Implement Hyperledger Fabric CA chart (#6181)

* Implement hlf-ca chart Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology> * Add appVersion to help validation Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology> * Small fix for default values of Organisation and OU Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology> * Remove service.nodePort from README.md Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology> * Fix NOTES.txt Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology> * Small edits in values.yaml and README.md Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology> * Move chart from incubator to stable Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology> * Fix PVC to conform to best practices Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology> * Fix deployment.yaml Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology> * Move persistent data location to default Hyperledger /var/persistence Signed-off-by: Alejandro Vicente Grabovetsky <sasha@aid.technology>
2026-08-23 22:37:45 +00:00 · 2018-06-28 13:22:21 -07:00
parent 54bd619a46
commit f3aa264463
14 changed files with 893 additions and 0 deletions
@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
@@ -0,0 +1,19 @@
+apiVersion: v1
+description: Hyperledger Fabric Certificate Authority chart (these charts are created by AID:Tech and are currently not directly associated with the Hyperledger project)
+name: hlf-ca
+version: 1.0.10
+appVersion: 1.1.0
+keywords:
+  - blockchain
+  - hyperledger
+  - fabric
+home: http://hyperledger-fabric-ca.readthedocs.io
+sources:
+  - https://github.com/hyperledger/fabric-ca
+maintainers:
+  - name: alexvicegrab
+    email: sasha@aid.technology
+  - name: nicolapaoli
+    email: nicola@aid.technology
+## Icon not included while sorting out trademark question with Hyperledger project
+# icon: https://www.hyperledger.org/wp-content/uploads/2018/04/fabric-logo.png
@@ -0,0 +1,118 @@
+# Hyperledger Fabric CA
+
+[Hyperledger Fabric CA](http://hyperledger-fabric-ca.readthedocs.io/) is a Certificate Authority node for the [Hyperledger](https://www.hyperledger.org/) Fabric permissioned blockchain framework. Learn more about it by visiting the [user's guide](http://hyperledger-fabric-ca.readthedocs.io/en/latest/users-guide.html#).
+
+## TL;DR;
+
+```bash
+$ helm install stable/hlf-ca
+```
+
+## Introduction
+
+The Hyperledger Fabric CA can be installed as either a Root CA, or an intermediate CA (by pointing to a parent CA, which can itself be a Root CA or an intermediate).
+
+This CA can then be used to register and enroll identities for clients, admins and nodes of the Hyperledger Fabric network.
+
+## Prerequisites
+
+- Kubernetes 1.9+
+- PV provisioner support in the underlying infrastructure.
+- A running [PostgreSQL Chart](https://github.com/kubernetes/charts/tree/master/stable/postgresql) to host the Hyperledger Fabric CA data, in a database defined under the settings `db.database`.
+
+## Installing the Chart
+
+To install the chart with the release name `org1-ca`:
+
+```bash
+$ helm install stable/hlf-ca --name org1-ca
+```
+
+The command deploys the Hyperledger Fabric CA on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
+
+### Custom parameters
+
+Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example:
+
+```bash
+$ helm install stable/hlf-ca --name org1-ca --set adminUsername=ca-admin,adminPassword=secretpassword
+```
+
+The above command creates a CA Admin user named `ca-admin` with password `secretpassword`.
+
+Alternatively, a YAML file can be provided while installing the chart. This file specifies values to override those provided in the defualt values.yaml. For example,
+
+```bash
+$ helm install stable/hlf-ca --name org1-ca -f my-values.yaml
+```
+
+## Updating the chart
+
+When updating the chart, make sure you provide the `adminPassword`, otherwise `helm update` will generate a new random (and invalid) password.
+
+```bash
+$ export CA_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} org1-ca -o jsonpath="{.data.CA_PASSWORD}" | base64 --decode; echo)
+$ helm upgrade org1-ca stable/hlf-ca --set adminPassword=$CA_PASSWORD
+```
+
+## Uninstalling the Chart
+
+To uninstall/delete the `org1-ca` deployment:
+
+```bash
+$ helm delete org1-ca
+```
+
+The command removes all the Kubernetes components associated with the chart and deletes the release.
+
+## Configuration
+
+The following table lists the configurable parameters of the Hyperledger Fabric CA chart and default values.
