mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
[HLF-Peer] Support Cryptogen as well as Fabric CA by attaching secrets (#8792)
* [HLF-Peer] Support Cryptogen as well as Fabric CA by attaching crypto material as secrets Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology> * [HLF-Peer] Remove secret Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology>
This commit is contained in:
Sasha (Alejandro Vicente Grabovetsky)
committed by
k8s-ci-robot
k8s-ci-robot
parent
7de016bd66
commit
d93ad7c41d
@@ -1,7 +1,7 @@
|
||||
apiVersion: v1
|
||||
description: Hyperledger Fabric Peer chart (these charts are created by AID:Tech and are currently not directly associated with the Hyperledger project)
|
||||
name: hlf-peer
|
||||
version: 1.1.1
|
||||
version: 1.2.0
|
||||
appVersion: 1.2.0
|
||||
keywords:
|
||||
- blockchain
|
||||
|
||||
+24
-12
@@ -18,7 +18,8 @@ This Peer can receive transaction requests, which it checks and signs, endorsing
|
||||
|
||||
- Kubernetes 1.9+
|
||||
- PV provisioner support in the underlying infrastructure.
|
||||
- Three K8S secrets containing:
|
||||
- K8S secrets containing:
|
||||
- the crypto-materials (e.g. signcert, key, cacert, and optionally intermediatecert, CA credentials)
|
||||
- the channel transaction for the Peer
|
||||
- the certificate of the Peer Organisation Admin
|
||||
- the private key of the Peer Organisation Admin (needed to join the channel)
|
||||
@@ -39,11 +40,9 @@ The command deploys the Hyperledger Fabric Peer on the Kubernetes cluster in the
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example:
|
||||
|
||||
```bash
|
||||
$ helm install stable/hlf-peer --name peer1 --set caUsername=peer1,caPassword=secretpassword
|
||||
$ helm install stable/hlf-peer --name peer1 --set peer.mspID=MyMSP
|
||||
```
|
||||
|
||||
The above command specifies (but does not register/enroll) a Peer username of `peer1` with password `secretpassword`.
|
||||
|
||||
Alternatively, a YAML file can be provided while installing the chart. This file specifies values to override those provided in the default values.yaml. For example,
|
||||
|
||||
```bash
|
||||
@@ -52,11 +51,10 @@ $ helm install stable/hlf-peer --name peer1 -f my-values.yaml
|
||||
|
||||
## Updating the chart
|
||||
|
||||
When updating the chart, make sure you provide the `caPassword`, otherwise `helm update` will generate a new random (and invalid) password.
|
||||
To update the chart:
|
||||
|
||||
```bash
|
||||
$ export CA_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} peer1-hlf-peer -o jsonpath="{.data.CA_PASSWORD}" | base64 --decode; echo)
|
||||
$ helm upgrade peer1 stable/hlf-peer --set caPassword=$CA_PASSWORD
|
||||
$ helm upgrade peer1 stable/hlf-peer -f my-values.yaml
|
||||
```
|
||||
|
||||
## Uninstalling the Chart
|
||||
@@ -85,17 +83,21 @@ The following table lists the configurable parameters of the Hyperledger Fabric
|
||||
| `persistence.annotations` | Persistent Volume annotations | `{}` |
|
||||
| `persistence.size` | Size of data volume (adjust for production!) | `1Gi` |
|
||||
| `persistence.storageClass` | Storage class of backing PVC | `default` |
|
||||
| `caAddress` | Address of CA to register/enroll with | `hlf-ca.local` |
|
||||
| `caUsername` | Username for registering/enrolling with CA | `peer1` |
|
||||
| `caPassword` | Password for registering/enrolling with CA | Random 24 alphanumeric characters |
