From f3aa26446329150f9569b1664fb6228f2eddeb9a Mon Sep 17 00:00:00 2001 From: Sasha Date: Thu, 28 Jun 2018 23:22:21 +0300 Subject: [PATCH] Implement Hyperledger Fabric CA chart (#6181) * Implement hlf-ca chart Signed-off-by: Alejandro Vicente Grabovetsky * Add appVersion to help validation Signed-off-by: Alejandro Vicente Grabovetsky * Small fix for default values of Organisation and OU Signed-off-by: Alejandro Vicente Grabovetsky * Remove service.nodePort from README.md Signed-off-by: Alejandro Vicente Grabovetsky * Fix NOTES.txt Signed-off-by: Alejandro Vicente Grabovetsky * Small edits in values.yaml and README.md Signed-off-by: Alejandro Vicente Grabovetsky * Move chart from incubator to stable Signed-off-by: Alejandro Vicente Grabovetsky * Fix PVC to conform to best practices Signed-off-by: Alejandro Vicente Grabovetsky * Fix deployment.yaml Signed-off-by: Alejandro Vicente Grabovetsky * Move persistent data location to default Hyperledger /var/persistence Signed-off-by: Alejandro Vicente Grabovetsky --- stable/hlf-ca/.helmignore | 21 ++ stable/hlf-ca/Chart.yaml | 19 + stable/hlf-ca/README.md | 118 ++++++ stable/hlf-ca/templates/NOTES.txt | 33 ++ stable/hlf-ca/templates/_helpers.tpl | 45 +++ stable/hlf-ca/templates/configmap--ca.yaml | 11 + .../hlf-ca/templates/configmap--config.yaml | 335 ++++++++++++++++++ stable/hlf-ca/templates/configmap--db.yaml | 13 + stable/hlf-ca/templates/deployment.yaml | 113 ++++++ stable/hlf-ca/templates/ingress.yaml | 35 ++ stable/hlf-ca/templates/pvc.yaml | 21 ++ stable/hlf-ca/templates/secret.yaml | 14 + stable/hlf-ca/templates/service.yaml | 16 + stable/hlf-ca/values.yaml | 99 ++++++ 14 files changed, 893 insertions(+) create mode 100644 stable/hlf-ca/.helmignore create mode 100644 stable/hlf-ca/Chart.yaml create mode 100644 stable/hlf-ca/README.md create mode 100644 stable/hlf-ca/templates/NOTES.txt create mode 100644 stable/hlf-ca/templates/_helpers.tpl create mode 100644 stable/hlf-ca/templates/configmap--ca.yaml create mode 100644 stable/hlf-ca/templates/configmap--config.yaml create mode 100644 stable/hlf-ca/templates/configmap--db.yaml create mode 100644 stable/hlf-ca/templates/deployment.yaml create mode 100644 stable/hlf-ca/templates/ingress.yaml create mode 100644 stable/hlf-ca/templates/pvc.yaml create mode 100644 stable/hlf-ca/templates/secret.yaml create mode 100644 stable/hlf-ca/templates/service.yaml create mode 100644 stable/hlf-ca/values.yaml diff --git a/stable/hlf-ca/.helmignore b/stable/hlf-ca/.helmignore new file mode 100644 index 0000000000..f0c1319444 --- /dev/null +++ b/stable/hlf-ca/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/stable/hlf-ca/Chart.yaml b/stable/hlf-ca/Chart.yaml new file mode 100644 index 0000000000..7ca868b4c4 --- /dev/null +++ b/stable/hlf-ca/Chart.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +description: Hyperledger Fabric Certificate Authority chart (these charts are created by AID:Tech and are currently not directly associated with the Hyperledger project) +name: hlf-ca +version: 1.0.10 +appVersion: 1.1.0 +keywords: + - blockchain + - hyperledger + - fabric +home: http://hyperledger-fabric-ca.readthedocs.io +sources: + - https://github.com/hyperledger/fabric-ca +maintainers: + - name: alexvicegrab + email: sasha@aid.technology + - name: nicolapaoli + email: nicola@aid.technology +## Icon not included while sorting out trademark question with Hyperledger project +# icon: https://www.hyperledger.org/wp-content/uploads/2018/04/fabric-logo.png diff --git a/stable/hlf-ca/README.md b/stable/hlf-ca/README.md new file mode 100644 index 0000000000..6d4d751408 --- /dev/null +++ b/stable/hlf-ca/README.md @@ -0,0 +1,118 @@ +# Hyperledger Fabric CA + +[Hyperledger Fabric CA](http://hyperledger-fabric-ca.readthedocs.io/) is a Certificate Authority node for the [Hyperledger](https://www.hyperledger.org/) Fabric permissioned blockchain framework. Learn more about it by visiting the [user's guide](http://hyperledger-fabric-ca.readthedocs.io/en/latest/users-guide.html#). + +## TL;DR; + +```bash +$ helm install stable/hlf-ca +``` + +## Introduction + +The Hyperledger Fabric CA can be installed as either a Root CA, or an intermediate CA (by pointing to a parent CA, which can itself be a Root CA or an intermediate). + +This CA can then be used to register and enroll identities for clients, admins and nodes of the Hyperledger Fabric network. + +## Prerequisites + +- Kubernetes 1.9+ +- PV provisioner support in the underlying infrastructure. +- A running [PostgreSQL Chart](https://github.com/kubernetes/charts/tree/master/stable/postgresql) to host the Hyperledger Fabric CA data, in a database defined under the settings `db.database`. + +## Installing the Chart + +To install the chart with the release name `org1-ca`: + +```bash +$ helm install stable/hlf-ca --name org1-ca +``` + +The command deploys the Hyperledger Fabric CA on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. + +### Custom parameters + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example: + +```bash +$ helm install stable/hlf-ca --name org1-ca --set adminUsername=ca-admin,adminPassword=secretpassword +``` + +The above command creates a CA Admin user named `ca-admin` with password `secretpassword`. + +Alternatively, a YAML file can be provided while installing the chart. This file specifies values to override those provided in the defualt values.yaml. For example, + +```bash +$ helm install stable/hlf-ca --name org1-ca -f my-values.yaml +``` + +## Updating the chart + +When updating the chart, make sure you provide the `adminPassword`, otherwise `helm update` will generate a new random (and invalid) password. + +```bash +$ export CA_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} org1-ca -o jsonpath="{.data.CA_PASSWORD}" | base64 --decode; echo) +$ helm upgrade org1-ca stable/hlf-ca --set adminPassword=$CA_PASSWORD +``` + +## Uninstalling the Chart + +To uninstall/delete the `org1-ca` deployment: + +```bash +$ helm delete org1-ca +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +## Configuration + +The following table lists the configurable parameters of the Hyperledger Fabric CA chart and default values. + +| Parameter | Description | Default | +| ---------------------------------- | ------------------------------------------------ | ---------------------------------------------------------- | +| `image.repository` | `hlf-ca` image repository | `hyperledger/fabric-ca` | +| `image.tag` | `hlf-ca` image tag | `x86_64-1.1.0` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `service.port` | TCP port | `7054` | +| `service.type` | K8S service type exposing ports, e.g. `ClusterIP`| `ClusterIP` | +| `ingress.enabled` | If true, Ingress will be created | `false` | +| `ingress.annotations` | Ingress annotations | `{}` | +| `ingress.path` | Ingress path | `/` | +| `ingress.hosts` | Ingress hostnames | `[]` | +| `ingress.tls` | Ingress TLS configuration | `[]` | +| `persistence.accessMode` | Use volume as ReadOnly or ReadWrite | `ReadWriteOnce` | +| `persistence.annotations` | Persistent Volume annotations | `{}` | +| `persistence.size` | Size of data volume | `1Gi` | +| `persistence.storageClass` | Storage class of backing PVC | `default` | +| `adminUsername` | Admin Username for CA | `admin` | +| `adminPassword` | Admin Password | Random 24 alphanumeric characters | +| `caName` | Name of CA | `org1-ca` | +| `db.chart` | Name of a Database Chart holding CA data | `postgres-ca-postgresql` supports postgresql | +| `db.database` | Name of the actual Database holding the CA data | `fabric_ca` | +| `config.debug` | Enable debug logging | `true` | +| `config.csr.ca.pathlength` | Pathlength of CA certificate hierarchy | `1` | +| `config.csr.names.c` | Country to which CA belongs | `US` | +| `config.csr.names.st` | State to which CA belongs | `North Carolina` | +| `config.csr.names.l` | Locality to which CA belongs | `` | +| `config.csr.names.o` | Organization to which CA belongs | `Hyperledger` | +| `config.csr.names.ou` | Organizational Unit to which CA belongs | `Fabric` | +| `config.intermediate` | Structure defining that CA is intermediate | `nil` | +| `config.intermediate.parent.chart` | Which hlf-ca chart acts as parent to this CA | `nil` | +| `config.intermediate.parent.url` | URL of parent CA | `nil` | +| `config.intermediate.parent.port` | Port of parent CA | `nil` | +| `config.affiliations` | Affiliations for CA | `{org1: [] }` | +| `resources` | CPU/Memory resource requests/limits | `{}` | +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `tolerations` | Toleration labels for pod assignment | `[]` | +| `affinity` | Affinity settings for pod assignment | `{}` | + +## Persistence + +The volume stores the Fabric_CA data and configurations at the `/var/hyperledger` path of the container. + +The