> For the complete documentation index, see [llms.txt](https://docs.catalyx.solutions/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.catalyx.solutions/catalyx-blockchain-manager/canton-network/version-2.0/installation-instructions-canton/prerequisites.md).

# Prerequisites

Cluster, tooling, and access required before installing CAT-BM 2.0.

## Cluster and tooling

<table><thead><tr><th width="170">Requirement</th><th width="140">Version</th><th>Notes</th></tr></thead><tbody><tr><td>Kubernetes</td><td><code>1.26+</code></td><td>Any conformant distribution, including managed services and OpenShift.</td></tr><tr><td>Helm</td><td><code>3.x</code></td><td></td></tr><tr><td>Traefik</td><td><code>3.x</code></td><td>Must already be installed in the cluster. CAT-BM creates <code>IngressRoute</code> resources in the <code>traefik.io/v1alpha1</code> API group.</td></tr><tr><td>Keycloak</td><td><code>26.x</code></td><td>Or another OIDC-compliant identity provider — see <a href="/catalyx-blockchain-manager/canton-network/version-2.0/validator-management/identity-provider-configuration.md">Identity Provider Configuration</a>.</td></tr><tr><td>PostgreSQL</td><td><code>14+</code></td><td>Reachable from the cluster. In-cluster or managed (for example Amazon RDS).</td></tr></tbody></table>

{% hint style="warning" %}
Traefik must be configured with entry points named exactly **`web`** (HTTP) and **`websecure`** (HTTPS). CAT-BM references these names when creating ingress routes; a Traefik installation using different entry point names will not route traffic to the platform.
{% endhint %}

## Optional cluster components

Each of these unlocks an optional feature. The corresponding CRDs must already be installed in the cluster.

<table><thead><tr><th width="230">Component</th><th>Enables</th></tr></thead><tbody><tr><td><a href="https://cert-manager.io/">cert-manager</a></td><td>Automatic TLS certificate issuance for the platform hostname, instead of supplying a TLS secret yourself.</td></tr><tr><td>Prometheus Operator</td><td>A <code>ServiceMonitor</code> so Prometheus scrapes validator component metrics automatically.</td></tr><tr><td><a href="https://external-secrets.io/">External Secrets Operator</a></td><td>Sourcing the platform's Keycloak secrets from an external secret store instead of creating Kubernetes Secrets by hand.</td></tr></tbody></table>

## Database access

CAT-BM provisions validator databases for you. The credentials you give it must therefore be able to create databases and schemas.

* The credentials referenced by `spec.database.credentialsSecretRef` need `CREATEDB` privileges.
* The operator connects to the `postgres` maintenance database on the host you specify, so that database must be reachable.

Each validator uses at least two databases — one for the participant node and one for the validator app — plus one more when the Participant Query Store is enabled, and two more when the Wallet Gateway is enabled.

## Identity provider

An OIDC-compliant identity provider must be reachable from the cluster before you install.

{% hint style="danger" %}
**The realm must already exist.** CAT-BM never creates a realm. When managed authentication is enabled, the operator creates clients, client scopes, protocol mappers, and users *inside* an existing realm.
{% endhint %}

You need:

* An existing realm for the validators.
* An **admin client** in that realm, with a service account holding realm-management permissions. The operator authenticates as this client to provision per-validator objects.

{% hint style="warning" %}
The admin client must live **in the target realm**, not in the `master` realm. The operator authenticates against the realm you configure as `operator.keycloak.realm` using the client credentials grant.
{% endhint %}

* Two clients for the management plane itself:
  * a **confidential client** used by the API to mint per-validator Ledger API tokens — `catalyx-api` by default;
  * a **public client** used by the ui for browser login (authorization code with PKCE) — `catalyx-canton-ui` by default.

## Network access

<table><thead><tr><th width="260">From</th><th>To</th></tr></thead><tbody><tr><td>Cluster workloads</td><td>Your identity provider</td></tr><tr><td>Cluster workloads</td><td>PostgreSQL</td></tr><tr><td>Validator components</td><td>The Canton Network sequencer, sponsoring Super Validator, and Scan endpoints for your target network</td></tr><tr><td>Operators / users</td><td>The platform hostname, over HTTPS</td></tr><tr><td>Participant node</td><td>Your KMS endpoint, if KMS is enabled</td></tr></tbody></table>

For the global Canton Network, your egress IP addresses must be allowlisted by the network governance body and Super Validators. Start this process early — it requires a two-thirds approval threshold and is usually the longest lead-time item in an onboarding.

## Container images

Platform images are published to the IntellectEU Artifactory registry at `intellecteu-catbp-docker.jfrog.io`, built for `linux/amd64` and `linux/arm64`:

| Component | Repository                        |
| --------- | --------------------------------- |
| Operator  | `catalyx/canton/catalyx-operator` |
| API       | `catalyx/canton/catalyx-console`  |
| UI        | `catalyx/canton/catalyx-ui`       |

You need an image pull secret with credentials for that registry. Contact IntellectEU support to obtain access.

{% hint style="info" %}
Pin `image.tag` to the release you intend to run — for example `v2.0.0`. The chart default is `latest`, which is convenient for evaluation but not appropriate for production.
{% endhint %}

## Onboarding secret

To join a validator to a network you need a one-time onboarding secret from a sponsoring Super Validator.

* Request it against the **Super Validator** URL (`sv.…`), not the Scan URL.
* Onboarding secrets are single-use and short-lived — typically valid for **48 hours**, and only **1 hour** for DevNet self-service tokens.
* Request the secret shortly before you apply the `Validator` resource, not days in advance.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.catalyx.solutions/catalyx-blockchain-manager/canton-network/version-2.0/installation-instructions-canton/prerequisites.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.