feat(cardano-node): support custom mithril image overrides (#415)

Adds support for specifying a dedicated image, tag, and pullPolicy for the mithril-snapshot initContainer.

Sets default pullPolicy to Always to ensure mutable tags (like latest-unstable) are always checked on restart.

Note: The built-in mithril-client v0.13.9 in ghcr.io/blinklabs-io/cardano-node:11.0.1-1 has a closed-channel stream race condition bug on GCS (Download: could not write 0 bytes to stream). Suggest using ghcr.io/input-output-hk/mithril-client:latest-unstable (or v2617.0+).

Signed-off-by: Ales Verbic <verbotenj@blinklabs.io>

Author: verbotenj

charts/cardano-node/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v2
 name: cardano-node
 description: Creates a Cardano node deployment with SOCAT sidecar
-version: 0.8.5
-appVersion: 10.5.3
+version: 0.8.6
+appVersion: 11.0.1
 maintainers:
   - name: aurora
     email: aurora@blinklabs.io

charts/cardano-node/templates/statefulset.yaml

@@ -27,19 +27,29 @@ spec:
 {{ toYaml . | indent 8 }}
 {{- end }}
     spec:
+{{- if .Values.mithril.enabled }}
+      securityContext:
+        fsGroup: 1000
+{{- end }}
 {{- if .Values.affinity }}
       affinity: {{ .Values.affinity | toYaml | nindent 8 }}
 {{- end }}
 {{- if .Values.mithril.enabled }}
       initContainers:
       # Download Cardano snapshot using mithril-client
       - name: mithril-snapshot
-        image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
-        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        securityContext:
+          runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 1000
+        image: {{ .Values.mithril.image.repository | default .Values.image.repository }}:{{ .Values.mithril.image.tag | default .Values.image.tag }}
+        imagePullPolicy: {{ .Values.mithril.image.pullPolicy }}
         command: ["/bin/sh", "-c"]
         args:
           - |
             set -e
+            set -o pipefail
+            export PATH=/app/bin:$PATH
             NETWORK="{{ .Values.cardano_network }}"
 
             if [ "$DEBUG_INIT" = "true" ]; then
@@ -50,10 +60,7 @@ spec:
               ls -la /data/db/ || true
             fi
 
-            if ! command -v jq >/dev/null 2>&1; then
-              echo "ERROR: jq is required but not found in the image"
-              exit 1
-            fi
+
             if ! command -v mithril-client >/dev/null 2>&1; then
               echo "ERROR: mithril-client is required but not found in the image"
               exit 1
@@ -88,15 +95,26 @@ spec:
             fi
 
             # Read keys from image config files if they exist, otherwise use values from helm chart
+            # Read keys from image config files if they exist, otherwise use values from helm chart or fall back to known defaults
             if [ -f "/opt/cardano/config/${NETWORK}/genesis.vkey" ] && [ -s "/opt/cardano/config/${NETWORK}/genesis.vkey" ]; then
               GENESIS_VERIFICATION_KEY=$(cat /opt/cardano/config/${NETWORK}/genesis.vkey)
               export GENESIS_VERIFICATION_KEY
             elif [ -n "{{ .Values.mithril.genesisVerificationKey }}" ]; then
               export GENESIS_VERIFICATION_KEY="{{ .Values.mithril.genesisVerificationKey }}"
             else
-              echo "ERROR: Genesis verification key not found in image or values.yaml"
-              echo "Please set mithril.genesisVerificationKey in values.yaml"
-              exit 1
+              echo "Resolving default genesis verification key automatically for ${NETWORK}..."
+              case ${NETWORK} in
+                mainnet)
+                  export GENESIS_VERIFICATION_KEY="5b3139312c36362c3134302c3138352c3133382c31312c3233372c3230372c3235302c3134342c32372c322c3138382c33302c31322c38312c3135352c3230342c31302c3137392c37352c32332c3133382c3139362c3231372c352c31342c32302c35372c37392c33392c3137365d"
+                  ;;
+                preview|preprod)
+                  export GENESIS_VERIFICATION_KEY="5b3132372c37332c3132342c3136312c362c3133372c3133312c3231332c3230372c3131372c3139382c38352c3137362c3139392c3136322c3234312c36382c3132332c3131392c3134352c31332c3233322c3234332c34392c3232392c322c3234392c3230352c3230352c33392c3233352c34345d"
+                  ;;
+                *)
+                  echo "ERROR: Genesis verification key not found and no default for ${NETWORK}"
+                  exit 1
+                  ;;
+              esac
             fi
 
