refactor: use publishers-per-pod in deployments (#21039)

This PR changes `VALIDATOR_PUBLISHERS_PER_VALIDATOR_KEY` to
`VALIDATOR_PUBLISHERS_PER_REPLICA` to reduce the number of overall
publishers used for a test deployment

Fix A-609

Author: alexghr

spartan/CLAUDE.md

@@ -57,7 +57,7 @@ The main entry point is `terraform/deploy-aztec-infra/`:
 **aztec-validator** (extends aztec-node):
 - Wrapper chart with `aztec-node` as dependency (aliased as `validator`)
 - Adds validator-specific ConfigMap (`env.configmap.yaml`)
-- Configures mnemonic, validators-per-node, publisher keys
+- Configures mnemonic, validators-per-node, publishers-per-replica
 
 **aztec-prover-stack**:
 - Multi-component: prover node, broker, and agent replicas
@@ -263,26 +263,31 @@ locals {
 
 **Key derivation via Terraform + `setup-attester-keystore.sh`:**
 
-Each release receives a different `PUBLISHER_KEY_INDEX_START` from Terraform:
+Publishers are allocated **per replica (pod)**, not per attester key. Each release receives a different `PUBLISHER_KEY_INDEX_START` from Terraform:
 
 ```hcl
 # In main.tf custom_settings per release:
 "validator.node.env.PUBLISHER_KEY_INDEX_START" = var.VALIDATOR_PUBLISHER_MNEMONIC_START_INDEX +
-  (idx * (var.VALIDATORS_PER_NODE * var.VALIDATOR_PUBLISHERS_PER_VALIDATOR_KEY * var.VALIDATOR_REPLICAS))
+  (idx * (var.VALIDATOR_PUBLISHERS_PER_REPLICA * var.VALIDATOR_REPLICAS))
 ```
 
-Example with 4 replicas, 12 validators/node, 2 publishers/key, base index 5000:
+Example with 4 replicas, 4 publishers/replica, base index 5000:
 - Primary (idx=0): `PUBLISHER_KEY_INDEX_START = 5000`
-- HA-1 (idx=1): `PUBLISHER_KEY_INDEX_START = 5000 + (1 * 12 * 2 * 4) = 5096`
+- HA-1 (idx=1): `PUBLISHER_KEY_INDEX_START = 5000 + (1 * 4 * 4) = 5016`
 
 At runtime, `setup-attester-keystore.sh` calculates publisher indices:
 
 ```bash
 # POD_INDEX extracted from pod name (validator-0 → 0, validator-1 → 1, etc.)
-PUBLISHER_KEY_INDEX=$((POD_INDEX * VALIDATORS_PER_NODE * PUBLISHERS_PER_VALIDATOR_KEY + PUBLISHER_KEY_INDEX_START))
+PUBLISHER_KEY_INDEX=$((POD_INDEX * VALIDATOR_PUBLISHERS_PER_REPLICA + PUBLISHER_KEY_INDEX_START))
 ```
 
-This ensures each release uses non-overlapping publisher key ranges.
+The keystore uses **schema v2** with a top-level `publisher` array shared by all validators on the pod:
+```json
+{"schemaVersion": 2, "publisher": ["0x1", "0x2", "0x3", "0x4"], "validators": [{"attester": "..."}]}
+```
+
+This ensures each release uses non-overlapping publisher key ranges while decoupling publisher count from attester count.
 
 **HA coordination:**
 - Both releases connect to shared PostgreSQL via `VALIDATOR_HA_DATABASE_URL`

spartan/aztec-keystore/templates/batchjob.yaml

@@ -33,7 +33,7 @@ spec:
               NODES="{{ .Values.attesters.nodeCount }}"
               HA_COUNT="{{ .Values.attesters.haCount }}"
               ATTESTERS_PER_NODE="{{ .Values.attesters.attestersPerNode }}"
-              PUBLISHERS_PER_VALIDATOR_KEY="{{ .Values.publishers.perValidatorKey }}"
+              VALIDATOR_PUBLISHERS_PER_REPLICA="{{ .Values.publishers.perReplica }}"
               ATTESTER_KEY_INDEX_START="{{ .Values.attesters.mnemonicStartIndex }}"
               PUBLISHER_KEY_INDEX_START="{{ .Values.publishers.mnemonicStartIndex }}"
               PROVER_COUNT=1
@@ -73,29 +73,27 @@ spec:
                   printf '%s' "$addr" >> "$ADDR_FILE"
                 done
 
