diff --git a/stable/hlf-peer/Chart.yaml b/stable/hlf-peer/Chart.yaml index a814e22925..41b4c67c47 100644 --- a/stable/hlf-peer/Chart.yaml +++ b/stable/hlf-peer/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 description: Hyperledger Fabric Peer chart (these charts are created by AID:Tech and are currently not directly associated with the Hyperledger project) name: hlf-peer -version: 1.1.1 +version: 1.2.0 appVersion: 1.2.0 keywords: - blockchain diff --git a/stable/hlf-peer/README.md b/stable/hlf-peer/README.md index 3fbfdd9a18..be6267baa7 100644 --- a/stable/hlf-peer/README.md +++ b/stable/hlf-peer/README.md @@ -18,7 +18,8 @@ This Peer can receive transaction requests, which it checks and signs, endorsing - Kubernetes 1.9+ - PV provisioner support in the underlying infrastructure. -- Three K8S secrets containing: +- K8S secrets containing: + - the crypto-materials (e.g. signcert, key, cacert, and optionally intermediatecert, CA credentials) - the channel transaction for the Peer - the certificate of the Peer Organisation Admin - the private key of the Peer Organisation Admin (needed to join the channel) @@ -39,11 +40,9 @@ The command deploys the Hyperledger Fabric Peer on the Kubernetes cluster in the Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example: ```bash -$ helm install stable/hlf-peer --name peer1 --set caUsername=peer1,caPassword=secretpassword +$ helm install stable/hlf-peer --name peer1 --set peer.mspID=MyMSP ``` -The above command specifies (but does not register/enroll) a Peer username of `peer1` with password `secretpassword`. - Alternatively, a YAML file can be provided while installing the chart. This file specifies values to override those provided in the default values.yaml. For example, ```bash @@ -52,11 +51,10 @@ $ helm install stable/hlf-peer --name peer1 -f my-values.yaml ## Updating the chart -When updating the chart, make sure you provide the `caPassword`, otherwise `helm update` will generate a new random (and invalid) password. +To update the chart: ```bash -$ export CA_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} peer1-hlf-peer -o jsonpath="{.data.CA_PASSWORD}" | base64 --decode; echo) -$ helm upgrade peer1 stable/hlf-peer --set caPassword=$CA_PASSWORD +$ helm upgrade peer1 stable/hlf-peer -f my-values.yaml ``` ## Uninstalling the Chart @@ -85,17 +83,21 @@ The following table lists the configurable parameters of the Hyperledger Fabric | `persistence.annotations` | Persistent Volume annotations | `{}` | | `persistence.size` | Size of data volume (adjust for production!) | `1Gi` | | `persistence.storageClass` | Storage class of backing PVC | `default` | -| `caAddress` | Address of CA to register/enroll with | `hlf-ca.local` | -| `caUsername` | Username for registering/enrolling with CA | `peer1` | -| `caPassword` | Password for registering/enrolling with CA | Random 24 alphanumeric characters | -| `peer.hlfToolsVersion` | Which version of HLF tools we use (e.g. CA client) | `1.1.0` | | `peer.databaseType` | Database type to use (`goleveldb` or `CouchDB`) | `goleveldb` | | `peer.couchdbInstance | CouchDB chart name to use `cdb-peer1` | `cdb-peer1` | | `peer.mspID` | ID of MSP the Peer belongs to | `Org1MSP` | +| `peer.tls.server.enabled` | Do we enable server-side TLS? | `false` | +| `peer.tls.client.enabled` | Do we enable client-side TLS? | `false` | +| `secrets.peer.cred` | Credentials: 'CA_USERNAME' and 'CA_PASSWORD' | `` | +| `secrets.peer.cert` | Certificate: as 'cert.pem' | `` | +| `secrets.peer.key` | Private key: as 'key.pem' | `` | +| `secrets.peer.caCert` | CA Cert: as 