Disclaimer:

This e-mail and its attachments may contain official Indian Government information. If you are not the intended recipient, please notify the sender immediately and delete this e-mail. Any dissemination or use of this information by a person other than the intended recipient is unauthorized. The responsibility lies with the recipient to check this email and any attachment for the presence of viruses.   

Disclaimer:

This e-mail and its attachments may contain official Indian Government information. If you are not the intended recipient, please notify the sender immediately and delete this e-mail. Any dissemination or use of this information by a person other than the intended recipient is unauthorized. The responsibility lies with the recipient to check this email and any attachment for the presence of viruses.   

On Apr 29, 2021, at 2:10 AM, Nikos Karamolegkos <nkaram@...> wrote:

So you propose each IoT end device (ED) to be an organization? The EDs can not support fabric to run the a fabric client application and  start a transaction, somehow a proxy (or a IoT) should translate the IoT data and send them to BC. Is this feasible?

On Apr 29, 2021, at 1:41 AM, mahwish.anwar@... wrote:

Thanks for your reply.
You mean, like we register users in an org? 
These users are defined in crypto-config.yaml and cryptogen assigns IDs to all. New users are added via the client API.
When devices are added from the API (similar to the way users are now added), are they supposed to be mentioned in any config file?

For simulation purposes, how could it be done?

On Apr 29, 2021, at 6:45 AM, Yacov Manevich <YACOVM@...> wrote:

You can, but it's not recommended 



From:        "Pechimuthu T" <tpmuthu@...>
To:        alaskadd@..., fabric@...
Date:        04/29/2021 02:40 PM
Subject:        [EXTERNAL] Re: [Hyperledger Fabric] Fabric CA server with customized CSR details.
Sent by:        fabric@...

---

Hi, For an Organization let say Org1, if we setup a CA server, do We have to setup of TLSCA separately ? Can't we use the same CA which can function as CA and TLSCA as well ? Thanks and Regards, T. Pechimuthu ‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍ZjQcmQRYFpfptBannerStart
This Message Is From an External Sender 
This message came from outside your organization. 
ZjQcmQRYFpfptBannerEnd
Hi,

For an Organization let say Org1,  if we setup a CA server, do We have to setup of TLSCA separately ?
Can't we use the same CA which can  function  as CA and TLSCA as well ? 

Thanks and Regards,
T. Pechimuthu

---

From: alaskadd@...
To: alaskadd@...
Cc: "Pechimuthu T" <tpmuthu@...>, fabric@...
Sent: Tuesday, April 27, 2021 7:23:36 PM
Subject: Re: [Hyperledger Fabric] Fabric CA server with customized CSR details.

Meant to say it must be 'set' to true.

--------------------------------------------------------------------------------
fabric-ca-server start \
  -b ${USERNAME}:${PASSWORD} \
  --tls.enabled true \
  --csr.hosts ${CSR_HOSTS} \
  --csr.cn${CSR_CN}
--------------------------------------------------------------------------------


On Apr 27, 2021, at 6:51 AM, Chris Gabriel via lists.hyperledger.org<alaskadd=gmail.com@...> wrote:

Hello,

--tls.enabled is not complete.  It must equal "true"

so --tls.enabled true if using command line flags

Note the 'tls' section of the following doc:
https://hyperledger-fabric-ca.readthedocs.io/en/latest/deployguide/ca-config.html

Hope this helps,
Chris

On Apr 27, 2021, at 6:14 AM, Pechimuthu T <tpmuthu@...> wrote:

hello,

when we start fabric-ca server we get the following files are generated.
--------------------------------------------------------------------------------
fabric-ca-server start \
  -b ${USERNAME}:${PASSWORD} \
  --tls.enabled \
  --csr.hosts ${CSR_HOSTS} \
  --csr.cn${CSR_CN}
--------------------------------------------------------------------------------

IssuerPublicKey
IssuerRevocationPublicKey  
ca-cert.pem  
fabric-ca-server-config.yaml  
fabric-ca-server.db  
./msp
tls-cert.pem


I have changed fabric-ca-server-config.yaml file( changes are specific to CSR section )
deleted ca-cert.pem, ./msp folder, and tls-cert.pem
after that started fabric-ca-server again as mentioned above.

ca-cert.pem has been changed as per my csr config.

