-
Notifications
You must be signed in to change notification settings - Fork 2k
confidential workflows e2e tests #23397
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Changes from all commits
Commits
Show all changes
33 commits
Select commit
Hold shift + click to select a range
7685e84
confidential workflows e2e
vreff 838ddf0
ci fix
vreff 48a9fd7
fix test
vreff bcb8fec
fix tests
vreff 273400b
fix tests
vreff 81d9207
fix tests
vreff a5241c5
update docs
vreff fc007ba
fix tests
vreff d83822a
fix tests
vreff 230ae4b
fix test
vreff e3798b5
consoldiate CI
vreff 95caf43
test updates
vreff ed40599
fix tests
vreff cbe23eb
remove envar overrides
vreff 864469b
remove replace
vreff 2c76b23
update docs
vreff b7f37b4
fix test
vreff 3caa042
lint
vreff 60e5249
fix tests
vreff 0fd5e7e
Update system-tests/tests/smoke/cre/confidential_workflows_test.go
vreff 25f22a3
Skip for lack of envar
vreff 14e257f
Merge branch 'conf-e2e' of https://github.com/smartcontractkit/chainl…
vreff 8360703
move comment
vreff d6ddce0
make function private
vreff 7f312e0
remove helper func
vreff 7e75d30
Merge branch 'develop' into conf-e2e
vreff f4911b6
fix md
vreff 0bcef34
Update system-tests/tests/smoke/cre/confidential_workflows_test_helpe…
vreff d98207f
Merge remote-tracking branch 'origin' into conf-e2e
vreff e1bee28
Update system-tests/lib/cre/registry_update.go
vreff d305f34
fix insecure slice
vreff 4efdb85
Merge branch 'conf-e2e' of https://github.com/smartcontractkit/chainl…
vreff 84c1ec4
lint fixes
vreff File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
154 changes: 154 additions & 0 deletions
154
...pts/cre/environment/configs/workflow-gateway-capabilities-don-confidential-workflows.toml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,154 @@ | ||
| # Topology for the confidential workflows engine E2E test. | ||
| # | ||
| # Differences from workflow-gateway-capabilities-don.toml: | ||
| # - the workflow DON also hosts "confidential-workflows" (the capability that | ||
| # routes execution into the enclaves) and "confidential-relay" (the gateway | ||
| # handler the enclaves call back through) | ||
| # - PerWorkflow.ConfidentialWorkflows is enabled so the engine will honour a | ||
| # workflow registered with {"confidential":true} attributes | ||
| # - the workflow DON exposes remote capabilities and enables the DKG recipient | ||
| # so the pre-enclave secret fetch can reach the vault DON | ||
| # | ||
| # The confidential-workflows capability binary is not part of this repository; it | ||
| # is built from a chainlink-confidential-compute checkout and mounted at | ||
| # ./binaries/confidential-workflows (see .github/workflows/cre-system-tests.yaml). | ||
|
|
||
| # Fake enclaves emit a sentinel attestation document rather than real PCRs, so | ||
| # attestation validation is relaxed. INSECURE; for tests only. | ||
| [capability_configs.confidential-relay] | ||
| [capability_configs.confidential-relay.values] | ||
| trustEnclaves = true | ||
| requireBFTQuorum = true | ||
|
|
||
| # The "enclaves" value is a JSON array of enclaves the capability routes to. | ||
| # Whoever starts the enclaves supplies it, since their addresses are only known | ||
| # once they are running; absent it, the capability registers an empty list. | ||
| [capability_configs.confidential-workflows] | ||
| binary_name = "confidential-workflows" | ||
| [capability_configs.confidential-workflows.values] | ||
| version = "1.0.0-alpha" | ||
|
|
||
| [chip_router] | ||
| image = "local-cre-chip-router:v1.0.1" | ||
|
|
||
| [[blockchains]] | ||
| type = "anvil" | ||
| chain_id = "1337" | ||
| container_name = "anvil-1337" | ||
| docker_cmd_params = ["-b", "0.5", "--mixed-mining"] | ||
|
|
||
| [[blockchains]] | ||
| type = "anvil" | ||
| chain_id = "2337" | ||
| container_name = "anvil-2337" | ||
| port = "8546" | ||
| docker_cmd_params = ["-b", "0.5", "--mixed-mining"] | ||
|
|
||
| [jd] | ||
| csa_encryption_key = "d1093c0060d50a3c89c189b2e485da5a3ce57f3dcb38ab7e2c0d5f0bb2314a44" # any random 32 byte hex string | ||
| image = "job-distributor:0.28.0" | ||
|
|
||
| [fake] | ||
| port = 8171 | ||
|
|
||
| [fake_http] | ||
| port = 8666 | ||
|
|
||
| [infra] | ||
