学习Fabric(二)：fabric部署生产网络

fabric部署生产网络（fabric2.2版本）
fabric2.4版本移除了系统通道的概念，本次学习fabric2.2版本的生产网络的部署

---

步骤：

1. 步骤一：选定你的网络配置

2. 步骤二：为你的资源设置一个集群

3. 步骤三：设置你得CA（证书颁发机构）节点

4. 步骤四：用CA来创建身份和MSP （可以抽象理解为MSP类似一个接口，CA实现这个接口）

5. 步骤五：部署节点

   1. 创建一个peer节点
   2. 创建一个排序节点

Fabric2.2中文文档连接：Fabric2.2中文文档
fabrc2.4环境搭建（2.x版本通用）：fabric环境搭建

---

一、生成证书文件

生成模板文件

新建一个文件夹
mkdir twonodes

在该文件夹下，执行:

cryptogen showtemplate

输出到指定的配置文件当中：

cryptogen showtemplate > crypto-config.yaml

编辑：

vi crypto-config.yaml

Name：节点名称（排序节点）

Domain：节点域名

OU：类似于组织下的部门， false为关闭，true为开启

Template: Count表明部署多少个节点

User表明终端个数

生成证书文件

cryptogen generate --config=crypto-config.yaml

生成如下文件：

二、创建通道

将fabric-samples/test-network/configtx/configtx.yaml 配置文件复制在twonodes中

cp ../hyperledger/fabric-samples/test-network/configtx/configtx.yaml  ./

编辑configtx.yaml文件

vi configtx.yaml

更改项目路径：

将所有MSPDir路径更改为我们的项目路径;

Orderer

Org1:

Org2:

证书路径更改：

Profiles

用下面的代码替换configtx.yaml下profiles的代码：

TwoOrgsOrdererGenesis:
    <<: *ChannelDefaults
    Orderer:
        <<: *OrdererDefaults
        Organizations:
            - *OrdererOrg
        Capabilities:
            <<: *OrdererCapabilities
    Consortiums:
        SampleConsortium:
            Organizations:
                - *Org1
                - *Org2
TwoOrgsChannel:
    Consortium: SampleConsortium
    <<: *ChannelDefaults
    Application:
        <<: *ApplicationDefaults
        Organizations:
            - *Org1
            - *Org2
        Capabilities:
            <<: *ApplicationCapabilities

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-Xb3Yo6FH-1655012581177)(https://raw.githubusercontent.com/Uoyaij/TyporaImage/main/img/202206121308307.png)]

使用configtxgen工具进行区块生成：

官方代码：
configtxgen -outputBlock genesis_block.pb -profile SampleSingleMSPRaftV1_1 -channelID orderer-system-channel

​ -profile[配置项]要指定刚刚写的profile下的创世块的部分，

​ -outputBlock指定路径下进行输出

​ -channelID与后边不同

修改为：

configtxgen  -profile TwoOrgsOrdererGenesis -outputBlock ./channel-artifacts/genesis.block -channelID fabric-channel

生成通道文件

官方代码：
configtxgen -outputCreateChannelTx create_chan_tx.pb -profile SampleSingleMSPChannelV1_1 -channelID application-channel-1

修改为：

configtxgen -profile TwoOrgsChannel -outputCreateChannelTx ./channel-artifacts/channel.tx  -channelID mychannel

生成组织锚节点（2.2版本后已弃用）

执行命令

vi configtx.yaml

在Org1的MSPDir下添加代码：否则报错

 AnchorPeers:
            - Host: peer0.org1.example.com
              Port: 7051

Org2同理;

 AnchorPeers:
            - Host: peer0.org2.example.com
              Port: 9051

生成组织1的锚节点：

configtxgen -outputAnchorPeersUpdate ./channel-artifacts/Org1MSPanchors.tx -channelID mychannel -profile TwoOrgsChannel -asOrg Org1MSP

生成组织2的锚节点：

configtxgen -outputAnchorPeersUpdate ./channel-artifacts/Org2MSPanchors.tx -channelID mychannel -profile TwoOrgsChannel -asOrg Org2MSP

