statefulset.yaml

{{ $fullname :=  include "node.fullname" . }}
{{ $selectorLabels :=  include "node.selectorLabels" . }}
{{ $serviceLabels :=  include "node.serviceLabels" .  }}
{{ $serviceAccountName :=  include "node.serviceAccountName" . }}
{{ $databasePath := include "node.databasePath" . }}
{{ $chartManagedFlagsRegex := include "node.chartManagedFlagsRegex" . }}
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: {{ $fullname }}
  labels:
    {{- include "node.labels" . | nindent 4 }}
spec:
  selector:
    matchLabels:
  {{- $selectorLabels | nindent 6 }}
  podManagementPolicy: {{ default "OrderedReady" .Values.node.podManagementPolicy }}
  {{- if not .Values.autoscaling.enabled }}
  replicas: {{ .Values.node.replicas | int }}
  {{- end }}
  serviceName: {{ $fullname }}
  template:
    metadata:
    {{- if or .Values.podAnnotations .Values.node.vault.keys .Values.node.vault.nodeKey }}
      annotations:
      {{- with .Values.podAnnotations }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- range $keys := .Values.node.vault.keys }}
        vault.hashicorp.com/agent-inject-secret-{{ .name }}: {{ .vaultPath | squote }}
        vault.hashicorp.com/agent-inject-template-{{ .name }}: |
          {{`{{ with secret "`}}{{ .vaultPath }}{{`" }}{{ .Data.data.`}}{{ .vaultKey }}{{` }}{{ end }}`}}
      {{- end }}
      {{- if .Values.node.vault.nodeKey }}
        {{- if .Values.node.vault.nodeKey.vaultKeyAppendPodIndex }}
          {{- range $index := until (.Values.node.replicas | int) }}
        vault.hashicorp.com/agent-inject-secret-{{ $.Values.node.vault.nodeKey.name }}-{{ $index }}: {{ $.Values.node.vault.nodeKey.vaultPath | squote }}
        vault.hashicorp.com/agent-inject-template-{{ $.Values.node.vault.nodeKey.name }}-{{ $index }}: |
            {{`{{ with secret "`}}{{ $.Values.node.vault.nodeKey.vaultPath }}{{`" }}{{ .Data.data.`}}{{ printf "%s_%s" $.Values.node.vault.nodeKey.vaultKey ($index | toString) }}{{` }}{{ end }}`}}
          {{- end }}
        {{- else }}
        vault.hashicorp.com/agent-inject-secret-{{ .Values.node.vault.nodeKey.name }}: {{ .Values.node.vault.nodeKey.vaultPath | squote }}
        vault.hashicorp.com/agent-inject-template-{{ .Values.node.vault.nodeKey.name }}: |
          {{`{{ with secret "`}}{{ .Values.node.vault.nodeKey.vaultPath }}{{`" }}{{ .Data.data.`}}{{ .Values.node.vault.nodeKey.vaultKey }}{{` }}{{ end }}`}}
        {{- end }}
      {{- end }}
      {{- if or .Values.node.vault.keys .Values.node.vault.nodeKey }}
        vault.hashicorp.com/agent-inject: 'true'
        vault.hashicorp.com/agent-init-first: 'true'
        vault.hashicorp.com/agent-pre-populate-only: 'true'
        vault.hashicorp.com/role: {{ .Values.node.vault.authRole | default (include "node.serviceAccountName" .) | squote }}
      {{- end }}
      {{- if .Values.node.vault.authType }}
        vault.hashicorp.com/auth-type: {{ .Values.node.vault.authType | squote }}
      {{- end }}
      {{- if .Values.node.vault.authPath }}
        vault.hashicorp.com/auth-path: {{ .Values.node.vault.authPath | squote }}
      {{- end }}
      {{- if .Values.node.vault.authConfigType }}
        vault.hashicorp.com/auth-config-type: {{ .Values.node.vault.authConfigType | squote }}
      {{- end }}
      {{- if .Values.node.vault.authConfigServiceAccount }}
        vault.hashicorp.com/auth-config-service-account: {{ .Values.node.vault.authConfigServiceAccount | squote }}
      {{- end }}
    {{- end }}
      labels:
      {{- include "node.labels" . | nindent 8 }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
      {{- toYaml . | nindent 8 }}
      {{- end }}
      initContainers:
        {{- if .Values.node.chainData.snapshotUrl }}
        - name: download-chain-snapshot
          image: {{ .Values.initContainer.image.repository }}:{{ .Values.initContainer.image.tag }}
          command: [ "/bin/sh" ]
          args:
            - -c
            - |
              set -eu -o pipefail {{ if .Values.initContainer.debug }}-x{{ end }}
              if [ -d "/chain-data/chains/${CHAIN_PATH}/{{ $databasePath }}" ]; then
                echo "Database directory already exists, skipping chain snapshot download"
              else
                echo "Downloading chain snapshot"
                SNAPSHOT_URL="{{ .Values.node.chainData.snapshotUrl }}"
                mkdir -p /chain-data/chains/${CHAIN_PATH}/{{ $databasePath }}/
                if [ "${SNAPSHOT_FORMAT}" == "lz4" ]; then
                  wget -O - ${SNAPSHOT_URL} | lz4 -c -d - | tar -x -C /chain-data/chains/${CHAIN_PATH}/
                else
                  wget -O - ${SNAPSHOT_URL} | tar -x -C /chain-data/chains/${CHAIN_PATH}/{{ $databasePath }}/
                fi
              fi
          env:
            - name: CHAIN_PATH
              value: {{ default .Values.node.chain .Values.node.chainData.chainPath }}
            - name: SNAPSHOT_FORMAT
              value: {{ default "tar" .Values.node.chainData.snapshotFormat }}
          volumeMounts:
            - mountPath: /chain-data
              name: chain-data
        {{- end }}