But tls-cert.pem is not generated at all.  Any thing i am missing ?
we want the tls-cert.pem also to be regenerated as per my modify CSR config.

any one has faced this issue ? Help in this regard is very much appreciated.

Thanks and Regards,
T. Pechimuthu












Disclaimer:

This e-mail and its attachments may contain official Indian Government information. If you are not the intended recipient, please notify the sender immediately and delete this e-mail. Any dissemination or use of this information by a person other than the intended recipient is unauthorized. The responsibility lies with the recipient to check this email and any attachment for the presence of viruses.   

Disclaimer:

This e-mail and its attachments may contain official Indian Government information. If you are not the intended recipient, please notify the sender immediately and delete this e-mail. Any dissemination or use of this information by a person other than the intended recipient is unauthorized. The responsibility lies with the recipient to check this email and any attachment for the presence of viruses.   

Disclaimer:

This e-mail and its attachments may contain official Indian Government information. If you are not the intended recipient, please notify the sender immediately and delete this e-mail. Any dissemination or use of this information by a person other than the intended recipient is unauthorized. The responsibility lies with the recipient to check this email and any attachment for the presence of viruses.   

On Apr 28, 2021, at 4:21 AM, mahwish.anwar@... wrote:

In an IoT scenario, multiple nodes are sending frequent data. It is not feasible to create a fabric network with all devices.
Instead, a fabric node acts as an aggregator, that takes all values from 100s of devices. Note, some of these values can be wrong. So the aggregator filters outliers. Then the aggregator sends an average - one stream to the server so it can take decisions. The aggregator is a fabric peer so is trusted.

One, if a single stream is sent over to the server, then we lose the information - which IoT device sent which data. Any other way?
Second, there is a single point of failure. What else can be a good option? How else to drop outliers?

On Apr 28, 2021, at 1:32 AM, Kumar Shantanu <km.shantanu@...> wrote:

Sure, here it is,

##############

image: hyperledger/fabric-orderer:2.3

environment:

- FABRIC_LOGGING_SPEC=INFO

- ORDERER_GENERAL_LISTENADDRESS=0.0.0.0

- ORDERER_GENERAL_LISTENPORT=7050

- ORDERER_GENERAL_LOCALMSPID=OrdererMSP

- ORDERER_GENERAL_LOCALMSPDIR=/tmp/orderer/orderers/orderer1.build.dlt/msp

# enabled TLS

- ORDERER_GENERAL_TLS_ENABLED=true

- ORDERER_GENERAL_TLS_PRIVATEKEY=/tmp/orderer/orderers/orderer1.build.dlt/tls/keystore/94d3083485ebea73e4e2154776e3fd149edda3c4d5671dcc9c4981a492180b30_sk

- ORDERER_GENERAL_TLS_CERTIFICATE=/tmp/orderer/orderers/orderer1.build.dlt/tls/signcerts/cert.pem

- ORDERER_GENERAL_TLS_ROOTCAS=[/tmp/orderer/orderers/orderer1.build.dlt/tls/tlscacerts/tls-fabric-ca-build-dlt.pem]

- ORDERER_KAFKA_TOPIC_REPLICATIONFACTOR=1

- ORDERER_KAFKA_VERBOSE=true

- ORDERER_GENERAL_CLUSTER_CLIENTCERTIFICATE=/tmp/orderer/orderers/orderer1.build.dlt/tls/signcerts/cert.pem

- ORDERER_GENERAL_CLUSTER_CLIENTPRIVATEKEY=/tmp/orderer/orderers/orderer1.build.dlt/tls/keystore/94d3083485ebea73e4e2154776e3fd149edda3c4d5671dcc9c4981a492180b30_sk

- ORDERER_GENERAL_CLUSTER_ROOTCAS=[/tmp/orderer/orderers/orderer1.build.dlt/tls/tlscacerts/tls-fabric-ca-build-dlt.pem]

