missed a .git ignored directory on add

Signed-off-by: Josh Kneubuhl <jkneubuh@us.ibm.com>

.gitignore

@@ -27,3 +27,6 @@ builders/
 config/
 external-chaincode/
 install-fabric.sh
+
+# override the ignore of all config/ folders
+!full-stack-asset-transfer-guide/infrastructure/sample-network/config

full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/kustomization.yaml

@@ -0,0 +1,25 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - org0-ca.yaml
+  - org1-ca.yaml
+  - org2-ca.yaml

full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/org0-ca.yaml

@@ -0,0 +1,135 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+apiVersion: ibp.com/v1beta1
+kind: IBPCA
+metadata:
+  name: org0-ca
+spec:
+  action:
+    renew: {}
+  configoverride:
+    ca:
+      affiliations:
+        org1:
+          - department1
+          - department2
+        org2:
+          - department1
+      registry:
+        identities:
+          - name: rcaadmin
+            pass: rcaadminpw
+            type: client
+            attrs:
+              hf.Registrar.Roles: "*"
+              hf.Registrar.DelegateRoles: "*"
+              hf.Revoker: true
+              hf.IntermediateCA: true
+              hf.GenCRL: true
+              hf.Registrar.Attributes: "*"
+              hf.AffiliationMgr: true
+          - name: orderer1
+            pass: orderer1pw
+            type: orderer
+          - name: orderer2
+            pass: orderer2pw
+            type: orderer
+          - name: orderer3
+            pass: orderer3pw
+            type: orderer
+          - name: org0admin
+            pass: org0adminpw
+            type: admin
+      debug: true
+      signing:
+        default:
+          expiry: 87600h0m0s
+    tlsca:
+      affiliations:
+        org1:
+          - department1
+          - department2
+        org0:
+          - department1
+      registry:
+        identities:
+          - name: admin
+            pass: adminpw
+            type: client # todo: shouldn't this be an admin?
+            attrs:
+              hf.Registrar.Roles: "*"
+              hf.Registrar.DelegateRoles: "*"
+              hf.Revoker: true
+              hf.IntermediateCA: true
+              hf.GenCRL: true
+              hf.Registrar.Attributes: "*"
+              hf.AffiliationMgr: true
+          - name: orderer1
+            pass: orderer1pw
+            type: orderer
+          - name: orderer2
+            pass: orderer2pw
+            type: orderer
+          - name: orderer3
+            pass: orderer3pw
+            type: orderer
+          - name: org0admin
+            pass: org0adminpw
+            type: admin
+
+      debug: true
+      signing:
+        default:
+          expiry: 87600h0m0s
+  customNames:
+    pvc: {}
+  domain: "${INGRESS_DOMAIN}"
+  images:
+    caImage: ${CA_IMAGE}
+    caTag: ${CA_IMAGE_LABEL}
+    caInitImage: ${INIT_IMAGE}
+    caInitTag: ${INIT_IMAGE_LABEL}
+  ingress:
+    class: ""
+    tlsSecretName: ""
+  license:
+    accept: true
+  replicas: 1
+  resources:
+    ca:
+      limits:
+        cpu: 100m
+        memory: 200M
+      requests:
+        cpu: 10m
+        memory: 10M
+    init:
+      limits:
+        cpu: 100m
+        memory: 200M
+      requests:
+        cpu: 10m
+        memory: 10M
+  service:
+    type: ClusterIP
+  storage:
+    ca:
+      class: "${STORAGE_CLASS}"
+      size: 100M
+  version: ${FABRIC_CA_VERSION}

full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/org1-ca.yaml

@@ -0,0 +1,128 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+apiVersion: ibp.com/v1beta1
+kind: IBPCA
+metadata:
+  name: org1-ca
+spec:
+  action:
+    renew: {}
+  configoverride:
+    ca:
+      affiliations:
+        org1:
+          - department1
+          - department2
+        org2:
+          - department1
+      registry:
+        identities:
+          - name: rcaadmin
+            pass: rcaadminpw
+            type: client
+            attrs:
+              hf.Registrar.Roles: "*"
+              hf.Registrar.DelegateRoles: "*"
+              hf.Revoker: true
+              hf.IntermediateCA: true
+              hf.GenCRL: true
+              hf.Registrar.Attributes: "*"
+              hf.AffiliationMgr: true
+          - name: peer1
+            pass: peer1pw
+            type: peer
+          - name: peer2
+            pass: peer2pw
+            type: peer
+          - name: org1admin
+            pass: org1adminpw
+            type: admin
+      debug: true
+      signing:
+        default:
+          expiry: 87600h0m0s
+    tlsca:
+      affiliations:
+        org1:
+          - department1
+          - department2
+        org2:
+          - department1
+      registry:
+        identities:
+          - name: admin
+            pass: adminpw
+            type: client # todo: shouldn't this be an admin?
+            attrs:
+              hf.Registrar.Roles: "*"
+              hf.Registrar.DelegateRoles: "*"
+              hf.Revoker: true
+              hf.IntermediateCA: true
+              hf.GenCRL: true
+              hf.Registrar.Attributes: "*"
+              hf.AffiliationMgr: true
+          - name: peer1
+            pass: peer1pw
+            type: peer
+          - name: peer2
+            pass: peer2pw
+            type: peer
+          - name: org1admin
+            pass: org1adminpw
+            type: admin
+      debug: true
+      signing:
+        default:
+          expiry: 87600h0m0s
+  customNames:
+    pvc: {}
+  domain: "${INGRESS_DOMAIN}"
+  images:
+    caImage: ${CA_IMAGE}
+    caTag: ${CA_IMAGE_LABEL}
+    caInitImage: ${INIT_IMAGE}
+    caInitTag: ${INIT_IMAGE_LABEL}
+  ingress:
+    class: ""
+    tlsSecretName: ""
+  license:
+    accept: true
+  replicas: 1
+  resources:
+    ca:
+      limits:
+        cpu: 100m
+        memory: 200M
+      requests:
+        cpu: 10m
+        memory: 10M
+    init:
+      limits:
+        cpu: 100m
+        memory: 200M
+      requests:
+        cpu: 10m
+        memory: 10M
+  service:
+    type: ClusterIP
+  storage:
+    ca:
+      class: "${STORAGE_CLASS}"
+      size: 100M
+  version: ${FABRIC_CA_VERSION}

full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/org2-ca.yaml

@@ -0,0 +1,130 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+apiVersion: ibp.com/v1beta1
+kind: IBPCA
+metadata:
+  name: org2-ca
+spec:
+  action:
+    renew: {}
+  configoverride:
+    ca:
+      affiliations:
+        org1:
+          - department1
+          - department2
+        org2:
+          - department1
+      registry:
+        identities:
+          - name: rcaadmin
+            pass: rcaadminpw
+            type: client
+            attrs:
+              hf.Registrar.Roles: "*"
+              hf.Registrar.DelegateRoles: "*"
+              hf.Revoker: true
+              hf.IntermediateCA: true
+              hf.GenCRL: true
+              hf.Registrar.Attributes: "*"
+              hf.AffiliationMgr: true
+          - name: peer1
+            pass: peer1pw
+            type: peer
+          - name: peer2
+            pass: peer2pw
+            type: peer
+          - name: org2admin
+            pass: org2adminpw
+            type: admin
+      debug: true
+      signing:
+        default:
+          expiry: 87600h0m0s
+    tlsca:
+      affiliations:
+        org1:
+          - department1
+          - department2
+        org2:
+          - department1
+      registry:
+        identities:
+          - name: admin
+            pass: adminpw
+            type: client # todo: shouldn't this be an admin?
+            attrs:
+              hf.Registrar.Roles: "*"
+              hf.Registrar.DelegateRoles: "*"
+              hf.Revoker: true
+              hf.IntermediateCA: true
+              hf.GenCRL: true
+              hf.Registrar.Attributes: "*"
+              hf.AffiliationMgr: true
+          - name: peer1
+            pass: peer1pw
+            type: peer
+          - name: peer2
+            pass: peer2pw
+            type: peer
+          - name: org2admin
+            pass: org2adminpw
+            type: admin
+      debug: true
+      signing:
+        default:
+          expiry: 87600h0m0s
+  customNames:
+    pvc: {}
+  domain: "${INGRESS_DOMAIN}"
+  # imagePullSecrets:
+  # - regcred
+  images:
+    caImage: ${CA_IMAGE}
+    caTag: ${CA_IMAGE_LABEL}
+    caInitImage: ${INIT_IMAGE}
+    caInitTag: ${INIT_IMAGE_LABEL}
+  ingress:
+    class: ""
+    tlsSecretName: ""
+  license:
+    accept: true
+  replicas: 1
+  resources:
+    ca:
+      limits:
+        cpu: 100m
+        memory: 200M
+      requests:
+        cpu: 10m
+        memory: 10M
+    init:
+      limits:
+        cpu: 100m
+        memory: 200M
+      requests:
+        cpu: 10m
+        memory: 10M
+  service:
+    type: ClusterIP
+  storage:
+    ca:
+      class: "${STORAGE_CLASS}"
+      size: 100M
+  version: ${FABRIC_CA_VERSION}

full-stack-asset-transfer-guide/infrastructure/sample-network/config/configtx-template.yaml

