Implement Hyperledger Fabric Peer chart (#6165)

* Implement Hyperledger Fabric Peer chart Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology> * Update naming of variables to conform with hlf-ord Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology> * Move chart from incubator to stable Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology> * Align with persistence best-practices and fix deployment apiVersion Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology> * Move persistent data location to default Hyperledger /var/persistence Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology> * Update PVC Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology> * Update comment for storageClass * Update chart by specifying HLF tools (Fabric-CA explicitly) and removing strict requirement to specify secrets Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology> * Fix issues with spaces Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology>
2026-08-23 22:37:45 +00:00 · 2018-08-18 12:56:03 -07:00
parent 5ef7aca369
commit 76c969d653
11 changed files with 590 additions and 0 deletions
@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
@@ -0,0 +1,19 @@
+apiVersion: v1
+description: Hyperledger Fabric Peer chart (these charts are created by AID:Tech and are currently not directly associated with the Hyperledger project)
+name: hlf-peer
+version: 1.0.8
+appVersion: 1.1.0
+keywords:
+  - blockchain
+  - hyperledger
+  - fabric
+home: http://hyperledger-fabric.readthedocs.io
+sources:
+  - https://github.com/hyperledger/fabric
+maintainers:
+  - name: alexvicegrab
+    email: sasha@aid.technology
+  - name: nicolapaoli
+    email: nicola@aid.technology
+## Icon not included while sorting out trademark question with Hyperledger project
+# icon: https://www.hyperledger.org/wp-content/uploads/2018/04/fabric-logo.png
@@ -0,0 +1,111 @@
+# Hyperledger Fabric Peer
+
+[Hyperledger Fabric Peer](http://hyperledger-fabric.readthedocs.io/) is the node type responsible for endorsing transactions and recording them on the Blockchain for the [Hyperledger](https://www.hyperledger.org/) Fabric permissioned blockchain framework.
+
+## TL;DR;
+
+```bash
+$ helm install stable/hlf-peer
+```
+
+## Introduction
+
+The Hyperledger Fabric Peer can either use a `goleveldb` or a `CouchDB` database for holding the ledger data.
+
+This Peer can receive transaction requests, which it checks and signs, endorsing them. These endorsements can then be sent to the Ordering Service (one or more Orderer nodes), which will package them and return blocks that the Peer can then commit to their own Ledger.
+
+## Prerequisites
+
+- Kubernetes 1.9+
+- PV provisioner support in the underlying infrastructure.
+- Three K8S secrets containing:
+    - the channel transaction for the Peer
+    - the certificate of the Peer Organisation Admin
+    - the private key of the Peer Organisation Admin (needed to join the channel)
+- A running [HLF-CouchDB Chart](https://github.com/kubernetes/charts/tree/master/stable/hlf-couchdb) if you are using the `CouchDB` database.
+
+## Installing the Chart
+
+To install the chart with the release name `peer1`:
+
+```bash
+$ helm install stable/hlf-peer --name peer1
+```
+
+The command deploys the Hyperledger Fabric Peer on the Kubernetes cluster in the default configuration. The [Configuration](#configuration) section lists the parameters that can be configured during installation.
+
+### Custom parameters
+
+Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example:
+
+```bash
+$ helm install stable/hlf-peer --name peer1 --set caUsername=peer1,caPassword=secretpassword
+```
+
+The above command specifies (but does not register/enroll) a Peer username of `peer1` with password `secretpassword`.
+
+Alternatively, a YAML file can be provided while installing the chart. This file specifies values to override those provided in the defualt values.yaml. For example,
+
+```bash
+$ helm install stable/hlf-peer --name peer1 -f my-values.yaml
+```
+
+## Updating the chart
+
+When updating the chart, make sure you provide the `caPassword`, otherwise `helm update` will generate a new random (and invalid) password.
