AWS

Prerequisites

1

Set up a Kubernetes cluster

Supported Kubernetes version: 1.17 and later.

You can use an existing cluster or create a new one using managed service EKS or provision one manually with kops on EC2 machines.

• Make your default storage class's underlying provider resizable, so all PVCs for Hyperledger Fabric nodes can be resized when needed.

• Add zone labels to Kubernetes nodes when a cluster is stretched across multiple availability zones.

Minimum cluster size:

• Catalyst Blockchain Platform (1 instance): 2 core CPU, 4 GB RAM, 10 GB disk space

• Each additional node (CA, orderer, or peer):

Node	CPU	Memory (Mi)	Storage (Gi)
CA	0.1	128	1
Peer	0.1	128	1
Orderer	0.1	128	1

Consider the expected load and increase these values accordingly. Each chaincode installed to a peer runs as a separate pod consuming additional resources.

2

Install Helm to your workstation

Installation guide: https://helm.sh/docs/intro/install/

Supported Helm version: 3.*

3

Configure ingress and DNS

Ingress Controller

We recommend using the Traefik ingress controller (v2.3). Installation guide: https://github.com/traefik/traefik-helm-chart

The ingress controller exposes Hyperledger Fabric nodes (peer, orderer, CA) as well as API and UI through port :443.

• Ingress resources for Hyperledger Fabric nodes are provisioned automatically — these nodes require TLS passthrough because of mutual TLS.

• Ingress resources for API and UI require a trusted TLS certificate.

Two load balancer options:

Option 1 — Single NLB (recommended)

A single network load balancer (NLB) with TLS passthrough. TLS certificate is provisioned by cert-manager. Traefik handles TLS termination for API and UI.

No additional customization needed.

DNS record:

A *.example.com -> NLB address

Option 2 — Two NLBs + ACM

Component endpoints:

• UI: example.com:443

• API: example.com:443/api

• Any HL Fabric node: <nodeName>.example.com:443

4

Create a namespace

kubectl create ns ${ns_name}

• Get credentials to the Helm repository in JFrog Artifactory from the IntellectEU admin team.

• Add the repo to Helm:

helm repo add catbp https://intellecteu.jfrog.io/artifactory/catbp-helm \
  --username ${ARTIFACTORY_USERNAME} \
  --password ${ARTIFACTORY_PASSWORD}

5

Create an ImagePullSecret

kubectl create secret intellecteu-jfrog-access regcred \
  --docker-server=intellecteu-catbp-docker.jfrog.io \
  --docker-username=${your-name} \
  --docker-password=${your-password} \
  --docker-email=${your-email} \
  -n ${ns_name}

6

Deploy a message broker

Message broker is needed by the Catalyst Blockchain Platform Hyperledger Fabric service to schedule commands, emit events and control workflows.

The Catalyst Blockchain Platform Hyperledger Fabric service requires a vhost and a user with full access for the vhost. Single queue will be propagated upon the Catalyst Blockchain Platform Hyperledger Fabric service startup.

Currently, only RabbitMQ is supported.

Version: 3.7 and later.

We recommend using Amazon MQ managed service.

• No specific configurations are needed.

• 1GB RAM is recommended as a minimum setup.

• Usually, load on the message broker is low so it does not require much resources. t3.micro can be selected as a machine.

Default configuration comes with TLS enabled, even for private VPC, make sure you enable amqp.tls option in helm values.

7

Deploy a database

We recommend using Amazon RDS managed service.

• 1GB RAM is recommended as a minimum setup.

• No specific configurations are needed.

• db.t3.small can be selected as a machine.

A database is required by the Catalyst Blockchain Platform Hyperledger Fabric service to support internal architecture for workflows as well as store users action logs.

The Catalyst Blockchain Platform Hyperledger Fabric service requires a database and a user with full read/write access to the database. Database tables will be provisioned in default schema on application startup.

In this example we will use PostgreSQL. Schema is ‘public’ by default.

Run these commands to provision a database on the recently deployed server:

CREATE DATABASE "catbp-org1";
CREATE USER "catbp" WITH ENCRYPTED PASSWORD 'catbp';
GRANT ALL PRIVILEGES ON DATABASE "catbp-org1" to "catbp";

Make sure to set up automatic backups so that all action logs of users won’t be lost in case of failure.

8

Setup

Configure Helm chart values

Install the Catalyst Blockchain Platform

Once prerequisites are complete, proceed with the Installation Instructions to configure Helm chart values and deploy the service.