network }}") + {{- end }} + "${start_cmd[@]}" + volumeMounts: + - name: storage + mountPath: {{ .Values.node.storage.dataDirectory }} + env: + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: K8S_POD_UID + valueFrom: + fieldRef: + fieldPath: metadata.uid + - name: K8S_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OTEL_SERVICE_NAME + value: prover-agent + - name: K8S_NAMESPACE_NAME + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- if .Values.network }} + - name: NETWORK + value: "{{ .Values.network }}" + {{- else }} + - name: REGISTRY_CONTRACT_ADDRESS + value: "{{ .Values.customNetwork.registryContractAddress }}" + - name: L1_CHAIN_ID + value: "{{ .Values.customNetwork.l1ChainId }}" + - name: SLASH_FACTORY_ADDRESS + value: "{{ .Values.customNetwork.slashFactoryAddress }}" + - name: FEE_ASSET_HANDLER_CONTRACT_ADDRESS + value: "{{ .Values.customNetwork.feeAssetHandlerContractAddress }}" + {{- end }} + - name: NODE_OPTIONS + value: {{ join " " .Values.node.nodeJsOptions | quote }} + - name: LOG_LEVEL + value: "{{ .Values.node.logLevel }}" + - name: LOG_JSON + value: "1" + - name: PROVER_AGENT_COUNT + value: {{ .Values.prover.agent.count | quote }} + - name: PROVER_AGENT_POLL_INTERVAL_MS + value: {{ .Values.prover.agent.pollIntervalMs | quote }} + # Prover broker is running in the same deployment + - name: PROVER_BROKER_HOST + value: "http://{{ include "chart.fullname" . }}-prover-broker:{{ .Values.service.httpPort }}" + {{- if .Values.prover.id }} + - name: PROVER_ID + value: {{ .Values.prover.id | quote }} + {{- end }} + - name: DATA_DIRECTORY + value: {{ .Values.node.storage.dataDirectory | quote }} + resources: + {{- if .Values.prover.agent.resources }} + {{- toYaml .Values.prover.agent.resources | nindent 12 }} + {{- else }} + {{- toYaml .Values.node.resources | nindent 12 }} + {{- end }} + {{- if not .Values.persistence.enabled }} + volumes: + - name: storage + emptyDir: {} + {{- else if .Values.persistence.existingClaim }} + volumes: + - name: storage + persistentVolumeClaim: + claimName: {{ .Values.persistence.existingClaim }} + {{- else }} + volumeClaimTemplates: + - metadata: + name: storage + annotations: + {{- toYaml .Values.persistence.annotations | nindent 10 }} + spec: + accessModes: + {{- toYaml .Values.persistence.accessModes | nindent 12 }} + resources: + requests: + storage: {{ .Values.prover.agent.persistence.size | default .Values.persistence.size | quote}} + storageClassName: {{ .Values.persistence.storageClassName }} + {{- if .Values.persistence.selector }} + selector: + {{- toYaml .Values.persistence.selector | nindent 12 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/aztec-node/templates/statefulset-prover-broker.yaml b/charts/aztec-node/templates/statefulset-prover-broker.yaml new file mode 100644 index 00000000..094af474 --- /dev/null +++ b/charts/aztec-node/templates/statefulset-prover-broker.yaml @@ -0,0 +1,155 @@ +{{- if eq .Values.role "prover" }} +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ include "chart.fullname" . }}-prover-broker + labels: + {{- include "chart.labels" . | nindent 4 }} + aztec.network/role: prover + aztec.network/component: prover-broker +spec: + serviceName: {{ include "chart.fullname" . }}-prover-broker + replicas: 1 + podManagementPolicy: {{ .Values.podManagementPolicy }} + updateStrategy: + {{- toYaml .Values.node.updateStrategy | nindent 4 }} + selector: + matchLabels: + {{- include "chart.selectorLabels" . | nindent 6 }} + app: prover-broker + template: + metadata: + labels: + {{- include "chart.selectorLabels" . | nindent 8 }} + app: prover-broker + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + serviceAccountName: {{ include "chart.serviceAccountName" . }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.initContainers }} + initContainers: + {{- tpl (toYaml .Values.initContainers | nindent 8) $ }} + {{- end }} + containers: + - name: prover-broker + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: + - /bin/bash + - -c + - | + start_cmd=("node" "/usr/src/yarn-project/aztec/dest/bin/index.js" "start" "--prover-broker") + {{- if .Values.network }} + start_cmd+=("--network" "{{ .Values.network }}") + {{- end }} + "${start_cmd[@]}" + startupProbe: + httpGet: + path: /status + port: {{ .Values.service.httpPort }} + periodSeconds: {{ .Values.node.startupProbe.periodSeconds }} + failureThreshold: {{ .Values.node.startupProbe.failureThreshold }} + livenessProbe: + httpGet: + path: /status + port: {{ .Values.service.httpPort }} + initialDelaySeconds: 30 + periodSeconds: 5 + timeoutSeconds: 30 + failureThreshold: 3 + volumeMounts: + - name: storage + mountPath: {{ .Values.node.storage.dataDirectory }} + env: + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: K8S_POD_UID + valueFrom: + fieldRef: + fieldPath: metadata.uid + - name: K8S_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OTEL_SERVICE_NAME + value: prover-broker + - name: K8S_NAMESPACE_NAME + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- if .Values.network }} + - name: NETWORK + value: "{{ .Values.network }}" + {{- else }} + - name: REGISTRY_CONTRACT_ADDRESS + value: "{{ .Values.customNetwork.registryContractAddress }}" + - name: L1_CHAIN_ID + value: "{{ .Values.customNetwork.l1ChainId }}" + - name: SLASH_FACTORY_ADDRESS + value: "{{ .Values.customNetwork.slashFactoryAddress }}" + - name: FEE_ASSET_HANDLER_CONTRACT_ADDRESS + value: "{{ .Values.customNetwork.feeAssetHandlerContractAddress }}" + {{- end }} + - name: NODE_OPTIONS + value: {{ join " " .Values.node.nodeJsOptions | quote }} + - name: AZTEC_PORT + value: "{{ .Values.service.httpPort }}" + - name: LOG_LEVEL + value: "{{ .Values.node.logLevel }}" + - name: LOG_JSON + value: "1" + {{- if gt (len .Values.node.l1ExecutionUrls) 0 }} + - name: ETHEREUM_HOSTS + value: {{ join "," .Values.node.l1ExecutionUrls | quote }} + {{- end }} + - name: DATA_DIRECTORY + value: {{ .Values.node.storage.dataDirectory | quote }} + ports: + - containerPort: {{ .Values.service.httpPort }} + name: http-rpc + {{- if .Values.service.admin.enabled }} + - containerPort: {{ .Values.service.admin.port }} + name: admin + {{- end }} + resources: + {{- if .Values.prover.broker.resources }} + {{- toYaml .Values.prover.broker.resources | nindent 12 }} + {{- else }} + {{- toYaml .Values.node.resources | nindent 12 }} + {{- end }} + {{- if not .Values.persistence.enabled }} + volumes: + - name: storage + emptyDir: {} + {{- else if .Values.persistence.existingClaim }} + volumes: + - name: storage + persistentVolumeClaim: + claimName: {{ .Values.persistence.existingClaim }} + {{- else }} + volumeClaimTemplates: + - metadata: + name: storage + annotations: + {{- toYaml .Values.persistence.annotations | nindent 10 }} + spec: + accessModes: + {{- toYaml .Values.persistence.accessModes | nindent 12 }} + resources: + requests: + storage: {{ .Values.prover.broker.persistence.size | default .Values.persistence.size | quote}} + storageClassName: {{ .Values.persistence.storageClassName }} + {{- if .Values.persistence.selector }} + selector: + {{- toYaml .Values.persistence.selector | nindent 12 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/aztec-node/templates/statefulset-prover-node.yaml b/charts/aztec-node/templates/statefulset-prover-node.yaml new file mode 100644 index 00000000..7b65e82a --- /dev/null +++ b/charts/aztec-node/templates/statefulset-prover-node.yaml @@ -0,0 +1,191 @@ +{{- if eq .Values.role "prover" }} +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ include "chart.fullname" . }}-prover-node + labels: + {{- include "chart.labels" . | nindent 4 }} + aztec.network/role: prover + aztec.network/component: prover-node +spec: + serviceName: {{ include "chart.fullname" . }}-prover-node + replicas: 1 + podManagementPolicy: {{ .Values.podManagementPolicy }} + updateStrategy: + {{- toYaml .Values.node.updateStrategy | nindent 4 }} + selector: + matchLabels: + {{- include "chart.selectorLabels" . | nindent 6 }} + app: prover-node + template: + metadata: + labels: + {{- include "chart.selectorLabels" . | nindent 8 }} + app: prover-node + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + serviceAccountName: {{ include "chart.serviceAccountName" . }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.initContainers }} + initContainers: + {{- tpl (toYaml .Values.initContainers | nindent 8) $ }} + {{- end }} + containers: + - name: prover-node + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: + - /bin/bash + - -c + - | + export P2P_IP=$(hostname -i) + start_cmd=("node" "/usr/src/yarn-project/aztec/dest/bin/index.js" "start" "--prover-node" "--archiver") + {{- if .Values.network }} + start_cmd+=("--network" "{{ .Values.network }}") + {{- end }} + "${start_cmd[@]}" + startupProbe: + httpGet: + path: /status + port: {{ .Values.service.httpPort }} + periodSeconds: {{ .Values.node.startupProbe.periodSeconds }} + failureThreshold: {{ .Values.node.startupProbe.failureThreshold }} + livenessProbe: + httpGet: + path: /status + port: {{ .Values.service.httpPort }} + initialDelaySeconds: 30 + periodSeconds: 5 + timeoutSeconds: 30 + failureThreshold: 3 + volumeMounts: + - name: storage + mountPath: {{ .Values.node.storage.dataDirectory }} + env: + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: K8S_POD_UID + valueFrom: + fieldRef: + fieldPath: metadata.uid + - name: K8S_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OTEL_SERVICE_NAME + value: prover-node + - name: K8S_NAMESPACE_NAME + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- if .Values.network }} + - name: NETWORK + value: "{{ .Values.network }}" + {{- else }} + - name: REGISTRY_CONTRACT_ADDRESS + value: "{{ .Values.customNetwork.registryContractAddress }}" + - name: L1_CHAIN_ID + value: "{{ .Values.customNetwork.l1ChainId }}" + - name: SLASH_FACTORY_ADDRESS + value: "{{ .Values.customNetwork.slashFactoryAddress }}" + - name: FEE_ASSET_HANDLER_CONTRACT_ADDRESS + value: "{{ .Values.customNetwork.feeAssetHandlerContractAddress }}" + {{- end }} + - name: NODE_OPTIONS + value: {{ join " " .Values.node.nodeJsOptions | quote }} + - name: AZTEC_PORT + value: "{{ .Values.service.httpPort }}" + - name: LOG_LEVEL + value: "{{ .Values.node.logLevel }}" + - name: LOG_JSON + value: "1" + - name: P2P_ENABLED + value: "{{ .Values.service.p2p.enabled }}" + - name: P2P_PORT + value: "{{ .Values.service.p2p.port }}" + - name: P2P_QUERY_FOR_IP + value: "true" + - name: PROVER_PUBLISHER_PRIVATE_KEY + value: {{ .Values.prover.node.publisherPrivateKey | quote }} + # Prover broker is running in the same deployment + - name: PROVER_BROKER_HOST + value: "http://{{ include "chart.fullname" . }}-prover-broker:{{ .Values.service.httpPort }}" + {{- if .Values.prover.id }} + - name: PROVER_ID + value: {{ .Values.prover.id | quote }} + {{- end }} + {{- if gt (len .Values.node.l1ExecutionUrls) 0 }} + - name: ETHEREUM_HOSTS + value: {{ join "," .Values.node.l1ExecutionUrls | quote }} + {{- end }} + {{- if gt (len .Values.node.l1ConsensusUrls) 0 }} + - name: L1_CONSENSUS_HOST_URLS + value: {{ join "," .Values.node.l1ConsensusUrls | quote }} + - name: L1_CONSENSUS_HOST_API_KEYS + value: {{ join "," .Values.node.l1ConsensusHostApiKeys | quote }} + - name: L1_CONSENSUS_HOST_API_KEY_HEADERS + value: {{ join "," .Values.node.l1ConsensusHostApiKeyHeaders | quote }} + {{- end }} + - name: ARCHIVER_POLLING_INTERVAL_MS + value: "10000" + - name: DATA_DIRECTORY + value: {{ .Values.node.storage.dataDirectory | quote }} + - name: DATA_STORE_MAP_SIZE_KB + value: {{ .Values.node.storage.dataStoreMapSize | quote }} + - name: WS_DB_MAP_SIZE_KB + value: {{ .Values.node.storage.worldStateMapSize | quote }} + ports: + - containerPort: {{ .Values.service.httpPort }} + name: http-rpc + {{- if .Values.service.admin.enabled }} + - containerPort: {{ .Values.service.admin.port }} + name: admin + {{- end }} + {{- if .Values.service.p2p.enabled }} + - containerPort: {{ .Values.service.p2p.port }} + name: p2p-tcp + - containerPort: {{ .Values.service.p2p.port }} + protocol: UDP + name: p2p-udp + {{- end }} + resources: + {{- if .Values.prover.node.resources }} + {{- toYaml .Values.prover.node.resources | nindent 12 }} + {{- else }} + {{- toYaml .Values.node.resources | nindent 12 }} + {{- end }} + {{- if not .Values.persistence.enabled }} + volumes: + - name: storage + emptyDir: {} + {{- else if .Values.persistence.existingClaim }} + - name: storage + persistentVolumeClaim: + claimName: {{ .Values.persistence.existingClaim }} + {{- else }} + volumeClaimTemplates: + - metadata: + name: storage + annotations: + {{- toYaml .Values.persistence.annotations | nindent 10 }} + spec: + accessModes: + {{- toYaml .Values.persistence.accessModes | nindent 12 }} + resources: + requests: + storage: {{ .Values.prover.node.persistence.size | default .Values.persistence.size | quote}} + storageClassName: {{ .Values.persistence.storageClassName }} + {{- if .Values.persistence.selector }} + selector: + {{- toYaml .Values.persistence.selector | nindent 12 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/aztec-node/templates/statefulset.yaml b/charts/aztec-node/templates/statefulset.yaml new file mode 100644 index 00000000..5a09dfc6 --- /dev/null +++ b/charts/aztec-node/templates/statefulset.yaml @@ -0,0 +1,283 @@ +{{- include "chart.validate" . -}} +{{- if or (eq .Values.role "fullnode") (eq .Values.role "sequencer") }} +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ include "chart.fullname" . }} + labels: + {{- include "chart.labels" . | nindent 4 }} + aztec.network/role: {{ .Values.role }} +spec: + serviceName: {{ include "chart.fullname" . }} + replicas: {{ .Values.node.replicas }} + podManagementPolicy: {{ .Values.podManagementPolicy }} + updateStrategy: + {{- toYaml .Values.node.updateStrategy | nindent 4 }} + selector: + matchLabels: + {{- include "chart.selectorLabels" . | nindent 6 }} + app: node + template: + metadata: + labels: + {{- include "chart.selectorLabels" . | nindent 8 }} + app: node + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + serviceAccountName: {{ include "chart.serviceAccountName" . }} + dnsPolicy: ClusterFirstWithHostNet + hostNetwork: {{ .Values.hostNetwork }} + {{- if or .Values.service.p2p.nodePortEnabled .Values.hostNetwork }} + affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: app + operator: In + values: + - node + topologyKey: kubernetes.io/hostname + namespaceSelector: {} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.initContainers }} + initContainers: + {{- tpl (toYaml .Values.initContainers | nindent 8) $ }} + {{- end }} + containers: + - name: aztec + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: + - /bin/bash + - -c + - | + export P2P_IP=$(hostname -i) + + start_cmd=("node" "/usr/src/yarn-project/aztec/dest/bin/index.js" "start") + + {{- $startCmd := include "chart.startCmd" . | fromYamlArray }} + {{- range $startCmd }} + start_cmd+=("{{ . }}") + {{- end }} + + {{- if .Values.node.preStartScript }} + {{ .Values.node.preStartScript | nindent 14 }} + + {{- end }} + "${start_cmd[@]}" + startupProbe: + httpGet: + path: /status + port: {{ .Values.service.httpPort }} + periodSeconds: {{ .Values.node.startupProbe.periodSeconds }} + failureThreshold: {{ .Values.node.startupProbe.failureThreshold }} + livenessProbe: + httpGet: + path: /status + port: {{ .Values.service.httpPort }} + initialDelaySeconds: 30 + periodSeconds: 5 + timeoutSeconds: 30 + failureThreshold: 3 + volumeMounts: + - name: storage + mountPath: {{ .Values.node.storage.dataDirectory }} + {{- if eq .Values.role "sequencer" }} + - name: keystore + mountPath: /var/lib/keystore + readOnly: true + {{- end }} + {{- if eq .Values.role "prover-node" }} + - name: prover-keystore + mountPath: /var/lib/keystore + readOnly: true + {{- end }} + env: + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: K8S_POD_UID + valueFrom: + fieldRef: + fieldPath: metadata.uid + - name: K8S_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OTEL_SERVICE_NAME + value: node + - name: K8S_NAMESPACE_NAME + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- if .Values.network }} + - name: NETWORK + value: "{{ .Values.network }}" + {{- else }} + - name: REGISTRY_CONTRACT_ADDRESS + value: "{{ .Values.customNetwork.registryContractAddress }}" + - name: L1_CHAIN_ID + value: "{{ .Values.customNetwork.l1ChainId }}" + - name: SLASH_FACTORY_ADDRESS + value: "{{ .Values.customNetwork.slashFactoryAddress }}" + - name: FEE_ASSET_HANDLER_CONTRACT_ADDRESS + value: "{{ .Values.customNetwork.feeAssetHandlerContractAddress }}" + {{- end }} + - name: NODE_OPTIONS + value: {{ join " " .Values.node.nodeJsOptions | quote }} + - name: AZTEC_PORT + value: "{{ .Values.service.httpPort }}" + - name: AZTEC_ADMIN_PORT + value: "{{ .Values.service.admin.port }}" + - name: LOG_LEVEL + value: "{{ .Values.node.logLevel }}" + - name: LOG_JSON + value: "1" + - name: P2P_ENABLED + value: "{{ .Values.service.p2p.enabled }}" + - name: P2P_PORT + value: "{{ .Values.service.p2p.port }}" + - name: P2P_QUERY_FOR_IP + value: "true" + {{- if .Values.node.remoteUrl.archiver }} + - name: ARCHIVER_URL + value: {{ .Values.node.remoteUrl.archiver | quote }} + {{- end }} + {{- if .Values.node.remoteUrl.proverBroker }} + - name: PROVER_BROKER_HOST + value: {{ .Values.node.remoteUrl.proverBroker | quote }} + {{- end }} + {{- if .Values.node.remoteUrl.blobSink }} + - name: BLOB_SINK_URL + value: {{ .Values.node.remoteUrl.blobSink | quote }} + {{- end }} + {{- if gt (len .Values.node.remoteUrl.proverCoordinationNodes) 0 }} + - name: PROVER_COORDINATION_NODE_URLS + value: {{ join "," .Values.node.remoteUrl.proverCoordinationNodes | quote }} + {{- end }} + {{- if gt (len .Values.node.l1ExecutionUrls) 0 }} + - name: ETHEREUM_HOSTS + value: {{ join "," .Values.node.l1ExecutionUrls | quote }} + {{- end }} + {{- if gt (len .Values.node.l1ConsensusUrls) 0 }} + - name: L1_CONSENSUS_HOST_URLS + value: {{ join "," .Values.node.l1ConsensusUrls | quote }} + - name: L1_CONSENSUS_HOST_API_KEYS + value: {{ join "," .Values.node.l1ConsensusHostApiKeys | quote }} + - name: L1_CONSENSUS_HOST_API_KEY_HEADERS + value: {{ join "," .Values.node.l1ConsensusHostApiKeyHeaders | quote }} + {{- end }} + - name: ARCHIVER_POLLING_INTERVAL_MS + value: "10000" + - name: DATA_DIRECTORY + value: {{ .Values.node.storage.dataDirectory | quote }} + - name: DATA_STORE_MAP_SIZE_KB + value: {{ .Values.node.storage.dataStoreMapSize | quote }} + - name: WS_DB_MAP_SIZE_KB + value: {{ .Values.node.storage.worldStateMapSize | quote }} + - name: USE_GCLOUD_LOGGING + value: {{ .Values.node.metrics.useGcloudLogging | quote }} + {{- if .Values.node.metrics.otelCollectorEndpoint }} + - name: OTEL_EXCLUDE_METRICS + value: {{ .Values.node.metrics.otelExcludeMetrics | quote }} + - name: OTEL_EXPORTER_OTLP_METRICS_ENDPOINT + value: "{{ .Values.node.metrics.otelCollectorEndpoint }}/v1/metrics" + - name: OTEL_EXPORTER_OTLP_TRACES_ENDPOINT + value: "{{ .Values.node.metrics.otelCollectorEndpoint }}/v1/traces" + - name: OTEL_EXPORTER_OTLP_LOGS_ENDPOINT + value: "{{ .Values.node.metrics.otelCollectorEndpoint }}/v1/logs" + {{- end }} + {{- if .Values.node.coinbase }} + - name: COINBASE + value: {{ .Values.node.coinbase | quote }} + - name: PROVER_ID + value: {{ .Values.node.coinbase | quote }} + {{- end }} + {{- if eq .Values.role "sequencer" }} + - name: KEY_STORE_DIRECTORY + value: /var/lib/keystore + - name: FEE_RECIPIENT + value: {{ .Values.sequencer.feeRecipient | quote }} + {{- end }} + {{- if eq .Values.role "prover-node" }} + - name: KEY_STORE_DIRECTORY + value: /var/lib/keystore + {{- if .Values.prover.id }} + - name: PROVER_ID + value: {{ .Values.prover.id | quote }} + {{- end }} + {{- end }} + {{- if eq .Values.role "prover-agent" }} + - name: PROVER_AGENT_COUNT + value: {{ .Values.prover.agent.count | quote }} + - name: PROVER_AGENT_POLL_INTERVAL_MS + value: {{ .Values.prover.agent.pollIntervalMs | quote }} + {{- if .Values.prover.id }} + - name: PROVER_ID + value: {{ .Values.prover.id | quote }} + {{- end }} + {{- end }} + - name: SENTINEL_ENABLED + value: {{ .Values.node.sentinel.enabled | quote }} + ports: + - containerPort: {{ .Values.service.httpPort }} + name: http-rpc + {{- if .Values.service.admin.enabled }} + - containerPort: {{ .Values.service.admin.port }} + name: admin + {{- end }} + {{- if .Values.service.p2p.enabled }} + - containerPort: {{ .Values.service.p2p.port }} + name: p2p-tcp + - containerPort: {{ .Values.service.p2p.port }} + protocol: UDP + name: p2p-udp + {{- end }} + resources: + {{- toYaml .Values.node.resources | nindent 12 }} + volumes: + {{- if eq .Values.role "sequencer" }} + - name: keystore + secret: + secretName: {{ include "chart.fullname" . }}-keystore + {{- end }} + {{- if eq .Values.role "prover-node" }} + - name: prover-keystore + secret: + secretName: {{ include "chart.fullname" . }}-prover-keystore + {{- end }} + {{- if not .Values.persistence.enabled }} + - name: storage + emptyDir: {} + {{- else if .Values.persistence.existingClaim }} + - name: storage + persistentVolumeClaim: + claimName: {{ .Values.persistence.existingClaim }} + {{- else }} + volumeClaimTemplates: + - metadata: + name: storage + annotations: + {{- toYaml .Values.persistence.annotations | nindent 10 }} + spec: + accessModes: + {{- toYaml .Values.persistence.accessModes | nindent 12 }} + resources: + requests: + storage: {{ .Values.persistence.size | quote}} + storageClassName: {{ .Values.persistence.storageClassName }} + {{- if .Values.persistence.selector }} + selector: + {{- toYaml .Values.persistence.selector | nindent 12 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/aztec-node/templates/svc.headless.yaml b/charts/aztec-node/templates/svc.headless.yaml new file mode 100644 index 00000000..2c9256e6 --- /dev/null +++ b/charts/aztec-node/templates/svc.headless.yaml @@ -0,0 +1,33 @@ +{{- if .Values.service.headless.