chore: release v0.0.25 (seed per-source-IP connection cap) - #46
Merged
Conversation
Carries #45: applySeedOverrides sets max_incoming_connection_attempts to 32. That key caps CONCURRENT connections per source IP rather than attempt rate, and upstream leaves it equal to max_connections (100/100) where it can never bind — so raising the seed total to 1000 had left one source able to hold ~10% of a seed's inbound. Also records that AllowDuplicateIP is inert: sei-tendermint declares and renders it but never reads it. Consumed next by seictl, whose sidecar renders config.toml (sidecar/tasks/config_apply.go) and is therefore what makes this real on a running node, and by sei-k8s-controller to keep its pin in sync. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
PR SummaryLow Risk Overview This diff only rewrites comments in Reviewed by Cursor Bugbot for commit aa85118. Bugbot is set up for automated code reviews on this repo. Configure here. |
Comment-only; no behavior change.
The giga comment described a prior tree state ("previously rendered"), which a
reader cannot verify against the code in front of them. Restated as present fact,
keeping the pin instruction for nodes that must stay on the v2 executor.
The seed cap comment gave the mechanism ("multiplies against the LB's address
count") without the consequence, so it read as benign re-accounting: under SNAT
the ceiling collapses and legitimate peers are dropped, silently, because seed
mode serves no metrics. It now leads with the silent-rejection property, says
outright that this tightens 100 to 32, carries the measured basis for 32 (a fleet
maximum of 8 real peers per address) so the number stays checkable, and records
that the accept path is NodeID-blind and so bounds inbound persistent and
unconditional peers too.
Raised independently by idiomatic-reviewer and prose-steward while blinded.
Ledger: bdchatham-designs designs/seed-node-mode/xreview/sei-config-v0.0.25-rollout.md
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Suggested version: Changes in (empty)
Cutting a Release (and modifying non-markdown files)This PR is modifying both Automatically created GitHub ReleaseA draft GitHub Release has been created. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release bump for #45.
What it carries
applySeedOverridesnow setsmax_incoming_connection_attempts = 32.That key caps concurrent connections per source IP (
conn_tracker.go:33-38), not attempt rate as the name suggests. Upstream sei-tendermint leaves it equal tomax_connectionsat 100/100, where it can never bind — so raising the seed total to 1000 made it the first real constraint while it still carried the inherited 100, letting a single source hold ~10% of a seed's inbound capacity.Also records that
AllowDuplicateIPis inert: sei-tendermint declares it, defaults it, and renders it intoconfig.toml, but never reads it. It documented intent while providing nothing.Delivery
seictl/sidecar/tasks/config_apply.gois the sole renderer of nodeconfig.toml, so the sidecar image is what makes this real on a running node. Chain: this tag → seictl bump + release → controller bump + release → platformimages.sidecarper cluster, controller restart to reload platform config, which rolls that cluster's SeiNodes.Rollout is staged between clusters, with prod last since that cell carries pacific-1 and atlantic-2 alongside arctic-1.
Prerequisite already met
The value is only meaningful where the load balancer preserves client IPs — under SNAT the cap multiplies against the balancer's address count rather than the peers'. arctic-1's
seed-0was in that state; sei-protocol/platform#1440 fixed it and preservation is verified live from two independent sources.seed-1/seed-2were already preserving.🤖 Generated with Claude Code