chart mounts a [Persistent Volume](http://kubernetes.io/docs/user-guide/persistent-volumes/) at this location. The volume is created using dynamic volume provisioning through a PersistentVolumeClaim managed by the chart. + +## Feedback and feature requests + +This is a work in progress and we are happy to accept feature requests. We are even happier to accept pull requests implementing improvements :-) diff --git a/stable/hlf-ca/templates/NOTES.txt b/stable/hlf-ca/templates/NOTES.txt new file mode 100644 index 0000000000..56e64db4c3 --- /dev/null +++ b/stable/hlf-ca/templates/NOTES.txt @@ -0,0 +1,33 @@ +Run the following commands to... +1. Get the name of the pod running the Fabric CA Server: + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ include "hlf-ca.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + +2. Get the application URL: +{{- if .Values.ingress.enabled }} +{{- range .Values.ingress.hosts }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ . }}{{ $.Values.ingress.path }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "hlf-ca.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get svc -w {{ include "hlf-ca.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "hlf-ca.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}') + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl port-forward $POD_NAME 8080:7054 +{{- end }} + +3. Display local (admin "client" enrollment) certificate, if it has been created: + kubectl exec $POD_NAME -- cat /var/hyperledger/fabric-ca/msp/signcerts/cert.pem + +4. Enroll the bootstrap admin identity: + kubectl exec $POD_NAME -- bash -c 'fabric-ca-client enroll -d -u http://$CA_ADMIN:$CA_PASSWORD@$SERVICE_DNS:{{ .Values.service.port }}' + +5. Update the chart without resetting a password: + export CA_ADMIN=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "hlf-ca.fullname" . }} -o jsonpath="{.data.CA_ADMIN}" | base64 --decode; echo) + export CA_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "hlf-ca.fullname" . }} -o jsonpath="{.data.CA_PASSWORD}" | base64 --decode; echo) + helm upgrade {{ .Release.Name }} stable/hlf-ca --namespace {{ .Release.Namespace }} -f my-values.yaml --set adminUsername=$CA_ADMIN,adminPassword=$CA_PASSWORD diff --git a/stable/hlf-ca/templates/_helpers.tpl b/stable/hlf-ca/templates/_helpers.tpl new file mode 100644 index 0000000000..e7f6f95d75 --- /dev/null +++ b/stable/hlf-ca/templates/_helpers.tpl @@ -0,0 +1,45 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "hlf-ca.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "hlf-ca.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "hlf-ca.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- /* +Credit: @technosophos +https://github.com/technosophos/common-chart/ +labels.standard prints the standard Helm labels. +The standard labels are frequently used in metadata. +*/ -}} +{{- define "labels.standard" -}} +app: {{ include "hlf-ca.name" . }} +heritage: {{ .Release.Service | quote }} +release: {{ .Release.Name | quote }} +chart: {{ include "hlf-ca.chart" . }} +{{- end -}} diff --git a/stable/hlf-ca/templates/configmap--ca.yaml b/stable/hlf-ca/templates/configmap--ca.yaml new file mode 100644 index 0000000000..340e6aae68 --- /dev/null +++ b/stable/hlf-ca/templates/configmap--ca.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "hlf-ca.fullname" . }}--ca + labels: +{{ include "labels.standard" . | indent 4 }} +data: + GODEBUG: "netdns=go" + FABRIC_CA_HOME: /var/hyperledger/fabric-ca + FABRIC_CA_SERVER_CA_NAME: {{ .Values.caName | quote }} + SERVICE_DNS: {{ include "hlf-ca.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local diff --git a/stable/hlf-ca/templates/configmap--config.yaml b/stable/hlf-ca/templates/configmap--config.yaml new file mode 100644 index 0000000000..c8be93dd3b --- /dev/null +++ b/stable/hlf-ca/templates/configmap--config.yaml @@ -0,0 +1,335 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "hlf-ca.fullname" . }}--config + labels: +{{ include "labels.standard" . | indent 4 }} +data: + ca.yaml: | + ############################################################################# + # This is a configuration file for the fabric-ca-server command. + ############################################################################# + # Version of config file + version: 1.1.0 + # Server's listening port + port: 7054 + # Enables debug logging + debug: {{ .Values.config.debug }} + # Size limit of an acceptable CRL in bytes (default: 512000) + crlsizelimit: 512000 + ############################################################################# + # TLS section + ############################################################################# + tls: + # Enable TLS (handled by the Ingress) + enabled: false + # TLS for the server's listening port + certfile: /var/hyperledger/tls_secret/tls.crt + keyfile: /var/hyperledger/tls_secret/tls.key + clientauth: + # Supported types: NoClientCert, RequestClientCert, RequireAnyClientCert, VerifyClientCertIfGiven and RequireAndVerifyClientCert. + type: noclientcert + # List of root certificate authorities used when verifying client certificates + certfiles: + ############################################################################# + # The CA section contains information related to the Certificate Authority + # including the name of the CA, which should be unique for all members + # of a blockchain network. It also includes the key and certificate files + # used when issuing enrollment certificates (ECerts) and transaction + # certificates (TCerts). + # The chainfile (if it exists) contains the certificate chain which + # should be trusted for this CA, where the 1st in the chain is always the + # root CA certificate. + ############################################################################# + ca: + # Name of this CA + name: + # Key file (is only used to import a private key into BCCSP) + keyfile: + # Certificate file (default: ca-cert.pem) + certfile: /var/hyperledger/fabric-ca/msp/certs/{{ include "hlf-ca.fullname" . }}-cert.pem + # Chain file + chainfile: + ############################################################################# + # The gencrl REST endpoint is used to generate a CRL that contains revoked + # certificates. This section contains configuration options that are used + # during gencrl request processing. + ############################################################################# + crl: + # Specifies expiration for the generated CRL. The number of hours + # specified by this property is added to the UTC time, the resulting time + # is used to set the 'Next Update' date of the CRL. + expiry: 24h + ############################################################################# + # The registry section controls how the fabric-ca-server does two things: + # 1) authenticates enrollment requests which contain a username and password + # (also known as an enrollment ID and secret). + # 2) once authenticated, retrieves the identity's attribute names and + # values which the fabric-ca-server optionally puts into TCerts + # which it issues for transacting on the Hyperledger Fabric blockchain. + # These attributes are useful for making access control decisions in + # chaincode. + # There are two main configuration options: + # 1) The fabric-ca-server is the registry. + # This is true if "ldap.enabled" in the ldap section below is false. + # 2) An LDAP server is the registry, in which case the fabric-ca-server + # calls the LDAP server to perform these tasks. + # This is true if "ldap.enabled" in the ldap section below is true, + # which means this "registry" section is ignored. + ############################################################################# + registry: + # Maximum number of times a password/secret can be reused for enrollment + # (default: -1, which means there is no limit) + maxenrollments: -1 + # Contains identity information which is used when LDAP is disabled + identities: + - name: <<>> + pass: <<>> + type: client + affiliation: "" + attrs: + hf.Registrar.Roles: "peer,orderer,client,user" + hf.Registrar.DelegateRoles: "peer,orderer,client,user" + hf.Revoker: true + hf.IntermediateCA: true + hf.GenCRL: true + hf.Registrar.Attributes: "*" + hf.AffiliationMgr: true + ############################################################################# + # Database section + # Supported types are: "sqlite3", "postgres", and "mysql". + # The datasource value depends on the type. + # If the type is "sqlite3", the datasource value is a file name to use + # as the database store. Since "sqlite3" is an embedded database, it + # may not be used if you want to run the fabric-ca-server in a cluster. + # To run the fabric-ca-server in a cluster, you must choose "postgres" + # or "mysql". + ############################################################################# + db: + type: <<>> + datasource: <<>> + tls: + enabled: false + certfiles: + client: + certfile: + keyfile: + ############################################################################# + # LDAP section + # If LDAP is enabled, the fabric-ca-server calls LDAP to: + # 1) authenticate enrollment ID and secret (i.e. username and password) + # for enrollment requests; + # 2) To retrieve identity attributes + ############################################################################# + ldap: + # Enables or disables the LDAP client (default: false) + # If this is set to true, the "registry" section is ignored. + enabled: false + # The URL of the LDAP server + url: ldap://:@:/ + # TLS configuration for the client connection to the LDAP server + tls: + certfiles: + client: + certfile: + keyfile: + # Attribute related configuration for mapping from LDAP entries to Fabric CA attributes + attribute: + # 'names' is an array of strings containing the LDAP attribute names which are + # requested from the LDAP server for an LDAP identity's entry + names: ['uid','member'] + # The 'converters' section is used to convert an LDAP entry to the value of + # a fabric CA attribute. + # For example, the following converts an LDAP 'uid' attribute + # whose value begins with 'revoker' to a fabric CA attribute + # named "hf.Revoker" with a value of "true" (because the boolean expression + # evaluates to true). + # converters: + # - name: hf.Revoker + # value: attr("uid") =~ "revoker*" + converters: + - name: + value: + # The 'maps' section contains named maps which may be referenced by the 'map' + # function in the 'converters' section to map LDAP responses to arbitrary values. + # For example, assume a user has an LDAP attribute named 'member' which has multiple + # values which are each a distinguished name (i.e. a DN). For simplicity, assume the + # values of the 'member' attribute are 'dn1', 'dn2', and 'dn3'. + # Further assume the following configuration. + # converters: + # - name: hf.Registrar.Roles + # value: map(attr("member"),"groups") + # maps: + # groups: + # - name: dn1 + # value: peer + # - name: dn2 + # value: client + # The value of the user's 'hf.Registrar.Roles' attribute is then computed to be + # "peer,client,dn3". This is because the value of 'attr("member")' is + # "dn1,dn2,dn3", and the call to 'map' with a 2nd argument of + # "group" replaces "dn1" with "peer" and "dn2" with "client". + maps: + groups: + - name: + value: + ############################################################################# + # Affiliations section, specified as hierarchical maps. + # Note: Affiliations are case sensitive except for the non-leaf affiliations. + ############################################################################# + affiliations: + {{ toYaml .Values.config.affiliations | indent 4 }} + ############################################################################# + # Signing section + # + # The "default" subsection is used to sign enrollment certificates; + # the default expiration ("expiry" field) is "8760h", which is 1 year in hours. + # + # The "ca" profile subsection is used to sign intermediate CA certificates; + # the default expiration ("expiry" field) is "43800h" which is 5 years in hours. + # Note that "isca" is true, meaning that it issues a CA certificate. + # A maxpathlen of 0 means that the intermediate CA cannot issue other + # intermediate CA certificates, though it can still issue end entity certificates. + # (See RFC 5280, section 4.2.1.9) + # + # The "tls" profile subsection is used to sign TLS certificate requests; + # the default expiration ("expiry" field) is "8760h", which is 1 year in hours. + ############################################################################# + signing: + default: + usage: + - digital signature + expiry: 8760h + profiles: + ca: + usage: + - cert sign + - crl sign + expiry: 43800h + caconstraint: + isca: true + maxpathlen: 0 + tls: + usage: + - signing + - key encipherment + - server auth + - client auth + - key agreement + expiry: 8760h + ########################################################################### + # Certificate Signing Request (CSR) section. + # This controls the creation of the root CA certificate. + # The expiration for the root CA certificate is configured with the + # "ca.expiry" field below, whose default value is "131400h" which is + # 15 years