From 111c75b2b2191a1956d8e8aafef245e2b6fcc2dc Mon Sep 17 00:00:00 2001 From: Josh Kneubuhl Date: Wed, 9 Nov 2022 16:01:24 -0500 Subject: [PATCH] missed a .git ignored directory on add Signed-off-by: Josh Kneubuhl --- .gitignore | 3 + .../config/cas/kustomization.yaml | 25 + .../sample-network/config/cas/org0-ca.yaml | 135 +++ .../sample-network/config/cas/org1-ca.yaml | 128 +++ .../sample-network/config/cas/org2-ca.yaml | 130 +++ .../config/configtx-template.yaml | 428 ++++++++++ .../console/hlf-operations-console.yaml | 80 ++ .../config/console/kustomization.yaml | 5 + .../sample-network/config/core.yaml | 775 ++++++++++++++++++ .../config/gateway/kustomization.yaml | 24 + .../config/gateway/org1-peer-gateway.yaml | 76 ++ .../config/gateway/org2-peer-gateway.yaml | 76 ++ .../manager/fabric-operator-manager.yaml | 123 +++ .../config/manager/kustomization.yaml | 22 + .../config/orderers/kustomization.yaml | 24 + .../config/orderers/org0-orderers.yaml | 151 ++++ .../config/peers/kustomization.yaml | 27 + .../config/peers/org1-peer1.yaml | 103 +++ .../config/peers/org1-peer2.yaml | 103 +++ .../config/peers/org2-peer1.yaml | 103 +++ .../config/peers/org2-peer2.yaml | 103 +++ .../rbac/fabric-operator-clusterrole.yaml | 205 +++++ .../fabric-operator-clusterrolebinding.yaml | 36 + .../config/rbac/fabric-operator-psp.yaml | 48 ++ .../rbac/fabric-operator-serviceaccount.yaml | 22 + .../config/rbac/kustomization.yaml | 25 + 26 files changed, 2980 insertions(+) create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/kustomization.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/org0-ca.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/org1-ca.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/org2-ca.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/configtx-template.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/console/hlf-operations-console.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/console/kustomization.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/core.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/gateway/kustomization.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/gateway/org1-peer-gateway.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/gateway/org2-peer-gateway.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/manager/fabric-operator-manager.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/manager/kustomization.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/orderers/kustomization.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/orderers/org0-orderers.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/kustomization.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org1-peer1.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org1-peer2.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org2-peer1.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org2-peer2.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-clusterrole.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-clusterrolebinding.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-psp.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-serviceaccount.yaml create mode 100644 full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/kustomization.yaml diff --git a/.gitignore b/.gitignore index f5102b7d..3fbf0f49 100644 --- a/.gitignore +++ b/.gitignore @@ -27,3 +27,6 @@ builders/ config/ external-chaincode/ install-fabric.sh + +# override the ignore of all config/ folders +!full-stack-asset-transfer-guide/infrastructure/sample-network/config \ No newline at end of file diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/kustomization.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/kustomization.yaml new file mode 100644 index 00000000..0d354cf4 --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/kustomization.yaml @@ -0,0 +1,25 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - org0-ca.yaml + - org1-ca.yaml + - org2-ca.yaml diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/org0-ca.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/org0-ca.yaml new file mode 100644 index 00000000..61d0f69d --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/org0-ca.yaml @@ -0,0 +1,135 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +apiVersion: ibp.com/v1beta1 +kind: IBPCA +metadata: + name: org0-ca +spec: + action: + renew: {} + configoverride: + ca: + affiliations: + org1: + - department1 + - department2 + org2: + - department1 + registry: + identities: + - name: rcaadmin + pass: rcaadminpw + type: client + attrs: + hf.Registrar.Roles: "*" + hf.Registrar.DelegateRoles: "*" + hf.Revoker: true + hf.IntermediateCA: true + hf.GenCRL: true + hf.Registrar.Attributes: "*" + hf.AffiliationMgr: true + - name: orderer1 + pass: orderer1pw + type: orderer + - name: orderer2 + pass: orderer2pw + type: orderer + - name: orderer3 + pass: orderer3pw + type: orderer + - name: org0admin + pass: org0adminpw + type: admin + debug: true + signing: + default: + expiry: 87600h0m0s + tlsca: + affiliations: + org1: + - department1 + - department2 + org0: + - department1 + registry: + identities: + - name: admin + pass: adminpw + type: client # todo: shouldn't this be an admin? + attrs: + hf.Registrar.Roles: "*" + hf.Registrar.DelegateRoles: "*" + hf.Revoker: true + hf.IntermediateCA: true + hf.GenCRL: true + hf.Registrar.Attributes: "*" + hf.AffiliationMgr: true + - name: orderer1 + pass: orderer1pw + type: orderer + - name: orderer2 + pass: orderer2pw + type: orderer + - name: orderer3 + pass: orderer3pw + type: orderer + - name: org0admin + pass: org0adminpw + type: admin + + debug: true + signing: + default: + expiry: 87600h0m0s + customNames: + pvc: {} + domain: "${INGRESS_DOMAIN}" + images: + caImage: ${CA_IMAGE} + caTag: ${CA_IMAGE_LABEL} + caInitImage: ${INIT_IMAGE} + caInitTag: ${INIT_IMAGE_LABEL} + ingress: + class: "" + tlsSecretName: "" + license: + accept: true + replicas: 1 + resources: + ca: + limits: + cpu: 100m + memory: 200M + requests: + cpu: 10m + memory: 10M + init: + limits: + cpu: 100m + memory: 200M + requests: + cpu: 10m + memory: 10M + service: + type: ClusterIP + storage: + ca: + class: "${STORAGE_CLASS}" + size: 100M + version: ${FABRIC_CA_VERSION} diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/org1-ca.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/org1-ca.yaml new file mode 100644 index 00000000..0681b22f --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/org1-ca.yaml @@ -0,0 +1,128 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +apiVersion: ibp.com/v1beta1 +kind: IBPCA +metadata: + name: org1-ca +spec: + action: + renew: {} + configoverride: + ca: + affiliations: + org1: + - department1 + - department2 + org2: + - department1 + registry: + identities: + - name: rcaadmin + pass: rcaadminpw + type: client + attrs: + hf.Registrar.Roles: "*" + hf.Registrar.DelegateRoles: "*" + hf.Revoker: true + hf.IntermediateCA: true + hf.GenCRL: true + hf.Registrar.Attributes: "*" + hf.AffiliationMgr: true + - name: peer1 + pass: peer1pw + type: peer + - name: peer2 + pass: peer2pw + type: peer + - name: org1admin + pass: org1adminpw + type: admin + debug: true + signing: + default: + expiry: 87600h0m0s + tlsca: + affiliations: + org1: + - department1 + - department2 + org2: + - department1 + registry: + identities: + - name: admin + pass: adminpw + type: client # todo: shouldn't this be an admin? + attrs: + hf.Registrar.Roles: "*" + hf.Registrar.DelegateRoles: "*" + hf.Revoker: true + hf.IntermediateCA: true + hf.GenCRL: true + hf.Registrar.Attributes: "*" + hf.AffiliationMgr: true + - name: peer1 + pass: peer1pw + type: peer + - name: peer2 + pass: peer2pw + type: peer + - name: org1admin + pass: org1adminpw + type: admin + debug: true + signing: + default: + expiry: 87600h0m0s + customNames: + pvc: {} + domain: "${INGRESS_DOMAIN}" + images: + caImage: ${CA_IMAGE} + caTag: ${CA_IMAGE_LABEL} + caInitImage: ${INIT_IMAGE} + caInitTag: ${INIT_IMAGE_LABEL} + ingress: + class: "" + tlsSecretName: "" + license: + accept: true + replicas: 1 + resources: + ca: + limits: + cpu: 100m + memory: 200M + requests: + cpu: 10m + memory: 10M + init: + limits: + cpu: 100m + memory: 200M + requests: + cpu: 10m + memory: 10M + service: + type: ClusterIP + storage: + ca: + class: "${STORAGE_CLASS}" + size: 100M + version: ${FABRIC_CA_VERSION} diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/org2-ca.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/org2-ca.yaml new file mode 100644 index 00000000..f0a6ed4d --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/cas/org2-ca.yaml @@ -0,0 +1,130 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +apiVersion: ibp.com/v1beta1 +kind: IBPCA +metadata: + name: org2-ca +spec: + action: + renew: {} + configoverride: + ca: + affiliations: + org1: + - department1 + - department2 + org2: + - department1 + registry: + identities: + - name: rcaadmin + pass: rcaadminpw + type: client + attrs: + hf.Registrar.Roles: "*" + hf.Registrar.DelegateRoles: "*" + hf.Revoker: true + hf.IntermediateCA: true + hf.GenCRL: true + hf.Registrar.Attributes: "*" + hf.AffiliationMgr: true + - name: peer1 + pass: peer1pw + type: peer + - name: peer2 + pass: peer2pw + type: peer + - name: org2admin + pass: org2adminpw + type: admin + debug: true + signing: + default: + expiry: 87600h0m0s + tlsca: + affiliations: + org1: + - department1 + - department2 + org2: + - department1 + registry: + identities: + - name: admin + pass: adminpw + type: client # todo: shouldn't this be an admin? + attrs: + hf.Registrar.Roles: "*" + hf.Registrar.DelegateRoles: "*" + hf.Revoker: true + hf.IntermediateCA: true + hf.GenCRL: true + hf.Registrar.Attributes: "*" + hf.AffiliationMgr: true + - name: peer1 + pass: peer1pw + type: peer + - name: peer2 + pass: peer2pw + type: peer + - name: org2admin + pass: org2adminpw + type: admin + debug: true + signing: + default: + expiry: 87600h0m0s + customNames: + pvc: {} + domain: "${INGRESS_DOMAIN}" + # imagePullSecrets: + # - regcred + images: + caImage: ${CA_IMAGE} + caTag: ${CA_IMAGE_LABEL} + caInitImage: ${INIT_IMAGE} + caInitTag: ${INIT_IMAGE_LABEL} + ingress: + class: "" + tlsSecretName: "" + license: + accept: true + replicas: 1 + resources: + ca: + limits: + cpu: 100m + memory: 200M + requests: + cpu: 10m + memory: 10M + init: + limits: + cpu: 100m + memory: 200M + requests: + cpu: 10m + memory: 10M + service: + type: ClusterIP + storage: + ca: + class: "${STORAGE_CLASS}" + size: 100M + version: ${FABRIC_CA_VERSION} diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/configtx-template.