Repository navigation
feat(consensus/keys): add consensus keys init - #1200
Open
leninmehedy wants to merge 1 commit into
Open
leninmehedy wants to merge 1 commit into
leninmehedy wants to merge 1 commit into
Conversation
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
leninmehedy
force-pushed
the
01195-consensus-keys-init
branch
from
September 29, 2026 05:13
33a53e1 to
37dafc9
Compare
leninmehedy
force-pushed
the
01195-consensus-keys-init
branch
from
October 13, 2026 06:27
37dafc9 to
f8c7fc2
Compare
leninmehedy
force-pushed
the
01195-consensus-keys-init
branch
from
October 13, 2026 10:33
f8c7fc2 to
4978e78
Compare
leninmehedy
force-pushed
the
01195-consensus-keys-init
branch
from
October 13, 2026 11:06
4978e78 to
3a0cd47
Compare
leninmehedy
force-pushed
the
01195-consensus-keys-init
branch
from
October 13, 2026 11:29
3a0cd47 to
1012dbd
Compare
leninmehedy
force-pushed
the
01195-consensus-keys-init
branch
from
October 13, 2026 12:37
1012dbd to
276e5c6
Compare
leninmehedy
force-pushed
the
01195-consensus-keys-init
branch
from
October 13, 2026 12:52
276e5c6 to
57cfa24
Compare
leninmehedy
marked this pull request as draft
October 20, 2026 06:24
leninmehedy
added
the
skip-kvm-runner
leninmehedy
force-pushed
the
01195-consensus-keys-init
branch
from
October 21, 2026 03:38
57cfa24 to
ae9ce29
Compare
leninmehedy
force-pushed
the
01195-consensus-keys-init
branch
from
October 21, 2026 04:44
ae9ce29 to
7ecacf3
Compare
leninmehedy
force-pushed
the
01195-consensus-keys-init
branch
from
October 21, 2026 05:19
7ecacf3 to
d9f4ac7
Compare
Add the one-shot init verb: generate a node's key material into --keys-dir and create the per-node secrets from it, reusing the generate and import code paths (no new key logic). - `consensus keys init --node-id N --keys-dir DIR` (node-id required): generate then import. Pass-through flags: --identity, --machine-id, --gossip/--tls/--admin selectors, --force. - Idempotent: an existing key type in --keys-dir is kept (not regenerated), and re-applying identical secrets is a no-op; --force regenerates and overwrites differing material. - No admin key is generated: the operator creates it in an external wallet and saves its public key as admin.pub in --keys-dir. init imports it when present (or with --admin) and otherwise says it was not imported. - For a DAB join (node-id unknown until assigned) use generate + import separately instead. Refs #1195 Signed-off-by: Lenin Mehedy <lenin.mehedy@hashgraph.com>
radkomih
force-pushed
the
01195-consensus-keys-init
branch
from
November 4, 2026 12:46
d9f4ac7 to
a977157
Compare
radkomih
marked this pull request as ready for review
November 4, 2026 13:06
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fifth PR in the stacked series for epic #1164 — Consensus Node Key & Secret Management. Stacked on #1199 (base branch
01168-consensus-keys-verify).Adds the one-shot
consensus keys initverb — generate a node's key material and create its Kubernetes secrets in a single command — plus makes generation/import/export idempotent with an audit trail.What's in it
consensus keys init --node-id N --keys-dir DIR— runsgenerate(gossip and gRPC keys) thenimport, reusing the exact same code paths (no new key logic). It never generates an admin key: if the operator saved the wallet's admin public key asadmin.pubin--keys-dir, it is imported too (or required with--admin); otherwiseinitsays no admin key was imported. The output names the exact secrets created. Pass-through flags:--identity,--machine-id,--grpc-cn,--grpc-org,--grpc-dns,--grpc-ip,--grpc-validity-days,--gossip/--tls/--admin,--force. For a DAB join (node-id unknown until assigned) usegenerate+importseparately.generate/initkeep an existing key type in--keys-dirinstead of regenerating (protecting the gossip identity);--forceregenerates.importre-applies identical material as a no-op and refuses a secret whose material differs without--force.exportleaves identical files untouched and refuses to clobber differing files without--force.admin.pub) reaches Kubernetes.Files
cmd/cli/commands/consensus/keys/init.goinitsubcommand (generate + import, idempotent)cmd/cli/commands/consensus/keys/init_test.gocmd/cli/commands/consensus/keys/keys.goinitdocs/commands/consensus.mdinitsectionTesting
Validated in the UTM VM:
All pass.
Update: admin key generation was removed, which the VM run above predates, and the new gRPC certificate options were added after the VM run above. Their tests pass for
pkg/internalon macOS and the command tests compile for Linux, but they still need a VM run.Closes #1195.