Repository navigation
ansible: parallelize large devnet deploys - #173
Merged
Merged
Conversation
Raise concurrent SSH sessions above Ansible's default of five and use the free execution strategy so hosts do not block each other at every task. Document overrides (ANSIBLE_FORKS, -f, ANSIBLE_STRATEGY) in ansible README, group_vars, site.yml, and ansible.cfg comments.
Ansible cannot choose forks from YAML at runtime; run-ansible.sh and ansible-deploy.sh now pass -f from unique enrFields.ip (with min/max clamps via LEAN_ANSIBLE_FORKS_*). ANSIBLE_FORKS still overrides. Add ansible/compute-forks-from-validator-config.sh and document LEAN_VALIDATOR_CONFIG_PATH for ansible-deploy.
Peers verify using public genesis metadata, not other nodes' private keys. Copy *.key files whose enrFields.ip matches ansible_host; fall back to inventory_hostname. Document remote layout in ansible README.
- generate-genesis: hash-sig-cli --export-format ssz; detect existing keys via .ssz - parse-vc: HASH_SIG_* paths point at .ssz files - ansible copy/deploy: stop copying *_pk.json / *_sk.json - README: document SSZ key layout and troubleshooting
g11tech
approved these changes
May 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Faster / more parallel Ansible
strategy = freeand a higher defaultforksinansible/ansible.cfgso hosts are not limited to Ansible’s stockforks=5/ linear lockstep whenansible-playbookis run without wrappers.run-ansible.shandansible-deploy.shpass-fderived from the count of uniqueenrFields.ipvalues in the activevalidator-config.yaml(viaansible/compute-forks-from-validator-config.sh), clamped byLEAN_ANSIBLE_FORKS_MIN(default 5) andLEAN_ANSIBLE_FORKS_MAX(default 128).ANSIBLE_FORKSstill overrides.ansible/README.md,group_vars/all.yml, andsite.ymlcomments.copy-genesis: libp2p keys only where needed
copy-genesis.ymlnow copies*.keyonly for validators collocated on the host (enrFields.ip==ansible_host), not every node’s private key to every server. Peers verify using public genesis metadata (validators.yaml,genesis.ssz, ENRs, etc.); other nodes’ private.keyfiles are not required cluster-wide.[inventory_hostname]so single-node layouts still work.*.keyto exist in the local genesis directory before any remote copy.ansible/README.md: clarified what appears on remotes vs local genesis.Rationale
forksfrom inventory at runtime; wrappers compute-fbefore startup. Unique IP count approximates distinct machines; the minimum avoids-f 1when many validators share one IP.deploy-nodes.yml(per-node sync) andprepare.yml(grouping by IP).How to test
bash -n run-ansible.sh ansible-deploy.sh ansible/compute-forks-from-validator-config.shansible-playbook --syntax-checkonsite.yml/copy-genesis.yml/deploy-nodes.yml/prepare.yml./ansible/compute-forks-from-validator-config.sh ansible-devnet/genesis/validator-config.yamland confirm printed forks match expectations.copy-genesis, on a multi-IP devnet, spot-check two remotes: each should have all shared genesis files but only*.keyfiles for validators on that IP (plus existing per-node hash-sig behavior).