Skip to content

Commit 8605874

Browse files
dviejokfsdviejokfs
authored
Hashicorp Vault Integration (#260)
* Start the implementation of Hashicorp Vault for bevel operator fabric Signed-off-by: David VIEJO <[email protected]> * Update in implementation vault Signed-off-by: dviejokfs <[email protected]> * CA controller integration with Hashicorp Vault Signed-off-by: dviejokfs <[email protected]> * Modify types for impl Signed-off-by: dviejokfs <[email protected]> * Progress on HLF vault Signed-off-by: David VIEJO <[email protected]> * Update Signed-off-by: dviejokfs <[email protected]> * Implement vault in identity_controller Signed-off-by: dviejokfs <[email protected]> * Update Signed-off-by: David VIEJO <[email protected]> * Update Signed-off-by: dviejokfs <[email protected]> * Fix go.mod/go.sum Signed-off-by: dviejokfs <[email protected]> * Update Signed-off-by: dviejokfs <[email protected]> * Update Signed-off-by: David VIEJO <[email protected]> * Update Signed-off-by: David VIEJO <[email protected]> * Fix tests Signed-off-by: David VIEJO <[email protected]> * Fix tests Signed-off-by: David VIEJO <[email protected]> * Fix tests Signed-off-by: David VIEJO <[email protected]> * Update Signed-off-by: David VIEJO <[email protected]> * Enhance Fabric CA configuration by making replicas field nullable and updating related logic - Updated the Fabric CA CRD to allow the `replicas` field to be nullable, providing more flexibility in deployment configurations. - Modified the peer controller to use `Caname` instead of `Enrollid` for naming enroll requests. - Refactored the credential store handling in the crypto material creation function to use a switch statement for better clarity and maintainability. These changes improve the usability and robustness of the Fabric CA deployment and its associated components. Signed-off-by: David VIEJO <[email protected]> * Fix tests Signed-off-by: David VIEJO <[email protected]> * Update dependencies and remove unused client examples - Added `golang.org/x/oauth2` and `github.com/consensys/gnark-crypto` to `go.mod`. - Removed unused Go and Node.js client example files, including `main.go`, `connection-org.yaml`, and related scripts. - Cleaned up `go.mod` and `go.sum` by deleting unnecessary entries. These changes streamline the project by updating dependencies and removing obsolete client implementations. Signed-off-by: David VIEJO <[email protected]> * Update dependencies in go.mod and go.sum - Removed unused versions of `golang.org/x/oauth2` and `github.com/consensys/gnark-crypto`. - Added indirect dependencies for `github.com/bits-and-blooms/bitset`, `github.com/consensys/bavard`, and updated `github.com/consensys/gnark-crypto` to v0.12.1. - Updated `golang.org/x/oauth2` to v0.27.0. These changes streamline the dependency management and ensure compatibility with the latest versions. Signed-off-by: David VIEJO <[email protected]> * Update Signed-off-by: David VIEJO <[email protected]> --------- Signed-off-by: David VIEJO <[email protected]> Signed-off-by: dviejokfs <[email protected]>
1 parent 886ab2c commit 8605874