查看channel-artifacts文件：

通道配置完成！

三、创建Peer节点和Order节点

在twonodes文件夹下，创建一份docker-compose.yaml文件，该文件在fabric-samples\test-network\compose目录下存在

更改为：

# Copyright IBM Corp. All Rights Reserved.
#
# SPDX-License-Identifier: Apache-2.0
#

version: '2.4'

volumes:
  orderer.example.com:
  peer0.org1.example.com:
  peer0.org2.example.com:

networks:
  test:
    name: twonodes_test

services:

  orderer.example.com:
    container_name: orderer.example.com
    image: hyperledger/fabric-orderer:latest
    labels:
      service: hyperledger-fabric
    environment:
      - FABRIC_LOGGING_SPEC=DEBUG
      - ORDERER_GENERAL_LISTENADDRESS=0.0.0.0
      - ORDERER_GENERAL_LISTENPORT=7050
      - ORDERER_GENERAL_GENESISMETHOD=file
      - ORDERER_GENERAL_GENESISFILE=/var/hyperledger/orderer/orderer.genesis.block
      - ORDERER_GENERAL_LOCALMSPID=OrdererMSP
      - ORDERER_GENERAL_LOCALMSPDIR=/var/hyperledger/orderer/msp
      # enabled TLS
      - ORDERER_GENERAL_TLS_ENABLED=true
      - ORDERER_GENERAL_TLS_PRIVATEKEY=/var/hyperledger/orderer/tls/server.key
      - ORDERER_GENERAL_TLS_CERTIFICATE=/var/hyperledger/orderer/tls/server.crt
      - ORDERER_GENERAL_TLS_ROOTCAS=[/var/hyperledger/orderer/tls/ca.crt]
      - ORDERER_GENERAL_CLUSTER_CLIENTCERTIFICATE=/var/hyperledger/orderer/tls/server.crt
      - ORDERER_GENERAL_CLUSTER_CLIENTPRIVATEKEY=/var/hyperledger/orderer/tls/server.key
      - ORDERER_GENERAL_CLUSTER_ROOTCAS=[/var/hyperledger/orderer/tls/ca.crt]
#      - ORDERER_GENERAL_BOOTSTRAPMETHOD=none
      - ORDERER_CHANNELPARTICIPATION_ENABLED=true
      - ORDERER_ADMIN_TLS_ENABLED=true
      - ORDERER_ADMIN_TLS_CERTIFICATE=/var/hyperledger/orderer/tls/server.crt
      - ORDERER_ADMIN_TLS_PRIVATEKEY=/var/hyperledger/orderer/tls/server.key
      - ORDERER_ADMIN_TLS_ROOTCAS=[/var/hyperledger/orderer/tls/ca.crt]
      - ORDERER_ADMIN_TLS_CLIENTROOTCAS=[/var/hyperledger/orderer/tls/ca.crt]
      - ORDERER_ADMIN_LISTENADDRESS=0.0.0.0:7053
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric
    command: orderer
    volumes:
        - ./channel-artifacts/genesis.block:/var/hyperledger/orderer/orderer.genesis.block
        - ./crypto-config/ordererOrganizations/example.com/orderers/orderer.example.com/msp:/var/hyperledger/orderer/msp
        - ./crypto-config/ordererOrganizations/example.com/orderers/orderer.example.com/tls/:/var/hyperledger/orderer/tls
        - orderer.example.com:/var/hyperledger/production/orderer
    ports:
      - 7050:7050
      - 7053:7053
    networks:
      - test