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/configtx-template.yaml new file mode 100644 index 00000000..ccdcd937 --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/configtx-template.yaml @@ -0,0 +1,428 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +--- +################################################################################ +# +# Section: Organizations +# +# - This section defines the different organizational identities which will +# be referenced later in the configuration. +# +################################################################################ +Organizations: + + # SampleOrg defines an MSP using the sampleconfig. It should never be used + # in production but may be used as a template for other definitions + - &OrdererOrg + # DefaultOrg defines the organization which is used in the sampleconfig + # of the fabric.git development environment + Name: OrdererOrg + + # ID to load the MSP definition as + ID: OrdererMSP + + # MSPDir is the filesystem path which contains the MSP configuration + MSPDir: ../../temp/channel-msp/ordererOrganizations/org0/msp + + # Policies defines the set of policies at this level of the config tree + # For organization policies, their canonical path is usually + # /Channel/// + Policies: + Readers: + Type: Signature + Rule: "OR('OrdererMSP.member')" + Writers: + Type: Signature + Rule: "OR('OrdererMSP.member')" + Admins: + Type: Signature + Rule: "OR('OrdererMSP.admin')" + + OrdererEndpoints: + - org0-orderersnode1.${KUBE_DNS_DOMAIN}:7050 + - org0-orderersnode2.${KUBE_DNS_DOMAIN}:7050 + - org0-orderersnode3.${KUBE_DNS_DOMAIN}:7050 + + - &Org1 + # DefaultOrg defines the organization which is used in the sampleconfig + # of the fabric.git development environment + Name: Org1MSP + + # ID to load the MSP definition as + ID: Org1MSP + + MSPDir: ../../temp/channel-msp/peerOrganizations/org1/msp + + # Policies defines the set of policies at this level of the config tree + # For organization policies, their canonical path is usually + # /Channel/// + Policies: + Readers: + Type: Signature + Rule: "OR('Org1MSP.admin', 'Org1MSP.peer', 'Org1MSP.client')" + Writers: + Type: Signature + Rule: "OR('Org1MSP.admin', 'Org1MSP.client')" + Admins: + Type: Signature + Rule: "OR('Org1MSP.admin')" + Endorsement: + Type: Signature + Rule: "OR('Org1MSP.peer')" + + # leave this flag set to true. + AnchorPeers: + # AnchorPeers defines the location of peers which can be used + # for cross org gossip communication. Note, this value is only + # encoded in the genesis block in the Application section context + - Host: org1-peer1.${KUBE_DNS_DOMAIN} + Port: 7051 + + - &Org2 + # DefaultOrg defines the organization which is used in the sampleconfig + # of the fabric.git development environment + Name: Org2MSP + + # ID to load the MSP definition as + ID: Org2MSP + + MSPDir: ../../temp/channel-msp/peerOrganizations/org2/msp + + # Policies defines the set of policies at this level of the config tree + # For organization policies, their canonical path is usually + # /Channel/// + Policies: + Readers: + Type: Signature + Rule: "OR('Org2MSP.admin', 'Org2MSP.peer', 'Org2MSP.client')" + Writers: + Type: Signature + Rule: "OR('Org2MSP.admin', 'Org2MSP.client')" + Admins: + Type: Signature + Rule: "OR('Org2MSP.admin')" + Endorsement: + Type: Signature + Rule: "OR('Org2MSP.peer')" + + AnchorPeers: + # AnchorPeers defines the location of peers which can be used + # for cross org gossip communication. Note, this value is only + # encoded in the genesis block in the Application section context + - Host: org2-peer1.${KUBE_DNS_DOMAIN} + Port: 7051 + +################################################################################ +# +# SECTION: Capabilities +# +# - This section defines the capabilities of fabric network. This is a new +# concept as of v1.1.0 and should not be utilized in mixed networks with +# v1.0.x peers and orderers. Capabilities define features which must be +# present in a fabric binary for that binary to safely participate in the +# fabric network. For instance, if a new MSP type is added, newer binaries +# might recognize and validate the signatures from this type, while older +# binaries without this support would be unable to validate those +# transactions. This could lead to different versions of the fabric binaries +# having different world states. Instead, defining a capability for a channel +# informs those binaries without this capability that they must cease +# processing transactions until they have been upgraded. For v1.0.x if any +# capabilities are defined (including a map with all capabilities turned off) +# then the v1.0.x peer will deliberately crash. +# +################################################################################ +Capabilities: + # Channel capabilities apply to both the orderers and the peers and must be + # supported by both. + # Set the value of the capability to true to require it. + Channel: &ChannelCapabilities + # V2_0 capability ensures that orderers and peers behave according + # to v2.0 channel capabilities. Orderers and peers from + # prior releases would behave in an incompatible way, and are therefore + # not able to participate in channels at v2.0 capability. + # Prior to enabling V2.0 channel capabilities, ensure that all + # orderers and peers on a channel are at v2.0.0 or later. + V2_0: true + + # Orderer capabilities apply only to the orderers, and may be safely + # used with prior release peers. + # Set the value of the capability to true to require it. + Orderer: &OrdererCapabilities + # V2_0 orderer capability ensures that orderers behave according + # to v2.0 orderer capabilities. Orderers from + # prior releases would behave in an incompatible way, and are therefore + # not able to participate in channels at v2.0 orderer capability. + # Prior to enabling V2.0 orderer capabilities, ensure that all + # orderers on channel are at v2.0.0 or later. + V2_0: true + + # Application capabilities apply only to the peer network, and may be safely + # used with prior release orderers. + # Set the value of the capability to true to require it. + Application: &ApplicationCapabilities + # V2_0 application capability ensures that peers behave according + # to v2.0 application capabilities. Peers from + # prior releases would behave in an incompatible way, and are therefore + # not able to participate in channels at v2.0 application capability. + # Prior to enabling V2.0 application capabilities, ensure that all + # peers on channel are at v2.0.0 or later. + V2_0: true + +################################################################################ +# +# SECTION: Application +# +# - This section defines the values to encode into a config transaction or +# genesis block for application related parameters +# +################################################################################ +Application: &ApplicationDefaults + + # Organizations is the list of orgs which are defined as participants on + # the application side of the network + Organizations: + + # Policies defines the set of policies at this level of the config tree + # For Application policies, their canonical path is + # /Channel/Application/ + Policies: + Readers: + Type: ImplicitMeta + Rule: "ANY Readers" + Writers: + Type: ImplicitMeta + Rule: "ANY Writers" + Admins: + Type: ImplicitMeta + Rule: "MAJORITY Admins" + LifecycleEndorsement: + Type: Signature + Rule: "OR('Org1MSP.peer','Org2MSP.peer')" + Endorsement: + Type: Signature + Rule: "OR('Org1MSP.peer','Org2MSP.peer')" + + Capabilities: + <<: *ApplicationCapabilities +################################################################################ +# +# SECTION: Orderer +# +# - This section defines the values to encode into a config transaction or +# genesis block for orderer related parameters +# +################################################################################ +Orderer: &OrdererDefaults + + # Orderer Type: The orderer implementation to start + OrdererType: etcdraft + + EtcdRaft: + Consenters: + - Host: org0-orderersnode1.${KUBE_DNS_DOMAIN} + Port: 7050 + ClientTLSCert: ../../temp/channel-msp/ordererOrganizations/org0/orderers/org0-orderersnode1/tls/signcerts/tls-cert.pem + ServerTLSCert: ../../temp/channel-msp/ordererOrganizations/org0/orderers/org0-orderersnode1/tls/signcerts/tls-cert.pem + - Host: org0-orderersnode2.${KUBE_DNS_DOMAIN} + Port: 7050 + ClientTLSCert: ../../temp/channel-msp/ordererOrganizations/org0/orderers/org0-orderersnode2/tls/signcerts/tls-cert.pem + ServerTLSCert: ../../temp/channel-msp/ordererOrganizations/org0/orderers/org0-orderersnode2/tls/signcerts/tls-cert.pem + - Host: org0-orderersnode3.