github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add ingress to Peer and fix TLS (#9464)

Browse Source 
* Add ingress to Peer and fix TLS

Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology>

* Add manual integrity test to HLF-Peer

Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology>
This commit is contained in:
Sasha (Alejandro Vicente Grabovetsky)
2018-11-23 08:54:25 -08:00
committed by k8s-ci-robot
parent 4f936da2d8
commit 687d3b3658
14 changed files with 252 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/hlf-peer/Chart.yaml
+2 -2
View File
@@ -1,8 +1,8 @@
apiVersion: v1
description: Hyperledger Fabric Peer chart (these charts are created by AID:Tech and are currently not directly associated with the Hyperledger project)
name: hlf-peer
version: 1.2.0
appVersion: 1.2.0
version: 1.2.3
appVersion: 1.3.0
keywords:
- blockchain
- hyperledger
stable/hlf-peer/README.md
+8
View File
@@ -83,6 +83,11 @@ The following table lists the configurable parameters of the Hyperledger Fabric
| `persistence.annotations` | Persistent Volume annotations | `{}` |
| `persistence.size` | Size of data volume (adjust for production!) | `1Gi` |
| `persistence.storageClass` | Storage class of backing PVC | `default` |
| `ingress.enabled` | If true, Ingress will be created | `false` |
| `ingress.annotations` | Ingress annotations | `{}` |
| `ingress.path` | Ingress path | `/` |
| `ingress.hosts` | Ingress hostnames | `[]` |
| `ingress.tls` | Ingress TLS configuration | `[]` |
| `peer.databaseType` | Database type to use (`goleveldb` or `CouchDB`) | `goleveldb` |
| `peer.couchdbInstance | CouchDB chart name to use `cdb-peer1` | `cdb-peer1` |
| `peer.mspID` | ID of MSP the Peer belongs to | `Org1MSP` |
@@ -95,9 +100,12 @@ The following table lists the configurable parameters of the Hyperledger Fabric
| `secrets.peer.intCaCert` | Int. CA Cert: as 'intermediatecacert.pem' | `` |
| `secrets.peer.tls` | TLS secret: as 'tls.crt' and 'tls.key' | `` |
| `secrets.peer.tlsRootCert` | TLS root CA certificate: as 'cert.pem' | `` |
| `secrets.peer.tlsClient` | TLS client secret: as 'tls.crt' and 'tls.key' | `` |
| `secrets.peer.tlsClientRootCerts` | TLS Client root CA certificate files (any name) | `` |
| `secrets.channel` | Secret containing Channel tx for peer to create/join | `` |
| `secrets.adminCert` | Secret containing Peer Org admin certificate | `` |
| `secrets.adminCert` | Secret containing Peer Org admin private key | `` |
| `secrets.ordTlsRootCert` | Secret containing Orderer TLS root CA certificate | `` |
| `resources` | CPU/Memory resource requests/limits | `{}` |
| `nodeSelector` | Node labels for pod assignment | `{}` |
| `tolerations` | Toleration labels for pod assignment | `[]` |
stable/hlf-peer/templates/configmap--peer.yaml
+13 -6
View File
@@ -7,7 +7,12 @@ metadata:
data:
CORE_PEER_ADDRESSAUTODETECT: "true"
CORE_PEER_NETWORKID: nid1
# If we have an ingress, we set hostname to it
{{- if .Values.ingress.enabled }}
CORE_PEER_ADDRESS: {{ index .Values.ingress.hosts 0 }}:443
{{- else }}