@@ -0,0 +1,428 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+---
+################################################################################
+#
+#   Section: Organizations
+#
+#   - This section defines the different organizational identities which will
+#   be referenced later in the configuration.
+#
+################################################################################
+Organizations:
+
+  # SampleOrg defines an MSP using the sampleconfig.  It should never be used
+  # in production but may be used as a template for other definitions
+  - &OrdererOrg
+    # DefaultOrg defines the organization which is used in the sampleconfig
+    # of the fabric.git development environment
+    Name: OrdererOrg
+
+    # ID to load the MSP definition as
+    ID: OrdererMSP
+
+    # MSPDir is the filesystem path which contains the MSP configuration
+    MSPDir: ../../temp/channel-msp/ordererOrganizations/org0/msp
+
+    # Policies defines the set of policies at this level of the config tree
+    # For organization policies, their canonical path is usually
+    #   /Channel/<Application|Orderer>/<OrgName>/<PolicyName>
+    Policies:
+      Readers:
+        Type: Signature
+        Rule: "OR('OrdererMSP.member')"
+      Writers:
+        Type: Signature
+        Rule: "OR('OrdererMSP.member')"
+      Admins:
+        Type: Signature
+        Rule: "OR('OrdererMSP.admin')"
+
+    OrdererEndpoints:
+      - org0-orderersnode1.${KUBE_DNS_DOMAIN}:7050
+      - org0-orderersnode2.${KUBE_DNS_DOMAIN}:7050
+      - org0-orderersnode3.${KUBE_DNS_DOMAIN}:7050
+
+  - &Org1
+    # DefaultOrg defines the organization which is used in the sampleconfig
+    # of the fabric.git development environment
+    Name: Org1MSP
+
+    # ID to load the MSP definition as
+    ID: Org1MSP
+
+    MSPDir: ../../temp/channel-msp/peerOrganizations/org1/msp
+
+    # Policies defines the set of policies at this level of the config tree
+    # For organization policies, their canonical path is usually
+    #   /Channel/<Application|Orderer>/<OrgName>/<PolicyName>
+    Policies:
+      Readers:
+        Type: Signature
+        Rule: "OR('Org1MSP.admin', 'Org1MSP.peer', 'Org1MSP.client')"
+      Writers:
+        Type: Signature
+        Rule: "OR('Org1MSP.admin', 'Org1MSP.client')"
+      Admins:
+        Type: Signature
+        Rule: "OR('Org1MSP.admin')"
+      Endorsement:
+        Type: Signature
+        Rule: "OR('Org1MSP.peer')"
+
+    # leave this flag set to true.
+    AnchorPeers:
+      # AnchorPeers defines the location of peers which can be used
+      # for cross org gossip communication.  Note, this value is only
+      # encoded in the genesis block in the Application section context
+      - Host: org1-peer1.${KUBE_DNS_DOMAIN}
+        Port: 7051
+
+  - &Org2
+    # DefaultOrg defines the organization which is used in the sampleconfig
+    # of the fabric.git development environment
+    Name: Org2MSP
+
+    # ID to load the MSP definition as
+    ID: Org2MSP
+
+    MSPDir: ../../temp/channel-msp/peerOrganizations/org2/msp
+
+    # Policies defines the set of policies at this level of the config tree
+    # For organization policies, their canonical path is usually
+    #   /Channel/<Application|Orderer>/<OrgName>/<PolicyName>
+    Policies:
+      Readers:
+        Type: Signature
+        Rule: "OR('Org2MSP.admin', 'Org2MSP.peer', 'Org2MSP.client')"
+      Writers:
+        Type: Signature
+        Rule: "OR('Org2MSP.admin', 'Org2MSP.client')"
+      Admins:
+        Type: Signature
+        Rule: "OR('Org2MSP.admin')"
+      Endorsement:
+        Type: Signature
+        Rule: "OR('Org2MSP.peer')"
+
+    AnchorPeers:
+      # AnchorPeers defines the location of peers which can be used
+      # for cross org gossip communication.  Note, this value is only
+      # encoded in the genesis block in the Application section context
+      - Host: org2-peer1.${KUBE_DNS_DOMAIN}
+        Port: 7051
+
+################################################################################
+#
+#   SECTION: Capabilities
+#
+#   - This section defines the capabilities of fabric network. This is a new
+#   concept as of v1.1.0 and should not be utilized in mixed networks with
+#   v1.0.x peers and orderers.  Capabilities define features which must be
+#   present in a fabric binary for that binary to safely participate in the
+#   fabric network.  For instance, if a new MSP type is added, newer binaries
+#   might recognize and validate the signatures from this type, while older
+#   binaries without this support would be unable to validate those
+#   transactions.  This could lead to different versions of the fabric binaries
+#   having different world states.  Instead, defining a capability for a channel
+#   informs those binaries without this capability that they must cease
+#   processing transactions until they have been upgraded.  For v1.0.x if any
+#   capabilities are defined (including a map with all capabilities turned off)
+#   then the v1.0.x peer will deliberately crash.
+#
+################################################################################
+Capabilities:
+  # Channel capabilities apply to both the orderers and the peers and must be
+  # supported by both.
+  # Set the value of the capability to true to require it.
+  Channel: &ChannelCapabilities
+    # V2_0 capability ensures that orderers and peers behave according
+    # to v2.0 channel capabilities. Orderers and peers from
+    # prior releases would behave in an incompatible way, and are therefore
+    # not able to participate in channels at v2.0 capability.
+    # Prior to enabling V2.0 channel capabilities, ensure that all
+    # orderers and peers on a channel are at v2.0.0 or later.
+    V2_0: true
+
+  # Orderer capabilities apply only to the orderers, and may be safely
+  # used with prior release peers.
+  # Set the value of the capability to true to require it.
+  Orderer: &OrdererCapabilities
+    # V2_0 orderer capability ensures that orderers behave according
+    # to v2.0 orderer capabilities. Orderers from
+    # prior releases would behave in an incompatible way, and are therefore
+    # not able to participate in channels at v2.0 orderer capability.
+    # Prior to enabling V2.0 orderer capabilities, ensure that all
+    # orderers on channel are at v2.0.0 or later.
+    V2_0: true
+
+  # Application capabilities apply only to the peer network, and may be safely
+  # used with prior release orderers.
+  # Set the value of the capability to true to require it.
+  Application: &ApplicationCapabilities
+    # V2_0 application capability ensures that peers behave according
+    # to v2.0 application capabilities. Peers from
+    # prior releases would behave in an incompatible way, and are therefore
+    # not able to participate in channels at v2.0 application capability.
+    # Prior to enabling V2.0 application capabilities, ensure that all
+    # peers on channel are at v2.0.0 or later.
+    V2_0: true
+
+################################################################################
+#
+#   SECTION: Application
+#
+#   - This section defines the values to encode into a config transaction or
+#   genesis block for application related parameters
+#
+################################################################################
+Application: &ApplicationDefaults
+
+  # Organizations is the list of orgs which are defined as participants on
+  # the application side of the network
+  Organizations:
+
+  # Policies defines the set of policies at this level of the config tree
+  # For Application policies, their canonical path is
+  #   /Channel/Application/<PolicyName>
+  Policies:
+    Readers:
+      Type: ImplicitMeta
+      Rule: "ANY Readers"
+    Writers:
+      Type: ImplicitMeta
+      Rule: "ANY Writers"
+    Admins:
+      Type: ImplicitMeta
+      Rule: "MAJORITY Admins"
+    LifecycleEndorsement:
+      Type: Signature
+      Rule: "OR('Org1MSP.peer','Org2MSP.peer')"
+    Endorsement:
+      Type: Signature
+      Rule: "OR('Org1MSP.peer','Org2MSP.peer')"
+
+  Capabilities:
+    <<: *ApplicationCapabilities
+################################################################################
+#
+#   SECTION: Orderer
+#
+#   - This section defines the values to encode into a config transaction or
+#   genesis block for orderer related parameters
+#
+################################################################################
+Orderer: &OrdererDefaults
+
+  # Orderer Type: The orderer implementation to start
+  OrdererType: etcdraft
+
+  EtcdRaft:
+    Consenters:
+      - Host: org0-orderersnode1.${KUBE_DNS_DOMAIN}
+        Port: 7050
+        ClientTLSCert: ../../temp/channel-msp/ordererOrganizations/org0/orderers/org0-orderersnode1/tls/signcerts/tls-cert.pem
+        ServerTLSCert: ../../temp/channel-msp/ordererOrganizations/org0/orderers/org0-orderersnode1/tls/signcerts/tls-cert.pem
+      - Host: org0-orderersnode2.${KUBE_DNS_DOMAIN}
+        Port: 7050
+        ClientTLSCert: ../../temp/channel-msp/ordererOrganizations/org0/orderers/org0-orderersnode2/tls/signcerts/tls-cert.pem
+        ServerTLSCert: ../../temp/channel-msp/ordererOrganizations/org0/orderers/org0-orderersnode2/tls/signcerts/tls-cert.pem
+      - Host: org0-orderersnode3.${KUBE_DNS_DOMAIN}
+        Port: 7050
+        ClientTLSCert: ../../temp/channel-msp/ordererOrganizations/org0/orderers/org0-orderersnode3/tls/signcerts/tls-cert.pem
+        ServerTLSCert: ../../temp/channel-msp/ordererOrganizations/org0/orderers/org0-orderersnode3/tls/signcerts/tls-cert.pem
+
+
+    # Options to be specified for all the etcd/raft nodes. The values here
+    # are the defaults for all new channels and can be modified on a
+    # per-channel basis via configuration updates.
+    Options:
+      # TickInterval is the time interval between two Node.Tick invocations.
+      #TickInterval: 500ms default
+      TickInterval: 2500ms
+
+      # ElectionTick is the number of Node.Tick invocations that must pass
+      # between elections. That is, if a follower does not receive any
+      # message from the leader of current term before ElectionTick has
+      # elapsed, it will become candidate and start an election.
+      # ElectionTick must be greater than HeartbeatTick.
+      # ElectionTick: 10 default
+      ElectionTick: 5
+
+      # HeartbeatTick is the number of Node.Tick invocations that must
+      # pass between heartbeats. That is, a leader sends heartbeat
+      # messages to maintain its leadership every HeartbeatTick ticks.
+      HeartbeatTick: 1
+
+      # MaxInflightBlocks limits the max number of in-flight append messages
+      # during optimistic replication phase.
+      MaxInflightBlocks: 5
+
+      # SnapshotIntervalSize defines number of bytes per which a snapshot is taken
+      SnapshotIntervalSize: 16 MB
+
+  # Batch Timeout: The amount of time to wait before creating a batch
+  BatchTimeout: 2s
+
+  # Batch Size: Controls the number of messages batched into a block
+  BatchSize:
+
+    # Max Message Count: The maximum number of messages to permit in a batch
+    MaxMessageCount: 10
+
+    # Absolute Max Bytes: The absolute maximum number of bytes allowed for
+    # the serialized messages in a batch.
+    AbsoluteMaxBytes: 99 MB
+
+    # Preferred Max Bytes: The preferred maximum number of bytes allowed for
+    # the serialized messages in a batch. A message larger than the preferred
+    # max bytes will result in a batch larger than preferred max bytes.
+    PreferredMaxBytes: 512 KB
+
+  # Organizations is the list of orgs which are defined as participants on
+  # the orderer side of the network
+  Organizations:
+
+  # Policies defines the set of policies at this level of the config tree
+  # For Orderer policies, their canonical path is
+  #   /Channel/Orderer/<PolicyName>
+  Policies:
+    Readers:
+      Type: ImplicitMeta
+      Rule: "ANY Readers"
+    Writers:
+      Type: ImplicitMeta
+      Rule: "ANY Writers"
+    Admins:
+      Type: ImplicitMeta
+      Rule: "MAJORITY Admins"
+    # BlockValidation specifies what signatures must be included in the block
+    # from the orderer for the peer to validate it.
+    BlockValidation:
+      Type: ImplicitMeta
+      Rule: "ANY Writers"
+
+################################################################################
+#
+#   CHANNEL
+#
+#   This section defines the values to encode into a config transaction or
+#   genesis block for channel related parameters.
+#
+################################################################################
+Channel: &ChannelDefaults
+  # Policies defines the set of policies at this level of the config tree
+  # For Channel policies, their canonical path is
+  #   /Channel/<PolicyName>
+  Policies:
+    # Who may invoke the 'Deliver' API
+    Readers:
+      Type: ImplicitMeta
+      Rule: "ANY Readers"
+    # Who may invoke the 'Broadcast' API
+    Writers:
+      Type: ImplicitMeta
+      Rule: "ANY Writers"
+    # By default, who may modify elements at this config level
+    Admins:
+      Type: ImplicitMeta
+      Rule: "MAJORITY Admins"
+
+  # Capabilities describes the channel level capabilities, see the
+  # dedicated Capabilities section elsewhere in this file for a full
+  # description
+  Capabilities:
+    <<: *ChannelCapabilities
+
+################################################################################
+#
+#   Profile
+#
+#   - Different configuration profiles may be encoded here to be specified
+#   as parameters to the configtxgen tool
+#
+################################################################################
+Profiles:
+
+  # test network profile with application (not system) channel.
+  TwoOrgsApplicationGenesis:
+    <<: *ChannelDefaults
+    Orderer:
+      <<: *OrdererDefaults
+      Organizations:
+        - *OrdererOrg
+      Capabilities: *OrdererCapabilities
+    Application:
+      <<: *ApplicationDefaults
+      Organizations:
+        - *Org1
+        - *Org2
+      Capabilities: *ApplicationCapabilities
+
+
+  #
+  # Unclear lineage for these profiles:  nano-fab?
+  #
+  # TwoOrgsOrdererGenesis will construct a system channel as it has a Consortiums stanza, which is not
+  # compatible with osnadmin.
+  #
+  # @enyeart - which profile should be used for the kube test network?
+  #
+  TwoOrgsOrdererGenesis:
+    <<: *ChannelDefaults
+    Orderer:
+      <<: *OrdererDefaults
+      OrdererType: etcdraft
+      Organizations:
+        - *OrdererOrg
+      Capabilities:
+        <<: *OrdererCapabilities
+    Consortiums:
+      SampleConsortium:
+        Organizations:
+          - *Org1
+          - *Org2
+  TwoOrgsChannel:
+    Consortium: SampleConsortium
+    <<: *ChannelDefaults
+    Application:
+      <<: *ApplicationDefaults
+      Organizations:
+        - *Org1
+        - *Org2
+      Capabilities:
+        <<: *ApplicationCapabilities
+  Org1Channel:
+    Consortium: SampleConsortium
+    <<: *ChannelDefaults
+    Application:
+      <<: *ApplicationDefaults
+      Organizations:
+        - *Org1
+      Capabilities:
+        <<: *ApplicationCapabilities
+  Org2Channel:
+    Consortium: SampleConsortium
+    <<: *ChannelDefaults
+    Application:
+      <<: *ApplicationDefaults
+      Organizations:
+        - *Org2
+      Capabilities:
+        <<: *ApplicationCapabilities

