Tutorial

Resources:

• Hyperledger Fabric build ARM

Create Kubernetes Cluster

To start deploying our red fabric we have to have a Kubernetes cluster. For this we will use KinD.

Ensure you have these ports available before creating the cluster:

• 80
• 443

If these ports are not available this tutorial will not work.

cat << EOF > kind-config.yaml

kind: Cluster

apiVersion: kind.x-k8s.io/v1alpha4

nodes:

- role: control-plane

extraPortMappings:

- containerPort: 30949

hostPort: 80

- containerPort: 30950

hostPort: 443

EOF

kind create cluster --config=./kind-config.yaml

Install Kubernetes operator

In this step we are going to install the kubernetes operator for Fabric, this will install:

• CRD (Custom Resource Definitions) to deploy Certification Fabric Peers, Orderers and Authorities
• Deploy the program to deploy the nodes in Kubernetes

To install helm: https://helm.sh/docs/intro/install/

helm repo add kfs https://kfsoftware.github.io/hlf-helm-charts --force-update

helm install hlf-operator --version=1.8.0 kfs/hlf-operator

Install the Kubectl plugin

To install the kubectl plugin, you must first install Krew: https://krew.sigs.k8s.io/docs/user-guide/setup/install/

Afterwards, the plugin can be installed with the following command:

kubectl krew install hlf

Install Istio

Install Istio binaries on the machine:

curl -L https://istio.io/downloadIstio | sh -

Install Istio on the Kubernetes cluster:

kubectl create namespace istio-system

istioctl operator init

kubectl apply -f - <<EOF

apiVersion: install.istio.io/v1alpha1

kind: IstioOperator

metadata:

name: istio-gateway

namespace: istio-system

spec:

addonComponents:

grafana:

enabled: false

kiali:

enabled: false

prometheus:

enabled: false

tracing:

enabled: false

components:

ingressGateways:

- enabled: true

k8s:

hpaSpec:

minReplicas: 1

resources:

limits:

cpu: 500m

memory: 512Mi

requests:

cpu: 100m

memory: 128Mi

service:

ports:

- name: http

port: 80

targetPort: 8080

nodePort: 30949

- name: https

port: 443

targetPort: 8443

nodePort: 30950

type: NodePort

name: istio-ingressgateway

pilot:

enabled: true

k8s:

hpaSpec:

minReplicas: 1

resources:

limits:

cpu: 300m

memory: 512Mi

requests:

cpu: 100m

memory: 128Mi

meshConfig:

accessLogFile: /dev/stdout

enableTracing: false

outboundTrafficPolicy:

mode: ALLOW_ANY

profile: default

EOF

Deploy a Peer organization

Environment Variables for AMD (Default)

export PEER_IMAGE=hyperledger/fabric-peer

export PEER_VERSION=2.4.6

export ORDERER_IMAGE=hyperledger/fabric-orderer

export ORDERER_VERSION=2.4.6

Environment Variables for ARM (Mac M1)

export PEER_IMAGE=bswamina/fabric-peer

export PEER_VERSION=2.4.6

export ORDERER_IMAGE=bswamina/fabric-orderer

export ORDERER_VERSION=2.4.6

Configurar DNS interno

CLUSTER_IP=$(kubectl -n istio-system get svc istio-ingressgateway -o json | jq -r .spec.clusterIP)

kubectl apply -f - <<EOF

kind: ConfigMap

apiVersion: v1

metadata:

name: coredns

namespace: kube-system

data:

Corefile: |

.:53 {

errors

health {

lameduck 5s

}

rewrite name regex (.*)\.localho\.st host.ingress.internal

hosts {

${CLUSTER_IP} host.ingress.internal

fallthrough

}

ready

kubernetes cluster.local in-addr.arpa ip6.arpa {

pods insecure

fallthrough in-addr.arpa ip6.arpa

ttl 30

}

prometheus :9153

forward . /etc/resolv.conf {

max_concurrent 1000

}

cache 30

loop

reload

loadbalance

}

EOF

Deploy a certificate authority

kubectl hlf ca create --storage-class=standard --capacity=1Gi --name=org1-ca \

--enroll-id=enroll --enroll-pw=enrollpw --hosts=org1-ca.localho.st --istio-port=443

kubectl wait --timeout=180s --for=condition=Running fabriccas.hlf.kungfusoftware.es --all

Check that the certification authority is deployed and works:

curl -k https://org1-ca.localho.st:443/cainfo

Register a user in the certification authority of the peer organization (Org1MSP)