'cacert.pem' | `` | +| `secrets.peer.intCaCert` | Int. CA Cert: as 'intermediatecacert.pem' | `` | +| `secrets.peer.tls` | TLS secret: as 'tls.crt' and 'tls.key' | `` | +| `secrets.peer.tlsRootCert` | TLS root CA certificate: as 'cert.pem' | `` | | `secrets.channel` | Secret containing Channel tx for peer to create/join | `` | | `secrets.adminCert` | Secret containing Peer Org admin certificate | `` | | `secrets.adminCert` | Secret containing Peer Org admin private key | `` | -| `secrets.caServerTls` | Secret containing CA Server TLS certificate | `ca--tls` | | `resources` | CPU/Memory resource requests/limits | `{}` | | `nodeSelector` | Node labels for pod assignment | `{}` | | `tolerations` | Toleration labels for pod assignment | `[]` | @@ -107,6 +109,16 @@ The volume stores the Fabric Peer data and configurations at the `/var/hyperledg The chart mounts a [Persistent Volume](http://kubernetes.io/docs/user-guide/persistent-volumes/) at this location. The volume is created using dynamic volume provisioning through a PersistentVolumeClaim managed by the chart. +## Upgrading from version 1.1.x + +Previous versions of this chart performed enrollment with the Fabric CA directly from the pod. This prevented the possibility of using development cryptographic material (certificates and keys) from Cryptogen or the usage of other CA mechanisms. + +Instead, crypto-material and CA credentials are stored separately as secrets. + +If you used the former type of chart, you will need to obtain the relevant credentials and cryptographic material from the running pod, and save it externally to a set of secrets, whose names you will need to feed into the chart, under the `secrets.ord` section. + +An example upgrade procedure is described in `UPGRADE_1-1-x.md` + ## Feedback and feature requests This is a work in progress and we are happy to accept feature requests. We are even happier to accept pull requests implementing improvements :-) diff --git a/stable/hlf-peer/UPGRADE_1-1-x.md b/stable/hlf-peer/UPGRADE_1-1-x.md new file mode 100644 index 0000000000..1d753b1ed5 --- /dev/null +++ b/stable/hlf-peer/UPGRADE_1-1-x.md @@ -0,0 +1,90 @@ +# Upgrading from version 1.1.x and up. + +## Secret creation + +Specify which release we want to work with: + +``` +export RELEASE='peer1' +export NAMESPACE='default' +export POD_NAME=$(kubectl -n ${NAMESPACE} get pods -l "app=hlf-peer,release=${RELEASE}" -o jsonpath="{.items[0].metadata.name}") +``` + +### Cred secret + +Get relevant credentials + +``` +export CA_USERNAME=$(kubectl -n ${NAMESPACE} get secret ${RELEASE}-hlf-peer -o jsonpath="{.data.CA_USERNAME}" | base64 --decode; echo) +export CA_PASSWORD=$(kubectl -n ${NAMESPACE} get secret ${RELEASE}-hlf-peer -o jsonpath="{.data.CA_PASSWORD}" | base64 --decode; echo) + ``` + +Save credentials in secret + +``` +kubectl -n ${NAMESPACE} create secret generic hlf--${RELEASE}-cred --from-literal=CA_USERNAME=$CA_USERNAME --from-literal=CA_PASSWORD=$CA_PASSWORD +``` + +### Cert secret + +Get content of certificate file and save it as a secret: + +``` +export CONTENT=$(kubectl -n ${NAMESPACE} exec ${POD_NAME} -- cat /var/hyperledger/msp/signcerts/cert.pem) +kubectl -n ${NAMESPACE} create secret generic hlf--${RELEASE}-idcert --from-literal=cert.pem=$CONTENT +``` + +### Key secret + +Get content of key file and save it as a secret: + +``` +export CONTENT=$(kubectl -n ${NAMESPACE} exec ${POD_NAME} -- bash -c 'cat /var/hyperledger/msp/keystore/*_sk') +kubectl -n ${NAMESPACE} create secret generic hlf--${RELEASE}-idkey --from-literal=key.pem=$CONTENT +``` + +### CA cert secret + +Get content of key file and