|
||||
| `peer.hlfToolsVersion` | Which version of HLF tools we use (e.g. CA client) | `1.1.0` |
|
||||
| `peer.databaseType` | Database type to use (`goleveldb` or `CouchDB`) | `goleveldb` |
|
||||
| `peer.couchdbInstance | CouchDB chart name to use `cdb-peer1` | `cdb-peer1` |
|
||||
| `peer.mspID` | ID of MSP the Peer belongs to | `Org1MSP` |
|
||||
| `peer.tls.server.enabled` | Do we enable server-side TLS? | `false` |
|
||||
| `peer.tls.client.enabled` | Do we enable client-side TLS? | `false` |
|
||||
| `secrets.peer.cred` | Credentials: 'CA_USERNAME' and 'CA_PASSWORD' | `` |
|
||||
| `secrets.peer.cert` | Certificate: as 'cert.pem' | `` |
|
||||
| `secrets.peer.key` | Private key: as 'key.pem' | `` |
|
||||
| `secrets.peer.caCert` | CA Cert: as 'cacert.pem' | `` |
|
||||
| `secrets.peer.intCaCert` | Int. CA Cert: as 'intermediatecacert.pem' | `` |
|
||||
| `secrets.peer.tls` | TLS secret: as 'tls.crt' and 'tls.key' | `` |
|
||||
| `secrets.peer.tlsRootCert` | TLS root CA certificate: as 'cert.pem' | `` |
|
||||
| `secrets.channel` | Secret containing Channel tx for peer to create/join | `` |
|
||||
| `secrets.adminCert` | Secret containing Peer Org admin certificate | `` |
|
||||
| `secrets.adminCert` | Secret containing Peer Org admin private key | `` |
|
||||
| `secrets.caServerTls` | Secret containing CA Server TLS certificate | `ca--tls` |
|
||||
| `resources` | CPU/Memory resource requests/limits | `{}` |
|
||||
| `nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `tolerations` | Toleration labels for pod assignment | `[]` |
|
||||
@@ -107,6 +109,16 @@ The volume stores the Fabric Peer data and configurations at the `/var/hyperledg
|
||||
|
||||
The chart mounts a [Persistent Volume](http://kubernetes.io/docs/user-guide/persistent-volumes/) at this location. The volume is created using dynamic volume provisioning through a PersistentVolumeClaim managed by the chart.
|
||||
|
||||
## Upgrading from version 1.1.x
|
||||
|
||||
Previous versions of this chart performed enrollment with the Fabric CA directly from the pod. This prevented the possibility of using development cryptographic material (certificates and keys) from Cryptogen or the usage of other CA mechanisms.
|
||||
|
||||
Instead, crypto-material and CA credentials are stored separately as secrets.
|
||||
|
||||
If you used the former type of chart, you will need to obtain the relevant credentials and cryptographic material from the running pod, and save it externally to a set of secrets, whose names you will need to feed into the chart, under the `secrets.ord` section.
|
||||
|
||||
An example upgrade procedure is described in `UPGRADE_1-1-x.md`
|
||||
|
||||
## Feedback and feature requests
|
||||
|
||||
This is a work in progress and we are happy to accept feature requests. We are even happier to accept pull requests implementing improvements :-)
|
||||
|
||||
@@ -0,0 +1,90 @@
|
||||
# Upgrading from version 1.1.x and up.
|
||||
|
||||
## Secret creation
|
||||
|
||||
Specify which release we want to work with:
|
||||
|
||||
```
|
||||
export RELEASE='peer1'
|
||||
export NAMESPACE='default'
|
||||
export POD_NAME=$(kubectl -n ${NAMESPACE} get pods -l "app=hlf-peer,release=${RELEASE}" -o jsonpath="{.items[0].metadata.name}")
|
||||
```
|
||||
|
||||
### Cred secret
|
||||
|
||||
Get relevant credentials
|
||||
|
||||
```
|
