Releases: npci/falcon
Falcon:v1.2.0
Updates/Changes on existing charts
Common changes.
- Added support for
NodePort
service type and Port specification. Affected chartsfabric-ca,fabric-orderer,fabric-peers
. - Changed default
peerServicePort
from30002
to standard7051
port. - Changed all
core_peer_address
frompeer0-initialpeerorg:30002
=>core_peer_address: peer0-initialpeerorg:7051
. Affected chartsfabric-ops/approve-cc,commit cc
Chart: fabric-ops
Job: Channel creation
Multi channel support is available.
- Removed
.Values.config_transaction_filename
. Job will create txn file named as<channel-name>.tx
due to multi-channel support. - Removed
Values.channel_block_filename
. Job will create channel block file named as<channel-name>.block
due to multi-channel support. - Removed
Values.hlf_channel
and added multi-channel support. Use.Values.app_channels
a list of channels to be created. Example.
app_channels:
- mychannel1
- mychannel2
- Replaced
.Values.admin_identity
and replaced it with.Values.admin_organizations
for supporting the multi-channel functionalities and for re-using the existing configtx.yaml used by thecryptogen
job. Example.
admin_organizations:
- org_type: consortium
org_name: initialpeerorg
ica_endpoint: ica-initialpeerorg.my-hlf-domain.com:30000
cert_path: /root/initialpeerorg.pem
admin_identity: admin
admin_secret: initialpeerorgAdminSamplePassword
require_msp_enrollment: true
require_tls_enrollment: false
anchor_peers:
- host: peer0-initialpeerorg.my-hlf-domain.com
port: "30000"
- Added new value
.Values.configTxProfileType
for specifying configtxn profile. The value should beConsortiumProfile
- Added new value
.Values.consortiumName
. The value should beInitialConsortium
. Prior to Falcon 1.2.0, the default name was "SampleConsortium". - Added more verbosity to the channel txn file print section
- Added
.Values.core_peer_mspconfigpath_override
. Optional.
Chart: fabric-ops
Job: Configure-org-channel
- Corrected typo in variable name
.Values.organizatons
to.Values.organizations
- Removed
identity_name
&identity_secret
fields from.Values.organizations
array since it is not required. - Added support to delete orgs from channel. Added new field "status" with acceptable values
active
ordisabled
for add/remove an org respectively. Example;
- name: org1
ica_endpoint: ica-org1.my-hlf-domain.com:30000
anchor_peer: peer0-org1.my-hlf-domain.com
anchor_peer_port: 30000
status: active # Set to `disabled` to remove an org from the network.
Chart: fabric-ops
Job: Cryptogen
- Changed variable
.Values.organizations
toValues.admin_organizations
- Changed Org type value from
peerorg
type toconsortium
for the consortium member org. - Removed
.Values.channel_artifact_dir
- Removed
.Values.base_dir
- Removed
.Values.hlf_channel
- Removed
.Values.config_transaction_filename
- Added
.Values.configTxProfileType
- Added
.Values.consortiumName
- Added more verbosity to the gensis.block print section.
Charts: fabric-orderer
- Added individual
hlf_domain
support fororderers
. Optional - Added option to add commands/args to orderers in-case if required.
- Fixed orderer data pvc variable name mismatch
- Changed the tcp health to http health check since the tcp health check was causing handshake error in orderer.
Chart: fabric-peer
- Changed
.Values.global.peerServicePort
from30002
to7051
- Added option to choose ingress as optional for peers.
What's Changed
- Add support to delete orgs from channel by @jithindevasia in #21
- Removed default nginx annotations from fabric-ca default values file by @jithindevasia in #22
- Adding multi channel support on channel creation job by @jithindevasia in #26
- Fixed orderer data pvc variable name mismatch by @jithindevasia in #27
- Fixed peer cert pvc issue by @jithindevasia in #28
- Removed Org admin credentials from Org addition job by @jithindevasia in #30
- Added individual hlf_domain support for orderers by @jithindevasia in #33
- Fixed ingress optional bug for peers by @jithindevasia in #36
- Corrected nodeport port specification by @jithindevasia in #37
- Release/v1.2.0 by @jithindevasia in #38
- Release/v1.2.0 by @jithindevasia in #39
Full Changelog: v1.1.0...v1.2.0
Falcon:v1.1.0
Updates/Changes on existing charts
Common changes that affects all charts.
