Prerequisites

System, infrastructure, and access requirements to prepare for a CatalyX Blockchain Manager installation on Canton Network.

1

Setup Kubernetes or OpenShift cluster

Supported version of Kubernetes: 1.21 and later. We recommend AWS (EKS) or Google Cloud (GKE), but you can install it on a standalone cluster as well.

Define your cluster size considering the following minimum requirements and your business needs:

1. Minimal requirements for the Catalyst Blockchain Manager Canton service for 1 instance with:

• 2 core CPU

• 4GB RAM

• 10GB disk space

1. Each node (Domain, participant, or application) that will be deployed consumes additional resources. Minimal requirements for one node:

Node	CPUe	Memory, Gi	Storage, Gi
Domain	1	1	1
Participant	1	1	1
Application	1	1	1

Deciding on the size of the cluster, please consider the expected load of the nodes and increase these values accordingly.

2

Install Helm to your workstation

Helm can be installed either from source, or from pre-built binary releases.

Follow the installation manual below:

Installing Helm | Helmhelm.sh

Supported version of Helm: 3.X. No customisation is needed.

3

Install Traefik ingress

The ingress-controller is needed for traffic routing to expose nodes (domains & applications). The Catalyst Blockchain Manager Canton service creates a CRD resource (IngressRoute in case of using Traefik), that is automatically started and deleted along with each application (and on demand for domains).

Follow the installation manual below:

GitHub - traefik/traefik-helm-chart: Traefik Proxy Helm ChartGitHub

Supported version of Traefik: 2.3.

No customisation is needed, the default port ( :443 ) for HTTPS traffic will be used.

We recommend installing Traefik to a separate namespace from the application (creation of a namespace for the CatalyX Blockchain Manager Canton service is described in step 6).

4

Install cert-manager to create TLS certificate

TLS certificate is needed for secured communication between a User and the СatalyX Blockchain Manager Canton service components.

Follow the installation manual below:

Helmcert-manager

We recommend using the last release of the official helm chart.

You can skip this step and specify your TLS certificate and key as a Kubernetes secret in Helm chart values instead later (Helm chart values are described in the Setup section). You can find the manual on how to create a Kubernetes secret here:

kubernetes.io/docs/concepts/configuration/secret/#tls-secrets

5

Create an A-record in a zone in your domain’s DNS management panel and assign it to the load balancer created upon Traefik or OpenShift installation

CatalyX Blockchain Manager Canton service needs a wildcard record *.<domain> to expose nodes. All created nodes (domains, participants, applications) will have a <NodeName>.<domainName> address.

For example, in case you are using AWS, follow these steps:

1. Go to the Route53 service.

2. Create a new domain or choose the existing domain.

3. Create an A record.

4. Switch “alias” to ON.

5. In the “Route traffic to” field select “Alias to application and classic load balancer.”

6. Select your region (where the cluster is installed).

7. Select an ELB balancer from the drop-down list.*

Choose the ELB balancer, which was automatically configured upon the Traefik chart installation as described in step 3 (or upon OpenShift installation in case of using OpenShift). You can check the ELB by the following command:

kubectl get svc -n ${ingress-namespace}

• where:

  • ${ingress-namespace} is the name of the namespace, where the ingress was installed.

  • ELB is displayed in the EXTERNAL-IP field.

6

Create a namespace for the CatalyX Blockchain Manager Canton service application

kubectl create ns ${ns_name}

where ${ns_name} — name of namespace (can be any).

7

Get the credentials to the Helm repository in the JFrog artifactory provided by the IntellectEU admin team

Add the repo to Helm with the username and password provided:

helm repo add catbp <https://intellecteu.jfrog.io/artifactory/catbp-helm> --username ${ARTIFACTORY_USERNAME} --password ${ARTIFACTORY_PASSWORD}

As a result: "catbp" has been added to your repositories

8

Create an ImagePullSecret to access the Catalyst Blockchain Manager Canton service deployable images

For example, create this Secret, naming it intellecteu-jfrog-access:

kubectl create secret intellecteu-jfrog-access regcred --docker-server=intellecteu-catbp-docker.jfrog.io --docker-username=${your-name} --docker-password=${your-password} --docker-email=${your-email} -n ${ns_name}

where:

• ${your-name}+ — your Docker username.

• ${your-password} — your Docker password.

• ${your-email} — your Docker email.

• ${ns_name} — the namespace created for the Catalyst Blockchain Manager Canton service on the previous step.

In case you want to use a readiness check and use a private repository for the image, you should create a “secret” file with your credentials in Kubernetes for further specifying it in the Helm chart upon Catalyst Blockchain Manager installation. Please refer to the official Kubernetes documentation: kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ Helm chart configuration instructions you will find here.

9

Setup Keycloak realm or Auth0 tenant

For Keycloak

Download the realm.json file and import it to create necessary clients, scopes & users in your keycloak realm.

User roles canton_viewer & canton_writer will be evaluated by the Catalyst Blockchain Manager Canton service

After creating realm, set url and realm name in helm values.

Role-Based Access Control (RBAC)

Console UI enforcement of these roles was added in v1.11.15. In earlier versions the roles existed on the backend but the Console UI did not adapt to them.

Two roles are supported:

• canton_viewer — can view all resources (domains, participants, applications, validators), but cannot create, edit, or delete anything.

• canton_writer — can create, edit, and delete any resource, in addition to viewing.

Enforcement is gated by the AUTH_ROLES flag, which must be set consistently on both the API and the UI:

helm-values.yaml

api:
  extraEnv:
    AUTH_ROLES: "true"

ui:
  extraEnv:
    AUTH_ROLES: "true"

If AUTH_ROLES differs between the api and ui sections, a viewer can end up seeing create/edit/delete controls that the backend then rejects with HTTP 403 — the API is the source of truth for enforcement, but the UI must match it to hide those controls in the first place. Set the same value in both places.

For Keycloak Auth0 tenant

If you want to enable Auth0 as an option for ledger authentication, set up a tenant.

After creating tenant, make sure set 'enabled', domain, api id, client id and client secret in helm values.

10

(Optional) Setup Monitoring & Dashboard

The installation of the CatalyX Blockchain Manager Canton service includes templates to assist monitoring. If you use Graphana, to observe the metrics of all nodes, install the kube-prometheus-stack on your cluster.

Once installed, configure Keycloak OAuth2 authentication on Grafana following the detailed steps provided in the Grafana documentation

This file is a default dashboard that can be imported in Grafana.

After configuring Grafana, make sure set 'url' & 'clusterDashboard' in the Grafana section in helm values.

11

Enter License Key

Request a license key and set it in helm values.