YNU-858: prepare clearnode stress environment

clearnode/chart/config/secrets.yaml

@@ -0,0 +1,10 @@
+ghcrPullDockerConfigJson: ENC[AES256_GCM,data:ymxEUjjpVkWv9wT6rX5HkYRLd9F+JQd9bzZCpnb/QUgDKL5sSAOYaPSJ5AhvEB2XiVgcz6L8Njs/w5s9OLIRI68LFu/Fp/gkzKVXRxDrrvr924UDCxoQh5Rd55kq2ClgxjaFk+YCq2YbsS2+6cQK3yBE0L1f8aOgU6H+pD0K1CHMd+x1bYv8ZnqeZOs52/OT3mFhblG6SLadWAVek7hA7CW5SlQ8XgIqpyb4Kavf5qCuNikvglzP/JFJEBGIvI+ha3V4eH4feyAf1DAjYD+NONpq9i6HerWf75BcXN/ljPnWtqV+Xjh3JVX2FFyn+5EVLDsyJkibkWuFHczVb9WaHRD1A8kQwzAiEf1jU9QUcII=,iv:95a54zK998kMBtDlKZrZf2acygFcnkQm/osBI3Urq8A=,tag:RRPNjFGTfHOcwtyDPBZGnA==,type:str]
+sops:
+    gcp_kms:
+        - resource_id: projects/ynet-stage/locations/global/keyRings/sops/cryptoKeys/sops-uat-key
+          created_at: "2026-04-02T12:06:41Z"
+          enc: CiQAMMK76ezqx/QwM9G//M0kOwk3Fz777m7ay6W3kGDw/Vtb8qUSSQC9etkIkNWwThHRkMkNO2j6nxfI/TMWb476eAD15D449G7ZZQhp4JrQlX0PMQijyYU1s2LlfpwqntGV0Fg0vw871Z4J/g4rmZQ=
+    lastmodified: "2026-04-02T12:06:42Z"
+    mac: ENC[AES256_GCM,data:cMtClcwu85XndRef2a4PwqESMWKkQ0YNd0wPE722FqEGFgtzXnloHPftXNYjciDS+vqWubLj79gjcTlCSFurJcoAHiaLkJZ81TdPOxU7t10FlRjwPYSKKCXXJjg/rzJCqkRO0quRhOXznvyPKAuqrJBcTo0iPJtGjDjwZZOfKRI=,iv:CNkK4C/ATnhIGsL4YWnibaW0duls4BBGhYJiNTNBXKQ=,tag:24a7H3MVs4aw4uRmieygsw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2

clearnode/chart/config/stress-v1/assets.yaml

@@ -0,0 +1,47 @@
+assets:
+  - name: "Yellow USD"
+    symbol: "yusd"
+    decimals: 6
+    suggested_blockchain_id: 11155111
+    tokens:
+      - blockchain_id: 11155111
+        address: "0xD3E8Eb01Ae895262f187c4aAe936eC5c0665bbf8"
+        decimals: 6
+      - blockchain_id: 80002
+        address: "0x0827b6aAA03475A8BF59Ee1A2bD76903DDFbaDB6"
+        decimals: 8
+  - name: "BNB"
+    symbol: "bnb"
+    decimals: 18
+    suggested_blockchain_id: 11155111
+    tokens:
+      - blockchain_id: 11155111
+        address: "0x719a00F9e8b831335F156337cEF7dC48986b2e84"
+        decimals: 18
+      - blockchain_id: 80002
+        address: "0x9d8193e5655a36FFB9CD7D88D31c91d2650896D0"
+        decimals: 18
+  - name: "Ether"
+    symbol: "eth"
+    decimals: 18
+    suggested_blockchain_id: 11155111
+    tokens:
+      - blockchain_id: 11155111
+        address: "0x0000000000000000000000000000000000000000"
+        decimals: 18
+  - name: "POL"
+    symbol: "pol"
+    decimals: 18
+    suggested_blockchain_id: 80002
+    tokens:
+      - blockchain_id: 80002
+        address: "0x0000000000000000000000000000000000000000"
+        decimals: 18
+  - name: "Yellow"
+    symbol: "yellow"
+    decimals: 18
+    suggested_blockchain_id: 11155111
+    tokens:
+      - blockchain_id: 11155111
+        address: "0x236eB848C95b231299B4AA9f56c73D6893462720"
+        decimals: 18