${KUBE_DNS_DOMAIN} + Port: 7050 + ClientTLSCert: ../../temp/channel-msp/ordererOrganizations/org0/orderers/org0-orderersnode3/tls/signcerts/tls-cert.pem + ServerTLSCert: ../../temp/channel-msp/ordererOrganizations/org0/orderers/org0-orderersnode3/tls/signcerts/tls-cert.pem + + + # Options to be specified for all the etcd/raft nodes. The values here + # are the defaults for all new channels and can be modified on a + # per-channel basis via configuration updates. + Options: + # TickInterval is the time interval between two Node.Tick invocations. + #TickInterval: 500ms default + TickInterval: 2500ms + + # ElectionTick is the number of Node.Tick invocations that must pass + # between elections. That is, if a follower does not receive any + # message from the leader of current term before ElectionTick has + # elapsed, it will become candidate and start an election. + # ElectionTick must be greater than HeartbeatTick. + # ElectionTick: 10 default + ElectionTick: 5 + + # HeartbeatTick is the number of Node.Tick invocations that must + # pass between heartbeats. That is, a leader sends heartbeat + # messages to maintain its leadership every HeartbeatTick ticks. + HeartbeatTick: 1 + + # MaxInflightBlocks limits the max number of in-flight append messages + # during optimistic replication phase. + MaxInflightBlocks: 5 + + # SnapshotIntervalSize defines number of bytes per which a snapshot is taken + SnapshotIntervalSize: 16 MB + + # Batch Timeout: The amount of time to wait before creating a batch + BatchTimeout: 2s + + # Batch Size: Controls the number of messages batched into a block + BatchSize: + + # Max Message Count: The maximum number of messages to permit in a batch + MaxMessageCount: 10 + + # Absolute Max Bytes: The absolute maximum number of bytes allowed for + # the serialized messages in a batch. + AbsoluteMaxBytes: 99 MB + + # Preferred Max Bytes: The preferred maximum number of bytes allowed for + # the serialized messages in a batch. A message larger than the preferred + # max bytes will result in a batch larger than preferred max bytes. + PreferredMaxBytes: 512 KB + + # Organizations is the list of orgs which are defined as participants on + # the orderer side of the network + Organizations: + + # Policies defines the set of policies at this level of the config tree + # For Orderer policies, their canonical path is + # /Channel/Orderer/ + Policies: + Readers: + Type: ImplicitMeta + Rule: "ANY Readers" + Writers: + Type: ImplicitMeta + Rule: "ANY Writers" + Admins: + Type: ImplicitMeta + Rule: "MAJORITY Admins" + # BlockValidation specifies what signatures must be included in the block + # from the orderer for the peer to validate it. + BlockValidation: + Type: ImplicitMeta + Rule: "ANY Writers" + +################################################################################ +# +# CHANNEL +# +# This section defines the values to encode into a config transaction or +# genesis block for channel related parameters. +# +################################################################################ +Channel: &ChannelDefaults + # Policies defines the set of policies at this level of the config tree + # For Channel policies, their canonical path is + # /Channel/ + Policies: + # Who may invoke the 'Deliver' API + Readers: + Type: ImplicitMeta + Rule: "ANY Readers" + # Who may invoke the 'Broadcast' API + Writers: + Type: ImplicitMeta + Rule: "ANY Writers" + # By default, who may modify elements at this config level + Admins: + Type: ImplicitMeta + Rule: "MAJORITY Admins" + + # Capabilities describes the channel level capabilities, see the + # dedicated Capabilities section elsewhere in this file for a full + # description + Capabilities: + <<: *ChannelCapabilities + +################################################################################ +# +# Profile +# +# - Different configuration profiles may be encoded here to be specified +# as parameters to the configtxgen tool +# +################################################################################ +Profiles: + + # test network profile with application (not system) channel. + TwoOrgsApplicationGenesis: + <<: *ChannelDefaults + Orderer: + <<: *OrdererDefaults + Organizations: + - *OrdererOrg + Capabilities: *OrdererCapabilities + Application: + <<: *ApplicationDefaults + Organizations: + - *Org1 + - *Org2 + Capabilities: *ApplicationCapabilities + + + # + # Unclear lineage for these profiles: nano-fab? + # + # TwoOrgsOrdererGenesis will construct a system channel as it has a Consortiums stanza, which is not + # compatible with osnadmin. + # + # @enyeart - which profile should be used for the kube test network? + # + TwoOrgsOrdererGenesis: + <<: *ChannelDefaults + Orderer: + <<: *OrdererDefaults + OrdererType: etcdraft + Organizations: + - *OrdererOrg + Capabilities: + <<: *OrdererCapabilities + Consortiums: + SampleConsortium: + Organizations: + - *Org1 + - *Org2 + TwoOrgsChannel: + Consortium: SampleConsortium + <<: *ChannelDefaults + Application: + <<: *ApplicationDefaults + Organizations: + - *Org1 + - *Org2 + Capabilities: + <<: *ApplicationCapabilities + Org1Channel: + Consortium: SampleConsortium + <<: *ChannelDefaults + Application: + <<: *ApplicationDefaults + Organizations: + - *Org1 + Capabilities: + <<: *ApplicationCapabilities + Org2Channel: + Consortium: SampleConsortium + <<: *ChannelDefaults + Application: + <<: *ApplicationDefaults + Organizations: + - *Org2 + Capabilities: + <<: *ApplicationCapabilities diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/console/hlf-operations-console.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/console/hlf-operations-console.yaml new file mode 100644 index 00000000..e43cb710 --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/console/hlf-operations-console.yaml @@ -0,0 +1,80 @@ +--- +apiVersion: ibp.com/v1beta1 +kind: IBPConsole +metadata: + name: hlf-console +spec: + arch: + - amd64 + license: + accept: true + serviceAccountName: default + email: "${CONSOLE_USERNAME}" + password: "${CONSOLE_PASSWORD}" + allowDefaultPassword: true + # registryURL: ghcr.io/ibm-blockchain + imagePullSecrets: + - ghcr-pull-secret + images: + consoleInitImage: ${INIT_IMAGE} + consoleInitTag: ${INIT_IMAGE_LABEL} + consoleImage: ${CONSOLE_IMAGE} + consoleTag: ${CONSOLE_IMAGE_LABEL} + deployerImage: ${DEPLOYER_IMAGE} + deployerTag: ${DEPLOYER_IMAGE_LABEL} + configtxlatorImage: ${TOOLS_IMAGE} + configtxlatorTag: ${TOOLS_IMAGE_LABEL} + couchdbImage: ${COUCHDB_IMAGE} + couchdbTag: ${COUCHDB_IMAGE_LABEL} + networkinfo: + domain: "${CONSOLE_DOMAIN}" + storage: + console: + class: "${STORAGE_CLASS}" + size: 5Gi + usetags: true + version: 1.0.0 + resources: + init: + limits: + cpu: 100m + memory: 200M + requests: + cpu: 10m + memory: 20M + configtxlator: + limits: + cpu: 25m + ephemeral-storage: 1G + memory: 50Mi + requests: + cpu: 25m + ephemeral-storage: 100M + memory: 50Mi + couchdb: + limits: + cpu: 500m + ephemeral-storage: 1Gi + memory: 1000Mi + requests: + cpu: 50m + ephemeral-storage: 100Mi + memory: 128Mi + deployer: + limits: + cpu: 100m + ephemeral-storage: 1G + memory: 200Mi + requests: + cpu: 100m + ephemeral-storage: 100M + memory: 128Mi + console: + limits: + cpu: 500m + ephemeral-storage: 1G + memory: 1000Mi + requests: + cpu: 50m + ephemeral-storage: 100M + memory: 128Mi \ No newline at end of file diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/console/kustomization.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/console/kustomization.yaml new file mode 100644 index 00000000..1f7ec5bd --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/console/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - hlf-operations-console.yaml diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/core.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/core.yaml new file mode 100644 index 00000000..fa5eeeb3 --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/core.yaml @@ -0,0 +1,775 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +############################################################################### +# +# Peer section +# +############################################################################### +peer: + + # The peer id provides a name for this peer instance and is used when + # naming docker resources. + id: jdoe + + # The networkId allows for logical separation of networks and is used when + # naming docker resources. + networkId: dev + + # The Address at local network interface this Peer will listen on. + # By default, it will listen on all network interfaces + listenAddress: 0.0.0.0:7051 + + # The endpoint this peer uses to listen for inbound chaincode connections. + # If this is commented-out, the listen address is selected to be + # the peer's address (see below) with port 7052 + # chaincodeListenAddress: 0.0.0.0:7052 + + # The endpoint the chaincode for this peer uses to connect to the peer. + # If this is not specified, the chaincodeListenAddress address is selected. + # And if chaincodeListenAddress is not specified, address is selected from + # peer address (see below). If specified peer address is invalid then it + # will fallback to the auto detected IP (local IP) regardless of the peer + # addressAutoDetect value. + # chaincodeAddress: 0.0.0.0:7052 + + # When used as peer config, this represents the endpoint to other peers + # in the same organization. For peers in other organization, see + # gossip.externalEndpoint for more info. + # When used as CLI config, this means the peer's endpoint to interact with + address: 0.0.0.0:7051 + + # Whether the Peer should programmatically determine its address + # This case is useful for docker containers. + # When set to true, will override peer address. + addressAutoDetect: false + + # Keepalive settings for peer server and clients + keepalive: + # Interval is the duration after which if the server does not see + # any activity from the client it pings the client to see if it's alive + interval: 7200s + # Timeout is the duration the server waits for a response + # from the client after sending a ping before closing the connection + timeout: 20s + # MinInterval is the minimum permitted time between client pings. + # If clients send pings more frequently, the peer server will + # disconnect them + minInterval: 60s + # Client keepalive settings for communicating with other peer nodes + client: + # Interval is the time between pings to peer nodes. This must + # greater than or equal to the minInterval specified by peer + # nodes + interval: 60s + # Timeout is the duration the client waits for a response from + # peer nodes before closing the connection + timeout: 20s + # DeliveryClient keepalive settings for communication with ordering + # nodes. + deliveryClient: + # Interval is the time between pings to ordering nodes. This must + # greater than or equal to the minInterval specified by ordering + # nodes. + interval: 60s + # Timeout is the duration the client waits for a response from + # ordering nodes before closing the connection + timeout: 20s + + + # Gossip related configuration + gossip: + # Bootstrap set to initialize gossip with. + # This is a list of other peers that this peer reaches out to at startup. + # Important: The endpoints here have to be endpoints of peers in the same + # organization, because