+
+| Parameter                          | Description                                     | Default                                                    |
+| ---------------------------------- | ------------------------------------------------ | ---------------------------------------------------------- |
+| `image.repository`                 | `hlf-ca` image repository                        | `hyperledger/fabric-ca`                                    |
+| `image.tag`                        | `hlf-ca` image tag                               | `x86_64-1.1.0`                                             |
+| `image.pullPolicy`                 | Image pull policy                                | `IfNotPresent`                                             |
+| `service.port`                     | TCP port                                         | `7054`                                                     |
+| `service.type`                     | K8S service type exposing ports, e.g. `ClusterIP`| `ClusterIP`                                                |
+| `ingress.enabled`                  | If true, Ingress will be created                 | `false`                                                    |
+| `ingress.annotations`              | Ingress annotations                              | `{}`                                                       |
+| `ingress.path`                     | Ingress path                                     | `/`                                                        |
+| `ingress.hosts`                    | Ingress hostnames                                | `[]`                                                       |
+| `ingress.tls`                      | Ingress TLS configuration                        | `[]`                                                       |
+| `persistence.accessMode`           | Use volume as ReadOnly or ReadWrite              | `ReadWriteOnce`                                            |
+| `persistence.annotations`          | Persistent Volume annotations                    | `{}`                                                       |
+| `persistence.size`                 | Size of data volume                              | `1Gi`                                                      |
+| `persistence.storageClass`         | Storage class of backing PVC                     | `default`                                                  |
+| `adminUsername`                    | Admin Username for CA                            | `admin`                                                    |
+| `adminPassword`                    | Admin Password                                   | Random 24 alphanumeric characters                          |
+| `caName`                           | Name of CA                                       | `org1-ca`                                                  |
+| `db.chart`                         | Name of a Database Chart holding CA data         | `postgres-ca-postgresql` supports postgresql           |
+| `db.database`                      | Name of the actual Database holding the CA data  | `fabric_ca`                                                |
+| `config.debug`                     | Enable debug logging                             | `true`                                                     |
+| `config.csr.ca.pathlength`         | Pathlength of CA certificate hierarchy           | `1`                                                        |
+| `config.csr.names.c`               | Country to which CA belongs                      | `US`                                                       |
+| `config.csr.names.st`              | State to which CA belongs                        | `North Carolina`                                                  |
+| `config.csr.names.l`               | Locality to which CA belongs                     | ``                                                         |
+| `config.csr.names.o`               | Organization to which CA belongs                 | `Hyperledger`                                              |
+| `config.csr.names.ou`              | Organizational Unit to which CA belongs          | `Fabric`                                                   |
+| `config.intermediate`              | Structure defining that CA is intermediate       | `nil`                                                      |
+| `config.intermediate.parent.chart` | Which hlf-ca chart acts as parent to this CA     | `nil`                                                      |
+| `config.intermediate.parent.url`   | URL of parent CA                                 | `nil`                                                      |
+| `config.intermediate.parent.port`  | Port of parent CA                                | `nil`                                                      |
+| `config.affiliations`              | Affiliations for CA                              | `{org1: [] }`                                              |
+| `resources`                        | CPU/Memory resource requests/limits              | `{}`                                                       |
+| `nodeSelector`                     | Node labels for pod assignment                   | `{}`                                                       |
+| `tolerations`                      | Toleration labels for pod assignment             | `[]`                                                       |
+| `affinity`                         | Affinity settings for pod assignment             | `{}`                                                       |
+
+## Persistence
+
+The volume stores the Fabric_CA data and configurations at the `/var/hyperledger` path of the container.
+
+The chart mounts a [Persistent Volume](http://kubernetes.io/docs/user-guide/persistent-volumes/) at this location. The volume is created using dynamic volume provisioning through a PersistentVolumeClaim managed by the chart.
+
+## Feedback and feature requests
+
+This is a work in progress and we are happy to accept feature requests. We are even happier to accept pull requests implementing improvements :-)
@@ -0,0 +1,33 @@
+Run the following commands to...