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+3688
-1741
lines changed

‎.github/workflows/test-kubectl-plugin.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,7 @@ jobs:
173173
export CA_IMAGE=hyperledger/fabric-ca
174174
export CA_VERSION=1.5.13
175175
176-
kubectl hlf ca create --image=$CA_IMAGE --version=$CA_VERSION --storage-class=standard --capacity=2Gi --name=org1-ca \
176+
kubectl hlf ca create --credential-store=kubernetes --image=$CA_IMAGE --version=$CA_VERSION --storage-class=standard --capacity=2Gi --name=org1-ca \
177177
--enroll-id=enroll --hosts=org1-ca.localho.st --enroll-pw=enrollpw
178178
kubectl wait --timeout=240s --for=condition=Running fabriccas.hlf.kungfusoftware.es --all
179179
@@ -182,7 +182,7 @@ jobs:
182182
--enroll-id enroll --enroll-secret=enrollpw --mspid Org1MSP
183183
184184
185-
kubectl hlf peer create --statedb=couchdb --image=$PEER_IMAGE --version=$PEER_VERSION \
185+
kubectl hlf peer create --credential-store=kubernetes --statedb=couchdb --image=$PEER_IMAGE --version=$PEER_VERSION \
186186
--storage-class=standard --enroll-id=peer --mspid=Org1MSP \
187187
--enroll-pw=peerpw --hosts=peer0-org1.localho.st --capacity=5Gi --name=org1-peer0 --ca-name=org1-ca.default
188188
kubectl wait --timeout=240s --for=condition=Running fabricpeers.hlf.kungfusoftware.es --all
@@ -194,14 +194,14 @@ jobs:
194194
export CA_IMAGE=hyperledger/fabric-ca
195195
export CA_VERSION=1.5.13
196196
197-
kubectl hlf ca create --image=$CA_IMAGE --version=$CA_VERSION --storage-class=standard --capacity=2Gi --name=ord-ca \
197+
kubectl hlf ca create --credential-store=kubernetes --image=$CA_IMAGE --version=$CA_VERSION --storage-class=standard --capacity=2Gi --name=ord-ca \
198198
--enroll-id=enroll --enroll-pw=enrollpw --hosts=ord-ca.localho.st
199199
200200
kubectl wait --timeout=240s --for=condition=Running fabriccas.hlf.kungfusoftware.es --all
201201
kubectl hlf ca register --name=ord-ca --user=orderer --secret=ordererpw \
202202
--type=orderer --enroll-id enroll --enroll-secret=enrollpw --mspid=OrdererMSP
203203
204-
kubectl hlf ordnode create --image=$ORDERER_IMAGE --version=$ORDERER_VERSION \
204+
kubectl hlf ordnode create --credential-store=kubernetes --image=$ORDERER_IMAGE --version=$ORDERER_VERSION \
205205
--storage-class=standard --enroll-id=orderer --mspid=OrdererMSP --hosts=orderer0-ord.localho.st --admin-hosts=admin-orderer0-ord.localho.st \
206206
--enroll-pw=ordererpw --capacity=2Gi --name=ord-node1 --ca-name=ord-ca.default
207207
kubectl wait --timeout=240s --for=condition=Running fabricorderernodes.hlf.kungfusoftware.es --all

‎.github/workflows/test.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ jobs:
77
test:
88
strategy:
99
matrix:
10-
go-version: [ 1.23.1 ]
10+
go-version: [ 1.23.5 ]
1111
os: [ ubuntu-latest ]
1212
runs-on: ${{ matrix.os }}
1313
steps:

‎README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -222,13 +222,13 @@ EOF
222222

223223
```bash
224224
export PEER_IMAGE=hyperledger/fabric-peer
225-
export PEER_VERSION=3.0.0
225+
export PEER_VERSION=3.1.0
226226

227227
export ORDERER_IMAGE=hyperledger/fabric-orderer
228-
export ORDERER_VERSION=3.0.0
228+
export ORDERER_VERSION=3.1.0
229229

230230
export CA_IMAGE=hyperledger/fabric-ca
231-
export CA_VERSION=1.5.13
231+
export CA_VERSION=1.5.15
232232
```
233233