in hours. + # The pathlength field is used to limit CA certificate hierarchy as described + # in section 4.2.1.9 of RFC 5280. + # Examples: + # 1) No pathlength value means no limit is requested. + # 2) pathlength == 1 means a limit of 1 is requested which is the default for + # a root CA. This means the root CA can issue intermediate CA certificates, + # but these intermediate CAs may not in turn issue other CA certificates + # though they can still issue end entity certificates. + # 3) pathlength == 0 means a limit of 0 is requested; + # this is the default for an intermediate CA, which means it can not issue + # CA certificates though it can still issue end entity certificates. + ########################################################################### + csr: + {{- if .Values.config.intermediate }} + cn: + {{- else}} + cn: {{ .Values.caName | quote }} + {{- end}} + names: + - C: {{ .Values.config.csr.names.c | quote }} + ST: {{ .Values.config.csr.names.st | quote }} + L: {{ .Values.config.csr.names.l | quote }} + O: {{ .Values.config.csr.names.o | quote }} + OU: {{ .Values.config.csr.names.ou | quote }} + hosts: + - localhost + # K8S Service + - {{ include "hlf-ca.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local + {{- if .Values.ingress.enabled }} + # Ingresses + {{- range .Values.ingress.hosts }} + - {{ . }} + {{- end }} + {{- end }} + ca: + expiry: 131400h + pathlength: {{ .Values.config.csr.ca.pathlength}} + ############################################################################# + # BCCSP (BlockChain Crypto Service Provider) section is used to select which + # crypto library implementation to use + ############################################################################# + bccsp: + default: SW + sw: + hash: SHA2 + security: 256 + filekeystore: + # The directory used for the software file-based keystore + keystore: msp/keystore + ############################################################################# + # Multi CA section (unused in a K8S deployment) + ############################################################################# + cacount: + cafiles: + ############################################################################# + # Intermediate CA section + # + # The relationship between servers and CAs is as follows: + # 1) A single server process may contain or function as one or more CAs. + # This is configured by the "Multi CA section" above. + # 2) Each CA is either a root CA or an intermediate CA. + # 3) Each intermediate CA has a parent CA which is either a root CA or another intermediate CA. + # + # This section pertains to configuration of #2 and #3. + # If the "intermediate.parentserver.url" property is set, + # then this is an intermediate CA with the specified parent + # CA. + # + # parentserver section + # url - The URL of the parent server + # caname - Name of the CA to enroll within the server + # + # enrollment section used to enroll intermediate CA with parent CA + # profile - Name of the signing profile to use in issuing the certificate + # label - Label to use in HSM operations + # + # tls section for secure socket connection + # certfiles - PEM-encoded list of trusted root certificate files + # client: + # certfile - PEM-encoded certificate file for when client authentication + # is enabled on server + # keyfile - PEM-encoded key file for when client authentication + # is enabled on server + ############################################################################# + intermediate: + parentserver: + {{- if .Values.config.intermediate }} + url: http://<<>>:<<>>@{{ .Values.config.intermediate.parent.url }}:{{ .Values.config.intermediate.parent.port }} + {{- else}} + url: + {{- end}} + caname: + enrollment: + hosts: + profile: + label: + tls: + certfiles: + client: + certfile: + keyfile: + ############################################################################# + # Extra configuration options + # .e.g to enable adding and removing affiliations or identities + ############################################################################# + cfg: + affiliations: + allowremove: true + identities: + allowremove: true diff --git a/stable/hlf-ca/templates/configmap--db.yaml b/stable/hlf-ca/templates/configmap--db.yaml new file mode 100644 index 0000000000..1588c5e378 --- /dev/null +++ b/stable/hlf-ca/templates/configmap--db.