||||
export CA_USERNAME=$(kubectl -n ${NAMESPACE} get secret ${RELEASE}-hlf-peer -o jsonpath="{.data.CA_USERNAME}" | base64 --decode; echo)
|
||||
export CA_PASSWORD=$(kubectl -n ${NAMESPACE} get secret ${RELEASE}-hlf-peer -o jsonpath="{.data.CA_PASSWORD}" | base64 --decode; echo)
|
||||
```
|
||||
|
||||
Save credentials in secret
|
||||
|
||||
```
|
||||
kubectl -n ${NAMESPACE} create secret generic hlf--${RELEASE}-cred --from-literal=CA_USERNAME=$CA_USERNAME --from-literal=CA_PASSWORD=$CA_PASSWORD
|
||||
```
|
||||
|
||||
### Cert secret
|
||||
|
||||
Get content of certificate file and save it as a secret:
|
||||
|
||||
```
|
||||
export CONTENT=$(kubectl -n ${NAMESPACE} exec ${POD_NAME} -- cat /var/hyperledger/msp/signcerts/cert.pem)
|
||||
kubectl -n ${NAMESPACE} create secret generic hlf--${RELEASE}-idcert --from-literal=cert.pem=$CONTENT
|
||||
```
|
||||
|
||||
### Key secret
|
||||
|
||||
Get content of key file and save it as a secret:
|
||||
|
||||
```
|
||||
export CONTENT=$(kubectl -n ${NAMESPACE} exec ${POD_NAME} -- bash -c 'cat /var/hyperledger/msp/keystore/*_sk')
|
||||
kubectl -n ${NAMESPACE} create secret generic hlf--${RELEASE}-idkey --from-literal=key.pem=$CONTENT
|
||||
```
|
||||
|
||||
### CA cert secret
|
||||
|
||||
Get content of key file and save it as a secret:
|
||||
|
||||
```
|
||||
export CONTENT=$(kubectl -n ${NAMESPACE} exec ${POD_NAME} -- bash -c 'cat /var/hyperledger/msp/cacerts/*.pem')
|
||||
kubectl -n ${NAMESPACE} create secret generic hlf--${RELEASE}-cacert --from-literal=cacert.pem=$CONTENT
|
||||
```
|
||||
|
||||
### Intermediate CA cert secret
|
||||
|
||||
Get content of key file and save it as a secret (if you have used an intermediate CA):
|
||||
|
||||
```
|
||||
export CONTENT=$(kubectl -n ${NAMESPACE} exec ${POD_NAME} -- bash -c 'cat /var/hyperledger/msp/intermediatecerts/*.pem')
|
||||
kubectl -n ${NAMESPACE} create secret generic hlf--${RELEASE}-intcacert --from-literal=intermediatecacert.pem=$CONTENT
|
||||
```
|
||||
|
||||
## Move old MSP material out
|
||||
|
||||
We can move the crypto material we created earlier to another directory in our Persistent Volume, so we can rollback if needed.
|
||||
|
||||
```
|
||||
kubectl -n ${NAMESPACE} exec ${POD_NAME} -- mv /var/hyperledger/msp /var/hyperledger/msp_old
|
||||
```
|
||||
|
||||
## Upgrade the chart
|
||||
|
||||
You will need to update the chart to the latest version by editing the relevant values files:
|
||||
|
||||
```
|
||||
secrets:
|
||||
ord:
|
||||
cred: hlf--peer1-cred
|
||||
cert: hlf--peer1-idcert
|
||||
key: hlf--peer1-idkey
|
||||
caCert: hlf--peer1-cacert
|
||||
intCaCert: hlf--peer1-caintcert # If applicable
|
||||
```
|
||||
|
||||
And running:
|
||||
|
||||
```
|
||||
helm upgrade ${RELEASE} ./hlf-peer
|
||||
```
|
||||
@@ -5,7 +5,6 @@ metadata:
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
data:
|
||||
HLF_TOOLS_BUILD: linux-amd64-{{ .Values.peer.hlfToolsVersion }}
|
||||
CORE_PEER_ADDRESSAUTODETECT: "true"
|
||||
CORE_PEER_NETWORKID: nid1
|
||||
CORE_PEER_ADDRESS: {{ include "hlf-peer.fullname" . }}:7051
|
||||
@@ -16,7 +15,7 @@ data:
|
||||
CORE_PEER_DISCOVERY_PERIOD: 60s
|
||||
CORE_PEER_DISCOVERY_TOUCHPERIOD: 60s
|
||||
CORE_VM_ENDPOINT: unix:///host/var/run/docker.sock
|
||||
CORE_PEER_LOCALMSPID: {{ .Values.peer.mspID }}
|
||||
CORE_PEER_LOCALMSPID: {{ .Values.peer.mspID | quote }}
|
||||