        {{- if .Values.node.collatorRelayChain.chainData.snapshotUrl }}
        - name: download-relay-chain-snapshot
          image: {{ .Values.initContainer.image.repository }}:{{ .Values.initContainer.image.tag }}
          command: [ "/bin/sh" ]
          args:
            - -c
            - |
              set -eu -o pipefail {{ if .Values.initContainer.debug }}-x{{ end }}
              if [ -d "/relaychain-data/chains/${RELAY_CHAIN_PATH}/{{ $databasePath }}" ]; then
                echo "Database directory already exists, skipping relay-chain snapshot download"
              else
                echo "Downloading relay-chain snapshot"
                RELAY_SNAPSHOT_URL="{{ .Values.node.collatorRelayChain.chainData.snapshotUrl }}"
                mkdir -p /relaychain-data/chains/${RELAY_CHAIN_PATH}/{{ $databasePath }}
                if [ "${RELAY_SNAPSHOT_FORMAT}" == "lz4" ]; then
                  wget -O - ${RELAY_SNAPSHOT_URL} | lz4 -c -d - | tar -x -C /relaychain-data/chains/${RELAY_CHAIN_PATH}/
                else
                  wget -O - ${RELAY_SNAPSHOT_URL} | tar -x -C /relaychain-data/chains/${RELAY_CHAIN_PATH}/{{ $databasePath }}/
                fi
              fi
          env:
            - name: RELAY_SNAPSHOT_FORMAT
              value: {{ default "tar" .Values.node.collatorRelayChain.chainData.snapshotFormat }}
            - name: RELAY_CHAIN_PATH
              value: {{ default .Values.node.collatorRelayChain.chain .Values.node.collatorRelayChain.chainData.chainPath }}
          volumeMounts:
            - mountPath: /relaychain-data
              name: relaychain-data
        {{- end }}
        {{- if .Values.node.enableChainBackupGcs }}
        - name: backup-chain-gcs
          image: {{ .Values.googleCloudSdk.image.repository }}:{{ .Values.googleCloudSdk.image.tag }}
          command: [ "/bin/sh" ]
          args:
            - -c
            - |
              set -eu {{ if .Values.initContainer.debug }}-x{{ end }}
              {{- if .Values.googleCloudSdk.serviceAccountKey }}
              gcloud auth activate-service-account --key-file /tmp/service-account-key.json
              {{- end }}
              if [ -d "/chain-data/chains/${CHAIN_PATH}/{{ $databasePath }}" ]; then
                echo "Chain database directory exists, starting GCS backup sync"
                BUCKET_URL="{{ .Values.node.chainBackupGcsUrl }}/${HOSTNAME}"
                NOW=$(date +"%Y%m%d-%H%M%S")
                echo -e "\nStart gsutil backup\n"
                gsutil {{ .Values.googleCloudSdk.gsutilFlags }} cp -r /chain-data/chains/${CHAIN_PATH}/{{ $databasePath }}/ ${BUCKET_URL}/${NOW}
                size=$(gsutil du -s ${BUCKET_URL}/${NOW} | awk '{ print $1 }' )
                echo "size: ${size}\nversion: {{ .Values.image.tag }}" > /chain-data/now.meta.txt
                gsutil cp /chain-data/now.meta.txt ${BUCKET_URL}/${NOW}.meta.txt
                rm -f /chain-data/now.meta.txt
                echo "${NOW}" > /chain-data/latest_version.meta.txt
                gsutil cp /chain-data/latest_version.meta.txt ${BUCKET_URL}/latest_version.meta.txt
                rm -f /chain-data/latest_version.meta.txt
              fi
          env:
            - name: CHAIN_PATH
              value: {{ default .Values.node.chain .Values.node.chainData.chainPath }}
          volumeMounts:
            - mountPath: /chain-data
              name: chain-data
            {{- if .Values.googleCloudSdk.serviceAccountKey }}
            - name: service-account-key
              mountPath: /tmp
              readOnly: true
            {{- end }}
        {{- end }}
        {{- if .Values.node.chainData.GCSBucketUrl }}
        - name: sync-chain-gcs
          image: {{ .Values.googleCloudSdk.image.repository }}:{{ .Values.googleCloudSdk.image.tag }}
          command: [ "/bin/sh" ]
          args:
            - -c
            - |
              set -eu {{ if .Values.initContainer.debug }}-x{{ end }}
              {{- if .Values.googleCloudSdk.serviceAccountKey }}
              gcloud auth activate-service-account --key-file /tmp/service-account-key.json
              {{- end }}
              if [ -d "/chain-data/chains/${CHAIN_PATH}/{{ $databasePath }}" ]; then
                echo "Chain database directory already exists, skipping GCS sync"
              else
                BUCKET_URL="{{ .Values.node.chainData.GCSBucketUrl }}"
                LATEST=$(gsutil cat ${BUCKET_URL}/latest_version.meta.txt)
                if [ -z "$LATEST" ]; then
                  echo "Failed to retrieve latest_version metadata"
                  exit 1
                fi
                mkdir -p /chain-data/chains/${CHAIN_PATH}/{{ $databasePath }}
                gsutil {{ .Values.googleCloudSdk.gsutilFlags }} cp -r "${BUCKET_URL}/${LATEST}/*" /chain-data/chains/${CHAIN_PATH}/{{ $databasePath }}/
              fi
          env:
            - name: CHAIN_PATH
              value: {{ default .Values.node.chain .Values.node.chainData.chainPath }}
          volumeMounts:
            - mountPath: /chain-data
              name: chain-data
            {{- if .Values.googleCloudSdk.serviceAccountKey }}
