ethereum-optimism/optimism kona-node/v1.10.0

kona-node v1.10.0

on GitHub

Overview

This release removes every subcommand except node, and changes several flags and RPC methods to match op-node. Review the breaking changes before you upgrade. It also adds static peers, makes sequencing with op-conductor safer, and fixes two cases where kona-node's safe chain could diverge from op-node's.

Breaking changes

• Only the node subcommand remains (#23812). The net (p2p, network), bootstore (b, boot, store), registry (r, scr) and info subcommands are removed. Use the opp2p_* RPC methods of a running node, such as opp2p_peers, opp2p_peerCount and opp2p_discoveryTable, in place of net and bootstore. The hardfork schedule that info printed is now logged at startup as a single Hardfork schedule event.
• L1 RPC trust is off by default (#23690). --l1.trust-rpc (KONA_NODE_L1_TRUST_RPC) now defaults to false, as in op-node, so kona-node verifies the hashes of the L1 blocks it fetches. To keep the previous behaviour, set --l1.trust-rpc=true or KONA_NODE_L1_TRUST_RPC=true. Both trust flags now accept an explicit true or false, separated by = or a space. A bare flag means true, and a value given on the command line overrides the environment variable. --l2.trust-rpc still defaults to true.
• --p2p.no-discovery now turns discovery off (#23753). Until now kona-node ignored this flag and its variable, KONA_NODE_P2P_NO_DISCOVERY. With the flag set, the node binds no UDP port, publishes no ENR and ignores its bootnodes. It connects only to static peers, to peers that dial it, and to peers added with opp2p_connectPeer. Remove the flag from any node that should keep discovering peers. Without discovery, the P2P RPC behaves as op-node's does: opp2p_discoveryTable returns a discovery disabled error and opp2p_self has no ENR.
• RPC flags and namespaces removed (#23268). --rpc.ws-enabled, --rpc.dev-enabled and --rpc.no-restart are removed, and kona-node no longer starts if they are given. Remove them from your launch configuration. Their variables, KONA_NODE_RPC_WS_ENABLED, KONA_NODE_RPC_DEV_ENABLED and KONA_NODE_RPC_NO_RESTART, are now ignored. WebSocket is now always served on the RPC port. The ws_subscribe_unsafe_head, ws_subscribe_safe_head, ws_subscribe_finalized_head, dev_subscribe_engine_queue_size and dev_taskQueueLength methods are no longer served. If the RPC server stops, the node now exits rather than restarting the server, so rely on your process supervisor to restart it.
• --sequencer.max-safe-lag removed (#23738). The flag had no effect in kona-node, and kona-node no longer starts if it is given. Remove it from your launch configuration. KONA_NODE_SEQUENCER_MAX_SAFE_LAG is now ignored.
• Starting a sequencer requires the expected unsafe head and conductor leadership (#23581, #23720). admin_startSequencer now takes the expected unsafe-head hash as its parameter, as in op-node. Pass the hash returned by admin_stopSequencer, or the node's current unsafe head. Update any tooling that calls it without a parameter. When a conductor is configured, the start is refused unless this node is the conductor leader. A sequencer with --conductor.rpc set now always starts stopped, regardless of --sequencer.stopped, and waits for op-conductor to start it.
• Stricter peer scoring and banning (#23726). kona-node now refuses to start with peer-scoring parameters that gossipsub rejects, such as a block time under one second. Previously it logged a warning and ran without peer scoring. --p2p.ban.peers now bans peers whose score falls below --p2p.ban.threshold, where previously it had no effect. Peer scores also decay at op-node's rate, about 100 times faster than before, which changes scoring for every node on the default --p2p.scoring light. Check your ban settings before upgrading.

Other changes

Derivation

• kona-node now derives the same L1-info deposit as op-node when a chain's SystemConfig still holds a version-0 scalar with nonzero padding carried over from Bedrock. Previously the block hashes of such a chain diverged from op-node from Ecotone onward (#23727)
• When a safe block is replaced at the same height, for example after an L1 reorg, span-batch overlap checks now compare against the new block. Previously they could use the stale block and accept a batch that op-node drops, which left kona-node's safe chain diverged from op-node's until a restart (#23297)
• New --verifier.l1-confs (KONA_NODE_VERIFIER_L1_CONFS) keeps derivation the given number of blocks behind the L1 head, in validator and sequencer mode, so that L1 reorgs shallower than that no longer trigger a reset. The default is 0, as in op-node (#23696)
• L1 receipts are now fetched with debug_getRawReceipts, falling back to eth_getBlockReceipts when that call fails. Endpoints that don't serve the debug method are detected once and not asked again. Receipt responses are about half the size, and derivation keeps going on endpoints where eth_getBlockReceipts fails (#22553)

