values.yaml

# Images not part of the tezos-k8s repo go here
images:
  octez: tezos/tezos:v17.3
  tacoinfraRemoteSigner: ghcr.io/oxheadalpha/tacoinfra-remote-signer:0.1.0
# Images that are part of the tezos-k8s repo go here with 'dev' tag
tezos_k8s_images:
  utils: ghcr.io/oxheadalpha/tezos-k8s-utils:master

## Properties that are templated for some k8s resources. There are container
## scripts that will look up some of these values. They should not be modified.
tzkt_indexer_statefulset:
  name: tzkt-indexer
bcd_indexer_statefulset:
  name: bcd-indexer
octez_signer_statefulset:
  name: octez-signer
  pod_type: signing
chain_initiator_job:
  name: chain-initiator
  pod_type: activating
smart_rollup_node_statefulset:
  name: smart-rollup
  pod_type: rollup

# For non-public chains the default mutez given to an account if the
# account is not explicitly set below.
bootstrap_mutez: "4000000000000"

# # Accounts
#
# The `accounts` object of values.yaml defines Tezos accounts used in the chart.
# By default no account is configured:
accounts: {}
#
# `accounts` is a map where keys are account aliases and values are maps of
# fields `key`, `is_bootstrap_baker_account`, `bootstrap_balance`, `signer_url`
# `protocols` and `operations_pool`.
#
# The `key` field can be set to a public or private key. For a bootstrap baker,
# it must be set to a private key. The key type will be recognized automatically,
# and the pod will fail if the key type is unexpected.
#
# The `protocols` fields overrides the top-level `protocols` field described
# below and has the same syntax. This allows to set specific per-block votes per
# baker.
#
# The `operations_pool` field instructs the baker to target a url for external
# mempool queries when baking a block. This is useful to run a Flashbake-capable baker.
# The entry is passed to baker binaries using the `--operations-pool` flag.
#
# The `dal_node` field instructs the baker to target a url for a DAL node.
#
# - Public chains: Accounts do not get `is_bootstrap_baker_account` and
# `bootstrap_balance` fields.
# - Non-public chains: If you don't specify accounts needed by nodes, they can
#   be created deterministically via the above setting. If specifying, accounts
#   can be given a bootstrap balance and can also be configured to be bootstrap
#   baker accounts. Accounts with balances set to "0" will be imported by the
#   node but they will not be bootstrap accounts. If you don't set a bootstrap
#   balance, it will default to the `bootstrap_mutez` field above.
#
# Example:
#
# ```
# accounts:
#   baker0:
#     key: edsk...
#     is_bootstrap_baker_account: true
#     bootstrap_balance: "50000000000000"
#
#   baker1:
#     key: edsk...
#     operations_pool: http://flashbake-endpoint-baker-listener:12732
#     dal_node: http://dal_node:10732
#     protocols:
#     - command: PtMumbai
#       vote:
#         liquidity_baking_toggle_vote: "on"
# ```
# A public key account can contain a `signer_url` to a remote signer
# that signs with the corresponding secret key. You don't need to
# set this if you're deploying a tezos-k8s signer into the same
# namespace of its baker. See `octezSigners` and `tacoinfraSigners`
# fields in values.yaml to define remote signers. (You shouldn't add things
# to the URL path such as the public key hash. It will be added automatically.)
# ```
# accounts:
#   externalSignerAccount:
#     key: edpk...
#     is_bootstrap_baker_account: true
#     bootstrap_balance: "4000000000000"
#     signer_url: http://[POD-NAME].[SERVICE-NAME].[NAMESPACE]:6732
# ```
#
#  An account being signed for by a Tacoinfra AWS KMS signer requires a
# `key_id` field. This should be a valid id of the AWS KMS key.
#  The key's corresponding public key must be provided here as well.
# ```
# accounts:
#   tacoinfraSigner:
#     key: sppk...
#     key_id: "cloud-id-of-key"
#     is_bootstrap_baker_account: true
#     bootstrap_balance: "4000000000000"
# ```
#
# # End Accounts