CORE_PEER_MSPCONFIGPATH: /var/hyperledger/msp
|
||||
CORE_LOGGING_LEVEL: debug
|
||||
CORE_LOGGING_PEER: debug
|
||||
@@ -26,10 +25,15 @@ data:
|
||||
CORE_LOGGING_MSP: info
|
||||
CORE_LOGGING_POLICIES: debug
|
||||
CORE_LOGGING_GRPC: debug
|
||||
CORE_PEER_TLS_ENABLED: "false"
|
||||
CORE_PEER_TLS_CERTIFICATE: "/var/hyperledger/tls/tls.crt"
|
||||
CORE_PEER_TLS_PRIVATEKEY: "/var/hyperledger/tls/tls.key"
|
||||
CORE_LEDGER_STATE_STATEDATABASE: {{ .Values.peer.databaseType }}
|
||||
CORE_PEER_TLS_ENABLED: {{ .Values.peer.tls.server.enabled | quote }}
|
||||
CORE_PEER_TLS_CERT_FILE: "/var/hyperledger/tls/tls.crt"
|
||||
CORE_PEER_TLS_KEY_FILE: "/var/hyperledger/tls/tls.key"
|
||||
CORE_PEER_TLS_ROOTCERT_FILE: "/var/hyperledger/msp_tls/cert.pem"
|
||||
CORE_PEER_TLS_CLIENTAUTHREQUIRED: {{ .Values.peer.tls.client.enabled | quote }}
|
||||
CORE_PEER_TLS_CLIENTROOTCAS_FILES: "/var/hyperledger/msp_tls/cert.pem"
|
||||
CORE_PEER_TLS_CLIENTCERT_FILE: "/var/hyperledger/tls/tls.crt"
|
||||
CORE_PEER_TLS_CLIENTKEY_FILE: "/var/hyperledger/tls/tls.key"
|
||||
CORE_LEDGER_STATE_STATEDATABASE: {{ .Values.peer.databaseType | quote }}
|
||||
# Containers in the same pod share the host
|
||||
{{- if eq .Values.peer.databaseType "CouchDB" }}
|
||||
CORE_LEDGER_STATE_COUCHDBCONFIG_COUCHDBADDRESS: {{ .Values.peer.couchdbInstance }}-hlf-couchdb:5984
|
||||
|
||||
@@ -10,6 +10,10 @@ spec:
|
||||
matchLabels:
|
||||
app: {{ include "hlf-peer.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
# Ensure we allow our pod to be unavailable, so we can upgrade
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
@@ -26,6 +30,36 @@ spec:
|
||||
- name: dockersocket
|
||||
hostPath:
|
||||
path: /var/run/docker.sock
|
||||
{{- if .Values.secrets.peer.cert }}
|
||||
- name: id-cert
|
||||
secret:
|
||||
secretName: {{ .Values.secrets.peer.cert }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.peer.key }}
|
||||
- name: id-key
|
||||
secret:
|
||||
secretName: {{ .Values.secrets.peer.key }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.peer.caCert }}
|
||||
- name: cacert
|
||||
secret:
|
||||
secretName: {{ .Values.secrets.peer.caCert }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.peer.intCaCert }}
|
||||
- name: intcacert
|
||||
secret:
|
||||
secretName: {{ .Values.secrets.peer.intCaCert }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.peer.tls }}
|
||||
- name: tls
|
||||
secret:
|
||||
secretName: {{ .Values.secrets.peer.tls }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.peer.tlsRootCert }}
|
||||
- name: tls-rootcert
|
||||
secret:
|
||||
secretName: {{ .Values.secrets.peer.tlsRootCert }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.channel }}
|
||||
- name: channel
|
||||
secret:
|
||||
@@ -41,10 +75,15 @@ spec:
|
||||
secret:
|
||||
secretName: {{ .Values.secrets.adminKey }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.caServerTls }}
|
||||
- name: ca-server-tls
|
||||
{{- if .Values.secrets.caPeerServerTls }}
|
||||
- name: ca-peer-server-tls
|
||||
secret:
|
||||
secretName: {{ .Values.secrets.caServerTls }}
|
||||
secretName: {{ .Values.secrets.caPeerServerTls }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.caOrdServerTls }}
|
||||
- name: ca-ord-server-tls
|
||||
secret:
|
||||
secretName: {{ .Values.secrets.caOrdServerTls }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: peer
|
||||