# register user in CA for peers

kubectl hlf ca register --name=org1-ca --user=peer --secret=peerpw --type=peer \

--enroll-id enroll --enroll-secret=enrollpw --mspid Org1MSP

Deploy a peer

kubectl hlf peer create --statedb=couchdb --image=$PEER_IMAGE --version=$PEER_VERSION --storage-class=standard --enroll-id=peer --mspid=Org1MSP \

--enroll-pw=peerpw --capacity=5Gi --name=org1-peer0 --ca-name=org1-ca.default \

--hosts=peer0-org1.localho.st --istio-port=443

kubectl hlf peer create --statedb=couchdb --image=$PEER_IMAGE --version=$PEER_VERSION --storage-class=standard --enroll-id=peer --mspid=Org1MSP \

--enroll-pw=peerpw --capacity=5Gi --name=org1-peer1 --ca-name=org1-ca.default \

--hosts=peer1-org1.localho.st --istio-port=443

kubectl wait --timeout=180s --for=condition=Running fabricpeers.hlf.kungfusoftware.es --all

Check that the peer is deployed and works:

curl -vik https://peer0-org1.localho.st:443

Deploy an Orderer organization

To deploy an Orderer organization we have to:

1. Create a certification authority
2. Register user orderer with password ordererpw
3. Create orderer

Create the certification authority

kubectl hlf ca create --storage-class=standard --capacity=1Gi --name=ord-ca \

--enroll-id=enroll --enroll-pw=enrollpw --hosts=ord-ca.localho.st --istio-port=443

kubectl wait --timeout=180s --for=condition=Running fabriccas.hlf.kungfusoftware.es --all

Check that the certification authority is deployed and works:

curl -vik https://ord-ca.localho.st:443/cainfo

Register user orderer

kubectl hlf ca register --name=ord-ca --user=orderer --secret=ordererpw \

--type=orderer --enroll-id enroll --enroll-secret=enrollpw --mspid=OrdererMSP --ca-url="https://ord-ca.localho.st:443"

Deploy orderer

kubectl hlf ordnode create --image=$ORDERER_IMAGE --version=$ORDERER_VERSION \

--storage-class=standard --enroll-id=orderer --mspid=OrdererMSP \

--enroll-pw=ordererpw --capacity=2Gi --name=ord-node1 --ca-name=ord-ca.default \

--hosts=orderer0-ord.localho.st --istio-port=443

kubectl wait --timeout=180s --for=condition=Running fabricorderernodes.hlf.kungfusoftware.es --all

Check that the orderer is running:

kubectl get pods

curl -vik https://orderer0-ord.localho.st:443

Prepare connection string to interact with orderer

To prepare the connection string, we have to:

• Get the connection string without users
• Register a user in the certification authority for signature
• Get the certificates using the user created above
• Attach the user to the connection string

1. Get the connection string without users

kubectl hlf inspect --output ordservice.yaml -o OrdererMSP

2. Register a user in the TLS certification authority

kubectl hlf ca register --name=ord-ca --user=admin --secret=adminpw \

--type=admin --enroll-id enroll --enroll-secret=enrollpw --mspid=OrdererMSP

3. Get the certificates using the certificate

kubectl hlf ca enroll --name=ord-ca --user=admin --secret=adminpw --mspid OrdererMSP \

--ca-name ca --output admin-ordservice.yaml

4. Attach the user to the connection string

kubectl hlf utils adduser --userPath=admin-ordservice.yaml --config=ordservice.yaml --username=admin --mspid=OrdererMSP

Create channel

To create the channel we need to first create the wallet secret, which will contain the identities used by the operator to manage the channel

Register and enrolling OrdererMSP identity

# register

kubectl hlf ca register --name=ord-ca --user=admin --secret=adminpw \

--type=admin --enroll-id enroll --enroll-secret=enrollpw --mspid=OrdererMSP

# enroll

kubectl hlf ca enroll --name=ord-ca --namespace=default \

--user=admin --secret=adminpw --mspid OrdererMSP \

--ca-name tlsca --output orderermsp.yaml

Register and enrolling Org1MSP identity

# register

kubectl hlf ca register --name=org1-ca --namespace=default --user=admin --secret=adminpw \