full-stack-asset-transfer-guide/infrastructure/sample-network/config/console/hlf-operations-console.yaml

@@ -0,0 +1,80 @@
+---
+apiVersion: ibp.com/v1beta1
+kind: IBPConsole
+metadata:
+  name: hlf-console
+spec:
+  arch:
+    - amd64
+  license:
+    accept: true
+  serviceAccountName: default
+  email: "${CONSOLE_USERNAME}"
+  password: "${CONSOLE_PASSWORD}"
+  allowDefaultPassword: true
+  # registryURL: ghcr.io/ibm-blockchain
+  imagePullSecrets:
+    - ghcr-pull-secret
+  images:
+    consoleInitImage: ${INIT_IMAGE}
+    consoleInitTag: ${INIT_IMAGE_LABEL}
+    consoleImage: ${CONSOLE_IMAGE}
+    consoleTag: ${CONSOLE_IMAGE_LABEL}
+    deployerImage: ${DEPLOYER_IMAGE}
+    deployerTag: ${DEPLOYER_IMAGE_LABEL}
+    configtxlatorImage: ${TOOLS_IMAGE}
+    configtxlatorTag: ${TOOLS_IMAGE_LABEL}
+    couchdbImage: ${COUCHDB_IMAGE}
+    couchdbTag: ${COUCHDB_IMAGE_LABEL}
+  networkinfo:
+    domain: "${CONSOLE_DOMAIN}"
+  storage:
+    console:
+      class: "${STORAGE_CLASS}"
+      size: 5Gi
+  usetags: true
+  version: 1.0.0
+  resources:
+    init:
+      limits:
+        cpu: 100m
+        memory: 200M
+      requests:
+        cpu: 10m
+        memory: 20M
+    configtxlator:
+      limits:
+        cpu: 25m
+        ephemeral-storage: 1G
+        memory: 50Mi
+      requests:
+        cpu: 25m
+        ephemeral-storage: 100M
+        memory: 50Mi
+    couchdb:
+      limits:
+        cpu: 500m
+        ephemeral-storage: 1Gi
+        memory: 1000Mi
+      requests:
+        cpu: 50m
+        ephemeral-storage: 100Mi
+        memory: 128Mi
+    deployer:
+      limits:
+        cpu: 100m
+        ephemeral-storage: 1G
+        memory: 200Mi
+      requests:
+        cpu: 100m
+        ephemeral-storage: 100M
+        memory: 128Mi
+    console:
+      limits:
+        cpu: 500m
+        ephemeral-storage: 1G
+        memory: 1000Mi
+      requests:
+        cpu: 50m
+        ephemeral-storage: 100M
+        memory: 128Mi

full-stack-asset-transfer-guide/infrastructure/sample-network/config/console/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - hlf-operations-console.yaml