- Changed default
ImagepullPolicy
fromAlways
toIfNotPresent
on all charts. - Added
additionalLabels
for every charts to include more labels. For orderers and peers the value will be perorderer/peer
or you can set itglobally
as well(.Values.global.additionalLabels)
, for the rest of the charts it will be.Values.additionalLabels
. - Removed the unecessary peer identity enrollment from most of the
channel/chaincode
relatedfabric-ops
jobs which improved the overall job execution time. (Reduced to 50% of the previous execution time) - All charts have been updated with Readme with complete list of parameters.
Chart : fabric-ops
- Separated all fabric-ops jobs and configmaps to different template files for easy management.
- Filestore fileupload/download are now separated into functions in the common script.
- Fixed bug on the filestore upload as it was reporting successful upload even if the uploads were failing.
- Restructured the common functions such as enrollment function to support msp/tls enrollments.
- Removed the dependency on
identity_type
to decide whether tls/msp enrollement is needed. - From now on, you don't need to add a step to download the CA server public key explicitly using
fabric_public_key_fetch
function if you're using the common enrollment function. When you call the common enroll function by passing 10 parameters, it will handle the public key fetch itself. - All the above common functions are now in
fabric_enroll.sh
which is default when rendering this chart. All jobs can source this file and start using it, so that no separate enrollment script is needed as it supports most of the use cases.
Job: approve-chaincode
- Removed
job_type: chaincode_ops
and only.Values.fabric_actions.approve_chaincode
totrue
is required. - Modified
.Values.ca.tlss_ca_endpoint
to.Values.tlsca_endpoint
- Modified
.Values.ca.ca_endpoint
to.Values.ica_endpoint
- Modified
.Values.identities
to.Values.admin_identity
and removedidentity_type
field. Also added additional fieldsrequire_msp_enrollment
&require_tls_enrollment
. Only the Org admin credentials are required to perform chaincode approval operations. - New parameter required
.Values.core_peer_address
Job: channel-create
- Removed
job_type: chaincode_ops
and only.Values.fabric_actions.create_channel
totrue
is required. - Modified
.Values.ca.tlss_ca_endpoint
to.Values.tlsca_endpoint
- Modified
.Values.ca.ca_endpoint
to.Values.ica_endpoint
- Modified
.Values.identities
to.Values.admin_identity
and removedidentity_type
field. Also added additional fieldsrequire_msp_enrollment
&require_tls_enrollment
. Only the Org admin credentials are required to perform the channel creation operation.
Job: commit-chaincode
- Removed
job_type: chaincode_ops
and only.Values.fabric_actions.commit_chaincode
totrue
is required. - Modified
.Values.ca.tlss_ca_endpoint
to.Values.tlsca_endpoint
- Modified
.Values.ca.ca_endpoint
to.Values.ica_endpoint
- Modified
.Values.identities
to.Values.admin_identity
and removedidentity_type
field. Also added additional fieldsrequire_msp_enrollment
&require_tls_enrollment
. Only the Org admin credentials are required to perform the chaincode commit operation. - New parameter required
.Value.core_peer_address
Job: configure-org-channel
- Removed
job_type: chaincode_ops
and only.Values.fabric_actions.configure_org_channel
totrue
is required. - Modified
.Values.ca.tlss_ca_endpoint
to.Values.tlsca_endpoint
- Modified
.Values.ca.ca_endpoint
to.Values.ica_endpoint
- Modified
.Values.identities
to.Values.admin_identity
and removedidentity_type
field. Also added additional fieldsrequire_msp_enrollment
&require_tls_enrollment
. Only the Org admin credentials are required to perform org addition operations. - New Org's
ica username/password
is not required to add it to the channel. Instead only anadmin
user credentials are required instead of ica user. - New Org's
msp_dir
will be taken from the chart default. You don't have to specify it unless there is a reason.
Job: Identities
- Removed
job_type: chaincode_ops
and only.Values.fabric_actions.identity
totrue
is required. - Modified
.Values.ca.tlss_ca_endpoint
to.Values.tlsca_endpoint
- Modified
.Values.ca.ca_endpoint
to.Values.ca_endpoint
- Modified
.Values.ca.admin_secret
to.Values.ca_secret
- Added
hlf_domain
to support common enrollment function.