+1. Get the name of the pod running the Fabric CA Server:
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ include "hlf-ca.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+
+2. Get the application URL:
+{{- if .Values.ingress.enabled }}
+{{- range .Values.ingress.hosts }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ . }}{{ $.Values.ingress.path }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "hlf-ca.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get svc -w {{ include "hlf-ca.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "hlf-ca.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl port-forward $POD_NAME 8080:7054
+{{- end }}
+
+3. Display local (admin "client" enrollment) certificate, if it has been created:
+  kubectl exec $POD_NAME -- cat /var/hyperledger/fabric-ca/msp/signcerts/cert.pem
+
+4. Enroll the bootstrap admin identity:
+  kubectl exec $POD_NAME -- bash -c 'fabric-ca-client enroll -d -u http://$CA_ADMIN:$CA_PASSWORD@$SERVICE_DNS:{{ .Values.service.port }}'
+
+5. Update the chart without resetting a password:
+  export CA_ADMIN=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "hlf-ca.fullname" . }} -o jsonpath="{.data.CA_ADMIN}" | base64 --decode; echo)
+  export CA_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "hlf-ca.fullname" . }} -o jsonpath="{.data.CA_PASSWORD}" | base64 --decode; echo)
+  helm upgrade {{ .Release.Name }} stable/hlf-ca --namespace {{ .Release.Namespace }} -f my-values.yaml --set adminUsername=$CA_ADMIN,adminPassword=$CA_PASSWORD
@@ -0,0 +1,45 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "hlf-ca.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "hlf-ca.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "hlf-ca.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- /*
+Credit: @technosophos
+https://github.com/technosophos/common-chart/
+labels.standard prints the standard Helm labels.
+The standard labels are frequently used in metadata.
+*/ -}}
+{{- define "labels.standard" -}}
+app: {{ include "hlf-ca.name" . }}
+heritage: {{ .Release.Service | quote }}
+release: {{ .Release.Name | quote }}
+chart: {{ include "hlf-ca.chart" . }}
+{{- end -}}
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "hlf-ca.fullname" . }}--ca
+  labels:
+{{ include "labels.standard" . | indent 4 }}
+data:
+  GODEBUG: "netdns=go"
+  FABRIC_CA_HOME: /var/hyperledger/fabric-ca
+  FABRIC_CA_SERVER_CA_NAME: {{ .Values.caName | quote }}
+  SERVICE_DNS: {{ include "hlf-ca.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local
@@ -0,0 +1,335 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "hlf-ca.fullname" . }}--config
+  labels:
+{{ include "labels.standard" . | indent 4 }}
+data:
+  ca.yaml: |
+    #############################################################################
+    #   This is a configuration file for the fabric-ca-server command.
+    #############################################################################
+    # Version of config file
+    version: 1.1.0
+    # Server's listening port
+    port: 7054
+    # Enables debug logging
+    debug: {{ .Values.config.debug }}
+    # Size limit of an acceptable CRL in bytes (default: 512000)
+    crlsizelimit: 512000
+    #############################################################################
+    #  TLS section
+    #############################################################################
+    tls:
+      # Enable TLS (handled by the Ingress)
+      enabled: false
+      # TLS for the server's listening port
+      certfile: /var/hyperledger/tls_secret/tls.crt
+      keyfile: /var/hyperledger/tls_secret/tls.key
+      clientauth:
+        # Supported types: NoClientCert, RequestClientCert, RequireAnyClientCert, VerifyClientCertIfGiven and RequireAndVerifyClientCert.
+        type: noclientcert
+        # List of root certificate authorities used when verifying client certificates
+        certfiles:
+    #############################################################################
+    #  The CA section contains information related to the Certificate Authority
+    #  including the name of the CA, which should be unique for all members
+    #  of a blockchain network.  It also includes the key and certificate files
+    #  used when issuing enrollment certificates (ECerts) and transaction
+    #  certificates (TCerts).
+    #  The chainfile (if it exists) contains the certificate chain which
+    #  should be trusted for this CA, where the 1st in the chain is always the
+    #  root CA certificate.