@@ -66,73 +105,18 @@ spec:
|
||||
export CORE_LEDGER_STATE_COUCHDBCONFIG_USERNAME=$COUCHDB_USER
|
||||
export CORE_LEDGER_STATE_COUCHDBCONFIG_PASSWORD=$COUCHDB_PASSWORD
|
||||
|
||||
while [ ! -d /hl_config/admin/admincerts ] || [ -z "$(ls -A /hl_config/admin/admincerts)" ];
|
||||
while [ ! -d /var/hyperledger/admin_msp/admincerts ] || [ -z "$(ls -A /var/hyperledger/admin_msp/admincerts)" ];
|
||||
do
|
||||
echo "\033[0;31m /hl_config/admin/admincerts must contain Peer admin certificates files \033[0m"
|
||||
echo "\033[0;31m /var/hyperledger/admin_msp/admincerts must contain Peer admin certificates files \033[0m"
|
||||
sleep 60
|
||||
done
|
||||
|
||||
# Download Fabric CA-client if it does not exist
|
||||
if [ ! -f /bin/fabric-ca-client ]
|
||||
then
|
||||
if [ ! -f /var/hyperledger/fabric-ca-${HLF_TOOLS_BUILD}.tar.gz ]
|
||||
then
|
||||
# Curl is needed to download Fabric CA-client
|
||||
apt update
|
||||
apt install curl -y
|
||||
|
||||
echo "Downloading Fabric CA-client"
|
||||
curl -f -s -C - https://nexus.hyperledger.org/content/repositories/releases/org/hyperledger/fabric-ca/hyperledger-fabric-ca/${HLF_TOOLS_BUILD}/hyperledger-fabric-ca-${HLF_TOOLS_BUILD}.tar.gz > /var/hyperledger/fabric-ca-${HLF_TOOLS_BUILD}.tar.gz
|
||||
fi
|
||||
echo "Unzipping Fabric CA-client"
|
||||
tar xzf /var/hyperledger/fabric-ca-${HLF_TOOLS_BUILD}.tar.gz -C /
|
||||
fi
|
||||
|
||||
while [ ! -f ${CORE_PEER_MSPCONFIGPATH}/signcerts/cert.pem ];
|
||||
while [ ! -d ${CORE_PEER_MSPCONFIGPATH}/signcerts ];
|
||||
do
|
||||
{{- if .Values.secrets.caServerTls }}
|
||||
echo ">\033[0;35m fabric-ca-client enroll -d -u https://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M ${CORE_PEER_MSPCONFIGPATH} --tls.certfiles /hl_config/ca_server/tls/tls.crt \033[0m"
|
||||
fabric-ca-client enroll -d -u https://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M ${CORE_PEER_MSPCONFIGPATH} --tls.certfiles /hl_config/ca_server/tls/tls.crt
|
||||
{{- else }}
|
||||
echo ">\033[0;35m fabric-ca-client enroll -d -u http://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M ${CORE_PEER_MSPCONFIGPATH} \033[0m"
|
||||
fabric-ca-client enroll -d -u http://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M ${CORE_PEER_MSPCONFIGPATH}
|
||||
{{- end }}
|
||||
|
||||
if [ ! -f ${CORE_PEER_MSPCONFIGPATH}/signcerts/cert.pem ]
|
||||
then
|
||||
echo ">\033[0;31m Unable to enroll Peer, make sure you have registered them first \(sleeping 180 seconds and re-trying\) \033[0m"
|
||||
sleep 180
|
||||
fi
|
||||
echo "\033[0;31m ${CORE_PEER_MSPCONFIGPATH}/signcerts directory must exist \033[0m"
|
||||
sleep 60
|
||||
done
|
||||
|
||||
echo ">\033[0;32m Copy admincerts to ${CORE_PEER_MSPCONFIGPATH}/admincerts \033[0m"
|
||||
mkdir -p ${CORE_PEER_MSPCONFIGPATH}/admincerts
|
||||
cp -L /hl_config/admin/signcerts/* ${CORE_PEER_MSPCONFIGPATH}/admincerts
|
||||
|
||||
echo ">\033[0;32m Setup admin certificates in ${ADMIN_MSP_PATH} \033[0m"
|
||||
mkdir -p ${ADMIN_MSP_PATH} ${ADMIN_MSP_PATH}/cacerts ${ADMIN_MSP_PATH}/intermediatecerts
|
||||
cp -L -r /hl_config/admin/* ${ADMIN_MSP_PATH}
|
||||
cp ${CORE_PEER_MSPCONFIGPATH}/cacerts/* ${ADMIN_MSP_PATH}/cacerts
|
||||
cp ${CORE_PEER_MSPCONFIGPATH}/intermediatecerts/* ${ADMIN_MSP_PATH}/intermediatecerts
|
||||
|
||||
# Create TLS certificate for Peer
|
||||
if [ ! -f ${CORE_PEER_TLS_PRIVATEKEY} ]
|
||||
then
|
||||