Job: install-chaincode
- Removed
job_type: chaincode_ops
and only.Values.fabric_actions.install_chaincode
totrue
is required. - Modified
.Values.ca.tlss_ca_endpoint
to.Values.tlsca_endpoint
- Modified
.Values.ca.ca_endpoint
to.Values.ica_endpoint
- Modified
.Values.identities
to.Values.admin_identity
and removedidentity_type
field. Also added additional fieldsrequire_msp_enrollment
&require_tls_enrollment
. Only the Org admin credentials are required to perform chaincode installation. And no peer identities and enrollments are required. - Added
.Values.peer_identities
array for target peers on which chaincode needs to be installed. - Added
.peer_endpoint
field topeer_identities
array, so that chaincode can be installed remotely (Optionally). By default it will be{{ .identity_name }}:{{ $.Values.peer_internal_service_port }}
Job: Update-anchor-peer
- Removed
job_type: chaincode_ops
and only.Values.fabric_actions.update_anchor_peer
totrue
is required. - Modified
.Values.ca.tlss_ca_endpoint
to.Values.tlsca_endpoint
- Modified
.Values.ca.ca_endpoint
to.Values.ica_endpoint
- Modified
.Values.identities
to.Values.admin_identity
and removedidentity_type
field. Also added additional fieldsrequire_msp_enrollment
&require_tls_enrollment
. Only the Org admin credentials are required to perform anchor peer update.
Job: Cryptogen
- Removed
job_type: chaincode_ops
and only.Values.fabric_actions.cryptogen
totrue
is required. - Orderer orgname can be completely managed from values. Previously it was hardcoded to
OrdererMSP
in the template. - No need to expose the Orderer Org OR Initialpeer Org ICA credentials. Instead, provide any user credentials that has admin privileges.
- Initial network
organization
array has been simplfied and eliminated many repetitve items, it's clean and more readable than the previous version. Previously the orderer organization and peer org name were mentioned twice in the values file. Now with a single.Values.organizations
array, you can specify the Orderer org, its identities & Peer org and its anchor peer list. All you need to do is markorg_type
as"orderer"
for orderer organization andorg_type
as"peerorg"
for initial peer org. - Removed
.Values.orderer_org_name
&.Values.peer_org_name
since this is now handled in.Values.organizations
array. - Removed
.Values.anchorPeers
since this can be handled under.Values.organizations
array. - Removed
.Values.orderer_port
since it is not used anywhere. - Removed
.Values.orderer_identities
since this can be handled under.Values.organizations
array. - Modified
.Values.tls.ca_endpoint
to.Values.tlsca_endpoint
and.Values.tls.cert_path
will be handled by default values.
Chart : fabric-orderer
- Modified
.Values.global.enroll_on_every_pod_recreation
to.Values.global.require_certs_dir_persistence
which is more readable. This can be set per orderer or globally. - Changed
.Values.block_file
to.Values.global.block_file
. This can be overridden using.block_file
per orderer when deploying new orderers with different genesis blockfile. - Added
.tls_cert_archive
field per orderer incase if the orderer want to use a non-defaulttls_cert_archive
file from the filestore. Default is<orderer-identity>-tls-certs.tar.gz
in the filestore. - Added
.renew_orderer_certs
for re-generating certs. This will delete the existing certs and do new enrollment on pod startup. - Added
.use_existing_pvc_data
, this option will allow you to use an existing pvc for your orderer. This only handles the kubernetes part of mouting an existing pvc to the falcon managed orderer. But it is your responsibility to make sure that data inside the existing pvc matching to the new orderer in terms of all other configurations. - Ingress resource is now optional, you can turn it off using
ingressEnabled
true/false globally or per orderer. - Modified
.Values.ca.ica_endpoint
to.Values.global.ica_endpoint
- Modified
.Values.ca.tlsca_endpoint
to.Values.global.tlsca_endpoint
- Removed env variable
ORDERER_GENERAL_LOCALMSPID
from values file and added new parameter.Values.MspIdOverride
if you want to override the default value, which is.Values.nameOverride
. This env is now part of deployment template. - Removed env variable
ORDERER_GENERAL_GENESISFILE
from values file since this value needs to be customised per orderer using (.block_file). This env is now part of deployment template. - Added new field
.additionalEnvironmentVars
for indiviaul orderes if required to add custom env variable unique to orderers. livenessprobe, readinessprobes & startupprobes
can now be handled per orderer or to Chart default from.Values.livenessprobe
,.Values.readinessprobes
&.Values.startupprobes
.affinities, tolerations, nodeselectors & resources
can also be handled per orderer or globally using.Values.global.affinities
etc.- To disable default livenessprobe, use
.disableDefaultLivenessProbe
per orderer or under.Values.global.disableDefaultLivenessProbe
. Similarly, use `disableDefaultStartupPr...
