feat: https for bootnode in devnet

.github/workflows/devnet-deploy.yml

@@ -57,6 +57,7 @@ jobs:
     with:
       namespace: ${{ github.event.inputs.namespace }}
       cluster: ${{ github.event.inputs.cluster }}
+      # This represents the name of the deployment as well.
       values_file: release-devnet.yaml
       aztec_docker_image: ${{ github.event.inputs.aztec_docker_image }}
       deployment_mnemonic_secret_name: ${{ github.event.inputs.deployment_mnemonic_secret_name }}

.github/workflows/network-deploy.yml

@@ -227,6 +227,7 @@ jobs:
               -var="EXTERNAL_ETHEREUM_CONSENSUS_HOST=${{ env.EXTERNAL_ETHEREUM_CONSENSUS_HOST }}" \
               -var="EXTERNAL_ETHEREUM_CONSENSUS_HOST_API_KEY=${{ secrets.SEPOLIA_API_KEY }}" \
               -var="EXTERNAL_ETHEREUM_CONSENSUS_HOST_API_KEY_HEADER=${{ env.GCP_API_KEY_HEADER }}" \
+              ${{ contains(env.VALUES_FILE, 'devnet') && '-var="EXPOSE_HTTPS_BOOTNODE=true"' || '' }} \
               -out=tfplan \
               -lock=${{ inputs.respect_tf_lock }}
           else
@@ -237,6 +238,7 @@ jobs:
               -var="AZTEC_DOCKER_IMAGE=${{ env.AZTEC_DOCKER_IMAGE }}" \
               -var="L1_DEPLOYMENT_MNEMONIC=${{ steps.get-mnemonic.outputs.mnemonic }}" \
               -var="L1_DEPLOYMENT_SALT=${DEPLOYMENT_SALT:-$RANDOM}" \
+              ${{ contains(env.VALUES_FILE, 'devnet') && '-var="EXPOSE_HTTPS_BOOTNODE=true"' || '' }} \
               -out=tfplan \
               -lock=${{ inputs.respect_tf_lock }}
           fi

spartan/aztec-network/templates/boot-node.yaml

@@ -319,6 +319,9 @@ spec:
   # If this is a public network, we want to expose the boot node as a LoadBalancer
   {{- if .Values.network.public }}
   type: LoadBalancer
+  {{- if hasKey .Values.bootNode "fixedExternalIP" }}
+  loadBalancerIP: {{ .Values.bootNode.fixedExternalIP }}
+  {{- end}}
   {{- else }}
   type: ClusterIP
   clusterIP: None
@@ -337,3 +340,33 @@ spec:
     {{- end }}
     - port: {{ .Values.bootNode.service.nodePort }}
       name: node
+---
+{{- if hasKey .Values.bootNode "fixedExternalIP" }}
+apiVersion: networking.gke.io/v1beta2
+kind: ManagedCertificate
+metadata:
+  name: {{ include "aztec-network.fullname" . }}-boot-node-cert
+spec:
+  domains:
+  - aztecprotocol.com
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "aztec-network.fullname" . }}-boot-node-ingress
+  annotations:
+    kubernetes.io/ingress.class: "gce"
+    networking.gke.io/managed-certificates: {{ include "aztec-network.fullname" . }}-boot-node-cert
+spec:
+  rules:
+  - host: aztecprotocol.com
+    http:
+      paths:
+      - path: /*
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: {{ include "aztec-network.fullname" . }}-boot-node
+            port:
+              number: {{ .Values.bootNode.service.nodePort }}
+{{- end }}

spartan/terraform/deploy-release/main.tf

@@ -38,6 +38,14 @@ data "terraform_remote_state" "metrics" {
   }
 }
 
+resource "google_compute_address" "bootnode_ip" {
+  for_each     = var.EXPOSE_HTTPS_BOOTNODE == true ? toset(["${var.RELEASE_NAME}-bootnode-ip"]) : toset([])
+  provider     = google
+  name         = each.key
+  address_type = "EXTERNAL"
+  region       = var.BOOTNODE_IP_REGION
+}
+
 # Aztec Helm release for gke-cluster
 resource "helm_release" "aztec-gke-cluster" {
   provider         = helm.gke-cluster
@@ -104,6 +112,14 @@ resource "helm_release" "aztec-gke-cluster" {
     }
   }
 
+  dynamic "set" {
+    for_each = var.EXPOSE_HTTPS_BOOTNODE == true ? toset(["iterate"]) : toset([])
+    content {
+      name  = "bootNode.fixedExternalIP"
+      value = google_compute_address.bootnode_ip["${var.RELEASE_NAME}-bootnode-ip"].address
+    }
+  }
+
   set {
     name  = "aztec.l1Salt"
     value = var.L1_DEPLOYMENT_SALT

spartan/terraform/deploy-release/variables.tf

@@ -62,3 +62,14 @@ variable "L1_DEPLOYMENT_SALT" {
   type        = string
   default     = ""
 }
+
+variable "EXPOSE_HTTPS_BOOTNODE" {
+  description = "Whether to expose the bootnode with HTTPS"
+  type        = bool
+  default     = false
+}
+
+variable "BOOTNODE_IP_REGION" {
+  default = "us-west1"
+  type    = string
+}