CORE_PEER_ADDRESS: {{ include "hlf-peer.fullname" . }}:7051
{{- end }}
CORE_PEER_LISTENADDRESS: 0.0.0.0:7051
CORE_PEER_EVENTS_ADDRESS: 0.0.0.0:7053
CORE_PEER_COMMITTER_ENABLED: "true"
@@ -26,13 +31,14 @@ data:
CORE_LOGGING_POLICIES: debug
CORE_LOGGING_GRPC: debug
CORE_PEER_TLS_ENABLED: {{ .Values.peer.tls.server.enabled | quote }}
CORE_PEER_TLS_CERT_FILE: "/var/hyperledger/tls/tls.crt"
CORE_PEER_TLS_KEY_FILE: "/var/hyperledger/tls/tls.key"
CORE_PEER_TLS_ROOTCERT_FILE: "/var/hyperledger/msp_tls/cert.pem"
CORE_PEER_TLS_CERT_FILE: "/var/hyperledger/tls/server/pair/tls.crt"
CORE_PEER_TLS_KEY_FILE: "/var/hyperledger/tls/server/pair/tls.key"
CORE_PEER_TLS_ROOTCERT_FILE: "/var/hyperledger/tls/server/cert/cacert.pem"
CORE_PEER_TLS_CLIENTAUTHREQUIRED: {{ .Values.peer.tls.client.enabled | quote }}
CORE_PEER_TLS_CLIENTROOTCAS_FILES: "/var/hyperledger/msp_tls/cert.pem"
CORE_PEER_TLS_CLIENTCERT_FILE: "/var/hyperledger/tls/tls.crt"
CORE_PEER_TLS_CLIENTKEY_FILE: "/var/hyperledger/tls/tls.key"
# This is fixed prior to starting the peer
CORE_PEER_TLS_CLIENTROOTCAS_FILES: "/var/hyperledger/tls/client/cert/*"
CORE_PEER_TLS_CLIENTCERT_FILE: "/var/hyperledger/tls/client/pair/tls.crt"
CORE_PEER_TLS_CLIENTKEY_FILE: "/var/hyperledger/tls/client/pair/tls.key"
CORE_LEDGER_STATE_STATEDATABASE: {{ .Values.peer.databaseType | quote }}
# Containers in the same pod share the host
{{- if eq .Values.peer.databaseType "CouchDB" }}
@@ -42,3 +48,4 @@ data:
FABRIC_CFG_PATH: /var/hyperledger/fabric_cfg
GODEBUG: "netdns=go"
ADMIN_MSP_PATH: /var/hyperledger/admin_msp
ORD_TLS_PATH: /var/hyperledger/tls/ord/cert
stable/hlf-peer/templates/deployment.yaml
+48 -13
View File
@@ -58,7 +58,17 @@ spec:
{{- if .Values.secrets.peer.tlsRootCert }}
- name: tls-rootcert
secret:
secretName: {{ .Values.secrets.peer.tlsRootCert }}
secretName: {{ .Values.secrets.peer.tlsRootCert }}
{{- end }}
{{- if .Values.secrets.peer.tlsClient }}
- name: tls-client
secret:
secretName: {{ .Values.secrets.peer.tlsClient }}
{{- end }}
{{- if .Values.secrets.peer.tlsClientRootCert }}
- name: tls-clientrootcert
secret:
secretName: {{ .Values.secrets.peer.tlsClientRootCert }}
{{- end }}
{{- if .Values.secrets.channel }}
- name: channel
@@ -75,15 +85,10 @@ spec:
secret:
secretName: {{ .Values.secrets.adminKey }}
{{- end }}
{{- if .Values.secrets.caPeerServerTls }}
- name: ca-peer-server-tls
{{- if .Values.secrets.ordTlsRootCert }}
- name: ord-tls-rootcert
secret:
secretName: {{ .Values.secrets.caPeerServerTls }}
{{- end }}
{{- if .Values.secrets.caOrdServerTls }}
- name: ca-ord-server-tls
secret:
secretName: {{ .Values.secrets.caOrdServerTls }}
secretName: {{ .Values.secrets.ordTlsRootCert }}
{{- end }}
containers:
- name: peer
@@ -96,9 +101,22 @@ spec:
- name: event
containerPort: 7053
protocol: TCP
# TODO: Add liveness and readiness probes
livenessProbe:
exec:
command:
- ls
- /var/hyperledger
initialDelaySeconds: 5
periodSeconds: 5
# TODO: Improve readiness probe (ideally `ps aux | awk '$11=="orderer"'`)
readinessProbe:
exec:
command:
- ls
- /var/hyperledger
initialDelaySeconds: 15
command:
- sh
- bash
- -c
- |
