mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
[HLF-Ord] Support Cryptogen as well as Fabric CA by attaching secrets (#8791)
* [HLF-Ord] Support Cryptogen as well as Fabric CA by attaching crypto material as secrets Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology> * [HLF-Ord] Remove secret Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology>
This commit is contained in:
Sasha (Alejandro Vicente Grabovetsky)
committed by
k8s-ci-robot
k8s-ci-robot
parent
d93ad7c41d
commit
81aa6ca3f1
@@ -1,7 +1,7 @@
|
||||
apiVersion: v1
|
||||
description: Hyperledger Fabric Orderer chart (these charts are created by AID:Tech and are currently not directly associated with the Hyperledger project)
|
||||
name: hlf-ord
|
||||
version: 1.1.1
|
||||
version: 1.2.1
|
||||
appVersion: 1.2.0
|
||||
keywords:
|
||||
- blockchain
|
||||
|
||||
+26
-14
@@ -29,7 +29,8 @@ Learn more about deploying a production ready consensus framework based on Apach
|
||||
|
||||
- Kubernetes 1.9+
|
||||
- PV provisioner support in the underlying infrastructure.
|
||||
- Two K8S secrets containing:
|
||||
- K8S secrets containing:
|
||||
- the crypto-materials (e.g. signcert, key, cacert, and optionally intermediatecert, CA credentials)
|
||||
- the genesis block for the Orderer
|
||||
- the certificate of the Orderer Organisation Admin
|
||||
- A running [Kafka Chart](https://github.com/kubernetes/charts/tree/master/incubator/kafka) if you are using the `kafka` consensus mechanism.
|
||||
@@ -49,11 +50,9 @@ The command deploys the Hyperledger Fabric Orderer on the Kubernetes cluster in
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example:
|
||||
|
||||
```bash
|
||||
$ helm install stable/hlf-ord --name ord1 --set caUsername=ord1,caPassword=secretpassword
|
||||
$ helm install stable/hlf-ord --name ord1 --set ord.mspID=MyMSP
|
||||
```
|
||||
|
||||
The above command specifies (but does not register/enroll) an Orderer username of `ord1` with password `secretpassword`.
|
||||
|
||||
Alternatively, a YAML file can be provided while installing the chart. This file specifies values to override those provided in the default values.yaml. For example,
|
||||
|
||||
```bash
|
||||
@@ -62,11 +61,10 @@ $ helm install stable/hlf-ord --name ord1 -f my-values.yaml
|
||||
|
||||
## Updating the chart
|
||||
|
||||
When updating the chart, make sure you provide the `caPassword`, otherwise `helm update` will generate a new random (and invalid) password.
|
||||
To update the chart run:
|
||||
|
||||
```bash
|
||||
$ export CA_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} ord1-hlf-ord -o jsonpath="{.data.CA_PASSWORD}" | base64 --decode; echo)
|
||||
$ helm upgrade ord1 stable/hlf-ord --set caPassword=$CA_PASSWORD
|
||||
$ helm upgrade ord1 stable/hlf-ord -f my-values.yaml
|
||||
```
|
||||
|
||||
## Uninstalling the Chart
|
||||
@@ -94,15 +92,19 @@ The following table lists the configurable parameters of the Hyperledger Fabric
|
||||
| `persistence.annotations` | Persistent Volume annotations | `{}` |
|
||||
| `persistence.size` | Size of data volume (adjust for production!) | `1Gi` |
|
||||
