Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Signer authorized keys #610

Merged
merged 7 commits into from
Nov 6, 2023
Merged

Signer authorized keys #610

merged 7 commits into from
Nov 6, 2023

Commits on Oct 24, 2023

  1. Support for Signer Authorized Keys

    Authorized key is the tezos native method to authenticate signing
    requests, one that we use in the new tezos-kms-signer-lambda.
    
    This adds the required support on tezos-k8s to sign with such a signer.
    
    The way it works in octez is:
    
    * when the baker/client connects to the signer for the first time,
      signer answers with a list of "authorized_keys" that the signature
      request must be signed with. These authorized keys are just tezos
      accounts
    * if the baker/client has the secret key for one of these authorized
      keys, they will just sign every request with it. otherwise, there will
      be an error
    * this can't be nested. the authorized_key can't be remote
    
    We add support in tezos-k8s by assuming the authorized_keys are just
    standard "accounts". Then, you may configure a baker as follows:
    
    ```
    nodes:
      mybaker:
        bake_using_accounts:
        - mybakeraddy
        authorized_keys:
        - my_authorized_key
    ```
    
    config-generator then ensures that the private authorized key is
    accessible to the baker.
    
    We also add support on octez-signer end:
    
    ```
    octezSigners:
      mysigner:
        sign_for_accounts:
        - mybakeraddy
        authorized_keys:
        - my_authorized_key
    ```
    
    When set, the signer mandates requests to be authenticated. Otherwise,
    it signs anything.
    
    This way, you can test end-to-end in a private chain.
    
    We modify mkchain to do this by default: mkchain now generates an
    authorized key and uses it to sign by default.
    
    Also, mkchain was previously defaulting to using one remote signer, but
    this broke when adding support for tacoInfra signer. I fixed it.
    
    I have tested it with 3 bakers and 2 signers, one authorized and one
    not. It's all working. I haven't tried zerotier and public chains.
    
    Other changes:
    
    * switch default version to 17.3
    * no magic byte restriction from signer - prevents activation
    nicolasochem committed Oct 24, 2023
    Configuration menu
    Copy the full SHA
    5afa03f View commit details
    Browse the repository at this point in the history

Commits on Oct 25, 2023

  1. Update mkchain/tqchain/mkchain.py

    Co-authored-by: Aryeh Harris <harryttd@users.noreply.github.com>
    nicolasochem and harryttd authored Oct 25, 2023
    Configuration menu
    Copy the full SHA
    804b2c8 View commit details
    Browse the repository at this point in the history
  2. Update charts/tezos/values.yaml

    Co-authored-by: Aryeh Harris <harryttd@users.noreply.github.com>
    nicolasochem and harryttd authored Oct 25, 2023
    Configuration menu
    Copy the full SHA
    aa9233a View commit details
    Browse the repository at this point in the history
  3. Configuration menu
    Copy the full SHA
    e1c5304 View commit details
    Browse the repository at this point in the history

Commits on Nov 6, 2023

  1. fix comments per review

    nicolasochem committed Nov 6, 2023
    Configuration menu
    Copy the full SHA
    2ec0c45 View commit details
    Browse the repository at this point in the history
  2. Configuration menu
    Copy the full SHA
    fd58c59 View commit details
    Browse the repository at this point in the history
  3. Update charts/tezos/templates/_helpers.tpl

    Co-authored-by: Aryeh Harris <harryttd@users.noreply.github.com>
    nicolasochem and harryttd authored Nov 6, 2023
    Configuration menu
    Copy the full SHA
    be05447 View commit details
    Browse the repository at this point in the history