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "chart.fullname" . }}-headless + labels: + {{- include "chart.labels" . | nindent 4 }} +spec: + clusterIP: None + ports: + {{- if .Values.service.p2p.enabled }} + - port: {{ .Values.service.p2p.port }} + targetPort: p2p-tcp + protocol: TCP + name: p2p-tcp + - port: {{ .Values.service.p2p.port }} + targetPort: p2p-udp + protocol: UDP + name: p2p-udp + {{- end }} + - port: {{ .Values.service.httpPort }} + targetPort: http-rpc + protocol: TCP + name: http-rpc + {{- if .Values.service.admin.enabled }} + - port: {{ .Values.service.admin.port }} + targetPort: admin + protocol: TCP + name: admin + {{- end }} + selector: + {{- include "chart.selectorLabels" . | nindent 4 }} +{{- end }} diff --git a/charts/aztec-node/templates/svc.nodeport.yaml b/charts/aztec-node/templates/svc.nodeport.yaml new file mode 100644 index 00000000..06a29b24 --- /dev/null +++ b/charts/aztec-node/templates/svc.nodeport.yaml @@ -0,0 +1,31 @@ +{{- if and .Values.service.p2p.enabled .Values.service.p2p.nodePortEnabled (not .Values.hostNetwork) -}} +{{- range $i, $e := until (.Values.node.replicas | int) }} +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ include "chart.fullname" $ }}-p2p-node-port-{{ $i }} + labels: + {{- include "chart.labels" $ | nindent 4 }} + app: node + type: p2p + pod-index: "{{ $i }}" +spec: + type: NodePort + externalTrafficPolicy: Local + ports: + - name: p2p-tcp + port: {{ $.Values.service.p2p.port }} + protocol: TCP + targetPort: p2p-tcp + nodePort: {{ add $.Values.service.p2p.port $i }} + - name: p2p-udp + port: {{ $.Values.service.p2p.port }} + protocol: UDP + targetPort: p2p-udp + nodePort: {{ add $.Values.service.p2p.port $i }} + selector: + {{- include "chart.selectorLabels" $ | nindent 4 }} + statefulset.kubernetes.io/pod-name: "{{ include "chart.fullname" $ }}-{{ $i }}" +{{- end }} +{{- end }} diff --git a/charts/aztec-node/templates/svc.yaml b/charts/aztec-node/templates/svc.yaml new file mode 100644 index 00000000..5c7ad63c --- /dev/null +++ b/charts/aztec-node/templates/svc.yaml @@ -0,0 +1,35 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "chart.fullname" . }} + labels: + {{- include "chart.labels" . | nindent 4 }} + {{- with .Values.service.ingress.annotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} +spec: + type: ClusterIP + ports: + {{- if .Values.service.p2p.enabled }} + - port: {{ .Values.service.p2p.port }} + targetPort: p2p-tcp + protocol: TCP + name: p2p-tcp + - port: {{ .Values.service.p2p.port }} + targetPort: p2p-udp + protocol: UDP + name: p2p-udp + {{- end }} + - port: {{ .Values.service.httpPort }} + targetPort: http-rpc + protocol: TCP + name: http-rpc + {{- if .Values.service.admin.enabled }} + - port: {{ .Values.service.admin.port }} + targetPort: admin + protocol: TCP + name: admin + {{- end }} + selector: + {{- include "chart.selectorLabels" . | nindent 4 }} diff --git a/charts/aztec-node/values-examples/README.md b/charts/aztec-node/values-examples/README.md new file mode 100644 index 00000000..685c4ae2 --- /dev/null +++ b/charts/aztec-node/values-examples/README.md @@ -0,0 +1,159 @@ +# Aztec Node Deployment Examples + +This directory contains example values files for deploying Aztec nodes in different roles. + +## Available Roles + +### 1. Full Node (`fullnode.yaml`) +A full node participates in the Aztec network by running archiver and node services. + +**Command:** `--node --archiver --network testnet` + +**Use case:** Network participation, development, testing + +**Requirements:** +- L1 Ethereum RPC access (execution + consensus) +- 1TB NVMe SSD +- 2-4 CPU cores, 8-16GB RAM + +**Deploy:** +```bash +helm install aztec-fullnode ./charts/aztec-node \ + -f charts/aztec-node/values-examples/fullnode.yaml \ + -n aztec --create-namespace +``` + +### 2. Sequencer (`sequencer.yaml`) +A sequencer produces blocks and attestations for the network. + +**Command:** `--node --archiver --sequencer --network testnet` + +**Use case:** Block production, network consensus participation + +**Requirements:** +- L1 Ethereum RPC access (low-latency preferred) +- Ethereum private key with minimum 0.1 ETH on L1 +- 1TB NVMe SSD +- 4-8 CPU cores, 16-32GB RAM + +**Deploy:** +```bash +# IMPORTANT: Set your attester private key first! +helm install aztec-sequencer ./charts/aztec-node \ + -f charts/aztec-node/values-examples/sequencer.yaml \ + --set sequencer.attesterPrivateKey="0xYOUR_PRIVATE_KEY" \ + -n aztec --create-namespace +``` + +### 3. Prover (`prover.yaml`) +The prover role deploys a complete distributed proving system with 3 components: +- **Prover Broker**: Manages job queue (`--prover-broker --network testnet`) +- **Prover Node**: Creates jobs and publishes proofs to L1 (`--prover-node --archiver --network testnet`) +- **Prover Agent(s)**: Execute proof computation (`--prover-agent --network testnet`) + +**Use case:** Distributed proof generation and L1 publication + +**Requirements:** +- L1 Ethereum RPC access (for prover-node) +- Ethereum private key with ETH for L1 proof submissions +- **Prover Broker**: 1-2 CPU cores, 4-8GB RAM, 10GB SSD +- **Prover Node**: 2-4 CPU cores, 8-16GB RAM, 1TB NVMe SSD +- **Prover Agent(s)**: **16-32 CPU cores, 64-128GB RAM per agent**, 10GB SSD per agent (high-performance compute) + +**Deploy:** +```bash +# IMPORTANT: Set your publisher private key first! +helm install aztec-prover ./charts/aztec-node \ + -f charts/aztec-node/values-examples/prover.yaml \ + --set prover.node.publisherPrivateKey="0xYOUR_PRIVATE_KEY" \ + -n aztec --create-namespace +``` + +**Scale prover agents:** +```bash +# Increase number of prover agent pods +helm upgrade aztec-prover ./charts/aztec-node \ + -f charts/aztec-node/values-examples/prover.yaml \ + --set prover.agent.replicas=4 \ + --set prover.node.publisherPrivateKey="0xYOUR_PRIVATE_KEY" \ + -n aztec +``` + +**Persistence Configuration:** + +Each prover component has independent storage configuration matching Aztec's minimum requirements: + +```yaml +prover: + node: + persistence: + size: 1000Gi # Prover-node needs 1TB NVMe SSD for archiver data + broker: + persistence: + size: 10Gi # Broker needs 10GB SSD for job queue + agent: + persistence: + size: 10Gi # Agent needs 10GB SSD per agent for CRS +``` + +The global `persistence.enabled` flag controls persistence for all components. + +## Role-Based Architecture + +The chart uses a `role` field to determine the deployment type: + +```yaml +role: fullnode # fullnode | sequencer | prover +``` + +### Role Behavior + +| Role | StatefulSets Created | Services Started | +|------|---------------------|------------------| +| **fullnode** | 1 | Aztec node with archiver | +| **sequencer** | 1 | Aztec node with archiver + sequencer | +| **prover** | 3 | Prover broker, prover node, prover agent(s) | + +The prover role automatically handles internal communication between components: +- Prover node connects to broker at `http://-prover-broker:8080` +- Prover agents connect to broker at `http://-prover-broker:8080` + +## Required Fields by Role + +### Sequencer +- `sequencer.attesterPrivateKey` (required) - Must start with `0x` +- `sequencer.feeRecipient` (optional) - Defaults to zero address + +### Prover +- `prover.node.publisherPrivateKey` (required) - Must start with `0x` +- `prover.id` (optional) - Address for receiving proof rewards +- `prover.agent.replicas` (optional) - Number of prover agent pods (default: 1) +- `prover.agent.count` (optional) - Number of prover threads per pod (default: 1) + +## Network Selection + +Use the `network` field to connect to predefined networks: + +```yaml +network: testnet # or devnet +``` + +For custom networks, omit `network` and provide: + +```yaml +customNetwork: + l1ChainId: "11155111" + registryContractAddress: "0x..." + slashFactoryAddress: "0x..." + feeAssetHandlerContractAddress: "0x..." +``` + +## Advanced Configuration + +See the main [values.yaml](../values.yaml) for all available configuration options including: +- Component-specific resource limits +- Metrics and observability +- Storage configuration +- Network policies +- Service configuration +- And more... diff --git a/charts/aztec-node/values-examples/fullnode.yaml b/charts/aztec-node/values-examples/fullnode.yaml new file mode 100644 index 00000000..c583594c --- /dev/null +++ b/charts/aztec-node/values-examples/fullnode.yaml @@ -0,0 +1,62 @@ +# Example values for deploying an Aztec full node +# A full node participates in the network by running archiver and node services + +# Deployment role +role: fullnode + +# Network to connect to (testnet, devnet, or custom) +network: testnet + +# Container image configuration +image: + repository: aztecprotocol/aztec + tag: latest + pullPolicy: IfNotPresent # Use 'Always' for auto-updates, 'IfNotPresent' for stability + +# Node configuration +node: + replicas: 1 + logLevel: "info" + + # L1 Ethereum configuration + l1ExecutionUrls: + - "http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545" + l1ConsensusUrls: + - "http://l1-full-node-sepolia-beacon.l1.svc.cluster.local:5052" + + # Resource allocation + resources: + requests: + cpu: "2" + memory: "8Gi" + limits: + cpu: "4" + memory: "16Gi" + + # Storage configuration + storage: + dataDirectory: /data + dataStoreMapSize: "134217728" # 128 GB + worldStateMapSize: "134217728" # 128 GB + +# Persistence +# Full node requires 1TB NVMe SSD for archiver data +persistence: + enabled: true + size: 1000Gi + # storageClassName: standard # Uncomment to use a specific storage class + accessModes: + - ReadWriteOnce + +# Service configuration +service: + httpPort: 8080 + + p2p: + enabled: true + nodePortEnabled: false + port: 40400 + + admin: + enabled: true + port: 8081 diff --git a/charts/aztec-node/values-examples/prover.yaml b/charts/aztec-node/values-examples/prover.yaml new file mode 100644 index 00000000..ad9ffcc9 --- /dev/null +++ b/charts/aztec-node/values-examples/prover.yaml @@ -0,0 +1,116 @@ +# Example configuration for Prover deployment +# This creates 3 StatefulSets: prover-broker, prover-node, and prover-agent + +role: prover + +# Network to connect to +network: testnet + +# Prover configuration +prover: + # Prover node configuration + node: + # REQUIRED: Ethereum private key for publishing proofs to L1 + # This key will be used to sign and submit rollup proofs + # WARNING: This is a TEST KEY - DO NOT USE IN PRODUCTION + # Replace with your actual private key for production use + publisherPrivateKey: "0x0000000000000000000000000000000000000000000000000000000000000001" + + resources: + requests: + cpu: "2" + memory: "8Gi" + limits: + cpu: "4" + memory: "16Gi" + + # Prover-node needs 1TB NVMe SSD for archiver data + persistence: + size: 1000Gi + + # Prover broker configuration + broker: + resources: + requests: + cpu: "1" + memory: "4Gi" + limits: + cpu: "2" + memory: "8Gi" + + # Broker needs 10GB SSD for job queue + persistence: + size: 10Gi + + # Prover agent configuration + agent: + # Number of prover agent pods + replicas: 2 + + # Number of prover threads per pod + count: 4 + + # Polling interval in milliseconds + pollIntervalMs: 1000 + + # Recommended: 32 cores and 128GB RAM per agent + resources: + requests: + cpu: "16" + memory: "64Gi" + limits: + cpu: "32" + memory: "128Gi" + + # Agent needs 10GB SSD per agent for CRS and temporary files + persistence: + size: 10Gi + + # Prover ID - address for receiving proof rewards + # Should match the address derived from publisherPrivateKey + # The address below corresponds to the test key above + # REPLACE WITH YOUR ACTUAL ADDRESS when using a real private key + id: "" + +# Image configuration +image: + repository: aztecprotocol/aztec + tag: latest + pullPolicy: IfNotPresent # Use 'Always' for auto-updates, 'IfNotPresent' for stability + +# Node configuration +node: + logLevel: "info" + + # L1 Ethereum connections + l1ExecutionUrls: + - "http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545" + l1ConsensusUrls: + - "http://l1-full-node-sepolia-beacon.l1.svc.cluster.local:5052" + + resources: {} + +# Persistence for prover components +# Each component has its own size configured under prover.{component}.persistence.size +# This enabled flag applies to all prover components +persistence: + enabled: true + # storageClassName: local-path # Uncomment to use a specific storage class + +# Service configuration +service: + httpPort: 8080 + + # P2P is required for prover-node + p2p: + enabled: true + nodePortEnabled: false + port: 40400 + + admin: + enabled: true + port: 8081 + +# Optional: Pin to specific node +# nodeSelector: +# kubernetes.io/hostname: high-performance-node diff --git a/charts/aztec-node/values-examples/sequencer.yaml b/charts/aztec-node/values-examples/sequencer.yaml new file mode 100644 index 00000000..cea2d059 --- /dev/null +++ b/charts/aztec-node/values-examples/sequencer.yaml @@ -0,0 +1,86 @@ +# Example values for deploying an Aztec sequencer +# A sequencer produces blocks and attestations for the network + +# Deployment role +role: sequencer + +# Sequencer-specific configuration +sequencer: + # REQUIRED: Ethereum private key for attester (signs blocks and attestations) + # Must start with '0x' and have sufficient ETH on L1 (minimum 0.1 ETH recommended) + # SECURITY: Never commit real private keys to version control + # Use --set sequencer.attesterPrivateKey="0xYOUR_KEY" when deploying + attesterPrivateKey: "0xYOUR_PRIVATE_KEY_HERE" + + # Aztec address (32 bytes) to receive unburnt transaction fees + feeRecipient: "0x0000000000000000000000000000000000000000000000000000000000000000" + +# Network to connect to +network: testnet + +# Container image configuration +image: + repository: aztecprotocol/aztec + tag: latest + pullPolicy: Always # Use Always for auto-updates + +# Node configuration +node: + replicas: 1 + logLevel: "info" + + # L1 Ethereum configuration + # Sequencers need reliable, low-latency L1 connections + l1ExecutionUrls: + - "http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545" + l1ConsensusUrls: + - "http://l1-full-node-sepolia-beacon.l1.svc.cluster.local:5052" + + # Resource allocation (sequencers need more resources) + resources: + requests: + cpu: "4" + memory: "16Gi" + limits: + cpu: "8" + memory: "32Gi" + + # Storage configuration + storage: + dataDirectory: /data + dataStoreMapSize: "134217728" # 128 GB + worldStateMapSize: "134217728" # 128 GB + + # Startup probe (sequencers may need longer startup time) + startupProbe: + periodSeconds: 60 + failureThreshold: 30 # 30 minutes max startup time + +# Persistence +# Sequencer requires 1TB NVMe SSD for archiver data +persistence: + enabled: true + size: 1000Gi + # storageClassName: fast-ssd # Uncomment to specify high-performance NVMe storage class + accessModes: + - ReadWriteOnce + +# Service configuration +service: + httpPort: 8080 + + p2p: + enabled: true + nodePortEnabled: true # Enable for external P2P connectivity + port: 40400 + + admin: + enabled: true + port: 8081 + +# Use host networking for better P2P performance (optional) +hostNetwork: false + +# Optional: Pin to specific node for persistent storage +# nodeSelector: +# kubernetes.io/hostname: your-node-name diff --git a/charts/aztec-node/values.yaml b/charts/aztec-node/values.yaml new file mode 100644 index 00000000..a0ed3cee --- /dev/null +++ b/charts/aztec-node/values.yaml @@ -0,0 +1,311 @@ +# -- Overrides the chart name +nameOverride: "" +# -- Overrides the chart computed fullname +fullnameOverride: "" + +# ===================================================================== +# DEPLOYMENT ROLE +# ===================================================================== + +# -- Role determines the type of Aztec node deployment +# Valid roles: fullnode, sequencer, prover +role: fullnode + +# ===================================================================== +# SEQUENCER CONFIGURATION (only used when role: sequencer) +# ===================================================================== + +sequencer: + # -- Ethereum private key for attester (signs blocks and attestations) + # REQUIRED when role is 'sequencer' + attesterPrivateKey: "" + # -- Aztec address (32 bytes) to receive unburnt transaction fees + feeRecipient: "0x0000000000000000000000000000000000000000000000000000000000000000" + +# ===================================================================== +# PROVER CONFIGURATION (only used when role: prover) +# ===================================================================== +# When role is 'prover', creates 3 StatefulSets: +# - prover-broker: Manages job queue +# - prover-node: Creates jobs and submits proofs to L1 +# - prover-agent: Executes proof generation + +prover: + # Prover node configuration + node: + # -- Ethereum private key for publishing proofs to L1 + # REQUIRED when role is 'prover' + publisherPrivateKey: "" + # -- Resource requests/limits for prover-node pod + resources: {} + # -- Persistence configuration for prover-node + # Prover-node needs 1TB NVMe SSD for archiver data + persistence: + size: 1000Gi + + # Prover broker configuration + broker: + # -- Resource requests/limits for prover-broker pod + resources: {} + # -- Persistence configuration for prover-broker + # Broker needs 10GB SSD for job queue + persistence: + size: 10Gi + + # Prover agent configuration + agent: + # -- Number of prover agent replicas + replicas: 1 + # -- Number of prover agents to run per pod + count: 1 + # -- Agent polling interval in milliseconds + pollIntervalMs: 1000 + # -- Resource requests/limits for prover-agent pods + # Recommended: 32 cores, 128GB RAM per agent + resources: {} + # -- Persistence configuration for prover-agent + # Agent needs 10GB SSD per agent for CRS and temporary files + persistence: + size: 10Gi + + # -- Prover ID - address for receiving proof rewards + # Used by prover-node (usually matches publisherPrivateKey address) + id: "" + +# ===================================================================== +# IMAGE CONFIGURATION +# ===================================================================== + +# -- Image to use for the container +image: + # -- Image repository + repository: aztecprotocol/aztec + # -- Image tag + tag: latest + # -- Container pull policy + pullPolicy: IfNotPresent + +# ===================================================================== +# NETWORK CONFIGURATION +# ===================================================================== + +# -- Pod management policy +podManagementPolicy: Parallel + +# -- Network name - this is a predefined network - testnet, devnet +network: + +# -- Custom network - (not recommended) - Only for custom testnet usecases +# Must have deployed your own protocol contracts first +customNetwork: + l1ChainId: + registryContractAddress: + slashFactoryAddress: + feeAssetHandlerContractAddress: + +# -- Which rollup contract we want to follow from the registry +rollupVersion: "canonical" + +# -- Use host network - this will disable nodePort service and use host networking instead +hostNetwork: false + +# -- Pod annotations (e.g., for Keel auto-updates) +podAnnotations: {} + +# ===================================================================== +# NODE CONFIGURATION +# ===================================================================== + +# -- Aztec node configuration +node: + # -- Number of replicas + replicas: 1 + + # -- Log level - info, verbose, debug, trace + logLevel: "info" + + # -- L1 Ethereum configuration + # Ethereum execution layer RPC endpoint(s) - comma separated list + l1ExecutionUrls: [] + # L1 consensus layer RPC endpoint(s) - comma separated list + l1ConsensusUrls: [] + ## Only when api key is required via header, otherwise just provide in l1ConsensusUrls + ## Example: "1234abcd" + l1ConsensusHostApiKeys: [] + ## Example: "X-API-KEY" + l1ConsensusHostApiKeyHeaders: [] + + # -- Pre-start script (runs before node starts) + preStartScript: "" + + # -- Start command flags + # Auto-generated based on role, but can be overridden for custom configurations + # Leave empty to use role-based defaults + startCmd: [] + + # -- Remote service URLs + remoteUrl: + archiver: + proverBroker: + proverCoordinationNodes: [] + blobSink: + + # -- Address that will receive block or proof rewards + # For prover roles, this is the PROVER_ID + coinbase: + + # -- Sentinel configuration - gathers slashing information + sentinel: + enabled: false + + # -- Metrics configuration + metrics: + # Exclude metrics - comma separated list of metrics to exclude + otelExcludeMetrics: "" + # Collector endpoint - e.g. http://localhost:4318 + otelCollectorEndpoint: "" + # Use GCP logging + useGcloudLogging: false + + # -- Storage configuration + storage: + # Data directory + dataDirectory: /data + # Data store map size in kB (per database) + dataStoreMapSize: "134217728" # 128 GB + # World state map size in kB (per merkle tree) + worldStateMapSize: "134217728" # 128 GB + # P2P storage map size (kB) + p2pStorageMapSize: + # Archive storage map size (kB) + archiveStorageMapSize: + + # -- Node.js options + nodeJsOptions: + - --no-warnings + - --max-old-space-size=4096 + + # -- Startup probe configuration + startupProbe: + # Period seconds + periodSeconds: 30 + # Failure threshold (10 minutes default - may need more if downloading many blocks) + failureThreshold: 20 + + # -- Resource requests and limits + resources: {} + +# ===================================================================== +# PERSISTENCE +# ===================================================================== + +persistence: + # -- Uses an emptyDir when not enabled + enabled: false + # -- Use an existing PVC + existingClaim: null + # -- AccessModes + accessModes: + - ReadWriteOnce + # -- Requested size + size: 100Gi + # -- Use a specific storage class + storageClassName: null + # -- Annotations for volume claim template + annotations: {} + # -- Selector for volume claim template + selector: {} + +# ===================================================================== +# STATEFULSET CONFIGURATION +# ===================================================================== + +# -- Update strategy for the statefulset +updateStrategy: + type: RollingUpdate + +# -- Additional init containers +initContainers: [] +# - name: my-init-container +# image: busybox:latest +# command: ['sh', '-c', 'echo hello'] + +# ===================================================================== +# SERVICE CONFIGURATION +# ===================================================================== + +service: + ingress: + enabled: false + annotations: {} + # kubernetes.io/ingress.global-static-ip-name: my-static-ip + hosts: [] + # - node.example.com + + headless: + enabled: true + + p2p: + enabled: true + nodePortEnabled: true + port: 40400 + announcePort: 40400 + + admin: + enabled: true + port: 8081 + + httpPort: 8080 + +# ===================================================================== +# CERTIFICATE CONFIGURATION +# ===================================================================== + +# Certificate configuration +certificate: + enabled: false + domains: [] + # - example.com + # - api.example.com + +# ===================================================================== +# RBAC CONFIGURATION +# ===================================================================== + +rbac: + # -- Specifies whether RBAC resources are to be created + create: true + # -- Required ClusterRole rules + # @default -- See `values.yaml` + clusterRules: + # Required to obtain the nodes external IP + - apiGroups: [""] + resources: + - "nodes" + verbs: + - "get" + - "list" + - "watch" + # -- Required ClusterRole rules + # @default -- See `values.yaml` + rules: + # Required to get information about the services nodePort. + - apiGroups: [""] + resources: + - "services" + verbs: + - "get" + - "list" + - "watch" + +# ===================================================================== +# SERVICE ACCOUNT +# ===================================================================== + +serviceAccount: + # -- Create a service account + create: true + # -- Name of the service account - if not set, the fullname will be used + name: "" + # -- Annotations for the service account + annotations: {} From 6f3b3d08719a1ff60f30b227758fea1a57a4a097 Mon Sep 17 00:00:00 2001 From: bussyjd Date: Tue, 7 Oct 2025 15:52:22 +0400 Subject: [PATCH 02/27] feat: integrate aztec-node chart into repository - Add aztec-node to main repository README chart list - Create README.md.gotmpl template for helm-docs generation - Update all namespace references from 'aztec' to 'aztec-testnet' - Generate complete documentation with helm-docs The aztec-node chart deploys Aztec network nodes in three roles: - Full Node: Syncs and validates blocks - Sequencer: Produces blocks and participates in consensus - Prover: Generates zero-knowledge proofs --- README.md | 1 + charts/aztec-node/README.md | 117 +++++- charts/aztec-node/README.md.gotmpl | 422 ++++++++++++++++++++ charts/aztec-node/values-examples/README.md | 8 +- 4 files changed, 526 insertions(+), 22 deletions(-) create mode 100644 charts/aztec-node/README.md.gotmpl diff --git a/README.md b/README.md index 06abe9ad..e9139b1e 100644 --- a/README.md +++ b/README.md @@ -12,6 +12,7 @@ This repo contains Helm Charts for deploying Obol Distributed Validator [middlew - [`charon`](charts/charon) - [`charon-cluster`](charts/charon-cluster) - [`charon-relay`](charts/charon-relay) +- [`aztec-node`](charts/aztec-node) - Aztec network node deployment (Full Node, Sequencer, or Prover) ## Before you begin diff --git a/charts/aztec-node/README.md b/charts/aztec-node/README.md index 68a74f01..8c59a33b 100644 --- a/charts/aztec-node/README.md +++ b/charts/aztec-node/README.md @@ -1,3 +1,84 @@ + +Aztec Node +=========== + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.0.2](https://img.shields.io/badge/AppVersion-2.0.2-informational?style=flat-square) + +A Helm chart for deploying an Aztec node + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| certificate.domains | list | `[]` | | +| certificate.enabled | bool | `false` | | +| customNetwork | object | `{"feeAssetHandlerContractAddress":null,"l1ChainId":null,"registryContractAddress":null,"slashFactoryAddress":null}` | Custom network - (not recommended) - Only for custom testnet usecases Must have deployed your own protocol contracts first | +| fullnameOverride | string | `""` | Overrides the chart computed fullname | +| hostNetwork | bool | `false` | Use host network - this will disable nodePort service and use host networking instead | +| image | object | `{"pullPolicy":"IfNotPresent","repository":"aztecprotocol/aztec","tag":"latest"}` | Image to use for the container | +| image.pullPolicy | string | `"IfNotPresent"` | Container pull policy | +| image.repository | string | `"aztecprotocol/aztec"` | Image repository | +| image.tag | string | `"latest"` | Image tag | +| initContainers | list | `[]` | Additional init containers | +| nameOverride | string | `""` | Overrides the chart name | +| network | string | `nil` | Network name - this is a predefined network - testnet, devnet | +| node | object | `{"coinbase":null,"l1ConsensusHostApiKeyHeaders":[],"l1ConsensusHostApiKeys":[],"l1ConsensusUrls":[],"l1ExecutionUrls":[],"logLevel":"info","metrics":{"otelCollectorEndpoint":"","otelExcludeMetrics":"","useGcloudLogging":false},"nodeJsOptions":["--no-warnings","--max-old-space-size=4096"],"preStartScript":"","remoteUrl":{"archiver":null,"blobSink":null,"proverBroker":null,"proverCoordinationNodes":[]},"replicas":1,"resources":{},"sentinel":{"enabled":false},"startCmd":[],"startupProbe":{"failureThreshold":20,"periodSeconds":30},"storage":{"archiveStorageMapSize":null,"dataDirectory":"/data","dataStoreMapSize":"134217728","p2pStorageMapSize":null,"worldStateMapSize":"134217728"}}` | Aztec node configuration | +| node.coinbase | string | `nil` | Address that will receive block or proof rewards For prover roles, this is the PROVER_ID | +| node.l1ExecutionUrls | list | `[]` | L1 Ethereum configuration Ethereum execution layer RPC endpoint(s) - comma separated list | +| node.logLevel | string | `"info"` | Log level - info, verbose, debug, trace | +| node.metrics | object | `{"otelCollectorEndpoint":"","otelExcludeMetrics":"","useGcloudLogging":false}` | Metrics configuration | +| node.nodeJsOptions | list | `["--no-warnings","--max-old-space-size=4096"]` | Node.js options | +| node.preStartScript | string | `""` | Pre-start script (runs before node starts) | +| node.remoteUrl | object | `{"archiver":null,"blobSink":null,"proverBroker":null,"proverCoordinationNodes":[]}` | Remote service URLs | +| node.replicas | int | `1` | Number of replicas | +| node.resources | object | `{}` | Resource requests and limits | +| node.sentinel | object | `{"enabled":false}` | Sentinel configuration - gathers slashing information | +| node.startCmd | list | `[]` | Start command flags Auto-generated based on role, but can be overridden for custom configurations Leave empty to use role-based defaults | +| node.startupProbe | object | `{"failureThreshold":20,"periodSeconds":30}` | Startup probe configuration | +| node.storage | object | `{"archiveStorageMapSize":null,"dataDirectory":"/data","dataStoreMapSize":"134217728","p2pStorageMapSize":null,"worldStateMapSize":"134217728"}` | Storage configuration | +| persistence.accessModes | list | `["ReadWriteOnce"]` | AccessModes | +| persistence.annotations | object | `{}` | Annotations for volume claim template | +| persistence.enabled | bool | `false` | Uses an emptyDir when not enabled | +| persistence.existingClaim | string | `nil` | Use an existing PVC | +| persistence.selector | object | `{}` | Selector for volume claim template | +| persistence.size | string | `"100Gi"` | Requested size | +| persistence.storageClassName | string | `nil` | Use a specific storage class | +| podAnnotations | object | `{}` | Pod annotations (e.g., for Keel auto-updates) | +| podManagementPolicy | string | `"Parallel"` | Pod management policy | +| prover.agent.count | int | `1` | Number of prover agents to run per pod | +| prover.agent.persistence | object | `{"size":"10Gi"}` | Persistence configuration for prover-agent Agent needs 10GB SSD per agent for CRS and temporary files | +| prover.agent.pollIntervalMs | int | `1000` | Agent polling interval in milliseconds | +| prover.agent.replicas | int | `1` | Number of prover agent replicas | +| prover.agent.resources | object | `{}` | Resource requests/limits for prover-agent pods Recommended: 32 cores, 128GB RAM per agent | +| prover.broker.persistence | object | `{"size":"10Gi"}` | Persistence configuration for prover-broker Broker needs 10GB SSD for job queue | +| prover.broker.resources | object | `{}` | Resource requests/limits for prover-broker pod | +| prover.id | string | `""` | Prover ID - address for receiving proof rewards Used by prover-node (usually matches publisherPrivateKey address) | +| prover.node.persistence | object | `{"size":"1000Gi"}` | Persistence configuration for prover-node Prover-node needs 1TB NVMe SSD for archiver data | +| prover.node.publisherPrivateKey | string | `""` | Ethereum private key for publishing proofs to L1 REQUIRED when role is 'prover' | +| prover.node.resources | object | `{}` | Resource requests/limits for prover-node pod | +| rbac.clusterRules | list | See `values.yaml` | Required ClusterRole rules | +| rbac.create | bool | `true` | Specifies whether RBAC resources are to be created | +| rbac.rules | list | See `values.yaml` | Required ClusterRole rules | +| role | string | `"fullnode"` | Role determines the type of Aztec node deployment Valid roles: fullnode, sequencer, prover | +| rollupVersion | string | `"canonical"` | Which rollup contract we want to follow from the registry | +| sequencer.attesterPrivateKey | string | `""` | Ethereum private key for attester (signs blocks and attestations) REQUIRED when role is 'sequencer' | +| sequencer.feeRecipient | string | `"0x0000000000000000000000000000000000000000000000000000000000000000"` | Aztec address (32 bytes) to receive unburnt transaction fees | +| service.admin.enabled | bool | `true` | | +| service.admin.port | int | `8081` | | +| service.headless.enabled | bool | `true` | | +| service.httpPort | int | `8080` | | +| service.ingress.annotations | object | `{}` | | +| service.ingress.enabled | bool | `false` | | +| service.ingress.hosts | list | `[]` | | +| service.p2p.announcePort | int | `40400` | | +| service.p2p.enabled | bool | `true` | | +| service.p2p.nodePortEnabled | bool | `true` | | +| service.p2p.port | int | `40400` | | +| serviceAccount.annotations | object | `{}` | Annotations for the service account | +| serviceAccount.create | bool | `true` | Create a service account | +| serviceAccount.name | string | `""` | Name of the service account - if not set, the fullname will be used | +| updateStrategy | object | `{"type":"RollingUpdate"}` | Update strategy for the statefulset | + # Aztec Node Helm Chart A Kubernetes Helm chart for deploying Aztec network nodes in different roles: Full Node, Sequencer, or Prover. @@ -23,7 +104,7 @@ This chart deploys Aztec nodes using a role-based architecture. A single chart h ```bash helm install aztec-fullnode ./charts/aztec-node \ -f charts/aztec-node/values-examples/fullnode.yaml \ - -n aztec --create-namespace + -n aztec-testnet --create-namespace ``` ### Install a Sequencer @@ -32,7 +113,7 @@ helm install aztec-fullnode ./charts/aztec-node \ helm install aztec-sequencer ./charts/aztec-node \ -f charts/aztec-node/values-examples/sequencer.yaml \ --set sequencer.attesterPrivateKey="0xYOUR_PRIVATE_KEY" \ - -n aztec --create-namespace + -n aztec-testnet --create-namespace ``` **Requirements:** @@ -44,7 +125,7 @@ helm install aztec-sequencer ./charts/aztec-node \ helm install aztec-prover ./charts/aztec-node \ -f charts/aztec-node/values-examples/prover.yaml \ --set prover.node.publisherPrivateKey="0xYOUR_PRIVATE_KEY" \ - -n aztec --create-namespace + -n aztec-testnet --create-namespace ``` **Note:** The prover role creates 3 StatefulSets: @@ -216,10 +297,10 @@ Access node endpoints: ```bash # HTTP RPC endpoint -kubectl port-forward -n aztec svc/aztec-node 8080:8080 +kubectl port-forward -n aztec-testnet svc/aztec-node 8080:8080 # Admin endpoint -kubectl port-forward -n aztec svc/aztec-node 8081:8081 +kubectl port-forward -n aztec-testnet svc/aztec-node 8081:8081 ``` ### Verify Node is Running Properly @@ -236,7 +317,7 @@ You should see JSON response with the latest block number. If the block number i ```bash # Get the external IP or node port -kubectl get svc -n aztec +kubectl get svc -n aztec-testnet # Test TCP connectivity (replace with your IP/port) nc -vz 40400 @@ -255,7 +336,7 @@ Expected: "Connection succeeded" **4. View logs:** ```bash -kubectl logs -n aztec -l app.kubernetes.io/name=aztec-node --tail=100 -f +kubectl logs -n aztec-testnet -l app.kubernetes.io/name=aztec-node --tail=100 -f ``` Look for messages indicating: @@ -270,7 +351,7 @@ Look for messages indicating: ```bash helm upgrade aztec-node ./charts/aztec-node \ -f your-values.yaml \ - -n aztec + -n aztec-testnet ``` ### Auto-Updates @@ -294,12 +375,12 @@ image: ```bash # Force pod restart to pull latest image -kubectl rollout restart statefulset/aztec-node -n aztec +kubectl rollout restart statefulset/aztec-node -n aztec-testnet # For prover components -kubectl rollout restart statefulset/aztec-prover-broker -n aztec -kubectl rollout restart statefulset/aztec-prover-node -n aztec -kubectl rollout restart statefulset/aztec-prover-agent -n aztec +kubectl rollout restart statefulset/aztec-prover-broker -n aztec-testnet +kubectl rollout restart statefulset/aztec-prover-node -n aztec-testnet +kubectl rollout restart statefulset/aztec-prover-agent -n aztec-testnet ``` ### Scale Prover Agents @@ -308,19 +389,19 @@ kubectl rollout restart statefulset/aztec-prover-agent -n aztec helm upgrade aztec-prover ./charts/aztec-node \ -f charts/aztec-node/values-examples/prover.yaml \ --set prover.agent.replicas=4 \ - -n aztec + -n aztec-testnet ``` ## Uninstalling ```bash -helm uninstall aztec-node -n aztec +helm uninstall aztec-node -n aztec-testnet ``` **Note:** PersistentVolumeClaims are not automatically deleted. Remove manually if needed: ```bash -kubectl delete pvc -n aztec -l app.kubernetes.io/name=aztec-node +kubectl delete pvc -n aztec-testnet -l app.kubernetes.io/name=aztec-node ``` ## Security @@ -350,7 +431,7 @@ node: Verify PVC creation: ```bash -kubectl get pvc -n aztec +kubectl get pvc -n aztec-testnet ``` Check storage class availability: @@ -380,13 +461,13 @@ hostNetwork: true Verify all 3 StatefulSets are running: ```bash -kubectl get statefulsets -n aztec +kubectl get statefulsets -n aztec-testnet ``` Check service DNS resolution: ```bash -kubectl get svc -n aztec | grep prover +kubectl get svc -n aztec-testnet | grep prover ``` ## Resources diff --git a/charts/aztec-node/README.md.gotmpl b/charts/aztec-node/README.md.gotmpl new file mode 100644 index 00000000..6ab0854f --- /dev/null +++ b/charts/aztec-node/README.md.gotmpl @@ -0,0 +1,422 @@ + +Aztec Node +=========== +{{ template "chart.deprecationWarning" . }} + +{{ template "chart.versionBadge" . }}{{ template "chart.typeBadge" . }}{{ template "chart.appVersionBadge" . }} + +{{ template "chart.description" . }} + +{{ template "chart.homepageLine" . }} + +{{ template "chart.sourcesSection" . }} + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} + +# Aztec Node Helm Chart + +A Kubernetes Helm chart for deploying Aztec network nodes in different roles: Full Node, Sequencer, or Prover. + +## Overview + +This chart deploys Aztec nodes using a role-based architecture. A single chart handles three distinct deployment types: + +- **Full Node** - Participates in the network by syncing and validating blocks +- **Sequencer** - Produces blocks and participates in consensus +- **Prover** - Generates zero-knowledge proofs for the network + +## Quick Start + +### Prerequisites + +- Kubernetes cluster (v1.19+) +- Helm 3.0+ +- L1 Ethereum RPC access (execution + consensus layers) + +### Install a Full Node + +```bash +helm install aztec-fullnode ./charts/aztec-node \ + -f charts/aztec-node/values-examples/fullnode.yaml \ + -n aztec-testnet --create-namespace +``` + +### Install a Sequencer + +```bash +helm install aztec-sequencer ./charts/aztec-node \ + -f charts/aztec-node/values-examples/sequencer.yaml \ + --set sequencer.attesterPrivateKey="0xYOUR_PRIVATE_KEY" \ + -n aztec-testnet --create-namespace +``` + +**Requirements:** +- Ethereum private key with minimum 0.1 ETH on L1 (Sepolia for testnet) + +### Install a Prover + +```bash +helm install aztec-prover ./charts/aztec-node \ + -f charts/aztec-node/values-examples/prover.yaml \ + --set prover.node.publisherPrivateKey="0xYOUR_PRIVATE_KEY" \ + -n aztec-testnet --create-namespace +``` + +**Note:** The prover role creates 3 StatefulSets: +- `prover-broker` - Manages the job queue +- `prover-node` - Creates jobs and publishes proofs to L1 +- `prover-agent` - Executes proof generation (can scale replicas) + +## Architecture + +### Role-Based Deployment + +The chart uses a `role` field to determine the deployment type: + +```yaml +role: fullnode # Options: fullnode | sequencer | prover +``` + +Each role automatically configures the appropriate: +- Container command and flags +- Resource requirements +- Storage configuration +- Service endpoints +- Required secrets + +### Storage Requirements + +All storage sizes match [Aztec's official specifications](https://docs.aztec.network/the_aztec_network): + +| Role/Component | Storage | Type | +|----------------|---------|------| +| Full Node | 1TB | NVMe SSD | +| Sequencer | 1TB | NVMe SSD | +| Prover Node | 1TB | NVMe SSD | +| Prover Broker | 10GB | SSD | +| Prover Agent | 10GB | SSD | + +## Configuration + +### Networks + +Connect to predefined Aztec networks: + +```yaml +network: testnet # Options: testnet | devnet +``` + +Or configure a custom network: + +```yaml +network: null # Disable predefined network +customNetwork: + l1ChainId: "11155111" + registryContractAddress: "0x..." + slashFactoryAddress: "0x..." + feeAssetHandlerContractAddress: "0x..." +``` + +### L1 Ethereum Configuration + +All roles require L1 Ethereum RPC access: + +```yaml +node: + l1ExecutionUrls: + - "http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545" + l1ConsensusUrls: + - "http://l1-full-node-sepolia-beacon.l1.svc.cluster.local:5052" +``` + +### Persistence + +Persistence is enabled by default and uses the cluster's default storage class: + +```yaml +persistence: + enabled: true + size: 1000Gi # Automatically set per role + # storageClassName: local-path # Optional: specify storage class + accessModes: + - ReadWriteOnce +``` + +**Component-Specific Sizes (Prover Role):** + +The prover role allows per-component storage configuration: + +```yaml +prover: + node: + persistence: + size: 1000Gi # Prover node (archiver data) + broker: + persistence: + size: 10Gi # Broker (job queue) + agent: + persistence: + size: 10Gi # Agent (CRS files) +``` + +### Networking + +**P2P Configuration:** + +```yaml +service: + p2p: + enabled: true + nodePortEnabled: false # Set true for external P2P + port: 40400 +``` + +**Host Networking (Optional):** + +```yaml +hostNetwork: true # Use host network for better P2P performance +``` + +**Note:** When using `hostNetwork: true`, ensure pod affinity is set to distribute pods across different nodes if running multiple replicas. + +### Resource Allocation + +Example resource configuration: + +```yaml +node: + resources: + requests: + cpu: "4" + memory: "16Gi" + limits: + cpu: "8" + memory: "32Gi" +``` + +**Prover-Specific Resources:** + +```yaml +prover: + broker: + resources: + requests: + cpu: "1" + memory: "4Gi" + node: + resources: + requests: + cpu: "2" + memory: "8Gi" + agent: + replicas: 2 # Scale prover agents + resources: + requests: + cpu: "16" # High CPU for proof generation + memory: "64Gi" +``` + +## Examples + +See detailed configuration examples in [`values-examples/`](./values-examples/): + +- [`fullnode.yaml`](./values-examples/fullnode.yaml) - Full node configuration +- [`sequencer.yaml`](./values-examples/sequencer.yaml) - Sequencer configuration +- [`prover.yaml`](./values-examples/prover.yaml) - Prover configuration +- [`README.md`](./values-examples/README.md) - Detailed deployment guide + +## Monitoring + +Access node endpoints: + +```bash +# HTTP RPC endpoint +kubectl port-forward -n aztec-testnet svc/aztec-node 8080:8080 + +# Admin endpoint +kubectl port-forward -n aztec-testnet svc/aztec-node 8081:8081 +``` + +### Verify Node is Running Properly + +**1. Check node sync status:** + +```bash +curl -X POST http://localhost:8080 --data '{"method": "node_getL2Tips"}' +``` + +You should see JSON response with the latest block number. If the block number is increasing, your node is syncing correctly. + +**2. Check P2P connectivity (TCP):** + +```bash +# Get the external IP or node port +kubectl get svc -n aztec-testnet + +# Test TCP connectivity (replace with your IP/port) +nc -vz 40400 +``` + +Expected: "Connection succeeded" + +**3. Check P2P connectivity (UDP):** + +```bash +nc -vu 40400 +``` + +Expected: "Connection succeeded" + +**4. View logs:** + +```bash +kubectl logs -n aztec-testnet -l app.kubernetes.io/name=aztec-node --tail=100 -f +``` + +Look for messages indicating: +- Block synchronization progress +- P2P peer connections +- No error messages + +## Upgrading + +### Upgrade a Release + +```bash +helm upgrade aztec-node ./charts/aztec-node \ + -f your-values.yaml \ + -n aztec-testnet +``` + +### Auto-Updates + +Enable automatic image updates by setting the image pull policy: + +```yaml +image: + repository: aztecprotocol/aztec + tag: latest + pullPolicy: Always # Pull latest image on every pod restart +``` + +**Important Notes:** +- Using `pullPolicy: Always` with `tag: latest` ensures you get the newest version when pods restart +- This is recommended for testnet/devnet deployments to stay up-to-date +- For production, pin to specific versions (e.g., `tag: "2.0.2"`) and use `pullPolicy: IfNotPresent` +- Sequencers should use `pullPolicy: Always` to maintain network compatibility + +**Trigger an update manually:** + +```bash +# Force pod restart to pull latest image +kubectl rollout restart statefulset/aztec-node -n aztec-testnet + +# For prover components +kubectl rollout restart statefulset/aztec-prover-broker -n aztec-testnet +kubectl rollout restart statefulset/aztec-prover-node -n aztec-testnet +kubectl rollout restart statefulset/aztec-prover-agent -n aztec-testnet +``` + +### Scale Prover Agents + +```bash +helm upgrade aztec-prover ./charts/aztec-node \ + -f charts/aztec-node/values-examples/prover.yaml \ + --set prover.agent.replicas=4 \ + -n aztec-testnet +``` + +## Uninstalling + +```bash +helm uninstall aztec-node -n aztec-testnet +``` + +**Note:** PersistentVolumeClaims are not automatically deleted. Remove manually if needed: + +```bash +kubectl delete pvc -n aztec-testnet -l app.kubernetes.io/name=aztec-node +``` + +## Security + +**⚠️ Important Security Notes:** + +1. **Private Keys:** Never commit private keys to version control +2. **Sequencer:** Use `--set sequencer.attesterPrivateKey="0x..."` when deploying +3. **Prover:** Use `--set prover.node.publisherPrivateKey="0x..."` when deploying +4. **Secrets Management:** Consider using external secret managers (Vault, Sealed Secrets, etc.) + +## Troubleshooting + +### Pod Not Starting + +Check startup probe timeout (sequencers may need longer): + +```yaml +node: + startupProbe: + periodSeconds: 60 + failureThreshold: 30 # 30 minutes max +``` + +### Storage Issues + +Verify PVC creation: + +```bash +kubectl get pvc -n aztec-testnet +``` + +Check storage class availability: + +```bash +kubectl get storageclass +``` + +### P2P Connectivity + +For external P2P access, enable NodePort: + +```yaml +service: + p2p: + nodePortEnabled: true +``` + +Or use host networking: + +```yaml +hostNetwork: true +``` + +### Prover Components Not Communicating + +Verify all 3 StatefulSets are running: + +```bash +kubectl get statefulsets -n aztec-testnet +``` + +Check service DNS resolution: + +```bash +kubectl get svc -n aztec-testnet | grep prover +``` + +## Resources + +- [Aztec Documentation](https://docs.aztec.network) +- [Aztec Network Guide](https://docs.aztec.network/the_aztec_network) +- [Running an Aztec Node](https://docs.aztec.network/the_aztec_network/guides/run_nodes) +- [Chart Values Reference](./values.yaml) + +## License + +Apache 2.0 + +## Contributing + +Contributions welcome! Please submit issues and pull requests to the repository. diff --git a/charts/aztec-node/values-examples/README.md b/charts/aztec-node/values-examples/README.md index 685c4ae2..8532465e 100644 --- a/charts/aztec-node/values-examples/README.md +++ b/charts/aztec-node/values-examples/README.md @@ -20,7 +20,7 @@ A full node participates in the Aztec network by running archiver and node servi ```bash helm install aztec-fullnode ./charts/aztec-node \ -f charts/aztec-node/values-examples/fullnode.yaml \ - -n aztec --create-namespace + -n aztec-testnet --create-namespace ``` ### 2. Sequencer (`sequencer.yaml`) @@ -42,7 +42,7 @@ A sequencer produces blocks and attestations for the network. helm install aztec-sequencer ./charts/aztec-node \ -f charts/aztec-node/values-examples/sequencer.yaml \ --set sequencer.attesterPrivateKey="0xYOUR_PRIVATE_KEY" \ - -n aztec --create-namespace + -n aztec-testnet --create-namespace ``` ### 3. Prover (`prover.yaml`) @@ -66,7 +66,7 @@ The prover role deploys a complete distributed proving system with 3 components: helm install aztec-prover ./charts/aztec-node \ -f charts/aztec-node/values-examples/prover.yaml \ --set prover.node.publisherPrivateKey="0xYOUR_PRIVATE_KEY" \ - -n aztec --create-namespace + -n aztec-testnet --create-namespace ``` **Scale prover agents:** @@ -76,7 +76,7 @@ helm upgrade aztec-prover ./charts/aztec-node \ -f charts/aztec-node/values-examples/prover.yaml \ --set prover.agent.replicas=4 \ --set prover.node.publisherPrivateKey="0xYOUR_PRIVATE_KEY" \ - -n aztec + -n aztec-testnet ``` **Persistence Configuration:** From c273faabbf2230e137269f0cb94609c1ab37b078 Mon Sep 17 00:00:00 2001 From: bussyjd Date: Tue, 7 Oct 2025 16:04:52 +0400 Subject: [PATCH 03/27] fix(aztec-node): remove invalid role references in main statefulset Remove checks for "prover-node" and "prover-agent" roles from the main statefulset.yaml template. These are not valid role values according to the chart's role validation (_helpers.tpl). Valid roles are: fullnode, sequencer, prover The main statefulset.yaml only handles fullnode and sequencer roles. When role=prover is set, separate StatefulSet templates are used: - statefulset-prover-broker.yaml - statefulset-prover-node.yaml - statefulset-prover-agent.yaml This fixes template rendering and ensures role validation works correctly. --- charts/aztec-node/templates/statefulset.yaml | 28 -------------------- 1 file changed, 28 deletions(-) diff --git a/charts/aztec-node/templates/statefulset.yaml b/charts/aztec-node/templates/statefulset.yaml index 5a09dfc6..293d94d3 100644 --- a/charts/aztec-node/templates/statefulset.yaml +++ b/charts/aztec-node/templates/statefulset.yaml @@ -95,11 +95,6 @@ spec: mountPath: /var/lib/keystore readOnly: true {{- end }} - {{- if eq .Values.role "prover-node" }} - - name: prover-keystore - mountPath: /var/lib/keystore - readOnly: true - {{- end }} env: - name: POD_IP valueFrom: @@ -208,24 +203,6 @@ spec: - name: FEE_RECIPIENT value: {{ .Values.sequencer.feeRecipient | quote }} {{- end }} - {{- if eq .Values.role "prover-node" }} - - name: KEY_STORE_DIRECTORY - value: /var/lib/keystore - {{- if .Values.prover.id }} - - name: PROVER_ID - value: {{ .Values.prover.id | quote }} - {{- end }} - {{- end }} - {{- if eq .Values.role "prover-agent" }} - - name: PROVER_AGENT_COUNT - value: {{ .Values.prover.agent.count | quote }} - - name: PROVER_AGENT_POLL_INTERVAL_MS - value: {{ .Values.prover.agent.pollIntervalMs | quote }} - {{- if .Values.prover.id }} - - name: PROVER_ID - value: {{ .Values.prover.id | quote }} - {{- end }} - {{- end }} - name: SENTINEL_ENABLED value: {{ .Values.node.sentinel.enabled | quote }} ports: @@ -250,11 +227,6 @@ spec: secret: secretName: {{ include "chart.fullname" . }}-keystore {{- end }} - {{- if eq .Values.role "prover-node" }} - - name: prover-keystore - secret: - secretName: {{ include "chart.fullname" . }}-prover-keystore - {{- end }} {{- if not .Values.persistence.enabled }} - name: storage emptyDir: {} From f3cd13646cb5f1a402001c7ed51470c38a4fde76 Mon Sep 17 00:00:00 2001 From: bussyjd Date: Tue, 7 Oct 2025 16:10:36 +0400 Subject: [PATCH 04/27] fix(aztec-node): fix volume indentation in prover-node statefulset When persistence.existingClaim is set, the volumes section was missing the 'volumes:' key, causing incorrect YAML structure. This would prevent prover-node pods from starting when using an existing PVC. Added the missing 'volumes:' key to match the pattern used in the emptyDir case and align with the main statefulset template. --- charts/aztec-node/templates/statefulset-prover-node.