HLF K8S A hitchhiker s guide to deploying Hyperledger Fabric on Kubernetes

Transcription

1 HLF K8S A hitchhiker s guide to deploying Hyperledger Fabric on Kubernetes Alejandro (Sasha) Vicente Grabovetsky, CTO & Chief Data Scientist, AID:Tech Nicola Paoli, Lead Blockchain Engineer, AID:Tech

2 Sasha AID:Tech, CTO Sasha develops Blockchain solutions that can be easily deployed on the cloud using Kubernetes and Helm. Sasha used to be a Cognitive Neuroscientist at Cambridge, and has won international awards for science and technology communication. Nicola AID:Tech, Lead Blockchain Engineer Nicola is focused on developing business blockchain solutions on Hyperledger. Nicola has submitted multiple improvements to the Hyperledger Composer codebase, notably a feature enabling the use of an API-key to access the REST server.

3 4 steps to greatness with HLF & K8S 1 Hyperledger Fabric Hyperledger Fabric project and how the components interact. 2 Kubernetes Kubernetes framework, Helm Charts and basic building blocks. 3 4 Deploying Hyperledger Fabric to Kubernetes Step by step deployment of a network using CA, Orderer and Peers Helm Charts. Next Steps We discuss our upcoming Helm Charts, future improvements and how to contribute.

4 HLF hearts K8S Fabric CA Fabric Certificate Authority registration & enrolls identities Fabric Orderer Fabric Ordering service provides consensus for development (solo) and production (Kafka) networks. Fabric Peer Fabric Peer maintains the blockchain by communicating with the Ordering service.

5 Hyperledger Fabric Super-saiyan of permissioned blockchain

6 Hyperledger Fabric Fabric is a framework under the Hyperledger project. It allows building permissioned blockchain networks.

7 Hyperledger Fabric requires 3 types of nodes to be deployed in production Fabric Certificate Authority registration & enrolls identities Fabric Ordering service provides consensus for development (solo) and production (Kafka) networks. Fabric Peer maintains the blockchain by communicating with the Ordering service.

8 Certificate Authority Fabric CA manages identities, since it: Registers identities Issues ECerts Renews & revokes certs

9 Ordering service The Ordering service typically consists of a set of Orderer nodes establishing consensus by exchanging messages via a Kafka cluster

10 Peer Peers are the only nodes that actually store the blockchain ledger We can attach CouchDB to hold and query the blockchain world-state fabric.readthedocs.io/en/release- 1.2/peers/peers.html

11 Kubernetes I can haz cloud

12 Kubernetes Kubernetes is a system for orchestrating the deployment and management of containers (e.g. Docker)

13 To work with Kubernetes, we need to understand 3 core concepts The Kubernetes cluster manages a set of abstractions that make it easier to orchestrate containers Charts are package together Kubernetes component templates acting as a cookie cutter Helm (and its server-side Tiller) allow us to install Charts

14 Kubernetes cluster Kubernetes (K8S) allows us to group, deploy, scale, selfheal and connect to containers K8S orchestrates containers

15 Charts Charts are bundles of templates defining Kubernetes components You can browse these at Kubeapps Hub

16 Helm Helm allows you to package, search and deploy Charts Its server-side component, Tiller, manages the deployment on K8S

17 Before we start, you will need 3 things Set up the Kubernetes cluster and install Helm/Tiller on it Obtain a (free/cheap) domain name for your cluster Download our repository on

18 Install Ingress controller and cert manager helm install stable/nginx-ingress -n nginx-ingress --namespace ingresscontroller helm install stable/cert-manager -n cert-manager --namespace cert-manager kubectl create -f./extra/certmanagerci_staging.yaml kubectl create -f./extra/certmanagerci_production.yaml

19 Deploying HLF on K8S Let s get this party started, right meow!

20 HLF hearts K8S Fabric CA Fabric Certificate Authority registration & enrolls identities Fabric Orderer Fabric Ordering service provides consensus for development (solo) and production (Kafka) networks. Fabric Peer Fabric Peer maintains the blockchain by communicating with the Ordering service.