+    #############################################################################
+    ca:
+      # Name of this CA
+      name:
+      # Key file (is only used to import a private key into BCCSP)
+      keyfile:
+      # Certificate file (default: ca-cert.pem)
+      certfile: /var/hyperledger/fabric-ca/msp/certs/{{ include "hlf-ca.fullname" . }}-cert.pem
+      # Chain file
+      chainfile:
+    #############################################################################
+    #  The gencrl REST endpoint is used to generate a CRL that contains revoked
+    #  certificates. This section contains configuration options that are used
+    #  during gencrl request processing.
+    #############################################################################
+    crl:
+      # Specifies expiration for the generated CRL. The number of hours
+      # specified by this property is added to the UTC time, the resulting time
+      # is used to set the 'Next Update' date of the CRL.
+      expiry: 24h
+    #############################################################################
+    #  The registry section controls how the fabric-ca-server does two things:
+    #  1) authenticates enrollment requests which contain a username and password
+    #     (also known as an enrollment ID and secret).
+    #  2) once authenticated, retrieves the identity's attribute names and
+    #     values which the fabric-ca-server optionally puts into TCerts
+    #     which it issues for transacting on the Hyperledger Fabric blockchain.
+    #     These attributes are useful for making access control decisions in
+    #     chaincode.
+    #  There are two main configuration options:
+    #  1) The fabric-ca-server is the registry.
+    #     This is true if "ldap.enabled" in the ldap section below is false.
+    #  2) An LDAP server is the registry, in which case the fabric-ca-server
+    #     calls the LDAP server to perform these tasks.
+    #     This is true if "ldap.enabled" in the ldap section below is true,
+    #     which means this "registry" section is ignored.
+    #############################################################################
+    registry:
+      # Maximum number of times a password/secret can be reused for enrollment
+      # (default: -1, which means there is no limit)
+      maxenrollments: -1
+      # Contains identity information which is used when LDAP is disabled
+      identities:
+         - name: <<<ADMIN>>>
+           pass: <<<ADMINPW>>>
+           type: client
+           affiliation: ""
+           attrs:
+              hf.Registrar.Roles: "peer,orderer,client,user"
+              hf.Registrar.DelegateRoles: "peer,orderer,client,user"
+              hf.Revoker: true
+              hf.IntermediateCA: true
+              hf.GenCRL: true
+              hf.Registrar.Attributes: "*"
+              hf.AffiliationMgr: true
+    #############################################################################
+    #  Database section
+    #  Supported types are: "sqlite3", "postgres", and "mysql".
+    #  The datasource value depends on the type.
+    #  If the type is "sqlite3", the datasource value is a file name to use
+    #  as the database store.  Since "sqlite3" is an embedded database, it
+    #  may not be used if you want to run the fabric-ca-server in a cluster.
+    #  To run the fabric-ca-server in a cluster, you must choose "postgres"
+    #  or "mysql".
+    #############################################################################
+    db:
+      type: <<<DB_TYPE>>>
+      datasource: <<<DB_DATASOURCE>>>
+      tls:
+          enabled: false
+          certfiles:
+          client:
+            certfile:
+            keyfile:
+    #############################################################################
+    #  LDAP section
+    #  If LDAP is enabled, the fabric-ca-server calls LDAP to:
+    #  1) authenticate enrollment ID and secret (i.e. username and password)
+    #     for enrollment requests;
+    #  2) To retrieve identity attributes
+    #############################################################################
+    ldap:
+       # Enables or disables the LDAP client (default: false)
+       # If this is set to true, the "registry" section is ignored.
+       enabled: false
+       # The URL of the LDAP server
+       url: ldap://<adminDN>:<adminPassword>@<host>:<port>/<base>
+       # TLS configuration for the client connection to the LDAP server
+       tls:
+          certfiles:
+          client:
+             certfile:
+             keyfile:
+       # Attribute related configuration for mapping from LDAP entries to Fabric CA attributes
+       attribute:
+          # 'names' is an array of strings containing the LDAP attribute names which are
+          # requested from the LDAP server for an LDAP identity's entry
+          names: ['uid','member']
+          # The 'converters' section is used to convert an LDAP entry to the value of
+          # a fabric CA attribute.
+          # For example, the following converts an LDAP 'uid' attribute
+          # whose value begins with 'revoker' to a fabric CA attribute
+          # named "hf.Revoker" with a value of "true" (because the boolean expression
+          # evaluates to true).