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/charts/aztec-node/templates/statefulset-prover-node.yaml b/charts/aztec-node/templates/statefulset-prover-node.yaml index 7b65e82a..f3304c21 100644 --- a/charts/aztec-node/templates/statefulset-prover-node.yaml +++ b/charts/aztec-node/templates/statefulset-prover-node.yaml @@ -167,6 +167,7 @@ spec: - name: storage emptyDir: {} {{- else if .Values.persistence.existingClaim }} + volumes: - name: storage persistentVolumeClaim: claimName: {{ .Values.persistence.existingClaim }} From 01db56979b25496939983d939302673eb0442d54 Mon Sep 17 00:00:00 2001 From: bussyjd Date: Tue, 7 Oct 2025 16:17:00 +0400 Subject: [PATCH 05/27] chore: cleanup --- .github/helm-ci-values/skip-charts.txt | 1 + charts/aztec-node/values-examples/prover.yaml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/helm-ci-values/skip-charts.txt b/.github/helm-ci-values/skip-charts.txt index 4cffc9ce..e7e1c205 100644 --- a/.github/helm-ci-values/skip-charts.txt +++ b/.github/helm-ci-values/skip-charts.txt @@ -1,3 +1,4 @@ helios dv-pod obol-app +aztec-node \ No newline at end of file diff --git a/charts/aztec-node/values-examples/prover.yaml b/charts/aztec-node/values-examples/prover.yaml index ad9ffcc9..537efc6e 100644 --- a/charts/aztec-node/values-examples/prover.yaml +++ b/charts/aztec-node/values-examples/prover.yaml @@ -14,7 +14,7 @@ prover: # This key will be used to sign and submit rollup proofs # WARNING: This is a TEST KEY - DO NOT USE IN PRODUCTION # Replace with your actual private key for production use - publisherPrivateKey: "0x0000000000000000000000000000000000000000000000000000000000000001" + publisherPrivateKey: "0xYOUR_PRIVATE_KEY_HERE" resources: requests: From 55fd1250c02d6250ca89200665c47f4e98a4dd89 Mon Sep 17 00:00:00 2001 From: bussyjd Date: Tue, 7 Oct 2025 17:01:20 +0400 Subject: [PATCH 06/27] chore: update README version badges for charon charts Update version badges in charon and charon-cluster READMEs to reflect current chart versions (v0.4.8 and v0.3.8) and appVersion (v1.6.1). These changes are automatically generated by helm-docs based on the Chart.yaml files. --- charts/charon-cluster/README.md | 4 ++-- charts/charon/README.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/charts/charon-cluster/README.md b/charts/charon-cluster/README.md index b91e4b11..a2c49caf 100755 --- a/charts/charon-cluster/README.md +++ b/charts/charon-cluster/README.md @@ -2,7 +2,7 @@ Charon Cluster =========== -![Version: 0.3.6](https://img.shields.io/badge/Version-0.3.6-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.1](https://img.shields.io/badge/AppVersion-1.5.1-informational?style=flat-square) +![Version: 0.3.8](https://img.shields.io/badge/Version-0.3.8-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.1](https://img.shields.io/badge/AppVersion-1.6.1-informational?style=flat-square) Charon is an open-source Ethereum Distributed validator middleware written in golang. This chart deploys a full Charon cluster. @@ -52,7 +52,7 @@ Charon is an open-source Ethereum Distributed validator middleware written in go | config.validatorApiAddress | string | `"0.0.0.0:3600"` | Listening address (ip and port) for validator-facing traffic proxying the beacon-node API. (default "127.0.0.1:3600") | | containerSecurityContext | object | See `values.yaml` | The security context for containers | | fullnameOverride | string | `""` | Provide a name to substitute for the full names of resources | -| image | object | `{"pullPolicy":"IfNotPresent","repository":"obolnetwork/charon","tag":"v1.5.1"}` | Charon image repository, pull policy, and tag version | +| image | object | `{"pullPolicy":"IfNotPresent","repository":"obolnetwork/charon","tag":"v1.6.1"}` | Charon image repository, pull policy, and tag version | | imagePullSecrets | list | `[]` | Credentials to fetch images from private registry # ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ | | livenessProbe | object | `{"enabled":false,"httpGet":{"path":"/livez"},"initialDelaySeconds":10,"periodSeconds":5}` | Configure liveness probes # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ | | nameOverride | string | `""` | Provide a name in place of lighthouse for `app:` labels | diff --git a/charts/charon/README.md b/charts/charon/README.md index 24fe2636..2fc85158 100755 --- a/charts/charon/README.md +++ b/charts/charon/README.md @@ -2,7 +2,7 @@ Charon =========== -![Version: 0.4.6](https://img.shields.io/badge/Version-0.4.6-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.1](https://img.shields.io/badge/AppVersion-1.5.1-informational?style=flat-square) +![Version: 0.4.8](https://img.shields.io/badge/Version-0.4.8-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.1](https://img.shields.io/badge/AppVersion-1.6.1-informational?style=flat-square) Charon is an open-source Ethereum Distributed validator middleware written in golang. @@ -56,7 +56,7 @@ Charon is an open-source Ethereum Distributed validator middleware written in go | extraVolumes | list | `[]` | Additional volumes | | fullnameOverride | string | `""` | Provide a name to substitute for the full names of resources | | httpPort | int | `3600` | HTTP Port | -| image | object | `{"pullPolicy":"IfNotPresent","repository":"obolnetwork/charon","tag":"v1.5.1"}` | Charon image repository, pull policy, and tag version | +| image | object | `{"pullPolicy":"IfNotPresent","repository":"obolnetwork/charon","tag":"v1.6.1"}` | Charon image repository, pull policy, and tag version | | imagePullSecrets | list | `[]` | Credentials to fetch images from private registry # ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ | | initContainers | list | `[]` | Additional init containers | | jaegerPort | int | `6831` | Jaeger Port | From fa5bb0bc4fd218d4614f3e679e7c81e3fcbc80cf Mon Sep 17 00:00:00 2001 From: bussyjd Date: Tue, 7 Oct 2025 17:57:04 +0400 Subject: [PATCH 07/27] feat: add helm-lint pre-commit hook Add a new pre-commit hook that lints Helm charts using the same logic as the CI workflow. This ensures charts are validated locally before pushing, catching issues early. Features: - Uses CI-specific values files when available - Skips charts listed in skip-charts.txt - Ignores harmless dependency warnings for charts with local dependencies - Provides clear summary of linted, skipped, and failed charts This matches the behavior of .github/workflows/release.yml to ensure consistency between local development and CI. --- .pre-commit-config.yaml | 12 +++++ scripts/helm-lint-pre-commit.sh | 95 +++++++++++++++++++++++++++++++++ 2 files changed, 107 insertions(+) create mode 100755 scripts/helm-lint-pre-commit.sh diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 1aff5345..e26f5277 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -11,3 +11,15 @@ repos: files: (README\.md\.gotmpl|(Chart|requirements|values)\.yaml)$ language: docker_image require_serial: true + + - id: helm-lint + name: Helm Lint + description: > + Lint Helm charts using the same logic as CI workflow. + Skips charts listed in .github/helm-ci-values/skip-charts.txt. + Uses CI-specific values files when available. + entry: bash -c 'scripts/helm-lint-pre-commit.sh' + language: system + files: ^charts/.+\.(yaml|yml|tpl)$ + pass_filenames: false + require_serial: true diff --git a/scripts/helm-lint-pre-commit.sh b/scripts/helm-lint-pre-commit.sh new file mode 100755 index 00000000..5e3c4c87 --- /dev/null +++ b/scripts/helm-lint-pre-commit.sh @@ -0,0 +1,95 @@ +#!/usr/bin/env bash +# Helm lint pre-commit hook +# Mimics the CI lint workflow logic from .github/workflows/release.yml + +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)" +SKIP_FILE="$REPO_ROOT/.github/helm-ci-values/skip-charts.txt" + +cd "$REPO_ROOT" + +# Read skip list +skip_list=() +if [[ -f "$SKIP_FILE" ]]; then + while IFS= read -r line; do + # Skip empty lines and comments + [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]] && continue + skip_list+=("$line") + done < "$SKIP_FILE" +fi + +echo "Linting Helm charts..." +failed_charts=() +linted_count=0 +skipped_count=0 + +for chart_path in charts/*/; do + chart=$(basename "$chart_path") + values_file=".github/helm-ci-values/values-$chart.yaml" + + # Check if chart should be skipped + skip_chart=false + for skip in "${skip_list[@]}"; do + if [[ "$chart" == "$skip" ]]; then + skip_chart=true + break + fi + done + + if $skip_chart; then + echo "⊘ Skipping $chart (listed in skip-charts.txt)" + ((skipped_count++)) + continue + fi + + # Run helm lint and check exit code + set +e + if [[ -f "$values_file" ]]; then + echo "→ Linting $chart with values file: $values_file" + lint_output=$(helm lint "$chart_path" --values "$values_file" 2>&1) + lint_exit=$? + else + echo "→ Linting $chart without custom values" + lint_output=$(helm lint "$chart_path" 2>&1) + lint_exit=$? + fi + set -e + + # Display output + echo "$lint_output" + + # Check if lint failed (exit code 1) and if it's NOT just a dependency warning + if [[ $lint_exit -ne 0 ]]; then + # If it's only a dependency warning, don't fail + if echo "$lint_output" | grep -q "chart metadata is missing these dependencies"; then + echo " ℹ Ignoring dependency warning (local dependencies present)" + else + failed_charts+=("$chart") + fi + fi + + ((linted_count++)) +done + +echo "" +echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" +echo "Summary:" +echo " Linted: $linted_count chart(s)" +echo " Skipped: $skipped_count chart(s)" + +if [[ ${#failed_charts[@]} -gt 0 ]]; then + echo " Failed: ${#failed_charts[@]} chart(s)" + echo "" + echo "Failed charts:" + for chart in "${failed_charts[@]}"; do + echo " ✗ $chart" + done + echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" + exit 1 +fi + +echo " All charts passed! ✓" +echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" +exit 0 From b4857a54e38c242226e56b74dfac4e46d3469383 Mon Sep 17 00:00:00 2001 From: bussyjd Date: Tue, 7 Oct 2025 18:16:27 +0400 Subject: [PATCH 08/27] feat(ci): add CI values file for aztec-node chart Add minimal CI values configuration for aztec-node chart to enable automated testing in the release workflow. Configuration: - Role: fullnode (simplest role for testing) - Network: testnet - Persistence: disabled (not needed for CI) - Minimal resource requests for fast testing --- .github/helm-ci-values/values-aztec-node.yaml | 51 +++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 .github/helm-ci-values/values-aztec-node.yaml diff --git a/.github/helm-ci-values/values-aztec-node.yaml b/.github/helm-ci-values/values-aztec-node.yaml new file mode 100644 index 00000000..7696035b --- /dev/null +++ b/.github/helm-ci-values/values-aztec-node.yaml @@ -0,0 +1,51 @@ +# CI test values for aztec-node chart +# Minimal configuration for fullnode role + +# Deployment role +role: fullnode + +# Network to connect to +network: testnet + +# Container image configuration +image: + repository: aztecprotocol/aztec + tag: latest + pullPolicy: IfNotPresent + +# Node configuration +node: + replicas: 1 + logLevel: "info" + + # L1 Ethereum configuration (mock URLs for CI) + l1ExecutionUrls: + - "http://mock-l1-execution:8545" + l1ConsensusUrls: + - "http://mock-l1-consensus:5052" + + # Resource allocation (minimal for CI) + resources: + requests: + cpu: "100m" + memory: "256Mi" + limits: + cpu: "200m" + memory: "512Mi" + +# Persistence disabled for CI +persistence: + enabled: false + +# Service configuration +service: + httpPort: 8080 + + p2p: + enabled: true + nodePortEnabled: false + port: 40400 + + admin: + enabled: true + port: 8081 From 01a7b31586ccdfdfa7464d5d139783d8b29bf37f Mon Sep 17 00:00:00 2001 From: bussyjd Date: Tue, 7 Oct 2025 18:16:43 +0400 Subject: [PATCH 09/27] docs(aztec-node): update README with current values.yaml defaults Regenerate README to reflect updated default role in values.yaml (changed from fullnode to sequencer) and other recent value updates including hostNetwork and nodePort configuration. --- charts/aztec-node/README.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/charts/aztec-node/README.md b/charts/aztec-node/README.md index 8c59a33b..3e19a28f 100644 --- a/charts/aztec-node/README.md +++ b/charts/aztec-node/README.md @@ -14,7 +14,7 @@ A Helm chart for deploying an Aztec node | certificate.enabled | bool | `false` | | | customNetwork | object | `{"feeAssetHandlerContractAddress":null,"l1ChainId":null,"registryContractAddress":null,"slashFactoryAddress":null}` | Custom network - (not recommended) - Only for custom testnet usecases Must have deployed your own protocol contracts first | | fullnameOverride | string | `""` | Overrides the chart computed fullname | -| hostNetwork | bool | `false` | Use host network - this will disable nodePort service and use host networking instead | +| hostNetwork | bool | `true` | Use host network - provides best P2P performance by binding directly to node's network This is the recommended configuration for Aztec nodes | | image | object | `{"pullPolicy":"IfNotPresent","repository":"aztecprotocol/aztec","tag":"latest"}` | Image to use for the container | | image.pullPolicy | string | `"IfNotPresent"` | Container pull policy | | image.repository | string | `"aztecprotocol/aztec"` | Image repository | @@ -59,7 +59,7 @@ A Helm chart for deploying an Aztec node | rbac.clusterRules | list | See `values.yaml` | Required ClusterRole rules | | rbac.create | bool | `true` | Specifies whether RBAC resources are to be created | | rbac.rules | list | See `values.yaml` | Required ClusterRole rules | -| role | string | `"fullnode"` | Role determines the type of Aztec node deployment Valid roles: fullnode, sequencer, prover | +| role | string | `"sequencer"` | Role determines the type of Aztec node deployment Valid roles: fullnode, sequencer, prover | | rollupVersion | string | `"canonical"` | Which rollup contract we want to follow from the registry | | sequencer.attesterPrivateKey | string | `""` | Ethereum private key for attester (signs blocks and attestations) REQUIRED when role is 'sequencer' | | sequencer.feeRecipient | string | `"0x0000000000000000000000000000000000000000000000000000000000000000"` | Aztec address (32 bytes) to receive unburnt transaction fees | @@ -72,7 +72,8 @@ A Helm chart for deploying an Aztec node | service.ingress.hosts | list | `[]` | | | service.p2p.announcePort | int | `40400` | | | service.p2p.enabled | bool | `true` | | -| service.p2p.nodePortEnabled | bool | `true` | | +| service.p2p.nodePort | int | `30400` | | +| service.p2p.nodePortEnabled | bool | `false` | | | service.p2p.port | int | `40400` | | | serviceAccount.annotations | object | `{}` | Annotations for the service account | | serviceAccount.create | bool | `true` | Create a service account | From fecd1b54cf2d26fd262e663749cc3a674beab100 Mon Sep 17 00:00:00 2001 From: bussyjd Date: Tue, 7 Oct 2025 18:20:40 +0400 Subject: [PATCH 10/27] fix(aztec-node): configure hostNetwork as default with NodePort fallback Fix NodePort service template to use separate nodePort field (30400) instead of P2P port (40400) to comply with Kubernetes port range restrictions (30000-32767). Configure hostNetwork: true as the recommended default for best P2P performance, matching tested production configuration. NodePort remains available as a fallback option. Changes: - Add service.p2p.nodePort field (default: 30400) - Set hostNetwork: true as default - Update svc.nodeport.yaml to use nodePort field - Update all values-examples to use hostNetwork - Update README with hostNetwork as default, NodePort as alternative - Add L1 RPC endpoints to default values.yaml Validation: - Tested all 3 roles (fullnode, sequencer, prover) - Verified role-based validation (required fields enforced) - Confirmed correct StatefulSet and Service generation --- charts/aztec-node/aztec-node.yaml | 74 +++++++++++++++++++ charts/aztec-node/templates/svc.nodeport.yaml | 4 +- .../aztec-node/values-examples/fullnode.yaml | 5 +- charts/aztec-node/values-examples/prover.yaml | 5 +- .../aztec-node/values-examples/sequencer.yaml | 8 +- charts/aztec-node/values.yaml | 18 +++-- 6 files changed, 100 insertions(+), 14 deletions(-) create mode 100644 charts/aztec-node/aztec-node.yaml diff --git a/charts/aztec-node/aztec-node.yaml b/charts/aztec-node/aztec-node.yaml new file mode 100644 index 00000000..f2500a9e --- /dev/null +++ b/charts/aztec-node/aztec-node.yaml @@ -0,0 +1,74 @@ +# Sequencer deployment for Sepolia testnet +role: sequencer + +# Sequencer configuration +sequencer: + # Ethereum private key for attester (signs blocks and attestations) + # Ensure this account has at least 0.1 ETH on Sepolia to avoid slashing + attesterPrivateKey: "" + # Aztec address to receive unburnt transaction fees + feeRecipient: "0x0000000000000000000000000000000000000000000000000000000000000000" + +# -- Image to use for the container +image: + # -- Image repository + repository: aztecprotocol/aztec + # -- Image tag + tag: latest # Auto-updates to latest stable (currently 2.0.3) + # -- Container pull policy + pullPolicy: Always # Required for Keel auto-updates + +network: testnet + +# Use host network for P2P connectivity (port 40400) +hostNetwork: true + +# Keel auto-update configuration +podAnnotations: + keel.sh/policy: force # Always update to latest tag + keel.sh/trigger: poll # Poll for updates + keel.sh/pollSchedule: "@every 10m" # Check every 10 minutes + +node: + replicas: 1 + logLevel: "debug; info: aztec:simulator, json-rpc" + + l1ExecutionUrls: ["http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545"] + l1ConsensusUrls: ["http://l1-full-node-sepolia-beacon.l1.svc.cluster.local:5052"] + + startCmd: + - --node + - --archiver + - --sequencer + - --network + - testnet + + + startupProbe: + # -- Period seconds + periodSeconds: 60 + # -- Failure threshold + failureThreshold: 60 + +persistence: + enabled: true + size: 512Gi + storageClassName: local-path + accessModes: + - ReadWriteOnce + selector: {} + +# Pin to specific node for local-path storage +nodeSelector: + kubernetes.io/hostname: silvernuc2 + +service: + p2p: + enabled: true + nodePortEnabled: false + port: 40400 + announcePort: 40400 + admin: + enabled: true + port: 8082 + httpPort: 8080 \ No newline at end of file diff --git a/charts/aztec-node/templates/svc.nodeport.yaml b/charts/aztec-node/templates/svc.nodeport.yaml index 06a29b24..cceb50fd 100644 --- a/charts/aztec-node/templates/svc.nodeport.yaml +++ b/charts/aztec-node/templates/svc.nodeport.yaml @@ -18,12 +18,12 @@ spec: port: {{ $.Values.service.p2p.port }} protocol: TCP targetPort: p2p-tcp - nodePort: {{ add $.Values.service.p2p.port $i }} + nodePort: {{ add $.Values.service.p2p.nodePort $i }} - name: p2p-udp port: {{ $.Values.service.p2p.port }} protocol: UDP targetPort: p2p-udp - nodePort: {{ add $.Values.service.p2p.port $i }} + nodePort: {{ add $.Values.service.p2p.nodePort $i }} selector: {{- include "chart.selectorLabels" $ | nindent 4 }} statefulset.kubernetes.io/pod-name: "{{ include "chart.fullname" $ }}-{{ $i }}" diff --git a/charts/aztec-node/values-examples/fullnode.yaml b/charts/aztec-node/values-examples/fullnode.yaml index c583594c..ba9d7593 100644 --- a/charts/aztec-node/values-examples/fullnode.yaml +++ b/charts/aztec-node/values-examples/fullnode.yaml @@ -7,6 +7,9 @@ role: fullnode # Network to connect to (testnet, devnet, or custom) network: testnet +# Use host network for best P2P performance +hostNetwork: true + # Container image configuration image: repository: aztecprotocol/aztec @@ -54,7 +57,7 @@ service: p2p: enabled: true - nodePortEnabled: false + nodePortEnabled: false # Not needed with hostNetwork port: 40400 admin: diff --git a/charts/aztec-node/values-examples/prover.yaml b/charts/aztec-node/values-examples/prover.yaml index 537efc6e..d446ddd8 100644 --- a/charts/aztec-node/values-examples/prover.yaml +++ b/charts/aztec-node/values-examples/prover.yaml @@ -78,6 +78,9 @@ image: tag: latest pullPolicy: IfNotPresent # Use 'Always' for auto-updates, 'IfNotPresent' for stability +# Use host network for best P2P performance (prover-node needs P2P) +hostNetwork: true + # Node configuration node: logLevel: "info" @@ -104,7 +107,7 @@ service: # P2P is required for prover-node p2p: enabled: true - nodePortEnabled: false + nodePortEnabled: false # Not needed with hostNetwork port: 40400 admin: diff --git a/charts/aztec-node/values-examples/sequencer.yaml b/charts/aztec-node/values-examples/sequencer.yaml index cea2d059..e158bdf3 100644 --- a/charts/aztec-node/values-examples/sequencer.yaml +++ b/charts/aztec-node/values-examples/sequencer.yaml @@ -65,22 +65,22 @@ persistence: accessModes: - ReadWriteOnce +# Use host networking for best P2P performance +hostNetwork: true + # Service configuration service: httpPort: 8080 p2p: enabled: true - nodePortEnabled: true # Enable for external P2P connectivity + nodePortEnabled: false # Not needed with hostNetwork port: 40400 admin: enabled: true port: 8081 -# Use host networking for better P2P performance (optional) -hostNetwork: false - # Optional: Pin to specific node for persistent storage # nodeSelector: # kubernetes.io/hostname: your-node-name diff --git a/charts/aztec-node/values.yaml b/charts/aztec-node/values.yaml index a0ed3cee..662e2bb9 100644 --- a/charts/aztec-node/values.yaml +++ b/charts/aztec-node/values.yaml @@ -9,7 +9,7 @@ fullnameOverride: "" # -- Role determines the type of Aztec node deployment # Valid roles: fullnode, sequencer, prover -role: fullnode +role: sequencer # ===================================================================== # SEQUENCER CONFIGURATION (only used when role: sequencer) @@ -106,8 +106,9 @@ customNetwork: # -- Which rollup contract we want to follow from the registry rollupVersion: "canonical" -# -- Use host network - this will disable nodePort service and use host networking instead -hostNetwork: false +# -- Use host network - provides best P2P performance by binding directly to node's network +# This is the recommended configuration for Aztec nodes +hostNetwork: true # -- Pod annotations (e.g., for Keel auto-updates) podAnnotations: {} @@ -126,9 +127,9 @@ node: # -- L1 Ethereum configuration # Ethereum execution layer RPC endpoint(s) - comma separated list - l1ExecutionUrls: [] + l1ExecutionUrls: ["http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545"] # L1 consensus layer RPC endpoint(s) - comma separated list - l1ConsensusUrls: [] + l1ConsensusUrls: ["http://l1-full-node-sepolia-beacon.l1.svc.cluster.local:5052"] ## Only when api key is required via header, otherwise just provide in l1ConsensusUrls ## Example: "1234abcd" l1ConsensusHostApiKeys: [] @@ -247,8 +248,13 @@ service: p2p: enabled: true - nodePortEnabled: true + # NodePort is an alternative to hostNetwork for external P2P access + # Only used when hostNetwork: false + nodePortEnabled: false port: 40400 + # NodePort must be in range 30000-32767 (Kubernetes limitation) + # This is the external port exposed on the node, which forwards to internal port 40400 + nodePort: 30400 announcePort: 40400 admin: From adb40d42efd36ff0ca2f42cb67423252845160cb Mon Sep 17 00:00:00 2001 From: bussyjd Date: Tue, 7 Oct 2025 18:44:44 +0400 Subject: [PATCH 11/27] fix(aztec-node): correct StatefulSet serviceName reference The StatefulSet was referencing the wrong service name. It pointed to the regular ClusterIP service instead of the headless service, which prevented pods from getting stable DNS names. Changes: - Updated serviceName from {{ fullname }} to {{ fullname }}-headless - This connects the StatefulSet to the headless service (clusterIP: None) - Enables stable pod DNS names: pod-0.service.namespace.svc.cluster.local Also updated README to reflect current values.yaml defaults for L1 URLs. --- charts/aztec-node/templates/statefulset.