--type=admin --enroll-id enroll --enroll-secret=enrollpw --mspid=Org1MSP

# enroll

kubectl hlf ca enroll --name=org1-ca --namespace=default \

--user=admin --secret=adminpw --mspid Org1MSP \

--ca-name ca --output org1msp.yaml

Create the secret

kubectl create secret generic wallet --namespace=default \

--from-file=org1msp.yaml=$PWD/org1msp.yaml \

--from-file=orderermsp.yaml=$PWD/orderermsp.yaml

Create main channel

export PEER_ORG_SIGN_CERT=$(kubectl get fabriccas org1-ca -o=jsonpath='{.status.ca_cert}')

export PEER_ORG_TLS_CERT=$(kubectl get fabriccas org1-ca -o=jsonpath='{.status.tlsca_cert}')

export IDENT_8=$(printf "%8s" "")

export ORDERER_TLS_CERT=$(kubectl get fabriccas ord-ca -o=jsonpath='{.status.tlsca_cert}' | sed -e "s/^/${IDENT_8}/" )

export ORDERER0_TLS_CERT=$(kubectl get fabricorderernodes ord-node1 -o=jsonpath='{.status.tlsCert}' | sed -e "s/^/${IDENT_8}/" )

kubectl apply -f - <<EOF

apiVersion: hlf.kungfusoftware.es/v1alpha1

kind: FabricMainChannel

metadata:

name: demo

spec:

name: demo

adminOrdererOrganizations:

- mspID: OrdererMSP

adminPeerOrganizations:

- mspID: Org1MSP

channelConfig:

application:

acls: null

capabilities:

- V2_0

policies: null

capabilities:

- V2_0

orderer:

batchSize:

absoluteMaxBytes: 1048576

maxMessageCount: 10

preferredMaxBytes: 524288

batchTimeout: 2s

capabilities:

- V2_0

etcdRaft:

options:

electionTick: 10

heartbeatTick: 1

maxInflightBlocks: 5

snapshotIntervalSize: 16777216

tickInterval: 500ms

ordererType: etcdraft

policies: null

state: STATE_NORMAL

policies: null

externalOrdererOrganizations: []

peerOrganizations:

- mspID: Org1MSP

caName: "org1-ca"

caNamespace: "default"

identities:

OrdererMSP:

secretKey: orderermsp.yaml

secretName: wallet

secretNamespace: default

Org1MSP:

secretKey: org1msp.yaml

secretName: wallet

secretNamespace: default

externalPeerOrganizations: []

ordererOrganizations:

- caName: "ord-ca"

caNamespace: "default"

externalOrderersToJoin:

- host: ord-node1

port: 7053

mspID: OrdererMSP

ordererEndpoints:

- ord-node1:7050

orderersToJoin: []

orderers:

- host: ord-node1

port: 7050

tlsCert: |-

${ORDERER0_TLS_CERT}

EOF

Join peer to the channel

export IDENT_8=$(printf "%8s" "")

export ORDERER0_TLS_CERT=$(kubectl get fabricorderernodes ord-node1 -o=jsonpath='{.status.tlsCert}' | sed -e "s/^/${IDENT_8}/" )

kubectl apply -f - <<EOF

apiVersion: hlf.kungfusoftware.es/v1alpha1

kind: FabricFollowerChannel

metadata:

name: demo-org1msp

spec:

anchorPeers:

- host: org1-peer0.default

port: 7051

hlfIdentity:

secretKey: org1msp.yaml

secretName: wallet

secretNamespace: default

mspId: Org1MSP

name: demo

externalPeersToJoin: []

orderers:

- certificate: |

${ORDERER0_TLS_CERT}

url: grpcs://ord-node1.default:7050

peersToJoin:

- name: org1-peer0

namespace: default

- name: org1-peer1

namespace: default

EOF

Install a chaincode

Prepare connection string for a peer

To prepare the connection string, we have to:

1. Get connection string without users for organization Org1MSP and OrdererMSP

2. Register a user in the certification authority for signing (register)

3. Obtain the certificates using the previously created user (enroll)

4. Attach the user to the connection string

5. Get connection string without users for organization Org1MSP and OrdererMSP

kubectl hlf inspect --output org1.yaml -o Org1MSP -o OrdererMSP

2. Register a user in the certification authority for signing

kubectl hlf ca register --name=org1-ca --user=admin --secret=adminpw --type=admin \

--enroll-id enroll --enroll-secret=enrollpw --mspid Org1MSP

3. Get the certificates using the user created above

kubectl hlf ca enroll --name=org1-ca --user=admin --secret=adminpw --mspid Org1MSP \