-                # Publishers: start index per node, then pack by validator j and publisher p
-                pub_base=$((PUBLISHER_KEY_INDEX_START + i * ATTESTERS_PER_NODE * PUBLISHERS_PER_VALIDATOR_KEY))
-                for ((j=0;j<ATTESTERS_PER_NODE;j++)); do
-                  for ((p=0;p<PUBLISHERS_PER_VALIDATOR_KEY;p++)); do
-                    pub_idx=$((pub_base + j * PUBLISHERS_PER_VALIDATOR_KEY + p))
-                    ppk="$(cast wallet private-key --mnemonic "$MNEMONIC" --mnemonic-index "$pub_idx")"
-                    paddr="$(cast wallet address --private-key $ppk)"
-
-                    # write keystore file-separated entries
-                    [[ $j -gt 0 || $p -gt 0 ]] && echo '---' >> "$PUB_KS_FILE"
-                    printf 'type: file-raw\nkeyType: SECP256K1\nprivateKey: %s\n' "$ppk" >> "$PUB_KS_FILE"
-
-                    # write addresses CSV per node
-                    if [[ $j -gt 0 || $p -gt 0 ]]; then printf ',' >> "$PUB_ADDR_FILE"; fi
-                    printf '%s' "$paddr" >> "$PUB_ADDR_FILE"
-                  done
+                # Publishers: flat pool per replica (shared by all attesters on the node)
+                pub_base=$((PUBLISHER_KEY_INDEX_START + i * VALIDATOR_PUBLISHERS_PER_REPLICA))
+                for ((p=0;p<VALIDATOR_PUBLISHERS_PER_REPLICA;p++)); do
+                  pub_idx=$((pub_base + p))
+                  ppk="$(cast wallet private-key --mnemonic "$MNEMONIC" --mnemonic-index "$pub_idx")"
+                  paddr="$(cast wallet address --private-key $ppk)"
+
+                  # write keystore file-separated entries
+                  [[ $p -gt 0 ]] && echo '---' >> "$PUB_KS_FILE"
+                  printf 'type: file-raw\nkeyType: SECP256K1\nprivateKey: %s\n' "$ppk" >> "$PUB_KS_FILE"
+
+                  # write addresses CSV per node
+                  [[ $p -gt 0 ]] && printf ',' >> "$PUB_ADDR_FILE"
+                  printf '%s' "$paddr" >> "$PUB_ADDR_FILE"
                 done
 
                 echo "Generated config for attesters on node $i"
               done
 
               # Generate HA publisher keys (separate key ranges for each HA release)
-              PUBLISHERS_PER_STS=$((NODES * ATTESTERS_PER_NODE * PUBLISHERS_PER_VALIDATOR_KEY))
+              PUBLISHERS_PER_STS=$((NODES * VALIDATOR_PUBLISHERS_PER_REPLICA))
 
               for ((ha=0;ha<HA_COUNT;ha++)); do
                 HA_PUB_KS_FILE=/shared/publishers/keystores/ha_${ha}.yaml

spartan/aztec-keystore/values.yaml

@@ -27,7 +27,7 @@ attesters:
     name: "" # if empty name will be generated based on Release.Name
 
 publishers:
-  perValidatorKey: 1
+  perReplica: 4
   mnemonicStartIndex: 5000
   keyStoreSecret:
     create: true

spartan/aztec-node/scripts/setup-attester-keystore.sh

@@ -2,7 +2,7 @@
 set -eu
 
 VALIDATORS_PER_NODE=${VALIDATORS_PER_NODE:-1}
-PUBLISHERS_PER_VALIDATOR_KEY=${PUBLISHERS_PER_VALIDATOR_KEY:-1}
+VALIDATOR_PUBLISHERS_PER_REPLICA=${VALIDATOR_PUBLISHERS_PER_REPLICA:-4}
 
 # We get the index in the config map from the pod name, which will have the service index within it
 # For multiple validators per node, we need to multiply the pod index by VALIDATORS_PER_NODE
@@ -11,8 +11,8 @@ KEY_INDEX=$((POD_INDEX * VALIDATORS_PER_NODE))
 # Add the index to the start index to get the private key index
 PRIVATE_KEY_INDEX=$((KEY_INDEX_START + KEY_INDEX))
 