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/aztec-node/templates/statefulset.yaml b/charts/aztec-node/templates/statefulset.yaml index 293d94d3..b2c67d01 100644 --- a/charts/aztec-node/templates/statefulset.yaml +++ b/charts/aztec-node/templates/statefulset.yaml @@ -8,7 +8,7 @@ metadata: {{- include "chart.labels" . | nindent 4 }} aztec.network/role: {{ .Values.role }} spec: - serviceName: {{ include "chart.fullname" . }} + serviceName: {{ include "chart.fullname" . }}-headless replicas: {{ .Values.node.replicas }} podManagementPolicy: {{ .Values.podManagementPolicy }} updateStrategy: From 4c8ef2e611023d180020ecafea900ca6f0f64e48 Mon Sep 17 00:00:00 2001 From: bussyjd Date: Tue, 7 Oct 2025 18:50:15 +0400 Subject: [PATCH 12/27] docs(aztec-node): sync README with values.yaml L1 URL defaults --- charts/aztec-node/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/aztec-node/README.md b/charts/aztec-node/README.md index 3e19a28f..bdfedb84 100644 --- a/charts/aztec-node/README.md +++ b/charts/aztec-node/README.md @@ -22,9 +22,9 @@ A Helm chart for deploying an Aztec node | initContainers | list | `[]` | Additional init containers | | nameOverride | string | `""` | Overrides the chart name | | network | string | `nil` | Network name - this is a predefined network - testnet, devnet | -| node | object | `{"coinbase":null,"l1ConsensusHostApiKeyHeaders":[],"l1ConsensusHostApiKeys":[],"l1ConsensusUrls":[],"l1ExecutionUrls":[],"logLevel":"info","metrics":{"otelCollectorEndpoint":"","otelExcludeMetrics":"","useGcloudLogging":false},"nodeJsOptions":["--no-warnings","--max-old-space-size=4096"],"preStartScript":"","remoteUrl":{"archiver":null,"blobSink":null,"proverBroker":null,"proverCoordinationNodes":[]},"replicas":1,"resources":{},"sentinel":{"enabled":false},"startCmd":[],"startupProbe":{"failureThreshold":20,"periodSeconds":30},"storage":{"archiveStorageMapSize":null,"dataDirectory":"/data","dataStoreMapSize":"134217728","p2pStorageMapSize":null,"worldStateMapSize":"134217728"}}` | Aztec node configuration | +| node | object | `{"coinbase":null,"l1ConsensusHostApiKeyHeaders":[],"l1ConsensusHostApiKeys":[],"l1ConsensusUrls":["http://l1-full-node-sepolia-beacon.l1.svc.cluster.local:5052"],"l1ExecutionUrls":["http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545"],"logLevel":"info","metrics":{"otelCollectorEndpoint":"","otelExcludeMetrics":"","useGcloudLogging":false},"nodeJsOptions":["--no-warnings","--max-old-space-size=4096"],"preStartScript":"","remoteUrl":{"archiver":null,"blobSink":null,"proverBroker":null,"proverCoordinationNodes":[]},"replicas":1,"resources":{},"sentinel":{"enabled":false},"startCmd":[],"startupProbe":{"failureThreshold":20,"periodSeconds":30},"storage":{"archiveStorageMapSize":null,"dataDirectory":"/data","dataStoreMapSize":"134217728","p2pStorageMapSize":null,"worldStateMapSize":"134217728"}}` | Aztec node configuration | | node.coinbase | string | `nil` | Address that will receive block or proof rewards For prover roles, this is the PROVER_ID | -| node.l1ExecutionUrls | list | `[]` | L1 Ethereum configuration Ethereum execution layer RPC endpoint(s) - comma separated list | +| node.l1ExecutionUrls | list | `["http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545"]` | L1 Ethereum configuration Ethereum execution layer RPC endpoint(s) - comma separated list | | node.logLevel | string | `"info"` | Log level - info, verbose, debug, trace | | node.metrics | object | `{"otelCollectorEndpoint":"","otelExcludeMetrics":"","useGcloudLogging":false}` | Metrics configuration | | node.nodeJsOptions | list | `["--no-warnings","--max-old-space-size=4096"]` | Node.js options | From 4746dd775b1533b31372f039f53820d3ec396747 Mon Sep 17 00:00:00 2001 From: bussyjd Date: Tue, 7 Oct 2025 18:52:14 +0400 Subject: [PATCH 13/27] docs: clarify helm-docs pre-commit hook behavior Add clearer description to helm-docs hook explaining that if files are modified, the user needs to stage the changes and commit again. This prevents confusion when README.md is auto-regenerated. --- .pre-commit-config.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index e26f5277..1d18c53c 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -2,11 +2,12 @@ repos: - repo: local hooks: - id: helm-docs - name: Helm Docs + name: Helm Docs (auto-regenerates README files) args: [] description: > Uses 'helm-docs' to create documentation from the Helm chart's 'values.yaml' file, and inserts the result into a corresponding 'README.md' file. + If this hook modifies files, stage the changes (git add) and commit again. entry: jnorwood/helm-docs:v1.11.0 files: (README\.md\.gotmpl|(Chart|requirements|values)\.yaml)$ language: docker_image From 0f01e6c60a44327c7b245df974e238ecd59cf338 Mon Sep 17 00:00:00 2001 From: bussyjd Date: Tue, 7 Oct 2025 18:54:56 +0400 Subject: [PATCH 14/27] fix(ci): enable aztec-node chart linting Removed aztec-node from skip-charts.txt now that the chart is fully configured with CI values file and templates are fixed. --- .github/helm-ci-values/skip-charts.txt | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/helm-ci-values/skip-charts.txt b/.github/helm-ci-values/skip-charts.txt index e7e1c205..4cffc9ce 100644 --- a/.github/helm-ci-values/skip-charts.txt +++ b/.github/helm-ci-values/skip-charts.txt @@ -1,4 +1,3 @@ helios dv-pod obol-app -aztec-node \ No newline at end of file From 2c162798e2e25cf33d0515ea324b8adf54c69cac Mon Sep 17 00:00:00 2001 From: bussyjd Date: Tue, 7 Oct 2025 18:57:04 +0400 Subject: [PATCH 15/27] chore: cleanup --- .github/helm-ci-values/skip-charts.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/helm-ci-values/skip-charts.txt b/.github/helm-ci-values/skip-charts.txt index 4cffc9ce..ffccb681 100644 --- a/.github/helm-ci-values/skip-charts.txt +++ b/.github/helm-ci-values/skip-charts.txt @@ -1,3 +1,4 @@ helios dv-pod obol-app +aztec-node From 4d8a07a461763021a7bd49729765ceb49177478c Mon Sep 17 00:00:00 2001 From: bussyjd Date: Tue, 7 Oct 2025 18:59:44 +0400 Subject: [PATCH 16/27] fix(ci): prevent helm-lint from failing on arithmetic operations Changed from ((var++)) to var=$((var + 1)) syntax to avoid exit code 1 when incrementing from 0 with set -e enabled. Also added check to prevent iterating over empty skip_list array with set -u enabled. --- scripts/helm-lint-pre-commit.sh | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/scripts/helm-lint-pre-commit.sh b/scripts/helm-lint-pre-commit.sh index 5e3c4c87..60b446f7 100755 --- a/scripts/helm-lint-pre-commit.sh +++ b/scripts/helm-lint-pre-commit.sh @@ -31,16 +31,18 @@ for chart_path in charts/*/; do # Check if chart should be skipped skip_chart=false - for skip in "${skip_list[@]}"; do - if [[ "$chart" == "$skip" ]]; then - skip_chart=true - break - fi - done + if [[ ${#skip_list[@]} -gt 0 ]]; then + for skip in "${skip_list[@]}"; do + if [[ "$chart" == "$skip" ]]; then + skip_chart=true + break + fi + done + fi if $skip_chart; then echo "⊘ Skipping $chart (listed in skip-charts.txt)" - ((skipped_count++)) + skipped_count=$((skipped_count + 1)) continue fi @@ -70,7 +72,7 @@ for chart_path in charts/*/; do fi fi - ((linted_count++)) + linted_count=$((linted_count + 1)) done echo "" @@ -90,6 +92,11 @@ if [[ ${#failed_charts[@]} -gt 0 ]]; then exit 1 fi -echo " All charts passed! ✓" +# Success if no failures (even if all charts were skipped) +if [[ $linted_count -eq 0 ]]; then + echo " All charts skipped (none to lint) ✓" +else + echo " All charts passed! ✓" +fi echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" exit 0 From 0f86c18ce7a4d07a70cbfe7edf6f4f9842bab156 Mon Sep 17 00:00:00 2001 From: bussyjd Date: Tue, 7 Oct 2025 19:02:39 +0400 Subject: [PATCH 17/27] feat!: implement standardized service naming convention BREAKING CHANGE: All Kubernetes resources now follow the naming pattern: l2-{role}-node-{network}-{component} Examples: - Fullnode: l2-full-node-sepolia-node - Sequencer: l2-sequencer-node-sepolia-node - Prover: l2-prover-node-sepolia-{broker|node|agent} This requires deletion of existing StatefulSets and Services before upgrade. Changes: - Add networkName field to values.yaml (default: sepolia) - Create chart.resourceName helper for standardized naming - Update all 13 template files to use new naming - Update README with new service names and kubectl examples - Update DNS references in prover components - Update RBAC resource names --- charts/aztec-node/README.md | 30 ++++++++++++------- charts/aztec-node/templates/_helpers.tpl | 29 ++++++++++++++++-- charts/aztec-node/templates/secret.yaml | 2 +- .../templates/service-prover-agent.yaml | 2 +- .../templates/service-prover-broker.yaml | 2 +- .../templates/service-prover-node.yaml | 2 +- .../templates/statefulset-prover-agent.yaml | 6 ++-- .../templates/statefulset-prover-broker.yaml | 4 +-- .../templates/statefulset-prover-node.yaml | 6 ++-- charts/aztec-node/templates/statefulset.yaml | 6 ++-- charts/aztec-node/templates/svc.headless.yaml | 2 +- charts/aztec-node/templates/svc.nodeport.yaml | 4 +-- charts/aztec-node/templates/svc.yaml | 2 +- charts/aztec-node/values.yaml | 4 +++ 14 files changed, 69 insertions(+), 32 deletions(-) diff --git a/charts/aztec-node/README.md b/charts/aztec-node/README.md index bdfedb84..a5512e3d 100644 --- a/charts/aztec-node/README.md +++ b/charts/aztec-node/README.md @@ -130,9 +130,9 @@ helm install aztec-prover ./charts/aztec-node \ ``` **Note:** The prover role creates 3 StatefulSets: -- `prover-broker` - Manages the job queue -- `prover-node` - Creates jobs and publishes proofs to L1 -- `prover-agent` - Executes proof generation (can scale replicas) +- `l2-prover-node-sepolia-broker` - Manages the job queue +- `l2-prover-node-sepolia-node` - Creates jobs and publishes proofs to L1 +- `l2-prover-node-sepolia-agent` - Executes proof generation (can scale replicas) ## Architecture @@ -298,10 +298,15 @@ Access node endpoints: ```bash # HTTP RPC endpoint -kubectl port-forward -n aztec-testnet svc/aztec-node 8080:8080 - -# Admin endpoint -kubectl port-forward -n aztec-testnet svc/aztec-node 8081:8081 +# For fullnode +kubectl port-forward -n aztec svc/l2-full-node-sepolia-node 8080:8080 +# For sequencer +kubectl port-forward -n aztec svc/l2-sequencer-node-sepolia-node 8080:8080 +# For prover (prover-node component) +kubectl port-forward -n aztec svc/l2-prover-node-sepolia-node 8080:8080 + +# Admin endpoint (example for sequencer) +kubectl port-forward -n aztec svc/l2-sequencer-node-sepolia-node 8081:8081 ``` ### Verify Node is Running Properly @@ -376,12 +381,15 @@ image: ```bash # Force pod restart to pull latest image -kubectl rollout restart statefulset/aztec-node -n aztec-testnet +# For fullnode +kubectl rollout restart statefulset/l2-full-node-sepolia-node -n aztec +# For sequencer +kubectl rollout restart statefulset/l2-sequencer-node-sepolia-node -n aztec # For prover components -kubectl rollout restart statefulset/aztec-prover-broker -n aztec-testnet -kubectl rollout restart statefulset/aztec-prover-node -n aztec-testnet -kubectl rollout restart statefulset/aztec-prover-agent -n aztec-testnet +kubectl rollout restart statefulset/l2-prover-node-sepolia-broker -n aztec +kubectl rollout restart statefulset/l2-prover-node-sepolia-node -n aztec +kubectl rollout restart statefulset/l2-prover-node-sepolia-agent -n aztec ``` ### Scale Prover Agents diff --git a/charts/aztec-node/templates/_helpers.tpl b/charts/aztec-node/templates/_helpers.tpl index d98736f3..a466f505 100644 --- a/charts/aztec-node/templates/_helpers.tpl +++ b/charts/aztec-node/templates/_helpers.tpl @@ -56,7 +56,7 @@ Create the name of the service account to use */}} {{- define "chart.serviceAccountName" -}} {{- if .Values.serviceAccount.create }} -{{- default (include "chart.fullname" .) .Values.serviceAccount.name }} +{{- default (include "chart.resourceName" .) .Values.serviceAccount.name }} {{- else }} {{- default "default" .Values.serviceAccount.name }} {{- end }} @@ -67,9 +67,34 @@ Create the name of the cluster role. It needs to be namespace prefixed to avoid naming conflicts when using the same deployment name across namespaces. */}} {{- define "chart.clusterRoleName" -}} -{{ .Release.Namespace }}-{{ include "chart.fullname" . }} +{{ .Release.Namespace }}-{{ include "chart.resourceName" . }} {{- end }} +{{/* +Generate standardized resource names following pattern: l2-{role}-node-{network}-{component} +Usage: + {{ include "chart.resourceName" . }} - For fullnode/sequencer + {{ include "chart.resourceName" (dict "context" . "component" "broker") }} - For prover components +*/}} +{{- define "chart.resourceName" -}} +{{- $context := . -}} +{{- $component := "" -}} +{{- if hasKey . "context" -}} + {{- $context = .context -}} + {{- $component = .component | default "" -}} +{{- end -}} +{{- $role := $context.Values.role -}} +{{- if eq $role "fullnode" -}} + {{- $role = "full" -}} +{{- end -}} +{{- $network := $context.Values.networkName | default "sepolia" -}} +{{- if $component -}} + {{- printf "l2-%s-node-%s-%s" $role $network $component -}} +{{- else -}} + {{- printf "l2-%s-node-%s-node" $role $network -}} +{{- end -}} +{{- end -}} + {{/* Validate that the role is one of the allowed values */}} diff --git a/charts/aztec-node/templates/secret.yaml b/charts/aztec-node/templates/secret.yaml index abc0b264..d51ff5dc 100644 --- a/charts/aztec-node/templates/secret.yaml +++ b/charts/aztec-node/templates/secret.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: Secret metadata: - name: {{ include "chart.fullname" . }}-keystore + name: {{ include "chart.resourceName" . }}-keystore labels: {{- include "chart.labels" . | nindent 4 }} stringData: diff --git a/charts/aztec-node/templates/service-prover-agent.yaml b/charts/aztec-node/templates/service-prover-agent.yaml index db83ffe4..15d0b00d 100644 --- a/charts/aztec-node/templates/service-prover-agent.yaml +++ b/charts/aztec-node/templates/service-prover-agent.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: Service metadata: - name: {{ include "chart.fullname" . }}-prover-agent + name: {{ include "chart.resourceName" (dict "context" . "component" "agent") }} labels: {{- include "chart.labels" . | nindent 4 }} aztec.network/role: prover diff --git a/charts/aztec-node/templates/service-prover-broker.yaml b/charts/aztec-node/templates/service-prover-broker.yaml index 932607e0..b301f653 100644 --- a/charts/aztec-node/templates/service-prover-broker.yaml +++ b/charts/aztec-node/templates/service-prover-broker.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: Service metadata: - name: {{ include "chart.fullname" . }}-prover-broker + name: {{ include "chart.resourceName" (dict "context" . "component" "broker") }} labels: {{- include "chart.labels" . | nindent 4 }} aztec.network/role: prover diff --git a/charts/aztec-node/templates/service-prover-node.yaml b/charts/aztec-node/templates/service-prover-node.yaml index 9ba9364d..006b7e9d 100644 --- a/charts/aztec-node/templates/service-prover-node.yaml +++ b/charts/aztec-node/templates/service-prover-node.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: Service metadata: - name: {{ include "chart.fullname" . }}-prover-node + name: {{ include "chart.resourceName" (dict "context" . "component" "node") }} labels: {{- include "chart.labels" . | nindent 4 }} aztec.network/role: prover diff --git a/charts/aztec-node/templates/statefulset-prover-agent.yaml b/charts/aztec-node/templates/statefulset-prover-agent.yaml index b8596701..9239b2b2 100644 --- a/charts/aztec-node/templates/statefulset-prover-agent.yaml +++ b/charts/aztec-node/templates/statefulset-prover-agent.yaml @@ -2,13 +2,13 @@ apiVersion: apps/v1 kind: StatefulSet metadata: - name: {{ include "chart.fullname" . }}-prover-agent + name: {{ include "chart.resourceName" (dict "context" . "component" "agent") }} labels: {{- include "chart.labels" . | nindent 4 }} aztec.network/role: prover aztec.network/component: prover-agent spec: - serviceName: {{ include "chart.fullname" . }}-prover-agent + serviceName: {{ include "chart.resourceName" (dict "context" . "component" "agent") }} replicas: {{ .Values.prover.agent.replicas }} podManagementPolicy: {{ .Values.podManagementPolicy }} updateStrategy: @@ -96,7 +96,7 @@ spec: value: {{ .Values.prover.agent.pollIntervalMs | quote }} # Prover broker is running in the same deployment - name: PROVER_BROKER_HOST - value: "http://{{ include "chart.fullname" . }}-prover-broker:{{ .Values.service.httpPort }}" + value: "http://{{ include "chart.resourceName" (dict "context" . "component" "broker") }}:{{ .Values.service.httpPort }}" {{- if .Values.prover.id }} - name: PROVER_ID value: {{ .Values.prover.id | quote }} diff --git a/charts/aztec-node/templates/statefulset-prover-broker.yaml b/charts/aztec-node/templates/statefulset-prover-broker.yaml index 094af474..d82770bd 100644 --- a/charts/aztec-node/templates/statefulset-prover-broker.yaml +++ b/charts/aztec-node/templates/statefulset-prover-broker.yaml @@ -2,13 +2,13 @@ apiVersion: apps/v1 kind: StatefulSet metadata: - name: {{ include "chart.fullname" . }}-prover-broker + name: {{ include "chart.resourceName" (dict "context" . "component" "broker") }} labels: {{- include "chart.labels" . | nindent 4 }} aztec.network/role: prover aztec.network/component: prover-broker spec: - serviceName: {{ include "chart.fullname" . }}-prover-broker + serviceName: {{ include "chart.resourceName" (dict "context" . "component" "broker") }} replicas: 1 podManagementPolicy: {{ .Values.podManagementPolicy }} updateStrategy: diff --git a/charts/aztec-node/templates/statefulset-prover-node.yaml b/charts/aztec-node/templates/statefulset-prover-node.yaml index f3304c21..736903f0 100644 --- a/charts/aztec-node/templates/statefulset-prover-node.yaml +++ b/charts/aztec-node/templates/statefulset-prover-node.yaml @@ -2,13 +2,13 @@ apiVersion: apps/v1 kind: StatefulSet metadata: - name: {{ include "chart.fullname" . }}-prover-node + name: {{ include "chart.resourceName" (dict "context" . "component" "node") }} labels: {{- include "chart.labels" . | nindent 4 }} aztec.network/role: prover aztec.network/component: prover-node spec: - serviceName: {{ include "chart.fullname" . }}-prover-node + serviceName: {{ include "chart.resourceName" (dict "context" . "component" "node") }} replicas: 1 podManagementPolicy: {{ .Values.podManagementPolicy }} updateStrategy: @@ -117,7 +117,7 @@ spec: value: {{ .Values.prover.node.publisherPrivateKey | quote }} # Prover broker is running in the same deployment - name: PROVER_BROKER_HOST - value: "http://{{ include "chart.fullname" . }}-prover-broker:{{ .Values.service.httpPort }}" + value: "http://{{ include "chart.resourceName" (dict "context" . "component" "broker") }}:{{ .Values.service.httpPort }}" {{- if .Values.prover.id }} - name: PROVER_ID value: {{ .Values.prover.id | quote }} diff --git a/charts/aztec-node/templates/statefulset.yaml b/charts/aztec-node/templates/statefulset.yaml index b2c67d01..8a7aa5b0 100644 --- a/charts/aztec-node/templates/statefulset.yaml +++ b/charts/aztec-node/templates/statefulset.yaml @@ -3,12 +3,12 @@ apiVersion: apps/v1 kind: StatefulSet metadata: - name: {{ include "chart.fullname" . }} + name: {{ include "chart.resourceName" . }} labels: {{- include "chart.labels" . | nindent 4 }} aztec.network/role: {{ .Values.role }} spec: - serviceName: {{ include "chart.fullname" . }}-headless + serviceName: {{ include "chart.resourceName" . }}-headless replicas: {{ .Values.node.replicas }} podManagementPolicy: {{ .Values.podManagementPolicy }} updateStrategy: @@ -225,7 +225,7 @@ spec: {{- if eq .Values.role "sequencer" }} - name: keystore secret: - secretName: {{ include "chart.fullname" . }}-keystore + secretName: {{ include "chart.resourceName" . }}-keystore {{- end }} {{- if not .Values.persistence.enabled }} - name: storage diff --git a/charts/aztec-node/templates/svc.headless.yaml b/charts/aztec-node/templates/svc.headless.yaml index 2c9256e6..7701057b 100644 --- a/charts/aztec-node/templates/svc.headless.yaml +++ b/charts/aztec-node/templates/svc.headless.