# # Nodes
#
# Use `nodes` to configure the Tezos nodes running in your chart.
#
# `nodes` is a dictionary where each key/value pair defines a statefulset and a
# number of instances thereof. The name (key) defines the name of the
# statefulset and will be the base of the pod names. The instances are defined
# as a list because their names are simply -N appended to the statefulsetname.
# Said names are typically kebab case.
#
# Params at the statefulset level:
# - `config`: The "config" property should mimic the structure of a node's
#             config.json. Run `octez-node config --help` for more info.
#             If present at the statefulset level, it overrides it in
#             `node_globals`.
# - `env`: A dictionary of containers mapped to a dictionary of env
#          vars.  The container name "all" will apply the env vars to
#          all containers.  The most specific wins.  Find the names of
#          the containers by examining an installed environment, or by
#          looking at charts/tezos/templates/nodes.yaml.  Please note
#          that we truncate the protocol from the container name for
#          bakers and accusers, so "baker-011-pthangz2" is configured
#          using just "baker".
# - `storage_size`: The size of the PV.
# - `resources`: Resources specifications for the node.
#                Optionally set resources and limits for octez node
#                See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
# - `images`: Optional specification of images to use for the tezos node and
#           baker. Options are "octez" with a tezos/tezos image.
#           If no images are provided, the containers will default to the images
#           defined in the "images" field up above.
# - `runs`: A list of containers to run.
#         Options being `octez_node`, `accuser`, `baker`, `logger` and `vdf`.
# - `local_storage`: Use local storage instead of a volume. The storage will be
#                  wiped when the node restarts for any reason. Useful when
#                  faster IO is desired. Defaults to false.
# - `local_storage_pv_size`: The size of the persistent volume to store `identity.json`
#                            and `peers.json` when `local_storage` is enabled. Some cloud
#                            providers have minimum pv size requirements for which this
#                            value can be used. Default value is 1Gi.
# - `labels`: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
#      NOTE: the labels `appType`, `node_class`, and `baking_node` are set
#      automatically for you.
# - `node_selector`: Specify a kubernetes node selector in `key: value` format
#     for your tezos nodes.
# - `readiness_probe`: Attach a probe to the node. The probe checks whether
#                    the most recent block is recent enough. If not, the
#                    services will be unreachable. Defaults to True.
#                    True is good for RPC nodes, private nodes, and
#                    self-contained private chains.
#                    Recommended to set to False when bootstrapping a new
#                    chain with external bakers, such as a new test chain.
#                    Otherwise, the chain may become unreachable externally
#                    while waiting for other nodes to come online.
# - `instances`: A list of nodes to fire up, each is a dictionary defining:
#    - `bake_using_accounts`: List of account names that should be used for baking.
#    - `authorized_keys`: List of account names that should be used as keys to
#                         authenticate a baker to a signer.
#                         When a baker uses a remote signer that requires
#                         authentication, the relevant key from this list
#                         will be used to sign every signature request.
#    - `config`: Same as the outer statefulset level `config`. It overrides the
#                statefulset level.
#    - `is_bootstrap_node`: Boolean for is this node a bootstrap peer.
#    - `identity`: An optional map containing a pre-generated Tezos node
#                 identity. The identity file will be created at
#                 /var/tezos/node/data/identity.json.
#                 Required fields are `peer_id`, `public_key`, `secret_key`,
#                 and `proof_of_work_timestamp`.
#
# Defaults are filled in for most of the above values.  You can also provide
# global defaults for all nodes via a `node_globals` section which is also
# a dictionary.  Currently, two keys are defined: `config` and `env`.  These
# operate in the same way as the section in `nodes` going by the same name.
#
# Example config:
#
# ```
# node_globals:
#   config:
#     shell:
#       history_mode: full
#   env:
#     baker:
#       TEZOS_LOG: "* -> debug"
# nodes:
#   rolling-baking-node:
#     config:
#       shell:
#         history_mode: rolling
#     env:
#       all:
#         TEZOS_CLIENT_UNSAFE_DISABLE_DISCLAIMER: "Y"
#       snapshot-downloader:
#         HTTP_PROXY: http://my-proxy.my-company.com:3128/
#     labels:
#       # Example labels you might use to specify certain attributes of your nodes.
#       peer_node: "true" # Forward P2P traffic to this node types instances
#       rpc_node: "true" # Forward RPC traffic to this node types instances
#     node_selector:
#       nodeSelectorKey: nodeSelectorValue
#     storage_size: 15Gi
#     images: # (optional field)
#       octez: tezos/tezos:v...
#     local_storage: false
#     runs:
#       - octez_node
#       - baker
#     resources:
#       requests:
#         memory: 16192Mi
#       limits:
#         memory: 16192Mi
#     instances:
#       - bake_using_accounts: [baker0]
#         is_bootstrap_node: true
#         # Note the following config section overrides the above one even
#         # if we make them the same in this example.
#         config:
#           shell:
#             history_mode: rolling
#         identity:
#            peer_id: id...
#            public_key: ...
#            secret_key: ...
#            proof_of_work_stamp: ...
#   rolling-node:
#     labels:
#       # Example labels you might use to specify certain attributes of your nodes.
#       peer_node: "true"
#       rpc_node: "true"
#     images: # (optional field)
#       octez: tezos/tezos:v...
#     runs: ["octez_node"]
#     instances:
#       - {}
#       - {}
# ```
# The default configuration is:
node_globals:
  config: {}
  env: {}
nodes:
  rolling-node:
    storage_size: 100Gi
    runs:
      - octez_node
    instances:
      - is_bootstrap_node: false
        config:
          shell:
            history_mode: rolling
          metrics_addr: ["0.0.0.0:9932"]
# End nodes

