-
Notifications
You must be signed in to change notification settings - Fork 77
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(sequencer, charts)!: use uds for abci #1877
base: main
Are you sure you want to change the base?
Conversation
16d9bb4
to
e154694
Compare
3b54ffc
to
9a1a550
Compare
securityContext: | ||
runAsUser: 1000 | ||
runAsGroup: 3000 | ||
fsGroup: 2000 | ||
supplementalGroups: [4000] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@WafflesVonMaple feel a bit out of my depth on these settings. I'm also certain there is more configuration going on here than necessary, but these setting work.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
runAsUser: # hardcode user to non-root if not set in dockerfile
runAsGroup: # hardcode group to non root if not set in Dockerfile
runAsNonRoot: # hardcode to non-root. Redundant if dockerfile is set to USER 1000
General safety dictates runAsUser/Group are not explicit replacement for runAsNonRoot as the ID must exist in the container for it to run.
runAsNonRoot also limits access to host resources that might mistakenly get exposed to the container
fsGroup/GroupChangePolicy defines group which kube will change perm of all files in volumes mounted. Caution to be exercised as changing group ownership of an entire volume can cause startup delay or other issues
Summary
Add support to the sequencer to support running the ABCI connection over UDS instead of TCP only, updates to chart to use the UDS connection by default.
Background
Local testing found up to a 25x speed up using UDS instead of TCP loopback for ABCI communication. We can continue to offer the option of using TCP connections, and support the faster connection within our charts by default.
Changes
listen_addr
config with newabci_listener_url
config which is used to inform sequencer how to listenTesting
Synced a full node with mainnet, and tested with ABCI replay.
Changelogs
Changelogs updated.
Breaking Changelist
ASTRIA_SEQUENCER_LISTEN_ADDR
config variable, replaced withASTRIA_SEQUENCER_ABCI_LISTENER_URL
Related Issues
Link any issues that are related, prefer full GitHub links.
closes