full-stack-asset-transfer-guide/infrastructure/sample-network/config/core.yaml

@@ -0,0 +1,775 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+###############################################################################
+#
+#    Peer section
+#
+###############################################################################
+peer:
+
+    # The peer id provides a name for this peer instance and is used when
+    # naming docker resources.
+    id: jdoe
+
+    # The networkId allows for logical separation of networks and is used when
+    # naming docker resources.
+    networkId: dev
+
+    # The Address at local network interface this Peer will listen on.
+    # By default, it will listen on all network interfaces
+    listenAddress: 0.0.0.0:7051
+
+    # The endpoint this peer uses to listen for inbound chaincode connections.
+    # If this is commented-out, the listen address is selected to be
+    # the peer's address (see below) with port 7052
+    # chaincodeListenAddress: 0.0.0.0:7052
+
+    # The endpoint the chaincode for this peer uses to connect to the peer.
+    # If this is not specified, the chaincodeListenAddress address is selected.
+    # And if chaincodeListenAddress is not specified, address is selected from
+    # peer address (see below). If specified peer address is invalid then it
+    # will fallback to the auto detected IP (local IP) regardless of the peer
+    # addressAutoDetect value.
+    # chaincodeAddress: 0.0.0.0:7052
+
+    # When used as peer config, this represents the endpoint to other peers
+    # in the same organization. For peers in other organization, see
+    # gossip.externalEndpoint for more info.
+    # When used as CLI config, this means the peer's endpoint to interact with
+    address: 0.0.0.0:7051
+
+    # Whether the Peer should programmatically determine its address
+    # This case is useful for docker containers.
+    # When set to true, will override peer address.
+    addressAutoDetect: false
+
+    # Keepalive settings for peer server and clients
+    keepalive:
+        # Interval is the duration after which if the server does not see
+        # any activity from the client it pings the client to see if it's alive
+        interval: 7200s
+        # Timeout is the duration the server waits for a response
+        # from the client after sending a ping before closing the connection
+        timeout: 20s
+        # MinInterval is the minimum permitted time between client pings.
+        # If clients send pings more frequently, the peer server will
+        # disconnect them
+        minInterval: 60s
+        # Client keepalive settings for communicating with other peer nodes
+        client:
+            # Interval is the time between pings to peer nodes.  This must
+            # greater than or equal to the minInterval specified by peer
+            # nodes
+            interval: 60s
+            # Timeout is the duration the client waits for a response from
+            # peer nodes before closing the connection
+            timeout: 20s
+        # DeliveryClient keepalive settings for communication with ordering
+        # nodes.
+        deliveryClient:
+            # Interval is the time between pings to ordering nodes.  This must
+            # greater than or equal to the minInterval specified by ordering
+            # nodes.
+            interval: 60s
+            # Timeout is the duration the client waits for a response from
+            # ordering nodes before closing the connection
+            timeout: 20s
+
+
+    # Gossip related configuration
+    gossip:
+        # Bootstrap set to initialize gossip with.
+        # This is a list of other peers that this peer reaches out to at startup.
+        # Important: The endpoints here have to be endpoints of peers in the same
+        # organization, because the peer would refuse connecting to these endpoints
+        # unless they are in the same organization as the peer.
+        bootstrap: 127.0.0.1:7051
+
+        # NOTE: orgLeader and useLeaderElection parameters are mutual exclusive.
+        # Setting both to true would result in the termination of the peer
+        # since this is undefined state. If the peers are configured with
+        # useLeaderElection=false, make sure there is at least 1 peer in the
+        # organization that its orgLeader is set to true.
+
+        # Defines whenever peer will initialize dynamic algorithm for
+        # "leader" selection, where leader is the peer to establish
+        # connection with ordering service and use delivery protocol
+        # to pull ledger blocks from ordering service.
+        useLeaderElection: false
+        # Statically defines peer to be an organization "leader",
+        # where this means that current peer will maintain connection
+        # with ordering service and disseminate block across peers in
+        # its own organization. Multiple peers or all peers in an organization
+        # may be configured as org leaders, so that they all pull
+        # blocks directly from ordering service.
+        orgLeader: true
+
+        # Interval for membershipTracker polling
+        membershipTrackerInterval: 5s
+
+        # Overrides the endpoint that the peer publishes to peers
+        # in its organization. For peers in foreign organizations
+        # see 'externalEndpoint'
+        endpoint:
+        # Maximum count of blocks stored in memory
+        maxBlockCountToStore: 10
+        # Max time between consecutive message pushes(unit: millisecond)
+        maxPropagationBurstLatency: 10ms
+        # Max number of messages stored until a push is triggered to remote peers
+        maxPropagationBurstSize: 10
+        # Number of times a message is pushed to remote peers
+        propagateIterations: 1
+        # Number of peers selected to push messages to
+        propagatePeerNum: 3
+        # Determines frequency of pull phases(unit: second)
+        # Must be greater than digestWaitTime + responseWaitTime
+        pullInterval: 4s
+        # Number of peers to pull from
+        pullPeerNum: 3
+        # Determines frequency of pulling state info messages from peers(unit: second)
+        requestStateInfoInterval: 4s
+        # Determines frequency of pushing state info messages to peers(unit: second)
+        publishStateInfoInterval: 4s
+        # Maximum time a stateInfo message is kept until expired
+        stateInfoRetentionInterval:
+        # Time from startup certificates are included in Alive messages(unit: second)
+        publishCertPeriod: 10s
+        # Should we skip verifying block messages or not (currently not in use)
+        skipBlockVerification: false
+        # Dial timeout(unit: second)
+        dialTimeout: 3s
+        # Connection timeout(unit: second)
+        connTimeout: 2s
+        # Buffer size of received messages
+        recvBuffSize: 20
+        # Buffer size of sending messages
+        sendBuffSize: 200
+        # Time to wait before pull engine processes incoming digests (unit: second)
+        # Should be slightly smaller than requestWaitTime
+        digestWaitTime: 1s
+        # Time to wait before pull engine removes incoming nonce (unit: milliseconds)
+        # Should be slightly bigger than digestWaitTime
+        requestWaitTime: 1500ms
+        # Time to wait before pull engine ends pull (unit: second)
+        responseWaitTime: 2s
+        # Alive check interval(unit: second)
+        aliveTimeInterval: 5s
+        # Alive expiration timeout(unit: second)
+        aliveExpirationTimeout: 25s
+        # Reconnect interval(unit: second)
+        reconnectInterval: 25s
+        # Max number of attempts to connect to a peer
+        maxConnectionAttempts: 120
+        # Message expiration factor for alive messages
+        msgExpirationFactor: 20
+        # This is an endpoint that is published to peers outside of the organization.
+        # If this isn't set, the peer will not be known to other organizations.
+        externalEndpoint:
+        # Leader election service configuration
+        election:
+            # Longest time peer waits for stable membership during leader election startup (unit: second)
+            startupGracePeriod: 15s
+            # Interval gossip membership samples to check its stability (unit: second)
+            membershipSampleInterval: 1s
+            # Time passes since last declaration message before peer decides to perform leader election (unit: second)
+            leaderAliveThreshold: 10s
+            # Time between peer sends propose message and declares itself as a leader (sends declaration message) (unit: second)
+            leaderElectionDuration: 5s
+
+        pvtData:
+            # pullRetryThreshold determines the maximum duration of time private data corresponding for a given block
+            # would be attempted to be pulled from peers until the block would be committed without the private data
+            pullRetryThreshold: 60s
+            # As private data enters the transient store, it is associated with the peer's ledger's height at that time.
+            # transientstoreMaxBlockRetention defines the maximum difference between the current ledger's height upon commit,
+            # and the private data residing inside the transient store that is guaranteed not to be purged.
+            # Private data is purged from the transient store when blocks with sequences that are multiples
+            # of transientstoreMaxBlockRetention are committed.
+            transientstoreMaxBlockRetention: 1000
+            # pushAckTimeout is the maximum time to wait for an acknowledgement from each peer
+            # at private data push at endorsement time.
+            pushAckTimeout: 3s
+            # Block to live pulling margin, used as a buffer
+            # to prevent peer from trying to pull private data
+            # from peers that is soon to be purged in next N blocks.
+            # This helps a newly joined peer catch up to current
+            # blockchain height quicker.
+            btlPullMargin: 10
+            # the process of reconciliation is done in an endless loop, while in each iteration reconciler tries to
+            # pull from the other peers the most recent missing blocks with a maximum batch size limitation.
+            # reconcileBatchSize determines the maximum batch size of missing private data that will be reconciled in a
+            # single iteration.
+            reconcileBatchSize: 10
+            # reconcileSleepInterval determines the time reconciler sleeps from end of an iteration until the beginning
+            # of the next reconciliation iteration.
+            reconcileSleepInterval: 1m
+            # reconciliationEnabled is a flag that indicates whether private data reconciliation is enable or not.
+            reconciliationEnabled: true
+            # skipPullingInvalidTransactionsDuringCommit is a flag that indicates whether pulling of invalid
+            # transaction's private data from other peers need to be skipped during the commit time and pulled
+            # only through reconciler.
+            skipPullingInvalidTransactionsDuringCommit: false
+            # implicitCollectionDisseminationPolicy specifies the dissemination  policy for the peer's own implicit collection.
+            # When a peer endorses a proposal that writes to its own implicit collection, below values override the default values
+            # for disseminating private data.
+            # Note that it is applicable to all channels the peer has joined. The implication is that requiredPeerCount has to
+            # be smaller than the number of peers in a channel that has the lowest numbers of peers from the organization.
+            implicitCollectionDisseminationPolicy:
+               # requiredPeerCount defines the minimum number of eligible peers to which the peer must successfully
+               # disseminate private data for its own implicit collection during endorsement. Default value is 0.
+               requiredPeerCount: 0
+               # maxPeerCount defines the maximum number of eligible peers to which the peer will attempt to
+               # disseminate private data for its own implicit collection during endorsement. Default value is 1.
+               maxPeerCount: 1
+
+        # Gossip state transfer related configuration
+        state:
+            # indicates whenever state transfer is enabled or not
+            # default value is true, i.e. state transfer is active
+            # and takes care to sync up missing blocks allowing
+            # lagging peer to catch up to speed with rest network.
+            # Keep in mind that when peer.gossip.useLeaderElection is true
+            # and there are several peers in the organization,
+            # or peer.gossip.useLeaderElection is false alongside with
+            # peer.gossip.orgleader being false, the peer's ledger may lag behind
+            # the rest of the peers and will never catch up due to state transfer
+            # being disabled.
+            enabled: false
+            # checkInterval interval to check whether peer is lagging behind enough to
+            # request blocks via state transfer from another peer.
+            checkInterval: 10s
+            # responseTimeout amount of time to wait for state transfer response from
+            # other peers
+            responseTimeout: 3s
+            # batchSize the number of blocks to request via state transfer from another peer
+            batchSize: 10
+            # blockBufferSize reflects the size of the re-ordering buffer
+            # which captures blocks and takes care to deliver them in order
+            # down to the ledger layer. The actual buffer size is bounded between
+            # 0 and 2*blockBufferSize, each channel maintains its own buffer
+            blockBufferSize: 20
+            # maxRetries maximum number of re-tries to ask
+            # for single state transfer request
+            maxRetries: 3
+
+    # TLS Settings
+    tls:
+        # Require server-side TLS
+        enabled: true
+        # Require client certificates / mutual TLS for inbound connections.
+        # Note that clients that are not configured to use a certificate will
+        # fail to connect to the peer.
+        clientAuthRequired: false
+        # X.509 certificate used for TLS server
+        cert:
+            file: tls/server.crt
+        # Private key used for TLS server
+        key:
+            file: tls/server.key
+        # rootcert.file represents the trusted root certificate chain used for verifying certificates
+        # of other nodes during outbound connections.
+        # It is not required to be set, but can be used to augment the set of TLS CA certificates
+        # available from the MSPs of each channel’s configuration.
+        rootcert:
+            file: tls/ca.crt
+        # If mutual TLS is enabled, clientRootCAs.files contains a list of additional root certificates
+        # used for verifying certificates of client connections.
+        # It augments the set of TLS CA certificates available from the MSPs of each channel’s configuration.
+        # Minimally, set your organization's TLS CA root certificate so that the peer can receive join channel requests.
+        clientRootCAs:
+            files:
+              - tls/ca.crt
+        # Private key used for TLS when making client connections.
+        # If not set, peer.tls.key.file will be used instead
+        clientKey:
+            file:
+        # X.509 certificate used for TLS when making client connections.
+        # If not set, peer.tls.cert.file will be used instead
+        clientCert:
+            file:
+
+    # Authentication contains configuration parameters related to authenticating
+    # client messages
+    authentication:
+        # the acceptable difference between the current server time and the
+        # client's time as specified in a client request message
+        timewindow: 15m
+
+    # Path on the file system where peer will store data (eg ledger). This
+    # location must be access control protected to prevent unintended
+    # modification that might corrupt the peer operations.
+    fileSystemPath: /var/hyperledger/production
+
+    # BCCSP (Blockchain crypto provider): Select which crypto implementation or
+    # library to use
+    BCCSP:
+        Default: SW
+        # Settings for the SW crypto provider (i.e. when DEFAULT: SW)
+        SW:
+            # TODO: The default Hash and Security level needs refactoring to be
+            # fully configurable. Changing these defaults requires coordination
+            # SHA2 is hardcoded in several places, not only BCCSP
+            Hash: SHA2
+            Security: 256
+            # Location of Key Store
+            FileKeyStore:
+                # If "", defaults to 'mspConfigPath'/keystore
+                KeyStore:
+        # Settings for the PKCS#11 crypto provider (i.e. when DEFAULT: PKCS11)
+        PKCS11:
+            # Location of the PKCS11 module library
+            Library:
+            # Token Label
+            Label:
+            # User PIN
+            Pin:
+            Hash:
+            Security:
+
+    # Path on the file system where peer will find MSP local configurations
+    mspConfigPath: msp
+
+    # Identifier of the local MSP
+    # ----!!!!IMPORTANT!!!-!!!IMPORTANT!!!-!!!IMPORTANT!!!!----
+    # Deployers need to change the value of the localMspId string.
+    # In particular, the name of the local MSP ID of a peer needs
+    # to match the name of one of the MSPs in each of the channel