| # either "docker" or "kubernetes" | ||
| type = "docker" | ||
|
|
||
| [[nodesets]] | ||
| nodes = 4 | ||
| name = "workflow" | ||
| don_family = "test-don-family" | ||
| don_types = ["workflow"] | ||
| override_mode = "all" | ||
| http_port_range_start = 10100 | ||
|
|
||
| supported_evm_chains = [1337, 2337] | ||
|
|
||
| env_vars = { CL_EVM_CMD = "", OTEL_SERVICE_NAME = "chainlink-node", CL_CRE_SETTINGS = '{"global":{"VaultOrgIdAsSecretOwnerEnabled":false}}', CL_CRE_SETTINGS_DEFAULT = '{"RemoteExecutableWorkflowDONBindingEnabled":"true","PerWorkflow":{"ConfidentialWorkflows":{"Enabled":"true"}}}' } | ||
| capabilities = ["consensus", "confidential-workflows", "confidential-relay", "cron", "http-action", "http-trigger", "don-time", "evm-1337"] | ||
| exposes_remote_capabilities = true | ||
| registry_based_launch_allowlist = ["cron-trigger@1.0.0"] | ||
|
|
||
| [nodesets.db] | ||
| image = "postgres:12.0" | ||
| port = 13000 | ||
|
|
||
| [[nodesets.node_specs]] | ||
| roles = ["plugin"] | ||
| [nodesets.node_specs.node] | ||
| docker_ctx = "../../../.." | ||
| docker_file = "core/chainlink.Dockerfile" | ||
| docker_build_args = { "CL_IS_PROD_BUILD" = "false" } | ||
| user_config_overrides = """ | ||
| [P2P] | ||
| EnableExperimentalRageP2P = true | ||
|
|
||
| [CRE] | ||
| EnableDKGRecipient = true | ||
|
|
||
| # The test copies the workflow binary and config into the containers, so the | ||
| # syncer reads them from disk rather than fetching them remotely. | ||
| [CRE.WorkflowFetcher] | ||
| URL = "file:///home/chainlink/workflows" | ||
| """ | ||
|
|
||
| [[nodesets]] | ||
| nodes = 4 | ||
| name = "capabilities" | ||
| don_family = "test-don-family" | ||
| don_types = ["capabilities"] | ||
| exposes_remote_capabilities = true | ||
| override_mode = "all" | ||
| http_port_range_start = 10200 | ||
|
|
||
| supported_evm_chains = [1337, 2337] | ||
|
|
||
| env_vars = { CL_EVM_CMD = "", OTEL_SERVICE_NAME = "chainlink-node", CL_CRE_SETTINGS = '{"global":{"VaultOrgIdAsSecretOwnerEnabled":false}}', CL_CRE_SETTINGS_DEFAULT = '{"RemoteExecutableWorkflowDONBindingEnabled":"true"}' } | ||
| capabilities = ["vault", "evm-2337"] | ||
|
|
||
| [nodesets.db] | ||
| image = "postgres:12.0" | ||
| port = 13100 | ||
|
|
||
| [[nodesets.node_specs]] | ||
| roles = ["plugin"] | ||
| [nodesets.node_specs.node] | ||
| docker_ctx = "../../../.." | ||
| docker_file = "core/chainlink.Dockerfile" | ||
| docker_build_args = { "CL_IS_PROD_BUILD" = "false" } | ||
| user_config_overrides = """ | ||
| [P2P] | ||
| EnableExperimentalRageP2P = true | ||
|
|
||
| [CRE] | ||
| EnableDKGRecipient = true | ||
| """ | ||
|
|
||
| [[nodesets]] | ||
| nodes = 1 | ||
| name = "bootstrap-gateway" | ||
| don_family = "test-don-family" | ||
| don_types = ["bootstrap", "gateway"] | ||
| override_mode = "each" | ||
| http_port_range_start = 10300 | ||
|
|
||
| env_vars = { CL_EVM_CMD = "", OTEL_SERVICE_NAME = "chainlink-node", CL_CRE_SETTINGS = '{"global":{"PerOrg":{"BaseTriggerRetransmitEnabled":"true"}}}' } | ||
| supported_evm_chains = [1337, 2337] | ||
|
|
||
| [nodesets.db] | ||
| image = "postgres:12.0" | ||
| port = 13200 | ||
|
|
||
| [[nodesets.node_specs]] | ||
| roles = ["bootstrap", "gateway"] | ||
| [nodesets.node_specs.node] | ||
| docker_ctx = "../../../.." | ||
| docker_file = "core/chainlink.Dockerfile" | ||
| # 5002 is the web API capabilities port for incoming requests | ||
| # 15002 is the vault port for incoming requests | ||
| custom_ports = ["5002:5002","15002:15002"] | ||
| user_config_overrides = "" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Would it be worth making sure that the two revisions never diverge? Could read it from
system-tests/tests/go.modinstead of what is listed as the public plugin.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We want to use the public plugin sha to build the capability binary, because that is what actually gets used in the chainlink node. The revision used in
system-tests/tests/go.modis what consumes the testhelpers/harness, which is a different go module and is used for a different purpose.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do they not have to match?