Benchmarking infra: stellar-rpc-bench S3 bucket + benchmarking devbox #866

TL;DR

Stand up the infrastructure the benchmark CI runs on: the stellar-rpc-bench S3 bucket, its IAM roles, and the compute pattern for benchmark runs. Automated campaigns run on per-run EC2 instances; the instance terminates when the run ends.

Compute model

• Automated campaigns (e2e benchmark campaigns workflow — dispatch, run on EC2, publish results #868) run on a per-run EC2 instance. The existing ec2-leg.yml reusable workflow launches it: m6id-class (currently m6id.2xlarge), 360-minute budget, terminated at run end. No state survives a run. Datasets come from inputs/; results land in results/.
• Hard requirement: local NVMe instance store. Hot-ingest fsync numbers are only meaningful on a real local block device. Network volumes absorb fsync and make ingestion look faster than it is. The run script probes fsync latency at boot and aborts the run on GB/s-class numbers.

S3 bucket + IAM

• s3://stellar-rpc-bench with two prefixes: inputs/ (synthetic ledger datasets) and results/ (campaign output, hive-partitioned bench=/source=/profile=/date=/sha=/run=).
• Bucket config: versioning, SSE (AES256), public-access block, bucket-owner-enforced object ownership.
• Roles:
  • CI agent (instance) role: read inputs/*, write results/*, list results/*.
  • Admin/launcher roles: list inputs/* and results/*, read results/*.
  • rpc-bench-ingest: read-only OIDC role for the results-site repo (stellar-experimental/stellar-rpc-benchmarks). GetObject/ListBucket on results/* only. No write path.
• The terraform is drafted. It needs a PR and an Atlantis apply.

Chain configuration (secrets and variables)

• Results-site repo variable RPC_BENCH_INGEST_ROLE_ARN = the applied role's ARN.
• Dispatch credential for the publish step: a GitHub App with actions: write on the results-site repo, installed on both orgs → RPC_BENCH_APP_ID (variable) + RPC_BENCH_APP_PRIVATE_KEY (secret). A PAT (RPC_BENCH_VIEWER_DISPATCH_PAT) works as a stopgap.
• SLACK_BENCH_WEBHOOK_URL for run notifications. A missing webhook warns; it never fails a green run.

Done when

• Bucket live. Both IAM probes pass: the read-only role reads but cannot write results/; the instance role writes results/ and reads inputs/.
• One end-to-end read test passes: hand-upload a past campaign under results/…, dispatch the results site's ingest.yml at it, confirm the page renders.
• Chain secrets and variables set.
• Synthetic datasets mirrored from their interim GCS location into inputs/ (Synthetic ledger datasets for Phases 1–3 ("golden packs") #867). Not blocking: pack-sourced runs are staged behind the first campaigns.
• Standing devbox retired, after the first fully published automated campaign.

Related

• e2e benchmark campaigns workflow — dispatch, run on EC2, publish results #868 — the campaign workflow that runs on this infra
• Synthetic ledger datasets for Phases 1–3 ("golden packs") #867 — the datasets that land in inputs/
• Run the Phase 1 benchmark campaign — ingest and reads at 2 s blocks #872 / Run the Phase 2 benchmark campaign — ingest and reads at 1 s blocks #873 / Run the Phase 3 benchmark campaign — ingest and reads at 600 ms blocks #874 — the phase campaigns that consume both