Frontend PV Support for ripple and Fireblocks

contracts/fireblocks/frontend/terraform.tfvars.template

@@ -2,5 +2,12 @@
 FRONTEND_PLUGIN_IMAGE="registry.control12.dap.local/oso/dapcs-fireblocks-oso-plugins@sha256:"
 FIREBLOCKS_AGENT_IMAGE="registry.control12.dap.local/oso/fireblocks-agent@sha256:"
 
+# Update volume name if it is different from default value frontend_vol
+# VOLUME_NAME = ""
+
+# Frontend Workload Volume Configuration
+WORKLOAD_VOL_SEED="fb_frontend_seed1"
+WORKLOAD_VOLUME_PREV_SEED=""
+
 # Fireblocks
 REFRESH_TOKEN=""

contracts/fireblocks/frontend/user_data_common.tf

@@ -17,6 +17,18 @@
 locals {
   workload_template = {
     "type" : "workload",
-    "images": {}
+    "images": {},
+    "volumes": {
+        (var.VOLUME_NAME): merge(
+         {
+            "filesystem": "ext4",
+            "mount": "/data",
+            "seed": var.WORKLOAD_VOL_SEED,
+        },
+       length(var.WORKLOAD_VOLUME_PREV_SEED) > 0 ?
+       { previousSeed = var.WORKLOAD_VOLUME_PREV_SEED } :
+       {}
+       )
+    }
   }
 }

contracts/fireblocks/frontend/variables.tf

@@ -48,3 +48,20 @@ variable "REFRESH_TOKEN" {
   type        = string
   description = "Fireblocks refresh token (in base64)"
 }
+
+variable "VOLUME_NAME" {
+  type = string
+  description = "Volume name"
+  default = "frontend_vol"
+}
+
+variable "WORKLOAD_VOL_SEED" {
+  type        = string
+  description = "Workload volume encryption seed"
+}
+
+variable "WORKLOAD_VOLUME_PREV_SEED" {
+  type        = string
+  description = "Previous Workload Seed phrase for conductor disk volume."
+  default     = ""
+}

contracts/ripple/frontend_plugin/terraform.tfvars.template

@@ -1,6 +1,13 @@
 # Container Configuration
 FRONTEND_PLUGIN_IMAGE="registry.control12.dap.local/oso/oso-ripple-plugins@sha256:"
 
+# Update volume name if it is different from default value frontend_vol
+# VOLUME_NAME = ""
+
+# Frontend Workload Volume Configuration
+WORKLOAD_VOL_SEED="ripple_frontend_seed1"
+WORKLOAD_VOLUME_PREV_SEED=""
+
 # Ripple
 HMZ_AUTH_HOSTNAME=""
 HMZ_API_HOSTNAME=""

contracts/ripple/frontend_plugin/user_data_common.tf

@@ -16,6 +16,18 @@
 locals {
   workload_template = {
     "type" : "workload",
-    "images": {}
+    "images": {},
+    "volumes": {
+        (var.VOLUME_NAME): merge(
+         {
+            "filesystem": "ext4",
+            "mount": "/mnt/data",
+            "seed": var.WORKLOAD_VOL_SEED,
+        },
+       length(var.WORKLOAD_VOLUME_PREV_SEED) > 0 ?
+       { previousSeed = var.WORKLOAD_VOLUME_PREV_SEED } :
+       {}
+       )
+    }
   }
 }

contracts/ripple/frontend_plugin/variables.tf

@@ -69,3 +69,20 @@ variable "TOKEN_EXP" {
   description = "Ripple configured bearer token expiration (#h#m#s format)"
   default = "4h0m0s"
 }
+
+variable "VOLUME_NAME" {
+  type = string
+  description = "Volume name"
+  default = "frontend_vol"
+}
+
+variable "WORKLOAD_VOL_SEED" {
+  type = string
+  description = "Workload volume encryption seed"
+}
+
+variable "WORKLOAD_VOLUME_PREV_SEED" {
+  type        = string
+  description = "Previous Workload Seed phrase for conductor disk volume."
+  default     = ""
+}

fireblocks-plugin/src/fb/plugin.py

@@ -62,6 +62,9 @@ class FBPlugin(PluginProtocol):
     class Config(BaseSettings):
         hot_mode: bool = False
         min_keys: int = 1
+        workload_vol_seed: str = ""
+        workload_volume_prev_seed: str = ""
+        volume_name: str = "frontend_vol"
         model_config = SettingsConfigDict(env_prefix="FB__")
 
     internalViews = {

ripple-plugin/src/oso_ripple_plugins/frontend_plugin/frontend_plugin_manager.py

@@ -62,6 +62,11 @@ def __init__(self):
 
         self.seed = os.environ.get("SEED", "")
 
+        # Persistent volume configuration
+        self.workload_vol_seed = os.environ.get("WORKLOAD_VOL_SEED", "")
+        self.workload_volume_prev_seed = os.environ.get("WORKLOAD_VOLUME_PREV_SEED", "")
+        self.volume_name = os.environ.get("VOLUME_NAME", "frontend_vol")
+
         self.root_cert_b64 = os.environ.get("ROOTCERT")
         with tempfile.NamedTemporaryFile(delete=False) as root_cert_file:
             self.verify = self._write_root_cert(root_cert_file)