clearnode/chart/config/stress-v1/blockchains.yaml

@@ -0,0 +1,12 @@
+blockchains:
+- name: "ethereum_sepolia"
+  id: 11155111
+  channel_hub_address: "0xb7bE0E2007dDF320d680942cb9e008F986E74F83"
+  channel_hub_sig_validators:
+    1: "0x2aC63456d78Cf2E2FDAf45cbed45b5d29907f4ac"
+  locking_contract_address: "0x9B3D4dA5A37857F17648CC4d78Bbae0A681C02c6"
+- name: "polygon_amoy"
+  id: 80002
+  channel_hub_address: "0x55D6f0A0322606447fbc612Cf58014Faed65aF9D"
+  channel_hub_sig_validators:
+    1: "0x87825ACa5f4B9c3dc8B5aa3352724eDF5135D892"

clearnode/chart/config/stress-v1/clearnode.yaml

@@ -0,0 +1,75 @@
+config:
+  args: ["clearnode"]
+  logLevel: info
+  database:
+    driver: postgres
+    host: pgbouncer
+    port: 5432
+    name: clearnode_stress_v1
+    user: clearnode_stress_v1_admin
+  envSecret: clearnode-secret-env
+  extraEnvs: 
+    CLEARNODE_DATABASE_MAX_OPEN_CONNS: "10"
+    CLEARNODE_DATABASE_MAX_IDLE_CONNS: "2"
+    CLEARNODE_DATABASE_CONN_MAX_LIFETIME_SEC: "3600"
+    CLEARNODE_DATABASE_CONN_MAX_IDLE_TIME_SEC: "600"
+    CLEARNODE_SIGNER_TYPE: "gcp-kms"
+    CLEARNODE_GCP_KMS_KEY_NAME: "projects/ynet-stage/locations/europe-central2/keyRings/clearnode-signers-eu/cryptoKeys/stress-v1-a/cryptoKeyVersions/1"
+    CLEARNODE_MAX_PARTICIPANTS: "32"
+    CLEARNODE_MAX_SESSION_DATA_LEN: "1024"
+    CLEARNODE_MAX_SIGNED_UPDATES: "0"
+    CLEARNODE_MAX_SESSION_KEY_IDS: "256"
+
+image:
+  repository: ghcr.io/layer-3/nitrolite/clearnode
+  tag: v1.2.0
+
+service:
+  http:
+    enabled: true
+    port: 7824
+    path: /v1/ws
+
+serviceAccount:
+  create: true
+  annotations:
+    iam.gke.io/gcp-service-account: clearnode-stress-v1-agent@ynet-stage.iam.gserviceaccount.com
+
+metrics:
+  enabled: true
+  podmonitoring:
+    enabled: true
+  port: 4242
+  endpoint: "/metrics"
+
+resources:
+  limits:
+    cpu: 200m
+    memory: 200Mi
+    ephemeral-storage: 256Mi
+  requests:
+    cpu: 200m
+    memory: 200Mi
+    ephemeral-storage: 256Mi
+
+autoscaling:
+  enabled: false
+
+networking:
+  externalHostname: clearnode-stress.yellow.org
+  tlsClusterIssuer: zerossl-prod
+  gateway:
+    enabled: false
+  ingress:
+    enabled: true
+    className: nginx
+    tls:
+      enabled: true
+    annotations:
+      nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+      nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+      nginx.ingress.kubernetes.io/proxy-connect-timeout: "10"
+      nginx.ingress.kubernetes.io/proxy-buffering: "off"
+
+stressTest:
+  enabled: false