| `persistence.storageClass` | Storage class of backing PVC | `default` |
|
||||
| `caAddress` | Address of CA to register/enroll with | `hlf-ca.local` |
|
||||
| `caUsername` | Username for registering/enrolling with CA | `ord1` |
|
||||
| `caPassword` | Password for registering/enrolling with CA | Random 24 alphanumeric characters |
|
||||
| `ord.hlfToolsVersion` | Version of Hyperledger Fabric tools used | `1.1.0` |
|
||||
| `ord.type` | Type of Orderer (`solo` or `kafka`) | `solo` |
|
||||
| `ord.mspID` | ID of MSP the Orderer belongs to | `OrdererMSP` |
|
||||
| `secrets.genesis` | Secret containing Genesis Block for orderer | `hlf--genesis` |
|
||||
| `secrets.adminCert` | Secret containing Orderer Org admin certificate | `hlf--ord-admincert` |
|
||||
| `secrets.caServerTls` | Secret containing CA Server TLS certificate | `ca--tls` |
|
||||
| `ord.tls.server.enabled` | Do we enable server-side TLS? | `false` |
|
||||
| `ord.tls.client.enabled` | Do we enable client-side TLS? | `false` |
|
||||
| `secrets.ord.cred` | Credentials: 'CA_USERNAME' and 'CA_PASSWORD' | `` |
|
||||
| `secrets.ord.cert` | Certificate: as 'cert.pem' | `` |
|
||||
| `secrets.ord.key` | Private key: as 'key.pem' | `` |
|
||||
| `secrets.ord.caCert` | CA Cert: as 'cacert.pem' | `` |
|
||||
| `secrets.ord.intCaCert` | Int. CA Cert: as 'intermediatecacert.pem' | `` |
|
||||
| `secrets.ord.tls` | TLS secret: as 'tls.crt' and 'tls.key' | `` |
|
||||
| `secrets.ord.tlsRootCert` | TLS root CA certificate: as 'cert.pem' | `` |
|
||||
| `secrets.genesis` | Secret containing Genesis Block for orderer | `` |
|
||||
| `secrets.adminCert` | Secret containing Orderer Org admin certificate | `` |
|
||||
| `resources` | CPU/Memory resource requests/limits | `{}` |
|
||||
| `nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `tolerations` | Toleration labels for pod assignment | `[]` |
|
||||
@@ -114,6 +116,16 @@ The volume stores the Fabric Orderer data and configurations at the `/var/hyperl
|
||||
|
||||
The chart mounts a [Persistent Volume](http://kubernetes.io/docs/user-guide/persistent-volumes/) at this location. The volume is created using dynamic volume provisioning through a PersistentVolumeClaim managed by the chart.
|
||||
|
||||
## Upgrading from version 1.1.x
|
||||
|
||||
Previous versions of this chart performed enrollment with the Fabric CA directly from the pod. This prevented the possibility of using development cryptographic material (certificates and keys) from Cryptogen or the usage of other CA mechanisms.
|
||||
|
||||
Instead, crypto-material and CA credentials are stored separately as secrets.
|
||||
|
||||
If you used the former type of chart, you will need to obtain the relevant credentials and cryptographic material from the running pod, and save it externally to a set of secrets, whose names you will need to feed into the chart, under the `secrets.ord` section.
|
||||
|
||||
An example upgrade procedure is described in `UPGRADE_1-1-x.md`
|
||||
|
||||
## Feedback and feature requests
|
||||
|
||||
This is a work in progress and we are happy to accept feature requests. We are even happier to accept pull requests implementing improvements :-)
