CODEWITHSUNDEEP
apache-kafkahyperledger-fabrichyperledger
Nitish Bhardwaj
Nitish Bhardwaj

Reputation: 1187

Hyperledger Fabric Deployment with Kafka

I am confused about setting up the kafka nodes in production environment. I know, the Hyperledger community suggests Kafka to be setup at the joint venture of multiple organizations. As, the community prefers to keep all the Kafka and Zookeeper nodes at a single datacenter for a better performance.

But, I can't have a joint venture of all the orgs. Can Kafka, Zookeeper and Orderer nodes be distributed over multiple orgs? For an instance:

enter image description here

Suppose if there are two orgs, they can host the following:

Upvotes: 1

Views: 1056

Answers (1)

msingh
msingh

Reputation: 549

A distributed fabric network deployment should fine tune the trade-offs between division of responsibility and trust between the organizations hosting the services. As suggested in the question, peer organizations sharing the hosting of kafka-zookeeper cluster and ordering service nodes may lead to scalability and trust issues as the size of consortium grows. Following are two major concerns:

  1. zookeepers are required to be deployed in odd numbers to avoid split brain problems and deployments >=7 is not recommended. If peer organizations take the responsibility of hosting zookeepers as well, the solution will not scale once the zookeeper ensemble maxes out and new organizations keep coming in.

  2. On the other hand, hosting OSNs within the same organization as the peers is discouraged as well. This is due to the default block validation policy delimited by fabric which allows any valid certificate of the ordering organization, in this case the one hosting peer nodes as well, to sign blocks. This essentially means that a block signed by using any valid certificate generated by an organization hosting a variety of services, including the ordering service, will pass the validation. So,

    if an organization is acting both in an ordering and application role, then this policy should be updated to restrict block signers to the subset of certificates authorized for ordering

Upvotes: 2

Related Questions