+    # that this peer is a member of. Otherwise this peer's messages
+    # will not be identified as valid by other nodes.
+    localMspId: Org1MSP
+
+    # CLI common client config options
+    client:
+        # connection timeout
+        connTimeout: 15s
+
+    # Delivery service related config
+    deliveryclient:
+        # It sets the total time the delivery service may spend in reconnection
+        # attempts until its retry logic gives up and returns an error
+        reconnectTotalTimeThreshold: 3600s
+
+        # It sets the delivery service <-> ordering service node connection timeout
+        connTimeout: 15s
+
+        # It sets the delivery service maximal delay between consecutive retries
+        reConnectBackoffThreshold: 3600s
+
+        # A list of orderer endpoint addresses which should be overridden
+        # when found in channel configurations.
+        addressOverrides:
+        #  - from:
+        #    to:
+        #    caCertsFile:
+        #  - from:
+        #    to:
+        #    caCertsFile:
+
+    # Type for the local MSP - by default it's of type bccsp
+    localMspType: bccsp
+
+    # Used with Go profiling tools only in none production environment. In
+    # production, it should be disabled (eg enabled: false)
+    profile:
+        enabled:     false
+        listenAddress: 0.0.0.0:6060
+
+    # Handlers defines custom handlers that can filter and mutate
+    # objects passing within the peer, such as:
+    #   Auth filter - reject or forward proposals from clients
+    #   Decorators  - append or mutate the chaincode input passed to the chaincode
+    #   Endorsers   - Custom signing over proposal response payload and its mutation
+    # Valid handler definition contains:
+    #   - A name which is a factory method name defined in
+    #     core/handlers/library/library.go for statically compiled handlers
+    #   - library path to shared object binary for pluggable filters
+    # Auth filters and decorators are chained and executed in the order that
+    # they are defined. For example:
+    # authFilters:
+    #   -
+    #     name: FilterOne
+    #     library: /opt/lib/filter.so
+    #   -
+    #     name: FilterTwo
+    # decorators:
+    #   -
+    #     name: DecoratorOne
+    #   -
+    #     name: DecoratorTwo
+    #     library: /opt/lib/decorator.so
+    # Endorsers are configured as a map that its keys are the endorsement system chaincodes that are being overridden.
+    # Below is an example that overrides the default ESCC and uses an endorsement plugin that has the same functionality
+    # as the default ESCC.
+    # If the 'library' property is missing, the name is used as the constructor method in the builtin library similar
+    # to auth filters and decorators.
+    # endorsers:
+    #   escc:
+    #     name: DefaultESCC
+    #     library: /etc/hyperledger/fabric/plugin/escc.so
+    handlers:
+        authFilters:
+          -
+            name: DefaultAuth
+          -
+            name: ExpirationCheck    # This filter checks identity x509 certificate expiration
+        decorators:
+          -
+            name: DefaultDecorator
+        endorsers:
+          escc:
+            name: DefaultEndorsement
+            library:
+        validators:
+          vscc:
+            name: DefaultValidation
+            library:
+
+    #    library: /etc/hyperledger/fabric/plugin/escc.so
+    # Number of goroutines that will execute transaction validation in parallel.
+    # By default, the peer chooses the number of CPUs on the machine. Set this
+    # variable to override that choice.
+    # NOTE: overriding this value might negatively influence the performance of
+    # the peer so please change this value only if you know what you're doing
+    validatorPoolSize:
+
+    # The discovery service is used by clients to query information about peers,
+    # such as - which peers have joined a certain channel, what is the latest
+    # channel config, and most importantly - given a chaincode and a channel,
+    # what possible sets of peers satisfy the endorsement policy.
+    discovery:
+        enabled: true
+        # Whether the authentication cache is enabled or not.
+        authCacheEnabled: true
+        # The maximum size of the cache, after which a purge takes place
+        authCacheMaxSize: 1000
+        # The proportion (0 to 1) of entries that remain in the cache after the cache is purged due to overpopulation
+        authCachePurgeRetentionRatio: 0.75
+        # Whether to allow non-admins to perform non channel scoped queries.
+        # When this is false, it means that only peer admins can perform non channel scoped queries.
+        orgMembersAllowedAccess: false
+
+    # Limits is used to configure some internal resource limits.
+    limits:
+        # Concurrency limits the number of concurrently running requests to a service on each peer.
+        # Currently this option is only applied to endorser service and deliver service.
+        # When the property is missing or the value is 0, the concurrency limit is disabled for the service.
+        concurrency:
+            # endorserService limits concurrent requests to endorser service that handles chaincode deployment, query and invocation,
+            # including both user chaincodes and system chaincodes.
+            endorserService: 2500
+            # deliverService limits concurrent event listeners registered to deliver service for blocks and transaction events.
+            deliverService: 2500
+
+###############################################################################
+#
+#    VM section
+#
+###############################################################################
+vm:
+
+    # Endpoint of the vm management system.  For docker can be one of the following in general
+    # unix:///var/run/docker.sock
+    # http://localhost:2375
+    # https://localhost:2376
+    # endpoint: unix:///var/run/docker.sock
+
+    # DISABLE the docker daemon endpoint to prevent /healthz from checking for docker in "External Builder" mode.
+    endpoint:
+
+    # settings for docker vms
+    docker:
+        tls:
+            enabled: false
+            ca:
+                file: docker/ca.crt
+            cert:
+                file: docker/tls.crt
+            key:
+                file: docker/tls.key
+
+        # Enables/disables the standard out/err from chaincode containers for
+        # debugging purposes
+        attachStdout: false
+
+        # Parameters on creating docker container.
+        # Container may be efficiently created using ipam & dns-server for cluster
+        # NetworkMode - sets the networking mode for the container. Supported
+        # standard values are: `host`(default),`bridge`,`ipvlan`,`none`.
+        # Dns - a list of DNS servers for the container to use.
+        # Note:  `Privileged` `Binds` `Links` and `PortBindings` properties of
+        # Docker Host Config are not supported and will not be used if set.
+        # LogConfig - sets the logging driver (Type) and related options
+        # (Config) for Docker. For more info,
+        # https://docs.docker.com/engine/admin/logging/overview/
+        # Note: Set LogConfig using Environment Variables is not supported.
+        hostConfig:
+            NetworkMode: host
+            Dns:
+               # - 192.168.0.1
+            LogConfig:
+                Type: json-file
+                Config:
+                    max-size: "50m"
+                    max-file: "5"
+            Memory: 2147483648
+
+###############################################################################
+#
+#    Chaincode section
+#
+###############################################################################
+chaincode:
+
+    # The id is used by the Chaincode stub to register the executing Chaincode
+    # ID with the Peer and is generally supplied through ENV variables
+    # the `path` form of ID is provided when installing the chaincode.
+    # The `name` is used for all other requests and can be any string.
+    id:
+        path:
+        name:
+
+    # Generic builder environment, suitable for most chaincode types
+    builder: $(DOCKER_NS)/fabric-ccenv:$(TWO_DIGIT_VERSION)
+
+    # Enables/disables force pulling of the base docker images (listed below)
+    # during user chaincode instantiation.
+    # Useful when using moving image tags (such as :latest)
+    pull: false
+
+    golang:
+        # golang will never need more than baseos
+        runtime: $(DOCKER_NS)/fabric-baseos:$(TWO_DIGIT_VERSION)
+
+        # whether or not golang chaincode should be linked dynamically
+        dynamicLink: false
+
+    java:
+        # This is an image based on java:openjdk-8 with addition compiler
+        # tools added for java shim layer packaging.
+        # This image is packed with shim layer libraries that are necessary
+        # for Java chaincode runtime.
+        runtime: $(DOCKER_NS)/fabric-javaenv:$(TWO_DIGIT_VERSION)
+
+    node:
+        # This is an image based on node:$(NODE_VER)-alpine
+        runtime: $(DOCKER_NS)/fabric-nodeenv:$(TWO_DIGIT_VERSION)
+
+    # List of directories to treat as external builders and launchers for
+    # chaincode. The external builder detection processing will iterate over the
+    # builders in the order specified below.
+    externalBuilders:
+      - path: /var/hyperledger/fabric/chaincode/ccs-builder
+        name: ccs-builder
+        propagateEnvironment:
+          - HOME
+          - CORE_PEER_ID
+          - CORE_PEER_LOCALMSPID
+
+    # The maximum duration to wait for the chaincode build and install process
+    # to complete.
+    installTimeout: 300s
+
+    # Timeout duration for starting up a container and waiting for Register
+    # to come through.
+    startuptimeout: 300s
+
+    # Timeout duration for Invoke and Init calls to prevent runaway.
+    # This timeout is used by all chaincodes in all the channels, including
+    # system chaincodes.
+    # Note that during Invoke, if the image is not available (e.g. being
+    # cleaned up when in development environment), the peer will automatically
+    # build the image, which might take more time. In production environment,
+    # the chaincode image is unlikely to be deleted, so the timeout could be
+    # reduced accordingly.
+    executetimeout: 30s
+
+    # There are 2 modes: "dev" and "net".
+    # In dev mode, user runs the chaincode after starting peer from
+    # command line on local machine.
+    # In net mode, peer will run chaincode in a docker container.
+    mode: net
+
+    # keepalive in seconds. In situations where the communication goes through a
+    # proxy that does not support keep-alive, this parameter will maintain connection
+    # between peer and chaincode.
+    # A value <= 0 turns keepalive off
+    keepalive: 0
+
+    # enabled system chaincodes
+    system:
+        _lifecycle: enable
+        cscc: enable
+        lscc: enable
+        qscc: enable
+
+    # Logging section for the chaincode container
+    logging:
+      # Default level for all loggers within the chaincode container
+      level:  info
+      # Override default level for the 'shim' logger
+      shim:   warning
+      # Format for the chaincode container logs
+      format: '%{color}%{time:2006-01-02 15:04:05.000 MST} [%{module}] %{shortfunc} -> %{level:.4s} %{id:03x}%{color:reset} %{message}'
+
+###############################################################################
+#
+#    Ledger section - ledger configuration encompasses both the blockchain
+#    and the state
+#
+###############################################################################
+ledger:
+
+  blockchain:
+
+  state:
+    # stateDatabase - options are "goleveldb", "CouchDB"
+    # goleveldb - default state database stored in goleveldb.
+    # CouchDB - store state database in CouchDB
+    stateDatabase: goleveldb
+    # Limit on the number of records to return per query
+    totalQueryLimit: 100000
+    couchDBConfig:
+       # It is recommended to run CouchDB on the same server as the peer, and
+       # not map the CouchDB container port to a server port in docker-compose.
+       # Otherwise proper security must be provided on the connection between
+       # CouchDB client (on the peer) and server.
+       couchDBAddress: 127.0.0.1:5984
+       # This username must have read and write authority on CouchDB
+       username:
+       # The password is recommended to pass as an environment variable
+       # during start up (eg CORE_LEDGER_STATE_COUCHDBCONFIG_PASSWORD).
+       # If it is stored here, the file must be access control protected
+       # to prevent unintended users from discovering the password.
+       password:
+       # Number of retries for CouchDB errors
+       maxRetries: 3
+       # Number of retries for CouchDB errors during peer startup.
+       # The delay between retries doubles for each attempt.
+       # Default of 10 retries results in 11 attempts over 2 minutes.
+       maxRetriesOnStartup: 10
+       # CouchDB request timeout (unit: duration, e.g. 20s)
+       requestTimeout: 35s
+       # Limit on the number of records per each CouchDB query
+       # Note that chaincode queries are only bound by totalQueryLimit.
+       # Internally the chaincode may execute multiple CouchDB queries,
+       # each of size internalQueryLimit.
+       internalQueryLimit: 1000
+       # Limit on the number of records per CouchDB bulk update batch
+       maxBatchUpdateSize: 1000
+       # Warm indexes after every N blocks.
+       # This option warms any indexes that have been
+       # deployed to CouchDB after every N blocks.
+       # A value of 1 will warm indexes after every block commit,
+       # to ensure fast selector queries.
+       # Increasing the value may improve write efficiency of peer and CouchDB,
+       # but may degrade query response time.
+       warmIndexesAfterNBlocks: 1
+       # Create the _global_changes system database
+       # This is optional.  Creating the global changes database will require
+       # additional system resources to track changes and maintain the database
+       createGlobalChangesDB: false
+       # CacheSize denotes the maximum mega bytes (MB) to be allocated for the in-memory state
+       # cache. Note that CacheSize needs to be a multiple of 32 MB. If it is not a multiple
+       # of 32 MB, the peer would round the size to the next multiple of 32 MB.
+       # To disable the cache, 0 MB needs to be assigned to the cacheSize.
+       cacheSize: 64
+
+  history:
+    # enableHistoryDatabase - options are true or false
+    # Indicates if the history of key updates should be stored.
+    # All history 'index' will be stored in goleveldb, regardless if using
+    # CouchDB or alternate database for the state.
+    enableHistoryDatabase: true
+
+  pvtdataStore:
+    # the maximum db batch size for converting
+    # the ineligible missing data entries to eligible missing data entries
+    collElgProcMaxDbBatchSize: 5000
+    # the minimum duration (in milliseconds) between writing
+    # two consecutive db batches for converting the ineligible missing data entries to eligible missing data entries
+    collElgProcDbBatchesInterval: 1000
+    # The missing data entries are classified into two categories:
+    # (1) prioritized
+    # (2) deprioritized
+    # Initially, all missing data are in the prioritized list. When the
+    # reconciler is unable to fetch the missing data from other peers,
+    # the unreconciled missing data would be moved to the deprioritized list.
+    # The reconciler would retry deprioritized missing data after every
+    # deprioritizedDataReconcilerInterval (unit: minutes). Note that the
+    # interval needs to be greater than the reconcileSleepInterval
+    deprioritizedDataReconcilerInterval: 60m
+
+  snapshots:
+    # Path on the file system where peer will store ledger snapshots
+    rootDir: /var/hyperledger/production/snapshots
+
+###############################################################################
+#
+#    Operations section
+#
+###############################################################################
+operations:
+    # host and port for the operations server
+    listenAddress: 127.0.0.1:9443
+
+    # TLS configuration for the operations endpoint
+    tls:
+        # TLS enabled
+        enabled: false
+
+        # path to PEM encoded server certificate for the operations server
+        cert:
+            file:
+
+        # path to PEM encoded server key for the operations server
+        key:
+            file:
+
+        # most operations service endpoints require client authentication when TLS
+        # is enabled. clientAuthRequired requires client certificate authentication
+        # at the TLS layer to access all resources.
+        clientAuthRequired: false
+
+        # paths to PEM encoded ca certificates to trust for client authentication
+        clientRootCAs:
+            files: []
+
+###############################################################################
+#
+#    Metrics section
+#
+###############################################################################
+metrics:
+    # metrics provider is one of statsd, prometheus, or disabled
+    provider: disabled
+
+    # statsd configuration
+    statsd:
+        # network type: tcp or udp
+        network: udp
+
+        # statsd server address
+        address: 127.0.0.1:8125
+
+        # the interval at which locally cached counters and gauges are pushed
+        # to statsd; timings are pushed immediately
+        writeInterval: 10s
+
+        # prefix is prepended to all emitted statsd metrics
+        prefix:

full-stack-asset-transfer-guide/infrastructure/sample-network/config/gateway/kustomization.yaml

@@ -0,0 +1,24 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - org1-peer-gateway.yaml
+#  - org2-peer-gateway.yaml

full-stack-asset-transfer-guide/infrastructure/sample-network/config/gateway/org1-peer-gateway.yaml

@@ -0,0 +1,76 @@
+#
+# Copyright contributors to the Hyperledgendary Full Stack Asset Transfer project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: org1-peer-gateway
+  labels:
+    app: org1-peer-gateway
+    app.kubernetes.io/instance: fabricpeer
+    app.kubernetes.io/managed-by: fabric-operator
+    app.kubernetes.io/name: fabric
+    creator: fabric
+    orgname: Org1MSP
+spec:
+  # This selector stanza will match on the orgname: label below, distributing connections to all
+  # peers matching the org MSP.
+  selector:
+    # app: org1-peer1
+    app.kubernetes.io/instance: fabricpeer
+    app.kubernetes.io/managed-by: fabric-operator
+    app.kubernetes.io/name: fabric
+    creator: fabric
+    orgname: Org1MSP
+  ports:
+    - name: peer-api
+      port: 7051
+      protocol: TCP
+      targetPort: 7051
+
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: org1-peer-gateway
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-connect-timeout: 60s
+    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+  labels:
+    app: org1-peer-gateway
+    app.kubernetes.io/instance: fabricpeer
+    app.kubernetes.io/managed-by: fabric-operator
+    app.kubernetes.io/name: fabric
+    creator: fabric
+    orgname: Org1MSP
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: test-network-org1-peer-gateway.${WORKSHOP_INGRESS_DOMAIN}
+      http:
+        paths:
+          - backend:
+              service:
+                name: org1-peer-gateway
+                port:
+                  name: peer-api
+            path: /
+            pathType: ImplementationSpecific
+  tls:
+    - hosts:
+        - test-network-org1-peer-gateway.${WORKSHOP_INGRESS_DOMAIN}

full-stack-asset-transfer-guide/infrastructure/sample-network/config/gateway/org2-peer-gateway.yaml

@@ -0,0 +1,76 @@
+#
+# Copyright contributors to the Hyperledgendary Full Stack Asset Transfer project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: org2-peer-gateway
+  labels:
+    app: org2-peer-gateway
+    app.kubernetes.io/instance: fabricpeer
+    app.kubernetes.io/managed-by: fabric-operator
+    app.kubernetes.io/name: fabric
+    creator: fabric
+    orgname: Org2MSP
+spec:
+  # This selector stanza will match on the orgname: label below, distributing connections to all
+  # peers matching the org MSP.
+  selector:
+    # app: org2-peer1
+    app.kubernetes.io/instance: fabricpeer
+    app.kubernetes.io/managed-by: fabric-operator
+    app.kubernetes.io/name: fabric
+    creator: fabric
+    orgname: Org2MSP
+  ports:
+    - name: peer-api
+      port: 7051
+      protocol: TCP
+      targetPort: 7051
+
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: org2-peer-gateway
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-connect-timeout: 60s
+    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+  labels:
+    app: org2-peer-gateway
+    app.kubernetes.io/instance: fabricpeer
+    app.kubernetes.io/managed-by: fabric-operator
+    app.kubernetes.io/name: fabric
+    creator: fabric
+    orgname: Org2MSP
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: test-network-org2-peer-gateway.${WORKSHOP_INGRESS_DOMAIN}
+      http:
+        paths:
+          - backend:
+              service:
+                name: org2-peer-gateway
+                port:
+                  name: peer-api
+            path: /
+            pathType: ImplementationSpecific
+  tls:
+    - hosts:
+        - test-network-org2-peer-gateway.${WORKSHOP_INGRESS_DOMAIN}

full-stack-asset-transfer-guide/infrastructure/sample-network/config/manager/fabric-operator-manager.yaml

@@ -0,0 +1,123 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: fabric-operator
+  labels:
+    release: "operator"
+    helm.sh/chart: "hlf"
+    app.kubernetes.io/name: "hlf"
+    app.kubernetes.io/instance: "hlf"
+    app.kubernetes.io/managed-by: "fabric-operator"
+spec:
+  replicas: 1
+  strategy:
+    type: "Recreate"
+  selector:
+    matchLabels:
+      name: fabric-operator
+  template:
+    metadata:
+      labels:
+        name: fabric-operator
+        release: "operator"
+        helm.sh/chart: "hlf"
+        app.kubernetes.io/name: "hlf"
+        app.kubernetes.io/instance: "hlf"
+        app.kubernetes.io/managed-by: "fabric-operator"
+      annotations:
+        productName: "Hyperledger Fabric Operator"
+        productID: ""
+        productVersion: "1.0.0"
+        productChargedContainers: ""
+        productMetric: "VIRTUAL_PROCESSOR_CORE"
+    spec:
+      # hostIPC: false
+      # hostNetwork: false
+      # hostPID: false
+      serviceAccountName: fabric-operator
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values:
+                      - amd64
+      # securityContext:
+      #   runAsNonRoot: true
+      #   runAsUser: 1001
+      #   fsGroup: 2000
+
+      imagePullSecrets:
+        - name: ghcr-pull-secret
+
+      containers:
+        - name: fabric-operator
+          image: ${FABRIC_OPERATOR_IMAGE}
+          imagePullPolicy: ${IMAGE_PULL_POLICY}
+
+          command:
+            - ibp-operator
+          # securityContext:
+          #   privileged: false
+          #   allowPrivilegeEscalation: false
+          #   readOnlyRootFilesystem: false
+          #   runAsNonRoot: false
+          #   runAsUser: 1001
+          #   capabilities:
+          #     drop:
+          #       - ALL
+          #     add:
+          #       - CHOWN
+          #       - FOWNER
+          livenessProbe:
+            tcpSocket:
+              port: 8383
+            initialDelaySeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 5
+          readinessProbe:
+            tcpSocket:
+              port: 8383
+            initialDelaySeconds: 10
+            timeoutSeconds: 5
+            periodSeconds: 5
+          env:
+            - name: WATCH_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: OPERATOR_NAME
+              value: "fabric-operator"
+            - name: CLUSTERTYPE
+              value: K8S
+          resources:
+            requests:
+              cpu: 10m
+              memory: 10Mi
+            limits:
+              cpu: 100m
+              memory: 200Mi

full-stack-asset-transfer-guide/infrastructure/sample-network/config/manager/kustomization.yaml