+
+```bash
+$ export CA_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} peer1-hlf-peer -o jsonpath="{.data.CA_PASSWORD}" | base64 --decode; echo)
+$ helm upgrade peer1 stable/hlf-peer --set caPassword=$CA_PASSWORD
+```
+
+## Uninstalling the Chart
+
+To uninstall/delete the `peer1` deployment:
+
+```bash
+$ helm delete peer1
+```
+
+The command removes all the Kubernetes components associated with the chart and deletes the release.
+
+## Configuration
+
+The following table lists the configurable parameters of the Hyperledger Fabric Peer chart and default values.
+
+| Parameter                          | Description                                     | Default                                                    |
+| ---------------------------------- | ---------------------------------------------------- | ---------------------------------------------------------- |
+| `image.repository`                 | `hlf-peer` image repository                          | `hyperledger/fabric-peer`                                  |
+| `image.tag`                        | `hlf-peer` image tag                                 | `x86_64-1.1.0`                                             |
+| `image.pullPolicy`                 | Image pull policy                                    | `IfNotPresent`                                             |
+| `service.portRequest`              | TCP port for requests to Peer                        | `7051`                                                     |
+| `service.portEvent`                | TCP port for event service on Peer                   | `7053`                                                     |
+| `service.type`                     | K8S service type exposing ports, e.g. `ClusterIP`    | `ClusterIP`                                                |
+| `persistence.accessMode`           | Use volume as ReadOnly or ReadWrite                  | `ReadWriteOnce`                                            |
+| `persistence.annotations`          | Persistent Volume annotations                        | `{}`                                                       |
+| `persistence.size`                 | Size of data volume (adjust for production!)         | `1Gi`                                                      |
+| `persistence.storageClass`         | Storage class of backing PVC                         | `default`                                                  |
+| `caAddress`                        | Address of CA to register/enroll with                | `hlf-ca.local`                                             |
+| `caUsername`                       | Username for registering/enrolling with CA           | `peer1`                                                    |
+| `caPassword`                       | Password for registering/enrolling with CA           | Random 24 alphanumeric characters                          |
+| `peer.hlfToolsVersion`             | Which version of HLF tools we use (e.g. CA client)   | `1.1.0`                                                    |
+| `peer.databaseType`                | Database type to use (`goleveldb` or `CouchDB`)      | `goleveldb`                                                |
+| `peer.couchdbInstance              | CouchDB chart name to use `cdb-peer1`                | `cdb-peer1`                                                |
+| `peer.mspID`                       | ID of MSP the Peer belongs to                        | `Org1MSP`                                                  |
+| `secrets.channel`                  | Secret containing Channel tx for peer to create/join | ``                                                         |
+| `secrets.adminCert`                | Secret containing Peer Org admin certificate         | ``                                                         |
+| `secrets.adminCert`                | Secret containing Peer Org admin private key         | ``                                                         |
+| `resources`                        | CPU/Memory resource requests/limits                  | `{}`                                                       |
+| `nodeSelector`                     | Node labels for pod assignment                       | `{}`                                                       |
+| `tolerations`                      | Toleration labels for pod assignment                 | `[]`                                                       |
+| `affinity`                         | Affinity settings for pod assignment                 | `{}`                                                       |
+
+## Persistence
+
+The volume stores the Fabric Peer data and configurations at the `/var/hyperledger` path of the container.
+
+The chart mounts a [Persistent Volume](http://kubernetes.io/docs/user-guide/persistent-volumes/) at this location. The volume is created using dynamic volume provisioning through a PersistentVolumeClaim managed by the chart.
+
+## Feedback and feature requests
+
+This is a work in progress and we are happy to accept feature requests. We are even happier to accept pull requests implementing improvements :-)
@@ -0,0 +1,26 @@
+Run the following commands to...