{{- if .Values.secrets.caServerTls }}
|
||||
echo ">\033[0;35m fabric-ca-client enroll -d --enrollment.profile tls -u https://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M /tmp/tls --csr.hosts {{ include "hlf-peer.fullname" . }} --tls.certfiles /hl_config/ca_server/tls/tls.crt \033[0m"
|
||||
fabric-ca-client enroll -d --enrollment.profile tls -u https://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M /tmp/tls --csr.hosts {{ include "hlf-peer.fullname" . }} --tls.certfiles /hl_config/ca_server/tls/tls.crt
|
||||
{{- else }}
|
||||
echo ">\033[0;35m fabric-ca-client enroll -d --enrollment.profile tls -u http://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M /tmp/tls --csr.hosts {{ include "hlf-peer.fullname" . }} \033[0m"
|
||||
fabric-ca-client enroll -d --enrollment.profile tls -u http://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M /tmp/tls --csr.hosts {{ include "hlf-peer.fullname" . }}
|
||||
{{- end }}
|
||||
|
||||
mkdir -p $(dirname $CORE_PEER_TLS_PRIVATEKEY)
|
||||
cp /tmp/tls/keystore/* $CORE_PEER_TLS_PRIVATEKEY
|
||||
mkdir -p $(dirname $CORE_PEER_TLS_CERTIFICATE)
|
||||
cp /tmp/tls/signcerts/* $CORE_PEER_TLS_CERTIFICATE
|
||||
#rm -rf /tmp/tls
|
||||
fi
|
||||
|
||||
if [ ! -d ${FABRIC_CFG_PATH} ]
|
||||
then
|
||||
mkdir -p ${FABRIC_CFG_PATH}
|
||||
@@ -143,8 +127,6 @@ spec:
|
||||
echo ">\033[0;35m peer node start \033[0m"
|
||||
peer node start
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ include "hlf-peer.fullname" . }}
|
||||
{{- if eq .Values.peer.databaseType "CouchDB" }}
|
||||
- secretRef:
|
||||
name: {{ .Values.peer.couchdbInstance }}-hlf-couchdb
|
||||
@@ -156,24 +138,50 @@ spec:
|
||||
name: data
|
||||
- mountPath: /host/var/run/docker.sock
|
||||
name: dockersocket
|
||||
{{- if .Values.secrets.peer.cert }}
|
||||
- mountPath: /var/hyperledger/msp/signcerts
|
||||
name: id-cert
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.peer.key }}
|
||||
- mountPath: /var/hyperledger/msp/keystore
|
||||
name: id-key
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.peer.caCert }}
|
||||
- mountPath: /var/hyperledger/msp/cacerts
|
||||
name: cacert
|
||||
- mountPath: /var/hyperledger/admin_msp/cacerts
|
||||
name: cacert
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.peer.intCaCert }}
|
||||
- mountPath: /var/hyperledger/msp/intermediatecerts
|
||||
name: intcacert
|
||||
- mountPath: /var/hyperledger/admin_msp/intermediatecerts
|
||||
name: intcacert
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.peer.tls }}
|
||||
- mountPath: /var/hyperledger/msp_tls
|
||||
name: tls
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.peer.tlsRootCert }}
|
||||
- mountPath: /var/hyperledger/msp_tls
|
||||
name: tls-rootcert
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.channel }}
|
||||
- mountPath: /hl_config/channel
|
||||
name: channel
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.adminCert }}
|
||||
- mountPath: /hl_config/admin/admincerts
|
||||
- mountPath: /var/hyperledger/admin_msp/admincerts
|
||||
name: admin-cert
|
||||
- mountPath: /hl_config/admin/signcerts
|
||||
- mountPath: /var/hyperledger/admin_msp/signcerts
|
||||
name: admin-cert
|
||||
- mountPath: /var/hyperledger/msp/admincerts
|
||||
name: admin-cert
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.adminKey }}
|
||||
- mountPath: /hl_config/admin/keystore
|
||||