            - name: service-account-key
              mountPath: /tmp
              readOnly: true
            {{- end }}
        {{- end }}
        {{- if .Values.node.collatorRelayChain.chainData.GCSBucketUrl }}
        - name: sync-relay-chain-gcs
          image: {{ .Values.googleCloudSdk.image.repository }}:{{ .Values.googleCloudSdk.image.tag }}
          command: [ "/bin/sh" ]
          args:
            - -c
            - |
              set -eu {{ if .Values.initContainer.debug }}-x{{ end }}
              {{- if .Values.googleCloudSdk.serviceAccountKey }}
              gcloud auth activate-service-account --key-file /tmp/service-account-key.json
              {{- end }}
              if [ -d "/relaychain-data/chains/${RELAY_CHAIN_PATH}/{{ $databasePath }}" ]; then
                echo "Relay-chain database directory already exists, skipping GCS sync"
              else
                BUCKET_URL="{{ .Values.node.collatorRelayChain.chainData.GCSBucketUrl }}"
                LATEST=$(gsutil cat ${BUCKET_URL}/latest_version.meta.txt)
                if [ -z "$LATEST" ]; then
                  echo "Failed to retrieve latest_version metadata"
                  exit 1
                fi
                mkdir -p /relaychain-data/chains/${RELAY_CHAIN_PATH}/{{ $databasePath }}
                gsutil {{ .Values.googleCloudSdk.gsutilFlags }} cp -r "${BUCKET_URL}/${LATEST}/*" /relaychain-data/chains/${RELAY_CHAIN_PATH}/{{ $databasePath }}/
              fi
          env:
            - name: RELAY_CHAIN_PATH
              value: {{ default .Values.node.collatorRelayChain.chain .Values.node.collatorRelayChain.chainData.chainPath }}
          volumeMounts:
            - mountPath: /relaychain-data
              name: relaychain-data
             {{- if .Values.googleCloudSdk.serviceAccountKey }}
            - name: service-account-key
              mountPath: /tmp
              readOnly: true
             {{- end }}
         {{- end }}
        {{- if or .Values.node.customChainspecUrl .Values.node.collatorRelayChain.customChainspecUrl}}
        - name: download-chainspec
          image: {{ .Values.initContainer.image.repository }}:{{ .Values.initContainer.image.tag }}
          command: [ "/bin/sh" ]
          args:
            - -c
            - |
              set -eu -o pipefail {{ if .Values.initContainer.debug }}-x{{ end }}
              {{- if .Values.node.customChainspecUrl }}
              {{- if not .Values.node.forceDownloadChainspec }}
              if [ ! -f {{ .Values.node.customChainspecPath }} ]; then
              {{- end }}
                wget -O {{ .Values.node.customChainspecPath }} {{ .Values.node.customChainspecUrl }}
              {{- if not .Values.node.forceDownloadChainspec }}
              fi
              {{- end }}
              {{- end }}
              {{- if .Values.node.collatorRelayChain.customChainspecUrl}}
              {{- if not .Values.node.forceDownloadChainspec }}
              if [ ! -f {{ .Values.node.collatorRelayChain.customChainspecPath}} ]; then
              {{- end }}
                wget -O {{ .Values.node.collatorRelayChain.customChainspecPath}} {{ .Values.node.collatorRelayChain.customChainspecUrl}}
              {{- if not .Values.node.forceDownloadChainspec }}
              fi
              {{- end }}
              {{- end }}
          volumeMounts:
            - mountPath: /chain-data
              name: chain-data
            {{- if and .Values.node.isParachain .Values.node.collatorRelayChain.customChainspecUrl}}
            - mountPath: /relaychain-data
              name: relaychain-data
            {{- end }}
          securityContext:
            runAsUser: 0
        {{- end }}
        {{- if .Values.node.wasmRuntimeUrl }}
        - name: download-runtime
          image: {{ .Values.initContainer.image.repository }}:{{ .Values.initContainer.image.tag }}
          command: [ "/bin/sh" ]
          args:
            - -c
            - |
              set -eu -o pipefail {{ if .Values.initContainer.debug }}-x{{ end }}
              mkdir -p {{ .Values.node.wasmRuntimeOverridesPath }}
              wget -nc -P {{ .Values.node.wasmRuntimeOverridesPath }} {{ .Values.node.wasmRuntimeUrl }}
          volumeMounts:
            - mountPath: /chain-data
              name: chain-data
          securityContext:
            runAsUser: 0
        {{- end }}
        {{- if .Values.node.persistGeneratedNodeKey }}
        - name: persist-generated-node-key
          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
          command: [ "/bin/sh" ]
          args:
            - -c
            - |
              set -eu {{ if .Values.initContainer.debug }}-x{{ end }}
              NODE_KEY_PATH="/keystore/node-key"
              if [ -f "${NODE_KEY_PATH}" ]; then
                echo "Node key already exists, skipping node key generation"
              else
                {{ $.Values.node.command }} key generate-node-key --file ${NODE_KEY_PATH} \
                && echo "Generate node key into Keystore" \
                || echo "Failed to insert key into Keystore."