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: Service metadata: - name: {{ include "chart.fullname" . }}-headless + name: {{ include "chart.resourceName" . }}-headless labels: {{- include "chart.labels" . | nindent 4 }} spec: diff --git a/charts/aztec-node/templates/svc.nodeport.yaml b/charts/aztec-node/templates/svc.nodeport.yaml index cceb50fd..ce3a119a 100644 --- a/charts/aztec-node/templates/svc.nodeport.yaml +++ b/charts/aztec-node/templates/svc.nodeport.yaml @@ -4,7 +4,7 @@ apiVersion: v1 kind: Service metadata: - name: {{ include "chart.fullname" $ }}-p2p-node-port-{{ $i }} + name: {{ include "chart.resourceName" $ }}-p2p-node-port-{{ $i }} labels: {{- include "chart.labels" $ | nindent 4 }} app: node @@ -26,6 +26,6 @@ spec: nodePort: {{ add $.Values.service.p2p.nodePort $i }} selector: {{- include "chart.selectorLabels" $ | nindent 4 }} - statefulset.kubernetes.io/pod-name: "{{ include "chart.fullname" $ }}-{{ $i }}" + statefulset.kubernetes.io/pod-name: "{{ include "chart.resourceName" $ }}-{{ $i }}" {{- end }} {{- end }} diff --git a/charts/aztec-node/templates/svc.yaml b/charts/aztec-node/templates/svc.yaml index 5c7ad63c..4b538fa7 100644 --- a/charts/aztec-node/templates/svc.yaml +++ b/charts/aztec-node/templates/svc.yaml @@ -1,7 +1,7 @@ apiVersion: v1 kind: Service metadata: - name: {{ include "chart.fullname" . }} + name: {{ include "chart.resourceName" . }} labels: {{- include "chart.labels" . | nindent 4 }} {{- with .Values.service.ingress.annotations }} diff --git a/charts/aztec-node/values.yaml b/charts/aztec-node/values.yaml index 662e2bb9..243f2220 100644 --- a/charts/aztec-node/values.yaml +++ b/charts/aztec-node/values.yaml @@ -95,6 +95,10 @@ podManagementPolicy: Parallel # -- Network name - this is a predefined network - testnet, devnet network: +# -- Network identifier used in resource naming (l2-{role}-node-{networkName}-{component}) +# This appears in service/statefulset names for easy identification +networkName: sepolia + # -- Custom network - (not recommended) - Only for custom testnet usecases # Must have deployed your own protocol contracts first customNetwork: From 908109c9a19d1b61e64e1111ca955a40c1e5c980 Mon Sep 17 00:00:00 2001 From: bussyjd Date: Tue, 7 Oct 2025 22:11:08 +0400 Subject: [PATCH 18/27] docs(aztec-node): fix resource naming in README examples Updated README to use correct resource naming pattern: l2-{role}-node-{networkName}-{component} Examples now show: - l2-full-node-sepolia-node (fullnode) - l2-sequencer-node-sepolia-node (sequencer) - l2-prover-node-sepolia-broker/node/agent (prover components) This matches the actual resource names generated by chart.resourceName helper. --- charts/aztec-node/README.md | 29 +++++++++++++------------ charts/aztec-node/README.md.gotmpl | 34 ++++++++++++++++++------------ 2 files changed, 36 insertions(+), 27 deletions(-) diff --git a/charts/aztec-node/README.md b/charts/aztec-node/README.md index a5512e3d..38f4728f 100644 --- a/charts/aztec-node/README.md +++ b/charts/aztec-node/README.md @@ -22,6 +22,7 @@ A Helm chart for deploying an Aztec node | initContainers | list | `[]` | Additional init containers | | nameOverride | string | `""` | Overrides the chart name | | network | string | `nil` | Network name - this is a predefined network - testnet, devnet | +| networkName | string | `"sepolia"` | Network identifier used in resource naming (l2-{role}-node-{networkName}-{component}) This appears in service/statefulset names for easy identification | | node | object | `{"coinbase":null,"l1ConsensusHostApiKeyHeaders":[],"l1ConsensusHostApiKeys":[],"l1ConsensusUrls":["http://l1-full-node-sepolia-beacon.l1.svc.cluster.local:5052"],"l1ExecutionUrls":["http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545"],"logLevel":"info","metrics":{"otelCollectorEndpoint":"","otelExcludeMetrics":"","useGcloudLogging":false},"nodeJsOptions":["--no-warnings","--max-old-space-size=4096"],"preStartScript":"","remoteUrl":{"archiver":null,"blobSink":null,"proverBroker":null,"proverCoordinationNodes":[]},"replicas":1,"resources":{},"sentinel":{"enabled":false},"startCmd":[],"startupProbe":{"failureThreshold":20,"periodSeconds":30},"storage":{"archiveStorageMapSize":null,"dataDirectory":"/data","dataStoreMapSize":"134217728","p2pStorageMapSize":null,"worldStateMapSize":"134217728"}}` | Aztec node configuration | | node.coinbase | string | `nil` | Address that will receive block or proof rewards For prover roles, this is the PROVER_ID | | node.l1ExecutionUrls | list | `["http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545"]` | L1 Ethereum configuration Ethereum execution layer RPC endpoint(s) - comma separated list | @@ -130,9 +131,9 @@ helm install aztec-prover ./charts/aztec-node \ ``` **Note:** The prover role creates 3 StatefulSets: -- `l2-prover-node-sepolia-broker` - Manages the job queue -- `l2-prover-node-sepolia-node` - Creates jobs and publishes proofs to L1 -- `l2-prover-node-sepolia-agent` - Executes proof generation (can scale replicas) +- `l2-prover-node-{networkName}-broker` - Manages the job queue +- `l2-prover-node-{networkName}-node` - Creates jobs and publishes proofs to L1 +- `l2-prover-node-{networkName}-agent` - Executes proof generation (can scale replicas) ## Architecture @@ -294,19 +295,19 @@ See detailed configuration examples in [`values-examples/`](./values-examples/): ## Monitoring -Access node endpoints: +Access node endpoints (replace `sepolia` with your `networkName` value): ```bash # HTTP RPC endpoint # For fullnode -kubectl port-forward -n aztec svc/l2-full-node-sepolia-node 8080:8080 +kubectl port-forward -n aztec-testnet svc/l2-full-node-sepolia-node 8080:8080 # For sequencer -kubectl port-forward -n aztec svc/l2-sequencer-node-sepolia-node 8080:8080 +kubectl port-forward -n aztec-testnet svc/l2-sequencer-node-sepolia-node 8080:8080 # For prover (prover-node component) -kubectl port-forward -n aztec svc/l2-prover-node-sepolia-node 8080:8080 +kubectl port-forward -n aztec-testnet svc/l2-prover-node-sepolia-node 8080:8080 # Admin endpoint (example for sequencer) -kubectl port-forward -n aztec svc/l2-sequencer-node-sepolia-node 8081:8081 +kubectl port-forward -n aztec-testnet svc/l2-sequencer-node-sepolia-node 8081:8081 ``` ### Verify Node is Running Properly @@ -380,16 +381,16 @@ image: **Trigger an update manually:** ```bash -# Force pod restart to pull latest image +# Force pod restart to pull latest image (replace 'sepolia' with your networkName) # For fullnode -kubectl rollout restart statefulset/l2-full-node-sepolia-node -n aztec +kubectl rollout restart statefulset/l2-full-node-sepolia-node -n aztec-testnet # For sequencer -kubectl rollout restart statefulset/l2-sequencer-node-sepolia-node -n aztec +kubectl rollout restart statefulset/l2-sequencer-node-sepolia-node -n aztec-testnet # For prover components -kubectl rollout restart statefulset/l2-prover-node-sepolia-broker -n aztec -kubectl rollout restart statefulset/l2-prover-node-sepolia-node -n aztec -kubectl rollout restart statefulset/l2-prover-node-sepolia-agent -n aztec +kubectl rollout restart statefulset/l2-prover-node-sepolia-broker -n aztec-testnet +kubectl rollout restart statefulset/l2-prover-node-sepolia-node -n aztec-testnet +kubectl rollout restart statefulset/l2-prover-node-sepolia-agent -n aztec-testnet ``` ### Scale Prover Agents diff --git a/charts/aztec-node/README.md.gotmpl b/charts/aztec-node/README.md.gotmpl index 6ab0854f..346c0d0e 100644 --- a/charts/aztec-node/README.md.gotmpl +++ b/charts/aztec-node/README.md.gotmpl @@ -65,9 +65,9 @@ helm install aztec-prover ./charts/aztec-node \ ``` **Note:** The prover role creates 3 StatefulSets: -- `prover-broker` - Manages the job queue -- `prover-node` - Creates jobs and publishes proofs to L1 -- `prover-agent` - Executes proof generation (can scale replicas) +- `l2-prover-node-{networkName}-broker` - Manages the job queue +- `l2-prover-node-{networkName}-node` - Creates jobs and publishes proofs to L1 +- `l2-prover-node-{networkName}-agent` - Executes proof generation (can scale replicas) ## Architecture @@ -229,14 +229,19 @@ See detailed configuration examples in [`values-examples/`](./values-examples/): ## Monitoring -Access node endpoints: +Access node endpoints (replace `sepolia` with your `networkName` value): ```bash # HTTP RPC endpoint -kubectl port-forward -n aztec-testnet svc/aztec-node 8080:8080 - -# Admin endpoint -kubectl port-forward -n aztec-testnet svc/aztec-node 8081:8081 +# For fullnode +kubectl port-forward -n aztec-testnet svc/l2-full-node-sepolia-node 8080:8080 +# For sequencer +kubectl port-forward -n aztec-testnet svc/l2-sequencer-node-sepolia-node 8080:8080 +# For prover (prover-node component) +kubectl port-forward -n aztec-testnet svc/l2-prover-node-sepolia-node 8080:8080 + +# Admin endpoint (example for sequencer) +kubectl port-forward -n aztec-testnet svc/l2-sequencer-node-sepolia-node 8081:8081 ``` ### Verify Node is Running Properly @@ -310,13 +315,16 @@ image: **Trigger an update manually:** ```bash -# Force pod restart to pull latest image -kubectl rollout restart statefulset/aztec-node -n aztec-testnet +# Force pod restart to pull latest image (replace 'sepolia' with your networkName) +# For fullnode +kubectl rollout restart statefulset/l2-full-node-sepolia-node -n aztec-testnet +# For sequencer +kubectl rollout restart statefulset/l2-sequencer-node-sepolia-node -n aztec-testnet # For prover components -kubectl rollout restart statefulset/aztec-prover-broker -n aztec-testnet -kubectl rollout restart statefulset/aztec-prover-node -n aztec-testnet -kubectl rollout restart statefulset/aztec-prover-agent -n aztec-testnet +kubectl rollout restart statefulset/l2-prover-node-sepolia-broker -n aztec-testnet +kubectl rollout restart statefulset/l2-prover-node-sepolia-node -n aztec-testnet +kubectl rollout restart statefulset/l2-prover-node-sepolia-agent -n aztec-testnet ``` ### Scale Prover Agents From 0e5ddbf9714ac945adf5782598634cd1b3fda50c Mon Sep 17 00:00:00 2001 From: bussyjd Date: Thu, 9 Oct 2025 17:38:47 +0400 Subject: [PATCH 19/27] chore: unskip aztec-node --- .github/helm-ci-values/skip-charts.txt | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/helm-ci-values/skip-charts.txt b/.github/helm-ci-values/skip-charts.txt index ffccb681..4cffc9ce 100644 --- a/.github/helm-ci-values/skip-charts.txt +++ b/.github/helm-ci-values/skip-charts.txt @@ -1,4 +1,3 @@ helios dv-pod obol-app -aztec-node From 63777416e090c604035435764421cc0449a67b5c Mon Sep 17 00:00:00 2001 From: bussyjd Date: Wed, 5 Nov 2025 16:42:44 +0400 Subject: [PATCH 20/27] feat: staging-public network --- charts/aztec-node/values.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/aztec-node/values.yaml b/charts/aztec-node/values.yaml index 243f2220..4127c320 100644 --- a/charts/aztec-node/values.yaml +++ b/charts/aztec-node/values.yaml @@ -20,7 +20,7 @@ sequencer: # REQUIRED when role is 'sequencer' attesterPrivateKey: "" # -- Aztec address (32 bytes) to receive unburnt transaction fees - feeRecipient: "0x0000000000000000000000000000000000000000000000000000000000000000" + # feeRecipient: "0x0000000000000000000000000000000000000000000000000000000000000000" # ===================================================================== # PROVER CONFIGURATION (only used when role: prover) @@ -81,7 +81,7 @@ image: # -- Image repository repository: aztecprotocol/aztec # -- Image tag - tag: latest + tag: 2.1.0-rc.24 # -- Container pull policy pullPolicy: IfNotPresent @@ -97,7 +97,7 @@ network: # -- Network identifier used in resource naming (l2-{role}-node-{networkName}-{component}) # This appears in service/statefulset names for easy identification -networkName: sepolia +networkName: staging-public # -- Custom network - (not recommended) - Only for custom testnet usecases # Must have deployed your own protocol contracts first From 5e1175a2843bba913df1835acaee589ea81fce7a Mon Sep 17 00:00:00 2001 From: bussyjd Date: Wed, 5 Nov 2025 18:20:36 +0400 Subject: [PATCH 21/27] chore: fix linting --- charts/aztec-node/README.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/charts/aztec-node/README.md b/charts/aztec-node/README.md index 38f4728f..0bc2bb7a 100644 --- a/charts/aztec-node/README.md +++ b/charts/aztec-node/README.md @@ -15,14 +15,14 @@ A Helm chart for deploying an Aztec node | customNetwork | object | `{"feeAssetHandlerContractAddress":null,"l1ChainId":null,"registryContractAddress":null,"slashFactoryAddress":null}` | Custom network - (not recommended) - Only for custom testnet usecases Must have deployed your own protocol contracts first | | fullnameOverride | string | `""` | Overrides the chart computed fullname | | hostNetwork | bool | `true` | Use host network - provides best P2P performance by binding directly to node's network This is the recommended configuration for Aztec nodes | -| image | object | `{"pullPolicy":"IfNotPresent","repository":"aztecprotocol/aztec","tag":"latest"}` | Image to use for the container | +| image | object | `{"pullPolicy":"IfNotPresent","repository":"aztecprotocol/aztec","tag":"2.1.0-rc.24"}` | Image to use for the container | | image.pullPolicy | string | `"IfNotPresent"` | Container pull policy | | image.repository | string | `"aztecprotocol/aztec"` | Image repository | -| image.tag | string | `"latest"` | Image tag | +| image.tag | string | `"2.1.0-rc.24"` | Image tag | | initContainers | list | `[]` | Additional init containers | | nameOverride | string | `""` | Overrides the chart name | | network | string | `nil` | Network name - this is a predefined network - testnet, devnet | -| networkName | string | `"sepolia"` | Network identifier used in resource naming (l2-{role}-node-{networkName}-{component}) This appears in service/statefulset names for easy identification | +| networkName | string | `"staging-public"` | Network identifier used in resource naming (l2-{role}-node-{networkName}-{component}) This appears in service/statefulset names for easy identification | | node | object | `{"coinbase":null,"l1ConsensusHostApiKeyHeaders":[],"l1ConsensusHostApiKeys":[],"l1ConsensusUrls":["http://l1-full-node-sepolia-beacon.l1.svc.cluster.local:5052"],"l1ExecutionUrls":["http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545"],"logLevel":"info","metrics":{"otelCollectorEndpoint":"","otelExcludeMetrics":"","useGcloudLogging":false},"nodeJsOptions":["--no-warnings","--max-old-space-size=4096"],"preStartScript":"","remoteUrl":{"archiver":null,"blobSink":null,"proverBroker":null,"proverCoordinationNodes":[]},"replicas":1,"resources":{},"sentinel":{"enabled":false},"startCmd":[],"startupProbe":{"failureThreshold":20,"periodSeconds":30},"storage":{"archiveStorageMapSize":null,"dataDirectory":"/data","dataStoreMapSize":"134217728","p2pStorageMapSize":null,"worldStateMapSize":"134217728"}}` | Aztec node configuration | | node.coinbase | string | `nil` | Address that will receive block or proof rewards For prover roles, this is the PROVER_ID | | node.l1ExecutionUrls | list | `["http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545"]` | L1 Ethereum configuration Ethereum execution layer RPC endpoint(s) - comma separated list | @@ -63,7 +63,6 @@ A Helm chart for deploying an Aztec node | role | string | `"sequencer"` | Role determines the type of Aztec node deployment Valid roles: fullnode, sequencer, prover | | rollupVersion | string | `"canonical"` | Which rollup contract we want to follow from the registry | | sequencer.attesterPrivateKey | string | `""` | Ethereum private key for attester (signs blocks and attestations) REQUIRED when role is 'sequencer' | -| sequencer.feeRecipient | string | `"0x0000000000000000000000000000000000000000000000000000000000000000"` | Aztec address (32 bytes) to receive unburnt transaction fees | | service.admin.enabled | bool | `true` | | | service.admin.port | int | `8081` | | | service.headless.enabled | bool | `true` | | From 85dd537369ac71cc5a7ec8d1c7bac5e776ffd529 Mon Sep 17 00:00:00 2001 From: bussyjd Date: Sat, 8 Nov 2025 17:41:43 +0400 Subject: [PATCH 22/27] feat: add geth and prysm examples --- charts/aztec-node/values-examples/README.md | 84 ++++++++++- .../values-examples/geth-sepolia.yaml | 103 ++++++++++++++ .../values-examples/prysm-sepolia.yaml | 132 ++++++++++++++++++ .../aztec-node/values-examples/sequencer.yaml | 83 ++++++++--- 4 files changed, 375 insertions(+), 27 deletions(-) create mode 100644 charts/aztec-node/values-examples/geth-sepolia.yaml create mode 100644 charts/aztec-node/values-examples/prysm-sepolia.yaml diff --git a/charts/aztec-node/values-examples/README.md b/charts/aztec-node/values-examples/README.md index 8532465e..fa9b10c0 100644 --- a/charts/aztec-node/values-examples/README.md +++ b/charts/aztec-node/values-examples/README.md @@ -2,6 +2,68 @@ This directory contains example values files for deploying Aztec nodes in different roles. +## L1 Infrastructure for Sequencers + +Before deploying a sequencer, you need L1 infrastructure (Ethereum execution + consensus clients). The examples directory includes production-tested configurations for Sepolia testnet. + +**Note**: L1 node requirements (Geth + Prysm) are separate from Aztec sequencer requirements. You can run them on the same machine or separate machines depending on your setup. + +### Quick Start - Deploy L1 Stack + +```bash +# 1. Add ethpandaops Helm repository +helm repo add ethpandaops https://ethpandaops.github.io/ethereum-helm-charts +helm repo update + +# 2. Deploy Geth (execution client) +helm install geth-sepolia ethpandaops/geth \ + -f charts/aztec-node/values-examples/geth-sepolia.yaml \ + -n l1 --create-namespace + +# 3. Deploy Prysm (consensus client) +helm install prysm-sepolia ethpandaops/prysm \ + -f charts/aztec-node/values-examples/prysm-sepolia.yaml \ + -n l1 + +# 4. Wait for sync (check logs) +kubectl logs -f geth-sepolia-0 -n l1 +kubectl logs -f prysm-sepolia-0 -n l1 + +# 5. Deploy Aztec sequencer (once L1 is synced) +helm install aztec-sequencer ./charts/aztec-node \ + -f charts/aztec-node/values-examples/sequencer.yaml \ + --set sequencer.attesterPrivateKey="0xYOUR_PRIVATE_KEY" \ + -n aztec-testnet --create-namespace +``` + +### L1 Configuration Files + +- **`geth-sepolia.yaml`** - Geth v1.16.7 execution client + - Snap sync mode for fast initial sync + - **Resources**: 2-4 cores, 8-16GB RAM + - **Storage**: 500Gi NVMe SSD (Sepolia currently ~300-400GB) + - Engine API on port 8551 (for Prysm) + - JSON-RPC on port 8545 (for Aztec) + +- **`prysm-sepolia.yaml`** - Prysm v6.1.4 consensus client + - **Critical flags**: `--subscribe-all-data-subnets`, `--blob-storage-layout=by-epoch` + - Checkpoint sync enabled (5-10 minute sync vs hours) + - **Resources**: 2-4 cores, 16GB RAM + - **Storage**: 800Gi NVMe SSD (part of ~637GB total Geth+Prysm stack) + - gRPC gateway on port 3500 (for Aztec) + - **Important**: 10-minute liveness probe delay for data column warm-up + +### JWT Configuration + +Both Geth and Prysm use the same JWT secret for Engine API authentication. The example files include a production JWT, but you should generate your own: + +```bash +# Generate new JWT secret +openssl rand -hex 32 +``` + +Then update both `geth-sepolia.yaml` and `prysm-sepolia.yaml` with the new JWT value. + ## Available Roles ### 1. Full Node (`fullnode.yaml`) @@ -26,19 +88,31 @@ helm install aztec-fullnode ./charts/aztec-node \ ### 2. Sequencer (`sequencer.yaml`) A sequencer produces blocks and attestations for the network. -**Command:** `--node --archiver --sequencer --network testnet` +**Command:** `--node --archiver --sequencer --network staging-public` **Use case:** Block production, network consensus participation **Requirements:** -- L1 Ethereum RPC access (low-latency preferred) +- **L1 Infrastructure**: Deploy Geth + Prysm first (see [L1 Infrastructure](#l1-infrastructure-for-sequencers)) - Ethereum private key with minimum 0.1 ETH on L1 -- 1TB NVMe SSD -- 4-8 CPU cores, 16-32GB RAM +- **Aztec Sequencer Hardware** (separate from L1 nodes): + - **CPU**: 2-4 cores minimum (released in 2015 or later) + - **RAM**: 16GB minimum + - **Storage**: 1TB NVMe SSD for archiver data + - **Network**: 25 Mbps or higher +- Host networking enabled for P2P performance + +**Critical Configuration:** +- `sequencer.feeRecipient` - **REQUIRED** (node will crash if not set) +- `sequencer.attesterPrivateKey` - **REQUIRED** (must have ETH on L1) +- `node.startCmd` - Must include `--node --archiver --sequencer --network` +- `node.startupProbe` - Set to 60s period, 60 failureThreshold (1hr max startup) **Deploy:** ```bash -# IMPORTANT: Set your attester private key first! +# IMPORTANT: Deploy L1 infrastructure first! See "L1 Infrastructure for Sequencers" section above + +# Then deploy sequencer with your private key helm install aztec-sequencer ./charts/aztec-node \ -f charts/aztec-node/values-examples/sequencer.yaml \ --set sequencer.attesterPrivateKey="0xYOUR_PRIVATE_KEY" \ diff --git a/charts/aztec-node/values-examples/geth-sepolia.yaml b/charts/aztec-node/values-examples/geth-sepolia.yaml new file mode 100644 index 00000000..757a0bcd --- /dev/null +++ b/charts/aztec-node/values-examples/geth-sepolia.yaml @@ -0,0 +1,103 @@ +# Example values for deploying Geth execution client on Sepolia +# This is designed for use with the ethpandaops/geth Helm chart +# +# Installation: +# helm repo add ethpandaops https://ethpandaops.github.io/ethereum-helm-charts +# helm install geth-sepolia ethpandaops/geth -n l1 -f geth-sepolia.yaml +# +# This Geth instance will serve as the L1 execution client for your Aztec sequencer + +# Override the full name to ensure consistent service naming +# This ensures the service is accessible at geth-sepolia.l1.svc.cluster.local +fullnameOverride: geth-sepolia + +# Number of Geth replicas (typically 1 for a single sequencer) +replicas: 1 + +# Container image +image: + repository: ethereum/client-go + tag: v1.16.7 + pullPolicy: IfNotPresent + +# Port configuration +p2pPort: 30303 # P2P networking port (TCP and UDP) +httpPort: 8545 # JSON-RPC HTTP endpoint +wsPort: 8546 # WebSocket endpoint +authPort: 8551 # Engine API (authenticated RPC for consensus client) +metricsPort: 6060 # Prometheus metrics + +# JWT secret for Engine API authentication +# This MUST match the JWT used by your consensus client (Prysm) +# The same JWT is used in prysm-sepolia.yaml +jwt: ecb22bc24e7d4061f7ed690ccd5846d7d73f5d2b9733267e12f56790398d908a + +# Additional Geth command-line arguments +# These are flags not covered by the chart's default configuration +extraArgs: + # CRITICAL: Network flag - must be first + - --sepolia + + # Sync mode - "snap" is fastest for initial sync + - --syncmode=snap + + # Maximum number of network peers + - --maxpeers=50 + + # HTTP API configuration + - --http.api=eth,net,web3,engine,admin + + # WebSocket API configuration + - --ws.api=eth,net,web3 + +# Persistence configuration +# Minimum requirement: 1TB NVMe SSD (500Gi is sufficient for Sepolia testnet) +# For mainnet, use 2TB+ to accommodate growth +persistence: + enabled: true + size: 500Gi # Sepolia testnet size - increase for mainnet + storageClassName: local-path # Use NVMe-backed storage class for best performance + accessModes: + - ReadWriteOnce + +# Pin to specific node for local storage persistence +# IMPORTANT: This should match your Aztec sequencer's node for low latency +nodeSelector: + kubernetes.io/hostname: silverfib + +# Resource allocation +# Sepolia testnet minimum: 4 cores, 8-16 GB RAM +# Recommended for production: 4 cores, 16GB RAM +resources: + requests: + cpu: 2000m # 2 cores minimum + memory: 8Gi # 8GB minimum, 16GB recommended + limits: + cpu: 4000m # 4 cores + memory: 16Gi # 16GB for optimal performance + +# Probes +livenessProbe: + enabled: true + initialDelaySeconds: 60 + periodSeconds: 120 + +readinessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + +# Service configuration +service: + type: ClusterIP + +# RBAC and ServiceAccount +serviceAccount: + create: true + +rbac: + create: true + +# Pod management +podManagementPolicy: OrderedReady +terminationGracePeriodSeconds: 300 diff --git a/charts/aztec-node/values-examples/prysm-sepolia.yaml b/charts/aztec-node/values-examples/prysm-sepolia.yaml new file mode 100644 index 00000000..6d2750e7 --- /dev/null +++ b/charts/aztec-node/values-examples/prysm-sepolia.yaml @@ -0,0 +1,132 @@ +# Example values for deploying Prysm consensus client on Sepolia +# This is designed for use with the ethpandaops/prysm Helm chart +# +# Installation: +# helm repo add ethpandaops https://ethpandaops.github.io/ethereum-helm-charts +# helm install prysm-sepolia ethpandaops/prysm -n l1 -f prysm-sepolia.yaml +# +# This Prysm instance will serve as the L1 consensus client for your Aztec sequencer + +# Override the full name to ensure consistent service naming +# This ensures the service is accessible at prysm-sepolia.l1.svc.cluster.local +fullnameOverride: prysm-sepolia + +# Number of Prysm replicas (typically 1 for a single sequencer) +replicas: 1 + +# Container image +image: + repository: gcr.io/prysmaticlabs/prysm/beacon-chain + tag: v6.1.4 + pullPolicy: IfNotPresent + +# Port configuration +p2pPort: 13001 # P2P networking (TCP and UDP) +httpPort: 3500 # HTTP API (gRPC gateway) - used by Aztec +rpcPort: 4000 # gRPC RPC port +metricsPort: 8080 # Prometheus metrics + +# JWT secret for Engine API authentication +# This MUST match the JWT used by your execution client (Geth) +# The same JWT is used in geth-sepolia.yaml +jwt: ecb22bc24e7d4061f7ed690ccd5846d7d73f5d2b9733267e12f56790398d908a + +# Checkpoint sync configuration +# Using checkpoint sync significantly speeds up initial sync (minutes vs hours) +checkpointSync: + enabled: true + url: https://checkpoint-sync.sepolia.ethpandaops.io + +# CRITICAL: Additional Prysm flags for Aztec blob support +# These flags are essential for proper blob/data column handling +extraArgs: + # CRITICAL: Network flag - must be first + - --sepolia + + # CRITICAL: Execution endpoint - points to Geth service + - --execution-endpoint=http://geth-sepolia:8551 + + # Subscribe to all attestation subnets for complete network visibility + # Required for Aztec to fetch all blob sidecars + - --subscribe-all-data-subnets + + # Store blobs organized by epoch for efficient retrieval + # Required for Aztec blob API queries + - --blob-storage-layout=by-epoch + + # Accept Prysm terms of use + - --accept-terms-of-use=true + +# Persistence configuration +persistence: + enabled: true + size: 800Gi + storageClassName: local-path + accessModes: + - ReadWriteOnce + +# Pin to specific node for local storage persistence +# IMPORTANT: Should be on same node as Geth for best performance +nodeSelector: + kubernetes.io/hostname: silverfib + +# Resource allocation +# Sepolia testnet minimum: 4-8 cores, 16 GB RAM +# Total Sepolia stack (Geth + Prysm) uses ~637GB as of 2025 +resources: + requests: + cpu: 2000m # 2 cores minimum + memory: 16Gi # 16GB required for beacon chain + blobs + limits: + cpu: 4000m # 4 cores for optimal performance + memory: 16Gi + +# Probes +# CRITICAL: Prysm needs extended liveness probe delay +# Data column filesystem cache warm-up takes 5-6 minutes on startup +# Setting initialDelaySeconds to 600s prevents premature pod restarts +livenessProbe: + enabled: true + initialDelaySeconds: 600 # 10 minutes to allow data column warm-up + periodSeconds: 120 + failureThreshold: 3 + +readinessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + failureThreshold: 3 + +# Service configuration +service: + type: ClusterIP + +# RBAC and ServiceAccount +serviceAccount: + create: true + +rbac: + create: true + +# Pod management +podManagementPolicy: OrderedReady +terminationGracePeriodSeconds: 300 + +# Security context +securityContext: + fsGroup: 10001 + runAsUser: 10001 + runAsGroup: 10001 + runAsNonRoot: true + +# Init container to fix permissions +initContainers: + - name: init-chown-data + image: busybox:1.34.0 + command: ["chown", "-R", "10001:10001", "/data"] + securityContext: + runAsUser: 0 + runAsNonRoot: false + volumeMounts: + - name: storage + mountPath: /data diff --git a/charts/aztec-node/values-examples/sequencer.yaml b/charts/aztec-node/values-examples/sequencer.yaml index e158bdf3..81bfa20e 100644 --- a/charts/aztec-node/values-examples/sequencer.yaml +++ b/charts/aztec-node/values-examples/sequencer.yaml @@ -1,5 +1,11 @@ # Example values for deploying an Aztec sequencer # A sequencer produces blocks and attestations for the network +# +# IMPORTANT: This example assumes you have deployed: +# 1. Geth execution client (see geth-sepolia.yaml) +# 2. Prysm consensus client (see prysm-sepolia.yaml) +# +# Deploy those L1 clients first, then deploy this sequencer # Deployment role role: sequencer @@ -12,38 +18,55 @@ sequencer: # Use --set sequencer.attesterPrivateKey="0xYOUR_KEY" when deploying attesterPrivateKey: "0xYOUR_PRIVATE_KEY_HERE" - # Aztec address (32 bytes) to receive unburnt transaction fees + # REQUIRED: Aztec address (32 bytes) to receive unburnt transaction fees + # WARNING: If not set, the node will crash with "Invalid AztecAddress length 0" feeRecipient: "0x0000000000000000000000000000000000000000000000000000000000000000" # Network to connect to -network: testnet +network: staging-public +networkName: staging-public # Container image configuration image: repository: aztecprotocol/aztec tag: latest - pullPolicy: Always # Use Always for auto-updates + pullPolicy: Always # Use Always for auto-updates with keel.sh # Node configuration node: replicas: 1 - logLevel: "info" + + # Log level configuration + # Format: "default_level; override: component, other_component" + logLevel: "debug; info: aztec:simulator, json-rpc" + + # Startup command - REQUIRED for sequencer + # These flags tell Aztec to run as a full sequencer with archiver + startCmd: + - --node + - --archiver + - --sequencer + - --network + - staging-public # WARNING: Must match network field above # L1 Ethereum configuration - # Sequencers need reliable, low-latency L1 connections + # Point to your locally deployed Geth + Prysm stack + # These should match the service names from geth-sepolia.yaml and prysm-sepolia.yaml l1ExecutionUrls: - - "http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545" + - "http://geth-sepolia.l1.svc.cluster.local:8545" l1ConsensusUrls: - - "http://l1-full-node-sepolia-beacon.l1.svc.cluster.local:5052" + - "http://prysm-sepolia.l1.svc.cluster.local:3500" - # Resource allocation (sequencers need more resources) + # Resource allocation + # Aztec minimum requirements: 2-4 cores, 16GB RAM, 1TB NVMe SSD, 25 Mbps network + # These values provide headroom for production workloads resources: requests: - cpu: "4" - memory: "16Gi" + cpu: "4" # 4 cores (minimum: 2-4 cores) + memory: "16Gi" # 16GB (minimum: 16GB) limits: - cpu: "8" - memory: "32Gi" + cpu: "8" # 8 cores for burst capacity + memory: "32Gi" # 32GB for optimal performance # Storage configuration storage: @@ -51,36 +74,52 @@ node: dataStoreMapSize: "134217728" # 128 GB worldStateMapSize: "134217728" # 128 GB - # Startup probe (sequencers may need longer startup time) + # Startup probe - sequencers need extended startup time + # 60s * 60 = 1 hour max startup time startupProbe: periodSeconds: 60 - failureThreshold: 30 # 30 minutes max startup time + failureThreshold: 60 # Persistence -# Sequencer requires 1TB NVMe SSD for archiver data +# Aztec minimum requirement: 1TB NVMe SSD +# 512Gi is currently sufficient for staging-public network +# Increase size as network grows persistence: enabled: true - size: 1000Gi - # storageClassName: fast-ssd # Uncomment to specify high-performance NVMe storage class + size: 512Gi # Minimum 1TB recommended for production + storageClassName: local-path # Use NVMe-backed storage class accessModes: - ReadWriteOnce + selector: {} # Use host networking for best P2P performance +# This allows direct binding to node's network interface hostNetwork: true # Service configuration service: httpPort: 8080 + # P2P networking p2p: enabled: true nodePortEnabled: false # Not needed with hostNetwork port: 40400 + announcePort: 40400 + # Admin API for debugging and metrics admin: enabled: true - port: 8081 - -# Optional: Pin to specific node for persistent storage -# nodeSelector: -# kubernetes.io/hostname: your-node-name + port: 8082 + +# Auto-update configuration with keel.sh +# Polls for new images and force updates every 10 minutes +podAnnotations: + keel.sh/policy: force + keel.sh/pollSchedule: "@every 10m" + keel.sh/trigger: poll + +# RECOMMENDED: Pin to specific node for persistent storage +# This ensures the pod always runs on the same node with local storage +nodeSelector: + kubernetes.io/hostname: your-node-name From f40ce416bb857d64e434be931e716c31d4cb1f0a Mon Sep 17 00:00:00 2001 From: bussyjd Date: Sat, 8 Nov 2025 17:47:52 +0400 Subject: [PATCH 23/27] feat: add geth and prysm examples --- charts/aztec-node/values-examples/prysm-sepolia.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/charts/aztec-node/values-examples/prysm-sepolia.yaml b/charts/aztec-node/values-examples/prysm-sepolia.yaml index 6d2750e7..c172d903 100644 --- a/charts/aztec-node/values-examples/prysm-sepolia.yaml +++ b/charts/aztec-node/values-examples/prysm-sepolia.yaml @@ -54,9 +54,6 @@ extraArgs: # Required for Aztec blob API queries - --blob-storage-layout=by-epoch - # Accept Prysm terms of use - - --accept-terms-of-use=true - # Persistence configuration persistence: enabled: true From be16830e86aa0f7f27a165039075e0c81cb40ae7 Mon Sep 17 00:00:00 2001 From: JeanDaniel Bussy Date: Sun, 16 Nov 2025 12:47:24 -0300 Subject: [PATCH 24/27] Aztec node external secret support (#149) * feat: add external Kubernetes secret support for aztec-node attesterPrivateKey Add support for referencing pre-existing Kubernetes secrets for the sequencer's attesterPrivateKey, enabling better secrets management for production deployments on GKE and other platforms. Changes: - Add sequencer.attesterPrivateKeySecretName field in values.yaml - Make Secret resource creation conditional based on configuration method - Update StatefulSet volume to support both inline and external secrets - Enhance validation to enforce exactly one secret method (not both, not neither) - Add comprehensive documentation with usage examples in README The implementation uses a single field (attesterPrivateKeySecretName) and assumes the secret key is always "keystore.json" to keep the configuration lean. Users create secrets with: kubectl create secret --from-file=keystore.json=keystore.json This maintains full backward compatibility with the existing inline private key approach while providing a production-ready path for external secret management. * chore: cleanup * chore: cleanup * chore: cleanup * docs: restore external secrets section in README and add reference in Install section * docs: re-add external secrets documentation section The section was removed during merge, restoring it to ensure the link in the Install a Sequencer section works correctly. * docs: move external secrets documentation to README.md.gotmpl template Move the external secrets documentation from manually-edited README.md into the README.md.gotmpl template to ensure it persists when helm-docs regenerates the documentation. This prevents the content from being lost during future documentation generation runs. * feat: add sequencer mainnet example --------- Co-authored-by: bussyjd --- .gitignore | 1 + .pre-commit-config.yaml | 2 +- Makefile | 2 +- charts/aztec-node/README.md | 58 +++++++- charts/aztec-node/README.md.gotmpl | 51 +++++++ charts/aztec-node/aztec-node.yaml | 2 +- charts/aztec-node/templates/_helpers.tpl | 11 +- charts/aztec-node/templates/secret.yaml | 2 +- charts/aztec-node/templates/statefulset.yaml | 4 + .../values-examples/sequencer-mainnet.yaml | 134 ++++++++++++++++++ .../aztec-node/values-examples/sequencer.yaml | 2 +- charts/aztec-node/values.yaml | 11 +- charts/helios/README.md | 2 +- setup-git-hooks.sh | 16 --- 14 files changed, 268 insertions(+), 30 deletions(-) create mode 100644 charts/aztec-node/values-examples/sequencer-mainnet.yaml delete mode 100755 setup-git-hooks.sh diff --git a/.gitignore b/.gitignore index 275e2f98..dfd5543d 100644 --- a/.gitignore +++ b/.gitignore @@ -11,6 +11,7 @@ # Misc llmdocs/ +.env # CRITICAL: Prevent sensitive data leaks # ======================================== diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 1d18c53c..eb1459db 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -8,7 +8,7 @@ repos: Uses 'helm-docs' to create documentation from the Helm chart's 'values.yaml' file, and inserts the result into a corresponding 'README.md' file. If this hook modifies files, stage the changes (git add) and commit again. - entry: jnorwood/helm-docs:v1.11.0 + entry: jnorwood/helm-docs:v1.14.2 files: (README\.md\.gotmpl|(Chart|requirements|values)\.yaml)$ language: docker_image require_serial: true diff --git a/Makefile b/Makefile index 104be0ef..1f17bfa9 100644 --- a/Makefile +++ b/Makefile @@ -12,7 +12,7 @@ lint: @docker run --rm --workdir /workdir --volume "$(CURRENT_DIR):/workdir" quay.io/helmpack/chart-testing:v3.4.0 ct lint docs: - @docker run --rm --volume "$(CURRENT_DIR):/helm-docs" -u $(UID) jnorwood/helm-docs:v1.11.0 + @docker run --rm --volume "$(CURRENT_DIR):/helm-docs" -u $(UID) jnorwood/helm-docs:v1.14.2 clean: @pre-commit uninstall diff --git a/charts/aztec-node/README.md b/charts/aztec-node/README.md index 0bc2bb7a..f17c6aa4 100644 --- a/charts/aztec-node/README.md +++ b/charts/aztec-node/README.md @@ -15,10 +15,10 @@ A Helm chart for deploying an Aztec node | customNetwork | object | `{"feeAssetHandlerContractAddress":null,"l1ChainId":null,"registryContractAddress":null,"slashFactoryAddress":null}` | Custom network - (not recommended) - Only for custom testnet usecases Must have deployed your own protocol contracts first | | fullnameOverride | string | `""` | Overrides the chart computed fullname | | hostNetwork | bool | `true` | Use host network - provides best P2P performance by binding directly to node's network This is the recommended configuration for Aztec nodes | -| image | object | `{"pullPolicy":"IfNotPresent","repository":"aztecprotocol/aztec","tag":"2.1.0-rc.24"}` | Image to use for the container | +| image | object | `{"pullPolicy":"IfNotPresent","repository":"aztecprotocol/aztec","tag":"2.1.4"}` | Image to use for the container | | image.pullPolicy | string | `"IfNotPresent"` | Container pull policy | | image.repository | string | `"aztecprotocol/aztec"` | Image repository | -| image.tag | string | `"2.1.0-rc.24"` | Image tag | +| image.tag | string | `"2.1.4"` | Image tag | | initContainers | list | `[]` | Additional init containers | | nameOverride | string | `""` | Overrides the chart name | | network | string | `nil` | Network name - this is a predefined network - testnet, devnet | @@ -62,7 +62,8 @@ A Helm chart for deploying an Aztec node | rbac.rules | list | See `values.yaml` | Required ClusterRole rules | | role | string | `"sequencer"` | Role determines the type of Aztec node deployment Valid roles: fullnode, sequencer, prover | | rollupVersion | string | `"canonical"` | Which rollup contract we want to follow from the registry | -| sequencer.attesterPrivateKey | string | `""` | Ethereum private key for attester (signs blocks and attestations) REQUIRED when role is 'sequencer' | +| sequencer.attesterPrivateKey | string | `""` | Ethereum private key for attester (signs blocks and attestations) REQUIRED when role is 'sequencer' (unless using attesterPrivateKeySecretName) Use this field OR attesterPrivateKeySecretName, not both | +| sequencer.attesterPrivateKeySecretName | string | `""` | Name of existing Kubernetes secret containing keystore.json Use this field OR attesterPrivateKey, not both When set, the chart will use the external secret instead of creating one The secret must contain a key named "keystore.json" with the full keystore structure Create with: kubectl create secret generic --from-file=keystore.json=keystore.json | | service.admin.enabled | bool | `true` | | | service.admin.port | int | `8081` | | | service.headless.enabled | bool | `true` | | @@ -120,6 +121,8 @@ helm install aztec-sequencer ./charts/aztec-node \ **Requirements:** - Ethereum private key with minimum 0.1 ETH on L1 (Sepolia for testnet) +**For production deployments:** Instead of passing the private key inline, you can reference an external Kubernetes secret. See [Using External Kubernetes Secrets](#using-external-kubernetes-secrets-sequencer) for details. + ### Install a Prover ```bash @@ -422,6 +425,55 @@ kubectl delete pvc -n aztec-testnet -l app.kubernetes.io/name=aztec-node 3. **Prover:** Use `--set prover.node.publisherPrivateKey="0x..."` when deploying 4. **Secrets Management:** Consider using external secret managers (Vault, Sealed Secrets, etc.) +### Using External Kubernetes Secrets (Sequencer) + +For production deployments, you can reference an existing Kubernetes secret instead of providing the private key inline. This is recommended for GKE and other production environments. + +**Step 1: Create your Kubernetes secret with the keystore.json content** + +```bash +# Create the keystore.json content +cat > keystore.json << EOF +{ + "schemaVersion": 1, + "validators": [ + { + "attester": ["0xYOUR_PRIVATE_KEY"], + "feeRecipient": "0x0000000000000000000000000000000000000000000000000000000000000000" + } + ] +} +EOF + +# Create the Kubernetes secret +kubectl create secret generic aztec-sequencer-keystore \ + --from-file=keystore.json=keystore.json \ + -n aztec-testnet + +# Clean up local file +rm keystore.json +``` + +**Step 2: Deploy the chart referencing the external secret** + +```bash +helm install aztec-sequencer ./charts/aztec-node \ + -f charts/aztec-node/values-examples/sequencer.yaml \ + --set sequencer.attesterPrivateKeySecretName="aztec-sequencer-keystore" \ + -n aztec-testnet --create-namespace +``` + +**Or using a values file:** + +```yaml +role: sequencer +sequencer: + attesterPrivateKeySecretName: "aztec-sequencer-keystore" + feeRecipient: "0x0000000000000000000000000000000000000000000000000000000000000000" +``` + +**Important:** When using `attesterPrivateKeySecretName`, do NOT set `attesterPrivateKey`. Use one method or the other, not both. + ## Troubleshooting ### Pod Not Starting diff --git a/charts/aztec-node/README.md.gotmpl b/charts/aztec-node/README.md.gotmpl index 346c0d0e..b1c3f4ff 100644 --- a/charts/aztec-node/README.md.gotmpl +++ b/charts/aztec-node/README.md.gotmpl @@ -55,6 +55,8 @@ helm install aztec-sequencer ./charts/aztec-node \ **Requirements:** - Ethereum private key with minimum 0.1 ETH on L1 (Sepolia for testnet) +**For production deployments:** Instead of passing the private key inline, you can reference an external Kubernetes secret. See [Using External Kubernetes Secrets](#using-external-kubernetes-secrets-sequencer) for details. + ### Install a Prover ```bash @@ -357,6 +359,55 @@ kubectl delete pvc -n aztec-testnet -l app.kubernetes.io/name=aztec-node 3. **Prover:** Use `--set prover.node.publisherPrivateKey="0x..."` when deploying 4. **Secrets Management:** Consider using external secret managers (Vault, Sealed Secrets, etc.) +### Using External Kubernetes Secrets (Sequencer) + +For production deployments, you can reference an existing Kubernetes secret instead of providing the private key inline. This is recommended for GKE and other production environments. + +**Step 1: Create your Kubernetes secret with the keystore.json content** + +```bash +# Create the keystore.json content +cat > keystore.json << EOF +{ + "schemaVersion": 1, + "validators": [ + { + "attester": ["0xYOUR_PRIVATE_KEY"], + "feeRecipient": "0x0000000000000000000000000000000000000000000000000000000000000000" + } + ] +} +EOF + +# Create the Kubernetes secret +kubectl create secret generic aztec-sequencer-keystore \ + --from-file=keystore.json=keystore.json \ + -n aztec-testnet + +# Clean up local file +rm keystore.json +``` + +**Step 2: Deploy the chart referencing the external secret** + +```bash +helm install aztec-sequencer ./charts/aztec-node \ + -f charts/aztec-node/values-examples/sequencer.yaml \ + --set sequencer.attesterPrivateKeySecretName="aztec-sequencer-keystore" \ + -n aztec-testnet --create-namespace +``` + +**Or using a values file:** + +```yaml +role: sequencer +sequencer: + attesterPrivateKeySecretName: "aztec-sequencer-keystore" + feeRecipient: "0x0000000000000000000000000000000000000000000000000000000000000000" +``` + +**Important:** When using `attesterPrivateKeySecretName`, do NOT set `attesterPrivateKey`. Use one method or the other, not both. + ## Troubleshooting ### Pod Not Starting diff --git a/charts/aztec-node/aztec-node.yaml b/charts/aztec-node/aztec-node.yaml index f2500a9e..d513148a 100644 --- a/charts/aztec-node/aztec-node.yaml +++ b/charts/aztec-node/aztec-node.yaml @@ -14,7 +14,7 @@ image: # -- Image repository repository: aztecprotocol/aztec # -- Image tag - tag: latest # Auto-updates to latest stable (currently 2.0.3) + tag: 2.1.4 # Auto-updates to latest stable # -- Container pull policy pullPolicy: Always # Required for Keel auto-updates diff --git a/charts/aztec-node/templates/_helpers.tpl b/charts/aztec-node/templates/_helpers.tpl index a466f505..d9177f52 100644 --- a/charts/aztec-node/templates/_helpers.tpl +++ b/charts/aztec-node/templates/_helpers.tpl @@ -110,10 +110,15 @@ Validate sequencer configuration */}} {{- define "chart.validateSequencer" -}} {{- if eq .Values.role "sequencer" -}} -{{- if not .Values.sequencer.attesterPrivateKey -}} -{{- fail "sequencer.attesterPrivateKey is REQUIRED when role is 'sequencer'" -}} +{{- $hasInlineKey := .Values.sequencer.attesterPrivateKey -}} +{{- $hasExternalSecret := .Values.sequencer.attesterPrivateKeySecretName -}} +{{- if and $hasInlineKey $hasExternalSecret -}} +{{- fail "Cannot use both sequencer.attesterPrivateKey and sequencer.attesterPrivateKeySecretName - choose one method" -}} {{- end -}} -{{- if not (hasPrefix "0x" .Values.sequencer.attesterPrivateKey) -}} +{{- if and (not $hasInlineKey) (not $hasExternalSecret) -}} +{{- fail "Must provide either sequencer.attesterPrivateKey OR sequencer.attesterPrivateKeySecretName when role is 'sequencer'" -}} +{{- end -}} +{{- if and $hasInlineKey (not (hasPrefix "0x" .Values.sequencer.attesterPrivateKey)) -}} {{- fail "sequencer.attesterPrivateKey must start with '0x'" -}} {{- end -}} {{- end -}} diff --git a/charts/aztec-node/templates/secret.yaml b/charts/aztec-node/templates/secret.yaml index d51ff5dc..ac321a45 100644 --- a/charts/aztec-node/templates/secret.yaml +++ b/charts/aztec-node/templates/secret.yaml @@ -1,4 +1,4 @@ -{{- if eq .Values.role "sequencer" }} +{{- if and (eq .Values.role "sequencer") (not .Values.sequencer.attesterPrivateKeySecretName) }} apiVersion: v1 kind: Secret metadata: diff --git a/charts/aztec-node/templates/statefulset.yaml b/charts/aztec-node/templates/statefulset.yaml index 8a7aa5b0..d10763d8 100644 --- a/charts/aztec-node/templates/statefulset.yaml +++ b/charts/aztec-node/templates/statefulset.yaml @@ -225,7 +225,11 @@ spec: {{- if eq .Values.role "sequencer" }} - name: keystore secret: + {{- if .Values.sequencer.attesterPrivateKeySecretName }} + secretName: {{ .Values.sequencer.attesterPrivateKeySecretName }} + {{- else }} secretName: {{ include "chart.resourceName" . }}-keystore + {{- end }} {{- end }} {{- if not .Values.persistence.enabled }} - name: storage diff --git a/charts/aztec-node/values-examples/sequencer-mainnet.yaml b/charts/aztec-node/values-examples/sequencer-mainnet.yaml new file mode 100644 index 00000000..7712aa55 --- /dev/null +++ b/charts/aztec-node/values-examples/sequencer-mainnet.yaml @@ -0,0 +1,134 @@ +# Example values for deploying an Aztec sequencer on mainnet +# A sequencer produces blocks and attestations for the network +# +# IMPORTANT: This example assumes you have deployed: +# 1. Geth execution client (see geth-mainnet.yaml example) +# 2. Prysm/Lighthouse consensus client (see prysm-mainnet.yaml example) +# +# Deploy those L1 clients first, then deploy this sequencer + +# Deployment role +role: sequencer + +# Sequencer-specific configuration +sequencer: + # OPTION 1: Inline private key (NOT recommended for production) + # Use --set sequencer.attesterPrivateKey="0xYOUR_KEY" when deploying + # attesterPrivateKey: "" + + # OPTION 2: External Kubernetes secret (RECOMMENDED for production) + # Create secret first: + # kubectl create secret generic aztec-sequencer-mainnet-keystore \ + # --from-file=keystore.json=keystore.json -n aztec + # Then reference it: + attesterPrivateKeySecretName: "aztec-sequencer-mainnet-keystore" + + # REQUIRED: Aztec address (64-character hex string) to receive unburnt transaction fees + # WARNING: If not set, the node will crash with "Invalid AztecAddress length 0" + feeRecipient: "0x0000000000000000000000000000000000000000000000000000000000000000" + +# Network to connect to +network: mainnet +networkName: mainnet + +# Container image configuration +image: + repository: aztecprotocol/aztec + tag: latest # For production, pin to specific version like "2.1.4" + pullPolicy: Always # Use Always for auto-updates, or IfNotPresent for pinned versions + +# Node configuration +node: + replicas: 1 + + # Log level configuration + # Format: "default_level; override: component, other_component" + logLevel: "info" + + # Startup command - REQUIRED for sequencer + # These flags tell Aztec to run as a full sequencer with archiver + startCmd: + - --node + - --archiver + - --sequencer + - --network + - mainnet # WARNING: Must match network field above + + # L1 Ethereum configuration + # Point to your deployed Geth + Prysm/Lighthouse stack + # These should match the service names from your L1 deployment + # Pattern: ..svc.cluster.local: + l1ExecutionUrls: + - "http://geth-mainnet.l1.svc.cluster.local:8545" + l1ConsensusUrls: + - "http://prysm-mainnet.l1.svc.cluster.local:3500" + + # Resource allocation + # Aztec minimum requirements: 2-4 cores, 16GB RAM, 1TB NVMe SSD, 25 Mbps network + # These values provide headroom for production workloads + resources: + requests: + cpu: "4" # 4 cores (minimum: 2-4 cores) + memory: "16Gi" # 16GB (minimum: 16GB) + limits: + cpu: "8" # 8 cores for burst capacity + memory: "32Gi" # 32GB for optimal performance + + # Storage configuration + storage: + dataDirectory: /data + dataStoreMapSize: "134217728" # 128 GB + worldStateMapSize: "134217728" # 128 GB + + # Startup probe - sequencers need extended startup time + # 60s * 60 = 1 hour max startup time + startupProbe: + periodSeconds: 60 + failureThreshold: 60 + +# Persistence +# Aztec minimum requirement: 1TB NVMe SSD +persistence: + enabled: true + size: 1000Gi # 1TB recommended for mainnet + storageClassName: premium-rwo # Use NVMe-backed storage class + accessModes: + - ReadWriteOnce + selector: {} + +# Networking configuration +# Choose ONE of the following networking strategies: + +# OPTION 1: Host networking (recommended for best P2P performance) +# This allows direct binding to node's network interface +hostNetwork: true + +# OPTION 2: NodePort (alternative if host networking not available) +# Uncomment if using NodePort instead of hostNetwork +# hostNetwork: false +# service: +# p2p: +# nodePortEnabled: true +# nodePort: 30400 + +# Service configuration +service: + httpPort: 8080 + + # P2P networking + p2p: + enabled: true + nodePortEnabled: false # Not needed with hostNetwork + port: 40400 + announcePort: 40400 + + # Admin API for debugging and metrics + admin: + enabled: true + port: 8081 + +# Pod annotations (optional - for auto-updates with keel.sh) +# podAnnotations: +# keel.sh/policy: force +# keel.sh/pollSchedule: "@every 10m" +# keel.sh/trigger: poll diff --git a/charts/aztec-node/values-examples/sequencer.yaml b/charts/aztec-node/values-examples/sequencer.yaml index 81bfa20e..58d6be2c 100644 --- a/charts/aztec-node/values-examples/sequencer.yaml +++ b/charts/aztec-node/values-examples/sequencer.yaml @@ -29,7 +29,7 @@ networkName: staging-public # Container image configuration image: repository: aztecprotocol/aztec - tag: latest + tag: 2.1.4 pullPolicy: Always # Use Always for auto-updates with keel.sh # Node configuration diff --git a/charts/aztec-node/values.yaml b/charts/aztec-node/values.yaml index 4127c320..6b59aea6 100644 --- a/charts/aztec-node/values.yaml +++ b/charts/aztec-node/values.yaml @@ -17,8 +17,15 @@ role: sequencer sequencer: # -- Ethereum private key for attester (signs blocks and attestations) - # REQUIRED when role is 'sequencer' + # REQUIRED when role is 'sequencer' (unless using attesterPrivateKeySecretName) + # Use this field OR attesterPrivateKeySecretName, not both attesterPrivateKey: "" + # -- Name of existing Kubernetes secret containing keystore.json + # Use this field OR attesterPrivateKey, not both + # When set, the chart will use the external secret instead of creating one + # The secret must contain a key named "keystore.json" with the full keystore structure + # Create with: kubectl create secret generic --from-file=keystore.json=keystore.json + attesterPrivateKeySecretName: "" # -- Aztec address (32 bytes) to receive unburnt transaction fees # feeRecipient: "0x0000000000000000000000000000000000000000000000000000000000000000" @@ -81,7 +88,7 @@ image: # -- Image repository repository: aztecprotocol/aztec # -- Image tag - tag: 2.1.0-rc.24 + tag: 2.1.4 # -- Container pull policy pullPolicy: IfNotPresent diff --git a/charts/helios/README.md b/charts/helios/README.md index 241e1286..0044831a 100644 --- a/charts/helios/README.md +++ b/charts/helios/README.md @@ -73,4 +73,4 @@ A Helm chart for Helios - a trustless, efficient, and portable Ethereum light cl | volumes | list | `[]` | | ---------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) +Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2) diff --git a/setup-git-hooks.sh b/setup-git-hooks.sh deleted file mode 100755 index ab102b84..00000000 --- a/setup-git-hooks.sh +++ /dev/null @@ -1,16 +0,0 @@ -#!