## Configuration for K8s Service resources. Configuring the labels selector of a
## service will result in the service forwarding traffic only to pods that have
## matching labels.
services:
  ## Configure the labels selector of the Tezos node RPC service. Traffic will
  ## be forwarded to all nodes if no labels are specified.
  tezos_node_rpc:
    selector:
#      rpc_node: "true"

## Configuration for the tezos-node-rpc ingress
ingress:
  enabled: false
  host: ""
  annotations: {}
  className: ""
  labels: {}
  pathType: Prefix
  tls: []

# Prometheus Operator is required in your cluster in order to enable
# serviceMonitor below.
# ServiceMonitor allows you to scrape the prometheus endpoints of your tezos nodes.
# Make sure the endpoints are active by adding:
#     metrics_addr: [ ":9932" ]
# to your config.
serviceMonitor:
  enabled: false
  labels:
    # release: my-monitoring-release

# # Signers
#
# Define remote signers. Bakers automatically use signers in their namespace
# that are configured to sign for the accounts they are baking for.
# By default no signer is configured.
#
# https://tezos.gitlab.io/user/key-management.html#signer
octezSigners: {}
# Example:
# ```
# octezSigners:
#  tezos-signer-0:
#    accounts:
#     - baker0
#    authorized_keys:
#     # Names of accounts used to authenticate the baker to the signer.
#     # The baker must have the private key for one of the listed
#     # accounts. The signer will only sign a request from a baker
#     # authenticated by an allowed key.
#     - authorized-key-0
# ```
#
# Deploys a signer using AWS KMS to sign operations.
# The `AWS_REGION` env var must be set.
# https://github.com/oxheadalpha/tacoinfra-remote-signer
tacoinfraSigners: {}
# Example:
# ```
# tacoinfraSigners
#   tacoinfra-signer:
#     accounts:
#       - tacoinfraSigner
#     env:
#       AWS_REGION: us-east-2
#     serviceAccount:
#       create: true
#       ## EKS example for setting the role-arn
#       annotations:
#         eks.amazonaws.com/role-arn: <SIGNER_ROLE_ARN>
# ```
# End Signers

# # Rollup nodes
# Define Smart Rollup nodes. An operator account and rollup address
# must be provided.
# In private chains, you can create a rollup with the same address during
# activation.
# Optionally define an ingress for your rollup to be accessible from outside
# the cluster.
# If your rollup is an EVM rollup, you can also define an EVM proxy object,
# which can in turn have an ingress.
#
smartRollupNodes: {}
# Example:
# ```
# smartRollupNodes:
#   rollup-node-0:
#     operator_account: archive-baking-node-0
#     rollup_address: sr1RYurGZtN8KNSpkMcCt9CgWeUaNkzsAfXf
#     annotations: {}
#     ingress:
#       enabled: false
#       host: ""
#       annotations: {}
#       className: ""
#       labels: {}
#       pathType: Prefix
#       tls: []
#     evm_proxy:
#       annotations: {}
#       ingress:
#         enabled: false
#         host: ""
#         annotations: {}
#         className: ""
#         labels: {}
#         pathType: Prefix
#         tls: []
# ```

