Installation Instructions

Prerequisites

1

Set up a Kubernetes or OpenShift cluster

Supported OpenShift version: 4.7

Supported Kubernetes version: 1.17 and later

We recommend AWS (EKS) or Google Cloud (GKE), but you can install on a standalone cluster as well.

Minimum cluster size:

• Catalyst Blockchain Platform (1 instance per org): 2 core CPU, 4 GB RAM, 10 GB disk space

• Each additional node:

Node	CPUe	Memory (Mi)	Storage (Gi)
CA	0.1	128	1
Peer	0.1	128	1
Orderer	0.1	128	1

Consider the expected load and increase values accordingly. Each chaincode installed to a peer runs as a separate pod consuming additional resources.

2

Install Helm to your workstation

Installation guide: https://helm.sh/docs/intro/install/

Supported Helm version: 3.*

3

Install Traefik ingress

The ingress controller is needed for traffic routing to expose nodes (peer, CA, orderer). The Catalyst Blockchain Platform creates a CRD resource (IngressRouteTCP for Traefik or Route for OpenShift), automatically started and deleted with each node.

Installation guide: https://github.com/traefik/traefik-helm-chart

No customization is needed. The default port (:443) for HTTPS traffic will be used.

We recommend installing Traefik to a separate namespace from the application.

Supported Traefik version: 2.3

If using OpenShift, skip this step — OpenShift has a built-in ingress controller. Specify it in Helm chart values later.

4

Install cert-manager for TLS

TLS certificate is needed for secured communication between users and the Catalyst Blockchain Platform components.

Installation guide: https://cert-manager.io/docs/installation/helm/

You can skip this step and specify your TLS certificate and key as a Kubernetes secret in Helm chart values instead. See Kubernetes TLS secrets.

5

Create a wildcard DNS A-record

Catalyst Blockchain Platform needs a wildcard record *.<domain> to expose nodes. All nodes (peers, orderers, CAs) will have a <NodeName>.<domainName> address.

For AWS (Route 53):

1. Go to Route53 and create or select a domain.

2. Create an A record, switch Alias to ON.

3. In Route traffic to, select "Alias to application and classic load balancer."

4. Select your region and ELB balancer.

See the AWS guide for detailed ingress and DNS setup options.

6

Create a namespace

kubectl create ns ${ns_name}

6.1 — Get credentials to the Helm repository from the IntellectEU admin team.

6.2 — Add the repo:

helm repo add catbp https://intellecteu.jfrog.io/artifactory/catbp-helm \
  --username ${ARTIFACTORY_USERNAME} \
  --password ${ARTIFACTORY_PASSWORD}

7

Create an ImagePullSecret

kubectl create secret intellecteu-jfrog-access regcred \
  --docker-server=intellecteu-catbp-docker.jfrog.io \
  --docker-username=${your-name} \
  --docker-password=${your-password} \
  --docker-email=${your-email} \
  -n ${ns_name}

8

Deploy a message broker (RabbitMQ)

A message broker is required for internal architecture workflows.

No specific configurations are needed. Use the official RabbitMQ documentation. Minimum recommended setup: 1 GB RAM.

9

Deploy a database

A database is required to support internal workflows and store users' action logs.

No secure data is stored in the database.

Catalyst Blockchain Platform supports PostgreSQL and MySQL:

Supported PostgreSQL version: 12.8 and later

Supported MySQL version: 8.0.21 and later

• MySQL: https://dev.mysql.com/doc/mysql-getting-started/en/

• PostgreSQL: https://www.postgresql.org/docs/12/tutorial-install.html

Minimum recommended: 1 GB RAM.

10

(Optional) Set up secret storage

Digital identities are stored as a private key and x509 certificate. Two options:

Kubernetes Secrets (default)

Enabled by default. For each enrolled identity, a corresponding Kubernetes secret is created. No additional configuration required — use the default configuration in Helm chart values.

Hashicorp Vault

---

Setup: Configure Helm Chart Values

1. domainName

# -- address where the application will be hosted.
# All created nodes will have <NodeName>.proxy.<domainName> address
domainName: ""

2. auth

Two authentication methods are supported: basic and openid.

auth:
  enabled: true
  # -- available methods: 'basic', 'openid'
  method: basic

  basic:
    username: ""
    password: ""
    # Or specify credentials via Kubernetes secret (keys: username, password)
    authSecret: ""

  openid:
    url: ""
    wellKnownURL: ""
    clientID: ""
    roleBasedAuthEnabled: false

3. ingressConfig

ingressConfig:
  provider:
    # Supported: traefik, openshift, istio
    name: traefik
    traefik:
      ingressClass: ""
    traefikCRD:
      tlsStore:
        enabled: false
        name: default
    istio:
      gateway: ""
      port: 443
  enabled: false
  tls:
    enabled: false
    certManager:
      enabled: false
      email: "[e-mail]"
      server: "https://acme-staging-v02.api.letsencrypt.org/directory"
    secretName: ""

4. amqp (RabbitMQ)

amqp:
  readinessCheck:
    enabled: true
    initContainer:
      image:
        repository: busybox
        pullPolicy: IfNotPresent
        tag: latest
  host: "rabbitmq.rabbitmq"
  port: "5672"
  # Or specify via Kubernetes secret (keys: username, password)
  credentialsSecret:
  username: "test1"
  password: "Abcd1234"
  vhost: "test1"

5. database

database:
  readinessCheck:
    enabled: true
    initContainer:
      image:
        repository: busybox
        pullPolicy: IfNotPresent
        tag: latest
  # 'postgres' or 'mysql'
  type: postgres
  host: "postgresql.postgresql"
  port: "5432"
  # Or specify via Kubernetes secret (keys: username, password)
  credentialsSecret:
  username: "test1"
  password: "Abcd1234"
  dbname: "test1"
  # Set to true to use AWS IAM authentication
  authAws: false

6. identityStore (Hashicorp Vault)

identityStore: vault
vault:
  enabled: true
  roleId: <role_id>
  secretId: <secret_id>
  address: <vault_address>
  pathPrefix: <path_prefix>

---

Install the Catalyst Blockchain Platform

helm upgrade --install ${release_name} catbp/fabric-console \
  --values values.yaml \
  -n ${ns_name}

Verify the installation:

helm ls                  # Status should show "deployed"
kubectl get pods         # All pod statuses must be "Running"