Skip to content

Commit 9e6c387

Browse files
piizamapiizama
committed
feat: add zama protocol pause helm chart
1 parent b3f8252 commit 9e6c387

7 files changed

Lines changed: 497 additions & 0 deletions

File tree

‎charts/zama-protocol-pause/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/zama-protocol-pause/Chart.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: v2
2+
name: zama-protocol-pause
3+
description: A Helm chart for Kubernetes
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 0.1.0
19+
20+
# This is the version number of the application being deployed. This version number should be
21+
# incremented each time you make changes to the application. Versions are not expected to
22+
# follow Semantic Versioning. They should reflect the version the application is using.
23+
# It is recommended to use it with quotes.
24+
appVersion: "1.16.0"

‎charts/zama-protocol-pause/README.md‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
# zama-protocol-pause
2+
3+
A Helm chart for deploying a Kubernetes CronJob to pause the Zama Protocol on both Ethereum and Gateway networks in emergency situations.
4+
5+
## Overview
6+
7+
This chart deploys a CronJob that can execute pause transactions on:
8+
- Ethereum ACL Contract (on Ethereum Mainnet/Sepolia Testnet)
9+
- Gateway Config Contract (on Zama Gateway Mainnet/Testnet/Devnet)
10+
11+
The CronJob is configured to be suspended by default and uses an invalid schedule (`0 0 31 2 *`) to prevent automatic execution.
12+
It is designed to be manually triggered only in emergency situations.
13+
14+
## Prerequisites
15+
16+
- Access to RPC endpoints for both Ethereum and Gateway networks
17+
- A wallet with pause permissions configured via AWS KMS or private key
18+
19+
## Installation
20+
21+
TODO: add tfmodule instructions
22+
23+
```bash
24+
helm install zama-protocol-pause ./charts/zama-protocol-pause \
25+
--set network=mainnet \
26+
--namespace zama-protocol
27+
```
28+
29+
## Configuration
30+
31+
### Key Parameters
32+
33+
| Parameter | Description | Default |
34+
|-----------|-------------|---------|
35+
| `network` | Network environment (devnet/testnet/mainnet) | `mainnet` |
36+
| `dryRun` | Enable dry-run mode (no transactions sent) | `false` |
37+
38+
### Wallet Configuration
39+
40+
The chart supports two wallet authentication methods:
41+
42+
#### AWS KMS (Recommended)
43+
44+
```yaml
45+
serviceAccount:
46+
name: "zama-protocol-pause" # Should be bound to an IRSA that can sign txs with the AWS-KMS key
47+
48+
wallet:
49+
awsKMS:
50+
enabled: true
51+
configmap:
52+
name: pauser
53+
key: AWS_KMS_KEY_ID
54+
```
55+
56+
#### Private Key (Fallback)
57+
58+
```yaml
59+
wallet:
60+
awsKMS:
61+
enabled: false
62+
secret:
63+
name: pauser-wallet
64+
key: private-key
65+
```
66+
67+
### Network Configuration
68+
69+
Contract addresses are pre-configured for each network: **Devnet**, **Testnet**: and **Mainnet**.
70+
71+
### RPC Endpoints
72+
73+
RPC URLs must be provided via the environment variables:
74+
75+
```yaml
76+
env:
77+
- name: GATEWAY_RPC_URL
78+
valueFrom:
79+
secretKeyRef:
80+
name: rpcs
81+
key: gateway-rpc-url
82+
- name: ETHEREUM_RPC_URL
83+
valueFrom:
84+
secretKeyRef:
85+
name: rpcs
86+
key: ethereum-rpc-url
87+
```
88+
89+
**Note**: It is highly recommended to use authenticated RPC endpoints instead of public ones for reliability.
90+
91+
## Usage
92+
93+
### Manual Trigger
94+
95+
To manually trigger the pause operation:
96+
97+
```bash
98+
kubectl create job --from=cronjob/zama-protocol-pause zama-pause-$(date +%s) -n zama-protocol
99+
```
100+
101+
### Dry Run
102+
103+
To test without sending transactions, install with `--set dryRun=true`.
104+
Then trigger the job manually.
105+
106+
## Security Considerations
107+
108+
- The CronJob is suspended by default to prevent accidental execution
109+
- Uses an invalid cron schedule as an additional safeguard
110+
- Supports AWS KMS for secure key management
111+
- Requires specific pause permissions on the PauserSet contracts of Host and Gateway networks.
112+
- Set `backoffLimit: 0` to prevent automatic retries on failure
113+
114+
## Values
115+
116+
See [values.yaml](values.yaml) for the complete list of configurable parameters.