+1. Get the name of the pod running the Fabric Peer:
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ include "hlf-peer.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+
+2. Get the application URL by running these commands:
+{{- if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "hlf-peer.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get svc -w {{ include "hlf-peer.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "hlf-peer.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ include "hlf-peer.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl port-forward $POD_NAME 8080:7051
+{{- end }}
+
+3. Obtain CA_USERNAME and CA_PASSWORD to register identity with CA:
+  export CA_USERNAME=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "hlf-peer.fullname" . }} -o jsonpath="{.data.CA_USERNAME}" | base64 --decode; echo)
+  export CA_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "hlf-peer.fullname" . }} -o jsonpath="{.data.CA_PASSWORD}" | base64 --decode; echo)
+
+4. Update the chart without resetting a password (requires running step 3):
+  helm upgrade {{ .Release.Name }} stable/hlf-peer --namespace {{ .Release.Namespace }} -f my-values.yaml --set caUsername=$CA_USERNAME,caPassword=$CA_PASSWORD
@@ -0,0 +1,45 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "hlf-peer.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "hlf-peer.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "hlf-peer.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- /*
+Credit: @technosophos
+https://github.com/technosophos/common-chart/
+labels.standard prints the standard Helm labels.
+The standard labels are frequently used in metadata.
+*/ -}}
+{{- define "labels.standard" -}}
+app: {{ include "hlf-peer.name" . }}
+heritage: {{ .Release.Service | quote }}
+release: {{ .Release.Name | quote }}
+chart: {{ include "hlf-peer.chart" . }}
+{{- end -}}
@@ -0,0 +1,40 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "hlf-peer.fullname" . }}--peer
+  labels:
+{{ include "labels.standard" . | indent 4 }}
+data:
+  HLF_TOOLS_BUILD: linux-amd64-{{ .Values.peer.hlfToolsVersion }}
+  CORE_PEER_ADDRESSAUTODETECT: "true"
+  CORE_PEER_NETWORKID: nid1
+  CORE_PEER_ADDRESS: {{ include "hlf-peer.fullname" . }}:7051
+  CORE_PEER_LISTENADDRESS: 0.0.0.0:7051
+  CORE_PEER_EVENTS_ADDRESS: 0.0.0.0:7053
+  CORE_PEER_COMMITTER_ENABLED: "true"
+  CORE_PEER_PROFILE_ENABLED: "true"
+  CORE_PEER_DISCOVERY_PERIOD: 60s
+  CORE_PEER_DISCOVERY_TOUCHPERIOD: 60s
+  CORE_VM_ENDPOINT: unix:///host/var/run/docker.sock
+  CORE_PEER_LOCALMSPID: {{ .Values.peer.mspID }}
+  CORE_PEER_MSPCONFIGPATH: /var/hyperledger/msp
+  CORE_LOGGING_LEVEL: debug
+  CORE_LOGGING_PEER: debug
+  CORE_LOGGING_CAUTHDSL: debug
+  CORE_LOGGING_GOSSIP: debug
+  CORE_LOGGING_LEDGER: debug
+  CORE_LOGGING_MSP: info
+  CORE_LOGGING_POLICIES: debug
+  CORE_LOGGING_GRPC: debug
+  CORE_PEER_TLS_ENABLED: "false"
+  CORE_PEER_TLS_CERTIFICATE: "/var/hyperledger/tls/tls.crt"
+  CORE_PEER_TLS_PRIVATEKEY: "/var/hyperledger/tls/tls.key"
+  CORE_LEDGER_STATE_STATEDATABASE: {{ .Values.peer.databaseType }}
+  # Containers in the same pod share the host
+  {{- if eq .Values.peer.databaseType "CouchDB" }}
+  CORE_LEDGER_STATE_COUCHDBCONFIG_COUCHDBADDRESS: {{ .Values.peer.couchdbInstance }}-hlf-couchdb:5984
+  {{- end }}
+  PEER_CFG_PATH: /var/hyperledger/config
+  FABRIC_CFG_PATH: /var/hyperledger/fabric_cfg
+  GODEBUG: "netdns=go"
+  ADMIN_MSP_PATH: /var/hyperledger/admin_msp
@@ -0,0 +1,183 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "hlf-peer.fullname" . }}
+  labels:
+{{ include "labels.standard" . | indent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ include "hlf-peer.name" . }}
+      release: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+{{ include "labels.standard" . | indent 8 }}
