Node Identity and Configuration

When installing a node on an Aptos network, the installation steps require you to work with identities and configurations. This document describes how to interpret the terms identity and configuration, and presents a description of the identity YAML files.

Concept

This section presents a mental-model view of an identity and configuration. It is meant to help make the node installation process easy.

The terms identity and configuration should be understood in the following way:

• The terms validator node, fullnode, and validator fullnode refer to the machine (physical or virtual).
• The terms operator, owner and voter refer to the persona.
• A machine has both an identity and a configuration. They are defined in separate YAML files. A persona's identity and configuration are combined into a single YAML file.

Machine

Identity

Machine identity is defined in a YAML file. An identity is established by means of keys. A machine identity YAML contains only private keys. Moreover, an identity YAML always contains the associated blockchain account address.

A machine identity YAML has the string identity in its name. For example:

• validator-identity.yaml contains the private keys for the validator node.
• validator-full-node-identity.yaml contains the private keys for validator fullnode and public fullnode.

Hence, if you are looking for your machine’s private keys, look for YAML filenames with identity in them.

Configuration

Machine configuration is also defined in a YAML file. A machine configuration YAML never contains any key, public or private. For example, the configuration YAMLs validator.yaml, fullnode.yaml, docker-compose.yaml and docker-compose-fullnode.yaml do not contain any keys.

As noted earlier, a machine has an identity and a configuration. Hence:

• For a validator node, identity is defined in validator-identity.yaml and configuration is in validator.yaml.
• For a validator fullnode, its identity is defined in validator-full-node-identity.yaml and its configuration is defined in fullnode.yaml.

Persona

Identity and configuration

A persona has a single YAML that combines the persona’s identity and configuration information. For example, for the three personas, owner, operator and voter:

• An owner's identity-configuration is defined in owner.yaml. The owner.yaml contains the public keys and blockchain account addresses for owner, operator and voter, and some owner-specific configuration such as stake amount and commission percentage.
• An operator’s identity-configuration is defined in operator.yaml. The operator.yaml contains public keys and blockchain account address for the operator and some machine configuration information plus a consensus public key and consensus proof of possession key. Only the operator has the consensus keys. Neither the owner nor the voter has the consensus keys.
• A voter's identity-configuration, i.e., voter.yaml, does not exist.

Description of identity YAMLs

This section explains the following key and identity YAML files that are generated during the deployment of a validator node:

• public-keys.yaml.
• private-keys.yaml.
• validator-identity.yaml.
• validator-full-node-identity.yaml.

The following command is used to generate the above key and identity YAMLs. See, for example, Step 10 while using AWS to deploy the validator node, or in Step 10 while using GCP.

aptos genesis generate-keys --output-dir ~/$WORKSPACE/keys

See below a diagram that shows how the identities for the validator node and validator fullnode are derived from the private and public keys:

public-keys.yaml

Example

Click below to see an example YAML configuration:

public-keys.yaml

---
account_address: a5a643aa695fc5f34927386c8d767cddcc0607933f40c89a7ad78de7804965b8
account_public_key: "0x9ccfc50f334064e1b24455029a5bc1646a2c4dd2b1433de1364470692ba6b99b"
consensus_public_key: "0xa7e8334381d9f80d33d70da543aea22c87fe9862ab7df5cbef9ee11b5285b89c56e0e7a3a78c1561833b2d6fa4d9d4bf"
consensus_proof_of_possession: "0xa51dfd1734e581df99c4c637324ee38c3e48e51c61c1e1dd03bd5a84cf1cd5b2fa00e976b9a9ea0e0908f0d53085318c03f24de3ebf86b07ff883effe0142e0d3f24c7c1e36dd198ea4d8eb6f5c5a2f3a188de22720bd1914a9effa6f595de38"
full_node_network_public_key: "0xa6845691a00d6cfdaa9823c4d12b2b5e13d2ecfdc3049d0f2838c805bfd01633"
validator_network_public_key: "0x71f2642aeaa6cbfacf75663cf14d2f6e9e1bd890f9bc1c96900fd225cce01836"

Description

public-keys.yaml	Description
account_address	The Aptos blockchain account address for the operator, i.e., the persona who deploys the validator node.
account_public_key	The public key associated with the blockchain account.
consensus_public_key	Used only by the operator for validation purpose.
consensus_proof_of_possession	Used only by the operator for validation purpose.
full_node_network_public_key	The public key for the fullnode by which a VFN (validator fullnode) or a PFN (public fullnode) is identified in the Aptos network.
validator_network_public_key	The public key for the validator node and by which the validator node is identified in the Aptos network.

private-keys.yaml

Example

Click below to see an example YAML configuration:

private-keys.yaml

---
account_address: a5a643aa695fc5f34927386c8d767cddcc0607933f40c89a7ad78de7804965b8
account_private_key: "0x80478d60a52f54a88e7095abf48b1f4294a335b30f1066cd73768b9b789e833f"
consensus_private_key: "0x4aedda33ef3fd71243eb2a926307d8826c95b9939f88e753d62d9bc577e99916"
full_node_network_private_key: "0x689c11c6e5405219b5eae1312086c801e3a044946afc74429e5157b46fb65b61"
validator_network_private_key: "0xa03ec46b24f2f1066d7980dc13b4baf722ba60c367e498e47a657ba0815adb58"

Description

private-keys.yaml	Description
account_address	The Aptos blockchain account address for the operator, i.e., the persona who deploys the validator node.
account_private_key	The private key associated with the blockchain account.
consensus_private_key	The consensus private key, used only by the operator for validation purpose and for rotating the consensus key.
full_node_network_private_key	The private key for the fullnode. Whoever holds this private key will be able to establish the ownership of the VFN and PFN in the Aptos network.
validator_network_private_key	The private key for the validator node. Whoever holds this private key will be able to establish the ownership of the validator node in the Aptos network.

validator-identity.yaml

Example

Click below to see an example YAML configuration:

validator-identity.yaml

---
account_address: a5a643aa695fc5f34927386c8d767cddcc0607933f40c89a7ad78de7804965b8
account_private_key: "0x80478d60a52f54a88e7095abf48b1f4294a335b30f1066cd73768b9b789e833f"
consensus_private_key: "0x4aedda33ef3fd71243eb2a926307d8826c95b9939f88e753d62d9bc577e99916"
network_private_key: "0xa03ec46b24f2f1066d7980dc13b4baf722ba60c367e498e47a657ba0815adb58"

Description

validator-identity.yaml	Description
account_address	The Aptos blockchain account address for the operator, i.e., the persona who deploys the validator node.
account_private_key	The private key associated with the blockchain account.
consensus_private_key	The consensus private key, used only by the operator for validation purpose and for rotating the consensus key.
network_private_key	The private key for the validator node. Whoever holds this private key will be able to establish the ownership of the validator node in the Aptos network.

validator-full-node-identity.yaml

Example

Click below to see an example YAML configuration:

validator-full-node-identity.yaml

---
account_address: a5a643aa695fc5f34927386c8d767cddcc0607933f40c89a7ad78de7804965b8
network_private_key: "0x689c11c6e5405219b5eae1312086c801e3a044946afc74429e5157b46fb65b61"

Description

validator-full-node-identity.yaml	Description
account_address	The Aptos blockchain account address for the operator, i.e., the persona who deploys the validator node.
network_private_key	The private key for the fullnode. Whoever holds this private key will be able to establish the ownership of the VFN and PFN in the Aptos network.