save it as a secret: + +``` +export CONTENT=$(kubectl -n ${NAMESPACE} exec ${POD_NAME} -- bash -c 'cat /var/hyperledger/msp/cacerts/*.pem') +kubectl -n ${NAMESPACE} create secret generic hlf--${RELEASE}-cacert --from-literal=cacert.pem=$CONTENT +``` + +### Intermediate CA cert secret + +Get content of key file and save it as a secret (if you have used an intermediate CA): + +``` +export CONTENT=$(kubectl -n ${NAMESPACE} exec ${POD_NAME} -- bash -c 'cat /var/hyperledger/msp/intermediatecerts/*.pem') +kubectl -n ${NAMESPACE} create secret generic hlf--${RELEASE}-intcacert --from-literal=intermediatecacert.pem=$CONTENT +``` + +## Move old MSP material out + +We can move the crypto material we created earlier to another directory in our Persistent Volume, so we can rollback if needed. + +``` +kubectl -n ${NAMESPACE} exec ${POD_NAME} -- mv /var/hyperledger/msp /var/hyperledger/msp_old +``` + +## Upgrade the chart + +You will need to update the chart to the latest version by editing the relevant values files: + +``` +secrets: + ord: + cred: hlf--peer1-cred + cert: hlf--peer1-idcert + key: hlf--peer1-idkey + caCert: hlf--peer1-cacert + intCaCert: hlf--peer1-caintcert # If applicable +``` + +And running: + +``` +helm upgrade ${RELEASE} ./hlf-peer +``` diff --git a/stable/hlf-peer/templates/configmap--peer.yaml b/stable/hlf-peer/templates/configmap--peer.yaml index 280d123057..3384e082c4 100644 --- a/stable/hlf-peer/templates/configmap--peer.yaml +++ b/stable/hlf-peer/templates/configmap--peer.yaml @@ -5,7 +5,6 @@ metadata: labels: {{ include "labels.standard" . | indent 4 }} data: - HLF_TOOLS_BUILD: linux-amd64-{{ .Values.peer.hlfToolsVersion }} CORE_PEER_ADDRESSAUTODETECT: "true" CORE_PEER_NETWORKID: nid1 CORE_PEER_ADDRESS: {{ include "hlf-peer.fullname" . }}:7051 @@ -16,7 +15,7 @@ data: CORE_PEER_DISCOVERY_PERIOD: 60s CORE_PEER_DISCOVERY_TOUCHPERIOD: 60s CORE_VM_ENDPOINT: unix:///host/var/run/docker.sock - CORE_PEER_LOCALMSPID: {{ .Values.peer.mspID }} + CORE_PEER_LOCALMSPID: {{ .Values.peer.mspID | quote }} CORE_PEER_MSPCONFIGPATH: /var/hyperledger/msp CORE_LOGGING_LEVEL: debug CORE_LOGGING_PEER: debug @@ -26,10 +25,15 @@ data: CORE_LOGGING_MSP: info CORE_LOGGING_POLICIES: debug CORE_LOGGING_GRPC: debug - CORE_PEER_TLS_ENABLED: "false" - CORE_PEER_TLS_CERTIFICATE: "/var/hyperledger/tls/tls.crt" - CORE_PEER_TLS_PRIVATEKEY: "/var/hyperledger/tls/tls.key" - CORE_LEDGER_STATE_STATEDATABASE: {{ .Values.peer.databaseType }} + CORE_PEER_TLS_ENABLED: {{ .Values.peer.tls.server.enabled | quote }} + CORE_PEER_TLS_CERT_FILE: "/var/hyperledger/tls/tls.crt" + CORE_PEER_TLS_KEY_FILE: "/var/hyperledger/tls/tls.key" + CORE_PEER_TLS_ROOTCERT_FILE: "/var/hyperledger/msp_tls/cert.pem" + CORE_PEER_TLS_CLIENTAUTHREQUIRED: {{ .Values.peer.tls.client.enabled | quote }} + CORE_PEER_TLS_CLIENTROOTCAS_FILES: "/var/hyperledger/msp_tls/cert.pem" + CORE_PEER_TLS_CLIENTCERT_FILE: "/var/hyperledger/tls/tls.crt" + CORE_PEER_TLS_CLIENTKEY_FILE: "/var/hyperledger/tls/tls.key" + CORE_LEDGER_STATE_STATEDATABASE: {{ .Values.peer.databaseType | quote }} # Containers in the same pod share the host {{- if eq .Values.peer.databaseType "CouchDB" }} CORE_LEDGER_STATE_COUCHDBCONFIG_COUCHDBADDRESS: {{ .Values.peer.couchdbInstance }}-hlf-couchdb:5984 diff --git a/stable/hlf-peer/templates/deployment.yaml b/stable/hlf-peer/templates/deployment.yaml index 6f04202d0b..3ad37ac896 100644 --- a/stable/hlf-peer/templates/deployment.yaml +++ b/stable/hlf-peer/templates/deployment.yaml @@ -10,6 +10,10 @@ spec: matchLabels: app: {{ include "hlf-peer.name" . }} release: {{ .Release.Name }} + # Ensure we allow