              fi
              NODE_PEER_ID="$({{ .Values.node.command }} key inspect-node-key --file ${NODE_KEY_PATH})"
              echo "Node key present in ${NODE_KEY_PATH} with peer-id: ${NODE_PEER_ID}"
          volumeMounts:
            - mountPath: /keystore
              name: chain-keystore
        {{- end }}
        {{- if .Values.node.keys }}
        - name: inject-keys
          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
          command: [ "/bin/sh" ]
          args:
            - -c
            - |
              set -eu {{ if .Values.initContainer.debug }}-x{{ end }}
              {{- range $keys := .Values.node.keys }}
              if [ ! -f /var/run/secrets/{{ .type }}/type ]; then
                 echo "Error: File /var/run/secrets/{{ .type }}/type does not exist"
                 exit 1
              fi
              {{ $.Values.node.command }} key insert \
              --keystore-path /keystore \
              --key-type $(cat /var/run/secrets/{{ .type }}/type) \
              --scheme $(cat /var/run/secrets/{{ .type }}/scheme) \
              {{- if .extraDerivation }}
              --suri "$(cat /var/run/secrets/{{ .type }}/seed){{ .extraDerivation }}" \
              {{- else }}
              --suri /var/run/secrets/{{ .type }}/seed \
              {{- end }}
              && echo "Inserted key {{ .type }} into Keystore" \
              || echo "Failed to insert key {{ .type}} into Keystore."
              {{- end }}
          env:
            - name: CHAIN
              value: {{ .Values.node.chain }}
          volumeMounts:
            - mountPath: /keystore
              name: chain-keystore
          {{- range $keys := .Values.node.keys }}
            - mountPath: /var/run/secrets/{{ .type }}
              name: {{ .type }}
          {{- end }}
        {{ else if .Values.node.vault.keys }}
        - name: inject-vault-keys
          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
          command: [ "/bin/sh" ]
          args:
            - -c
            - |
              set -eu {{ if .Values.initContainer.debug }}-x{{ end }}
              {{- if .Values.node.vault.nodeKey }}
              NODE_KEY_PATH="/vault/secrets/{{ .Values.node.vault.nodeKey.name }}{{ if .Values.node.vault.nodeKey.vaultKeyAppendPodIndex }}-${HOSTNAME##*-}{{ end }}"
              if [ ! -f ${NODE_KEY_PATH} ]; then
                 echo "Error: File ${NODE_KEY_PATH} does not exist"
                 exit 1
              fi
              NODE_PEER_ID="$(cat ${NODE_KEY_PATH} | {{ .Values.node.command }} key inspect-node-key)"
              echo "Inserted node key at ${NODE_KEY_PATH} with peer-id: ${NODE_PEER_ID}"
              {{- end }}
              {{- range $keys := .Values.node.vault.keys }}
              if [ ! -f /vault/secrets/{{ .name }} ]; then
                 echo "Error: File /vault/secrets/{{ .name }} does not exist"
                 exit 1
              fi
              {{ $.Values.node.command }} key insert \
              --keystore-path /keystore \
              --key-type {{ .type }} \
              --scheme {{ .scheme }} \
              {{- if .extraDerivation }}
              --suri "$(cat /vault/secrets/{{ .name }}){{ .extraDerivation }}" \
              {{- else }}
              --suri "/vault/secrets/{{ .name }}" \
              {{- end }}
              && echo "Inserted key {{ .name }} (type={{ .type }}, scheme={{ .scheme }}) into Keystore" \
              || echo "Failed to insert key {{ .name }} (type={{ .type }}, scheme={{ .scheme }}) into Keystore."
              {{- end }}
          env:
            - name: CHAIN
              value: {{ .Values.node.chain }}
          volumeMounts:
            - mountPath: /keystore
              name: chain-keystore
        {{- end }}
        {{- if or (eq .Values.node.perNodeServices.relayP2pService.type "NodePort") (eq .Values.node.perNodeServices.paraP2pService.type "NodePort") .Values.node.perNodeServices.setPublicAddressToExternalIp.enabled }}
        - name: retrieve-service-info
          image: {{ .Values.kubectl.image.repository }}:{{ .Values.kubectl.image.tag }}
          command: [ "/bin/sh" ]
          args:
            - -c
            - |
              set -eu {{ if .Values.initContainer.debug }}-x{{ end }}
              POD_INDEX="${HOSTNAME##*-}"
              {{- if and .Values.node.perNodeServices.relayP2pService.enabled (eq .Values.node.perNodeServices.relayP2pService.type "NodePort") }}
              RELAY_CHAIN_P2P_PORT="$(kubectl --namespace {{ .Release.Namespace }} get service {{ $fullname }}-${POD_INDEX}-relay-chain-p2p -o jsonpath='{.spec.ports[?(@.name=="p2p")].nodePort}')"
              {{- if .Values.node.perNodeServices.relayP2pService.ws.enabled }}
              RELAY_CHAIN_P2P_PORT_WS="$(kubectl --namespace {{ .Release.Namespace }} get service {{ $fullname }}-${POD_INDEX}-relay-chain-p2p -o jsonpath='{.spec.ports[?(@.name=="ws")].nodePort}')"
              echo "${RELAY_CHAIN_P2P_PORT_WS}" > /chain-data/relay_chain_p2p_port_ws
              echo "Saved ${RELAY_CHAIN_P2P_PORT_WS} to /chain-data/relay_chain_p2p_port_ws"
              {{- end }}
              echo "${RELAY_CHAIN_P2P_PORT}" > /chain-data/relay_chain_p2p_port
              echo "Retrieved Kubernetes service node port from {{ $fullname }}-${POD_INDEX}-relay-chain-p2p"
              echo "Saved ${RELAY_CHAIN_P2P_PORT} to /chain-data/relay_chain_p2p_port"
              {{- end }}
              {{- if and .Values.node.perNodeServices.paraP2pService.enabled  (eq .Values.node.perNodeServices.paraP2pService.type "NodePort") }}
              PARA_CHAIN_P2P_PORT="$(kubectl --namespace {{ .Release.Namespace }} get service {{ $fullname }}-${POD_INDEX}-para-chain-p2p -o jsonpath='{.spec.ports[0].nodePort}')"
              echo "${PARA_CHAIN_P2P_PORT}" > /chain-data/para_chain_p2p_port
              echo "Retrieved Kubernetes service node port from {{ $fullname }}-${POD_INDEX}-para-chain-p2p, saved ${PARA_CHAIN_P2P_PORT} to /chain-data/para_chain_p2p_port"