|
||||
|
||||
@@ -0,0 +1,90 @@
|
||||
# Upgrading from version 1.1.x and up.
|
||||
|
||||
## Secret creation
|
||||
|
||||
Specify which release we want to work with:
|
||||
|
||||
```
|
||||
export RELEASE='ord1'
|
||||
export NAMESPACE='default'
|
||||
export POD_NAME=$(kubectl -n ${NAMESPACE} get pods -l "app=hlf-ord,release=${RELEASE}" -o jsonpath="{.items[0].metadata.name}")
|
||||
```
|
||||
|
||||
### Cred secret
|
||||
|
||||
Get relevant credentials
|
||||
|
||||
```
|
||||
export CA_USERNAME=$(kubectl -n ${NAMESPACE} get secret ${RELEASE}-hlf-ord -o jsonpath="{.data.CA_USERNAME}" | base64 --decode; echo)
|
||||
export CA_PASSWORD=$(kubectl -n ${NAMESPACE} get secret ${RELEASE}-hlf-ord -o jsonpath="{.data.CA_PASSWORD}" | base64 --decode; echo)
|
||||
```
|
||||
|
||||
Save credentials in secret
|
||||
|
||||
```
|
||||
kubectl -n ${NAMESPACE} create secret generic hlf--${RELEASE}-cred --from-literal=CA_USERNAME=$CA_USERNAME --from-literal=CA_PASSWORD=$CA_PASSWORD
|
||||
```
|
||||
|
||||
### Cert secret
|
||||
|
||||
Get content of certificate file and save it as a secret:
|
||||
|
||||
```
|
||||
export CONTENT=$(kubectl -n ${NAMESPACE} exec ${POD_NAME} -- cat /var/hyperledger/msp/signcerts/cert.pem)
|
||||
kubectl -n ${NAMESPACE} create secret generic hlf--${RELEASE}-idcert --from-literal=cert.pem=$CONTENT
|
||||
```
|
||||
|
||||
### Key secret
|
||||
|
||||
Get content of key file and save it as a secret:
|
||||
|
||||
```
|
||||
export CONTENT=$(kubectl -n ${NAMESPACE} exec ${POD_NAME} -- bash -c 'cat /var/hyperledger/msp/keystore/*_sk')
|
||||
kubectl -n ${NAMESPACE} create secret generic hlf--${RELEASE}-idkey --from-literal=key.pem=$CONTENT
|
||||
```
|
||||
|
||||
### CA cert secret
|
||||
|
||||
Get content of key file and save it as a secret:
|
||||
|
||||
```
|
||||
export CONTENT=$(kubectl -n ${NAMESPACE} exec ${POD_NAME} -- bash -c 'cat /var/hyperledger/msp/cacerts/*.pem')
|
||||
kubectl -n ${NAMESPACE} create secret generic hlf--${RELEASE}-cacert --from-literal=cacert.pem=$CONTENT
|
||||
```
|
||||
|
||||
### Intermediate CA cert secret
|
||||
|
||||
Get content of key file and save it as a secret (if you have used an intermediate CA):
|
||||
|
||||
```
|
||||
export CONTENT=$(kubectl -n ${NAMESPACE} exec ${POD_NAME} -- bash -c 'cat /var/hyperledger/msp/intermediatecerts/*.pem')
|
||||
kubectl -n ${NAMESPACE} create secret generic hlf--${RELEASE}-intcacert --from-literal=intermediatecacert.pem=$CONTENT
|
||||
```
|
||||
|
||||
## Move old MSP material out
|
||||
|
||||
We can move the crypto material we created earlier to another directory in our Persistent Volume, so we can rollback if needed.
|
||||
|
||||
```
|
||||
kubectl -n ${NAMESPACE} exec ${POD_NAME} -- mv /var/hyperledger/msp /var/hyperledger/msp_old
|
||||
```
|
||||
|
||||
## Upgrade the chart
|
||||
|
||||
You will need to update the chart to the latest version by editing the relevant values files:
|
||||
|
||||
```
|
||||
secrets:
|
||||
ord:
|
||||
cred: hlf--ord1-cred
|
||||
cert: hlf--ord1-idcert
|
||||
key: hlf--ord1-idkey
|
||||
caCert: hlf--ord1-cacert
|
||||
intCaCert: hlf--ord1-caintcert # If applicable
|
||||
```
|
||||
|
||||
And running:
|
||||
|
||||
```
|
||||
helm upgrade ${RELEASE} ./hlf-ord
|
||||
```
|
||||
@@ -5,8 +5,6 @@ metadata:
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
