From a0c819bba7644e6ca626ca90cd9c0dc8ca918b9f Mon Sep 17 00:00:00 2001 From: DaevMithran Date: Mon, 21 Sep 2026 19:21:49 +0530 Subject: [PATCH 1/2] feat: Add hsm helm config Signed-off-by: DaevMithran --- helm/testnet-wallet/README.md | 41 +++++++++++++++++++++++++++- helm/testnet-wallet/values.yaml | 47 +++++++++++++++++++++++++++++++++ 2 files changed, 87 insertions(+), 1 deletion(-) diff --git a/helm/testnet-wallet/README.md b/helm/testnet-wallet/README.md index 1e5226019..63d1fcc3e 100644 --- a/helm/testnet-wallet/README.md +++ b/helm/testnet-wallet/README.md @@ -2,7 +2,9 @@ Deploys the Interledger TestNet Wallet application to Kubernetes. The chart manages two workloads: -- **backend** — NestJS API (`test-wallet-backend` image, port `4003`) +- **backend** — NestJS API (`test-wallet-backend` image, HTTP port `4003`), + optionally hosting the issuer and merchant HSM adapters on ports `50051` and + `50052` - **frontend** — Next.js UI (`test-wallet-frontend` image, port `4003`) ## Dependencies @@ -59,6 +61,43 @@ Defined under `secretsMaps.backend.contentMap`. Secrets are only created by the Secrets are mounted into the backend container via individual `env[].valueFrom.secretKeyRef` entries (not `envFrom`). +### Atalla HSM adapters + +The wallet backend can host both Atalla HSM adapters. They are disabled by +default, so local development and deployments without an HSM continue to start +without an Atalla TLS secret. + +Enable the adapters and configure the HSM connection under +`config.backend.hsm`: + +```yaml +config: + backend: + hsm: + enabled: true + serverRole: both + grpcHost: 0.0.0.0 + issuerGrpcPort: 50051 + merchantGrpcPort: 50052 + atalla: + host: atalla.example.internal + port: 1111 + timeoutMs: 2000 + poolSize: 1 + tlsEnabled: false +``` + +The issuer and merchant listeners are cleartext h2c services intended for +in-cluster access. The cards-playground Atalla connection is also configured +without TLS. Restrict access to the backend service and HSM at the cluster +network layer. + +The backend deliberately consumes the published +`@interledger/hsm-atalla-issuer`, `@interledger/hsm-atalla-merchant`, and +`@interledger/hsm-atalla-transport` packages rather than sibling workspace +paths. Their generated protobuf dependencies are served by the Buf Schema +Registry, so the `@buf` registry entry in the repository `.npmrc` is required. + ## Image Tags By default both deployments use the chart's `appVersion` as the image tag. To pin a specific tag for one image: diff --git a/helm/testnet-wallet/values.yaml b/helm/testnet-wallet/values.yaml index 5074efb32..11c90af55 100644 --- a/helm/testnet-wallet/values.yaml +++ b/helm/testnet-wallet/values.yaml @@ -38,6 +38,19 @@ config: port: 4003 metricsPort: 9464 + hsm: + enabled: false + serverRole: both + grpcHost: 0.0.0.0 + issuerGrpcPort: 50051 + merchantGrpcPort: 50052 + atalla: + host: localhost + port: 1111 + timeoutMs: 2000 + poolSize: 1 + tlsEnabled: false + cookie: name: 'testnet.cookie' ttl: 2630000 @@ -243,6 +256,12 @@ deployments: - name: metrics containerPort: 9464 protocol: TCP + - name: issuer-grpc + containerPort: 50051 + protocol: TCP + - name: merchant-grpc + containerPort: 50052 + protocol: TCP resources: requests: memory: 256Mi @@ -310,6 +329,14 @@ services: targetPort: 9464 protocol: TCP name: metrics + - port: 50051 + targetPort: 