the peer would refuse connecting to these endpoints + # unless they are in the same organization as the peer. + bootstrap: 127.0.0.1:7051 + + # NOTE: orgLeader and useLeaderElection parameters are mutual exclusive. + # Setting both to true would result in the termination of the peer + # since this is undefined state. If the peers are configured with + # useLeaderElection=false, make sure there is at least 1 peer in the + # organization that its orgLeader is set to true. + + # Defines whenever peer will initialize dynamic algorithm for + # "leader" selection, where leader is the peer to establish + # connection with ordering service and use delivery protocol + # to pull ledger blocks from ordering service. + useLeaderElection: false + # Statically defines peer to be an organization "leader", + # where this means that current peer will maintain connection + # with ordering service and disseminate block across peers in + # its own organization. Multiple peers or all peers in an organization + # may be configured as org leaders, so that they all pull + # blocks directly from ordering service. + orgLeader: true + + # Interval for membershipTracker polling + membershipTrackerInterval: 5s + + # Overrides the endpoint that the peer publishes to peers + # in its organization. For peers in foreign organizations + # see 'externalEndpoint' + endpoint: + # Maximum count of blocks stored in memory + maxBlockCountToStore: 10 + # Max time between consecutive message pushes(unit: millisecond) + maxPropagationBurstLatency: 10ms + # Max number of messages stored until a push is triggered to remote peers + maxPropagationBurstSize: 10 + # Number of times a message is pushed to remote peers + propagateIterations: 1 + # Number of peers selected to push messages to + propagatePeerNum: 3 + # Determines frequency of pull phases(unit: second) + # Must be greater than digestWaitTime + responseWaitTime + pullInterval: 4s + # Number of peers to pull from + pullPeerNum: 3 + # Determines frequency of pulling state info messages from peers(unit: second) + requestStateInfoInterval: 4s + # Determines frequency of pushing state info messages to peers(unit: second) + publishStateInfoInterval: 4s + # Maximum time a stateInfo message is kept until expired + stateInfoRetentionInterval: + # Time from startup certificates are included in Alive messages(unit: second) + publishCertPeriod: 10s + # Should we skip verifying block messages or not (currently not in use) + skipBlockVerification: false + # Dial timeout(unit: second) + dialTimeout: 3s + # Connection timeout(unit: second) + connTimeout: 2s + # Buffer size of received messages + recvBuffSize: 20 + # Buffer size of sending messages + sendBuffSize: 200 + # Time to wait before pull engine processes incoming digests (unit: second) + # Should be slightly smaller than requestWaitTime + digestWaitTime: 1s + # Time to wait before pull engine removes incoming nonce (unit: milliseconds) + # Should be slightly bigger than digestWaitTime + requestWaitTime: 1500ms + # Time to wait before pull engine ends pull (unit: second) + responseWaitTime: 2s + # Alive check interval(unit: second) + aliveTimeInterval: 5s + # Alive expiration timeout(unit: second) + aliveExpirationTimeout: 25s + # Reconnect interval(unit: second) + reconnectInterval: 25s + # Max number of attempts to connect to a peer + maxConnectionAttempts: 120 + # Message expiration factor for alive messages + msgExpirationFactor: 20 + # This is an endpoint that is published to peers outside of the organization. + # If this isn't set, the peer will not be known to other organizations. + externalEndpoint: + # Leader election service configuration + election: + # Longest time peer waits for stable membership during leader election startup (unit: second) + startupGracePeriod: 15s + # Interval gossip membership samples to check its stability (unit: second) + membershipSampleInterval: 1s + # Time passes since last declaration message before peer decides to perform leader election (unit: second) + leaderAliveThreshold: 10s + # Time between peer sends propose message and declares itself as a leader (sends declaration message) (unit: second) + leaderElectionDuration: 5s + + pvtData: + # pullRetryThreshold determines the maximum duration of time private data corresponding for a given block + # would be attempted to be pulled from peers until the block would be committed without the private data + pullRetryThreshold: 60s + # As private data enters the transient store, it is associated with the peer's ledger's height at that time. + # transientstoreMaxBlockRetention defines the maximum difference between the current ledger's height upon commit, + # and the private data residing inside the transient store that is guaranteed not to be purged. + # Private data is purged from the transient store when blocks with sequences that are multiples + # of transientstoreMaxBlockRetention are committed. + transientstoreMaxBlockRetention: 1000 + # pushAckTimeout is the maximum time to wait for an acknowledgement from each peer + # at private data push at endorsement time. + pushAckTimeout: 3s + # Block to live pulling margin, used as a buffer + # to prevent peer from trying to pull private data + # from peers that is soon to be purged in next N blocks. + # This helps a newly joined peer catch up to current + # blockchain height quicker. + btlPullMargin: 10 + # the process of reconciliation is done in an endless loop, while in each iteration reconciler tries to + # pull from the other peers the most recent missing blocks with a maximum batch size limitation. + # reconcileBatchSize determines the maximum batch size of missing private data that will be reconciled in a + # single iteration. + reconcileBatchSize: 10 + # reconcileSleepInterval determines the time reconciler sleeps from end of an iteration until the beginning + # of the next reconciliation iteration. + reconcileSleepInterval: 1m + # reconciliationEnabled is a flag that indicates whether private data reconciliation is enable or not. + reconciliationEnabled: true + # skipPullingInvalidTransactionsDuringCommit is a flag that indicates whether pulling of invalid + # transaction's private data from other peers need to be skipped during the commit time and pulled + # only through reconciler. + skipPullingInvalidTransactionsDuringCommit: false + # implicitCollectionDisseminationPolicy specifies the dissemination policy for the peer's own implicit collection. + # When a peer endorses a proposal that writes to its own implicit collection, below values override the default values + # for disseminating private data. + # Note that it is applicable to all channels the peer has joined. The implication is that requiredPeerCount has to + # be smaller than the number of peers in a channel that has the lowest numbers of peers from the organization. + implicitCollectionDisseminationPolicy: + # requiredPeerCount defines the minimum number of eligible peers to which the peer must successfully + # disseminate private data for its own implicit collection during endorsement. Default value is 0. + requiredPeerCount: 0 + # maxPeerCount defines the maximum number of eligible peers to which the peer will attempt to + # disseminate private data for its own implicit collection during endorsement. Default value is 1. + maxPeerCount: 1 + + # Gossip state transfer related configuration + state: + # indicates whenever state transfer is enabled or not + # default value is true, i.e. state transfer is active + # and takes care to sync up missing blocks allowing + # lagging peer to catch up to speed with rest network. + # Keep in mind that when peer.gossip.useLeaderElection is true + # and there are several peers in the organization, + # or peer.gossip.useLeaderElection is false alongside with + # peer.gossip.orgleader being false, the peer's ledger may lag behind + # the rest of the peers and will never catch up due to state transfer + # being disabled. + enabled: false + # checkInterval interval to check whether peer is lagging behind enough to + # request blocks via state transfer from another peer. + checkInterval: 10s + # responseTimeout amount of time to wait for state transfer response from + # other peers + responseTimeout: 3s + # batchSize the number of blocks to request via state transfer from another peer + batchSize: 10 + # blockBufferSize reflects the size of the re-ordering buffer + # which captures blocks and takes care to deliver them in order + # down to the ledger layer. The actual buffer size is bounded between + # 0 and 2*blockBufferSize, each channel maintains its own buffer + blockBufferSize: 20 + # maxRetries maximum number of re-tries to ask + # for single state transfer request + maxRetries: 3 + + # TLS Settings + tls: + # Require server-side TLS + enabled: true + # Require client certificates / mutual TLS for inbound connections. + # Note that clients that are not configured to use a certificate will + # fail to connect to the peer. + clientAuthRequired: false + # X.509 certificate used for TLS server + cert: + file: tls/server.crt + # Private key used for TLS server + key: + file: tls/server.key + # rootcert.file represents the trusted root certificate chain used for verifying certificates + # of other nodes during outbound connections. + # It is not required to be set, but can be used to augment the set of TLS CA certificates + # available from the MSPs of each channel’s configuration. + rootcert: + file: tls/ca.crt + # If mutual TLS is enabled, clientRootCAs.files contains a list of additional root certificates + # used for verifying certificates of client connections. + # It augments the set of TLS CA certificates available from the MSPs of each channel’s configuration. + # Minimally, set your organization's TLS CA root certificate so that the peer can receive join channel requests. + clientRootCAs: + files: + - tls/ca.crt + # Private key used for TLS when making client connections. + # If not set, peer.tls.key.file will be used instead + clientKey: + file: + # X.509 certificate used for TLS when making client connections. + # If not set, peer.tls.cert.file will be used instead + clientCert: + file: + + # Authentication contains configuration parameters related to authenticating + # client messages + authentication: + # the acceptable difference between the current server time and the + # client's time as specified in a client request message + timewindow: 15m + + # Path on the file system where peer will store data (eg ledger). This + # location must be access control protected to prevent unintended + # modification that might corrupt the peer operations. + fileSystemPath: /var/hyperledger/production + + # BCCSP (Blockchain crypto provider): Select which crypto implementation or + # library to use + BCCSP: + Default: SW + # Settings for the SW crypto provider (i.e. when DEFAULT: SW) + SW: + # TODO: The default Hash and Security level needs refactoring to be + # fully configurable. Changing these defaults requires coordination + # SHA2 is hardcoded in several places, not only BCCSP + Hash: SHA2 + Security: 256 + # Location of Key Store + FileKeyStore: + # If "", defaults to 'mspConfigPath'/keystore + KeyStore: + # Settings for the PKCS#11 crypto provider (i.e. when DEFAULT: PKCS11) + PKCS11: + # Location of the PKCS11 module library + Library: + # Token Label + Label: + # User PIN + Pin: + Hash: + Security: + + # Path on the file system where peer will find MSP local configurations + mspConfigPath: msp + + # Identifier of the local MSP + # ----!!!!IMPORTANT!!!