Hyperledger Fabric: adding one more raft orderer

Question

1. I want to add one more raft orderer to my network: I fetch the config block and convert it to json format. When I want to add the new orderer, I don't know what kind of format I should use for client.crt and server.crt.

{
    "client_tls_cert":"client.crt",
    "host": "orderer3.com",
    "port": 7050,
    "server_tls_cert":"server.crt"
}

i want something like this:

"client_tls_cert":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNXRENDQWYrZ0F3SUJBZ0lRYTN2NXYySzBYeUhaMHk1andmS2lyVEFLQmdncWhrak9QUVFEQWpCc01Rc3cKQ1FZRFZRUUdFd0pWVXpFVE1CRUdBMVVFQ0JNS1EyRnNhV1p2Y201cFlURVdNQlFHQTFVRUJ4TU5VMkZ1SUVaeQpZVzVqYVhOamJ6RVVNQklHQTFVRUNoTUxaWGhoYlhCc1pTNWpiMjB4R2pBWUJnTlZCQU1URVhSc2MyTmhMbVY0CllXMXdiR1V1WTI5dE1CNFhEVEU1TVRJeE56RTBNRFF3TUZvWERUSTVNVEl4TkRFME1EUXdNRm93V0RFTE1Ba0cKQTFVRUJoTUNWVk14RXpBUkJnTlZCQWdUQ2tOaGJHbG1iM0p1YVdFeEZqQVVCZ05WQkFjVERWTmhiaUJHY21GdQpZMmx6WTI4eEhEQWFCZ05WQkFNVEUyOXlaR1Z5WlhJdVpYaGhiWEJzWlM1amIyMHdXVEFUQmdjcWhrak9QUUlCCkJnZ3Foa2pPUFFNQkJ3TkNBQVNjNEhVUklQN0tndFJVWXFGbTA1SGtDdFkySnB2R2RsSzNsUGZXR1hEM3JEaTMKMVY4V1YxRWU3RlZjRWF4ZjVYUFBETlpDM0Exb3ZETGxYb3h0WlNaNm80R1dNSUdUTUE0R0ExVWREd0VCL3dRRQpBd0lGb0RBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUlLd1lCQlFVSEF3SXdEQVlEVlIwVEFRSC9CQUl3CkFEQXJCZ05WSFNNRUpEQWlnQ0Npb1RjcTZMSzJNYnhHazZDdVQ5bmYwSDB1RHdSLytEbFRpQzBHaXRNN3dUQW4KQmdOVkhSRUVJREFlZ2hOdmNtUmxjbVZ5TG1WNFlXMXdiR1V1WTI5dGdnZHZjbVJsY21WeU1Bb0dDQ3FHU000OQpCQU1DQTBjQU1FUUNJSGI0QVN3aUZzbGEySm9xRFlvUmlYeVZ0eUppZVFUbVByR01DMDQ5clVaYkFpQlc4dWhHCk9vY0I1S0N6MlU5ZktxSHYwZ1E0NUhLY1VMTS9ETnZEei9TMmFRPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=",

One way that I use is recreating the genesis.block in a test environment and copy it's server.crt from the json format and it's corresponding crypto from the crypto-config directory to my real environment. But I want an easier and simpler way.

2. I also don't know how to creat a client.crt for my orderers.

Answer 1

You can see here a very, very old script of mine that I created when I wanted to test automatic addition of Raft nodes. The third parameter (configFunc) should be "addOSN".

I don't know if it still works, but you can read it and understand the idea.

addOSN() {
    cert=`base64 /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer3.example.com/tls/server.crt | sed ':a;N;$!ba;s/\n//g'`
    cat config.json |  jq '.channel_group.groups.Orderer.values.ConsensusType.value.metadata.consenters += [{"client_tls_cert": "'$cert'", "host": "orderer3.example.com", "port": 7050, "server_tls_cert": "'$cert'"}] ' > modified_config.json
}


channelConfig() {
    channel=$1
    srcSeq=$2
    configFunc=$3
    cert=`base64 /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer3.example.com/tls/server.crt | sed ':a;N;$!ba;s/\n//g'`
    echo "fetching config block"
    CORE_PEER_LOCALMSPID="OrdererMSP"
    CORE_PEER_TLS_ROOTCERT_FILE=$ORDERER_CA
    CORE_PEER_MSPCONFIGPATH=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/users/Admin@example.com/msp
    peer channel fetch $srcSeq configBlock.pb -o orderer0.example.com:7050 -c "${channel}" --tls --cafile $ORDERER_CA
    echo "converting config to JSON"
    configtxlator proto_decode --input configBlock.pb --type common.Block | jq '.data.data[0].payload.data.config' > config.json
    echo "adding orderer3.example.com as a new consenter"
    eval $configFunc
    echo "computing the config delta"
    configtxlator proto_encode --input config.json --type common.Config --output config.pb
    configtxlator proto_encode --input modified_config.json --type common.Config --output modified_config.pb
    configtxlator compute_update --channel_id ${channel} --original config.pb --updated modified_config.pb --output orderer3Addition.pb
    configtxlator proto_decode --input orderer3Addition.pb --type common.ConfigUpdate | jq . > orderer3Addition.json
    echo '{"payload":{"header":{"channel_header":{"channel_id":"'${channel}'", "type":2}},"data":{"config_update":'$(cat orderer3Addition.json)'}}}' | jq . > orderer3AdditionInEnvelope.json
    configtxlator proto_encode --input orderer3AdditionInEnvelope.json --type common.Envelope --output orderer3AdditionInEnvelope.pb
    peer channel signconfigtx -f orderer3AdditionInEnvelope.pb
    peer channel update -f orderer3AdditionInEnvelope.pb -c ${channel} -o orderer0.example.com:7050 --tls --cafile $ORDERER_CA
}

To use the function, the script in my link runs:

echo "Adding orderer3.example.com to the network"
channelConfig $ORDERER_SYSCHAN_ID 0 addOSN
channelConfig $CHANNEL_NAME 2 addOSN