data:
|
||||
## Environmental variable defining which version of tools to obtain (for fabric-ca-client)
|
||||
HLF_TOOLS_BUILD: linux-amd64-{{ .Values.ord.hlfToolsVersion }}
|
||||
## Location where fabric-ca-client configuration is saved
|
||||
FABRIC_CA_CLIENT_HOME: /var/hyperledger/fabric-ca-client
|
||||
## Orderer defaults
|
||||
@@ -16,17 +14,20 @@ data:
|
||||
ORDERER_GENERAL_BATCHTIMEOUT: 1s
|
||||
ORDERER_GENERAL_BATCHSIZE_MAXMESSAGECOUNT: "10"
|
||||
ORDERER_GENERAL_MAXWINDOWSIZE: "1000"
|
||||
ORDERER_GENERAL_ORDERERTYPE: {{ .Values.ord.type }}
|
||||
ORDERER_GENERAL_ORDERERTYPE: {{ .Values.ord.type | quote }}
|
||||
ORDERER_GENERAL_LISTENADDRESS: 0.0.0.0
|
||||
ORDERER_GENERAL_LISTENPORT: "7050"
|
||||
ORDERER_GENERAL_LOGLEVEL: debug
|
||||
ORDERER_GENERAL_LOCALMSPDIR: /var/hyperledger/msp
|
||||
ORDERER_GENERAL_LOCALMSPID: {{ .Values.ord.mspID }}
|
||||
ORDERER_GENERAL_LOCALMSPID: {{ .Values.ord.mspID | quote }}
|
||||
ORDERER_GENERAL_GENESISMETHOD: file
|
||||
ORDERER_GENERAL_GENESISFILE: /hl_config/genesis/genesis.block
|
||||
ORDERER_GENERAL_GENESISPROFILE: initial
|
||||
ORDERER_GENERAL_TLS_ENABLED: "false"
|
||||
ORDERER_GENERAL_TLS_CERTIFICATE: "/var/hyperledger/tls/tls.crt"
|
||||
ORDERER_GENERAL_TLS_PRIVATEKEY: "/var/hyperledger/tls/tls.key"
|
||||
ORDERER_GENERAL_TLS_ENABLED: {{ .Values.ord.tls.server.enabled | quote }}
|
||||
ORDERER_GENERAL_TLS_CERTIFICATE: "/var/hyperledger/msp_tls/tls.crt"
|
||||
ORDERER_GENERAL_TLS_PRIVATEKEY: "/var/hyperledger/msp_tls/tls.key"
|
||||
ORDERER_GENERAL_TLS_ROOTCAS: "/var/hyperledger/msp_tls/cert.pem"
|
||||
ORDERER_GENERAL_TLS_CLIENTAUTHREQUIRED: {{ .Values.ord.tls.client.enabled | quote }}
|
||||
ORDERER_GENERAL_TLS_CLIENTROOTCAS: "/var/hyperledger/msp_tls/cert.pem"
|
||||
GODEBUG: "netdns=go"
|
||||
ADMIN_MSP_PATH: /var/hyperledger/admin_msp
|
||||
|
||||
@@ -10,6 +10,10 @@ spec:
|
||||
matchLabels:
|
||||
app: {{ include "hlf-ord.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
# Ensure we allow our pod to be unavailable, so we can upgrade
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
@@ -23,6 +27,36 @@ spec:
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.ord.cert }}
|
||||
- name: id-cert
|
||||
secret:
|
||||
secretName: {{ .Values.secrets.ord.cert }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.ord.key }}
|
||||
- name: id-key
|
||||
secret:
|
||||
secretName: {{ .Values.secrets.ord.key }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.ord.caCert }}
|
||||
- name: cacert
|
||||
secret:
|
||||
secretName: {{ .Values.secrets.ord.caCert }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.ord.intCaCert }}
|
||||
- name: intcacert
|
||||
secret:
|
||||
secretName: {{ .Values.secrets.ord.intCaCert }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.ord.tls }}
|
||||
- name: tls
|
||||
secret:
|
||||
secretName: {{ .Values.secrets.ord.tls }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.ord.tlsRootCert }}
|
||||
- name: tls-rootcert
|
||||
secret:
|
||||
secretName: {{ .Values.secrets.ord.tlsRootCert }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.genesis }}
|
||||
- name: genesis
|
||||
secret:
|
||||
@@ -33,7 +67,6 @@ spec:
|
||||
secret:
|
||||
secretName: {{ .Values.secrets.adminCert }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.secrets.caServerTls }}