-!!!IMPORTANT!!!-!!!IMPORTANT!!!!---- + # Deployers need to change the value of the localMspId string. + # In particular, the name of the local MSP ID of a peer needs + # to match the name of one of the MSPs in each of the channel + # that this peer is a member of. Otherwise this peer's messages + # will not be identified as valid by other nodes. + localMspId: Org1MSP + + # CLI common client config options + client: + # connection timeout + connTimeout: 15s + + # Delivery service related config + deliveryclient: + # It sets the total time the delivery service may spend in reconnection + # attempts until its retry logic gives up and returns an error + reconnectTotalTimeThreshold: 3600s + + # It sets the delivery service <-> ordering service node connection timeout + connTimeout: 15s + + # It sets the delivery service maximal delay between consecutive retries + reConnectBackoffThreshold: 3600s + + # A list of orderer endpoint addresses which should be overridden + # when found in channel configurations. + addressOverrides: + # - from: + # to: + # caCertsFile: + # - from: + # to: + # caCertsFile: + + # Type for the local MSP - by default it's of type bccsp + localMspType: bccsp + + # Used with Go profiling tools only in none production environment. In + # production, it should be disabled (eg enabled: false) + profile: + enabled: false + listenAddress: 0.0.0.0:6060 + + # Handlers defines custom handlers that can filter and mutate + # objects passing within the peer, such as: + # Auth filter - reject or forward proposals from clients + # Decorators - append or mutate the chaincode input passed to the chaincode + # Endorsers - Custom signing over proposal response payload and its mutation + # Valid handler definition contains: + # - A name which is a factory method name defined in + # core/handlers/library/library.go for statically compiled handlers + # - library path to shared object binary for pluggable filters + # Auth filters and decorators are chained and executed in the order that + # they are defined. For example: + # authFilters: + # - + # name: FilterOne + # library: /opt/lib/filter.so + # - + # name: FilterTwo + # decorators: + # - + # name: DecoratorOne + # - + # name: DecoratorTwo + # library: /opt/lib/decorator.so + # Endorsers are configured as a map that its keys are the endorsement system chaincodes that are being overridden. + # Below is an example that overrides the default ESCC and uses an endorsement plugin that has the same functionality + # as the default ESCC. + # If the 'library' property is missing, the name is used as the constructor method in the builtin library similar + # to auth filters and decorators. + # endorsers: + # escc: + # name: DefaultESCC + # library: /etc/hyperledger/fabric/plugin/escc.so + handlers: + authFilters: + - + name: DefaultAuth + - + name: ExpirationCheck # This filter checks identity x509 certificate expiration + decorators: + - + name: DefaultDecorator + endorsers: + escc: + name: DefaultEndorsement + library: + validators: + vscc: + name: DefaultValidation + library: + + # library: /etc/hyperledger/fabric/plugin/escc.so + # Number of goroutines that will execute transaction validation in parallel. + # By default, the peer chooses the number of CPUs on the machine. Set this + # variable to override that choice. + # NOTE: overriding this value might negatively influence the performance of + # the peer so please change this value only if you know what you're doing + validatorPoolSize: + + # The discovery service is used by clients to query information about peers, + # such as - which peers have joined a certain channel, what is the latest + # channel config, and most importantly - given a chaincode and a channel, + # what possible sets of peers satisfy the endorsement policy. + discovery: + enabled: true + # Whether the authentication cache is enabled or not. + authCacheEnabled: true + # The maximum size of the cache, after which a purge takes place + authCacheMaxSize: 1000 + # The proportion (0 to 1) of entries that remain in the cache after the cache is purged due to overpopulation + authCachePurgeRetentionRatio: 0.75 + # Whether to allow non-admins to perform non channel scoped queries. + # When this is false, it means that only peer admins can perform non channel scoped queries. + orgMembersAllowedAccess: false + + # Limits is used to configure some internal resource limits. + limits: + # Concurrency limits the number of concurrently running requests to a service on each peer. + # Currently this option is only applied to endorser service and deliver service. + # When the property is missing or the value is 0, the concurrency limit is disabled for the service. + concurrency: + # endorserService limits concurrent requests to endorser service that handles chaincode deployment, query and invocation, + # including both user chaincodes and system chaincodes. + endorserService: 2500 + # deliverService limits concurrent event listeners registered to deliver service for blocks and transaction events. + deliverService: 2500 + +############################################################################### +# +# VM section +# +############################################################################### +vm: + + # Endpoint of the vm management system. For docker can be one of the following in general + # unix:///var/run/docker.sock + # http://localhost:2375 + # https://localhost:2376 + # endpoint: unix:///var/run/docker.sock + + # DISABLE the docker daemon endpoint to prevent /healthz from checking for docker in "External Builder" mode. + endpoint: + + # settings for docker vms + docker: + tls: + enabled: false + ca: + file: docker/ca.crt + cert: + file: docker/tls.crt + key: + file: docker/tls.key + + # Enables/disables the standard out/err from chaincode containers for + # debugging purposes + attachStdout: false + + # Parameters on creating docker container. + # Container may be efficiently created using ipam & dns-server for cluster + # NetworkMode - sets the networking mode for the container. Supported + # standard values are: `host`(default),`bridge`,`ipvlan`,`none`. + # Dns - a list of DNS servers for the container to use. + # Note: `Privileged` `Binds` `Links` and `PortBindings` properties of + # Docker Host Config are not supported and will not be used if set. + # LogConfig - sets the logging driver (Type) and related options + # (Config) for Docker. For more info, + # https://docs.docker.com/engine/admin/logging/overview/ + # Note: Set LogConfig using Environment Variables is not supported. + hostConfig: + NetworkMode: host + Dns: + # - 192.168.0.1 + LogConfig: + Type: json-file + Config: + max-size: "50m" + max-file: "5" + Memory: 2147483648 + +############################################################################### +# +# Chaincode section +# +############################################################################### +chaincode: + + # The id is used by the Chaincode stub to register the executing Chaincode + # ID with the Peer and is generally supplied through ENV variables + # the `path` form of ID is provided when installing the chaincode. + # The `name` is used for all other requests and can be any string. + id: + path: + name: + + # Generic builder environment, suitable for most chaincode types + builder: $(DOCKER_NS)/fabric-ccenv:$(TWO_DIGIT_VERSION) + + # Enables/disables force pulling of the base docker images (listed below) + # during user chaincode instantiation. + # Useful when using moving image tags (such as :latest) + pull: false + + golang: + # golang will never need more than baseos + runtime: $(DOCKER_NS)/fabric-baseos:$(TWO_DIGIT_VERSION) + + # whether or not golang chaincode should be linked dynamically + dynamicLink: false + + java: + # This is an image based on java:openjdk-8 with addition compiler + # tools added for java shim layer packaging. + # This image is packed with shim layer libraries that are necessary + # for Java chaincode runtime. + runtime: $(DOCKER_NS)/fabric-javaenv:$(TWO_DIGIT_VERSION) + + node: + # This is an image based on node:$(NODE_VER)-alpine + runtime: $(DOCKER_NS)/fabric-nodeenv:$(TWO_DIGIT_VERSION) + + # List of directories to treat as external builders and launchers for + # chaincode. The external builder detection processing will iterate over the + # builders in the order specified below. + externalBuilders: + - path: /var/hyperledger/fabric/chaincode/ccs-builder + name: ccs-builder + propagateEnvironment: + - HOME + - CORE_PEER_ID + - CORE_PEER_LOCALMSPID + + # The maximum duration to wait for the chaincode build and install process + # to complete. + installTimeout: 300s + + # Timeout duration for starting up a container and waiting for Register + # to come through. + startuptimeout: 300s + + # Timeout duration for Invoke and Init calls to prevent runaway. + # This timeout is used