50051 + protocol: TCP + name: issuer-grpc + - port: 50052 + targetPort: 50052 + protocol: TCP + name: merchant-grpc frontend: name: frontend-service @@ -357,6 +384,26 @@ configMaps: valueRef: config.backend.port - key: METRICS_PORT valueRef: config.backend.metricsPort + - key: HSM_ENABLED + valueRef: config.backend.hsm.enabled + - key: HSM_SERVER_ROLE + valueRef: config.backend.hsm.serverRole + - key: HSM_GRPC_HOST + valueRef: config.backend.hsm.grpcHost + - key: ISSUER_GRPC_PORT + valueRef: config.backend.hsm.issuerGrpcPort + - key: MERCHANT_GRPC_PORT + valueRef: config.backend.hsm.merchantGrpcPort + - key: ATALLA_HOST + valueRef: config.backend.hsm.atalla.host + - key: ATALLA_PORT + valueRef: config.backend.hsm.atalla.port + - key: ATALLA_TIMEOUT_MS + valueRef: config.backend.hsm.atalla.timeoutMs + - key: ATALLA_POOL_SIZE + valueRef: config.backend.hsm.atalla.poolSize + - key: ATALLA_TLS_ENABLED + valueRef: config.backend.hsm.atalla.tlsEnabled - key: COOKIE_NAME valueRef: config.backend.cookie.name - key: COOKIE_TTL From 7e25d745f11d267da7749f3f6c0c7967a8367637 Mon Sep 17 00:00:00 2001 From: Stephan Butler Date: Mon, 5 Oct 2026 11:57:24 +0200 Subject: [PATCH 2/2] fix: resolved linting and merge issues --- helm/testnet-wallet/README.md | 60 ++++++++++++++++++++++----------- helm/testnet-wallet/values.yaml | 47 -------------------------- 2 files changed, 40 insertions(+), 67 deletions(-) diff --git a/helm/testnet-wallet/README.md b/helm/testnet-wallet/README.md index c5dfff67a..5ee0e8635 100644 --- a/helm/testnet-wallet/README.md +++ b/helm/testnet-wallet/README.md @@ -79,12 +79,19 @@ Secrets are mounted into the backend container via individual `env[].valueFrom.s ### Atalla HSM adapters -The wallet backend can host both Atalla HSM adapters. They are disabled by -default, so local development and deployments without an HSM continue to start -without an Atalla TLS secret. +The backend can serve the issuer and the merchant HSM adapter contracts over +gRPC. One process runs both servers. `serverRole` chooses which servers start: +`both`, `issuer`, or `merchant`. -Enable the adapters and configure the HSM connection under -`config.backend.hsm`: +The adapters are off by default. Only the cards environments run them, so a +deployment without an HSM starts without any Atalla configuration. + +`templates/configMap.backend.yaml` adds the `HSM_*` and `ATALLA_*` keys to the +backend ConfigMap, and only when `enabled` is true. They are not +`configMaps.backend.contentMap` entries: the backend rejects an empty +`ATALLA_HOST` or `ATALLA_PORT` when `HSM_ENABLED` is true, and a contentMap +entry would write an empty string in every environment that leaves the value +unset. The render fails if `enabled` is true and either value is missing. ```yaml config: @@ -92,27 +99,40 @@ config: hsm: enabled: true serverRole: both - grpcHost: 0.0.0.0 - issuerGrpcPort: 50051 - merchantGrpcPort: 50052 + grpcHost: '0.0.0.0' + issuerPort: 50051 + merchantPort: 50052 + atalla: - host: atalla.example.internal - port: 1111 + host: 10.0.0.1 + port: 13506 timeoutMs: 2000 poolSize: 1 - tlsEnabled: false + tls: + enabled: true + # Skips the hostname check only. The transport still sets + # rejectUnauthorized, so the HSM certificate must chain to the CA at + # caCertPath. + skipServerIdentityCheck: true + # Paths, not PEM text. The backend