►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Cloud Native Smart Contract with Knative - Jay Guo & Ying Chun Guo, IBM
Smart contract in blockchain carries out business logics by manipulating data in ledger. Hyperledger Fabric, a permissioned blockchain technology, manages lifecycle of smart contracts by building and running them in Docker containers. However, alleviated privilege is required to access Docker daemon, which is normally against security principal in enterprise. It is not scalable to co-locate smart contracts with Fabric on same host. Also, idle contracts can be waste of resource. This session will cover in depth why smart contracts should be ran in cloud native fashion, and how this can benefit deployment, operation and performance. This talk will demonstrate the changes made to Fabric to offload smart contract lifecycle management to Knative, a Kubernetes native serverless platform. This talk will also walk through steps that deploy smart contract as Knative service exposed to Fabric.
https://sched.co/UaX9
A
Okay
welcome
everyone
good
morning,
I'm
excited
to
introduce
J
grow
and
Daisy
Grove,
both
from
IBM
China,
where
they
are
software
engineers
Jay
is
working
on
the
hyper
ledge
of
fabric
and
Daisy
works
on
the
K
native
project
and
they're,
going
to
talk
about
using
hyper
ledger
fabric
on
K
native
and
managing
the
lifecycle
of
smart
contracts
on
kubernetes.
So
I'm
pretty
excited
to
hear
about
that
use
case.
Take
it
away.
Thank.
B
You
hello,
everybody,
it's
quite
interesting
there.
Some
people
are
still
interesting,
this
very
exotic
topic,
so
thank
you
for
coming.
I'm,
J
I'm,
currently
a
maintainer
of
hypertrophy
Burak,
which
the
project
I
will
be
talking
about
later,
and
this
is
my
colleague
Daisy
today
we
will
firstly
talk
a
bit
about
blockchain,
general
and
hi
pooja
fabric,
which
is
a
permission,
blockchain
framework
and
then
we'll
dive
into
fabric
transaction
flow.
B
And
then
each
note
will
maintain
a
verifiable
tamper
proof,
append-only
locks,
meaning
big
say
that
is
the
chain
blocks
where
the
name
comes
from,
and
this
the
lock
or
the
ledger
is
append-only,
meaning
you
can
only
add
new
data
into
it,
and
you
cannot
alter
the
history
so
well
on
the
chain.
We
will
have
the
full
history
of
all
the
transactions
and
in
order,
and
they
are
chained
together
with
a
hash
link.
So
you
cannot
really
alter
one
block
or
some
data
back
in
the
history
and
trigger
others
to
believe
in
it
and
the.
B
Thirdly,
there
are
many
two
categories
of
blockchain
frameworks
out
there
today
public
or
a
consortium,
or
we
often
refer
them
as
permissionless
or
permissions.
They
are
really
designed
for
very
different
use
cases.
Probably
many
of
you
know
a
Bitcoin
or
a
few,
and
they
are
referred
as
permissionless
blockchain,
meaning
you
can
either
today
mean
any
time
you
can
just
download
all
the
blocks
on
your
computer
and
start
mining
I
mean
if
you
get
lucky
enough.
B
You
probably
can
earn
some
money
today,
but
nevertheless
you
don't
really
need
any
permission
from
anybody
to
download
those
data
participate
in
the
consensus,
algorithm
or
start
trading
with
others.
You
just
don't
need
any
permission
to
do
that,
but
that's
a
that's
solves
quite
a
lot
of
problems
and
got
very
popular
from
the
since
the
zero
day,
zero
from
the
in
the
industry,
but
that
doesn't
really
many
of
the
industrial
use
cases
like
many
like
organizations
or
companies
for
some
of
banks
or
insurance
companies
or
so
forth.
B
They
are
just
not
very
comfortable
letting
others
joining
the
network
and
instantly
pull
all
the
data
available
in
the
network,
even
though
that
data
might
be
encrypted,
but
still
your
key
might
be
lost
or
there
or
some
other
future
technologies
that
I
can
break
into
it.
They
just
don't
feel
comfortable,
letting
other
know
the
data
and
they
want
to
trade.
B
Privately,
probably,
you
have
a
network
of
the
consisting
of
let's
say
a
limited
number
of
organizations,
and
they
want
to
just
have
a
common
ground
or
common
trust
with
each
other
to
be
able
to
trade
within
the
network,
but
they
really
don't
want
that
data
to
leak
outside
of
this
network
or
if
you,
a
new
organization,
join
the
network,
they
need
a
very
explicit
permission
to
join
or
to
be
able
to
trade
with
others,
and
also
they
want
a
fine
finer
grain
permission.
