Commit 821f2f8
chore: cut seictl v0.0.70 (seed per-source-IP connection cap) (#242)
Bumps `sei-config` to **v0.0.25** and cuts **seictl v0.0.70**.
## What this delivers
v0.0.25 sets the seed profile's `max_incoming_connection_attempts` to
**32** — a cap on *concurrent connections per source IP*
(`conn_tracker.go:33-38`), not attempt rate. It had been carrying the
inherited 100 while the seed's `max_connections` is 1000, so one source
could hold ~10% of a seed's inbound slots and ~10 addresses could fill
it.
`sidecar/tasks/config_apply.go` is the sole renderer of node config,
which makes this image the delivery vehicle. Verified end to end —
`DefaultForMode(ModeSeed)` under v0.0.25 renders:
```
max-connections = 1000
max-incoming-connection-attempts = 32
allow-duplicate-ip = true
```
v0.0.25 also carries sei-config#42 (`GigaExecutor` in `baseDefaults`).
## Delivery mechanics — read before rolling this out
`TaskConfigApply` runs on the **init path only**. An update plan carries
only `p2pConfigPatch` (`planner.go:787-796`, and the convention is
stated at `planner.go:68-69` and `:821`). So putting this sidecar into a
cell does **not** re-render config on already-running nodes — a sidecar
bump restarts pods against unchanged on-disk config.
The seeds take the new default by being **deleted and recreated**, which
forces the init path. Verified safe for a seed:
- their p2p Services carry **no `ownerReferences`**, so deleting the
SeiNode does not cascade to the NLB — hostname and therefore the
`NodeID@host` address survive;
- `node_key.json` is a **read-only Secret mount**
(`arctic-1-seed-N-node-key`, mode 0400) overlaying whatever `seid init`
writes, so the NodeID survives the PVC being recreated;
- the 20Gi PVC holds no chain state; the address book rebuilds via PEX.
Ordering matters: the cell's `images.sidecar` must already point at this
image before a seed is recreated, or the new pod renders from the old
sidecar and keeps 100.
## Review
Full T3 `shared-stack` xreview:
`designs/seed-node-mode/xreview/sei-config-v0.0.25-rollout.md` in
`bdchatham-designs` (#130). It returned `OPEN-BLOCKED` against the
*original* rollout plan; this PR is step 2 of the revised plan, which
addresses both blockers.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>1 parent 912dba9 commit 821f2f8
3 files changed
Lines changed: 4 additions & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
16 | 16 | | |
17 | 17 | | |
18 | 18 | | |
19 | | - | |
| 19 | + | |
20 | 20 | | |
21 | 21 | | |
22 | 22 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1852 | 1852 | | |
1853 | 1853 | | |
1854 | 1854 | | |
1855 | | - | |
1856 | | - | |
| 1855 | + | |
| 1856 | + | |
1857 | 1857 | | |
1858 | 1858 | | |
1859 | 1859 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | 1 | | |
2 | | - | |
| 2 | + | |
3 | 3 | | |
0 commit comments