Sequencer

• Each sequenced block is now committed to op-conductor before kona-node updates its unsafe head or gossips the block, as op-node does. A rejected or timed-out commit leaves the head unchanged and is retried. Once op-conductor has accepted a block, kona-node never builds or gossips a different block at that height. It retries the accepted block, and shuts down if that block can no longer be applied (#23229, #23720)
• admin_overrideLeader now lets a sequencer resume block production after op-conductor loses quorum: kona-node stops checking leadership and committing to op-conductor until it restarts. conductor_overrideLeader is still needed on op-conductor for leader-gated proxy traffic (#23223)
• --conductor.rpc.timeout now bounds each whole conductor request, including reading the response, so a stalled conductor no longer blocks later admin commands (#23581)
• After a derivation reorg, the sequencer discards a build on the old unsafe head and retries on the new one. Previously it could retry the stale build indefinitely. An Engine API -38002 (invalid forkchoice state) rejection during a build now resets the engine and derivation. Other Engine API rejections are logged at error level, counted in the new kona_node_sequencer_build_rejections_total metric, and retried after one block time (#23624)
• The sequencer now fetches the next block's L1 origin and attributes in the background, so it no longer waits on L1 RPCs between sealing one block and starting the next. A missing or orphaned L1 origin now resets the engine, instead of eventually stalling block production at the max sequencer drift (#23627)
• --sequencer.l1-confs is now respected straight after startup: the sequencer waits until it has seen the L1 head before picking a non-genesis L1 origin (#23639)
• Remote block signing with op-signer now works. Previously the first signing request failed with -32602: non-array args, so a sequencer using op-signer could not gossip blocks. kona-node now sends op-node's V1 signing request, which also works with op-signer servers that don't expose V2 (#23707)

Networking

• New --p2p.static-peers flag (alias --p2p.static, env KONA_NODE_P2P_STATIC_PEERS), which takes a comma-separated list of peer multiaddrs. kona-node dials static peers at startup, and redials disconnected ones every minute and about a second after a disconnect. Static peers are protected from pruning, never banned for their score, and never shared through discovery. On their own they don't turn discovery off. To keep a node such as a sequencer off the public network, combine them with --p2p.no-discovery (#23726, #23753)
• After the unsafe block signer is rotated on L1, gossip signed by the previous signer is accepted for up to three hours, or until a block from the new signer verifies. A node therefore no longer leaves a gap in its unsafe chain when the sequencer switches keys after the rotation. Rotations and blocks accepted from the previous signer are logged at info level (#23626)
• Two peers dialling each other at the same moment no longer fail the connection handshake. On macOS, this also ends about 30 s of AddrInUse redial failures. --p2p.listen.udp 0 now binds a free UDP port and advertises it. The already_dialing, threshold_reached and already_connected series of kona_node_dial_peer_error drop, as kona-node no longer redials peers it is already connected to (#23661, #23726)
• Peer addresses given as /dns* names are now resolved before the blocked IP and subnet check. Every resolved IP is checked, and only checked IPs are dialled. Previously only the first resolved IP was checked, so a dial could reach a blocked IP (#23726)
• If the discovery service stops while the node is running, kona-node now logs an error and exits so the process supervisor can restart it. Previously it kept running without discovery (#23610)

RPC

• New --safedb.path (KONA_NODE_SAFEDB_PATH) records which L1 block each safe head was derived from. kona-node now serves optimism_safeHeadAtL1Block and the pre-interop superroot_atTimestamp from it, with op-node-compatible responses and errors. Nothing is recorded unless the path is set, and the flag cannot be combined with --l2.follow.source (#23583, #23590)
• optimism_syncStatus now reports derivation's L1 origin as current_l1, as op-node does. Previously it reported the L1 head, so a node whose derivation lagged could look synced (#23514)
• The kona_node_rpc_calls metric is replaced by kona_node_rpc_requests_total, kona_node_rpc_errors_total (by method and JSON-RPC error code) and kona_node_rpc_request_duration_seconds. Update dashboards that read the old metric (#23268)

Bug fixes

• When the execution client rejects the unsafe head's forkchoice as INVALID, kona-node now resets and resumes derivation. Previously a validator retried the same head indefinitely before Holocene, and could exit from Holocene onward (#23628)

Full Changelog: kona-node/v1.9.0...kona-node/v1.10.0

🚢 Docker Image:

• https://us-docker.pkg.dev/oplabs-tools-artifacts/images/kona-node:v1.10.0