+    spec:
+      volumes:
+        - name: data
+        {{- if .Values.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.existingClaim | default (include "hlf-peer.fullname" .) }}
+        {{- else }}
+          emptyDir: {}
+        {{- end }}
+        - name: dockersocket
+          hostPath:
+            path: /var/run/docker.sock
+        {{- if .Values.secrets.channel }}
+        - name: channel
+          secret:
+            secretName: {{ .Values.secrets.channel }}
+        {{- end }}
+        {{- if .Values.secrets.adminCert }}
+        - name: admin-cert
+          secret:
+            secretName: {{ .Values.secrets.adminCert }}
+        {{- end }}
+        {{- if .Values.secrets.adminKey }}
+        - name: admin-key
+          secret:
+            secretName: {{ .Values.secrets.adminKey }}
+        {{- end }}
+      containers:
+        - name: peer
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: request
+              containerPort: 7051
+              protocol: TCP
+            - name: event
+              containerPort: 7053
+              protocol: TCP
+          # TODO: Add liveness and readiness probes
+          command:
+            - sh
+            - -c
+            - |
+              # To avoid having separate secrets for CouchDB and HLF
+              export CORE_LEDGER_STATE_COUCHDBCONFIG_USERNAME=$COUCHDB_USER
+              export CORE_LEDGER_STATE_COUCHDBCONFIG_PASSWORD=$COUCHDB_PASSWORD
+
+              while [ ! -d /hl_config/admin/admincerts ] || [ -z "$(ls -A /hl_config/admin/admincerts)" ];
+              do
+                echo "\033[0;31m /hl_config/admin/admincerts must contain Peer admin certificates files \033[0m"
+                sleep 60
+              done
+            
+              # Download Fabric CA-client if it does not exist
+              if [ ! -f /bin/fabric-ca-client ]
+              then
+                if [ ! -f /var/hyperledger/fabric-ca-${HLF_TOOLS_BUILD}.tar.gz ]
+                then
+                  # Curl is needed to download Fabric CA-client
+                  apt update
+                  apt install curl -y
+
+                  echo "Downloading Fabric CA-client"
+                  curl -f -s -C - https://nexus.hyperledger.org/content/repositories/releases/org/hyperledger/fabric-ca/hyperledger-fabric-ca/${HLF_TOOLS_BUILD}/hyperledger-fabric-ca-${HLF_TOOLS_BUILD}.tar.gz > /var/hyperledger/fabric-ca-${HLF_TOOLS_BUILD}.tar.gz
+                fi
+                echo "Unzipping Fabric CA-client"
+                tar xzf /var/hyperledger/fabric-ca-${HLF_TOOLS_BUILD}.tar.gz -C /
+              fi
+
+              while [ ! -f ${CORE_PEER_MSPCONFIGPATH}/signcerts/cert.pem ];
+              do
+                echo ">\033[0;35m fabric-ca-client enroll -d -u http://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M ${CORE_PEER_MSPCONFIGPATH} \033[0m"
+                fabric-ca-client enroll -d -u http://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M ${CORE_PEER_MSPCONFIGPATH}
+
+                if [ ! -f ${CORE_PEER_MSPCONFIGPATH}/signcerts/cert.pem ]
+                then
+                  echo ">\033[0;31m Unable to enroll Peer, make sure you have registered them first \(sleeping 180 seconds and re-trying\) \033[0m"
+                  sleep 180
+                fi
+              done
+
+              echo ">\033[0;32m Copy admincerts to ${CORE_PEER_MSPCONFIGPATH}/admincerts \033[0m"
+              mkdir -p ${CORE_PEER_MSPCONFIGPATH}/admincerts
+              cp -L /hl_config/admin/signcerts/* ${CORE_PEER_MSPCONFIGPATH}/admincerts
+
+              echo ">\033[0;32m Setup admin certificates in ${ADMIN_MSP_PATH} \033[0m"
+              mkdir -p ${ADMIN_MSP_PATH} ${ADMIN_MSP_PATH}/cacerts ${ADMIN_MSP_PATH}/intermediatecerts