@@ -0,0 +1,22 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - fabric-operator-manager.yaml

full-stack-asset-transfer-guide/infrastructure/sample-network/config/orderers/kustomization.yaml

@@ -0,0 +1,24 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - org0-orderers.yaml
+

full-stack-asset-transfer-guide/infrastructure/sample-network/config/orderers/org0-orderers.yaml

@@ -0,0 +1,151 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+apiVersion: ibp.com/v1beta1
+kind: IBPOrderer
+metadata:
+  name: org0-orderers
+spec:
+  version: "${FABRIC_VERSION}"
+  domain: "${INGRESS_DOMAIN}"
+  license:
+    accept: true
+  action:
+    enroll: {}
+    reenroll: {}
+  clusterSize: 3
+  clusterconfigoverride:
+    - general:
+        keepalive:
+          serverMinInterval: 61s
+    - general:
+        keepalive:
+          serverMinInterval: 61s
+    - general:
+        keepalive:
+          serverMinInterval: 61s
+  clustersecret:
+    - enrollment:
+        component:
+          caname: ca
+          cahost: test-network-org0-ca-ca.${INGRESS_DOMAIN}
+          caport: "443"
+          catls:
+            cacert: "${ORG0_CA_CERT}"
+          enrollid: "orderer1"
+          enrollsecret: "orderer1pw"
+        tls:
+          caname: tlsca
+          cahost: test-network-org0-ca-ca.${INGRESS_DOMAIN}
+          caport: "443"
+          catls:
+            cacert: "${ORG0_CA_CERT}"
+          enrollid: "orderer1"
+          enrollsecret: "orderer1pw"
+          csr:
+            hosts:
+              - "org0-orderersnode1"
+              - "org0-orderersnode1.${KUBE_DNS_DOMAIN}"
+    - enrollment:
+        component:
+          caname: ca
+          cahost: test-network-org0-ca-ca.${INGRESS_DOMAIN}
+          caport: "443"
+          catls:
+            cacert: "${ORG0_CA_CERT}"
+          enrollid: "orderer2"
+          enrollsecret: "orderer2pw"
+        tls:
+          caname: tlsca
+          cahost: test-network-org0-ca-ca.${INGRESS_DOMAIN}
+          caport: "443"
+          catls:
+            cacert: "${ORG0_CA_CERT}"
+          enrollid: "orderer2"
+          enrollsecret: "orderer2pw"
+          csr:
+            hosts:
+              - "org0-orderersnode2"
+              - "org0-orderersnode2.${KUBE_DNS_DOMAIN}"
+    - enrollment:
+        component:
+          caname: ca
+          cahost: test-network-org0-ca-ca.${INGRESS_DOMAIN}
+          caport: "443"
+          catls:
+            cacert: "${ORG0_CA_CERT}"
+          enrollid: "orderer3"
+          enrollsecret: "orderer3pw"
+        tls:
+          caname: tlsca
+          cahost: test-network-org0-ca-ca.${INGRESS_DOMAIN}
+          caport: "443"
+          catls:
+            cacert: "${ORG0_CA_CERT}"
+          enrollid: "orderer3"
+          enrollsecret: "orderer3pw"
+          csr:
+            hosts:
+              - "org0-orderersnode3"
+              - "org0-orderersnode3.${KUBE_DNS_DOMAIN}"
+
+  customNames:
+    pvc: {}
+  images:
+    ordererInitImage: ${INIT_IMAGE}
+    ordererInitTag: ${INIT_IMAGE_LABEL}
+    ordererImage: ${ORDERER_IMAGE}
+    ordererTag: ${ORDERER_IMAGE_LABEL}
+    grpcwebImage: ${GRPCWEB_IMAGE}
+    grpcwebTag: ${GRPCWEB_IMAGE_LABEL}
+  ingress:
+    class: ""
+    tlsSecretName: ""
+  mspID: OrdererMSP
+  ordererType: etcdraft
+  orgName: OrdererOrg
+  useChannelLess: true
+  systemChannelName: testchainid
+  resources:
+    init:
+      limits:
+        cpu: 100m
+        memory: 200M
+      requests:
+        cpu: 10m
+        memory: 10M
+    orderer:
+      limits:
+        cpu: 600m
+        memory: 1200M
+      requests:
+        cpu: 10m
+        memory: 10M
+    proxy:
+      limits:
+        cpu: 100m
+        memory: 200M
+      requests:
+        cpu: 10m
+        memory: 10M
+  service:
+    type: ClusterIP
+  storage:
+    orderer:
+      class: "${STORAGE_CLASS}"
+      size: 5G

full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/kustomization.yaml

@@ -0,0 +1,27 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - org1-peer1.yaml
+  - org1-peer2.yaml
+  - org2-peer1.yaml
+  - org2-peer2.yaml
+

full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org1-peer1.yaml

@@ -0,0 +1,103 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+apiVersion: ibp.com/v1beta1
+kind: IBPPeer
+metadata:
+  name: org1-peer1
+spec:
+  version: "${FABRIC_VERSION}"
+  domain: "${INGRESS_DOMAIN}"
+  peerExternalEndpoint: "test-network-org1-peer1-peer.${INGRESS_DOMAIN}:443"
+  license:
+    accept: true
+  action:
+    enroll: {}
+    reenroll: {}
+  configoverride:
+    peer:
+      keepalive:
+        minInterval: 61s
+  customNames:
+    pvc: {}
+  images:
+    peerInitImage: ${INIT_IMAGE}
+    peerInitTag: ${INIT_IMAGE_LABEL}
+    peerImage: ${PEER_IMAGE}
+    peerTag: ${PEER_IMAGE_LABEL}
+    grpcwebImage: ${GRPCWEB_IMAGE}
+    grpcwebTag: ${GRPCWEB_IMAGE_LABEL}
+  mspID: Org1MSP
+  mspSecret: org1-peer1-secret
+  secret:
+    enrollment:
+      component:
+        caname: ca
+        cahost: "test-network-org1-ca-ca.${INGRESS_DOMAIN}"
+        caport: "443"
+        catls:
+          cacert: "${ORG1_CA_CERT}"
+        enrollid: "peer1"
+        enrollsecret: "peer1pw"
+      tls:
+        caname: tlsca
+        cahost: "test-network-org1-ca-ca.${INGRESS_DOMAIN}"
+        caport: "443"
+        catls:
+          cacert: "${ORG1_CA_CERT}"
+        enrollid: "peer1"
+        enrollsecret: "peer1pw"
+        csr:
+          hosts:
+            - "org1-peer1"
+            - "org1-peer1.${KUBE_DNS_DOMAIN}"
+            - "test-network-org1-peer-gateway.${INGRESS_DOMAIN}"
+  chaincodeBuilderConfig:
+    peername: org1-peer1
+  service:
+    type: ClusterIP
+  stateDb: leveldb
+  storage:
+    peer:
+      class: "${STORAGE_CLASS}"
+      size: 5G
+    statedb:
+      class: "${STORAGE_CLASS}"
+      size: 10Gi
+  resources:
+    init:
+      limits:
+        cpu: 100m
+        memory: 200M
+      requests:
+        cpu: 10m
+        memory: 10M
+    peer:
+      limits:
+        cpu: 500m
+        memory: 1G
+      requests:
+        cpu: 10m
+        memory: 10M
+    proxy:
+      limits:
+        cpu: 100m
+        memory: 200M
+      requests:
+        cpu: 10m
+        memory: 10M

full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org1-peer2.yaml

@@ -0,0 +1,103 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+apiVersion: ibp.com/v1beta1
+kind: IBPPeer
+metadata:
+  name: org1-peer2
+spec:
+  version: "${FABRIC_VERSION}"
+  domain: "${INGRESS_DOMAIN}"
+  peerExternalEndpoint: "test-network-org1-peer2-peer.${INGRESS_DOMAIN}:443"
+  license:
+    accept: true
+  action:
+    enroll: {}
+    reenroll: {}
+  configoverride:
+    peer:
+      keepalive:
+        minInterval: 61s
+  customNames:
+    pvc: {}
+  images:
+    peerInitImage: ${INIT_IMAGE}
+    peerInitTag: ${INIT_IMAGE_LABEL}
+    peerImage: ${PEER_IMAGE}
+    peerTag: ${PEER_IMAGE_LABEL}
+    grpcwebImage: ${GRPCWEB_IMAGE}
+    grpcwebTag: ${GRPCWEB_IMAGE_LABEL}
+  mspID: Org1MSP
+  mspSecret: org1-peer2-secret
+  secret:
+    enrollment:
+      component:
+        caname: ca
+        cahost: "test-network-org1-ca-ca.${INGRESS_DOMAIN}"
+        caport: "443"
+        catls:
+          cacert: "${ORG1_CA_CERT}"
+        enrollid: "peer2"
+        enrollsecret: "peer2pw"
+      tls:
+        caname: tlsca
+        cahost: "test-network-org1-ca-ca.${INGRESS_DOMAIN}"
+        caport: "443"
+        catls:
+          cacert: "${ORG1_CA_CERT}"
+        enrollid: "peer2"
+        enrollsecret: "peer2pw"
+        csr:
+          hosts:
+            - "org1-peer2"
+            - "org1-peer2.${KUBE_DNS_DOMAIN}"
+            - "test-network-org1-peer-gateway.${INGRESS_DOMAIN}"
+  chaincodeBuilderConfig:
+    peername: org1-peer2
+  service:
+    type: ClusterIP
+  stateDb: leveldb
+  storage:
+    peer:
+      class: "${STORAGE_CLASS}"
+      size: 5G
+    statedb:
+      class: "${STORAGE_CLASS}"
+      size: 10Gi
+  resources:
+    init:
+      limits:
+        cpu: 100m
+        memory: 200M
+      requests:
+        cpu: 10m
+        memory: 10M
+    peer:
+      limits:
+        cpu: 500m
+        memory: 1G
+      requests:
+        cpu: 10m
+        memory: 10M
+    proxy:
+      limits:
+        cpu: 100m
+        memory: 200M
+      requests:
+        cpu: 10m
+        memory: 10M

