Implement small service for overriding JWT secrets per EL node #18
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
π Summary
This implements new tool that allows to issue JWT tokens based on multiple secrets
β± Motivation and Context
If we want to send CL requests to multiple ELs, and each of them has a different jwt secret, while keep using nginx for multiplexing, we need a way to dynamically generate JWT tokens for each EL. Engine API mandates that ELs should verify timestamp in JWT token to not be far off from current time[1], so we can't hardcode a JWT token in nginx config. To issue tokens dynamically we can use following options:
auth_requestmodule and write an external service that would issue them.I think the latter is the optimal option considering size of changes required.
This could be implemented in sync-proxy itself, but we don't want to use sync-proxy for multiplexing yet.
This PR also based off #17 to avoid go.mod conflicts
π References
[1] https://github.com/ethereum/execution-apis/blob/main/src/engine/authentication.md#jwt-claims
[2] https://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html
[3] https://github.com/kjdev/nginx-auth-jwt
[4] https://github.com/SkyLothar/lua-resty-jwt
[5] https://nginx.org/en/docs/http/ngx_http_auth_request_module.html
β I have run these commands
make lintmake test-racego mod tidyCONTRIBUTING.md