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "hlf-ca.fullname" . }}--db + labels: +{{ include "labels.standard" . | indent 4 }} +data: + DB_TYPE: postgres + DB_USERNAME: postgres + DB_DATABASE: {{ .Values.db.database | quote }} + DB_HOST: {{ .Values.db.chart }}.{{ .Release.Namespace }}.svc.cluster.local + DB_PORT: "5432" + DB_SSL: disable diff --git a/stable/hlf-ca/templates/deployment.yaml b/stable/hlf-ca/templates/deployment.yaml new file mode 100644 index 0000000000..feeb8ecde1 --- /dev/null +++ b/stable/hlf-ca/templates/deployment.yaml @@ -0,0 +1,113 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "hlf-ca.fullname" . }} + labels: +{{ include "labels.standard" . | indent 4 }} +spec: + replicas: 1 + selector: + matchLabels: + app: {{ include "hlf-ca.name" . }} + release: {{ .Release.Name }} + template: + metadata: + labels: +{{ include "labels.standard" . | indent 8 }} + spec: + volumes: + - name: data + {{- if .Values.persistence.enabled }} + persistentVolumeClaim: + claimName: {{ .Values.persistence.existingClaim | default (include "hlf-ca.fullname" .) }} + {{- else }} + emptyDir: {} + {{- end }} + {{- if .Values.ingress.tls }} + - name: tls-secret + secret: + secretName: {{ (index .Values.ingress.tls 0).secretName }} + {{- end }} + - name: ca-config + configMap: + name: {{ include "hlf-ca.fullname" . }}--config + containers: + - name: ca + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + # TODO: Add liveness and readiness probes (for health checks) + command: + - sh + - -c + - | + export DB_DATASOURCE="host=${DB_HOST} port=${DB_PORT} user=${DB_USERNAME} password=${DB_PASSWORD} dbname=${DB_DATABASE} sslmode=${DB_SSL}" + mkdir -p $FABRIC_CA_HOME + cp /var/hyperledger/ca_config/ca.yaml $FABRIC_CA_HOME/fabric-ca-server-config.yaml + sed -i "s/<<>>/${CA_ADMIN}/g" ${FABRIC_CA_HOME}/fabric-ca-server-config.yaml + sed -i "s/<<>>/${CA_PASSWORD}/g" $FABRIC_CA_HOME/fabric-ca-server-config.yaml + sed -i "s/<<>>/${DB_TYPE}/g" $FABRIC_CA_HOME/fabric-ca-server-config.yaml + sed -i "s/<<>>/${DB_DATASOURCE}/g" $FABRIC_CA_HOME/fabric-ca-server-config.yaml + + {{- if .Values.config.intermediate }} + echo ">\033[0;33m Adding Parent CA (typically a Root CA) values to $FABRIC_CA_HOME/fabric-ca-server-config.yaml \033[0m" + sed -i "s/<<>>/${PARENT_CA_ADMIN}/g" $FABRIC_CA_HOME/fabric-ca-server-config.yaml + sed -i "s/<<>>/${PARENT_CA_PASSWORD}/g" $FABRIC_CA_HOME/fabric-ca-server-config.yaml + {{- end}} + + echo ">\033[0;35m fabric-ca-server start \033[0m" + fabric-ca-server start + envFrom: + - secretRef: + name: {{ include "hlf-ca.fullname" . }} + - configMapRef: + name: {{ include "hlf-ca.fullname" . }}--db + - configMapRef: + name: {{ include "hlf-ca.fullname" . }}--ca + env: + # Database environmental variable + - name: DB_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Values.db.chart | quote }} + key: postgres-password + {{- if .Values.config.intermediate }} + - name: PARENT_CA_ADMIN + valueFrom: + secretKeyRef: + name: {{ .Values.config.intermediate.parent.chart | quote }} + key: CA_ADMIN + - name: PARENT_CA_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Values.config.intermediate.parent.chart | quote }} + key: CA_PASSWORD + {{- end}} + ports: + - name: ca-port + containerPort: 7054 + protocol: TCP + volumeMounts: + - name: data + mountPath: /var/hyperledger + - name: ca-config + readOnly: true + mountPath: /var/hyperledger/ca_config + {{- if .Values.ingress.tls }} + - name: tls-secret + readOnly: true + mountPath: /var/hyperledger/tls_secret + {{- end }} + resources: +{{ toYaml .Values.resources | indent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} + {{- end }} diff --git a/stable/hlf-ca/templates/ingress.yaml b/stable/hlf-ca/templates/ingress.yaml new file mode 100644 index 0000000000..59fe5f657c --- /dev/null +++ b/stable/hlf-ca/templates/ingress.yaml @@ -0,0 +1,35 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "hlf-ca.fullname" . -}} +{{- $ingressPath := .Values.ingress.path -}} +apiVersion: extensions/v1beta1 +kind: Ingress +metadata: + name: {{ $fullName }} + labels: +{{ include "labels.standard" . | indent 4 }} +{{- with .Values.ingress.annotations }} + annotations: +{{ toYaml . | indent 4 }} +{{- end }} +spec: +{{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} +{{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ . }} + http: + paths: + - path: {{ $ingressPath }} + backend: + serviceName: {{ $fullName }} + servicePort: http + {{- end }} +{{- end }} diff --git a/stable/hlf-ca/templates/pvc.yaml b/stable/hlf-ca/templates/pvc.yaml new file mode 100644 index 0000000000..36fcf5f9c4 --- /dev/null +++ b/stable/hlf-ca/templates/pvc.yaml @@ -0,0 +1,21 @@ +{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: {{ include "hlf-ca.fullname" . }} + labels: +{{ include "labels.standard" . | indent 4 }} +{{- if .Values.persistence.annotations }} + annotations: +{{ toYaml .Values.persistence.annotations | indent 4 }} +{{- end }} +spec: + accessModes: + - {{ .Values.persistence.accessMode | quote }} + resources: + requests: + storage: {{ .Values.persistence.size | quote }} + {{- if .Values.persistence.storageClass }} + storageClassName: {{ .Values.persistence.storageClass | quote }} + {{- end }} +{{- end }} diff --git a/stable/hlf-ca/templates/secret.yaml b/stable/hlf-ca/templates/secret.yaml new file mode 100644 index 0000000000..342881ce5a --- /dev/null +++ b/stable/hlf-ca/templates/secret.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "hlf-ca.fullname" . }} + labels: +{{ include "labels.standard" . | indent 4 }} +type: Opaque +data: + CA_ADMIN: {{ .Values.adminUsername | b64enc | quote }} + {{ if .Values.adminPassword }} + CA_PASSWORD: {{ .Values.adminPassword | b64enc | quote }} + {{ else }} + CA_PASSWORD: {{ randAlphaNum 24 | b64enc | quote }} + {{ end }} diff --git a/stable/hlf-ca/templates/service.yaml b/stable/hlf-ca/templates/service.yaml new file mode 100644 index 0000000000..3da7d71d1a --- /dev/null +++ b/stable/hlf-ca/templates/service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "hlf-ca.fullname" . }} + labels: +{{ include "labels.standard" . | indent 4 }} +spec: + type: {{ .Values.service.type | quote }} + ports: + - port: {{ .Values.service.port }} + targetPort: 7054 + protocol: TCP + name: http + selector: + app: {{ include "hlf-ca.name" . }} + release: {{ .Release.Name }} diff --git a/stable/hlf-ca/values.yaml b/stable/hlf-ca/values.yaml new file mode 100644 index 0000000000..2663676e24 --- /dev/null +++ b/stable/hlf-ca/values.yaml @@ -0,0 +1,99 @@ +## Default values for hlf-ca. +## This is a YAML-formatted file. +## Declare variables to be passed into your templates. + +image: + repository: hyperledger/fabric-ca + tag: x86_64-1.1.0 + pullPolicy: IfNotPresent + +service: + ## Cluster IP or LoadBalancer + type: ClusterIP + port: 7054 + +ingress: + enabled: false + annotations: {} + # kubernetes.io/ingress.class: nginx + # certmanager.k8s.io/cluster-issuer: "letsencrypt-staging" + path: / + hosts: + - hlf-ca.local + tls: [] + # - secretName: hlf-ca-tls + # hosts: + # - hlf-ca.local + +persistence: + enabled: true + annotations: {} + ## If unset or "", use "default" storage class. + storageClass: "" + accessMode: ReadWriteOnce + size: 1Gi + # existingClaim: "" + +################################## +## Further configuration options # +################################## +## CA Admin Username +adminUsername: admin +## CA Admin password (set to 24 random characters by default) +# adminPassword: +## Name of CA, stored in FABRIC_CA_SERVER_CA_NAME (and the configMap "--config", if deploying a Root CA) +caName: org1-ca + +## Settings used in configMap "--db" +db: + chart: postgres-ca-postgresql + database: fabric_ca + +## Settings used in configMap "--config" +config: + ## Enable debug logging in ca Server configuration file + debug: true + ## CSR pathlength in ca Server configuration file + csr: + ca: + pathlength: 1 + names: + c: US + st: "North Carolina" + l: + o: Hyperledger + ou: Fabric + ## "intermediate" is only specified for Intermediate CA's + # intermediate: + # parent: + # chart: parent-ca + # url: parent-ca.example.com + # port: 7054 + ## Affiliations used in ca Server configuration file + affiliations: + org1: [] + +resources: {} + ## We usually recommend not to specify default resources and to leave this as a conscious + ## choice for the user. This also increases chances charts run on environments with little + ## resources, such as Minikube. If you do want to specify resources, uncomment the following + ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +nodeSelector: {} + +tolerations: [] + +affinity: {} + ## Suggested antiAffinity, as each CA should be on a separate Node for resilience + # podAntiAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # - topologyKey: "kubernetes.io/hostname" + # labelSelector: + # matchLabels: + # app: hlf-ca