+          #    converters:
+          #       - name: hf.Revoker
+          #         value: attr("uid") =~ "revoker*"
+          converters:
+             - name:
+               value:
+          # The 'maps' section contains named maps which may be referenced by the 'map'
+          # function in the 'converters' section to map LDAP responses to arbitrary values.
+          # For example, assume a user has an LDAP attribute named 'member' which has multiple
+          # values which are each a distinguished name (i.e. a DN). For simplicity, assume the
+          # values of the 'member' attribute are 'dn1', 'dn2', and 'dn3'.
+          # Further assume the following configuration.
+          #    converters:
+          #       - name: hf.Registrar.Roles
+          #         value: map(attr("member"),"groups")
+          #    maps:
+          #       groups:
+          #          - name: dn1
+          #            value: peer
+          #          - name: dn2
+          #            value: client
+          # The value of the user's 'hf.Registrar.Roles' attribute is then computed to be
+          # "peer,client,dn3".  This is because the value of 'attr("member")' is
+          # "dn1,dn2,dn3", and the call to 'map' with a 2nd argument of
+          # "group" replaces "dn1" with "peer" and "dn2" with "client".
+          maps:
+             groups:
+                - name:
+                  value:
+    #############################################################################
+    # Affiliations section, specified as hierarchical maps.
+    # Note: Affiliations are case sensitive except for the non-leaf affiliations.
+    #############################################################################
+    affiliations:
+    {{ toYaml .Values.config.affiliations | indent 4 }}
+    #############################################################################
+    #  Signing section
+    #
+    #  The "default" subsection is used to sign enrollment certificates;
+    #  the default expiration ("expiry" field) is "8760h", which is 1 year in hours.
+    #
+    #  The "ca" profile subsection is used to sign intermediate CA certificates;
+    #  the default expiration ("expiry" field) is "43800h" which is 5 years in hours.
+    #  Note that "isca" is true, meaning that it issues a CA certificate.
+    #  A maxpathlen of 0 means that the intermediate CA cannot issue other
+    #  intermediate CA certificates, though it can still issue end entity certificates.
+    #  (See RFC 5280, section 4.2.1.9)
+    #
+    #  The "tls" profile subsection is used to sign TLS certificate requests;
+    #  the default expiration ("expiry" field) is "8760h", which is 1 year in hours.
+    #############################################################################
+    signing:
+        default:
+          usage:
+            - digital signature
+          expiry: 8760h
+        profiles:
+          ca:
+             usage:
+               - cert sign
+               - crl sign
+             expiry: 43800h
+             caconstraint:
+               isca: true
+               maxpathlen: 0
+          tls:
+             usage:
+                - signing
+                - key encipherment
+                - server auth
+                - client auth
+                - key agreement
+             expiry: 8760h
+    ###########################################################################
+    #  Certificate Signing Request (CSR) section.
+    #  This controls the creation of the root CA certificate.
+    #  The expiration for the root CA certificate is configured with the
+    #  "ca.expiry" field below, whose default value is "131400h" which is
+    #  15 years in hours.
+    #  The pathlength field is used to limit CA certificate hierarchy as described
+    #  in section 4.2.1.9 of RFC 5280.
+    #  Examples:
+    #  1) No pathlength value means no limit is requested.
+    #  2) pathlength == 1 means a limit of 1 is requested which is the default for
+    #     a root CA.  This means the root CA can issue intermediate CA certificates,
+    #     but these intermediate CAs may not in turn issue other CA certificates
+    #     though they can still issue end entity certificates.
+    #  3) pathlength == 0 means a limit of 0 is requested;
+    #     this is the default for an intermediate CA, which means it can not issue
+    #     CA certificates though it can still issue end entity certificates.