|
||||
- name: ca-server-tls
|
||||
secret:
|
||||
@@ -53,9 +86,9 @@ spec:
|
||||
- -c
|
||||
- |
|
||||
|
||||
while [ ! -d /hl_config/admin/admincerts ] || [ -z "$(ls -A /hl_config/admin/admincerts)" ];
|
||||
while [ ! -d /var/hyperledger/admin_msp/admincerts ] || [ -z "$(ls -A /var/hyperledger/admin_msp/admincerts)" ];
|
||||
do
|
||||
echo "\033[0;31m /hl_config/admin/admincerts must contain Ord admin certificates files \033[0m"
|
||||
echo "\033[0;31m /var/hyperledger/admin_msp/admincerts must contain Ord admin certificates files \033[0m"
|
||||
sleep 60
|
||||
done
|
||||
|
||||
@@ -65,78 +98,24 @@ spec:
|
||||
sleep 60
|
||||
done
|
||||
|
||||
# Download Fabric CA-client if it does not exist
|
||||
if [ ! -f /bin/fabric-ca-client ]
|
||||
then
|
||||
if [ ! -f /var/hyperledger/fabric-ca-${HLF_TOOLS_BUILD}.tar.gz ]
|
||||
then
|
||||
# Curl is needed to download Fabric CA-client
|
||||
apt update
|
||||
apt install curl -y
|
||||
|
||||
echo "Downloading Fabric CA-client"
|
||||
curl -f -s -C - https://nexus.hyperledger.org/content/repositories/releases/org/hyperledger/fabric-ca/hyperledger-fabric-ca/${HLF_TOOLS_BUILD}/hyperledger-fabric-ca-${HLF_TOOLS_BUILD}.tar.gz > /var/hyperledger/fabric-ca-${HLF_TOOLS_BUILD}.tar.gz
|
||||
fi
|
||||
echo "Unzipping Fabric CA-client"
|
||||
tar xzf /var/hyperledger/fabric-ca-${HLF_TOOLS_BUILD}.tar.gz -C /
|
||||
fi
|
||||
|
||||
while [ ! -f ${ORDERER_GENERAL_LOCALMSPDIR}/signcerts/cert.pem ];
|
||||
while [ ! -d ${ORDERER_GENERAL_LOCALMSPDIR}/signcerts ];
|
||||
do
|
||||
{{- if .Values.secrets.caServerTls }}
|
||||
echo ">\033[0;35m fabric-ca-client enroll -d -u https://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M ${ORDERER_GENERAL_LOCALMSPDIR} --tls.certfiles /hl_config/ca_server/tls/tls.crt \033[0m"
|
||||
fabric-ca-client enroll -d -u https://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M ${ORDERER_GENERAL_LOCALMSPDIR} --tls.certfiles /hl_config/ca_server/tls/tls.crt
|
||||
{{- else }}
|
||||
echo ">\033[0;35m fabric-ca-client enroll -d -u http://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M ${ORDERER_GENERAL_LOCALMSPDIR} \033[0m"
|
||||
fabric-ca-client enroll -d -u http://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M ${ORDERER_GENERAL_LOCALMSPDIR}
|
||||
{{- end }}
|
||||
|
||||
if [ ! -f ${ORDERER_GENERAL_LOCALMSPDIR}/signcerts/cert.pem ]
|
||||
then
|
||||
echo ">\033[0;31m Unable to enroll Orderer, make sure you have registered them first \(sleeping 180 seconds and re-trying\) \033[0m"
|
||||
sleep 180
|
||||
fi
|
||||
echo "\033[0;31m ${ORDERER_GENERAL_LOCALMSPDIR}/signcerts directory must exist \033[0m"
|
||||
sleep 60
|
||||
done
|
||||
|
||||
echo ">\033[0;32m Copy admincerts to ${ORDERER_GENERAL_LOCALMSPDIR}/admincerts \033[0m"
|
||||
mkdir -p ${ORDERER_GENERAL_LOCALMSPDIR}/admincerts
|
||||
cp /hl_config/admin/signcerts/* ${ORDERER_GENERAL_LOCALMSPDIR}/admincerts
|
||||
|
||||
echo ">\033[0;32m Setup admin certificates in ${ADMIN_MSP_PATH} \033[0m"
|
||||
mkdir -p ${ADMIN_MSP_PATH} ${ADMIN_MSP_PATH}/cacerts ${ADMIN_MSP_PATH}/intermediatecerts
|
||||
cp -L -r /hl_config/admin/* ${ADMIN_MSP_PATH}
|
||||
cp ${ORDERER_GENERAL_LOCALMSPDIR}/cacerts/* ${ADMIN_MSP_PATH}/cacerts
|
||||
cp ${ORDERER_GENERAL_LOCALMSPDIR}/intermediatecerts/* ${ADMIN_MSP_PATH}/intermediatecerts