              {{- if .Values.node.perNodeServices.paraP2pService.ws.enabled }}
              PARA_CHAIN_P2P_PORT_WS="$(kubectl --namespace {{ .Release.Namespace }} get service {{ $fullname }}-${POD_INDEX}-para-chain-p2p -o jsonpath='{.spec.ports[?(@.name=="ws")].nodePort}')"
              echo "${PARA_CHAIN_P2P_PORT_WS}" > /chain-data/para_chain_p2p_port_ws
              echo "Saved ${PARA_CHAIN_P2P_PORT_WS} to /chain-data/para_chain_p2p_port_ws"
              {{- end }}
              {{- end }}
              {{- if .Values.node.perNodeServices.setPublicAddressToExternalIp.enabled }}
              EXTERNAL_IP=$(curl {{ .Values.node.perNodeServices.setPublicAddressToExternalIp.ipRetrievalServiceUrl }})
              echo "${EXTERNAL_IP}" > /chain-data/node_external_ip
              echo "Retrieved external IP from {{ .Values.node.perNodeServices.ipRetrievalServiceUrl }}, saved ${EXTERNAL_IP} to /chain-data/node_external_ip"
              {{- end }}
          volumeMounts:
            - mountPath: /chain-data
              name: chain-data
        {{- end }}
        {{- with .Values.extraInitContainers }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      containers:
        - name: {{ .Values.node.chain }}
          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          command: [ "/bin/sh" ]
          args:
            - -c
            - |
              set -eu{{ if .Values.image.debug }}x{{ end }}
              POD_INDEX="${HOSTNAME##*-}"
              {{- if and .Values.node.perNodeServices.setPublicAddressToExternalIp.enabled (or $.Values.node.perNodeServices.relayP2pService.enabled $.Values.node.perNodeServices.paraP2pService.enabled) }}
              EXTERNAL_IP="$(cat /chain-data/node_external_ip)"
              echo "EXTERNAL_IP=${EXTERNAL_IP}"
              {{- end }}
              {{- if and .Values.node.perNodeServices.relayP2pService.enabled (eq .Values.node.perNodeServices.relayP2pService.type "NodePort") }}
              {{- /* For NodePort services, set the p2p port to the value saved in the retrieve-service-info init container */}}
              RELAY_CHAIN_P2P_PORT="$(cat /chain-data/relay_chain_p2p_port)"
              echo "RELAY_CHAIN_P2P_PORT=${RELAY_CHAIN_P2P_PORT}"
              {{- if .Values.node.perNodeServices.relayP2pService.ws.enabled }}
              RELAY_CHAIN_P2P_PORT_WS="$(cat /chain-data/relay_chain_p2p_port_ws)"
              echo "RELAY_CHAIN_P2P_PORT_WS=${RELAY_CHAIN_P2P_PORT_WS}"
              {{- end }}
              {{- else }}
              {{- /* For non NodePort services, set the p2p port to value configured in `relayP2pService.port`*/}}
              RELAY_CHAIN_P2P_PORT={{ $.Values.node.perNodeServices.relayP2pService.port | quote }}
              echo "RELAY_CHAIN_P2P_PORT=${RELAY_CHAIN_P2P_PORT}"
              {{- if .Values.node.perNodeServices.relayP2pService.ws.enabled }}
              RELAY_CHAIN_P2P_PORT_WS={{ $.Values.node.perNodeServices.relayP2pService.ws.port | quote }}
              echo "RELAY_CHAIN_P2P_PORT_WS=${RELAY_CHAIN_P2P_PORT_WS}"
              {{- end }}
              {{- end }}
              {{- if .Values.node.isParachain }}
              {{- if and .Values.node.perNodeServices.paraP2pService.enabled  (eq .Values.node.perNodeServices.paraP2pService.type "NodePort") }}
              {{- /* For NodePort services, set the p2p port to the value saved in the retrieve-service-info init container */}}
              PARA_CHAIN_P2P_PORT="$(cat /chain-data/para_chain_p2p_port)"
              echo "PARA_CHAIN_P2P_PORT=${PARA_CHAIN_P2P_PORT}"
              {{- if .Values.node.perNodeServices.paraP2pService.ws.enabled }}
              PARA_CHAIN_P2P_PORT_WS="$(cat /chain-data/para_chain_p2p_port_ws)"
              echo "PARA_CHAIN_P2P_PORT_WS=${PARA_CHAIN_P2P_PORT_WS}"
              {{- end }}
              {{- else }}
              {{- /* For non NodePort services, set the p2p port to value configured in `paraP2pService.port` */}}
              PARA_CHAIN_P2P_PORT={{ $.Values.node.perNodeServices.paraP2pService.port | quote }}
              echo "PARA_CHAIN_P2P_PORT=${PARA_CHAIN_P2P_PORT}"
              {{- if .Values.node.perNodeServices.paraP2pService.ws.enabled }}
              PARA_CHAIN_P2P_PORT_WS={{ $.Values.node.perNodeServices.paraP2pService.ws.port | quote }}
              echo "PARA_CHAIN_P2P_PORT_WS=${PARA_CHAIN_P2P_PORT_WS}"
              {{- end }}
              {{- end }}
              {{- end }}
              exec {{ .Values.node.command }} \
                --name=${POD_NAME} \
                --base-path=/chain-data \
                --keystore-path=/keystore \
                --chain={{ if .Values.node.customChainspecUrl }}{{ .Values.node.customChainspecPath }}{{ else }}${CHAIN}{{ end }} \
                {{- if or (eq .Values.node.role "authority") (eq .Values.node.role "validator") }}
                --validator \
                {{- end }}
                {{- if .Values.node.chainData.database }}
                --database={{ .Values.node.chainData.database }} \
                {{- end }}
                {{- if ge ( int .Values.node.chainData.pruning ) 1 }}
                --pruning={{ .Values.node.chainData.pruning }} \
                {{- else if and ( not ( kindIs "invalid" .Values.node.chainData.pruning ) ) ( eq 0 ( int .Values.node.chainData.pruning ) ) }}
                --pruning=archive \
                {{- end }}
                {{- if eq .Values.node.role "collator" }}
                --collator \
                {{- end }}
                {{- if eq .Values.node.role "light" }}
                --light \
                {{- end }}
                {{- if .Values.node.prometheus.enabled }}
                --prometheus-external \
                --prometheus-port {{ .Values.node.prometheus.port }} \
                {{- end }}
                {{- /*
                The unsafe flags are required to expose RPC interfaces.