full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org2-peer1.yaml

@@ -0,0 +1,103 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+apiVersion: ibp.com/v1beta1
+kind: IBPPeer
+metadata:
+  name: org2-peer1
+spec:
+  version: "${FABRIC_VERSION}"
+  domain: "${INGRESS_DOMAIN}"
+  peerExternalEndpoint: "test-network-org2-peer1-peer.${INGRESS_DOMAIN}:443"
+  license:
+    accept: true
+  action:
+    enroll: {}
+    reenroll: {}
+  configoverride:
+    peer:
+      keepalive:
+        minInterval: 61s
+  customNames:
+    pvc: {}
+  images:
+    peerInitImage: ${INIT_IMAGE}
+    peerInitTag: ${INIT_IMAGE_LABEL}
+    peerImage: ${PEER_IMAGE}
+    peerTag: ${PEER_IMAGE_LABEL}
+    grpcwebImage: ${GRPCWEB_IMAGE}
+    grpcwebTag: ${GRPCWEB_IMAGE_LABEL}
+  mspID: Org2MSP
+  mspSecret: org2-peer1-secret
+  secret:
+    enrollment:
+      component:
+        caname: ca
+        cahost: "test-network-org2-ca-ca.${INGRESS_DOMAIN}"
+        caport: "443"
+        catls:
+          cacert: "${ORG2_CA_CERT}"
+        enrollid: "peer1"
+        enrollsecret: "peer1pw"
+      tls:
+        caname: tlsca
+        cahost: "test-network-org2-ca-ca.${INGRESS_DOMAIN}"
+        caport: "443"
+        catls:
+          cacert: "${ORG2_CA_CERT}"
+        enrollid: "peer1"
+        enrollsecret: "peer1pw"
+        csr:
+          hosts:
+            - "org2-peer1"
+            - "org2-peer1.${KUBE_DNS_DOMAIN}"
+            - "test-network-org2-peer-gateway.${INGRESS_DOMAIN}"
+  chaincodeBuilderConfig:
+    peername: org2-peer1
+  service:
+    type: ClusterIP
+  stateDb: leveldb
+  storage:
+    peer:
+      class: "${STORAGE_CLASS}"
+      size: 5G
+    statedb:
+      class: "${STORAGE_CLASS}"
+      size: 10Gi
+  resources:
+    init:
+      limits:
+        cpu: 100m
+        memory: 200M
+      requests:
+        cpu: 10m
+        memory: 10M
+    peer:
+      limits:
+        cpu: 500m
+        memory: 1G
+      requests:
+        cpu: 10m
+        memory: 10M
+    proxy:
+      limits:
+        cpu: 100m
+        memory: 200M
+      requests:
+        cpu: 10m
+        memory: 10M

full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org2-peer2.yaml

@@ -0,0 +1,103 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+apiVersion: ibp.com/v1beta1
+kind: IBPPeer
+metadata:
+  name: org2-peer2
+spec:
+  version: "${FABRIC_VERSION}"
+  domain: "${INGRESS_DOMAIN}"
+  peerExternalEndpoint: "test-network-org2-peer2-peer.${INGRESS_DOMAIN}:443"
+  license:
+    accept: true
+  action:
+    enroll: {}
+    reenroll: {}
+  configoverride:
+    peer:
+      keepalive:
+        minInterval: 61s
+  customNames:
+    pvc: {}
+  images:
+    peerInitImage: ${INIT_IMAGE}
+    peerInitTag: ${INIT_IMAGE_LABEL}
+    peerImage: ${PEER_IMAGE}
+    peerTag: ${PEER_IMAGE_LABEL}
+    grpcwebImage: ${GRPCWEB_IMAGE}
+    grpcwebTag: ${GRPCWEB_IMAGE_LABEL}
+  mspID: Org2MSP
+  mspSecret: org2-peer2-secret
+  secret:
+    enrollment:
+      component:
+        caname: ca
+        cahost: "test-network-org2-ca-ca.${INGRESS_DOMAIN}"
+        caport: "443"
+        catls:
+          cacert: "${ORG2_CA_CERT}"
+        enrollid: "peer2"
+        enrollsecret: "peer2pw"
+      tls:
+        caname: tlsca
+        cahost: "test-network-org2-ca-ca.${INGRESS_DOMAIN}"
+        caport: "443"
+        catls:
+          cacert: "${ORG2_CA_CERT}"
+        enrollid: "peer2"
+        enrollsecret: "peer2pw"
+        csr:
+          hosts:
+            - "org2-peer2"
+            - "org2-peer2.${KUBE_DNS_DOMAIN}"
+            - "test-network-org2-peer-gateway.${INGRESS_DOMAIN}"
+  chaincodeBuilderConfig:
+    peername: org2-peer2
+  service:
+    type: ClusterIP
+  stateDb: leveldb
+  storage:
+    peer:
+      class: "${STORAGE_CLASS}"
+      size: 5G
+    statedb:
+      class: "${STORAGE_CLASS}"
+      size: 10Gi
+  resources:
+    init:
+      limits:
+        cpu: 100m
+        memory: 200M
+      requests:
+        cpu: 10m
+        memory: 10M
+    peer:
+      limits:
+        cpu: 500m
+        memory: 1G
+      requests:
+        cpu: 10m
+        memory: 10M
+    proxy:
+      limits:
+        cpu: 100m
+        memory: 200M
+      requests:
+        cpu: 10m
+        memory: 10M

full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-clusterrole.yaml

@@ -0,0 +1,205 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: fabric-operator-role
+  labels:
+    release: "operator"
+    helm.sh/chart: "ibm-hlfsupport"
+    app.kubernetes.io/name: "ibm-hlfsupport"
+    app.kubernetes.io/instance: "ibm-hlfsupport"
+    app.kubernetes.io/managed-by: "ibm-hlfsupport-operator"
+rules:
+  - apiGroups:
+      - extensions
+    resourceNames:
+      - ibm-hlfsupport-psp
+    resources:
+      - podsecuritypolicies
+    verbs:
+      - use
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - persistentvolumeclaims
+      - persistentvolumes
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - patch
+      - watch
+      - delete
+      - deletecollection
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+  - apiGroups:
+      - route.openshift.io
+    resources:
+      - routes
+      - routes/custom-host
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - patch
+      - watch
+      - delete
+      - deletecollection
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - pods/log
+      - persistentvolumeclaims
+      - persistentvolumes
+      - services
+      - endpoints
+      - events
+      - configmaps
+      - secrets
+      - nodes
+      - serviceaccounts
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - patch
+      - watch
+      - delete
+      - deletecollection
+  - apiGroups:
+      - "batch"
+    resources:
+      - jobs
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - patch
+      - watch
+      - delete
+      - deletecollection
+  - apiGroups:
+      - "authorization.openshift.io"
+      - "rbac.authorization.k8s.io"
+    resources:
+      - roles
+      - rolebindings
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - patch
+      - watch
+      - delete
+      - deletecollection
+      - bind
+      - escalate
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - patch
+      - watch
+      - delete
+      - deletecollection
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - ibm-hlfsupport-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - ibp.com
+    resources:
+      - ibpcas.ibp.com
+      - ibppeers.ibp.com
+      - ibporderers.ibp.com
+      - ibpconsoles.ibp.com
+      - ibpcas
+      - ibppeers
+      - ibporderers
+      - ibpconsoles
+      - ibpcas/finalizers
+      - ibppeers/finalizers
+      - ibporderers/finalizers
+      - ibpconsoles/finalizers
+      - ibpcas/status
+      - ibppeers/status
+      - ibporderers/status
+      - ibpconsoles/status
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - patch
+      - watch
+      - delete
+      - deletecollection
+  - apiGroups:
+      - extensions
+      - networking.k8s.io
+      - config.openshift.io
+    resources:
+      - ingresses
+      - networkpolicies
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - patch
+      - watch
+      - delete
+      - deletecollection

full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-clusterrolebinding.yaml

@@ -0,0 +1,36 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: fabric-operator-rolebinding
+  labels:
+    release: "operator"
+    helm.sh/chart: "ibm-hlfsupport"
+    app.kubernetes.io/name: "ibm-hlfsupport"
+    app.kubernetes.io/instance: "ibm-hlfsupport"
+    app.kubernetes.io/managed-by: "ibm-hlfsupport-operator"
+subjects:
+  - kind: ServiceAccount
+    name: fabric-operator
+    namespace: "${NS}"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: fabric-operator-role

full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-psp.yaml

@@ -0,0 +1,48 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: ibm-hlfsupport-psp
+spec:
+  hostIPC: false
+  hostNetwork: false
+  hostPID: false
+  privileged: true
+  allowPrivilegeEscalation: true
+  readOnlyRootFilesystem: false
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+  runAsUser:
+    rule: RunAsAny
+  fsGroup:
+    rule: RunAsAny
+  requiredDropCapabilities:
+    - ALL
+  allowedCapabilities:
+    - NET_BIND_SERVICE
+    - CHOWN
+    - DAC_OVERRIDE
+    - SETGID
+    - SETUID
+    - FOWNER
+  volumes:
+    - '*'

full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-serviceaccount.yaml

@@ -0,0 +1,22 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fabric-operator

full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/kustomization.yaml

@@ -0,0 +1,25 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - fabric-operator-psp.yaml
+  - fabric-operator-serviceaccount.yaml
+  - fabric-operator-clusterrole.yaml
+  - fabric-operator-clusterrolebinding.yaml