--ca-name ca --output peer-org1.yaml

4. Attach the user to the connection string

kubectl hlf utils adduser --userPath=peer-org1.yaml --config=org1.yaml --username=admin --mspid=Org1MSP

Create metadata file

# remove the code.tar.gz chaincode.tgz if they exist

rm code.tar.gz chaincode.tgz

export CHAINCODE_NAME=asset

export CHAINCODE_LABEL=asset

cat << METADATA-EOF > "metadata.json"

{

"type": "ccaas",

"label": "${CHAINCODE_LABEL}"

}

METADATA-EOF

## chaincode as a service

Prepare connection file

cat > "connection.json" <<CONN_EOF

{

"address": "${CHAINCODE_NAME}:7052",

"dial_timeout": "10s",

"tls_required": false

}

CONN_EOF

tar cfz code.tar.gz connection.json

tar cfz chaincode.tgz metadata.json code.tar.gz

export PACKAGE_ID=$(kubectl hlf chaincode calculatepackageid --path=chaincode.tgz --language=node --label=$CHAINCODE_LABEL)

echo "PACKAGE_ID=$PACKAGE_ID"

kubectl hlf chaincode install --path=./chaincode.tgz \

--config=org1.yaml --language=golang --label=$CHAINCODE_LABEL --user=admin --peer=org1-peer0.default

kubectl hlf chaincode install --path=./chaincode.tgz \

--config=org1.yaml --language=golang --label=$CHAINCODE_LABEL --user=admin --peer=org1-peer1.default

Deploy chaincode container on cluster

The following command will create or update the CRD based on the packageID, chaincode name, and docker image.

kubectl hlf externalchaincode sync --image=kfsoftware/chaincode-external:latest \

--name=$CHAINCODE_NAME \

--namespace=default \

--package-id=$PACKAGE_ID \

--tls-required=false \

--replicas=1

Check installed chaincodes

kubectl hlf chaincode queryinstalled --config=org1.yaml --user=admin --peer=org1-peer0.default

Approve chaincode

export SEQUENCE=1

export VERSION="1.0"

kubectl hlf chaincode approveformyorg --config=org1.yaml --user=admin --peer=org1-peer0.default \

--package-id=$PACKAGE_ID \

--version "$VERSION" --sequence "$SEQUENCE" --name=asset \

--policy="OR('Org1MSP.member')" --channel=demo

Commit chaincode

kubectl hlf chaincode commit --config=org1.yaml --user=admin --mspid=Org1MSP \

--version "$VERSION" --sequence "$SEQUENCE" --name=asset \

--policy="OR('Org1MSP.member')" --channel=demo

Invoke a transaction on the channel

kubectl hlf chaincode invoke --config=org1.yaml \

--user=admin --peer=org1-peer0.default \

--chaincode=asset --channel=demo \

--fcn=initLedger -a '[]'

Query assets in the channel

kubectl hlf chaincode query --config=org1.yaml \

--user=admin --peer=org1-peer0.default \

--chaincode=asset --channel=demo \

--fcn=GetAllAssets -a '[]'

At this point, you should have:

• Ordering service with 1 nodes and a CA
• Peer organization with a peer and a CA
• A channel demo
• A chaincode install in peer0
• A chaincode approved and committed

If something went wrong or didn't work, please, open an issue.

Cleanup the environment

kubectl delete fabricorderernodes.hlf.kungfusoftware.es --all-namespaces --all

kubectl delete fabricpeers.hlf.kungfusoftware.es --all-namespaces --all

kubectl delete fabriccas.hlf.kungfusoftware.es --all-namespaces --all

kubectl delete fabricchaincode.hlf.kungfusoftware.es --all-namespaces --all

Troubleshooting

Chaincode installation/build error

Chaincode installation/build can fail due to unsupported local kubertenes version such as minikube.

$ kubectl hlf chaincode install --path=./fixtures/chaincodes/fabcar/go \

--config=org1.yaml --language=golang --label=fabcar --user=admin --peer=org1-peer0.default

Error: Transaction processing for endorser [192.168.49.2:31278]: Chaincode status Code: (500) UNKNOWN.

Description: failed to invoke backing implementation of 'InstallChaincode': could not build chaincode:

external builder failed: external builder failed to build: external builder 'my-golang-builder' failed:

exit status 1

If your purpose is to test the hlf-operator please consider to switch to kind that is tested and supported.