reads each file at start-up. + caCertPath: /etc/atalla/tls/ca.crt + clientCertPath: /etc/atalla/tls/client.crt + clientKeyPath: /etc/atalla/tls/client.key ``` -The issuer and merchant listeners are cleartext h2c services intended for -in-cluster access. The cards-playground Atalla connection is also configured -without TLS. Restrict access to the backend service and HSM at the cluster -network layer. +The issuer and merchant listeners are cleartext h2c services. Reach them inside +the namespace only, and keep the gRPC ports off the Ingress. + +`enabled: true` is not enough on its own. Helm replaces a list rather than +merging it, so the environment's values file must also write out, in full: + +- `deployments.backend.ports`, with the gRPC container ports added +- `services.backend.ports`, with the matching Service ports added +- `deployments.backend.volumes` and `deployments.backend.volumeMounts`, for the + Atalla TLS files at the paths above -The backend deliberately consumes the published -`@interledger/hsm-atalla-issuer`, `@interledger/hsm-atalla-merchant`, and -`@interledger/hsm-atalla-transport` packages rather than sibling workspace -paths. Their generated protobuf dependencies are served by the Buf Schema -Registry, so the `@buf` registry entry in the repository `.npmrc` is required. +`env/cards-playground/wallet/testnet-wallet.yaml` in `testnet-deploy` is the +worked example. ## Image Tags diff --git a/helm/testnet-wallet/values.yaml b/helm/testnet-wallet/values.yaml index 5c7942540..41e32d155 100644 --- a/helm/testnet-wallet/values.yaml +++ b/helm/testnet-wallet/values.yaml @@ -57,19 +57,6 @@ config: port: 4003 metricsPort: 9464 - hsm: - enabled: false - serverRole: both - grpcHost: 0.0.0.0 - issuerGrpcPort: 50051 - merchantGrpcPort: 50052 - atalla: - host: localhost - port: 1111 - timeoutMs: 2000 - poolSize: 1 - tlsEnabled: false - cookie: name: 'testnet.cookie' # Quoted. Helm parses a bare number as float64, and the ConfigMap would @@ -357,12 +344,6 @@ deployments: - name: metrics containerPort: 9464 protocol: TCP - - name: issuer-grpc - containerPort: 50051 - protocol: TCP - - name: merchant-grpc - containerPort: 50052 - protocol: TCP resources: requests: memory: 256Mi @@ -430,14 +411,6 @@ services: targetPort: 9464 protocol: TCP name: metrics - - port: 50051 - targetPort: 50051 - protocol: TCP - name: issuer-grpc - - port: 50052 - targetPort: 50052 - protocol: TCP - name: merchant-grpc frontend: name: frontend-service @@ -489,26 +462,6 @@ configMaps: valueRef: config.backend.port - key: METRICS_PORT valueRef: config.backend.metricsPort - - key: HSM_ENABLED - valueRef: config.backend.hsm.enabled - - key: HSM_SERVER_ROLE - valueRef: config.backend.hsm.serverRole - - key: HSM_GRPC_HOST - valueRef: config.backend.hsm.grpcHost - - key: ISSUER_GRPC_PORT - valueRef: config.backend.hsm.issuerGrpcPort - - key: MERCHANT_GRPC_PORT - valueRef: config.backend.hsm.merchantGrpcPort - - key: ATALLA_HOST - valueRef: config.backend.hsm.atalla.host - - key: ATALLA_PORT - valueRef: config.backend.hsm.atalla.port - - key: ATALLA_TIMEOUT_MS - valueRef: config.backend.hsm.atalla.timeoutMs - - key: ATALLA_POOL_SIZE - valueRef: config.backend.hsm.atalla.poolSize - - key: ATALLA_TLS_ENABLED - valueRef: config.backend.hsm.atalla.tlsEnabled - key: COOKIE_NAME valueRef: config.backend.cookie.name - key: COOKIE_TTL