+              cp -L -r /hl_config/admin/* ${ADMIN_MSP_PATH}
+              cp ${CORE_PEER_MSPCONFIGPATH}/cacerts/* ${ADMIN_MSP_PATH}/cacerts
+              cp ${CORE_PEER_MSPCONFIGPATH}/intermediatecerts/* ${ADMIN_MSP_PATH}/intermediatecerts
+
+              # Create TLS certificate for Peer
+              if [ ! -f ${CORE_PEER_TLS_PRIVATEKEY} ]
+              then
+                echo ">\033[0;35m fabric-ca-client enroll -d --enrollment.profile tls -u http://${CA_USERNAME}:${CA_PASSWORD}@http://${CA_ADDRESS} -M /tmp/tls --csr.hosts {{ include "hlf-peer.fullname" . }} \033[0m"
+                fabric-ca-client enroll -d --enrollment.profile tls -u http://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M /tmp/tls --csr.hosts {{ include "hlf-peer.fullname" . }}
+
+                mkdir -p $(dirname $CORE_PEER_TLS_PRIVATEKEY)
+                cp /tmp/tls/keystore/* $CORE_PEER_TLS_PRIVATEKEY
+                mkdir -p $(dirname $CORE_PEER_TLS_CERTIFICATE)
+                cp /tmp/tls/signcerts/* $CORE_PEER_TLS_CERTIFICATE
+                #rm -rf /tmp/tls
+              fi
+
+              if [ ! -d ${FABRIC_CFG_PATH} ]
+              then
+                mkdir -p ${FABRIC_CFG_PATH}
+                cp -r /etc/hyperledger/fabric/core.yaml ${FABRIC_CFG_PATH}
+                ls ${FABRIC_CFG_PATH}
+              fi
+
+              echo ">\033[0;35m peer node start \033[0m"
+              peer node start
+          envFrom:
+            - secretRef:
+                name: {{ include "hlf-peer.fullname" . }}
+            {{- if eq .Values.peer.databaseType "CouchDB" }}
+            - secretRef:
+                name: {{ .Values.peer.couchdbInstance }}-hlf-couchdb
+            {{- end }}
+            - configMapRef:
+                name: {{ include "hlf-peer.fullname" . }}--peer
+          volumeMounts:
+            - mountPath: /var/hyperledger
+              name: data
+            - mountPath: /host/var/run/docker.sock
+              name: dockersocket
+            {{- if .Values.secrets.channel }}
+            - mountPath: /hl_config/channel
+              name: channel
+            {{- end }}
+            {{- if .Values.secrets.adminCert }}
+            - mountPath: /hl_config/admin/admincerts
+              name: admin-cert
+            - mountPath: /hl_config/admin/signcerts
+              name: admin-cert
+            {{- end }}
+            {{- if .Values.secrets.adminKey }}
+            - mountPath: /hl_config/admin/keystore
+              name: admin-key
+            {{- end }}
+          resources:
+{{ toYaml .Values.resources | indent 12 }}
+    {{- with .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+        ## This affinity is required to ensure reasonable ledger access speeds
+        {{- if eq $.Values.peer.databaseType "CouchDB" }}
+        podAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchExpressions:
+              - key: release
+                operator: In
+                values:
+                - {{ $.Values.peer.couchdbInstance }}
+            topologyKey: "kubernetes.io/hostname"
+        {{- end }}
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
@@ -0,0 +1,25 @@
+{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ include "hlf-peer.fullname" . }}
+  labels:
+{{ include "labels.standard" . | indent 4 }}
+{{- if .Values.persistence.annotations }}
+  annotations:
+{{ toYaml .Values.persistence.annotations | indent 4 }}
+{{- end }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode | quote }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size | quote }}
+  {{- if .Values.persistence.storageClass }}
+  {{- if (eq "-" .Values.persistence.storageClass) }}
+  storageClassName: ""
+  {{- else }}
+  storageClassName: "{{ .Values.persistence.storageClass }}"
