Installation Instructions

This section provides an overview of the steps necessary to launch CAT-BM v1.10 for the Canton Network.

Prerequisites

Set up a Kubernetes or OpenShift cluster

Supported Kubernetes version: 1.21 and later.

We recommend AWS (EKS) or Google Cloud (GKE), but you can install on a standalone cluster as well.

Define your cluster size considering the following minimum requirements:

Catalyst Blockchain Manager Canton service (1 instance):

2 core CPU
4 GB RAM
10 GB disk space

Per additional node (Domain, Participant, or Application):

Node

CPUe

Memory (Gi)

Storage (Gi)

Domain

Participant

Application

When deciding on cluster size, consider the expected load of the nodes and increase these values accordingly.

Install Helm to your workstation

Installation guide: https://helm.sh/docs/intro/install/

No customization is needed.

Supported Helm version: 3.X

Install Traefik ingress

The ingress-controller is needed for traffic routing to expose nodes (domains & applications). Catalyst creates an IngressRoute CRD that is automatically started and deleted along with each application.

Installation guide: https://github.com/traefik/traefik-helm-chart

No customization is needed. The default port (:443) for HTTPS traffic will be used.

We recommend installing Traefik to a separate namespace from the application.

Supported Traefik version: 2.3

Install cert-manager for TLS certificates

TLS certificate is needed for secured communication between a user and the Catalyst Blockchain Manager Canton service.

Installation guide: https://cert-manager.io/docs/installation/helm/

You can skip this step and specify your TLS certificate and key as a Kubernetes secret in Helm chart values instead. See the Kubernetes secret documentation.

Create a wildcard DNS A-record

Catalyst needs a wildcard record *.<domain> to expose nodes. All created nodes (domains, participants, applications) will have a <NodeName>.<domainName> address.

For AWS (Route 53):

Go to the Route53 service.
Create a new domain or choose an existing domain.
Create an A record.
Switch Alias to ON.
In Route traffic to, select "Alias to application and classic load balancer."
Select your region.
Select an ELB balancer from the drop-down list.

How to find your ELB

Choose the ELB balancer that was automatically configured during Traefik chart installation:

kubectl get svc -n ${ingress-namespace}

Where ${ingress-namespace} is the name of the namespace where the ingress was installed. The ELB is displayed in the EXTERNAL-IP field.

Create a namespace

kubectl create ns ${ns_name}

Where ${ns_name} is the name of the namespace (can be any value).

Add the Helm repository

7.1 — Get credentials to the Helm repository in JFrog Artifactory from the IntellectEU admin team.

7.2 — Add the repo to Helm:

helm repo add catbp https://intellecteu.jfrog.io/artifactory/catbp-helm \
  --username ${ARTIFACTORY_USERNAME} \
  --password ${ARTIFACTORY_PASSWORD}

Expected result: "catbp" has been added to your repositories

Create an ImagePullSecret

kubectl create secret intellecteu-jfrog-access regcred \
  --docker-server=intellecteu-catbp-docker.jfrog.io \
  --docker-username=${your-name} \
  --docker-password=${your-password} \
  --docker-email=${your-email} \
  -n ${ns_name}

If you want to use a readiness check and a private repository for the image, create a Kubernetes secret. See: Kubernetes pull image from private registry

Set up Keycloak realm or Auth0 tenant

Download the realm.json file and import it to create the necessary clients, scopes, and users in your Keycloak realm.

User roles canton_viewer & canton_writer will be evaluated by the Catalyst Blockchain Manager Canton service.

(Optional) Set up Monitoring & Dashboard

Install the kube-prometheus-stack on your cluster.

Once installed, configure Keycloak OAuth2 authentication on Grafana following the Grafana Keycloak documentation.

A default dashboard JSON file is available for import in Grafana.

Enter License Key

Request a license key and set it in the Helm chart values.