# End Rollup Nodes

# DAL Nodes
dalNodes: {}
# Deploys DAL nodes in pods and maps them to L1 nodes.
# Example:
#  bootstrap:
#    bootstrapProfile: true
#    ingress:
#       enabled: false
#       host: ""
#       annotations: {}
#       className: ""
#       labels: {}
#       pathType: Prefix
#       tls: []
#    identity:
#       # fill here the identity of the node, if you want it to persist
#       peer_id:
#       public_key:
#       secret_key:
#       proof_of_work_stamp:
#  dal1:
#    storageSize: 50Gi
#    attesterProfiles: tz1foXHgRzdYdaLgX6XhpZGxbBv42LZ6ubvE

# When spinning up nodes, tezos-k8s will attempt to download a snapshot from a
# known source. This should be a url to a json metadata file in the format
# xtz-shots uses. If you want to sync from scratch or for a private chain, set
# to `null`.
snapshot_source: https://xtz-shots.io/tezos-snapshots.json

# By default, tezos-k8s will download and unpack snapshots.
# A tarball is a LZ4-compressed filesystem tar of a node's data directory.
# You must trust the tarball provider to provide good data, as no check is
# performed by the node.
# If you prefer tarballs, set to "true" below.
prefer_tarballs: false

# In case the network name in the snapshot metadata does not correspond to the
# network_name configured in `node_config_network`, hardcode the value here.
# snapshot_metadata_network_name: "weeklynet"

# By default, tezos-k8s will attempt to download the right artifact from
# `snapshot_source` set above. You can override and hard-code a snapshot URL
# source below. When any of the below variables are set, `snapshot_source` above
# will be ignored for all artifact types.
## NOTE: `*_tarball_url` and `*_snapshot_url` are mutually exclusive
## and cannot both be specified at the same time.
archive_tarball_url: null # e.g. https://mainnet.xtz-shots.io/archive-tarball
full_snapshot_url: null
full_tarball_url: null
rolling_snapshot_url: null
rolling_tarball_url: null

# List of peers for nodes to connect to. Gets set under config.json `p2p` field
bootstrap_peers: []

# Identity generation difficulty.
expected_proof_of_work: 26

## Create a custom network using a config structure that is similar to a node's
## config.json. Run `octez-node config --help` for more info.
## Note that the genesis block hash will be deterministically generated from
## the chain name if omitted.
##
# node_config_network:
#   chain_name: YOUR_CHAIN_NAME_HERE
#   genesis:
#     timestamp: "2021-03-04T20:00:00Z"
#     block: YOUR_GENESIS_BLOCK_HASH_HERE
#     protocol: Ps9mPmXaRzmzk35gbAYNCAw6UXdE2qoABTHbN2oEEc1qM7CwT9P
#   # The name of the account who's public key will be set downstream in
#   # config.json at `network.genesis_parameters.values.genesis_pubkey`.
#   activation_account_name: baker0
#
## To join a public network you may set `chain_name` in one of two ways:
## - Specify the name of the network which must be recognized by the
##   octez-node binary of the Octez image being used.
## - Pass a url that returns the config.json of the network. Example:
##   "https://teztnets.xyz/weeklynet". It is helpful for running
##   testnets and shouldn't be needed in general.
node_config_network:
  chain_name: mainnet
  ## When joining a public network, a tezos node will by default
  ## connect to the boot-nodes of the selected chain. This may not
  ## always be desired. For example, you may want to run a mainnet
  ## replica in isolation with yes-nodes. Uncomment the line below to
  ## stop the node from connecting to the chain's default boot-nodes.
  ## You can still specify boot-nodes with the `bootstrap_peers` field.
  # join_public_network: false

protocols:
  ## Tezos builds baker binaries for every supported protocol.
  ## List here the protocols that you wish to run bakers for.
  ## These binaries must be present in the docker image specified.
  ## You may want to run two or more if you are expecting an on-chain upgrade.
  ## Be mindful that running more protocols will start more containers in your
  ## pods which may consume more memory.
  ## Syntax:
  ## * command: the suffix of the tezos-baker binary
  ## * vote: a map of per-block votes. These are protocol specific.
  ##   "on" and "off" must be between quotes.
  ## Note that we are not providing default votes since every baker needs
  ## to make an explicit educated choice on every toggle.
  - command: PtNairob
    vote: {}
  # - command: alpha
  #   vote:
  #     liquidity_baking_toggle_vote: "pass"