|
||||
|
||||
# Create TLS certificate for Orderer
|
||||
if [ ! -f ${ORDERER_GENERAL_TLS_PRIVATEKEY} ]
|
||||
then
|
||||
|
||||
{{- if .Values.secrets.caServerTls }}
|
||||
echo ">\033[0;35m fabric-ca-client enroll -d --enrollment.profile tls -u https://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M /tmp/tls --csr.hosts {{ include "hlf-ord.fullname" . }} --tls.certfiles /hl_config/ca_server/tls/tls.crt \033[0m"
|
||||
fabric-ca-client enroll -d --enrollment.profile tls -u https://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M /tmp/tls --csr.hosts {{ include "hlf-ord.fullname" . }} --tls.certfiles /hl_config/ca_server/tls/tls.crt
|
||||
{{- else }}
|
||||
echo ">\033[0;35m fabric-ca-client enroll -d --enrollment.profile tls -u http://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M /tmp/tls --csr.hosts {{ include "hlf-ord.fullname" . }} \033[0m"
|
||||
fabric-ca-client enroll -d --enrollment.profile tls -u http://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M /tmp/tls --csr.hosts {{ include "hlf-ord.fullname" . }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
mkdir -p $(dirname $ORDERER_GENERAL_TLS_PRIVATEKEY)
|
||||
cp /tmp/tls/keystore/* $ORDERER_GENERAL_TLS_PRIVATEKEY
|
||||
mkdir -p $(dirname $ORDERER_GENERAL_TLS_CERTIFICATE)
|
||||
cp /tmp/tls/signcerts/* $ORDERER_GENERAL_TLS_CERTIFICATE
|
||||
rm -rf /tmp/tls
|
||||
fi
|
||||
|
||||
# Create directories to avoid restarts
|
||||
echo "\033[0;32m Create ${ORDERER_FILELEDGER_LOCATION} directory to avoid restarts \033[0m"
|
||||
mkdir -p ${ORDERER_FILELEDGER_LOCATION}
|
||||
mkdir -p ${ORDERER_FILELEDGER_LOCATION}/index
|
||||
|
||||
echo ">\033[0;35m orderer \033[0m"
|
||||
orderer
|
||||
envFrom:
|
||||
{{- if .Values.secrets.ord.cred }}
|
||||
- secretRef:
|
||||
name: {{ include "hlf-ord.fullname" . }}
|
||||
# Environmental variables CA_USERNAME and CA_PASSWORD
|
||||
name: {{ .Values.secrets.ord.cred }}
|
||||
{{- end }}
|
||||
- configMapRef:
|
||||
name: {{ include "hlf-ord.fullname" . }}--ord
|
||||
ports:
|
||||
@@ -146,19 +125,45 @@ spec:
|
||||
volumeMounts:
|
||||
- mountPath: /var/hyperledger
|
||||
name: data
|
||||
{{- if .Values.secrets.ord.cert }}
|
||||
- mountPath: /var/hyperledger/msp/signcerts
|
||||
name: id-cert
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.ord.key }}
|
||||
- mountPath: /var/hyperledger/msp/keystore
|
||||
name: id-key
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.ord.caCert }}
|
||||
- mountPath: /var/hyperledger/msp/cacerts
|
||||
name: cacert
|
||||
- mountPath: /var/hyperledger/admin_msp/cacerts
|
||||
name: cacert
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.ord.intCaCert }}
|
||||
- mountPath: /var/hyperledger/msp/intermediatecerts
|
||||
name: intcacert
|
||||
- mountPath: /var/hyperledger/admin_msp/intermediatecerts
|
||||
name: intcacert
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.ord.tls }}
|
||||
- mountPath: /var/hyperledger/msp_tls
|
||||
name: tls
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.ord.tlsRootCert }}
|
||||
- mountPath: /var/hyperledger/msp_tls
|
||||
name: tls-rootcert
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.genesis }}
|
||||
- mountPath: /hl_config/genesis
|
||||
name: genesis
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.adminCert }}