Setup

Configure Helm Chart Values

Full list of Helm chart values

# -- address where application will be hosted.
domainName: ""

auth:
  enabled: true
  keycloak:
    enabled: true
  keycloakUrl: ""
  keycloakRealm: ""
  # Configure below only if keycloak.enabled=false
  url: ""
  client:
    idApiOperator: ""
    idUI: ""
    secret: ""
    externalSecret:
      enabled: false
      remoteSecretRef: ""
      secretStoreRef:
        name: ""
        kind: "SecretStore"

rbac:
  enabled: true
  serviceAccountName: canton-console
  automountServiceAccountToken: false

operator:
  replicaCount: 1
  image:
    repository: intellecteu-catbp-docker.jfrog.io/catbp/canton/canton-operator
    pullPolicy: IfNotPresent
    tag: ""
  imagePullSecrets: []
  resources: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}
  keycloakClient:
    secret: ""
    externalSecret:
      enabled: false
      remoteSecretRef: ""
      secretStoreRef:
        name: ""
        kind: "SecretStore"
  probes:
    enabled: true
    livenessProbe:
      initialDelaySeconds: 60
      periodSeconds: 10
      timeoutSeconds: 1
      successThreshold: 1
      failureThreshold: 3
    readinessProbe:
      initialDelaySeconds: 40
      periodSeconds: 10
      timeoutSeconds: 1
      successThreshold: 1
      failureThreshold: 5

api:
  darsPvc:
    enabled: true
    size: 5Gi
    mountPath: /dars-storage
    storageClass: ""
  environment: "dev"
  replicaCount: 1
  image:
    repository: intellecteu-catbp-docker.jfrog.io/catbp/canton/canton-console
    pullPolicy: IfNotPresent
    tag: ""
  imagePullSecrets: []
  service:
    port: 8080
    portName: http
  resources: {}
  nodeSelector: {}
  keycloakClient:
    secret: ""
    externalSecret:
      enabled: false
      remoteSecretRef: ""
      secretStoreRef:
        name: ""
        kind: "SecretStore"
  probes:
    enabled: true
    livenessProbe:
      initialDelaySeconds: 90
      periodSeconds: 10
      timeoutSeconds: 3
      successThreshold: 1
      failureThreshold: 3
    readinessProbe:
      initialDelaySeconds: 60
      periodSeconds: 10
      timeoutSeconds: 10
      successThreshold: 1
      failureThreshold: 5
  licenseKey:
    key: ""
    secret:
      enabled: false
      name: ""
      key: ""
  ledgerAuth:
    auth0:
      enabled: false
      domain: ""
      apiIdentifier: ""
      clientId: ""
      clientSecret: ""

ui:
  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 5
    targetCPUUtilizationPercentage: 80
  replicaCount: 1
  image:
    repository: intellecteu-catbp-docker.jfrog.io/catbp/canton/canton-console-ui
    pullPolicy: IfNotPresent
    tag: ""
  imagePullSecrets: []
  service:
    port: 80
    portName: http
  resources: {}
  nodeSelector: {}
  keycloakClient:
    id: ""

ingressConfig:
  provider:
    name: traefikCRD
    traefikCRD:
      tlsStore:
        enabled: false
        name: default
  enabled: false
  tls:
    enabled: false
    certManager:
      enabled: false
      email: ""
      server: "https://acme-staging-v02.api.letsencrypt.org/directory"
    secretName: ""
  stripApplicationPrefix:
    enabled: true
    regex:
      - "/.*(/api)?/"

monitoring:
  enabled: false
  serviceMonitor:
    interval: 30s
  prometheusRules:
    enabled: false
    labels: {}
  grafana:
    enabled: false
    url: ""
    user: admin
    email: admin@domain.com
    clusterDashboard: ""
    service:
      name: grafana
      namespace: monitoring
      port: 80

Install the Catalyst Blockchain Manager Canton Service

helm upgrade --install ${canton_release_name} catbp/canton-console \
  --values values.yaml \
  -n ${ns_name}

Where:

${canton_release_name} — name of the release (any name/alias)
catbp/canton-console — chart name ("catbp" is the repo, "canton-console" is the chart)
values.yaml — your values file
${ns_name} — the namespace created earlier

Verify the installation:

helm ls                  # Check "status" field — should show "deployed"
kubectl get pods         # All pod statuses must be "Running"

PreviousOperations Guide NextOpen Source Licenses

Last updated 2 months ago

Was this helpful?