-# Calculate publisher key starting index for this pod
-PUBLISHER_KEY_INDEX=$((POD_INDEX * VALIDATORS_PER_NODE * PUBLISHERS_PER_VALIDATOR_KEY + PUBLISHER_KEY_INDEX_START))
+# Calculate publisher key starting index for this pod (flat per-replica pool)
+PUBLISHER_KEY_INDEX=$((POD_INDEX * VALIDATOR_PUBLISHERS_PER_REPLICA + PUBLISHER_KEY_INDEX_START))
 
 WEB3_SIGNER_URL=${WEB3_SIGNER_URL:-""}
 
@@ -25,7 +25,7 @@ echo "PUBLISHER_KEY_INDEX: $PUBLISHER_KEY_INDEX"
 echo "WEB3_SIGNER_URL: ${WEB3_SIGNER_URL}"
 # Specific for validators that can hold multiple keys on one node
 echo "VALIDATORS_PER_NODE: ${VALIDATORS_PER_NODE}"
-echo "PUBLISHERS_PER_VALIDATOR_KEY: ${PUBLISHERS_PER_VALIDATOR_KEY}"
+echo "VALIDATOR_PUBLISHERS_PER_REPLICA: ${VALIDATOR_PUBLISHERS_PER_REPLICA}"
 echo "MNEMONIC: $(echo $MNEMONIC | cut -d' ' -f1-2)..."
 
 private_keys=()
@@ -43,13 +43,11 @@ for ((i = 0; i < VALIDATORS_PER_NODE; i++)); do
   addresses+=("$address")
 done
 
-# Generate publisher keys
+# Generate publisher keys (shared pool for this replica)
 publisher_private_keys=()
 publisher_addresses=()
 
-total_publishers=$((VALIDATORS_PER_NODE * PUBLISHERS_PER_VALIDATOR_KEY))
-
-for ((i = 0; i < total_publishers; i++)); do
+for ((i = 0; i < VALIDATOR_PUBLISHERS_PER_REPLICA; i++)); do
   current_pub_index=$((PUBLISHER_KEY_INDEX + i))
   pub_private_key=$(cast wallet private-key "$MNEMONIC" --mnemonic-index $current_pub_index)
   pub_address=$(cast wallet address --private-key $pub_private_key)
@@ -59,24 +57,31 @@ for ((i = 0; i < total_publishers; i++)); do
 done
 
 remoteSigner=""
-attesters=()
 publishers=()
 
 if [ -n "$WEB3_SIGNER_URL" ]; then
   remoteSigner=$(jq -n '{remoteSignerUrl: $url}' --arg url "$WEB3_SIGNER_URL")
-  attesters=(${addresses[*]})
   publishers=(${publisher_addresses[*]})
 else
   remoteSigner="null"
-  attesters=(${private_keys[*]})
   # Without web3signer, use private keys for publishers
   publishers=(${publisher_private_keys[*]})
 fi
 
 export KEY_STORE_DIRECTORY="/shared/config/keys"
 mkdir -p "$KEY_STORE_DIRECTORY"
 
-# Build validators array with multiple entries
+# Build top-level publisher array (shared by all validators on this replica)
+publishers_json="["
+for ((p = 0; p < VALIDATOR_PUBLISHERS_PER_REPLICA; p++)); do
+  if [ $p -gt 0 ]; then
+    publishers_json+=","
+  fi
+  publishers_json+="\"${publishers[$p]}\""
+done
+publishers_json+="]"
+
+# Build validators array with multiple entries (no per-validator publishers)
 validators_json="["
 for ((v = 0; v < VALIDATORS_PER_NODE; v++)); do
   if [ $v -gt 0 ]; then
@@ -90,34 +95,23 @@ for ((v = 0; v < VALIDATORS_PER_NODE; v++)); do
     attester="${private_keys[$v]}"
   fi
 
-  # Get the publisher keys for this validator
-  validator_publishers="["
-  for ((p = 0; p < PUBLISHERS_PER_VALIDATOR_KEY; p++)); do
-    if [ $p -gt 0 ]; then
-      validator_publishers+=","
-    fi
-    pub_index=$((v * PUBLISHERS_PER_VALIDATOR_KEY + p))
-    validator_publishers+="\"${publishers[$pub_index]}\""
-  done
-  validator_publishers+="]"
-
-
   validators_json+="{
     \"attester\": \"$attester\",
     \"coinbase\": \"$attester\",
-    \"publisher\": $validator_publishers,
     \"feeRecipient\": \"0x0000000000000000000000000000000000000000000000000000000000000000\"
   }"
 done
 validators_json+="]"
 