+    ###########################################################################
+    csr:
+       {{- if .Values.config.intermediate }}
+       cn:
+       {{- else}}
+       cn: {{ .Values.caName | quote }}
+       {{- end}}
+       names:
+          - C: {{ .Values.config.csr.names.c | quote }}
+            ST: {{ .Values.config.csr.names.st | quote }}
+            L: {{ .Values.config.csr.names.l | quote }}
+            O: {{ .Values.config.csr.names.o | quote }}
+            OU: {{ .Values.config.csr.names.ou | quote }}
+       hosts:
+         - localhost
+         # K8S Service
+         - {{ include "hlf-ca.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local
+         {{- if .Values.ingress.enabled }}
+         # Ingresses
+         {{- range .Values.ingress.hosts }}
+         - {{ . }}
+         {{- end }}
+         {{- end }}
+       ca:
+          expiry: 131400h
+          pathlength: {{ .Values.config.csr.ca.pathlength}}
+    #############################################################################
+    # BCCSP (BlockChain Crypto Service Provider) section is used to select which
+    # crypto library implementation to use
+    #############################################################################
+    bccsp:
+        default: SW
+        sw:
+            hash: SHA2
+            security: 256
+            filekeystore:
+                # The directory used for the software file-based keystore
+                keystore: msp/keystore
+    #############################################################################
+    # Multi CA section (unused in a K8S deployment)
+    #############################################################################
+    cacount:
+    cafiles:
+    #############################################################################
+    # Intermediate CA section
+    #
+    # The relationship between servers and CAs is as follows:
+    #   1) A single server process may contain or function as one or more CAs.
+    #      This is configured by the "Multi CA section" above.
+    #   2) Each CA is either a root CA or an intermediate CA.
+    #   3) Each intermediate CA has a parent CA which is either a root CA or another intermediate CA.
+    #
+    # This section pertains to configuration of #2 and #3.
+    # If the "intermediate.parentserver.url" property is set,
+    # then this is an intermediate CA with the specified parent
+    # CA.
+    #
+    # parentserver section
+    #    url - The URL of the parent server
+    #    caname - Name of the CA to enroll within the server
+    #
+    # enrollment section used to enroll intermediate CA with parent CA
+    #    profile - Name of the signing profile to use in issuing the certificate
+    #    label - Label to use in HSM operations
+    #
+    # tls section for secure socket connection
+    #   certfiles - PEM-encoded list of trusted root certificate files
+    #   client:
+    #     certfile - PEM-encoded certificate file for when client authentication
+    #     is enabled on server
+    #     keyfile - PEM-encoded key file for when client authentication
+    #     is enabled on server
+    #############################################################################
+    intermediate:
+      parentserver:
+        {{- if .Values.config.intermediate }}
+        url: http://<<<PARENT_ADMIN>>>:<<<PARENT_ADMINPW>>>@{{ .Values.config.intermediate.parent.url }}:{{ .Values.config.intermediate.parent.port }}
+        {{- else}}
+        url:
+        {{- end}}
+        caname:
+      enrollment:
+        hosts:
+        profile:
+        label:
+      tls:
+        certfiles:
+        client:
+          certfile:
+          keyfile:
+    #############################################################################
+    # Extra configuration options
+    # .e.g to enable adding and removing affiliations or identities
+    #############################################################################
+    cfg:
+      affiliations:
+        allowremove: true
+      identities:
+        allowremove: true
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "hlf-ca.fullname" . }}--db
+  labels:
+{{ include "labels.standard" . | indent 4 }}
+data:
+  DB_TYPE: postgres
+  DB_USERNAME: postgres
+  DB_DATABASE: {{ .Values.db.database | quote }}
+  DB_HOST: {{ .Values.db.chart }}.{{ .Release.Namespace }}.svc.cluster.local