by all chaincodes in all the channels, including + # system chaincodes. + # Note that during Invoke, if the image is not available (e.g. being + # cleaned up when in development environment), the peer will automatically + # build the image, which might take more time. In production environment, + # the chaincode image is unlikely to be deleted, so the timeout could be + # reduced accordingly. + executetimeout: 30s + + # There are 2 modes: "dev" and "net". + # In dev mode, user runs the chaincode after starting peer from + # command line on local machine. + # In net mode, peer will run chaincode in a docker container. + mode: net + + # keepalive in seconds. In situations where the communication goes through a + # proxy that does not support keep-alive, this parameter will maintain connection + # between peer and chaincode. + # A value <= 0 turns keepalive off + keepalive: 0 + + # enabled system chaincodes + system: + _lifecycle: enable + cscc: enable + lscc: enable + qscc: enable + + # Logging section for the chaincode container + logging: + # Default level for all loggers within the chaincode container + level: info + # Override default level for the 'shim' logger + shim: warning + # Format for the chaincode container logs + format: '%{color}%{time:2006-01-02 15:04:05.000 MST} [%{module}] %{shortfunc} -> %{level:.4s} %{id:03x}%{color:reset} %{message}' + +############################################################################### +# +# Ledger section - ledger configuration encompasses both the blockchain +# and the state +# +############################################################################### +ledger: + + blockchain: + + state: + # stateDatabase - options are "goleveldb", "CouchDB" + # goleveldb - default state database stored in goleveldb. + # CouchDB - store state database in CouchDB + stateDatabase: goleveldb + # Limit on the number of records to return per query + totalQueryLimit: 100000 + couchDBConfig: + # It is recommended to run CouchDB on the same server as the peer, and + # not map the CouchDB container port to a server port in docker-compose. + # Otherwise proper security must be provided on the connection between + # CouchDB client (on the peer) and server. + couchDBAddress: 127.0.0.1:5984 + # This username must have read and write authority on CouchDB + username: + # The password is recommended to pass as an environment variable + # during start up (eg CORE_LEDGER_STATE_COUCHDBCONFIG_PASSWORD). + # If it is stored here, the file must be access control protected + # to prevent unintended users from discovering the password. + password: + # Number of retries for CouchDB errors + maxRetries: 3 + # Number of retries for CouchDB errors during peer startup. + # The delay between retries doubles for each attempt. + # Default of 10 retries results in 11 attempts over 2 minutes. + maxRetriesOnStartup: 10 + # CouchDB request timeout (unit: duration, e.g. 20s) + requestTimeout: 35s + # Limit on the number of records per each CouchDB query + # Note that chaincode queries are only bound by totalQueryLimit. + # Internally the chaincode may execute multiple CouchDB queries, + # each of size internalQueryLimit. + internalQueryLimit: 1000 + # Limit on the number of records per CouchDB bulk update batch + maxBatchUpdateSize: 1000 + # Warm indexes after every N blocks. + # This option warms any indexes that have been + # deployed to CouchDB after every N blocks. + # A value of 1 will warm indexes after every block commit, + # to ensure fast selector queries. + # Increasing the value may improve write efficiency of peer and CouchDB, + # but may degrade query response time. + warmIndexesAfterNBlocks: 1 + # Create the _global_changes system database + # This is optional. Creating the global changes database will require + # additional system resources to track changes and maintain the database + createGlobalChangesDB: false + # CacheSize denotes the maximum mega bytes (MB) to be allocated for the in-memory state + # cache. Note that CacheSize needs to be a multiple of 32 MB. If it is not a multiple + # of 32 MB, the peer would round the size to the next multiple of 32 MB. + # To disable the cache, 0 MB needs to be assigned to the cacheSize. + cacheSize: 64 + + history: + # enableHistoryDatabase - options are true or false + # Indicates if the history of key updates should be stored. + # All history 'index' will be stored in goleveldb, regardless if using + # CouchDB or alternate database for the state. + enableHistoryDatabase: true + + pvtdataStore: + # the maximum db batch size for converting + # the ineligible missing data entries to eligible missing data entries + collElgProcMaxDbBatchSize: 5000 + # the minimum duration (in milliseconds) between writing + # two consecutive db batches for converting the ineligible missing data entries to eligible missing data entries + collElgProcDbBatchesInterval: 1000 + # The missing data entries are classified into two categories: + # (1) prioritized + # (2) deprioritized + # Initially, all missing data are in the prioritized list. When the + # reconciler is unable to fetch the missing data from other peers, + # the unreconciled missing data would be moved to the deprioritized list. + # The reconciler would retry deprioritized missing data after every + # deprioritizedDataReconcilerInterval (unit: minutes). Note that the + # interval needs to be greater than the reconcileSleepInterval + deprioritizedDataReconcilerInterval: 60m + + snapshots: + # Path on the file system where peer will store ledger snapshots + rootDir: /var/hyperledger/production/snapshots + +############################################################################### +# +# Operations section +# +############################################################################### +operations: + # host and port for the operations server + listenAddress: 127.0.0.1:9443 + + # TLS configuration for the operations endpoint + tls: + # TLS enabled + enabled: false + + # path to PEM encoded server certificate for the operations server + cert: + file: + + # path to PEM encoded server key for the operations server + key: + file: + + # most operations service endpoints require client authentication when TLS + # is enabled. clientAuthRequired requires client certificate authentication + # at the TLS layer to access all resources. + clientAuthRequired: false + + # paths to PEM encoded ca certificates to trust for client authentication + clientRootCAs: + files: [] + +############################################################################### +# +# Metrics section +# +############################################################################### +metrics: + # metrics provider is one of statsd, prometheus, or disabled + provider: disabled + + # statsd configuration + statsd: + # network type: tcp or udp + network: udp + + # statsd server address + address: 127.0.0.1:8125 + + # the interval at which locally cached counters and gauges are pushed + # to statsd; timings are pushed immediately + writeInterval: 10s + + # prefix is prepended to all emitted statsd metrics + prefix: diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/gateway/kustomization.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/gateway/kustomization.yaml new file mode 100644 index 00000000..80554542 --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/gateway/kustomization.yaml @@ -0,0 +1,24 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - org1-peer-gateway.yaml +# - org2-peer-gateway.yaml \ No newline at end of file diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/gateway/org1-peer-gateway.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/gateway/org1-peer-gateway.yaml new file mode 100644 index 00000000..528e9561 --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/gateway/org1-peer-gateway.yaml @@ -0,0 +1,76 @@ +# +# Copyright contributors to the Hyperledgendary Full Stack Asset Transfer project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +apiVersion: v1 +kind: Service +metadata: + name: org1-peer-gateway + labels: + app: org1-peer-gateway + app.kubernetes.io/instance: fabricpeer + app.kubernetes.io/managed-by: fabric-operator + app.kubernetes.io/name: fabric + creator: fabric + orgname: Org1MSP +spec: + # This selector stanza will match on the orgname: label below, distributing connections to all + # peers matching the org MSP. + selector: + # app: org1-peer1 + app.kubernetes.io/instance: fabricpeer + app.kubernetes.io/managed-by: fabric-operator + app.kubernetes.io/name: fabric + creator: fabric + orgname: Org1MSP + ports: + - name: peer-api + port: 7051 + protocol: TCP + targetPort: 7051 + +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: org1-peer-gateway + annotations: + nginx.ingress.kubernetes.io/proxy-connect-timeout: 60s + nginx.ingress.kubernetes.io/ssl-passthrough: "true" + labels: + app: org1-peer-gateway + app.kubernetes.io/instance: fabricpeer + app.kubernetes.io/managed-by: fabric-operator + app.kubernetes.io/name: fabric + creator: fabric + orgname: Org1MSP +spec: + ingressClassName: nginx + rules: + - host: test-network-org1-peer-gateway.${WORKSHOP_INGRESS_DOMAIN} + http: + paths: + - backend: + service: + name: org1-peer-gateway + port: + name: peer-api + path: / + pathType: ImplementationSpecific + tls: + - hosts: + - test-network-org1-peer-gateway.${WORKSHOP_INGRESS_DOMAIN} diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/gateway/org2-peer-gateway.