Basically,
you
can
tip
it
depending
on
the
access
control.
B
You
can
trade
within
the
network
on
certain
type
of
transactions
and
you're,
not
a
lot
a
lot
to
see
all
the
data,
but
only
the
ones
that
you
are
you
interested
or
you
allowed
to
so
this
different
level
of
permission,
which
really
is,
as
we
refer
as
the
enterprise
blockchain
technology.
Basically,
it's
really
focusing
on
solving
the
problem
within
the
like
b2b
kind
of
network,
so
it's
basically
people
used
to
all
refer
like
public
or
consortium
as
the
in
a
battle
that
we
really
don't
see.
B
B
Hosting
many
projects,
but
all
of
them
are
have
special
focus
on
the
unpriced,
watching
technologies
and
fabric
which
I'm
currently
working
on
is
the
first
graduated
project.
Out
of
this
hyper
ledger
umbrella
and
it's
Apache
2.0
license
the
core
of
fabric
was
written
in,
go
and
as
we
have
several
SDKs
and
some
more
contract
language
available
in
go
Java
in
note,
so
the
only
general-purpose
languages
many
developers
are
probably
more
familiar
with,
and
it
has
currently
more
than
270
members
and
I
just
outlined
several
Premium
Member
members.
B
Okay,
next
we're
going
to
talk
about
the
transaction
flow
like
exactly
how
fabric
works
today.
So,
first
of
all,
you
have
a
transaction
that
contains
several
arguments.
For
example,
we
have
a
B,
+,
10,
meaning
I
want
to
transfer
10
tokens
from
A
to
B
and
an
F,
which
is
basically
the
targeting
contract
that
actually
carry
out
this
transaction.
Then
I
sent
this
ultra
section
to
the
smart
contract,
which
has
a
very
simple
logic
here,
basically
get
the
current
balance
of
a
and
B
and
checks.
B
If
a
has
enough
balance,
let's
say
in
this
case
is
10
and
then
I
just
deduced
that
amount
from
a
and
increase
them
balance
of
B,
then
mission
complete,
very
simple,
and
this
smart
contract
in
fabric.
Actually
it
produces
a
rewrite
set.
Actually,
in
this
case
the
the
output
will
be,
every
cell
is
a
100
initially
has
the
balance
would
be
100
and
at
version
1
and
B
also
100
at
version
1
and
the
right
set
is
basically
I.
Have
I
1
write
a
plus
90
at
version
2
and
B
110
and
version
2.
B
This
is
the
retry
said:
is
the
basically
the
output
of
the
smart
contract
and
then
this
output
is
patched
into
a
block.
Then
the
block
is
disseminated
among
the
network
and
the
collective
consensus
agreement,
and
then
we
call
this
block
final
and
eventually
written
into
the
chain.
I
could
append
to
the
tail
the
chain.
Then
this
readwrite
said
is
extracted
from
the
block
and
applied
against
a
local
state,
ledger
basically
maintained
in
the
key
value
of
a
and
B,
and
then
this
result
will
be
reflected
in
this
particularly
note,
and
every
node
will
do
this.
B
Do
this
process
individually
in
power
and
they
will
have
a
correct,
they
have
maintained
locally
and
if
any
note
is
malicious,
it
cannot
really
be
safe
and
they'll
manipulate
its
own
local
ledger
that
would
not
affect
others,
and
people
can
still
like
by
collecting
a
sufficient
amount
of
results.
In
case
they'll,
say:
okay,
I
I
can
basically
recognize
some
nodes
is
doing
something.
Fishy
and
I
can
still
have
trust
in
this
whole
network,
and
it's
very
important
that
fabric
has
very
I,
say
opinion
opinionated
transient
flow.
Comparing
to
some
other
frameworks
out.
B
But
the
fabric
will
basically
consent
on
the
output
of
this
more
contract,
which
gives
a
lot
of
flexibility
which
I
will
cover
later
and
the
output.
Basically,
as
I
said,
is
the
rewrite
set
and
the
blocks
actually
contain.
All
these
produced
results
so
to
some
to
summarize
on
a
bit
smart
contracting
fabric
or
in
box
in
general,
is
programs.
They
are
embedding
business
logics
like
in
this
particular
example.
It
could
be
transferring
very
simply
transferring
a
token
from
one
account
to
another
or
even
more
a
simpler.