                It is not a security risk unless they are exposed publicly.
                */}}
                --unsafe-rpc-external \
                --unsafe-ws-external \
                {{- /*
                CORS must be set to 'all' to allow RPC requests including Kubernetes heathchecks.
                */}}
                --rpc-cors=all \
                {{- if .Values.node.allowUnsafeRpcMethods }}
                --rpc-methods=unsafe \
                {{- end }}
                {{- if .Values.node.isParachain }}
                --listen-addr=/ip4/0.0.0.0/tcp/30334 \
                {{- if .Values.node.perNodeServices.paraP2pService.enabled }}
                {{- if .Values.node.perNodeServices.paraP2pService.ws.enabled }}
                --listen-addr=/ip4/0.0.0.0/tcp/30335/ws \
                --listen-addr=/ip4/0.0.0.0/tcp/${PARA_CHAIN_P2P_PORT_WS}/ws \
                {{- end }}
                {{- if .Values.node.perNodeServices.setPublicAddressToExternalIp.enabled }}
                --public-addr=/ip4/${EXTERNAL_IP}/tcp/${PARA_CHAIN_P2P_PORT} \
                {{- if .Values.node.perNodeServices.paraP2pService.ws.enabled }}
                --public-addr=/ip4/${EXTERNAL_IP}/tcp/${PARA_CHAIN_P2P_PORT_WS}/ws \
                {{- end }}
                {{- end }}
                --listen-addr=/ip4/0.0.0.0/tcp/${PARA_CHAIN_P2P_PORT} \
                {{- end }}
                {{- end }}
                {{- if .Values.node.persistGeneratedNodeKey }}
                --node-key-file /keystore/node-key \
                {{- else if .Values.node.customNodeKey }}
                --node-key $(cat /tmp/custom-node-key) \
                {{- else if .Values.node.vault.nodeKey }}
                --node-key $(cat /vault/secrets/{{ .Values.node.vault.nodeKey.name }}{{ if .Values.node.vault.nodeKey.vaultKeyAppendPodIndex }}-${POD_INDEX}{{ end }}) \
                {{- end }}
                {{- if .Values.node.wasmRuntimeUrl }}
                --wasm-runtime-overrides={{ .Values.node.wasmRuntimeOverridesPath }} \
                {{- end }}
                {{- if .Values.node.tracing.enabled }}
                --jaeger-agent=127.0.0.1:{{ .Values.jaegerAgent.ports.compactPort }} \
                {{- end }}
                {{- range .Values.node.logLevels }}
                --log={{ . | quote }} \
                {{- end }}
                {{- range .Values.node.telemetryUrls }}
                --telemetry-url={{ . | squote }} \
                {{- end }}
                {{- range .Values.node.flags }}
                {{- if regexMatch $chartManagedFlagsRegex . }}
                {{- fail (printf "%s should not be set through `node.flags` but with the appropriate chart value" .) }}
                {{- else }}
                {{ . }} \
                {{- end }}
                {{- end }}
                {{- if .Values.node.isParachain }}
                -- \
                --name=${POD_NAME} \
                --base-path=/relaychain-data \
                --keystore-path=/relaychain-keystore \
                {{- if .Values.node.collatorRelayChain.chainData.database }}
                --database={{ .Values.node.collatorRelayChain.chainData.database }} \
                {{- end }}
                {{- if ge ( int .Values.node.collatorRelayChain.chainData.pruning ) 1 }}
                --pruning={{ .Values.node.collatorRelayChain.chainData.pruning }} \
                {{- else if and ( not ( kindIs "invalid" .Values.node.collatorRelayChain.chainData.pruning ) ) ( eq 0 ( int .Values.node.collatorRelayChain.chainData.pruning ) ) }}
                --pruning=archive \
                {{- end }}
                {{- if .Values.node.collatorRelayChain.prometheus.enabled }}
                --prometheus-external \
                --prometheus-port {{ .Values.node.collatorRelayChain.prometheus.port }} \
                {{- end }}
                {{- if .Values.node.collatorRelayChain.customChainspecUrl}}
                --chain={{ .Values.node.collatorRelayChain.customChainspecPath}} \
                {{- end }}
                {{- range .Values.node.telemetryUrls }}
                --telemetry-url={{ . | squote }} \
                {{- end }}
                {{- range .Values.node.collatorRelayChain.flags }}
                {{- if regexMatch $chartManagedFlagsRegex . }}
                {{- fail (printf "%s should not be set through `node.collatorRelayChain.flags` but with the appropriate chart value" .) }}
                {{- else }}
                {{ . }} \
                {{- end }}
                {{- end }}
                {{- end }}
                {{- if .Values.node.perNodeServices.relayP2pService.enabled }}
                {{- if .Values.node.perNodeServices.setPublicAddressToExternalIp.enabled }}
                --public-addr=/ip4/${EXTERNAL_IP}/tcp/${RELAY_CHAIN_P2P_PORT} \
                {{- if .Values.node.perNodeServices.relayP2pService.ws.enabled }}
                --public-addr=/ip4/${EXTERNAL_IP}/tcp/${RELAY_CHAIN_P2P_PORT_WS}/ws \
                {{- end }}
                {{- end }}
                --listen-addr=/ip4/0.0.0.0/tcp/${RELAY_CHAIN_P2P_PORT} \
                {{- if and (not .Values.node.isParachain) .Values.node.perNodeServices.relayP2pService.ws.enabled }}