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/gateway/org2-peer-gateway.yaml new file mode 100644 index 00000000..ca1a46c3 --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/gateway/org2-peer-gateway.yaml @@ -0,0 +1,76 @@ +# +# Copyright contributors to the Hyperledgendary Full Stack Asset Transfer project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +apiVersion: v1 +kind: Service +metadata: + name: org2-peer-gateway + labels: + app: org2-peer-gateway + app.kubernetes.io/instance: fabricpeer + app.kubernetes.io/managed-by: fabric-operator + app.kubernetes.io/name: fabric + creator: fabric + orgname: Org2MSP +spec: + # This selector stanza will match on the orgname: label below, distributing connections to all + # peers matching the org MSP. + selector: + # app: org2-peer1 + app.kubernetes.io/instance: fabricpeer + app.kubernetes.io/managed-by: fabric-operator + app.kubernetes.io/name: fabric + creator: fabric + orgname: Org2MSP + ports: + - name: peer-api + port: 7051 + protocol: TCP + targetPort: 7051 + +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: org2-peer-gateway + annotations: + nginx.ingress.kubernetes.io/proxy-connect-timeout: 60s + nginx.ingress.kubernetes.io/ssl-passthrough: "true" + labels: + app: org2-peer-gateway + app.kubernetes.io/instance: fabricpeer + app.kubernetes.io/managed-by: fabric-operator + app.kubernetes.io/name: fabric + creator: fabric + orgname: Org2MSP +spec: + ingressClassName: nginx + rules: + - host: test-network-org2-peer-gateway.${WORKSHOP_INGRESS_DOMAIN} + http: + paths: + - backend: + service: + name: org2-peer-gateway + port: + name: peer-api + path: / + pathType: ImplementationSpecific + tls: + - hosts: + - test-network-org2-peer-gateway.${WORKSHOP_INGRESS_DOMAIN} diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/manager/fabric-operator-manager.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/manager/fabric-operator-manager.yaml new file mode 100644 index 00000000..9311f343 --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/manager/fabric-operator-manager.yaml @@ -0,0 +1,123 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: fabric-operator + labels: + release: "operator" + helm.sh/chart: "hlf" + app.kubernetes.io/name: "hlf" + app.kubernetes.io/instance: "hlf" + app.kubernetes.io/managed-by: "fabric-operator" +spec: + replicas: 1 + strategy: + type: "Recreate" + selector: + matchLabels: + name: fabric-operator + template: + metadata: + labels: + name: fabric-operator + release: "operator" + helm.sh/chart: "hlf" + app.kubernetes.io/name: "hlf" + app.kubernetes.io/instance: "hlf" + app.kubernetes.io/managed-by: "fabric-operator" + annotations: + productName: "Hyperledger Fabric Operator" + productID: "" + productVersion: "1.0.0" + productChargedContainers: "" + productMetric: "VIRTUAL_PROCESSOR_CORE" + spec: + # hostIPC: false + # hostNetwork: false + # hostPID: false + serviceAccountName: fabric-operator + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/arch + operator: In + values: + - amd64 + # securityContext: + # runAsNonRoot: true + # runAsUser: 1001 + # fsGroup: 2000 + + imagePullSecrets: + - name: ghcr-pull-secret + + containers: + - name: fabric-operator + image: ${FABRIC_OPERATOR_IMAGE} + imagePullPolicy: ${IMAGE_PULL_POLICY} + + command: + - ibp-operator + # securityContext: + # privileged: false + # allowPrivilegeEscalation: false + # readOnlyRootFilesystem: false + # runAsNonRoot: false + # runAsUser: 1001 + # capabilities: + # drop: + # - ALL + # add: + # - CHOWN + # - FOWNER + livenessProbe: + tcpSocket: + port: 8383 + initialDelaySeconds: 10 + timeoutSeconds: 5 + failureThreshold: 5 + readinessProbe: + tcpSocket: + port: 8383 + initialDelaySeconds: 10 + timeoutSeconds: 5 + periodSeconds: 5 + env: + - name: WATCH_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OPERATOR_NAME + value: "fabric-operator" + - name: CLUSTERTYPE + value: K8S + resources: + requests: + cpu: 10m + memory: 10Mi + limits: + cpu: 100m + memory: 200Mi diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/manager/kustomization.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/manager/kustomization.yaml new file mode 100644 index 00000000..d3112f7b --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/manager/kustomization.yaml @@ -0,0 +1,22 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - fabric-operator-manager.yaml diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/orderers/kustomization.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/orderers/kustomization.yaml new file mode 100644 index 00000000..91c9041d --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/orderers/kustomization.yaml @@ -0,0 +1,24 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - org0-orderers.yaml + diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/orderers/org0-orderers.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/orderers/org0-orderers.yaml new file mode 100644 index 00000000..3251afc1 --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/orderers/org0-orderers.yaml @@ -0,0 +1,151 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +apiVersion: ibp.com/v1beta1 +kind: IBPOrderer +metadata: + name: org0-orderers +spec: + version: "${FABRIC_VERSION}" + domain: "${INGRESS_DOMAIN}" + license: + accept: true + action: + enroll: {} + reenroll: {} + clusterSize: 3 + clusterconfigoverride: + - general: + keepalive: + serverMinInterval: 61s + - general: + keepalive: + serverMinInterval: 61s + - general: + keepalive: + serverMinInterval: 61s + clustersecret: + - enrollment: + component: + caname: ca + cahost: test-network-org0-ca-ca.${INGRESS_DOMAIN} + caport: "443" + catls: + cacert: "${ORG0_CA_CERT}" + enrollid: "orderer1" + enrollsecret: "orderer1pw" + tls: + caname: tlsca + cahost: test-network-org0-ca-ca.${INGRESS_DOMAIN} + caport: "443" + catls: + cacert: "${ORG0_CA_CERT}" + enrollid: "orderer1" + enrollsecret: "orderer1pw" + csr: + hosts: + - "org0-orderersnode1" + - "org0-orderersnode1.${KUBE_DNS_DOMAIN}" + - enrollment: + component: + caname: ca + cahost: test-network-org0-ca-ca.${INGRESS_DOMAIN} + caport: "443" + catls: + cacert: "${ORG0_CA_CERT}" + enrollid: "orderer2" + enrollsecret: "orderer2pw" + tls: + caname: tlsca + cahost: test-network-org0-ca-ca.${INGRESS_DOMAIN} + caport: "443" + catls: + cacert: "${ORG0_CA_CERT}" + enrollid: "orderer2" + enrollsecret: "orderer2pw" + csr: + hosts: + - "org0-orderersnode2" + - "org0-orderersnode2.${KUBE_DNS_DOMAIN}" + - enrollment: + component: + caname: ca + cahost: test-network-org0-ca-ca.${INGRESS_DOMAIN} + caport: "443" + catls: + cacert: "${ORG0_CA_CERT}" + enrollid: "orderer3" + enrollsecret: "orderer3pw" + tls: + caname: tlsca + cahost: test-network-org0-ca-ca.${INGRESS_DOMAIN} + caport: "443" + catls: + cacert: "${ORG0_CA_CERT}" + enrollid: "orderer3" + enrollsecret: "orderer3pw" + csr: + hosts: + - "org0-orderersnode3" + - "org0-orderersnode3.${KUBE_DNS_DOMAIN}" + + customNames: + pvc: {} + images: + ordererInitImage: ${INIT_IMAGE} + ordererInitTag: ${INIT_IMAGE_LABEL} + ordererImage: ${ORDERER_IMAGE} + ordererTag: ${ORDERER_IMAGE_LABEL} + grpcwebImage: ${GRPCWEB_IMAGE} + grpcwebTag: ${GRPCWEB_IMAGE_LABEL} + ingress: + class: "" + tlsSecretName: "" + mspID: OrdererMSP + ordererType: etcdraft + orgName: OrdererOrg + useChannelLess: true + systemChannelName: testchainid + resources: + init: + limits: + cpu: 100m + memory: 200M + requests: + cpu: 10m + memory: 10M + orderer: + limits: + cpu: 600m + memory: 1200M + requests: + cpu: 10m + memory: 10M + proxy: + limits: + cpu: 100m + memory: 200M + requests: + cpu: 10m + memory: 10M + service: + type: ClusterIP + storage: + orderer: + class: "${STORAGE_CLASS}" + size: 5G diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/kustomization.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/kustomization.yaml new file mode 100644 index 00000000..a962324c --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/kustomization.yaml @@ -0,0 +1,27 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - org1-peer1.yaml + - org1-peer2.yaml + - org2-peer1.yaml + - org2-peer2.yaml + diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org1-peer1.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org1-peer1.yaml new file mode 100644 index 00000000..3e0892a7 --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org1-peer1.yaml @@ -0,0 +1,103 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +apiVersion: ibp.com/v1beta1 +kind: IBPPeer +metadata: + name: org1-peer1 +spec: + version: "${FABRIC_VERSION}" + domain: "${INGRESS_DOMAIN}" + peerExternalEndpoint: "test-network-org1-peer1-peer.${INGRESS_DOMAIN}:443" + license: + accept: true + action: + enroll: {} + reenroll: {} + configoverride: + peer: + keepalive: + minInterval: 61s + customNames: + pvc: {} + images: + peerInitImage: ${INIT_IMAGE} + peerInitTag: ${INIT_IMAGE_LABEL} + peerImage: ${PEER_IMAGE} + peerTag: ${PEER_IMAGE_LABEL} + grpcwebImage: ${GRPCWEB_IMAGE} + grpcwebTag: ${GRPCWEB_IMAGE_LABEL} + mspID: Org1MSP + mspSecret: org1-peer1-secret + secret: + enrollment: + component: + caname: ca + cahost: "test-network-org1-ca-ca.${INGRESS_DOMAIN}" + caport: "443" + catls: + cacert: "${ORG1_CA_CERT}" + enrollid: "peer1" + enrollsecret: "peer1pw" + tls: + caname: tlsca + cahost: "test-network-org1-ca-ca.${INGRESS_DOMAIN}" + caport: "443" + catls: + cacert: "${ORG1_CA_CERT}" + enrollid: "peer1" + enrollsecret: "peer1pw" + csr: + hosts: + - "org1-peer1" + - "org1-peer1.${KUBE_DNS_DOMAIN}" + - "test-network-org1-peer-gateway.${INGRESS_DOMAIN}" + chaincodeBuilderConfig: + peername: org1-peer1 + service: + type: ClusterIP + stateDb: leveldb + storage: + peer: + class: "${STORAGE_CLASS}" + size: 5G + statedb: + class: "${STORAGE_CLASS}" + size: 10Gi + resources: + init: + limits: + cpu: 100m + memory: 200M + requests: + cpu: 10m + memory: 10M + peer: + limits: + cpu: 500m + memory: 1G + requests: + cpu: 10m + memory: 10M + proxy: + limits: + cpu: 100m + memory: 200M + requests: + cpu: 10m + memory: 10M \ No newline at end of file diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org1-peer2.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org1-peer2.yaml new file mode 100644 index 00000000..ea3fde41 --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org1-peer2.yaml @@ -0,0 +1,103 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +apiVersion: ibp.com/v1beta1 +kind: IBPPeer +metadata: + name: org1-peer2 +spec: + version: "${FABRIC_VERSION}" + domain: "${INGRESS_DOMAIN}" + peerExternalEndpoint: "test-network-org1-peer2-peer.${INGRESS_DOMAIN}:443" + license: + accept: true + action: + enroll: {} + reenroll: {} + configoverride: + peer: + keepalive: + minInterval: 61s + customNames: + pvc: {} + images: + peerInitImage: ${INIT_IMAGE} + peerInitTag: ${INIT_IMAGE_LABEL} + peerImage: ${PEER_IMAGE} + peerTag: ${PEER_IMAGE_LABEL} + grpcwebImage: ${GRPCWEB_IMAGE} + grpcwebTag: ${GRPCWEB_IMAGE_LABEL} + mspID: Org1MSP + mspSecret: org1-peer2-secret + secret: + enrollment: + component: + caname: ca + cahost: "test-network-org1-ca-ca.