B
B
Basically,
sometimes
we
rely
on
the
side
effect
of
the
smart
contract
like
in,
like
we
said
in
the
ëthere
'm,
you
execute
a
small
contract,
it
alters
the
ledger,
actually,
it's
a
side
effect
of
the
function
or
we
rely
on
the
return
value,
because
in
the
tress
extra
output,
like
in
fabric,
we
really
rely
on
the
read
write
set,
which
is
the
output
and
a
small
country
are
stateless.
It
doesn't
really
store
any
data
and
locally.
It
alters
the
global
ledger.
It's
lightweight.
B
Normally,
we
don't
put
very
complex,
complex
logic
into
it,
for
very
obvious
reason
like
in
easier
all
the
execution
of
smart
country
will
cost
you
more
money,
and
you
want
to
really
design
your
smart
country
in
a
way
that
is
financially
efficient
and
it's
ephemeral,
meaning
it's
executed
on
demand
and
after
completion,
it's
run
to
completion
and
then
terminate
it.
It's
not
never.
It's
never
a
service
that
long-running
or
survey
any
a
request
and
smart
country
are
deterministic,
meaning
we
don't
allow
random
number.
B
We
don't
allow
a
time
so
that,
with
exactly
the
same
input
you
will
get
exactly
the
same
output.
Sometimes
we
have
requirement
ill
invoke
external
API,
it's
like
to
curry,
for
example,
current
stock
price
or
the
weather,
or
some
sensor
data,
but
that
will
require
very
different
mechanics,
but
we
normally
refer
as
Oracle
so
make
sure
that
all
the
different
nodes
they
invoke
external
API
will
get
exactly
the
same
result.
This
is
again
to
to
maintain
the
determinism,
and
also
small
country
can
be
composable.
B
You
have
very
tiny
small
contract
and
many
of
them
and
they
can
invoke
each
other.
So
we
can
compose
these
contracts
into
a
bigger
logic
and
the
small
content
fabric.
We
have
a
certain
API
until
all
to
actually
update
the
ledger.
We
this
only
let's
list
the
current
ones
and
we
host.
We
also
have
many
more
for
some
more
complicated
logics
and
some
more
contrarian
fabric
runs
as
a
separate
process.
This
is
another
very
different
design
decision
comparing
to
other
blockchain
others
like
we
call
normally
call
it
on
chain
customer
contract.
B
Basically,
you
store
the
contract
code
in
the
ledger,
extracted
load
into
a
in
process
VM
and
get
the
output.
That's
normally
the
on
chain
process.
It
runs
within
the
node
process,
but
in
fabric
the
small
country
runs
as
a
separate
process.
Normally
today
we
actually
run
that
in
a
docker
container,
which
I
will
talk
about
later
and
it
communicate
with
the
fabric
node.
B
We
are
AG
RPC
stream
and
then
let's
talk
about
the
life
cycle
in
smart
country
today,
so,
firstly,
you
have
a
peer
fabric,
peer
that
running,
and
then
you
install
a
small
contract
on
the
on
peer.
Basically,
what
you
do
is
upload
Letarte
and
the
pier
will
extract
the
contents
of
the
tar,
basically
it's
Golan
or
Java
code,
and
that
it
pier
relies
on
a
local
doctor
daemon
to
compile
to
spawn
a
compiled
a
compiler
container,
compile
the
code
and
get
the
output
build.
B
That
output
into
a
docker
image
store
that
locally
in
the
registry,
and
then
this
installation,
you
can
think
of
it
as
a
Java
class.
Basically,
when
I
install
a
small
contract,
I'm
creating
a
class,
but
that
has
now
been
instantiated,
it
cannot
be
used
because
in
fabric
we
have
this
notion
of
channels
to
guarantee
the
data
privacy
you
have.
B
For
example,
only
a
single
pair
can
run
a
supply,
channel
supply,
chain,
channel
or
trading
channel
provenance
channel,
and
each
channel
has
their
its
own
ledger
to
keep
other
nodes
in
other
channels
to
from
seeing
the
data
in
within
this
channel.
So
after
you
install
a
small
contract,
you
need
to
instantiate
that
contract
on
one
of
the
channel
to
be
able
to
use
it
and
what
it
the
peer
actually
does
is
to
grab
that
docker
image.
B
We
shouldn't
really
manage
your
own
life
cycle
of
the
container
and
what
we
do
today,
some
workaround
or
terrible
hacks
are
running
talking-dog,
her
it
would
in
kubernetes
and,
secondly,
the
complexity
and
managing
container
is
all
built
into
a
fabric
peer.