## Activate a new chain from genesis. Uncommenting this will create an
## activation job. The activation job will activate the chain if the
## level is at zero, and do nothing otherwise, so this section can remain
## after chain activation.
##
# activation:
#  protocol_hash: PtNairobiyssHuh87hEhfVBGCVrK3WnS8Z2FT4ymB5tAa4r1nQf
#  protocol_parameters:
#    preserved_cycles: 3
#    blocks_per_cycle: 8
#    blocks_per_commitment: 4
#    blocks_per_stake_snapshot: 4
#    cycles_per_voting_period: 1
#    hard_gas_limit_per_operation: '1040000'
#    hard_gas_limit_per_block: '5200000'
#    proof_of_work_threshold: '-1'
#    minimal_stake: '6000000000'
#    seed_nonce_revelation_tip: '125000'
#    baking_reward_fixed_portion: '10000000'
#    baking_reward_bonus_per_slot: '4286'
#    endorsing_reward_per_slot: '2857'
#    hard_storage_limit_per_operation: '60000'
#    origination_size: 257
#    cost_per_byte: '250'
#    quorum_max: 7000
#    quorum_min: 2000
#    min_proposal_quorum: 500
#    liquidity_baking_subsidy: '2500000'
#    liquidity_baking_toggle_ema_threshold: 100000
#    max_operations_time_to_live: 120
#    minimal_block_delay: "5"
#    delay_increment_per_round: "5"
#    consensus_committee_size: 7000
#    consensus_threshold: 4667
#    minimal_participation_ratio:
#      numerator: 2
#      denominator: 3
#    max_slashing_period: 2
#    frozen_deposits_percentage: 10
#    double_baking_punishment: "640000000"
#    ratio_of_frozen_deposits_slashed_per_double_endorsement:
#      numerator: 1
#      denominator: 2
#    cache_script_size: 100000000
#    cache_stake_distribution_cycles: 8
#    cache_sampler_state_cycles: 8
#    nonce_revelation_threshold: 4
#    vdf_difficulty: '100000'
#    tx_rollup_enable: false
#    tx_rollup_origination_size: 4000
#    tx_rollup_hard_size_limit_per_inbox: 500000
#    tx_rollup_hard_size_limit_per_message: 5000
#    tx_rollup_commitment_bond: "10000000000"
#    tx_rollup_finality_period: 10
#    tx_rollup_max_inboxes_count: 15
#    tx_rollup_withdraw_period: 10
#    tx_rollup_max_messages_per_inbox: 1010
#    tx_rollup_max_commitments_count: 30
#    tx_rollup_cost_per_byte_ema_factor: 120
#    tx_rollup_max_withdrawals_per_batch: 15
#    tx_rollup_max_ticket_payload_size: 2048
#    tx_rollup_rejection_max_proof_size: 30000
#    tx_rollup_sunset_level: 10000000
#    dal_parametric:
#      feature_enable: true
#      number_of_slots: 256
#      number_of_shards: 2048
#      attestation_lag: 2
#      attestation_threshold: 50
#      slot_size: 1048576
#      redundancy_factor: 16
#      page_size: 4096
#      blocks_per_epoch: 8
#    smart_rollup_enable: true
#    smart_rollup_origination_size: 6314
#    smart_rollup_challenge_window_in_blocks: 40
#    smart_rollup_stake_amount: "32000000"
#    smart_rollup_commitment_period_in_blocks: 20
#    smart_rollup_max_lookahead_in_blocks: 30000
#    smart_rollup_max_active_outbox_levels: 20160
#    smart_rollup_max_outbox_messages_per_level: 100
#    smart_rollup_number_of_sections_in_dissection: 32
#    smart_rollup_timeout_period_in_blocks: 500
#    smart_rollup_max_number_of_cemented_commitments: 5
#    smart_rollup_max_number_of_parallel_games: 32
#    smart_rollup_arith_pvm_enable: true
#    zk_rollup_enable: true
#    zk_rollup_origination_size: 4000
#    zk_rollup_min_pending_to_process: 10
#
#   # Pass url pointing to additional contracts that you want injected at activation.
#   # This data is typically too large to pass it directly inside helm chart.
#   bootstrap_contract_urls: []
#
#   # Pass additional structured data to add to parameters.json
#   # This can be used to deploy smart rollup at bootstrap.
#   bootstrap_parameters:
#     bootstrap_smart_rollups:
#       address: "sr1RYurGZtN8KNSpkMcCt9CgWeUaNkzsAfXf"
#       pvm_kind: "arith"
#       kernel: ""
#       parameters_ty:
#         prim: unit
#
## Deploy an indexer with the chain. An indexer puts the chain
## contents in a database for efficient indexing. Most dapps need it.
## Supported indexers:
## * tzkt: https://github.com/baking-bad/tzkt
## * bcd: https://github.com/baking-bad/bcdhub
## Templatized indexer configuration values go in the config field.
##
# indexers:
#   tzkt:
#     images:
#       api: "bakingbad/tzkt-api:1.12.0"
#       indexer: "bakingbad/tzkt-sync:1.12.0"
#       postgres: "postgres:13"
#
#     ## Database volumeClaimTemplates config
#     storageClassName: ""
#     storage: "100Gi"
#     ## Statefulset annotations
#     # annotations:
#
#     ## Indexer replicas
#     replicas: 1
#
#     db:
#       # By default creates a postgres db container. Setting to true won't create
#       # it and instead expects credentials for an external postgres database.
#       isExternal: false
#       ## Tzkt provides new snapshots as they update their code. Update your
#       ## indexers by specifying new docker image tags and by using the matching
#       ## snapshot_url. Spin up an additional replica if you only have one to
#       ## avoid downtime. See tzkt's readme for public networks' db snapshot urls.
#       ## If you want to index a brand new archive node you are spinning up, just
#       ## let the indexer start syncing with it from scratch.
#       ## https://github.com/baking-bad/tzkt
#       snapshot_url: https://snapshots.tzkt.io/tzkt_v1.12_mainnet.backup
#       host: localhost
#       port: 5432
#       name: db
#       user: foo
#       password: bar
#       command_timeout: 600
#
#     ## Configurable tzkt fields
#     config:
#       ## RPC url of the node to index. A rolling node is sufficient if the
#       ## indexer is bootstrapped from the most recent snapshot. Otherwise an
#       ## archive node is needed.
#       rpc_url: http://rolling-node-0.rolling-node:8732
#       # api_log_level: Debug
#       # indexer_log_level: Debug

