Ctrlk
Support Center
For the complete documentation index, see llms.txt. This page is also available as Markdown.
ChatGPT

Create Validator with Integrated Keycloak

This guide is for the Default authentication option with integrated Keycloak. To set up a validator with a custom identity provider, see Create Validator with Custom Identity Provider.

Validator Management

Validators can be deployed on Catalyst and seamlessly connected to the Canton Network.

Set Up a Validator

To set up a Validator, go to the Validators tab and click the Set up validator button to open a side window.

For further details, expand the collapsible "More Info" sections on each step.

1

Main Settings Configuration

Provide the following information:

  • Name

  • Onboard secret

  • Image tag

  • Image repo

  • Image pull secret

  • Postgres user

  • Postgres password

More info about these fields
Field
Description

Name

The identifier or label for the validator node

Onboard secret

Passphrase obtained from the super validator in order to join the network

Image tag

The specific version or tag of the container image to be used

Image repo

The repository where the container image is stored

Image pull secret

Credentials required to pull the container image from a private registry (secret docker-registry)

Postgres user

Username for the Postgres database used by the validator

Postgres password

Password for the Postgres database user

An onboarding secret should be requested from your sponsoring SV in order to join the network.

Do not set the Custom Authentication flag on — these instructions are for integrated Keycloak configuration. To use a custom identity provider, see Create Validator with Custom Identity Provider.

2

Cluster Configuration

2.1 — Enable or disable:

  • Enable wallet

  • Fail on app version mismatch

  • Use sequencer connections from scan

2.2 — Fill in the remaining fields:

  • Cluster URL

  • Disable wallet

  • Fail on app version mismatch

  • Scan address

  • SV Sponsor Address

  • Party hint

  • Default JVM Options

  • Migration: Id

  • Top up: Enable, Top up min interval, Target throughput

2.3 — Enable or disable:

  • Participant identities dump import

  • Participant identities dump periodic backup

More info about these fields
Field
Description

Cluster URL

URL of the Kubernetes cluster where the validator is deployed. Used for looking up directory entries in the scan UI

Disable wallet

Turn on to not deploy a wallet UI with your validator

Fail on app version mismatch

If enabled, deployment fails on validator/network version mismatch

Scan address

Address used for scanning and retrieving validator-related data

SV Sponsor Address

URL of the SV app of the super validator sponsoring you (starts with https://sv.sv-N)

Party hint

Prefix for the Party ID. Format: <organization>-<function>-<enumerator>, e.g., myCompany-myWallet-1

Default JVM Options

Default JVM configuration options for the validator

Migration Id

Starts at 0 for initial deployment, increments by 1 with each migration

Attach PVC

Attach a Persistent Volume Claim for data persistence during migration (recommended)

Migrating

Set to true when upgrading to trigger the migration process

3

Cluster Participant Configuration

  • Insert your default JVM configurations

  • Enable or disable: Enable health probes

  • Insert your Node Identifier

More info about these fields
Field
Description

Node identifier

A unique identifier for the validator node within the network

Enable health probes

Turns on health checks to monitor the validator's status

Default JVM Options

Default JVM configuration options for the validator

4

Configure Resources

  • Requested CPU

  • CPU limit

  • Requested memory

  • Memory limit

  • Replicas

More info about these fields
Field
Description

Requested CPU

Minimum CPU resources requested

CPU limit

Maximum CPU resources allowed

Requested memory

Minimum memory requested

Memory limit

Maximum memory allowed

Replicas

Number of instances to run

5

Configure Environment Variables

Override environment variables for:

  • Participant node

  • Validator backend

  • Canton Name Service UI

  • Wallet UI

This is a very specific configuration. If you are not sure about this step, please contact IntellectEU.

6

Summary

Review your Validator configuration. Click Confirm to finalize and proceed with the deployment.

7

Create a Permanent Password in Keycloak

To access the wallet UI, you must first define a new password in Keycloak.

1

Save the credentials displayed in the pop-up window.

2

Once your node is up and running, click on the last link containing wallet-web-ui, then click the link at the top left of the screen.

3

A pop-up will ask you to re-authenticate. Close your session by clicking Log out.

4

Insert the temporary credentials saved in the previous step.

5

Define a new password and click Submit. You will be forwarded to the wallet UI console of your new Validator.

Identity and Access Management

As part of the validator provisioning process, Keycloak is set as the identity provider. Each validator is assigned a dedicated user ($VALIDATOR_NAME_walletuser) within the validator realm.

We strongly recommend updating the password for this user after the initial setup to maintain security.

Resetting the Wallet User Password in Keycloak

1

Log in to the Keycloak admin console

  • URL: https://<your-keycloak-domain>/auth/admin/

  • Use an account with administrative access.

2

Navigate to the validator realm

From the top-left dropdown, select validator, then find $VALIDATOR_NAME_walletuser under Users.

3

Reset the password

Navigate to the Credentials tab, enter a new password, toggle Temporary to OFF, and click Reset Password.

Store the new password securely and update any dependent services or configuration files if needed.

Additional Keycloak documentation resources
PreviousValidator Management
NextCreate Validator with Custom Identity Provider

Last updated

Was this helpful?