  peer0.org1.example.com:
    container_name: peer0.org1.example.com
    image: hyperledger/fabric-peer:latest
    labels:
      service: hyperledger-fabric
    environment:
      #Generic peer variables
      - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
      # the following setting starts chaincode containers on the same
      # bridge network as the peers
      # https://docs.docker.com/compose/networking/
      - CORE_VM_DOCKER_HOSTCONFIG_NETWORKMODE=twonodes_test
      - FABRIC_LOGGING_SPEC=INFO
      #- FABRIC_LOGGING_SPEC=DEBUG
      - CORE_PEER_TLS_ENABLED=true
      - CORE_PEER_PROFILE_ENABLED=true
      - CORE_PEER_TLS_CERT_FILE=/etc/hyperledger/fabric/tls/server.crt
      - CORE_PEER_TLS_KEY_FILE=/etc/hyperledger/fabric/tls/server.key
      - CORE_PEER_TLS_ROOTCERT_FILE=/etc/hyperledger/fabric/tls/ca.crt
      # Peer specific variabes
      - CORE_PEER_ID=peer0.org1.example.com
      - CORE_PEER_ADDRESS=peer0.org1.example.com:7051
      - CORE_PEER_LISTENADDRESS=0.0.0.0:7051
      - CORE_PEER_CHAINCODEADDRESS=peer0.org1.example.com:7052
      - CORE_PEER_CHAINCODELISTENADDRESS=0.0.0.0:7052
      - CORE_PEER_GOSSIP_BOOTSTRAP=peer0.org1.example.com:7051
      - CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer0.org1.example.com:7051
      - CORE_PEER_LOCALMSPID=Org1MSP
    volumes:
        - /var/run/docker.sock:/host/var/run/docker.sock
        - ./crypto-config/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/msp:/etc/hyperledger/fabric/msp
        - ./crypto-config/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls:/etc/hyperledger/fabric/tls
        - peer0.org1.example.com:/var/hyperledger/production
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer
    command: peer node start
    ports:
      - 7051:7051
    networks:
      - test

  peer0.org2.example.com:
    container_name: peer0.org2.example.com
    image: hyperledger/fabric-peer:latest
    environment:
      #Generic peer variables
      - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
      # the following setting starts chaincode containers on the same
      # bridge network as the peers
      # https://docs.docker.com/compose/networking/
      - CORE_VM_DOCKER_HOSTCONFIG_NETWORKMODE=twonodes_test
      - FABRIC_LOGGING_SPEC=DEBUG
      #- FABRIC_LOGGING_SPEC=DEBUG
      - CORE_PEER_TLS_ENABLED=true
      - CORE_PEER_PROFILE_ENABLED=true
      - CORE_PEER_TLS_CERT_FILE=/etc/hyperledger/fabric/tls/server.crt
      - CORE_PEER_TLS_KEY_FILE=/etc/hyperledger/fabric/tls/server.key
      - CORE_PEER_TLS_ROOTCERT_FILE=/etc/hyperledger/fabric/tls/ca.crt
      # Peer specific variabes
      - CORE_PEER_ID=peer0.org2.example.com
      - CORE_PEER_ADDRESS=peer0.org2.example.com:9051
      - CORE_PEER_LISTENADDRESS=0.0.0.0:9051
      - CORE_PEER_CHAINCODEADDRESS=peer0.org2.example.com:9052
      - CORE_PEER_CHAINCODELISTENADDRESS=0.0.0.0:9052
      - CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer0.org2.example.com:9051
      - CORE_PEER_GOSSIP_BOOTSTRAP=peer0.org2.example.com:9051
      - CORE_PEER_LOCALMSPID=Org2MSP
    volumes:
        - /var/run/docker.sock:/host/var/run/docker.sock
        - ./crypto-config/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/msp:/etc/hyperledger/fabric/msp
        - ./crypto-config/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls:/etc/hyperledger/fabric/tls
        - peer0.org2.example.com:/var/hyperledger/production
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer
    command: peer node start
    ports:
      - 9051:9051
    networks:
      - test