|
||||
- mountPath: /hl_config/admin/admincerts
|
||||
- mountPath: /var/hyperledger/admin_msp/admincerts
|
||||
name: admin-cert
|
||||
- mountPath: /hl_config/admin/signcerts
|
||||
- mountPath: /var/hyperledger/admin_msp/signcerts
|
||||
name: admin-cert
|
||||
- mountPath: /var/hyperledger/msp/admincerts
|
||||
name: admin-cert
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.caServerTls }}
|
||||
- mountPath: /hl_config/ca_server/tls
|
||||
name: ca-server-tls
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml .Values.resources | indent 12 }}
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "hlf-ord.fullname" . }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
CA_ADDRESS: {{ .Values.caAddress | b64enc | quote }}
|
||||
CA_USERNAME: {{ .Values.caUsername | b64enc | quote }}
|
||||
{{ if .Values.caPassword }}
|
||||
CA_PASSWORD: {{ .Values.caPassword | b64enc | quote }}
|
||||
{{ else }}
|
||||
CA_PASSWORD: {{ randAlphaNum 24 | b64enc | quote }}
|
||||
{{ end }}
|
||||
+25
-13
@@ -27,32 +27,44 @@ persistence:
|
||||
# existingClaim: ""
|
||||
|
||||
##################################
|
||||
## Further configuration options #
|
||||
## Orderer configuration options #
|
||||
##################################
|
||||
## Address of Certificate Authority where O
|
||||
caAddress: hlf-ca.local
|
||||
## Username for registering/enrolling with CA
|
||||
caUsername: ord1
|
||||
## Password for registering/enrolling with CA (defaults to random 24 alphanumeric)
|
||||
# caPassword:
|
||||
|
||||
ord:
|
||||
# Tools version
|
||||
hlfToolsVersion: 1.2.0
|
||||
## Type of Orderer, `solo` or `kafka`
|
||||
type: solo
|
||||
## MSP ID of the Orderer
|
||||
mspID: OrdererMSP
|
||||
# TLS
|
||||
tls:
|
||||
server:
|
||||
enabled: "false"
|
||||
client:
|
||||
enabled: "false"
|
||||
|
||||
secrets: {}
|
||||
|
||||
secrets:
|
||||
## These secrets should contain the Orderer crypto materials and credentials
|
||||
ord: {}
|
||||
## Credentials, saved under keys 'CA_USERNAME' and 'CA_PASSWORD'
|
||||
# cred: hlf--ord1-cred
|
||||
## Certificate, saved under key 'cert.pem'
|
||||
# cert: hlf--ord1-idcert
|
||||
## Key, saved under 'key.pem'
|
||||
# key: hlf--ord1-idkey
|
||||
## CA Cert, saved under 'cacert.pem'
|
||||
# caCert: hlf--ord1-cacert
|
||||
## Intermediate CA Cert (optional), saved under 'intermediatecacert.pem'
|
||||
# intCaCert: hlf--ord1-caintcert
|
||||
## TLS secret, saved under keys 'tls.crt' and 'tls.key' (to conform with K8S nomenclature)
|
||||
# tls: hlf--ord1-tls
|
||||
## TLS root CA certificate saved under key 'cert.pem'
|
||||
# tlsRootCert: hlf--ord1-tlsrootcert
|
||||
## This should contain "genesis" block derived from a configtx.yaml
|
||||
## configtxgen -profile OrdererGenesis -outputBlock genesis.block
|
||||
# genesis: hlf--genesis
|
||||
## This should contain the Certificate of the Orderer Organisation admin
|
||||
## This is necessary to successfully run the orderer
|
||||
# adminCert: hlf--ord-admincert
|
||||
## This should contain the CA server's TLS details under the key tls.crt (e.g. a Let's Encrypt Certificate PEM)
|
||||
# caServerTls: ca--tls
|
||||
|
||||
resources: {}
|
||||
## We usually recommend not to specify default resources and to leave this as a conscious
|
||||
|
||||
Reference in New Issue
Block a user