Basically,
as
I
said,
a
built
image
store
the
image
in
the
registry
star
container,
make
sure
the
container
is
up
and
running
restarted
when
he's
crash
and
deleted
when
we
upgrade
or
delete
the
smart
contract.
B
This,
basically
all
management
peer,
but
as
to
see
communities
does
pretty
well
all
this
job
and
a
third
one
is
it's
hard
to
develop
an
tasks
contract.
For
example.
Very
often
we
want
to
try
out
a
new
s'more
contract
I
whenever
I
deploy
I
need
to
go
through
the
whole
lifecycle
need
to
upload
tar,
wait
for
it
to
bill
and
if
something
goes
wrong,
I
need
to
really
around
this
process
again
again,
which
is
quite
bernstone
and
the
fourth
one
is
waste
of
a
resource,
because,
let's
say
you
deploy
thousands
of
contract
on
one
peer.
B
Basically,
you
have
thousands
containers
running
on
the
same
post
as
peer,
and
they
are
probably
idle
doing
nothing
when
there's
no
transaction
coming
in,
but
it's
you're
a
waste
of
a
resource
and
also
we
covered
the
collocation
of
peer
and
contract.
They
are
currently
running
all
running
on
the
same
host,
so
we
definitely
want
to
solve
all
these
problems
and
we
want
to
make
all
flow
basically
offload,
this
lifecycle
management
to
something
more
awesome
or
something
more
dedicated
for
this
job.
C
So,
let's
look
at
our
Tech
Talk,
so
Tech
Talk
is
a
kubernetes
native,
open
source
framework
for
creating
the
icd
system.
It
lets
you
build
test
and
deploy
applications
to
public
cloud,
o
premises
system.
So
there
are
two
major
projects
in
Tech
Talk
which
help
you
to
trigger
a
process
to
build
and
deploy
your
app.
First,
a
stack
town
pipeline
tacked
on
pipeline
provide
several
kubernetes
tile
resources
for
declare
CI
CD
pipelines.
For
example.
C
You
can
define
task,
which
is
a
collection
of
steps
you
would
want
to
run
as
part
of
you
flow
and
the
pipeline
is
a
sequence
of
tasks
and
parameters
and
the
resources
used
as
input
and
output
of
the
task
and
the
tackle
on
technology,
and
it's
a
it
defines
some
sums
kubernetes
CRT,
to
control,
to
allow
you
to
inch
extract
the
information
from
events
payload
and
and
the
feed
is
payload
to
a
pipeline
template,
and
that
starts
at
pipeline
templates
so
with
trigger
you
are
able
to
start
a
pipeline
based
after
some
event.
In
happens.
C
C
Kennedy,
who
is
kubernetes,
made
you
so
it
can
leverage
all
the
tools
in
Cochrane,
Eddie's,
family
and
it
is
based
on.
It-
is
used
kubernetes
to
learn
to
do
the
auto
scaling
and
you
service
mesh,
for
example,
easier
to
define
routing
and
network
programming,
and
it
can
also
use,
searching
or
promise
use
to
manage
the
observability.
C
So
here
is
a
an
example
of
Kennedy.
You
service,
the
concept
of
committee
of
service
can
be
complex,
but
as
some
common
user
you
only
I
want.
You
may
only
need
to
understand
that
the
parameter
is
your
image
URL.
If
you
have
an
image
you
are,
you
are
easily
create
a
clinical
service.
Kennedy
will
manage
to
create
all
the
artifacts
to
to
offer
such
a
service,
so
there
are
also
some
optional
parameters,
such
as
port
and
the
environment,
for
example.
C
Here,
because
the
pier
and
the
pier
under
the
contract
is
gr,
pcs
dream
to
come
to
communicate.
So
we
how
to
define
on
h2z
pod
here
there
are
some
correct
characteristics
of
clinical
service
which
is
quite
fit
which
are
quite
fit
to
to
the
smart
contract.
For
example,
they
are
also
they
are
both
lightweight.
They
are
rent
a
small
task.
When
terming
will,
they
will
terminate
for
short
time
and
their
canoe
service
is
containerized
and
stateless.
C
There
is
an
end
point
for
for
the
for
third
party
to
invoke
and
your
service
can
scale
up
to
infinity
and
scale
down
to
zero,
and
if
you
are
using
public
cloud
to
run
your
committal
service,
you
can
pay
by
usage.