21 Fabric CA All your certificates are belong to you

22 Fabric CA Install CA Database Helm Chart Install Fabric CA Helm Chart Generate Fabric CA Identity Obtain Crypto Material Save Crypto Material to K8S Generate Genesis and Channel

23 Install CA database Helm Chart Install CA Database Helm Chart Install Fabric CA Helm Chart helm install stable/postgresql -n ca-pg --namespace blockchain -f./helm_values/ca-pg_values.yaml Generate Fabric CA Identity Obtain Crypto Material Save Crypto Material to K8S Generate Genesis and Channel

24

25 Install Fabric CA Helm Chart Install CA Database Helm Chart Install Fabric CA Helm Chart Generate Fabric CA Identity Obtain Crypto Material helm install stable/hlf-ca -n ca --namespace blockchain -f./helm_values/ca_values.yaml CA_POD=$(kubectl get pods -n blockchain -l "app=hlfca,release=ca" -o jsonpath="{.items[0].metadata.name}") kubectl logs -n blockchain $CA_POD grep 'Listening on' Save Crypto Material to K8S Generate Genesis and Channel

26

27

28 Generate Fabric CA identity Install CA Database Helm Chart Install Fabric CA Helm Chart Generate Fabric CA Identity Obtain Crypto Material Save Crypto Material to K8S kubectl exec -n blockchain $CA_POD -- cat /var/hyperledger/fabric-ca/msp/signcerts/cert.pem kubectl exec -n blockchain $CA_POD -- bash -c 'fabric-ca-client enroll -d -u CA_INGRESS=$(kubectl get ingress -n blockchain -l "app=hlfca,release=ca" -o jsonpath="{.items[0].spec.rules[0].host}") curl Generate Genesis and Channel

29 Obtain crypto material Install CA Database Helm Chart Install Fabric CA Helm Chart Generate Fabric CA Identity Obtain Crypto Material Save Crypto Material to K8S FABRIC_CA_CLIENT_HOME=./config fabric-ca-client getcacert -u -M./AidTechMSP kubectl exec -n blockchain $CA_POD -- fabric-ca-client register -- id.name org-admin --id.secret OrgAdm1nPW --id.attrs 'admin=true:ecert' FABRIC_CA_CLIENT_HOME=./config fabric-ca-client enroll -u -M./AidTechMSP mkdir -p./config/aidtechmsp/admincerts cp./config/aidtechmsp/signcerts/*./config/aidtechmsp/admincerts Generate Genesis and Channel

30

31 Save crypto-material to K8S Install CA Database Helm Chart Install Fabric CA Helm Chart Generate Fabric CA Identity Obtain Crypto Material Save Crypto Material to K8S ORG_CERT=$(ls./config/AidTechMSP/admincerts/cert.pem) kubectl create secret generic -n blockchain hlf--org-admincert --from-file=cert.pem=$org_cert ORG_KEY=$(ls./config/AidTechMSP/keystore/*_sk) kubectl create secret generic -n blockchain hlf--org-adminkey --from-file=key.pem=$org_key Generate Genesis and Channel

32

33

34

35 Generate genesis & channel Install CA Database Helm Chart Install Fabric CA Helm Chart Generate Fabric CA Identity Obtain Crypto Material Save Crypto Material to K8S Generate Genesis and Channel cd./config configtxgen -profile OrdererGenesis -outputblock./genesis.block configtxgen -profile MyChannel -channelid mychannel - outputcreatechanneltx./mychannel.tx kubectl create secret generic -n blockchain hlf--genesis --fromfile=genesis.block kubectl create secret generic -n blockchain hlf--channel --fromfile=mychannel.tx

36 Fabric Orderer Chuck Norris consensus is nuclear-striketolerant

37 Fabric Orderer Install Kafka Helm Chart Install Fabric Orderer Helm Chart Setup Orderer Identity

38 Install Kafka Helm Chart Install Kafka Helm Chart Install Fabric Orderer Helm Chart helm install incubator/kafka -n kafka-hlf -- namespace blockchain -f./helm_values/kafkahlf_values.yaml Setup Orderer Identity

39

40

41 Install Fabric Orderer Helm Chart Install Kafka Helm Chart Install Fabric Orderer Helm Chart Setup Orderer Identity export NUM=1 helm install stable/hlf-ord -n ord${num} -- namespace blockchain -f./helm_values/ord${num}_values.yaml