# To avoid having separate secrets for CouchDB and HLF
@@ -124,6 +142,11 @@ spec:
ls ${FABRIC_CFG_PATH}
fi
if [ $CORE_PEER_TLS_CLIENTAUTHREQUIRED ]
then
export CORE_PEER_TLS_CLIENTROOTCAS_FILES=$(ls -d $CORE_PEER_TLS_CLIENTROOTCAS_FILES)
fi
echo ">\033[0;35m peer node start \033[0m"
peer node start
envFrom:
@@ -159,13 +182,25 @@ spec:
name: intcacert
{{- end }}
{{- if .Values.secrets.peer.tls }}
- mountPath: /var/hyperledger/msp_tls
- mountPath: /var/hyperledger/tls/server/pair
name: tls
{{- end }}
{{- if .Values.secrets.peer.tlsRootCert }}
- mountPath: /var/hyperledger/msp_tls
- mountPath: /var/hyperledger/tls/server/cert
name: tls-rootcert
{{- end }}
{{- if .Values.secrets.peer.tlsClient }}
- mountPath: /var/hyperledger/tls/client/pair
name: tls-client
{{- end }}
{{- if .Values.secrets.peer.tlsClientRootCert }}
- mountPath: /var/hyperledger/tls/client/cert
name: tls-clientrootcert
{{- end }}
{{- if .Values.secrets.ordTlsRootCert }}
- mountPath: /var/hyperledger/tls/ord/cert
name: ord-tls-rootcert
{{- end }}
{{- if .Values.secrets.channel }}
- mountPath: /hl_config/channel
name: channel
stable/hlf-peer/templates/ingress.yaml
+35
View File
@@ -0,0 +1,35 @@
{{- if .Values.ingress.enabled -}}
{{- $fullName := include "hlf-peer.fullname" . -}}
{{- $ingressPath := .Values.ingress.path -}}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: {{ $fullName }}
labels:
{{ include "labels.standard" . | indent 4 }}
{{- with .Values.ingress.annotations }}
annotations:
{{ toYaml . | indent 4 }}
{{- end }}
spec:
{{- if .Values.ingress.tls }}
tls:
{{- range .Values.ingress.tls }}
- hosts:
{{- range .hosts }}
- {{ . }}
{{- end }}
secretName: {{ .secretName }}
{{- end }}
{{- end }}
rules:
{{- range .Values.ingress.hosts }}
- host: {{ . }}
http:
paths:
- path: {{ $ingressPath }}
backend:
serviceName: {{ $fullName }}
servicePort: request
{{- end }}
{{- end }}
stable/hlf-peer/tests/README.md
+59
View File
@@ -0,0 +1,59 @@
# Chart testing
> Eventually this will be replaced with an integration test, likely running with `pytest`
Commands should be run from the root folder of the repository.
## Peer
### Set up cryptographic material
#### Peer Org admin
ORG_CERT=$(ls ./hlf-peer/tests/fixtures/crypto/admin/*.pem)
kubectl create secret generic -n test hlf--peer-admincert --from-file=cert.pem=$ORG_CERT
ORG_KEY=$(ls ./hlf-peer/tests/fixtures/crypto/admin/*_sk)
kubectl create secret generic -n test hlf--peer-adminkey --from-file=key.pem=$ORG_KEY
CA_CERT=$(ls ./hlf-peer/tests/fixtures/crypto/ca/*.pem)
kubectl create secret generic -n test hlf--peer-cacert --from-file=cacert.pem=$CA_CERT
#### Peer node
NODE_CERT=$(ls ./hlf-peer/tests/fixtures/crypto/peer/*.pem)
kubectl create secret generic -n test hlf--peer0-idcert --from-file=cert.pem=$NODE_CERT
NODE_KEY=$(ls ./hlf-peer/tests/fixtures/crypto/peer/*_sk)
kubectl create secret generic -n test hlf--peer0-idkey --from-file=key.pem=$NODE_KEY
#### Genesis block
kubectl create secret generic -n test hlf--channel --from-file=./hlf-peer/tests/fixtures/crypto/mychannel.tx
### Install
Install helm chart of peer.