${INGRESS_DOMAIN}" + caport: "443" + catls: + cacert: "${ORG1_CA_CERT}" + enrollid: "peer2" + enrollsecret: "peer2pw" + tls: + caname: tlsca + cahost: "test-network-org1-ca-ca.${INGRESS_DOMAIN}" + caport: "443" + catls: + cacert: "${ORG1_CA_CERT}" + enrollid: "peer2" + enrollsecret: "peer2pw" + csr: + hosts: + - "org1-peer2" + - "org1-peer2.${KUBE_DNS_DOMAIN}" + - "test-network-org1-peer-gateway.${INGRESS_DOMAIN}" + chaincodeBuilderConfig: + peername: org1-peer2 + service: + type: ClusterIP + stateDb: leveldb + storage: + peer: + class: "${STORAGE_CLASS}" + size: 5G + statedb: + class: "${STORAGE_CLASS}" + size: 10Gi + resources: + init: + limits: + cpu: 100m + memory: 200M + requests: + cpu: 10m + memory: 10M + peer: + limits: + cpu: 500m + memory: 1G + requests: + cpu: 10m + memory: 10M + proxy: + limits: + cpu: 100m + memory: 200M + requests: + cpu: 10m + memory: 10M \ No newline at end of file diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org2-peer1.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org2-peer1.yaml new file mode 100644 index 00000000..36676709 --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org2-peer1.yaml @@ -0,0 +1,103 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +apiVersion: ibp.com/v1beta1 +kind: IBPPeer +metadata: + name: org2-peer1 +spec: + version: "${FABRIC_VERSION}" + domain: "${INGRESS_DOMAIN}" + peerExternalEndpoint: "test-network-org2-peer1-peer.${INGRESS_DOMAIN}:443" + license: + accept: true + action: + enroll: {} + reenroll: {} + configoverride: + peer: + keepalive: + minInterval: 61s + customNames: + pvc: {} + images: + peerInitImage: ${INIT_IMAGE} + peerInitTag: ${INIT_IMAGE_LABEL} + peerImage: ${PEER_IMAGE} + peerTag: ${PEER_IMAGE_LABEL} + grpcwebImage: ${GRPCWEB_IMAGE} + grpcwebTag: ${GRPCWEB_IMAGE_LABEL} + mspID: Org2MSP + mspSecret: org2-peer1-secret + secret: + enrollment: + component: + caname: ca + cahost: "test-network-org2-ca-ca.${INGRESS_DOMAIN}" + caport: "443" + catls: + cacert: "${ORG2_CA_CERT}" + enrollid: "peer1" + enrollsecret: "peer1pw" + tls: + caname: tlsca + cahost: "test-network-org2-ca-ca.${INGRESS_DOMAIN}" + caport: "443" + catls: + cacert: "${ORG2_CA_CERT}" + enrollid: "peer1" + enrollsecret: "peer1pw" + csr: + hosts: + - "org2-peer1" + - "org2-peer1.${KUBE_DNS_DOMAIN}" + - "test-network-org2-peer-gateway.${INGRESS_DOMAIN}" + chaincodeBuilderConfig: + peername: org2-peer1 + service: + type: ClusterIP + stateDb: leveldb + storage: + peer: + class: "${STORAGE_CLASS}" + size: 5G + statedb: + class: "${STORAGE_CLASS}" + size: 10Gi + resources: + init: + limits: + cpu: 100m + memory: 200M + requests: + cpu: 10m + memory: 10M + peer: + limits: + cpu: 500m + memory: 1G + requests: + cpu: 10m + memory: 10M + proxy: + limits: + cpu: 100m + memory: 200M + requests: + cpu: 10m + memory: 10M \ No newline at end of file diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org2-peer2.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org2-peer2.yaml new file mode 100644 index 00000000..519197c6 --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/peers/org2-peer2.yaml @@ -0,0 +1,103 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +apiVersion: ibp.com/v1beta1 +kind: IBPPeer +metadata: + name: org2-peer2 +spec: + version: "${FABRIC_VERSION}" + domain: "${INGRESS_DOMAIN}" + peerExternalEndpoint: "test-network-org2-peer2-peer.${INGRESS_DOMAIN}:443" + license: + accept: true + action: + enroll: {} + reenroll: {} + configoverride: + peer: + keepalive: + minInterval: 61s + customNames: + pvc: {} + images: + peerInitImage: ${INIT_IMAGE} + peerInitTag: ${INIT_IMAGE_LABEL} + peerImage: ${PEER_IMAGE} + peerTag: ${PEER_IMAGE_LABEL} + grpcwebImage: ${GRPCWEB_IMAGE} + grpcwebTag: ${GRPCWEB_IMAGE_LABEL} + mspID: Org2MSP + mspSecret: org2-peer2-secret + secret: + enrollment: + component: + caname: ca + cahost: "test-network-org2-ca-ca.${INGRESS_DOMAIN}" + caport: "443" + catls: + cacert: "${ORG2_CA_CERT}" + enrollid: "peer2" + enrollsecret: "peer2pw" + tls: + caname: tlsca + cahost: "test-network-org2-ca-ca.${INGRESS_DOMAIN}" + caport: "443" + catls: + cacert: "${ORG2_CA_CERT}" + enrollid: "peer2" + enrollsecret: "peer2pw" + csr: + hosts: + - "org2-peer2" + - "org2-peer2.${KUBE_DNS_DOMAIN}" + - "test-network-org2-peer-gateway.${INGRESS_DOMAIN}" + chaincodeBuilderConfig: + peername: org2-peer2 + service: + type: ClusterIP + stateDb: leveldb + storage: + peer: + class: "${STORAGE_CLASS}" + size: 5G + statedb: + class: "${STORAGE_CLASS}" + size: 10Gi + resources: + init: + limits: + cpu: 100m + memory: 200M + requests: + cpu: 10m + memory: 10M + peer: + limits: + cpu: 500m + memory: 1G + requests: + cpu: 10m + memory: 10M + proxy: + limits: + cpu: 100m + memory: 200M + requests: + cpu: 10m + memory: 10M \ No newline at end of file diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-clusterrole.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-clusterrole.yaml new file mode 100644 index 00000000..3a775e76 --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-clusterrole.yaml @@ -0,0 +1,205 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: fabric-operator-role + labels: + release: "operator" + helm.sh/chart: "ibm-hlfsupport" + app.kubernetes.io/name: "ibm-hlfsupport" + app.kubernetes.io/instance: "ibm-hlfsupport" + app.kubernetes.io/managed-by: "ibm-hlfsupport-operator" +rules: + - apiGroups: + - extensions + resourceNames: + - ibm-hlfsupport-psp + resources: + - podsecuritypolicies + verbs: + - use + - apiGroups: + - apiextensions.k8s.io + resources: + - persistentvolumeclaims + - persistentvolumes + verbs: + - get + - list + - create + - update + - patch + - watch + - delete + - deletecollection + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - apiGroups: + - route.openshift.io + resources: + - routes + - routes/custom-host + verbs: + - get + - list + - create + - update + - patch + - watch + - delete + - deletecollection + - apiGroups: + - "" + resources: + - pods + - pods/log + - persistentvolumeclaims + - persistentvolumes + - services + - endpoints + - events + - configmaps + - secrets + - nodes + - serviceaccounts + verbs: + - get + - list + - create + - update + - patch + - watch + - delete + - deletecollection + - apiGroups: + - "batch" + resources: + - jobs + verbs: + - get + - list + - create + - update + - patch + - watch + - delete + - deletecollection + - apiGroups: + - "authorization.openshift.io" + - "rbac.authorization.k8s.io" + resources: + - roles + - rolebindings + verbs: + - get + - list + - create + - update + - patch + - watch + - delete + - deletecollection + - bind + - escalate + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - replicasets + - statefulsets + verbs: + - get + - list + - create + - update + - patch + - watch + - delete + - deletecollection + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - create + - apiGroups: + - apps + resourceNames: + - ibm-hlfsupport-operator + resources: + - deployments/finalizers + verbs: + - update + - apiGroups: + - ibp.com + resources: + - ibpcas.ibp.com + - ibppeers.ibp.com + - ibporderers.ibp.com + - ibpconsoles.ibp.com + - ibpcas + - ibppeers + - ibporderers + - ibpconsoles + - ibpcas/finalizers + - ibppeers/finalizers + - ibporderers/finalizers + - ibpconsoles/finalizers + - ibpcas/status + - ibppeers/status + - ibporderers/status + - ibpconsoles/status + verbs: + - get + - list + - create + - update + - patch + - watch + - delete + - deletecollection + - apiGroups: + - extensions + - networking.k8s.io + - config.openshift.io + resources: + - ingresses + - networkpolicies + verbs: + - get + - list + - create + - update + - patch + - watch + - delete + - deletecollection diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-clusterrolebinding.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-clusterrolebinding.yaml new file mode 100644 index 00000000..7613c9fe --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-clusterrolebinding.yaml @@ -0,0 +1,36 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: fabric-operator-rolebinding + labels: + release: "operator" + helm.sh/chart: "ibm-hlfsupport" + app.kubernetes.io/name: "ibm-hlfsupport" + app.kubernetes.io/instance: "ibm-hlfsupport" + app.kubernetes.io/managed-by: "ibm-hlfsupport-operator" +subjects: + - kind: ServiceAccount + name: fabric-operator + namespace: "${NS}" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: fabric-operator-role diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-psp.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-psp.yaml new file mode 100644 index 00000000..dcd53c72 --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-psp.yaml @@ -0,0 +1,48 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: ibm-hlfsupport-psp +spec: + hostIPC: false + hostNetwork: false + hostPID: false + privileged: true + allowPrivilegeEscalation: true + readOnlyRootFilesystem: false + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + runAsUser: + rule: RunAsAny + fsGroup: + rule: RunAsAny + requiredDropCapabilities: + - ALL + allowedCapabilities: + - NET_BIND_SERVICE + - CHOWN + - DAC_OVERRIDE + - SETGID + - SETUID + - FOWNER + volumes: + - '*' diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-serviceaccount.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-serviceaccount.yaml new file mode 100644 index 00000000..2013b11f --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-serviceaccount.yaml @@ -0,0 +1,22 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fabric-operator diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/kustomization.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/kustomization.yaml new file mode 100644 index 00000000..a6930c5d --- /dev/null +++ b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/kustomization.yaml @@ -0,0 +1,25 @@ +# +# Copyright contributors to the Hyperledger Fabric Operator project +# +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - fabric-operator-psp.yaml + - fabric-operator-serviceaccount.yaml + - fabric-operator-clusterrole.yaml + - fabric-operator-clusterrolebinding.yaml