42

43 Setup Orderer Identity Install Kafka Helm Chart Install Fabric Orderer Helm Chart Setup Orderer Identity ORD_SECRET=$(kubectl get secret -n blockchain ord${num}-hlf-ord -o jsonpath="{.data.ca_password}" base64 --decode) kubectl exec $CA_POD -n blockchain -- fabric-ca-client register -- id.name ord${num} --id.secret $ORD_SECRET --id.type orderer ORD_POD=$(kubectl get pods -n blockchain -l "app=hlford,release=ord${num}" -o jsonpath="{.items[0].metadata.name}") kubectl logs -n blockchain $ORD_POD grep 'completeinitialization'

44 Fabric Peer Ledgers, ledgers everywhere...

45 Fabric Peer Install CouchDB Helm Chart Install Fabric Peer Helm Chart Setup Peer Identity Create Channel Fetch and Join Channel

46 Install CouchDB Helm Chart Install CouchDB Helm Chart Install Fabric Peer Helm Chart Setup Peer Identity Create Channel Fetch and Join Channel export NUM=1 helm install stable/hlf-couchdb -n cdb-peer${num} --namespace blockchain -f./helm_values/cdb-peer${num}_values.yaml CDB_POD=$(kubectl get pods -n blockchain -l "app=hlfcouchdb,release=cdb-peer${num}" -o jsonpath="{.items[*].metadata.name}") kubectl logs -n blockchain $CDB_POD grep 'Apache CouchDB has started on'

47

48 Install Fabric Peer Helm Chart Install CouchDB Helm Chart Install Fabric Peer Helm Chart helm install stable/hlf-peer -n peer${num} -- namespace blockchain -f./helm_values/peer${num}_values.yaml Setup Peer Identity Create Channel Fetch and Join Channel

49

50 Setup Peer Identity Install CouchDB Helm Chart Install Fabric Peer Helm Chart Setup Peer Identity Create Channel PEER_SECRET=$(kubectl get secret -n blockchain peer${num}-hlfpeer -o jsonpath="{.data.ca_password}" base64 --decode) kubectl exec -n blockchain $CA_POD -- fabric-ca-client register -- id.name peer${num} --id.secret $PEER_SECRET --id.type peer PEER_POD=$(kubectl get pods -n blockchain -l "app=hlfpeer,release=peer${num}" -o jsonpath="{.items[0].metadata.name}") kubectl logs -n blockchain $PEER_POD grep 'Starting peer' Fetch and Join Channel

51 Create Channel Install CouchDB Helm Chart Install Fabric Peer Helm Chart Setup Peer Identity kubectl exec -n blockchain $PEER_POD -- peer channel create -o ord1-hlford.blockchain.svc.cluster.local:7050 -c mychannel -f /hl_config/channel/mychannel.tx Create Channel Fetch and Join Channel

52 Fetch & Join Channel Install CouchDB Helm Chart Install Fabric Peer Helm Chart Setup Peer Identity Create Channel kubectl exec -n blockchain $PEER_POD -- peer channel fetch config /var/hyperledger/mychannel.block -c mychannel -o ord1-hlford.blockchain.svc.cluster.local:7050 kubectl exec -n blockchain $PEER_POD -- bash -c 'CORE_PEER_MSPCONFIGPATH=$ADMIN_MSP_PATH peer channel join -b /var/hyperledger/mychannel.block' kubectl exec -n blockchain $PEER_POD -- peer channel list Fetch and Join Channel

53 Next Steps To boldly go where no geek has gone before

54 Coming soon... EdX chapter The updated EdX course Blockchain for Business will feature our chapter on Hyperledger Composer Packt course We have released a course on Packt and Udemy on Hyperledger Fabric and Composer: Hyperledger for Blockchain Applications HGF presentations Nicola and Sasha will be speaking at Hyperledger Global Forum, related to deployment and our POC in Tanzania Composer chart We will soon be releasing an extra Chart for deploying Hyperledger Composer on Kubernetes

55 Community Stewardship and Technical, Legal, Marketing, Organizational Infrastructure Frameworks Permissionable smart contract machine (EVM) Permissioned with channel support Decentralized identity Mobile application focus Permissioned & permissionless support; EVM transaction family Tools Blockchain framework benchmark platform As-a-service deployment Model and build blockchain networks View and explore data on the blockchain Ledger interoperability

56 Questions? Alejandro (Sasha) Vicente Grabovetsky AID:Tech - CTO sasha@aid.technology Nicola Paoli AID:Tech - Lead Blockchain Engineer nicola@aid.technology