             if [ -f "/opt/cardano/config/${NETWORK}/ancillary.vkey" ] && [ -s "/opt/cardano/config/${NETWORK}/ancillary.vkey" ]; then
@@ -105,7 +123,18 @@ spec:
             elif [ -n "{{ .Values.mithril.ancillaryVerificationKey }}" ]; then
               export ANCILLARY_VERIFICATION_KEY="{{ .Values.mithril.ancillaryVerificationKey }}"
             else
-              echo "No ancillary verification key found (optional - skipping fast bootstrap)"
+              echo "Resolving default ancillary verification key automatically for ${NETWORK}..."
+              case ${NETWORK} in
+                mainnet)
+                  export ANCILLARY_VERIFICATION_KEY="5b32332c37312c39362c3133332c34372c3235332c3232362c3133362c3233352c35372c3136342c3130362c3138362c322c32312c32392c3132302c3136332c38392c3132312c3137372c3133382c3230382c3133382c3231342c39392c35382c32322c302c35382c332c36395d"
+                  ;;
+                preview|preprod)
+                  export ANCILLARY_VERIFICATION_KEY="5b3138392c3139322c3231362c3135302c3131342c3231362c3233372c3231302c34352c31382c32312c3139362c3230382c3234362c3134362c322c3235322c3234332c3235312c3139372c32382c3135372c3230342c3134352c33302c31342c3232382c3136382c3132392c38332c3133362c33365d"
+                  ;;
+                *)
+                  echo "No ancillary verification key default found for ${NETWORK} (optional)"
+                  ;;
+              esac
             fi
 
             export AGGREGATOR_ENDPOINT=https://aggregator.${__path}.api.mithril.network/aggregator
@@ -122,10 +151,18 @@ spec:
               echo "Using configured snapshot digest: ${SNAPSHOT_DIGEST}"
             else
               echo "Fetching latest snapshot digest from ${AGGREGATOR_ENDPOINT}..."
-              SNAPSHOT_DIGEST=$(mithril-client cardano-db snapshot list --json | jq -r '.[0].hash')
+              if ! SNAPSHOT_DIGEST=$(mithril-client cardano-db snapshot list --json | grep -o '"hash":"[^"]*' | head -n 1 | cut -d'"' -f4); then
+                echo "ERROR: Failed to fetch snapshot list from aggregator!"
+                exit 1
+              fi
               echo "Latest snapshot digest: ${SNAPSHOT_DIGEST}"
             fi
 
+            if [ -z "${SNAPSHOT_DIGEST}" ]; then
+              echo "ERROR: Failed to obtain a valid snapshot digest from aggregator!"
+              exit 1
+            fi
+
             mkdir -p /data
             cd /data
             echo "Starting mithril snapshot download..."

charts/cardano-node/values.yaml

@@ -5,7 +5,7 @@ cardano_network: preview
 # extraPodLabels: {}
 image:
   repository: ghcr.io/blinklabs-io/cardano-node
-  tag: 10.5.3
+  tag: 11.0.1-1
   pullPolicy: IfNotPresent
 replicaCount: 1
 resources: {}
@@ -27,9 +27,11 @@ service:
 
 # Mithril snapshot restoration via initContainer
 mithril:
-  # Enable Mithril snapshot download via initContainer (recommended)
-  # Runs mithril-client in initContainer before the main cardano-node container starts
   enabled: true
+  image:
+    repository: "ghcr.io/input-output-hk/mithril-client"
+    tag: "unstable"
+    pullPolicy: "Always"
   # Genesis and ancillary keys - read from image config files by default
   # These are fallbacks if /opt/cardano/config/{network}/*.vkey files don't exist
   genesisVerificationKey: ""  # Optional: fallback if image doesn't have genesis.vkey