                --listen-addr=/ip4/0.0.0.0/tcp/${RELAY_CHAIN_P2P_PORT_WS}/ws \
                {{- end }}
                {{- end }}

          env:
            - name: CHAIN
              value: {{ .Values.node.chain }}
            - name: NODE_NAME
              value: "$(POD_NAME)"
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.name
            {{- with .Values.node.extraEnvVars }}
            {{- toYaml . | nindent 12 }}
            {{- end}}
          ports:
            - containerPort: 9933
              name: http-rpc
              protocol: TCP
            - containerPort: 9944
              name: websocket-rpc
              protocol: TCP
            - containerPort: {{ .Values.node.prometheus.port }}
              name: prometheus
              protocol: TCP
            {{- if and .Values.node.isParachain .Values.node.collatorRelayChain.prometheus.enabled }}
            - containerPort: {{ .Values.node.collatorRelayChain.prometheus.port }}
              name: prom-relaychain
            {{- end }}
            - containerPort: 30333
              name: p2p
              protocol: TCP
          {{- if .Values.node.enableStartupProbe }}
          # On startup, retry the connection to the /health endpoint every 10s for 5 min before killing the container
          startupProbe:
            failureThreshold: 30
            periodSeconds: 10
            httpGet:
              path: /health
              port: http-rpc
          {{- end }}
          resources:
          {{- toYaml .Values.node.resources | nindent 12 }}
          volumeMounts:
            - mountPath: /chain-data
              name: chain-data
            - mountPath: /keystore
              name: chain-keystore
            {{- if .Values.node.isParachain }}
            - mountPath: /relaychain-data
              name: relaychain-data
            - mountPath: /relaychain-keystore
              name: relaychain-keystore
            {{- end }}
          {{- if .Values.node.persistGeneratedNodeKey }}
          {{- else if .Values.node.customNodeKey }}
            - mountPath: /tmp/
              name: custom-node-key
              readOnly: true
          {{- end }}
        {{- if .Values.node.substrateApiSidecar.enabled }}
        - name: substrate-api-sidecar
          image: {{ .Values.substrateApiSidecar.image.repository }}:{{ .Values.substrateApiSidecar.image.tag }}
          env:
            {{- range $key, $val := .Values.substrateApiSidecar.env }}
            - name: {{ $key }}
              value: {{ $val }}
            {{- end }}
          resources:
          {{- toYaml .Values.substrateApiSidecar.resources | nindent 12 }}
          ports:
            - containerPort: 8080
              name: api-sidecar
              protocol: TCP
        {{- end }}
        {{- if .Values.node.tracing.enabled }}
        - name: jaeger-agent-sidecar
          image: {{ .Values.jaegerAgent.image.repository }}:{{ .Values.jaegerAgent.image.tag }}
          args:
            - --reporter.grpc.host-port={{ .Values.jaegerAgent.collector.url }}:{{ .Values.jaegerAgent.collector.port }}
          env:
            {{- range $key, $val := .Values.jaegerAgent.env }}
            - name: {{ $key }}
              value: {{ $val }}
            {{- end }}
          resources:
          {{- toYaml .Values.jaegerAgent.resources | nindent 12 }}
          ports:
            - name: jaeger-compact
              containerPort: {{ .Values.jaegerAgent.ports.compactPort }}
              protocol: UDP
            - name: jaeger-binary
              containerPort: {{ .Values.jaegerAgent.ports.binaryPort }}
              protocol: UDP
            - name: http
              containerPort: {{ .Values.jaegerAgent.ports.samplingPort }}
              protocol: TCP
            - name: admin
              containerPort: 14271
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /
              port: admin
          readinessProbe:
            httpGet:
              path: /
              port: admin
        {{- end}}
        {{ if .Values.node.enableSidecarReadinessProbe }}
        - name: ws-health-exporter
          image: {{ .Values.wsHealthExporter.image.repository }}:{{ .Values.wsHealthExporter.image.tag }}
          env:
            - name: NODE_URL
              value: ws://127.0.0.1:9944
          resources:
          {{- toYaml .Values.wsHealthExporter.resources | nindent 12 }}
          readinessProbe:
            httpGet:
              path: /health/readiness
              port: 8001
        {{- end }}
        {{- with .Values.extraContainers }}
        {{- toYaml . | nindent 8 }}
        {{- end}}
      serviceAccountName: {{ $serviceAccountName }}
      securityContext:
      {{- toYaml .Values.podSecurityContext | nindent 8 }}
      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
      {{- toYaml . | nindent 10 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
      {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
      {{- toYaml . | nindent 8 }}
      {{- end }}
      volumes:
      {{- if .Values.googleCloudSdk.serviceAccountKey }}
        - name: service-account-key
          secret:
            secretName: {{ $fullname }}-gcs-bucket-service-account-key