clearnode/chart/config/stress-v1/secrets.yaml

@@ -0,0 +1,15 @@
+config:
+    secretEnvs:
+        CLEARNODE_BLOCKCHAIN_RPC_ETHEREUM_SEPOLIA: ENC[AES256_GCM,data:Qis/vy8w8KE/ap3xU1+gd2GqeGYRsQQBOld7tQ9YDEQx+jjQgsvyq3GMBrFytrsWeo24Zr+LrfWxP3iPcZdNQZRIgZbNgduNigt2nE77eZF8VZRm+0GqbMhwDlW663W0OVIWPmMnufSI8DZfo5niTfOU9LYhwxPi,iv:SpR+Twca+u7KH3XiIPbpqbidnqhXJobC4ytbj8Yr4/0=,tag:6CnwLthiSX9e8c+drbnFiA==,type:str]
+        CLEARNODE_BLOCKCHAIN_RPC_POLYGON_AMOY: ENC[AES256_GCM,data:UDmEBTUc+q9qGs5p9dzVXRbIsW1SzlTskNefVkJ++jb+H1DR+Z+pIDwnKL9P9u3hTX4zrLDzGO21v8mVECl6cYMq/4b8AHsIvt1cxjTz464X1RrTrtuJXArwSuFFKyMIojlLRte240VDxGrhRO+BzwIOPSA/63Q=,iv:QhQSYfEp/lT1tohVBBmBbJdrctFcN0kXC+pamhoZUmE=,tag:vU/5PsoPFVr4OTQQhYRVNA==,type:str]
+    database:
+        password: ENC[AES256_GCM,data:wLVLlRQYE+e4rQ==,iv:2foG2y5yg2goA2fNLKMw9ESLJ9vVmS61ozbn9StQEuM=,tag:6Tl46uxUdMe12pMbSQ5XGg==,type:str]
+sops:
+    gcp_kms:
+        - resource_id: projects/ynet-stage/locations/global/keyRings/sops/cryptoKeys/sops-uat-key
+          created_at: "2026-04-02T12:14:10Z"
+          enc: CiQAMMK76XoOsaEq3elJXL/OGZ/OvdDWr3hiLdfb5oQzSqJDrqESSQC9etkIbM0LvrkQHLBIV6ENlIMxX5lz/YMxBp/J5pzkO6KG3TUQ20eQmBVovw0EI1lEox7J1GtLwENfBfcYFCy1us7df6/0JNI=
+    lastmodified: "2026-04-02T12:29:32Z"
+    mac: ENC[AES256_GCM,data:/z776RGfHP6sVc/GzBN/UJ8KGf6KGtu+umE3hlQu9cnq3CjLe8oBVJg3CR9rsWlBwsgp9CB+3srzxvQLFEJ05HxjkwUfxt7bOu+MdydkzfWwrLRiV0MQgDGocLwmUpd8eew3pKNQzc89sWr6z9m8t8Sw3EYG7LmOmkqc0DwRgfo=,iv:nN/A08mDACrPNsZoRR9Xe1Ory9VU+TC9skPay/2kwm8=,tag:QFN45f+W1TXVONdcNLX+Mw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2

clearnode/chart/templates/secret.yaml → clearnode/chart/templates/env-secret.yaml

@@ -11,12 +11,7 @@ metadata:
     "helm.sh/hook-weight": "-1"
 data:
 {{- with .Values.config.database }}
-{{- if eq .driver "postgres" }}
-  CLEARNODE_DATABASE_URL: {{ printf "postgres://%s:%s@%s:%s/%s?sslmode=%s" .user .password .host (print .port) .name .sslmode | b64enc }}
-{{- end }}
-{{- if eq .driver "sqlite" }}
-  CLEARNODE_DATABASE_URL: {{ printf "file:%s" .path | b64enc }}
-{{- end }}
+  CLEARNODE_DATABASE_PASSWORD: {{ .password | b64enc }}
 {{- end }}
 {{- range $key, $value := .Values.config.secretEnvs  }}
   {{- $key | nindent 2 }}: {{ $value | print | b64enc }}