  cli1:
    container_name: cli1
    image: hyperledger/fabric-tools:latest
    tty: true
    stdin_open: true
    environment:                            # 环境变量相关设置
      - GOPATH=/opt/gopath
      - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
      - CORE_LOGGING_LEVEL=INFO
      - CORE_PEER_ID=cli1
      - CORE_PEER_ADDRESS=peer0.org1.example.com:7051
      - CORE_PEER_LOCALMSPID=Org1MSP
      - CORE_PEER_TLS_ENABLED=true
      - CORE_PEER_TLS_CERT_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/server.crt
      - CORE_PEER_TLS_KEY_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/server.key
      - CORE_PEER_TLS_ROOTCERT_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt
      - CORE_PEER_MSPCONFIGPATH=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp
      #- FABRIC_LOGGING_SPEC=DEBUG
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer
    command: /bin/bash
    volumes:
        # 挂载目录，默认就行
        - /var/run/:/host/var/run/
        # 链码存放路径(go或者node.js写的链代码)
        - ./chaincode/go/:/opt/gopath/src/github.com/hyperledger/fabric-cluster/chaincode/go
        # 存放证书的路径
        - ./crypto-config:/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/
        # 生成的创世块和管道以及更新的锚节点文件存放的路径(tx和block后缀的文件)
        - ./channel-artifacts:/opt/gopath/src/github.com/hyperledger/fabric/peer/channel-artifacts
        # 注意：./channel-artifacts这种是指路径，需要本地有这个路径，或者改成自己的路径
    networks:
      - test
      
  cli2:
    container_name: cli2
    image: hyperledger/fabric-tools:latest
    tty: true
    stdin_open: true
    environment:                            # 环境变量相关设置
      - GOPATH=/opt/gopath
      - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
      - CORE_LOGGING_LEVEL=INFO
      - CORE_PEER_ID=cli2
      - CORE_PEER_ADDRESS=peer0.org2.example.com:9051
      - CORE_PEER_LOCALMSPID=Org2MSP
      - CORE_PEER_TLS_ENABLED=true
      - CORE_PEER_TLS_CERT_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/server.crt
      - CORE_PEER_TLS_KEY_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/server.key
      - CORE_PEER_TLS_ROOTCERT_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt
      - CORE_PEER_MSPCONFIGPATH=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org2.example.com/users/Admin@org2.example.com/msp
      #- FABRIC_LOGGING_SPEC=DEBUG
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer
    command: /bin/bash
    volumes:
        # 挂载目录，默认就行
        - /var/run/:/host/var/run/
        # 链码存放路径(go或者node.js写的链代码)
        - ./chaincode/go/:/opt/gopath/src/github.com/hyperledger/fabric-cluster/chaincode/go
        # 存放证书的路径
        - ./crypto-config:/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/
        # 生成的创世块和管道以及更新的锚节点文件存放的路径(tx和block后缀的文件)
        - ./channel-artifacts:/opt/gopath/src/github.com/hyperledger/fabric/peer/channel-artifacts
        # 注意：./channel-artifacts这种是指路径，需要本地有这个路径，或者改成自己的路径
    networks:
      - test

保存退出后，回到twonodes,执行：

sudo docker-compose up -d

节点创建成功！

查看节点状态命令：

sudo docker ps -a
sudo docker-compose ps

关闭docker

sudo docker-compose down
docker volume prune

四、加入通道、安装/调用链码

开启节点网络：

sudo docker-compose up -d

进入容器节点1内部

docker exec -it cli1 bash

---

创建通道

-o 指定排序节点、-c 通道名、-f 通道文件所在目录 -tls 是否使用证书 -cafile CA路径

peer channel create -o orderer.example.com:7050 -c mychannel -f ./channel-artifacts/channel.tx --tls true --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/msp/tlscacerts/tlsca.example.com-cert.pem

退出docker环境，复制通道文件：

sudo docker cp cli1:/opt/gopath/src/github.com/hyperledger/fabric/peer/mychannel.block ./

sudo docker cp ./mychannel.block cli2:/opt/gopath/src/github.com/hyperledger/fabric/peer

开启另一个终端,进入Cli2容器

sudo docker exec -it cli2 bash

组织二加入通道

peer channel join -b mychannel.block 

同理，在组织一终端执行相同命令加入通道

sudo docker exec -it cli1 bash
peer channel join -b mychannel.block 

更新各自的锚节点：

在组织一的终端，更新组织一的：注意要在不同的终端，不要弄混

peer channel update -o orderer.example.com:7050 -c mychannel -f ./channel-artifacts/Org1MSPanchors.tx --tls --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem

更新组织二的：

peer channel update -o orderer.example.com:7050 -c mychannel -f ./channel-artifacts/Org2MSPanchors.tx --tls --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem

在fabric-samples/chaincode/sacc/目录下复制链码文件：因为还未编写链码，所以先复制测试网络的链码文件

cp sacc.go ~/fabric2.2/twonodes/chaincode/go/

回到组织一的twonodes目录，进入到cli1的容器内：

sudo docker exec -it cli1 bash

进入链码文件：

 cd /opt/gopath/src/github.com/hyperledger/fabric-cluster/chaincode/go

准备打包链码：

环境准备：
1.换代理源
go env -w GOPROXY=https://goproxy.cn,direct
go env -w GO111MODULE=auto
2.创建go mod
go mod init
3.创建依赖
go mod vendor

回到工作目录：

 cd /opt/gopath/src/github.com/hyperledger/fabric/peer

链码打包：

peer lifecycle chaincode package sacc.tar.gz \
  --path github.com/hyperledger/fabric-cluster/chaincode/go/ \
  --label sacc_1

退出容器组织1，复制到本地：

exit
sudo docker cp cli1:/opt/gopath/src/github.com/hyperledger/fabric/peer/sacc.tar.gz ./

复制到组织二中：

sudo docker cp sacc.tar.gz  cli2:/opt/gopath/src/github.com/hyperledger/fabric/peer

回到cli1的docker容器中：

sudo docker exec -it cli1 bash

安装链码：

注意：两个容器都需要安装，所以在cli1执行后，也要在cli2中执行

peer lifecycle chaincode install sacc.tar.gz

红框部分为packageID,在组织批准中需要用到

如果忘了，也有查询命令：

peer lifecycle chaincode queryinstalled

组织批准：(注意packageID是否一致)【Org1和Org2两个终端均要执行】

peer lifecycle chaincode approveformyorg --channelID mychannel --name sacc --version 1.0 --init-required --package-id sacc_1:9ffa6d574bee9027d9ae02ad3c8a6fb3c7d0f65e86dcf887e6e33f7216571af8 --sequence 1 --tls true --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem

任意一个终端查询是否approve成功：

peer lifecycle chaincode checkcommitreadiness --channelID mychannel --name sacc --version  1.0 --init-required --sequence 1 --tls true --cafile  /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem --output json

查询结果

链码提交

peer lifecycle chaincode commit -o orderer.example.com:7050 --channelID mychannel --name sacc --version  1.0 --init-required --sequence 1 --tls true --cafile  /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem  --peerAddresses peer0.org1.example.com:7051  --tlsRootCertFiles   /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt  --peerAddresses peer0.org2.example.com:9051  --tlsRootCertFiles   /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt  

链码调用

peer chaincode invoke  -o orderer.example.com:7050 --isInit  --ordererTLSHostnameOverride orderer.example.com --tls true  --cafile  /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem  -C mychannel -n sacc  --peerAddresses  peer0.org1.example.com:7051 --tlsRootCertFiles   /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt --peerAddresses peer0.org2.example.com:9051  --tlsRootCertFiles   /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt  -c '{"Args":["a","bb"]}'

cli2上查询：

peer chaincode query -C mychannel -n sacc -c '{"Args":["query","a"]}'

cli2上数据覆盖:

peer chaincode invoke  -o orderer.example.com:7050  --tls true  --cafile  /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem  -C mychannel -n sacc  --peerAddresses  peer0.org1.example.com:7051 --tlsRootCertFiles   /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt --peerAddresses peer0.org2.example.com:9051  --tlsRootCertFiles   /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt  -c '{"Args":["set","a","cc"]}'

cli1查询

peer chaincode query -C mychannel -n sacc -c '{"Args":["query","a"]}'

---

配置ip，通讯问题，有时候不配置IP，节点感知不到其他节点

vi /etc/hosts

其他记录：

Orderer节点启动挂掉

查看docker日志等相关命令

docker logs 容器名
docker ps -a -q
docker rm [容器id]	#删除docker
docker rmi 'docker images -q'	#删除所有本地docker
docker system prune --volumes #清楚docker缓存