mirror of
https://github.com/sigp/lighthouse.git
synced 2026-03-16 11:22:56 +00:00
Pass EL JWT secret key via cli flag (#3568)
## Proposed Changes In this change I've added a new beacon_node cli flag `--execution-jwt-secret-key` for passing the JWT secret directly as string. Without this flag, it was non-trivial to pass a secrets file containing a JWT secret key without compromising its contents into some management repo or fiddling around with manual file mounts for cloud-based deployments. When used in combination with environment variables, the secret can be injected into container-based systems like docker & friends quite easily. It's both possible to either specify the file_path to the JWT secret or pass the JWT secret directly. I've modified the docs and attached a test as well. ## Additional Info The logic has been adapted a bit so that either one of `--execution-jwt` or `--execution-jwt-secret-key` must be set when specifying `--execution-endpoint` so that it's still compatible with the semantics before this change and there's at least one secret provided.
This commit is contained in:
@@ -4,7 +4,7 @@ use crate::exec::{CommandLineTestExec, CompletedTest};
|
||||
use eth1::Eth1Endpoint;
|
||||
use lighthouse_network::PeerId;
|
||||
use std::fs::File;
|
||||
use std::io::Write;
|
||||
use std::io::{Read, Write};
|
||||
use std::net::IpAddr;
|
||||
use std::path::PathBuf;
|
||||
use std::process::Command;
|
||||
@@ -386,6 +386,27 @@ fn run_merge_execution_endpoints_flag_test(flag: &str) {
|
||||
});
|
||||
}
|
||||
#[test]
|
||||
fn run_execution_jwt_secret_key_is_persisted() {
|
||||
let jwt_secret_key = "0x3cbc11b0d8fa16f3344eacfd6ff6430b9d30734450e8adcf5400f88d327dcb33";
|
||||
CommandLineTest::new()
|
||||
.flag("execution-endpoint", Some("http://localhost:8551/"))
|
||||
.flag("execution-jwt-secret-key", Some(jwt_secret_key))
|
||||
.run_with_zero_port()
|
||||
.with_config(|config| {
|
||||
let config = config.execution_layer.as_ref().unwrap();
|
||||
assert_eq!(
|
||||
config.execution_endpoints[0].full.to_string(),
|
||||
"http://localhost:8551/"
|
||||
);
|
||||
let mut file_jwt_secret_key = String::new();
|
||||
File::open(config.secret_files[0].clone())
|
||||
.expect("could not open jwt_secret_key file")
|
||||
.read_to_string(&mut file_jwt_secret_key)
|
||||
.expect("could not read from file");
|
||||
assert_eq!(file_jwt_secret_key, jwt_secret_key);
|
||||
});
|
||||
}
|
||||
#[test]
|
||||
fn merge_execution_endpoints_flag() {
|
||||
run_merge_execution_endpoints_flag_test("execution-endpoints")
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user