clearnode/chart/templates/full-deployment.yaml

@@ -21,15 +21,15 @@ spec:
       annotations:
         {{- include "clearnode.component.metricsAnnotations" .Values.metrics | nindent 8 }}
         {{- if .Values.config.secretEnvs }}
-        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/env-secret.yaml") . | sha256sum }}
         {{- end }}
         checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
       labels:
         {{- include "clearnode.common.selectorLabels" . | nindent 8 }}
         app.kubernetes.io/component: server
     spec:
-      {{- with .Values.serviceAccount }}
-      serviceAccountName: {{ . }}
+      {{- if .Values.serviceAccount.create }}
+      serviceAccountName: {{ include "clearnode.common.fullname" . }}
       {{- end }}
       containers:
         - name: api

clearnode/chart/templates/helpers/_common.tpl

@@ -57,9 +57,14 @@ Create chart name and version as used by the chart label.
 Returns common image pull secrets
 */}}
 {{- define "clearnode.common.imagePullSecrets" -}}
-{{- with .Values.imagePullSecret }}
-imagePullSecrets:   
-- name: {{ . }}
+{{- if or .Values.imagePullSecret .Values.ghcrPullDockerConfigJson }}
+imagePullSecrets:
+{{- if .Values.imagePullSecret }}
+- name: {{ .Values.imagePullSecret }}
+{{- end }}
+{{- if .Values.ghcrPullDockerConfigJson }}
+- name: {{ include "clearnode.common.fullname" . }}-ghcr-pull
+{{- end }}
 {{- end }}
 {{- end }}
 

clearnode/chart/templates/image-pull-secret.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.ghcrPullDockerConfigJson }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "clearnode.common.fullname" . }}-ghcr-pull
+  labels:
+    {{- include "clearnode.common.labels" . | nindent 4 }}
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: {{ .Values.ghcrPullDockerConfigJson | quote }}
+{{- end }}

clearnode/chart/templates/service-account.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "clearnode.common.fullname" . }}
+  labels:
+    {{- include "clearnode.common.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

clearnode/chart/templates/tests/stress-test.yaml

@@ -105,7 +105,7 @@ spec:
                 export STRESS_PRIVATE_KEY="$(cat /stress-secrets/private-key)"
               fi
               {{- end }}
-              exec clearnode stress-test $STRESS_SPECS
+              exec clearnode stress-test basic $STRESS_SPECS
           env:
             - name: JOB_COMPLETION_INDEX
               valueFrom:

clearnode/chart/values.yaml

@@ -95,8 +95,12 @@ resources:
     # memory: 256Mi
     # ephemeral-storage: 100Mi
 
-# -- Service account name
-serviceAccount: ""
+serviceAccount:
+  # -- Create a ServiceAccount resource
+  create: false
+  # -- Annotations to add to the ServiceAccount (e.g. for GKE Workload Identity)
+  annotations: {}
+    # iam.gke.io/gcp-service-account: my-sa@my-project.iam.gserviceaccount.com
 
 autoscaling:
   # -- Enable autoscaling
@@ -140,6 +144,9 @@ networking:
 # -- Image pull secret name
 imagePullSecret: ""
 
+# -- Base64-encoded .dockerconfigjson for GHCR pull secret (provided via SOPS-encrypted secrets)
+ghcrPullDockerConfigJson: ""
+
 # -- Node selector
 nodeSelector: {}
 

clearnode/helmfile.yaml.gotmpl

@@ -1,5 +1,6 @@
 environments:
   sandbox-v1: {}
+  stress-v1: {}
   v1-rc: {}
 
 ---
@@ -9,6 +10,9 @@ releases:
     namespace: clearnode-{{ .Environment.Name }}
     chart: ./chart
     installed: true
+    secrets:
+      - chart/config/secrets.yaml
+      - chart/config/{{ .Environment.Name }}/secrets.yaml
     values:
       - chart/config/{{ .Environment.Name }}/clearnode.yaml
     set:
@@ -18,5 +22,3 @@ releases:
         file: chart/config/{{ .Environment.Name }}/blockchains.yaml
       - name: config.assets
         file: chart/config/{{ .Environment.Name }}/assets.yaml
-      - name: config.actionGateway
-        file: chart/config/{{ .Environment.Name }}/action_gateway.yaml