‎charts/zama-protocol-pause/templates/_helpers.tpl‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "zama-protocol-pause.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "zama-protocol-pause.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "zama-protocol-pause.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
zama-protocol-pause labels
35+
*/}}
36+
{{- define "zama-protocol-pause.labels" -}}
37+
helm.sh/chart: {{ include "zama-protocol-pause.chart" . }}
38+
{{ include "zama-protocol-pause.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "zama-protocol-pause.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "zama-protocol-pause.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "zama-protocol-pause.serviceAccountName" -}}
57+
{{- if .Values.serviceAccount.create }}
58+
{{- default (include "zama-protocol-pause.fullname" .) .Values.serviceAccount.name }}
59+
{{- else }}
60+
{{- default "default" .Values.serviceAccount.name }}
61+
{{- end }}
62+
{{- end }}
63+
64+
{{- define "zama-protocol-pause.namespace" -}}
65+
{{- if .Values.namespace }}
66+
{{- .Values.namespace }}
67+
{{- else }}
68+
{{- .Release.Namespace }}
69+
{{- end }}
70+
{{- end }}

‎charts/zama-protocol-pause/templates/cronjob.yaml‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
{{- if .Values.cronjob.enabled }}
2+
apiVersion: batch/v1
3+
kind: CronJob
4+
metadata:
5+
name: {{ include "zama-protocol-pause.fullname" . }}
6+
namespace: {{ include "zama-protocol-pause.namespace" . }}
7+
labels:
8+
{{- include "zama-protocol-pause.labels" . | nindent 4 }}
9+
{{- with .Values.cronjob.annotations }}
10+
annotations:
11+
{{- toYaml . | nindent 4 }}
12+
{{- end }}
13+
spec:
14+
schedule: {{ .Values.cronjob.schedule | quote }}
15+
{{- with .Values.cronjob.concurrencyPolicy }}
16+
concurrencyPolicy: {{ . }}
17+
{{- end }}
18+
{{- with .Values.cronjob.failedJobsHistoryLimit }}
19+
failedJobsHistoryLimit: {{ . }}
20+
{{- end }}
21+
{{- with .Values.cronjob.successfulJobsHistoryLimit }}
22+
successfulJobsHistoryLimit: {{ . }}
23+
{{- end }}
24+
{{- with .Values.cronjob.startingDeadlineSeconds }}
25+
startingDeadlineSeconds: {{ . }}
26+
{{- end }}
27+
{{- with .Values.cronjob.suspend }}
28+
suspend: {{ . }}
29+
{{- end }}
30+
jobTemplate:
31+
spec:
32+
{{- with .Values.cronjob.ttlSecondsAfterFinished }}
33+
ttlSecondsAfterFinished: {{ . }}
34+
{{- end }}
35+
{{- with .Values.cronjob.backoffLimit }}
36+
backoffLimit: {{ . }}
37+
{{- end }}
38+
{{- with .Values.cronjob.activeDeadlineSeconds }}
39+
activeDeadlineSeconds: {{ . }}
40+
{{- end }}
41+
template:
42+
metadata:
43+
{{- with .Values.podAnnotations }}
44+
annotations:
45+
{{- toYaml . | nindent 12 }}
46+
{{- end }}
47+
labels:
48+
{{- include "zama-protocol-pause.selectorLabels" . | nindent 12 }}
49+
{{- with .Values.podLabels }}
50+
{{- toYaml . | nindent 12 }}
51+
{{- end }}
52+
spec:
53+
{{- with .Values.imagePullSecrets }}
54+
imagePullSecrets:
55+
{{- toYaml . | nindent 12 }}
56+
{{- end }}
57+
{{- if .Values.serviceAccount.create }}
58+
serviceAccountName: {{ include "zama-protocol-pause.serviceAccountName" . }}
59+
{{- end }}
60+
{{- with .Values.podSecurityContext }}
61+
securityContext:
62+
{{- toYaml . | nindent 12 }}
63+
{{- end }}
64+
restartPolicy: {{ .Values.cronjob.restartPolicy | default "Never" }}
65+
containers:
66+
