[TEST ONLY] previewnet consensus-only baseline #6989
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* [gha] rename dockerhub release workflow * [gha][forge] include image tag in namespace to prevent cadence clash
* [gha] build on push to preview branch * [tf] update instance types for preview
Remove also ClusterRole and ClusterRoleBinding resources that were used to enact the PodSecurityPolicy policies. The current recommended Kubernetes version for these configs is 1.23 * updated autoscaler image tag v.1.21.0 -> v.1.23.0 * updated autoscaler permissions to the recommended set for this version The recommended mechanism to replace PodSecurityPolicy is [Pod Security Standards](https://v1-23.docs.kubernetes.io/docs/tasks/configure-pod-container/migrate-from-psp/). * removed SYS_RESOURCE from requested capability set for Haproxy Deployment for compatibility with the PSS Baseline profile. Without this change, the entire "default" namespace would have to run under the Privileged profile, possibly compromising the security of the validator nodes.
…ondition (#6915) This commit avoids that sync_to races with commit in state computer. previously it'd result in state sync error, with quorum store, it may panic the node because of decreasing round number. Co-authored-by: Zekun Li <[email protected]>
…h to clear state_computer between epoch end and start (#6916) * [Quorum Store] Implement end_epoch to clear state_computer between epoch end and start (#6889) We should not be using a stale PayloadManager after epoch end, so adding a end_epoch function that sets the PayloadManager to None. This fixes a panic that was observed because the stale PayloadManager was still held at StateComputer during sync_to called from initiate_new_epoch. The PayloadManager expects to only see commits from its epoch, which is violated if the epoch change includes multiple epochs. changing_working_quorum_test (with failpoints) failed with panics. Rerun and observe no panics. TODO (not in this PR): would be nice to have a test that explicitly causes a multiple epoch sync_to from epoch manager. * Fix headers (to pass pre-commit hooks)
…d its proto data. (#6834)
The script migrate_cluster_psp_to_pss.sh has two modes of operation: * check: will check whether there are pods that violate the PSS "baseline" profile. It's useful to see where the security policy can be tightened from the default "privileged" profile. * migrate: will perform the migration on the current K8s context. --policy-version should specify the target policy version, usually the same version as the K8s cluster. The migration works in two phases: 1. Disabling PodSecurityPolicy * create an allow-everything security policy * create a rolebinding that binds each namespace service account to the security policy newly created. this effectively disables the PodSecurityPolicy admission controller 2. Enabling Pod Security Standards * enforce the "privileged" profile on all namespaces * warn & audit violations of the "baseline" profile Example usage: $ ./migrate_cluster_psp_to_pss.sh --policy-version=v1.25 check $ ./migrate_cluster_psp_to_pss.sh --policy-version=v1.25 migrate If unspecified, the default target policy version is "v1.24".
…m_store_db instance across epochs (#6986) ### Description Previously, the quorum_store_db instance was torn down and restarted on epoch changes. We observed this occasionally caused panic when the new instance couldn't start. The DB doesn't have to be torn down and restarted. The only interesting thing here is the DB will be created regardless of whether quorum store is turned on, but that should be negligible overhead. Includes some refactoring to make twins unit tests work. ref: #6855 ### Test Plan Existing tests Co-authored-by: Balaji Arun <[email protected]>
bchocho
added
CICD:run-consensus-only-perf-test
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
❌ Forge suite
|
❌ Forge suite
|
✅ Forge suite
|
✅ Forge suite
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Test Plan