      {{- end }}
      {{- if .Values.node.persistGeneratedNodeKey }}
      {{- else if .Values.node.customNodeKey }}
        - name: custom-node-key
          secret:
            secretName: {{ $fullname }}-custom-node-key
      {{- end }}
      {{- range $keys := .Values.node.keys }}
        - name: {{ .type }}
          secret:
            secretName: {{ $fullname }}-{{ .type }}
            defaultMode: 0400
      {{- end }}
      {{- if .Values.node.chainKeystore.mountInMemory.enabled }}
        - name: chain-keystore
          emptyDir:
            medium: "Memory"
            {{- if and (.Values.node.chainKeystore.mountInMemory.sizeLimit) (semverCompare ">=1.22-0" .Capabilities.KubeVersion.GitVersion) }}
            sizeLimit: {{ .Values.node.chainKeystore.mountInMemory.sizeLimit }}
            {{- end }}
      {{- end }}
      {{- if and .Values.node.isParachain .Values.node.collatorRelayChain.chainKeystore.mountInMemory.enabled }}
        - name: relaychain-keystore
          emptyDir:
            medium: "Memory"
            {{- if and (.Values.node.collatorRelayChain.chainKeystore.mountInMemory.sizeLimit) (semverCompare ">=1.22-0" .Capabilities.KubeVersion.GitVersion) }}
            sizeLimit: {{ .Values.node.collatorRelayChain.chainKeystore.mountInMemory.sizeLimit }}
            {{- end }}
      {{- end }}
  volumeClaimTemplates:
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: chain-data
      spec:
        accessModes: [ "ReadWriteOnce" ]
        {{- if or .Values.node.chainData.kubernetesVolumeSnapshot .Values.node.chainData.kubernetesVolumeToClone }}
        dataSource:
          {{- if .Values.node.chainData.kubernetesVolumeSnapshot }}
          name: {{ .Values.node.chainData.kubernetesVolumeSnapshot }}
          kind: VolumeSnapshot
          apiGroup: snapshot.storage.k8s.io
          {{- else }}
          name: {{ .Values.node.chainData.kubernetesVolumeToClone }}
          kind: PersistentVolumeClaim
          {{- end }}
        {{- end }}
        storageClassName: {{ .Values.node.chainData.storageClass }}
        resources:
          requests:
            storage: {{ .Values.node.chainData.volumeSize }}
    {{- if not .Values.node.chainKeystore.mountInMemory.enabled }}
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: chain-keystore
      spec:
        accessModes: {{ .Values.node.chainKeystore.accessModes }}
        {{- if or .Values.node.chainKeystore.kubernetesVolumeSnapshot .Values.node.chainKeystore.kubernetesVolumeToClone }}
        dataSource:
          {{- if .Values.node.chainKeystore.kubernetesVolumeSnapshot }}
          name: {{ .Values.node.chainKeystore.kubernetesVolumeSnapshot }}
          kind: VolumeSnapshot
          apiGroup: snapshot.storage.k8s.io
          {{- else }}
          name: {{ .Values.node.chainKeystore.kubernetesVolumeToClone }}
          kind: PersistentVolumeClaim
          {{- end }}
        {{- end }}
        storageClassName: {{ .Values.node.chainKeystore.storageClass }}
        resources:
          requests:
            storage: {{ .Values.node.chainKeystore.volumeSize }}
    {{- end }}
    {{- if .Values.node.isParachain }}
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: relaychain-data
      spec:
        accessModes: [ "ReadWriteOnce" ]
        {{- if or .Values.node.collatorRelayChain.chainData.kubernetesVolumeSnapshot .Values.node.collatorRelayChain.chainData.kubernetesVolumeToClone }}
        dataSource:
          {{- if .Values.node.collatorRelayChain.chainData.kubernetesVolumeSnapshot }}
          name: {{ .Values.node.collatorRelayChain.chainData.kubernetesVolumeSnapshot }}
          kind: VolumeSnapshot
          apiGroup: snapshot.storage.k8s.io
          {{- else }}
          name: {{ .Values.node.collatorRelayChain.chainData.kubernetesVolumeToClone }}
          kind: PersistentVolumeClaim
          {{- end }}
        {{- end }}
        storageClassName: {{ .Values.node.collatorRelayChain.chainData.storageClass }}
        resources:
          requests:
            storage: {{ .Values.node.collatorRelayChain.chainData.volumeSize }}
    {{- if not .Values.node.collatorRelayChain.chainKeystore.mountInMemory.enabled }}
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: relaychain-keystore
      spec:
        accessModes: {{ .Values.node.collatorRelayChain.chainKeystore.accessModes }}
        {{- if or .Values.node.collatorRelayChain.chainKeystore.kubernetesVolumeSnapshot .Values.node.collatorRelayChain.chainKeystore.kubernetesVolumeToClone }}
        dataSource:
          {{- if .Values.node.collatorRelayChain.chainKeystore.kubernetesVolumeSnapshot }}
          name: {{ .Values.node.collatorRelayChain.chainKeystore.kubernetesVolumeSnapshot }}
          kind: VolumeSnapshot
          apiGroup: snapshot.storage.k8s.io
          {{- else }}
          name: {{ .Values.node.collatorRelayChain.chainKeystore.kubernetesVolumeToClone }}
          kind: PersistentVolumeClaim
          {{- end }}
        {{- end }}
        storageClassName: {{ .Values.node.collatorRelayChain.chainKeystore.storageClass }}
        resources:
          requests:
            storage: {{ .Values.node.collatorRelayChain.chainKeystore.volumeSize }}
    {{- end }}
    {{- end }}