- ORDERER_GENERAL_BOOTSTRAPMETHOD=none

- ORDERER_CHANNELPARTICIPATION_ENABLED=true

- ORDERER_ADMIN_TLS_ENABLED=true

- ORDERER_ADMIN_TLS_CERTIFICATE=/tmp/orderer/orderers/orderer1.build.dlt/tls/signcerts/cert.pem

- ORDERER_ADMIN_TLS_PRIVATEKEY=/tmp/orderer/orderers/orderer1.build.dlt/tls/keystore/94d3083485ebea73e4e2154776e3fd149edda3c4d5671dcc9c4981a492180b30_sk

- ORDERER_ADMIN_TLS_ROOTCAS=[/tmp/orderer/orderers/orderer1.build.dlt/tls/tlscacerts/tls-fabric-ca-build-dlt.pem]

- ORDERER_ADMIN_TLS_CLIENTROOTCAS=[/tmp/orderer/orderers/orderer1.build.dlt/tls/tlscacerts/tls-fabric-ca-build-dlt.pem]

- ORDERER_ADMIN_LISTENADDRESS=0.0.0.0:7053

####3

On Tue, Apr 27, 2021 at 11:46 PM Chris G <alaskadd@...> wrote:

Hi Shantanu,

Can you please share all of your orderer env variables?  That may assist in helping.

Thanks

On Apr 27, 2021, at 5:29 PM, Kumar Shantanu <km.shantanu@...> wrote:

Hello Team, 

I am trying to setup ORDERER_ADMIN_XX_XX values through environment variables however it doesn't seem to work,

For example, my docker-compose file says,

- ORDERER_ADMIN_TLS_ENABLED=true

- ORDERER_ADMIN_LISTENADDRESS=0.0.0.0:7053

however when the orderer node starts it says,

orderer1.build.| Admin.TLS.Enabled = false

orderer1.build.| Admin.TLS.PrivateKey = ""

orderer1.build.| Admin.TLS.Certificate = ""

orderer1.build.| Admin.TLS.RootCAs = []

orderer1.build.| Admin.TLS.ClientAuthRequired = false

orderer1.build.| Admin.TLS.ClientRootCAs = []

orderer1.build.| Admin.TLS.TLSHandshakeTimeShift = 0s

Can someone please suggest a solution here. I am using orderer version 2.3

Thanks
Shantanu

On Apr 28, 2021, at 3:50 AM, Gari Singh <gari.r.singh@...> wrote:

Using DinD in the short term should work ok, but be aware that you will need to run the Dind container with elevated privileges which can be problematic in many environments.  The best course of action is to plan for an upgrade and use a launcher.

On Tue, Apr 27, 2021 at 3:52 PM Chris Gabriel <alaskadd@...> wrote:

Also, I forgot to mention that when running on Kubernetes I set the environment variable for the CORE_VM_ENDPOINT to “http://localhost:2375” and not unix:///var/run/docker.sock 

There is more detail on this if you examine the CORE VM ENDPOINT section of core.yaml

On Apr 27, 2021, at 2:31 PM, Chris Gabriel via lists.hyperledger.org<alaskadd=gmail.com@...> wrote:

Hi Ramesh,

I am still looking into the ramifications of the Deprecation of Docker Runtime in Kubernetes for my network.  I’ll post what I find out.

As far as your second question, you can do either.  I am currently running HLF 2.3 on Kubernetes 1.20.2 with dind and all works fine.  I plan on migrating this to run the external chaincode builders in the near future however.  

Hope this helps,

Chris

On Apr 27, 2021, at 1:39 PM, ramesh.bobbala1990@... wrote:

Hello Everyone, 

 

Any further updates on this issue? I am facing the same issue, currently using HLF 1.4 version on Kubernetes 1.18 version and trying to upgrade kubernetes version to 1.19 version. 

Which is the best way to implement HLF setup on kubernetes latest versions.
1. Upgrading to 2.x versions using external chaincode builders and chaincode as an external service
2. Or  via dind (Docker-in-Docker)