helm install ./hlf-peer -n peer0 --namespace test -f ./hlf-peer/tests/values/peer.yaml
export PEER_POD=$(kubectl get pods --namespace test -l "app=hlf-peer,release=peer0" -o jsonpath="{.items[0].metadata.name}")
Check that server is running
kubectl logs -n test $PEER_POD | grep 'Starting peer'
### Cleanup
Delete charts we installed
helm delete --purge peer0
Delete the secrets we created
kubectl -n test delete secret hlf--peer-admincert hlf--peer-adminkey hlf--peer-cacert hlf--peer0-idcert hlf--peer0-idkey hlf--channel
stable/hlf-peer/tests/fixtures/crypto/admin/478bb28c12190a41a8eb361c6815cf91a0d0ec291f0977f562661a67b1c250dd_sk
Vendored
+5
View File
@@ -0,0 +1,5 @@
-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgn3Rvk8JAivQEgxEV
1uweQa3KtYKx2iY9lP7F+r1/yZOhRANCAAQmbMcHL/4/LTL9/CmIe9JCO9kcyyrb
XHhjaUMvc7lBIcx7C/FNccEFL9dbU6LI3/m3Nss0tD4PZh2v/oKOZiw6
-----END PRIVATE KEY-----
stable/hlf-peer/tests/fixtures/crypto/admin/Admin@test.svc.cluster.local-cert.pem
Vendored
+14
View File
@@ -0,0 +1,14 @@
-----BEGIN CERTIFICATE-----
MIICKzCCAdKgAwIBAgIRAORmUlx9x7GR5NlM9z1zP4QwCgYIKoZIzj0EAwIwfzEL
MAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNhbiBG
cmFuY2lzY28xHzAdBgNVBAoTFnRlc3Quc3ZjLmNsdXN0ZXIubG9jYWwxIjAgBgNV
BAMTGWNhLnRlc3Quc3ZjLmNsdXN0ZXIubG9jYWwwHhcNMTgxMTE2MTYzNjAwWhcN
MjgxMTEzMTYzNjAwWjBhMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p
YTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzElMCMGA1UEAwwcQWRtaW5AdGVzdC5z
dmMuY2x1c3Rlci5sb2NhbDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCZsxwcv
/j8tMv38KYh70kI72RzLKttceGNpQy9zuUEhzHsL8U1xwQUv11tTosjf+bc2yzS0
Pg9mHa/+go5mLDqjTTBLMA4GA1UdDwEB/wQEAwIHgDAMBgNVHRMBAf8EAjAAMCsG
A1UdIwQkMCKAIBsOEs+gj9C70F4Z1n29Dr7eLzY0h+h3uXpopgxnsQuyMAoGCCqG
SM49BAMCA0cAMEQCIAwfowKCEW2f33N4vy6HIj5LhqVRbZivbH4pydf1El0+AiBC
UUnlvLofHi2IseM7WQx5UC78Hv7FGrQr1Sut4P+GBQ==
-----END CERTIFICATE-----
stable/hlf-peer/tests/fixtures/crypto/ca/ca.test.svc.cluster.local-cert.pem
Vendored
+15
View File
@@ -0,0 +1,15 @@
-----BEGIN CERTIFICATE-----
MIICXDCCAgKgAwIBAgIRAN6p+R5Yq31fzE+ZBoxSoFowCgYIKoZIzj0EAwIwfzEL
MAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNhbiBG
cmFuY2lzY28xHzAdBgNVBAoTFnRlc3Quc3ZjLmNsdXN0ZXIubG9jYWwxIjAgBgNV
BAMTGWNhLnRlc3Quc3ZjLmNsdXN0ZXIubG9jYWwwHhcNMTgxMTE2MTYzNjAwWhcN
MjgxMTEzMTYzNjAwWjB/MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p
YTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEfMB0GA1UEChMWdGVzdC5zdmMuY2x1
c3Rlci5sb2NhbDEiMCAGA1UEAxMZY2EudGVzdC5zdmMuY2x1c3Rlci5sb2NhbDBZ
MBMGByqGSM49AgEGCCqGSM49AwEHA0IABBPFAO2F4wnI3zMWpLwbjBwDo+wYFR9r
WqjlXD79JFLUmOVimoergoXiGKk3Bufw4Ou7wtErCdmBsSSVxDIqNhSjXzBdMA4G
A1UdDwEB/wQEAwIBpjAPBgNVHSUECDAGBgRVHSUAMA8GA1UdEwEB/wQFMAMBAf8w
KQYDVR0OBCIEIBsOEs+gj9C70F4Z1n29Dr7eLzY0h+h3uXpopgxnsQuyMAoGCCqG
SM49BAMCA0gAMEUCIQCyD/XQi0NafSRf/NgYQexzLkh2w/PAtiWaE9wSazvRKgIg
UPvJDyI9nQGlXaXhSrA6m/09QJSQCKd3shS1Nu1YXwA=
-----END CERTIFICATE-----
stable/hlf-peer/tests/fixtures/crypto/mychannel.tx
Vendored
BIN
View File
Binary file not shown.