-# Create final JSON structure
+# Create final JSON structure (schema v2 with top-level publisher array)
 jq -n --argjson remoteSigner "$remoteSigner" \
       --argjson validators "$validators_json" \
+      --argjson publisher "$publishers_json" \
 '{
-  schemaVersion: 1,
+  schemaVersion: 2,
   remoteSigner: $remoteSigner,
+  publisher: $publisher,
   validators: $validators
 }' > "$KEY_STORE_DIRECTORY/attesters.json"
 
-echo "Generated configuration for $VALIDATORS_PER_NODE validators with $PUBLISHERS_PER_VALIDATOR_KEY publishers each"
+echo "Generated configuration for $VALIDATORS_PER_NODE validators with $VALIDATOR_PUBLISHERS_PER_REPLICA shared publishers per replica"

spartan/aztec-validator/templates/env.configmap.yaml

@@ -6,5 +6,5 @@ metadata:
     {{- include "chart.labels" . | nindent 4 }}
 data:
   VALIDATORS_PER_NODE: {{ .Values.validator.validatorsPerNode | quote }}
-  PUBLISHERS_PER_VALIDATOR_KEY: {{ .Values.validator.publishersPerValidatorKey | default 1 | quote }}
+  VALIDATOR_PUBLISHERS_PER_REPLICA: {{ .Values.validator.publishersPerReplica | default 4 | quote }}
   WEB3_SIGNER_URL: {{ .Values.validator.web3signerUrl | default "" | quote }}

spartan/aztec-validator/values.yaml

@@ -14,7 +14,7 @@ validator:
   mnemonic: "test test test test test test test test test test test junk"
   mnemonicStartIndex: 2000
   validatorsPerNode: 1
-  publishersPerValidatorKey: 2
+  publishersPerReplica: 4
   publisherMnemonicStartIndex: 7000
 
   persistence:

spartan/environments/alpha-net.env

@@ -39,7 +39,7 @@ OTEL_COLLECTOR_ENDPOINT=REPLACE_WITH_GCP_SECRET
 
 VALIDATOR_REPLICAS=12
 VALIDATORS_PER_NODE=4
-PUBLISHERS_PER_VALIDATOR_KEY=2
+VALIDATOR_PUBLISHERS_PER_REPLICA=4
 VALIDATOR_PUBLISHER_MNEMONIC_START_INDEX=5000
 VALIDATOR_RESOURCE_PROFILE="2-core-dedicated"
 

spartan/environments/devnet.env

@@ -52,7 +52,7 @@ AZTEC_TARGET_COMMITTEE_SIZE=1
 VALIDATOR_MNEMONIC_START_INDEX=$((1 + MNEMONIC_INDEX_OFFSET))
 VALIDATOR_INDICES=$(seq -s ',' $VALIDATOR_MNEMONIC_START_INDEX $((VALIDATOR_MNEMONIC_START_INDEX + TOTAL_VALIDATORS - 1)))
 VALIDATOR_PUBLISHER_MNEMONIC_START_INDEX=$((5000 + MNEMONIC_INDEX_OFFSET))
-PUBLISHERS_PER_VALIDATOR_KEY=1
+VALIDATOR_PUBLISHERS_PER_REPLICA=8
 SEQ_MIN_TX_PER_BLOCK=0
 SEQ_MAX_TX_PER_BLOCK=32
 

spartan/environments/five-tps-long-epoch.env

@@ -25,7 +25,7 @@ OTEL_COLLECTOR_ENDPOINT=REPLACE_WITH_GCP_SECRET
 
 VALIDATOR_REPLICAS=12
 VALIDATORS_PER_NODE=4
-PUBLISHERS_PER_VALIDATOR_KEY=2
+VALIDATOR_PUBLISHERS_PER_REPLICA=4
 VALIDATOR_PUBLISHER_MNEMONIC_START_INDEX=5000
 VALIDATOR_RESOURCE_PROFILE="2-core-dedicated"
 

spartan/environments/five-tps-short-epoch.env

@@ -25,7 +25,7 @@ OTEL_COLLECTOR_ENDPOINT=REPLACE_WITH_GCP_SECRET
 
 VALIDATOR_REPLICAS=12
 VALIDATORS_PER_NODE=4
-PUBLISHERS_PER_VALIDATOR_KEY=2
+VALIDATOR_PUBLISHERS_PER_REPLICA=4
 VALIDATOR_PUBLISHER_MNEMONIC_START_INDEX=5000
 VALIDATOR_RESOURCE_PROFILE="2-core-dedicated"