## Set values `indexerRpcUrl` and `db.password` for an indexer to be created.
bcdIndexer:
  images:
    api: ghcr.io/baking-bad/bcdhub-api:4.4.0
    indexer: ghcr.io/baking-bad/bcdhub-indexer:4.4.0
    gui: ghcr.io/baking-bad/bcdhub-gui:4.4.0
    postgres: postgres:14

  # Url of the RPC backend for the indexer to index
  rpcUrl: "" # http://archive-baking-node-0.archive-baking-node:8732
  # When creating an ingress, this will be the BCD api's hostname/FQDN (stripped
  # of http(s)). When deploying the BCD gui, this will also be the api's full
  # url called by the frontend.
  apiUrl: "" # http://localhost:14000

  gui:
    enabled: false
    # Url of the RPC backend for the frontend to query
    rpcUrl: http://localhost:8732

  ingress:
    enabled: false
    # Hostname for BCD frontend. The ingress rule will only be created when this
    # is set and gui is enabled.
    guiHostname: ""
    annotations: {}
    className: ""
    labels: {}
    pathType: Prefix
    tls: []

  db:
    # By default creates a postgres db container. Setting to true won't create
    # it and instead expects credentials for an external postgres database.
    isExternal: false
    hostname: localhost
    name: bcd
    password: bcd-password
    user: bcd

  # For the pv for the optional postgres container
  storageClassName: ""
  storage: "300Gi"

  imagePullSecrets: {}
  podAnnotations: {}
  podSecurityContext: {}
  affinity: {}
  nodeSelector: {}
  tolerations: {}