stable/hlf-peer/tests/fixtures/crypto/peer/22de23eeb2b0259b6b739a6954408780beb9e614858c879c75df2e6d04325bf4_sk
Vendored
+5
View File
@@ -0,0 +1,5 @@
-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgYxXOQsbAWgGe3jTk
mCXvrW/nQgdDTx6w8qR8RTccREWhRANCAAQfU3F6LblDCfBfAbQX/Znk9SUXjG0i
LyWVNIULoj+PzcC/5vRD18NcGkVn2gGZq9VnF4vEjv6Lv4yp87/GcUmW
-----END PRIVATE KEY-----
stable/hlf-peer/tests/fixtures/crypto/peer/peer0-hlf-peer.test.svc.cluster.local-cert.pem
Vendored
+14
View File
@@ -0,0 +1,14 @@
-----BEGIN CERTIFICATE-----
MIICNTCCAdugAwIBAgIRAK5bmw+kGL1WnGMKedQz3LEwCgYIKoZIzj0EAwIwfzEL
MAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNhbiBG
cmFuY2lzY28xHzAdBgNVBAoTFnRlc3Quc3ZjLmNsdXN0ZXIubG9jYWwxIjAgBgNV
BAMTGWNhLnRlc3Quc3ZjLmNsdXN0ZXIubG9jYWwwHhcNMTgxMTE2MTYzNjAwWhcN
MjgxMTEzMTYzNjAwWjBqMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p
YTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEuMCwGA1UEAxMlcGVlcjAtaGxmLXBl
ZXIudGVzdC5zdmMuY2x1c3Rlci5sb2NhbDBZMBMGByqGSM49AgEGCCqGSM49AwEH
A0IABB9TcXotuUMJ8F8BtBf9meT1JReMbSIvJZU0hQuiP4/NwL/m9EPXw1waRWfa
AZmr1WcXi8SO/ou/jKnzv8ZxSZajTTBLMA4GA1UdDwEB/wQEAwIHgDAMBgNVHRMB
Af8EAjAAMCsGA1UdIwQkMCKAIBsOEs+gj9C70F4Z1n29Dr7eLzY0h+h3uXpopgxn
sQuyMAoGCCqGSM49BAMCA0gAMEUCIQCjLN4bBUuCtxD8hOg1ZYp7CgCNQn8YHj2K
zocqBCWI1wIgOnOrhlNq2LZwT1YA0vRwP3ljibsTEzJaCyVfY4ra/Zk=
-----END CERTIFICATE-----
stable/hlf-peer/tests/values/peer.yaml
+11
View File
@@ -0,0 +1,11 @@
peer:
mspID: PeerMSP
secrets:
peer:
cert: hlf--peer0-idcert
key: hlf--peer0-idkey
caCert: hlf--peer-cacert
channel: hlf--channel
adminCert: hlf--peer-admincert
adminKey: hlf--peer-adminkey
stable/hlf-peer/values.yaml
+23 -2
View File
@@ -4,7 +4,7 @@
image:
repository: hyperledger/fabric-peer
tag: 1.2.0
tag: 1.3.0
pullPolicy: IfNotPresent
service:
@@ -13,6 +13,21 @@ service:
portRequest: 7051
portEvent: 7053
ingress:
enabled: false
annotations: {}
# kubernetes.io/ingress.class: nginx
# nginx.ingress.kubernetes.io/ssl-redirect: "true"
# nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
# certmanager.k8s.io/cluster-issuer: "letsencrypt-staging"
path: /
hosts:
- hlf-peer.local
tls: []
# - secretName: hlf-peer-tls
# hosts:
# - hlf-peer.local
persistence:
enabled: true
annotations: {}
@@ -60,7 +75,11 @@ secrets:
## TLS secret, saved under keys 'tls.crt' and 'tls.key' (to conform with K8S nomenclature)
# tls: hlf--peer1-tls
## TLS root CA certificate saved under key 'cert.pem'
# tlsRootCert: hlf--peer1-tlsrootcert
# tlsRootCert: hlf--peer-tlsrootcert
## TLS client root CA certificates saved under any names (as there may be multiple)
# tlsClient: hlf--peer1-tls
## TLS client root CA certificates saved under any names (as there may be multiple)
# tlsClientRootCerts: hlf--ord-tlsrootcert
## This should contain "channel" transaction derived from a configtx.yaml
## configtxgen -profile ComposerChannel -channelID composerchannel -outputCreateChannelTx composerchannel.tx
# channel: hlf--channel
@@ -70,6 +89,8 @@ secrets:
## This should contain the Private Key of the Peer Organisation admin
## This is necessary to successfully join a channel
# adminKey: hlf--peer-adminkey
## This should include the Orderer TLS 'cacert.pem'
# ordTlsRootCert: hlf--ord-tlsrootcert
resources: {}
## We usually recommend not to specify default resources and to leave this as a conscious