+  DB_PORT: "5432"
+  DB_SSL: disable
@@ -0,0 +1,113 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "hlf-ca.fullname" . }}
+  labels:
+{{ include "labels.standard" . | indent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ include "hlf-ca.name" . }}
+      release: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+{{ include "labels.standard" . | indent 8 }}
+    spec:
+      volumes:
+        - name: data
+        {{- if .Values.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.existingClaim | default (include "hlf-ca.fullname" .) }}
+        {{- else }}
+          emptyDir: {}
+        {{- end }}
+        {{- if .Values.ingress.tls }}
+        - name: tls-secret
+          secret:
+            secretName: {{ (index .Values.ingress.tls 0).secretName }}
+        {{- end }}
+        - name: ca-config
+          configMap:
+            name: {{ include "hlf-ca.fullname" . }}--config
+      containers:
+        - name: ca
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          # TODO: Add liveness and readiness probes (for health checks)
+          command:
+            - sh
+            - -c
+            - |
+              export DB_DATASOURCE="host=${DB_HOST} port=${DB_PORT} user=${DB_USERNAME} password=${DB_PASSWORD} dbname=${DB_DATABASE} sslmode=${DB_SSL}"
+              mkdir -p $FABRIC_CA_HOME
+              cp /var/hyperledger/ca_config/ca.yaml $FABRIC_CA_HOME/fabric-ca-server-config.yaml
+              sed -i "s/<<<ADMIN>>>/${CA_ADMIN}/g" ${FABRIC_CA_HOME}/fabric-ca-server-config.yaml
+              sed -i "s/<<<ADMINPW>>>/${CA_PASSWORD}/g" $FABRIC_CA_HOME/fabric-ca-server-config.yaml
+              sed -i "s/<<<DB_TYPE>>>/${DB_TYPE}/g" $FABRIC_CA_HOME/fabric-ca-server-config.yaml
+              sed -i "s/<<<DB_DATASOURCE>>>/${DB_DATASOURCE}/g" $FABRIC_CA_HOME/fabric-ca-server-config.yaml
+
+              {{- if .Values.config.intermediate }}
+              echo ">\033[0;33m Adding Parent CA (typically a Root CA) values to $FABRIC_CA_HOME/fabric-ca-server-config.yaml \033[0m"
+              sed -i "s/<<<PARENT_ADMIN>>>/${PARENT_CA_ADMIN}/g" $FABRIC_CA_HOME/fabric-ca-server-config.yaml
+              sed -i "s/<<<PARENT_ADMINPW>>>/${PARENT_CA_PASSWORD}/g" $FABRIC_CA_HOME/fabric-ca-server-config.yaml
+              {{- end}}
+
+              echo ">\033[0;35m fabric-ca-server start \033[0m"
+              fabric-ca-server start
+          envFrom:
+            - secretRef:
+                name: {{ include "hlf-ca.fullname" . }}
+            - configMapRef:
+                name: {{ include "hlf-ca.fullname" . }}--db
+            - configMapRef:
+                name: {{ include "hlf-ca.fullname" . }}--ca
+          env:
+            # Database environmental variable
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.db.chart | quote }}
+                  key: postgres-password
+            {{- if .Values.config.intermediate }}
+            - name: PARENT_CA_ADMIN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.intermediate.parent.chart | quote }}
+                  key: CA_ADMIN
+            - name: PARENT_CA_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.intermediate.parent.chart | quote }}
+                  key: CA_PASSWORD
+            {{- end}}
+          ports:
+            - name: ca-port
+              containerPort: 7054
+              protocol: TCP
+          volumeMounts:
+            - name: data
+              mountPath: /var/hyperledger
+            - name: ca-config
+              readOnly: true
+              mountPath: /var/hyperledger/ca_config
+            {{- if .Values.ingress.tls }}
+            - name: tls-secret
+              readOnly: true
+              mountPath: /var/hyperledger/tls_secret
+            {{- end }}
+          resources:
+{{ toYaml .Values.resources | indent 12 }}
+    {{- with .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
@@ -0,0 +1,35 @@
+{{- if .Values.ingress.enabled -}}
+{{- $fullName := include "hlf-ca.fullname" . -}}
+{{- $ingressPath := .Values.ingress.path -}}
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  labels:
+{{ include "labels.standard" . | indent 4 }}
+{{- with .Values.ingress.annotations }}
+  annotations:
+{{ toYaml . | indent 4 }}
+{{- end }}
+spec:
+{{- if .Values.ingress.tls }}
+  tls:
+  {{- range .Values.ingress.tls }}