- mountPath: /var/hyperledger/admin_msp/keystore
|
||||
name: admin-key
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.caServerTls }}
|
||||
- mountPath: /hl_config/ca_server/tls
|
||||
name: ca-server-tls
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml .Values.resources | indent 12 }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "hlf-peer.fullname" . }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
CA_ADDRESS: {{ .Values.caAddress | b64enc | quote }}
|
||||
CA_USERNAME: {{ .Values.caUsername | b64enc | quote }}
|
||||
{{ if .Values.caPassword }}
|
||||
CA_PASSWORD: {{ .Values.caPassword | b64enc | quote }}
|
||||
{{ else }}
|
||||
CA_PASSWORD: {{ randAlphaNum 24 | b64enc | quote }}
|
||||
{{ end }}
|
||||
+23
-13
@@ -28,27 +28,39 @@ persistence:
|
||||
# existingClaim: ""
|
||||
|
||||
##################################
|
||||
## Further configuration options #
|
||||
## Peer configuration options #
|
||||
##################################
|
||||
## Address of Certificate Authority where O
|
||||
caAddress: hlf-ca.local
|
||||
## Username for registering/enrolling with CA
|
||||
caUsername: peer1
|
||||
## Password for registering/enrolling with CA (defaults to random 24 alphanumeric)
|
||||
# caPassword:
|
||||
|
||||
peer:
|
||||
# Tools version
|
||||
hlfToolsVersion: 1.2.0
|
||||
# Type of database ("goleveldb" or "CouchDB"):
|
||||
databaseType: goleveldb
|
||||
# If CouchDB is used, which chart holds it
|
||||
couchdbInstance: cdb-peer1
|
||||
## MSP ID of the Peer
|
||||
mspID: Org1MSP
|
||||
tls:
|
||||
server:
|
||||
enabled: "false"
|
||||
client:
|
||||
enabled: "false"
|
||||
|
||||
# Secrets references, empty by default, fill in with your secrets (particularly adminCert) or add Peer Admin certificate manually after launching chart.
|
||||
secrets: {}
|
||||
secrets:
|
||||
## These secrets should contain the Orderer crypto materials and credentials
|
||||
peer: {}
|
||||
## Credentials, saved under keys 'CA_USERNAME' and 'CA_PASSWORD'
|
||||
# cred: hlf--peer1-cred
|
||||
## Certificate, saved under key 'cert.pem'
|
||||
# cert: hlf--peer1-idcert
|
||||
## Key, saved under 'key.pem'
|
||||
# key: hlf--peer1-idkey
|
||||
## CA Cert, saved under 'cacert.pem'
|
||||
# caCert: hlf--peer1-cacert
|
||||
## Intermediate CA Cert (optional), saved under 'intermediatecacert.pem'
|
||||
# intCaCert: hlf--peer1-caintcert
|
||||
## TLS secret, saved under keys 'tls.crt' and 'tls.key' (to conform with K8S nomenclature)
|
||||
# tls: hlf--peer1-tls
|
||||
## TLS root CA certificate saved under key 'cert.pem'
|
||||
# tlsRootCert: hlf--peer1-tlsrootcert
|
||||
## This should contain "channel" transaction derived from a configtx.yaml
|
||||
## configtxgen -profile ComposerChannel -channelID composerchannel -outputCreateChannelTx composerchannel.tx
|
||||
# channel: hlf--channel
|
||||
@@ -58,8 +70,6 @@ secrets: {}
|
||||
## This should contain the Private Key of the Peer Organisation admin
|
||||
## This is necessary to successfully join a channel
|
||||
# adminKey: hlf--peer-adminkey
|
||||
## This should contain the CA server's TLS details under the key tls.crt (e.g. a Let's Encrypt Certificate PEM)
|
||||
# caServerTls: ca--tls
|
||||
|
||||
resources: {}
|
||||
## We usually recommend not to specify default resources and to leave this as a conscious
|
||||
|
||||
Reference in New Issue
Block a user