our pod to be unavailable, so we can upgrade + strategy: + rollingUpdate: + maxUnavailable: 1 template: metadata: labels: @@ -26,6 +30,36 @@ spec: - name: dockersocket hostPath: path: /var/run/docker.sock + {{- if .Values.secrets.peer.cert }} + - name: id-cert + secret: + secretName: {{ .Values.secrets.peer.cert }} + {{- end }} + {{- if .Values.secrets.peer.key }} + - name: id-key + secret: + secretName: {{ .Values.secrets.peer.key }} + {{- end }} + {{- if .Values.secrets.peer.caCert }} + - name: cacert + secret: + secretName: {{ .Values.secrets.peer.caCert }} + {{- end }} + {{- if .Values.secrets.peer.intCaCert }} + - name: intcacert + secret: + secretName: {{ .Values.secrets.peer.intCaCert }} + {{- end }} + {{- if .Values.secrets.peer.tls }} + - name: tls + secret: + secretName: {{ .Values.secrets.peer.tls }} + {{- end }} + {{- if .Values.secrets.peer.tlsRootCert }} + - name: tls-rootcert + secret: + secretName: {{ .Values.secrets.peer.tlsRootCert }} + {{- end }} {{- if .Values.secrets.channel }} - name: channel secret: @@ -41,10 +75,15 @@ spec: secret: secretName: {{ .Values.secrets.adminKey }} {{- end }} - {{- if .Values.secrets.caServerTls }} - - name: ca-server-tls + {{- if .Values.secrets.caPeerServerTls }} + - name: ca-peer-server-tls secret: - secretName: {{ .Values.secrets.caServerTls }} + secretName: {{ .Values.secrets.caPeerServerTls }} + {{- end }} + {{- if .Values.secrets.caOrdServerTls }} + - name: ca-ord-server-tls + secret: + secretName: {{ .Values.secrets.caOrdServerTls }} {{- end }} containers: - name: peer @@ -66,73 +105,18 @@ spec: export CORE_LEDGER_STATE_COUCHDBCONFIG_USERNAME=$COUCHDB_USER export CORE_LEDGER_STATE_COUCHDBCONFIG_PASSWORD=$COUCHDB_PASSWORD - while [ ! -d /hl_config/admin/admincerts ] || [ -z "$(ls -A /hl_config/admin/admincerts)" ]; + while [ ! -d /var/hyperledger/admin_msp/admincerts ] || [ -z "$(ls -A /var/hyperledger/admin_msp/admincerts)" ]; do - echo "\033[0;31m /hl_config/admin/admincerts must contain Peer admin certificates files \033[0m" + echo "\033[0;31m /var/hyperledger/admin_msp/admincerts must contain Peer admin certificates files \033[0m" sleep 60 done - - # Download Fabric CA-client if it does not exist - if [ ! -f /bin/fabric-ca-client ] - then - if [ ! -f /var/hyperledger/fabric-ca-${HLF_TOOLS_BUILD}.tar.gz ] - then - # Curl is needed to download Fabric CA-client - apt update - apt install curl -y - echo "Downloading Fabric CA-client" - curl -f -s -C - https://nexus.hyperledger.org/content/repositories/releases/org/hyperledger/fabric-ca/hyperledger-fabric-ca/${HLF_TOOLS_BUILD}/hyperledger-fabric-ca-${HLF_TOOLS_BUILD}.tar.gz > /var/hyperledger/fabric-ca-${HLF_TOOLS_BUILD}.tar.gz - fi - echo "Unzipping Fabric CA-client" - tar xzf /var/hyperledger/fabric-ca-${HLF_TOOLS_BUILD}.tar.gz -C / - fi - - while [ ! -f ${CORE_PEER_MSPCONFIGPATH}/signcerts/cert.pem ]; + while [ ! -d ${CORE_PEER_MSPCONFIGPATH}/signcerts ]; do - {{- if .Values.secrets.caServerTls }} - echo ">\033[0;35m fabric-ca-client enroll -d -u https://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M ${CORE_PEER_MSPCONFIGPATH} --tls.certfiles /hl_config/ca_server/tls/tls.crt \033[0m" - fabric-ca-client enroll -d -u https://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M ${CORE_PEER_MSPCONFIGPATH} --tls.certfiles /hl_config/ca_server/tls/tls.crt - {{- else }} - echo ">\033[0;35m fabric-ca-client enroll -d -u http://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M ${CORE_PEER_MSPCONFIGPATH} \033[0m" - fabric-ca-client enroll -d -u http://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M ${CORE_PEER_MSPCONFIGPATH} - {{- end }} - - if [ ! -f ${CORE_PEER_MSPCONFIGPATH}/signcerts/cert.pem ] - then - echo ">\033[0;31m Unable to enroll Peer, make sure you have registered them first \(sleeping 180 seconds and re-trying\) \033[0m" - sleep 180 - fi + echo "\033[0;31m ${CORE_PEER_MSPCONFIGPATH}/signcerts directory must exist \033[0m" + sleep 60 done - echo ">\033[0;32m Copy admincerts to ${CORE_PEER_MSPCONFIGPATH}/admincerts \033[0m" - mkdir -p ${CORE_PEER_MSPCONFIGPATH}/admincerts - cp -L /hl_config/admin/signcerts/* ${CORE_PEER_MSPCONFIGPATH}/admincerts - - echo ">\033[0;32m Setup admin certificates in ${ADMIN_MSP_PATH} \033[0m" - mkdir -p ${ADMIN_MSP_PATH} ${ADMIN_MSP_PATH}/cacerts ${ADMIN_MSP_PATH}/intermediatecerts - cp -L -r /hl_config/admin/* ${ADMIN_MSP_PATH} - cp ${CORE_PEER_MSPCONFIGPATH}/cacerts/* ${ADMIN_MSP_PATH}/cacerts - cp ${CORE_PEER_MSPCONFIGPATH}/intermediatecerts/* ${ADMIN_MSP_PATH}/intermediatecerts - - # Create TLS certificate for Peer - if [ ! -f ${CORE_PEER_TLS_PRIVATEKEY} ] - then - {{- if .Values.secrets.caServerTls }} - echo ">\033[0;35m fabric-ca-client enroll -d --enrollment.profile tls -u https://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M /tmp/tls --csr.hosts {{ include "hlf-peer.fullname" . }} --tls.certfiles /hl_config/ca_server/tls/tls.crt \033[0m" - fabric-ca-client enroll -d --enrollment.profile tls -u https://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M /tmp/tls --csr.hosts {{ include "hlf-peer.fullname" . }} --tls.certfiles /hl_config/ca_server/tls/tls.crt - {{- else }} - echo ">\033[0;35m fabric-ca-client enroll -d --enrollment.profile tls -u http://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M /tmp/tls --csr.hosts {{ include "hlf-peer.fullname" . }} \033[0m" - fabric-ca-client enroll -d --enrollment.profile tls -u http://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M /tmp/tls --csr.hosts {{ include "hlf-peer.fullname" . }} - {{- end }} - - mkdir -p $(dirname $CORE_PEER_TLS_PRIVATEKEY) - cp /tmp/tls/keystore/* $CORE_PEER_TLS_PRIVATEKEY - mkdir -p $(dirname $CORE_PEER_TLS_CERTIFICATE) - cp /tmp/tls/signcerts/* $CORE_PEER_TLS_CERTIFICATE - #rm -rf /tmp/tls - fi - if [ ! -d ${FABRIC_CFG_PATH} ] then mkdir -p ${FABRIC_CFG_PATH} @@ -143,8 +127,6 @@ spec: echo ">\033[0;35m peer node start \033[0m" peer node start envFrom: - - secretRef: - name: {{ include "hlf-peer.fullname" . }} {{- if eq .Values.peer.databaseType "CouchDB" }} - secretRef: name: {{ .Values.peer.couchdbInstance }}-hlf-couchdb @@ -156,24 +138,50 @@ spec: name: data - mountPath: /host/var/run/docker.sock name: dockersocket + {{- if .Values.secrets.peer.cert }} + - mountPath: /var/hyperledger/msp/signcerts + name: id-cert + {{- end }} + {{- if .Values.secrets.peer.key }} + - mountPath: /var/hyperledger/msp/keystore + name: id-key + {{- end }} + {{- if .Values.secrets.peer.caCert }} + - mountPath: /var/hyperledger/msp/cacerts + name: cacert + - mountPath: /var/hyperledger/admin_msp/cacerts + name: cacert + {{- end }} + {{- if .Values.secrets.peer.intCaCert }} + - mountPath: /var/hyperledger/msp/intermediatecerts + name: intcacert + - mountPath: /var/hyperledger/admin_msp/intermediatecerts + name: intcacert + {{- end }} + {{- if .Values.secrets.peer.tls }} + - mountPath: /var/hyperledger/msp_tls + name: tls + {{- end }} + {{- if .Values.secrets.peer.tlsRootCert }} + - mountPath: /var/hyperledger/msp_tls + name: tls-rootcert + {{- end }} {{- if .Values.secrets.channel }} - mountPath: /hl_config/channel name: channel {{- end }} {{- if .Values.secrets.adminCert }} - - mountPath: /hl_config/admin/admincerts + - mountPath: /var/hyperledger/admin_msp/admincerts name: admin-cert - - mountPath: /hl_config/admin/signcerts + - mountPath: /var/hyperledger/admin_msp/signcerts + name: admin-cert + - mountPath: /var/hyperledger/msp/admincerts name: admin-cert {{- end }} {{- if .Values.secrets.adminKey }} - - mountPath: /hl_config/admin/keystore + - mountPath: /var/hyperledger/admin_msp/keystore name: admin-key {{- end }} - {{- if .Values.secrets.caServerTls }} - - mountPath: /hl_config/ca_server/tls - name: ca-server-tls - {{- end }} resources: {{ toYaml .Values.resources | indent 12 }} {{- with .Values.nodeSelector }} diff --git a/stable/hlf-peer/templates/secret.yaml b/stable/hlf-peer/templates/secret.yaml deleted file mode 100644 index cecfbd962e..0000000000 --- a/stable/hlf-peer/templates/secret.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "hlf-peer.fullname" . }} - labels: -{{ include "labels.standard" . | indent 4 }} -type: Opaque -data: - CA_ADDRESS: {{ .Values.caAddress | b64enc | quote }} - CA_USERNAME: {{ .Values.caUsername | b64enc | quote }} - {{ if .Values.caPassword }} - CA_PASSWORD: {{ .Values.caPassword | b64enc | quote }} - {{ else }} - CA_PASSWORD: {{ randAlphaNum 24 | b64enc | quote }} - {{ end }} diff --git a/stable/hlf-peer/values.yaml b/stable/hlf-peer/values.yaml index 6e2fca1f23..44fc9b4234 100644 --- a/stable/hlf-peer/values.yaml +++ b/stable/hlf-peer/values.yaml @@ -28,27 +28,39 @@ persistence: # existingClaim: "" ################################## -## Further configuration options # +## Peer configuration options # ################################## -## Address of Certificate Authority where O -caAddress: hlf-ca.local -## Username for registering/enrolling with CA -caUsername: peer1 -## Password for registering/enrolling with CA (defaults to random 24 alphanumeric) -# caPassword: - peer: - # Tools version - hlfToolsVersion: 1.2.0 # Type of database ("goleveldb" or "CouchDB"): databaseType: goleveldb # If CouchDB is used, which chart holds it couchdbInstance: cdb-peer1 ## MSP ID of the Peer mspID: Org1MSP + tls: + server: + enabled: "false" + client: + enabled: "false" # Secrets references, empty by default, fill in with your secrets (particularly adminCert) or add Peer Admin certificate manually after launching chart. -secrets: {} +secrets: + ## These secrets should contain the Orderer crypto materials and credentials + peer: {} + ## Credentials, saved under keys 'CA_USERNAME' and 'CA_PASSWORD' + # cred: hlf--peer1-cred + ## Certificate, saved under key 'cert.pem' + # cert: hlf--peer1-idcert + ## Key, saved under 'key.pem' + # key: hlf--peer1-idkey + ## CA Cert, saved under 'cacert.pem' + # caCert: hlf--peer1-cacert + ## Intermediate CA Cert (optional), saved under 'intermediatecacert.pem' + # intCaCert: hlf--peer1-caintcert + ## TLS secret, saved under keys 'tls.crt' and 'tls.key' (to conform with K8S nomenclature) + # tls: hlf--peer1-tls + ## TLS root CA certificate saved under key 'cert.pem' + # tlsRootCert: hlf--peer1-tlsrootcert ## This should contain "channel" transaction derived from a configtx.yaml ## configtxgen -profile ComposerChannel -channelID composerchannel -outputCreateChannelTx composerchannel.tx # channel: hlf--channel @@ -58,8 +70,6 @@ secrets: {} ## This should contain the Private Key of the Peer Organisation admin ## This is necessary to successfully join a channel # adminKey: hlf--peer-adminkey - ## This should contain the CA server's TLS details under the key tls.crt (e.g. a Let's Encrypt Certificate PEM) - # caServerTls: ca--tls resources: {} ## We usually recommend not to specify default resources and to leave this as a conscious