+    - hosts:
+      {{- range .hosts }}
+        - {{ . }}
+      {{- end }}
+      secretName: {{ .secretName }}
+  {{- end }}
+{{- end }}
+  rules:
+  {{- range .Values.ingress.hosts }}
+    - host: {{ . }}
+      http:
+        paths:
+          - path: {{ $ingressPath }}
+            backend:
+              serviceName: {{ $fullName }}
+              servicePort: http
+  {{- end }}
+{{- end }}
@@ -0,0 +1,21 @@
+{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ include "hlf-ca.fullname" . }}
+  labels:
+{{ include "labels.standard" . | indent 4 }}
+{{- if .Values.persistence.annotations }}
+  annotations:
+{{ toYaml .Values.persistence.annotations | indent 4 }}
+{{- end }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode | quote }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size | quote }}
+  {{- if .Values.persistence.storageClass }}
+  storageClassName: {{ .Values.persistence.storageClass | quote }}
+  {{- end }}
+{{- end }}
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "hlf-ca.fullname" . }}
+  labels:
+{{ include "labels.standard" . | indent 4 }}
+type: Opaque
+data:
+  CA_ADMIN: {{ .Values.adminUsername | b64enc | quote }}
+  {{ if .Values.adminPassword }}
+  CA_PASSWORD:  {{ .Values.adminPassword | b64enc | quote }}
+  {{ else }}
+  CA_PASSWORD: {{ randAlphaNum 24 | b64enc | quote }}
+  {{ end }}
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "hlf-ca.fullname" . }}
+  labels:
+{{ include "labels.standard" . | indent 4 }}
+spec:
+  type: {{ .Values.service.type | quote }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: 7054
+      protocol: TCP
+      name: http
+  selector:
+    app: {{ include "hlf-ca.name" . }}
+    release: {{ .Release.Name }}
@@ -0,0 +1,99 @@
+## Default values for hlf-ca.
+## This is a YAML-formatted file.
+## Declare variables to be passed into your templates.
+
+image:
+  repository: hyperledger/fabric-ca
+  tag: x86_64-1.1.0
+  pullPolicy: IfNotPresent
+
+service:
+  ## Cluster IP or LoadBalancer
+  type: ClusterIP
+  port: 7054
+
+ingress:
+  enabled: false
+  annotations: {}
+    # kubernetes.io/ingress.class: nginx
+    # certmanager.k8s.io/cluster-issuer: "letsencrypt-staging"
+  path: /
+  hosts:
+    - hlf-ca.local
+  tls: []
+  #  - secretName: hlf-ca-tls
+  #    hosts:
+  #      - hlf-ca.local
+
+persistence:
+  enabled: true
+  annotations: {}
+  ## If unset or "", use "default" storage class.
+  storageClass: ""
+  accessMode: ReadWriteOnce
+  size: 1Gi
+  # existingClaim: ""
+
+##################################
+## Further configuration options #
+##################################
+## CA Admin Username
+adminUsername: admin
+## CA Admin password (set to 24 random characters by default)
+# adminPassword:
+## Name of CA, stored in FABRIC_CA_SERVER_CA_NAME (and the configMap "--config", if deploying a Root CA)
+caName: org1-ca
+
+## Settings used in configMap "--db"
+db:
+  chart: postgres-ca-postgresql
+  database: fabric_ca
+
+## Settings used in configMap "--config"
+config:
+  ## Enable debug logging in ca Server configuration file
+  debug: true
+  ## CSR pathlength in ca Server configuration file
+  csr:
+    ca:
+      pathlength: 1
+    names:
+      c: US
+      st: "North Carolina"
+      l:
+      o: Hyperledger
+      ou: Fabric
+  ## "intermediate" is only specified for Intermediate CA's
+  # intermediate:
+  #   parent:
+  #     chart: parent-ca
+  #     url: parent-ca.example.com
+  #     port: 7054
+  ## Affiliations used in ca Server configuration file
+  affiliations:
+    org1: []
+
+resources: {}
+  ## We usually recommend not to specify default resources and to leave this as a conscious
+  ## choice for the user. This also increases chances charts run on environments with little
+  ## resources, such as Minikube. If you do want to specify resources, uncomment the following
+  ## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+  # limits:
+  #   cpu: 100m
+  #   memory: 128Mi
+  # requests:
+  #   cpu: 100m
+  #   memory: 128Mi
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+  ## Suggested antiAffinity, as each CA should be on a separate Node for resilience
+  # podAntiAffinity:
+  #   requiredDuringSchedulingIgnoredDuringExecution:
+  #     - topologyKey: "kubernetes.io/hostname"
+  #       labelSelector:
+  #         matchLabels:
+  #           app: hlf-ca