+  {{- end }}
+  {{- end }}
+{{- end }}
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "hlf-peer.fullname" . }}
+  labels:
+{{ include "labels.standard" . | indent 4 }}
+type: Opaque
+data:
+  CA_ADDRESS: {{ .Values.caAddress | b64enc | quote }}
+  CA_USERNAME: {{ .Values.caUsername | b64enc | quote }}
+  {{ if .Values.caPassword }}
+  CA_PASSWORD:  {{ .Values.caPassword | b64enc | quote }}
+  {{ else }}
+  CA_PASSWORD: {{ randAlphaNum 24 | b64enc | quote }}
+  {{ end }}
@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "hlf-peer.fullname" . }}
+  labels:
+{{ include "labels.standard" . | indent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.portRequest }}
+      targetPort: 7051
+      protocol: TCP
+      name: request
+    - port: {{ .Values.service.portEvent }}
+      targetPort: 7053
+      protocol: TCP
+      name: event
+  selector:
+    app: {{ include "hlf-peer.name" . }}
+    release: {{ .Release.Name }}
@@ -0,0 +1,85 @@
+# Default values for  hlf-peer.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+image:
+  repository: hyperledger/fabric-peer
+  tag: x86_64-1.1.0
+  pullPolicy: IfNotPresent
+
+service:
+  # Cluster IP or LoadBalancer
+  type: ClusterIP
+  portRequest: 7051
+  portEvent: 7053
+
+persistence:
+  enabled: true
+  annotations: {}
+  ## If defined, storageClassName: <storageClass>
+  ## If set to "-", storageClassName: "", which disables dynamic provisioning
+  ## If undefined (the default) or set to null, no storageClassName spec is
+  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
+  ##   GKE, AWS & OpenStack)
+  ##
+  storageClass: ""
+  accessMode: ReadWriteOnce
+  size: 1Gi
+  # existingClaim: ""
+
+##################################
+## Further configuration options #
+##################################
+## Address of Certificate Authority where O
+caAddress: hlf-ca.local
+## Username for registering/enrolling with CA
+caUsername: peer1
+## Password for registering/enrolling with CA  (defaults to random 24 alphanumeric)
+# caPassword:
+
+peer:
+  # Tools version
+  hlfToolsVersion: 1.1.0
+  # Type of database ("goleveldb" or "CouchDB"):
+  databaseType: goleveldb
+  # If CouchDB is used, which chart holds it
+  couchdbInstance: cdb-peer1
+  ## MSP ID of the Peer
+  mspID: Org1MSP
+
+# Secrets references, empty by default, fill in with your secrets (particularly adminCert) or add Peer Admin certificate manually after launching chart.
+secrets: {}
+  ## This should contain "channel" transaction derived from a configtx.yaml
+  ## configtxgen -profile ComposerChannel -channelID composerchannel -outputCreateChannelTx composerchannel.tx
+  # channel: hlf--channel
+  ## This should contain the Certificate of the Peer Organisation admin
+  ## This is necessary to successfully run the peer
+  # adminCert: hlf--peer-admincert
+  ## This should contain the Private Key of the Peer Organisation admin
+  ## This is necessary to successfully join a channel
+  # adminKey: hlf--peer-adminkey
+
+resources: {}
+  ## We usually recommend not to specify default resources and to leave this as a conscious
+  ## choice for the user. This also increases chances charts run on environments with little
+  ## resources, such as Minikube. If you do want to specify resources, uncomment the following
+  ## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+  # limits:
+  #   cpu: 100m
+  #   memory: 128Mi
+  # requests:
+  #   cpu: 100m
+  #   memory: 128Mi
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+  ## Suggested antiAffinity, as each Peer should be on a separate Node for resilience
+  # podAntiAffinity:
+  #   requiredDuringSchedulingIgnoredDuringExecution:
+  #     - topologyKey: "kubernetes.io/hostname"
+  #       labelSelector:
+  #         matchLabels:
+  #           app: hlf-peer