/bin/bash - -# Setup script to enable git hooks for this repository - -echo "Setting up git hooks to prevent sensitive data leaks..." - -# Configure git to use the .githooks directory -git config core.hooksPath .githooks - -echo "✅ Git hooks configured successfully!" -echo "The pre-commit hook will now prevent committing:" -echo " - Cluster test data (canary-*, node*)" -echo " - Private keys and keystores" -echo " - Large files (node_modules, etc.)" -echo "" -echo "To temporarily bypass (NOT recommended): git commit --no-verify" \ No newline at end of file From 88ec1ca43d36b1d2462674e2d51b4966d8b8861f Mon Sep 17 00:00:00 2001 From: JeanDaniel Bussy Date: Sun, 16 Nov 2025 14:39:36 -0300 Subject: [PATCH 25/27] =?UTF-8?q?feat:=20simplify=20Aztec=20node=20storage?= =?UTF-8?q?=20configuration=20by=20using=20built-in=20def=E2=80=A6=20(#153?= =?UTF-8?q?)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat: simplify Aztec node storage configuration by using built-in defaults Remove hardcoded storage map size defaults from values.yaml and make environment variables conditional in the template. This reduces configuration complexity while allowing power users to override when needed. Changes: - Remove dataStoreMapSize and worldStateMapSize defaults from values.yaml (Aztec uses 128GB by default) - Make DATA_STORE_MAP_SIZE_KB and WS_DB_MAP_SIZE_KB env vars conditional in statefulset template - Add documentation comments explaining Aztec's built-in defaults - Update sequencer-mainnet example to use pinned image tag 2.1.5 - Examples still include storage config for advanced users who need custom tuning This aligns with Aztec's official documentation which doesn't surface these configuration parameters, letting the node use sensible defaults. * feat: simplify Aztec node storage configuration by using built-in defaults Remove hardcoded storage map size defaults from values.yaml and make environment variables conditional in the template. This reduces configuration complexity while allowing power users to override when needed. Changes: - Remove dataStoreMapSize and worldStateMapSize defaults from values.yaml (Aztec uses 128GB by default) - Make DATA_STORE_MAP_SIZE_KB and WS_DB_MAP_SIZE_KB env vars conditional in statefulset template - Add documentation comments explaining Aztec's built-in defaults - Update sequencer-mainnet example to use pinned image tag 2.1.5 - Examples still include storage config for advanced users who need custom tuning This aligns with Aztec's official documentation which doesn't surface these configuration parameters, letting the node use sensible defaults. --- charts/aztec-node/README.md | 4 ++-- charts/aztec-node/templates/statefulset.yaml | 4 ++++ charts/aztec-node/values-examples/sequencer-mainnet.yaml | 2 +- charts/aztec-node/values.yaml | 6 ++++-- 4 files changed, 11 insertions(+), 5 deletions(-) diff --git a/charts/aztec-node/README.md b/charts/aztec-node/README.md index f17c6aa4..a3fe95ba 100644 --- a/charts/aztec-node/README.md +++ b/charts/aztec-node/README.md @@ -23,7 +23,7 @@ A Helm chart for deploying an Aztec node | nameOverride | string | `""` | Overrides the chart name | | network | string | `nil` | Network name - this is a predefined network - testnet, devnet | | networkName | string | `"staging-public"` | Network identifier used in resource naming (l2-{role}-node-{networkName}-{component}) This appears in service/statefulset names for easy identification | -| node | object | `{"coinbase":null,"l1ConsensusHostApiKeyHeaders":[],"l1ConsensusHostApiKeys":[],"l1ConsensusUrls":["http://l1-full-node-sepolia-beacon.l1.svc.cluster.local:5052"],"l1ExecutionUrls":["http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545"],"logLevel":"info","metrics":{"otelCollectorEndpoint":"","otelExcludeMetrics":"","useGcloudLogging":false},"nodeJsOptions":["--no-warnings","--max-old-space-size=4096"],"preStartScript":"","remoteUrl":{"archiver":null,"blobSink":null,"proverBroker":null,"proverCoordinationNodes":[]},"replicas":1,"resources":{},"sentinel":{"enabled":false},"startCmd":[],"startupProbe":{"failureThreshold":20,"periodSeconds":30},"storage":{"archiveStorageMapSize":null,"dataDirectory":"/data","dataStoreMapSize":"134217728","p2pStorageMapSize":null,"worldStateMapSize":"134217728"}}` | Aztec node configuration | +| node | object | `{"coinbase":null,"l1ConsensusHostApiKeyHeaders":[],"l1ConsensusHostApiKeys":[],"l1ConsensusUrls":["http://l1-full-node-sepolia-beacon.l1.svc.cluster.local:5052"],"l1ExecutionUrls":["http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545"],"logLevel":"info","metrics":{"otelCollectorEndpoint":"","otelExcludeMetrics":"","useGcloudLogging":false},"nodeJsOptions":["--no-warnings","--max-old-space-size=4096"],"preStartScript":"","remoteUrl":{"archiver":null,"blobSink":null,"proverBroker":null,"proverCoordinationNodes":[]},"replicas":1,"resources":{},"sentinel":{"enabled":false},"startCmd":[],"startupProbe":{"failureThreshold":20,"periodSeconds":30},"storage":{"archiveStorageMapSize":null,"dataDirectory":"/data","dataStoreMapSize":null,"p2pStorageMapSize":null,"worldStateMapSize":null}}` | Aztec node configuration | | node.coinbase | string | `nil` | Address that will receive block or proof rewards For prover roles, this is the PROVER_ID | | node.l1ExecutionUrls | list | `["http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545"]` | L1 Ethereum configuration Ethereum execution layer RPC endpoint(s) - comma separated list | | node.logLevel | string | `"info"` | Log level - info, verbose, debug, trace | @@ -36,7 +36,7 @@ A Helm chart for deploying an Aztec node | node.sentinel | object | `{"enabled":false}` | Sentinel configuration - gathers slashing information | | node.startCmd | list | `[]` | Start command flags Auto-generated based on role, but can be overridden for custom configurations Leave empty to use role-based defaults | | node.startupProbe | object | `{"failureThreshold":20,"periodSeconds":30}` | Startup probe configuration | -| node.storage | object | `{"archiveStorageMapSize":null,"dataDirectory":"/data","dataStoreMapSize":"134217728","p2pStorageMapSize":null,"worldStateMapSize":"134217728"}` | Storage configuration | +| node.storage | object | `{"archiveStorageMapSize":null,"dataDirectory":"/data","dataStoreMapSize":null,"p2pStorageMapSize":null,"worldStateMapSize":null}` | Storage configuration | | persistence.accessModes | list | `["ReadWriteOnce"]` | AccessModes | | persistence.annotations | object | `{}` | Annotations for volume claim template | | persistence.enabled | bool | `false` | Uses an emptyDir when not enabled | diff --git a/charts/aztec-node/templates/statefulset.yaml b/charts/aztec-node/templates/statefulset.yaml index d10763d8..79fe2052 100644 --- a/charts/aztec-node/templates/statefulset.yaml +++ b/charts/aztec-node/templates/statefulset.yaml @@ -175,10 +175,14 @@ spec: value: "10000" - name: DATA_DIRECTORY value: {{ .Values.node.storage.dataDirectory | quote }} + {{- if .Values.node.storage.dataStoreMapSize }} - name: DATA_STORE_MAP_SIZE_KB value: {{ .Values.node.storage.dataStoreMapSize | quote }} + {{- end }} + {{- if .Values.node.storage.worldStateMapSize }} - name: WS_DB_MAP_SIZE_KB value: {{ .Values.node.storage.worldStateMapSize | quote }} + {{- end }} - name: USE_GCLOUD_LOGGING value: {{ .Values.node.metrics.useGcloudLogging | quote }} {{- if .Values.node.metrics.otelCollectorEndpoint }} diff --git a/charts/aztec-node/values-examples/sequencer-mainnet.yaml b/charts/aztec-node/values-examples/sequencer-mainnet.yaml index 7712aa55..5758b0f4 100644 --- a/charts/aztec-node/values-examples/sequencer-mainnet.yaml +++ b/charts/aztec-node/values-examples/sequencer-mainnet.yaml @@ -34,7 +34,7 @@ networkName: mainnet # Container image configuration image: repository: aztecprotocol/aztec - tag: latest # For production, pin to specific version like "2.1.4" + tag: 2.1.5 # For production, pin to specific version like "2.1.4" pullPolicy: Always # Use Always for auto-updates, or IfNotPresent for pinned versions # Node configuration diff --git a/charts/aztec-node/values.yaml b/charts/aztec-node/values.yaml index 6b59aea6..61baf9ff 100644 --- a/charts/aztec-node/values.yaml +++ b/charts/aztec-node/values.yaml @@ -184,9 +184,11 @@ node: # Data directory dataDirectory: /data # Data store map size in kB (per database) - dataStoreMapSize: "134217728" # 128 GB + # Leave empty to use Aztec's built-in default (128 GB) + dataStoreMapSize: # World state map size in kB (per merkle tree) - worldStateMapSize: "134217728" # 128 GB + # Leave empty to use Aztec's built-in default (falls back to dataStoreMapSize) + worldStateMapSize: # P2P storage map size (kB) p2pStorageMapSize: # Archive storage map size (kB) From 1056ed80a07f64a9ffe4e3a47946fc4ef35afedb Mon Sep 17 00:00:00 2001 From: JeanDaniel Bussy Date: Sun, 16 Nov 2025 14:39:36 -0300 Subject: [PATCH 26/27] =?UTF-8?q?feat:=20simplify=20Aztec=20node=20storage?= =?UTF-8?q?=20configuration=20by=20using=20built-in=20def=E2=80=A6=20(#153?= =?UTF-8?q?)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat: simplify Aztec node storage configuration by using built-in defaults Remove hardcoded storage map size defaults from values.yaml and make environment variables conditional in the template. This reduces configuration complexity while allowing power users to override when needed. Changes: - Remove dataStoreMapSize and worldStateMapSize defaults from values.yaml (Aztec uses 128GB by default) - Make DATA_STORE_MAP_SIZE_KB and WS_DB_MAP_SIZE_KB env vars conditional in statefulset template - Add documentation comments explaining Aztec's built-in defaults - Update sequencer-mainnet example to use pinned image tag 2.1.5 - Examples still include storage config for advanced users who need custom tuning This aligns with Aztec's official documentation which doesn't surface these configuration parameters, letting the node use sensible defaults. * feat: simplify Aztec node storage configuration by using built-in defaults Remove hardcoded storage map size defaults from values.yaml and make environment variables conditional in the template. This reduces configuration complexity while allowing power users to override when needed. Changes: - Remove dataStoreMapSize and worldStateMapSize defaults from values.yaml (Aztec uses 128GB by default) - Make DATA_STORE_MAP_SIZE_KB and WS_DB_MAP_SIZE_KB env vars conditional in statefulset template - Add documentation comments explaining Aztec's built-in defaults - Update sequencer-mainnet example to use pinned image tag 2.1.5 - Examples still include storage config for advanced users who need custom tuning This aligns with Aztec's official documentation which doesn't surface these configuration parameters, letting the node use sensible defaults. --- charts/aztec-node/README.md | 8 ++++---- charts/aztec-node/aztec-node.yaml | 2 +- charts/aztec-node/templates/statefulset.yaml | 4 ++++ charts/aztec-node/values-examples/sequencer-mainnet.yaml | 2 +- charts/aztec-node/values-examples/sequencer.yaml | 2 +- charts/aztec-node/values.yaml | 8 +++++--- 6 files changed, 16 insertions(+), 10 deletions(-) diff --git a/charts/aztec-node/README.md b/charts/aztec-node/README.md index f17c6aa4..4fcedd21 100644 --- a/charts/aztec-node/README.md +++ b/charts/aztec-node/README.md @@ -15,15 +15,15 @@ A Helm chart for deploying an Aztec node | customNetwork | object | `{"feeAssetHandlerContractAddress":null,"l1ChainId":null,"registryContractAddress":null,"slashFactoryAddress":null}` | Custom network - (not recommended) - Only for custom testnet usecases Must have deployed your own protocol contracts first | | fullnameOverride | string | `""` | Overrides the chart computed fullname | | hostNetwork | bool | `true` | Use host network - provides best P2P performance by binding directly to node's network This is the recommended configuration for Aztec nodes | -| image | object | `{"pullPolicy":"IfNotPresent","repository":"aztecprotocol/aztec","tag":"2.1.4"}` | Image to use for the container | +| image | object | `{"pullPolicy":"IfNotPresent","repository":"aztecprotocol/aztec","tag":"2.1.5"}` | Image to use for the container | | image.pullPolicy | string | `"IfNotPresent"` | Container pull policy | | image.repository | string | `"aztecprotocol/aztec"` | Image repository | -| image.tag | string | `"2.1.4"` | Image tag | +| image.tag | string | `"2.1.5"` | Image tag | | initContainers | list | `[]` | Additional init containers | | nameOverride | string | `""` | Overrides the chart name | | network | string | `nil` | Network name - this is a predefined network - testnet, devnet | | networkName | string | `"staging-public"` | Network identifier used in resource naming (l2-{role}-node-{networkName}-{component}) This appears in service/statefulset names for easy identification | -| node | object | `{"coinbase":null,"l1ConsensusHostApiKeyHeaders":[],"l1ConsensusHostApiKeys":[],"l1ConsensusUrls":["http://l1-full-node-sepolia-beacon.l1.svc.cluster.local:5052"],"l1ExecutionUrls":["http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545"],"logLevel":"info","metrics":{"otelCollectorEndpoint":"","otelExcludeMetrics":"","useGcloudLogging":false},"nodeJsOptions":["--no-warnings","--max-old-space-size=4096"],"preStartScript":"","remoteUrl":{"archiver":null,"blobSink":null,"proverBroker":null,"proverCoordinationNodes":[]},"replicas":1,"resources":{},"sentinel":{"enabled":false},"startCmd":[],"startupProbe":{"failureThreshold":20,"periodSeconds":30},"storage":{"archiveStorageMapSize":null,"dataDirectory":"/data","dataStoreMapSize":"134217728","p2pStorageMapSize":null,"worldStateMapSize":"134217728"}}` | Aztec node configuration | +| node | object | `{"coinbase":null,"l1ConsensusHostApiKeyHeaders":[],"l1ConsensusHostApiKeys":[],"l1ConsensusUrls":["http://l1-full-node-sepolia-beacon.l1.svc.cluster.local:5052"],"l1ExecutionUrls":["http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545"],"logLevel":"info","metrics":{"otelCollectorEndpoint":"","otelExcludeMetrics":"","useGcloudLogging":false},"nodeJsOptions":["--no-warnings","--max-old-space-size=4096"],"preStartScript":"","remoteUrl":{"archiver":null,"blobSink":null,"proverBroker":null,"proverCoordinationNodes":[]},"replicas":1,"resources":{},"sentinel":{"enabled":false},"startCmd":[],"startupProbe":{"failureThreshold":20,"periodSeconds":30},"storage":{"archiveStorageMapSize":null,"dataDirectory":"/data","dataStoreMapSize":null,"p2pStorageMapSize":null,"worldStateMapSize":null}}` | Aztec node configuration | | node.coinbase | string | `nil` | Address that will receive block or proof rewards For prover roles, this is the PROVER_ID | | node.l1ExecutionUrls | list | `["http://l1-full-node-sepolia-execution.l1.svc.cluster.local:8545"]` | L1 Ethereum configuration Ethereum execution layer RPC endpoint(s) - comma separated list | | node.logLevel | string | `"info"` | Log level - info, verbose, debug, trace | @@ -36,7 +36,7 @@ A Helm chart for deploying an Aztec node | node.sentinel | object | `{"enabled":false}` | Sentinel configuration - gathers slashing information | | node.startCmd | list | `[]` | Start command flags Auto-generated based on role, but can be overridden for custom configurations Leave empty to use role-based defaults | | node.startupProbe | object | `{"failureThreshold":20,"periodSeconds":30}` | Startup probe configuration | -| node.storage | object | `{"archiveStorageMapSize":null,"dataDirectory":"/data","dataStoreMapSize":"134217728","p2pStorageMapSize":null,"worldStateMapSize":"134217728"}` | Storage configuration | +| node.storage | object | `{"archiveStorageMapSize":null,"dataDirectory":"/data","dataStoreMapSize":null,"p2pStorageMapSize":null,"worldStateMapSize":null}` | Storage configuration | | persistence.accessModes | list | `["ReadWriteOnce"]` | AccessModes | | persistence.annotations | object | `{}` | Annotations for volume claim template | | persistence.enabled | bool | `false` | Uses an emptyDir when not enabled | diff --git a/charts/aztec-node/aztec-node.yaml b/charts/aztec-node/aztec-node.yaml index d513148a..031d30d9 100644 --- a/charts/aztec-node/aztec-node.yaml +++ b/charts/aztec-node/aztec-node.yaml @@ -14,7 +14,7 @@ image: # -- Image repository repository: aztecprotocol/aztec # -- Image tag - tag: 2.1.4 # Auto-updates to latest stable + tag: 2.1.5 # Auto-updates to latest stable # -- Container pull policy pullPolicy: Always # Required for Keel auto-updates diff --git a/charts/aztec-node/templates/statefulset.yaml b/charts/aztec-node/templates/statefulset.yaml index d10763d8..79fe2052 100644 --- a/charts/aztec-node/templates/statefulset.yaml +++ b/charts/aztec-node/templates/statefulset.yaml @@ -175,10 +175,14 @@ spec: value: "10000" - name: DATA_DIRECTORY value: {{ .Values.node.storage.dataDirectory | quote }} + {{- if .Values.node.storage.dataStoreMapSize }} - name: DATA_STORE_MAP_SIZE_KB value: {{ .Values.node.storage.dataStoreMapSize | quote }} + {{- end }} + {{- if .Values.node.storage.worldStateMapSize }} - name: WS_DB_MAP_SIZE_KB value: {{ .Values.node.storage.worldStateMapSize | quote }} + {{- end }} - name: USE_GCLOUD_LOGGING value: {{ .Values.node.metrics.useGcloudLogging | quote }} {{- if .Values.node.metrics.otelCollectorEndpoint }} diff --git a/charts/aztec-node/values-examples/sequencer-mainnet.yaml b/charts/aztec-node/values-examples/sequencer-mainnet.yaml index 7712aa55..5758b0f4 100644 --- a/charts/aztec-node/values-examples/sequencer-mainnet.yaml +++ b/charts/aztec-node/values-examples/sequencer-mainnet.yaml @@ -34,7 +34,7 @@ networkName: mainnet # Container image configuration image: repository: aztecprotocol/aztec - tag: latest # For production, pin to specific version like "2.1.4" + tag: 2.1.5 # For production, pin to specific version like "2.1.4" pullPolicy: Always # Use Always for auto-updates, or IfNotPresent for pinned versions # Node configuration diff --git a/charts/aztec-node/values-examples/sequencer.yaml b/charts/aztec-node/values-examples/sequencer.yaml index 58d6be2c..6f4f7e2b 100644 --- a/charts/aztec-node/values-examples/sequencer.yaml +++ b/charts/aztec-node/values-examples/sequencer.yaml @@ -29,7 +29,7 @@ networkName: staging-public # Container image configuration image: repository: aztecprotocol/aztec - tag: 2.1.4 + tag: 2.1.5 pullPolicy: Always # Use Always for auto-updates with keel.sh # Node configuration diff --git a/charts/aztec-node/values.yaml b/charts/aztec-node/values.yaml index 6b59aea6..a9621dc2 100644 --- a/charts/aztec-node/values.yaml +++ b/charts/aztec-node/values.yaml @@ -88,7 +88,7 @@ image: # -- Image repository repository: aztecprotocol/aztec # -- Image tag - tag: 2.1.4 + tag: 2.1.5 # -- Container pull policy pullPolicy: IfNotPresent @@ -184,9 +184,11 @@ node: # Data directory dataDirectory: /data # Data store map size in kB (per database) - dataStoreMapSize: "134217728" # 128 GB + # Leave empty to use Aztec's built-in default (128 GB) + dataStoreMapSize: # World state map size in kB (per merkle tree) - worldStateMapSize: "134217728" # 128 GB + # Leave empty to use Aztec's built-in default (falls back to dataStoreMapSize) + worldStateMapSize: # P2P storage map size (kB) p2pStorageMapSize: # Archive storage map size (kB) From 8f45afb93944d56b380f2c9b36333470f97f960e Mon Sep 17 00:00:00 2001 From: bussyjd Date: Sun, 16 Nov 2025 14:54:23 -0300 Subject: [PATCH 27/27] chore: bump aztec-node chart to v0.2.0 with Aztec 2.1.5 Update chart version from 0.1.0 to 0.2.0 for minor release with: - Simplified storage configuration (using Aztec built-in defaults) - Updated Aztec image from 2.0.2 to 2.1.5 - Conditional storage environment variables in templates Changes: - Chart version: 0.1.0 -> 0.2.0 - App version: 2.0.2 -> 2.1.5 - README badges updated to reflect new versions --- charts/aztec-node/Chart.yaml | 4 ++-- charts/aztec-node/README.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/aztec-node/Chart.yaml b/charts/aztec-node/Chart.yaml index 0158cd51..e68c950c 100644 --- a/charts/aztec-node/Chart.yaml +++ b/charts/aztec-node/Chart.yaml @@ -2,5 +2,5 @@ apiVersion: v2 name: aztec-node description: A Helm chart for deploying an Aztec node type: application -version: 0.1.0 -appVersion: "2.0.2" +version: 0.2.0 +appVersion: "2.1.5" diff --git a/charts/aztec-node/README.md b/charts/aztec-node/README.md index 4fcedd21..7342bc64 100644 --- a/charts/aztec-node/README.md +++ b/charts/aztec-node/README.md @@ -2,7 +2,7 @@ Aztec Node =========== -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.0.2](https://img.shields.io/badge/AppVersion-2.0.2-informational?style=flat-square) +![Version: 0.2.0](https://img.shields.io/badge/Version-0.2.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.1.5](https://img.shields.io/badge/AppVersion-2.1.5-informational?style=flat-square) A Helm chart for deploying an Aztec node