- name: {{ .Chart.Name }}
67+
{{- with .Values.securityContext }}
68+
securityContext:
69+
{{- toYaml . | nindent 16 }}
70+
{{- end }}
71+
image: "{{ .Values.image.repository | default .Values.image.repository }}:{{ .Values.image.tag | default .Values.image.tag | default .Chart.AppVersion }}"
72+
imagePullPolicy: {{ .Values.image.pullPolicy | default .Values.image.pullPolicy }}
73+
command:
74+
- /bin/sh
75+
- -c
76+
args:
77+
{{- if .Values.wallet.awsKMS.enabled }}
78+
- PAUSER_ADDRESS=$(cast wallet address --aws ${WALLET_PRIVATE_KEY})
79+
{{- else }}
80+
- PAUSER_ADDRESS=$(cast wallet address --private-key ${WALLET_PRIVATE_KEY})
81+
{{- end }}
82+
- echo "Pauser job is configured for address:${PAUSER_ADDRESS}"
83+
{{- if .Values.dryRun }}
84+
- echo "Running in dry-run mode, no transactions will be sent."
85+
{{- else }}
86+
- echo "Pause Zama Protocol on Ethereum (Host) {{ .Values.network | title }}"
87+
- cast send {{ if .Values.wallet.awsKMS.enabled }}--aws{{ else }}--private-key ${WALLET_PRIVATE_KEY}{{ end }} ${ETHEREUM_ACL_CONTRACT_ADDRESS} ${ETHEREUM_ACL_CONTRACT_PAUSE_METHOD_ID} --rpc-url ${ETHEREUM_RPC_URL}
88+
- echo "Pause Zama Protocol on Gateway {{ .Values.network | title }}"
89+
- cast send {{ if .Values.wallet.awsKMS.enabled }}--aws{{ else }}--private-key ${WALLET_PRIVATE_KEY}{{ end }} ${GATEWAY_CONFIG_CONTRACT_ADDRESS} ${GATEWAY_CONFIG_CONTRACT_PAUSE_METHOD_ID} --rpc-url ${ETHEREUM_RPC_URL}
90+
{{- end }}
91+
env:
92+
{{- if .Values.wallet.awsKMS.enabled }}
93+
- name: AWS_KMS_KEY_ID
94+
valueFrom:
95+
configMapKeyRef:
96+
name: {{ .Values.wallet.awsKMS.configmap.name }}
97+
key: {{ .Values.wallet.awsKMS.configmap.key }}
98+
{{- else }}
99+
- name: WALLET_PRIVATE_KEY
100+
valueFrom:
101+
secretKeyRef:
102+
name: {{ .Values.wallet.secret.name }}
103+
key: {{ .Values.wallet.secret.key }}
104+
{{- end }}
105+
{{- with index .Values.config .Values.network }}
106+
- name: ETHEREUM_ACL_CONTRACT_ADDRESS
107+
value: {{ .ethereumAclContractAddress }}
108+
- name: GATEWAY_CONFIG_CONTRACT_ADDRESS
109+
value: {{ .gatewayConfigContractAddress }}
110+
{{- end }}
111+
- name: ETHEREUM_ACL_CONTRACT_PAUSE_METHOD_ID
112+
value: {{ .Values.config.pauseMethodIds.ethereumAclContract }}
113+
- name: GATEWAY_CONFIG_CONTRACT_PAUSE_METHOD_ID
114+
value: {{ .Values.config.pauseMethodIds.gatewayConfigContract }}
115+
{{- with .Values.env }}
116+
{{- toYaml . | nindent 16 }}
117+
{{- end }}
118+
{{- with .Values.cronjob.envFrom }}
119+
envFrom:
120+
{{- toYaml . | nindent 16 }}
121+
{{- end }}
122+
{{- if .Values.cronjob.resources }}
123+
resources:
124+
{{- toYaml .Values.cronjob.resources | nindent 16 }}
125+
{{- else }}
126+
{{- with .Values.resources }}
127+
resources:
128+
{{- toYaml . | nindent 16 }}
129+
{{- end }}
130+
{{- end }}
131+
{{- with .Values.volumeMounts }}
132+
volumeMounts:
133+
{{- toYaml . | nindent 16 }}
134+
{{- end }}
135+
{{- with .Values.volumes }}
136+
volumes:
137+
{{- toYaml . | nindent 12 }}
138+
{{- end }}
139+
{{- with .Values.nodeSelector }}
140+
nodeSelector:
141+
{{- toYaml . | nindent 12 }}
142+
{{- end }}
143+
{{- with .Values.affinity }}
144+
affinity:
145+
{{- toYaml . | nindent 12 }}
146+
{{- end }}
147+
{{- with .Values.tolerations }}
148+
tolerations:
149+
{{- toYaml . | nindent 12 }}
150+
{{- end }}
151+
{{- end }}

0 commit comments

Comments
 (0)