If
you
are
running
your
premise,
you
cloud
many
service
can
share
the
same
hardware,
so
you
can
say
we
your
results
and
it
also
you
can
easily
catch
the
observability,
the
secured
access
through
mutual
TRS.
C
So
when
we
add,
after
we
add
connait
you
we
can,
we
can
delegate
the
outer
container
management
and
the
oxygen
to
Kennedy
when
the
coronaries
peer
doesn't
need
to
manage
containers
at
all,
so
peer
doesn't
depend
on
docker,
demo
and
Kennedy.
You
service
can
scale
down
to
zero,
which
is
a
kind
of
aerosol
saving,
and
the
peer
in
a
contract
is
not
not
necessary
to
locate
in
the
same
host.
They
are
completely
decoupled.
C
So,
let's
look
at
what
we
have
done.
We
propose
to
use
Kennedy
when
Tecton
to
manage
the
left
circle
and
the
oxidation
of
smart
contract.
We
use
it
helped
to
start
counter
and
source
code
will
stalk
her
hub
to
stall
docker
image
and
the
windows
Kennedy.
When
you
coronated
to
run
service
well,
a
developer
either
tag
to
github
repo.
Let's
see
what
will
happen.
C
C
When
user
I
don't
I,
don't
get
either
tag
to
the
github,
the
event
message
will
send
to
event
listener
and
the
listener
will
Chi
will
trigger
a
pipeline.
There
are
two
tasks
in
the
pipeline.
First
I
start
to
image
subtle
image:
I
will
build
from
your
github
source
code
to
a
docker
image
and
the
push
the
image
to
github
repo
repo
and
as
a
and
the
second
task
is
to
deploy
to
Canadian
service,
so
Canadian
service
will
be
created
and
the
export
will
end
upon
the
will
be
export.
C
B
Right,
obviously,
as
we
said
before,
we're
uploading,
guitar
and
building
a
container
or
building
the
cold,
and
now
what
we
do
is
for
from
fabric
point
point
of
view.
We
basically
stole
the
idea
of
build
pack.
Actually
one
of
the
maintainer
was
working
on
Bill
pack
back
to
call
foundry
days,
and
we
separate
them
in
2d
tag,
bill
and
wrong
faces
which
are
evoking
external
or
a
customer,
customized
a
binaries
and
you
can
plug
in
whatever
a
logic
into
it
into
these
faces.
B
And
then
we
altered
this
a
belt
face
basically
saying
okay,
just
to
store
that
URL
into
locally,
and
whenever
this
one
contract
is
called,
will
will
be
just
go
to
this
URL
and
proceed
and
current
the
new
life
cycle
will
be
instead
of
upping.
That's
harder,
you
will
just
upload
a
URL
and
it
appear
doesn't
compile.
It
doesn't
build
docker
image
anymore.
It
just
store
that
you're
out
locally
and
we
still
in
till
for
the
fabric,
but
the
instantiation
doesn't
really
do
much
in
terms
of
code
building
or
the
image
building
is
still
on
fabrics.
B
I
just
make
sure
that
the
instance
of
the
smart
contract
is
available
on
the
channel
and
then
you,
the
user,
can
now
just
invokes
more
contract.
If
that
contract
service
is
running
on
the
candidate
and
in
the
demo,
and
it
stays
already
show
that
we
just
tagged
the
ripple
push
that
to
github
and
this
mark.
This,
the
contract
will
be
automatically
extract
by
Tecton
and
bill
into
docker
images,
and
hopefully
the
completion
is
currently
finished.
B
All
right
so
what
it
does
is
Israeli
compiled
and
at
first
time
Kenneth
ball
spawn
found
the
container,
but
once
and
after
the
timeout
it
will
just
terminate,
and
now
we
happen
to
see
that
face
and
I
have
a
a
one
fabric.
Peter
running
locally
on
my
computer
in
a
container
and
I've
installed
the
URL
on
this
pier,
but
there's
no
I,
there's
no
more
contract
container
running
on
this
pier
anymore.
So
we
only
see
a
fabric
pier
and
the
order
is
under
fabric
component,
and
then
we
could
just
I.
B
They
watch
here
to
observe
the
pot
are
currently
running.
We
can
see,
there's
no
contract
currently
running,
which
is
scaled
down
to
zero
and
I
can
run
query
and
that
will
trigger
a
container
being
started
in
the
just
a
second
yeah
being
started
on
Kenneth
and
whatever
vixen
is
already
executed
on
demand
and
the
container
will
keep
keep
alive
for
a
while.
I
can
now
you
vote.