234234
### Configure Internal DNS

‎config/crd/bases/hlf.kungfusoftware.es_fabriccas.yaml

Lines changed: 129 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -647,13 +647,13 @@ spec:
647647
attrs:
648648
properties:
649649
hf.AffiliationMgr:
650-
default: true
650+
default: false
651651
type: boolean
652652
hf.GenCRL:
653-
default: true
653+
default: false
654654
type: boolean
655655
hf.IntermediateCA:
656-
default: true
656+
default: false
657657
type: boolean
658658
hf.Registrar.Attributes:
659659
default: '*'
@@ -665,7 +665,7 @@ spec:
665665
default: '*'
666666
type: string
667667
hf.Revoker:
668-
default: true
668+
default: false
669669
type: boolean
670670
required:
671671
- hf.AffiliationMgr
@@ -826,6 +826,12 @@ spec:
826826
- enabled
827827
- origins
828828
type: object
829+
credentialStore:
830+
default: kubernetes
831+
enum:
832+
- kubernetes
833+
- vault
834+
type: string
829835
db:
830836
properties:
831837
datasource:
@@ -1050,6 +1056,7 @@ spec:
10501056
type: object
10511057
replicas:
10521058
default: 1
1059+
nullable: true
10531060
type: integer
10541061
resources:
10551062
properties:
@@ -1336,13 +1343,13 @@ spec:
13361343
attrs:
13371344
properties:
13381345
hf.AffiliationMgr:
1339-
default: true
1346+
default: false
13401347
type: boolean
13411348
hf.GenCRL:
1342-
default: true
1349+
default: false
13431350
type: boolean
13441351
hf.IntermediateCA:
1345-
default: true
1352+
default: false
13461353
type: boolean
13471354
hf.Registrar.Attributes:
13481355
default: '*'
@@ -1354,7 +1361,7 @@ spec:
13541361
default: '*'
13551362
type: string
13561363
hf.Revoker:
1357-
default: true
1364+
default: false
13581365
type: boolean
13591366
required:
13601367
- hf.AffiliationMgr
@@ -1546,6 +1553,120 @@ spec:
15461553
required:
15471554
- entryPoints
15481555
type: object
1556+
vault:
1557+
nullable: true
1558+
properties:
1559+
request:
1560+
properties:
1561+
pki:
1562+
type: string
1563+
role:
1564+
type: string
1565+
ttl:
1566+
default: 8760h
1567+
type: string
1568+
userIDs:
1569+
default: []
1570+
items:
1571+
type: string
1572+
nullable: true
1573+
type: array
1574+
required:
1575+
- pki
1576+
- role
1577+
type: object
1578+
vault:
1579+
properties:
1580+
authPath:
1581+
default: kubernetes
1582+
nullable: true
1583+
type: string
1584+
backend:
1585+
default: kv
1586+
type: string
1587+
caCert:
1588+
type: string
1589+
clientCert:
1590+
type: string
1591+
clientKey:
1592+
properties:
1593+
key:
1594+
type: string
1595+
name:
1596+
type: string
1597+
namespace:
1598+
type: string
1599+
required:
1600+
- key
1601+
- name
1602+
- namespace
1603+
type: object
1604+
kvVersion:
1605+
default: 2
1606+
type: integer
1607+
maxRetries:
1608+
default: 2
1609+
type: integer
1610+
path:
1611+
nullable: true
1612+
type: string
1613+
role:
1614+
nullable: true
1615+
type: string
1616+
secretIdSecretRef:
1617+
nullable: true
1618+
properties:
1619+
key:
1620+
type: string
1621+
name:
1622+
type: string
1623+
namespace:
1624+
type: string
1625+
required:
1626+
- key
1627+
- name
1628+
- namespace
1629+
type: object
1630+
serverCert:
1631+
nullable: true
1632+
type: string
1633+
serverName:
1634+
type: string
1635+
serviceAccountTokenPath:
1636+
nullable: true
1637+
type: string
1638+
timeout:
1639+
default: 30s
1640+
type: string
1641+
tlsSkipVerify:
1642+
default: false
1643+
type: boolean
1644+
tokenSecretRef:
1645+
nullable: true
1646+
properties:
1647+
key:
1648+
type: string
1649+
name:
1650+
type: string
1651+
namespace:
1652+
type: string
1653+
required:
1654+
- key
1655+
- name
1656+
- namespace
1657+
type: object
1658+
url:
1659+
type: string
1660+
required:
1661+
- maxRetries
1662+
- timeout
1663+
- tlsSkipVerify
1664+
- url
1665+
type: object
1666+
required:
1667+
- request
1668+
- vault
1669+
type: object
15491670
version:
15501671
minLength: 1
15511672
type: string
@@ -1558,7 +1679,6 @@ spec:
15581679
- hosts
15591680
- image
15601681
- metrics
1561-
- replicas
15621682
- resources
15631683
- rootCA
15641684
- service

0 commit comments

Comments
 (0)