Falcon:v1.0.2
v1.0.2 features:
- Peers & Orderes charts
- Added a new feature to skip msp/tls enrollments on every pod recreation through the boolean variable
enroll_on_every_pod_recreation
. If set totrue
, (by default) then deployment/sts will use an emptydir ephemeral volume for storing the certs and on every pod re-creation the init container performs the enrollment. If set tofalse
, a pvc will be created from the given storageclass and stores the certificates there. On pod recreation, the init script checks the existence of the certs and skip the enrollment if the the certs exists. - This will remove the dependency on the CA Server when a peer/orderer pod gets recreated due to any node failure. (But for the very first deployment, the CA server end-point should be available.)
- Added a new feature to skip msp/tls enrollments on every pod recreation through the boolean variable
- Filestore chart
- Added custom hostname/fqdn support for the filestore endpoint. This will remove the dependency on running filestore end-point with the same HLF domain. You can override the default chart generated filestore endpoint with any resolvable dns (If you have one already) using the
.Values.hostOverride
with your own FQDN. - Added optional TLS support for the filestore ingress resource. To do that, create a kubenetes secret of tls type and provide it here in
.Values.ingress.tls.secretName
- Added custom hostname/fqdn support for the filestore endpoint. This will remove the dependency on running filestore end-point with the same HLF domain. You can override the default chart generated filestore endpoint with any resolvable dns (If you have one already) using the
- Peer
- New option to renew peer certificates. Set
.Values.renew_peer_certs: true
to delete the existing certificates and generate new certs through an enrollment. Once the certs got renewed, change this to false again via a helm upgrade. Make this to true only when you want to renew the certs. - Added a feature to use existing PVCs for peer,dind & couchdb containers. So that falcon can be integrated into an already running peer without any data lose if it was not managed through falcon peer charts. Use the following vars under
.Values.peers
array to specify the existing volumes per peer OR you can add it under.Values.global
for all peers. Do a comparison by runninghelm template
and verify the output before you deploy it. The volume name prefix under thevolumeClaimTemplates.metadata.name
of your sts must match with the existing pvc.
Example:
- New option to renew peer certificates. Set
peers:
- name: peer0
identity_name: peer0-org
identity_secret: peer0orgSamplePassword
couchUseExistingPvcPrefix: couch-pvc
peerUseExistingPvcPrefix: peer-pvc
dindUseExistingPvcPrefix: dind-pvc
By specifying the above values, the chart assumes that a pvc exists already with the name couch-pvc-peer0-org-0
for the peer0
.
Falcon:v1.0.1
- Standardized all storage-class to "standard" in the example setup. Previously it was a mix of standard & standard-rwo.
- Updated Orderers / Tools charts to support StorageClass value to be passed from values file. Previously it was hard coded.
- Added additional ENV variable support on Peer / Orderer charts. Now you can add additional ENV variables of individual pods from values file.
- Added NodeSelector, Affinity, Tolerations, Resources, Probes, SecurityContext to Peer charts. Some of them were hard coded in 1.0.0 version.
- Fixed Imagepullpolicy value mapping on all charts. Few of them were hard coded previously.
Falcon:v1.0.0
Falcon - the hyperledger fabric deployment helper for Kubernetes is an open-source project designed to streamline the deployment and management of Hyperledger Fabric based blockchain networks on Kubernetes clusters. This tool simplifies the complex process of setting up, configuring, and maintaining Fabric nodes, peers, orderers, and channels within a Kubernetes environment. With templatised helm charts and customizable configuration options, the project empowers developers and administrators to effortlessly deploy and scale secure and robust Hyperledger Fabric networks, leveraging the flexibility and scalability of Kubernetes orchestration.
Features
- CA Management (Root CA, TLS CA & Intermediate CAs)
- Peer Creation
- Orderer Creation
- Channel Management
- Chaincode Lifecycle Management (Install, Approve, Commit and CC Upgrades)
- Cryptographic operations support and certification management
- Domain Name support and SNI Based Routing
- Ingress resource provisioning
- File Registry support for centralised config files
- Support for Hyperledger Fabric 2.3+
- Multi-zone, Multi-DC, Private Network (On-prem DCs) deployment support