Validator Management

This section covers creating a validator, and the operational tasks that go beyond viewing its health: managing parties, protecting keys, adding optional components, & keeping a validator upgradable &

Create a Validator

Apply your first Validator resource.

External & Multi-Host Parties

Parties whose keys live outside the participant, and parties hosted across several participants.

Users & Rights

Ledger users and wallet users, and how ledger rights work.

Identity Dumps & Database Backups

Identity dumps, database backups, and recovery.

Key Management Service (KMS)

Hold Canton node keys in an external KMS.

Participant Query Store

A queryable projection of the ledger.

Wallet Gateway

Custodial key holding and wallet management for a validator's parties.

Upgrades

Upgrading the platform and validator components.

---

How change reaches a validator

Worth internalising before you operate one, because it determines where you go to change things.

To change...	Do this
Component versions, resources, database, authentication, optional components, KMS	Edit the Validator resource and re-apply. The operator reconciles the change.
Parties, ledger users, wallet users, DAR packages	Use the UI, or the REST API. These are ledger operations, not configuration.
Platform-wide settings — hostnames, TLS, the identity provider the UI uses, Grafana links	Change the Helm values and upgrade the release.
Anything Canton supports that CatalyX does not surface	Use the Canton console.

Editing a Validator is a normal Kubernetes update — kubectl apply, kubectl edit, or a GitOps commit. Watch the Observed Generation on the validator's Status tab to confirm your change was picked up.