Prerequisites

Cluster, tooling, and access required before installing CAT-BM 2.0.

Cluster and tooling

Requirement	Version	Notes
Kubernetes	1.26+	Any conformant distribution, including managed services and OpenShift.
Helm	3.x
Traefik	3.x	Must already be installed in the cluster. CAT-BM creates IngressRoute resources in the traefik.io/v1alpha1 API group.
Keycloak	26.x	Or another OIDC-compliant identity provider — see Identity Provider Configuration.
PostgreSQL	14+	Reachable from the cluster. In-cluster or managed (for example Amazon RDS).

Traefik must be configured with entry points named exactly web (HTTP) and websecure (HTTPS). CAT-BM references these names when creating ingress routes; a Traefik installation using different entry point names will not route traffic to the platform.

Optional cluster components

Each of these unlocks an optional feature. The corresponding CRDs must already be installed in the cluster.

Component	Enables
cert-manager	Automatic TLS certificate issuance for the platform hostname, instead of supplying a TLS secret yourself.
Prometheus Operator	A ServiceMonitor so Prometheus scrapes validator component metrics automatically.
External Secrets Operator	Sourcing the platform's Keycloak secrets from an external secret store instead of creating Kubernetes Secrets by hand.

Database access

CAT-BM provisions validator databases for you. The credentials you give it must therefore be able to create databases and schemas.

• The credentials referenced by spec.database.credentialsSecretRef need CREATEDB privileges.

• The operator connects to the postgres maintenance database on the host you specify, so that database must be reachable.

Each validator uses at least two databases — one for the participant node and one for the validator app — plus one more when the Participant Query Store is enabled, and two more when the Wallet Gateway is enabled.

Identity provider

An OIDC-compliant identity provider must be reachable from the cluster before you install.

The realm must already exist. CAT-BM never creates a realm. When managed authentication is enabled, the operator creates clients, client scopes, protocol mappers, and users inside an existing realm.

You need:

• An existing realm for the validators.

• An admin client in that realm, with a service account holding realm-management permissions. The operator authenticates as this client to provision per-validator objects.

The admin client must live in the target realm, not in the master realm. The operator authenticates against the realm you configure as operator.keycloak.realm using the client credentials grant.

• Two clients for the management plane itself:

  • a confidential client used by the API to mint per-validator Ledger API tokens — catalyx-api by default;

  • a public client used by the ui for browser login (authorization code with PKCE) — catalyx-canton-ui by default.

Network access

From	To
Cluster workloads	Your identity provider
Cluster workloads	PostgreSQL
Validator components	The Canton Network sequencer, sponsoring Super Validator, and Scan endpoints for your target network
Operators / users	The platform hostname, over HTTPS
Participant node	Your KMS endpoint, if KMS is enabled

For the global Canton Network, your egress IP addresses must be allowlisted by the network governance body and Super Validators. Start this process early — it requires a two-thirds approval threshold and is usually the longest lead-time item in an onboarding.

Container images

Platform images are published to the IntellectEU Artifactory registry at intellecteu-catbp-docker.jfrog.io, built for linux/amd64 and linux/arm64:

Component	Repository
Operator	catalyx/canton/catalyx-operator
API	catalyx/canton/catalyx-console
UI	catalyx/canton/catalyx-ui

You need an image pull secret with credentials for that registry. Contact IntellectEU support to obtain access.

Pin image.tag to the release you intend to run — for example v2.0.0. The chart default is latest, which is convenient for evaluation but not appropriate for production.

Onboarding secret

To join a validator to a network you need a one-time onboarding secret from a sponsoring Super Validator.

• Request it against the Super Validator URL (sv.…), not the Scan URL.

• Onboarding secrets are single-use and short-lived — typically valid for 48 hours, and only 1 hour for DevNet self-service tokens.

• Request the secret shortly before you apply the Validator resource, not days in advance.