Documentation/DamlView on Daml ↗
Daml

Installation

​
Overview

The Covalidation Service enables a validator to participate as a covalidator by synchronizing DARs (Daml Archive files) from a primary validator and replicating them into its own participant.

​
Setup

Before installing the chart, ensure you have:

Prerequisites

  • Access to your GitHub organization
  • A primary validator willing to share DARs
  • A Kubernetes cluster
  • A Kubernetes namespace for the deployment
  • Helm 3.x
  • Kubernetes Secrets containing:
    • GitHub App private key
    • Participant OIDC client secret
Before deploying the service, a GitHub App must be created within your organization’s GitHub account. The primary validator installs this application into the repository containing the shared DARs, allowing the Covalidation Service to securely synchronize application packages. The deployment process consists of three stages:

​
Configure GitHub Access

​
Create a GitHub App

Important Creating a GitHub App requires GitHub Organization Owner permissions.
Note A single GitHub App can be reused for multiple Covalidation Service deployments within the same organization.

​
Create the application

Navigate to: Organization Settings → Developer Settings → GitHub Apps Select New GitHub App.

​
Configure the application

Use the following settings.
SettingValue
Name<Company Name> Covalidation
DescriptionA description such as Used by the Covalidation Service to synchronize DARs
Homepage URLYour organization’s website
Expire user authorization tokensDisabled
WebhooksDisabled

​
Repository Permissions

Configure the following permissions.
PermissionAccess
ContentsRead-only
WebhooksRead & Write

​
Installation Scope

Select: Any account Then create the application.

​
Record Required Information

After the application has been created, save the following values.
ItemRequired For
Public LinkSent to the primary validator
App IDHelm configuration
Private KeyKubernetes Secret

​
Generate Private Key

Generate a Private Key and store it as a Kubernetes Secret in the namespace where the chart will be installed. Example: 
kubectl create secret generic github-app-private-key \
  --from-file=private-key.pem

​
Primary Validator Setup

After creating the GitHub App:
  1. Send the Public Link to the primary validator.
  2. Ask them to install the application into the DAR repository.
  3. Request the Installation ID from the primary validator.
The Installation ID is required when configuring the Helm chart.

​
Install the Helm Chart

Deploy the service using Helm. 
helm upgrade --install \
  covalidation-service \
  -n some-namespace \
  -f values.yaml \
  oci://europe-docker.pkg.dev/da-images/public/charts/covalidation-service:0.7.4

​
Configuration

A minimal configuration looks like the following. 
covalidator:
  dars:
    github:
      appID: <GitHub App ID>
      installID: <GitHub Installation ID>

      privateKey:
        secretKeyRef:
          name: github-app-private-key
          key: private-key.pem

    repo:
      owner: <Primary validator GitHub organization>
      repo: <DAR repository>

  participant:
    id: <Participant ID>

    oidc:
      issuerUri: <Issuer URI>
      audience: <Audience>
      clientId: <Client ID>

      clientSecret:
        secretKeyRef:
          name: participant-oidc-secret
          key: client-secret

    endpoints:
      ledgerApi: participant.namespace:5001
      adminApi: participant.namespace:5002

  replication:
    participants:
      primary: <Primary participant ID>

      covalidators: []
  monitoring:
    otel:
      endpointURL: <OTEL Monitoring URL>

​
Configuration Reference

​
GitHub

FieldDescription
appIDGitHub App ID
installIDInstallation ID provided by the primary validator
privateKey.secretKeyRefKubernetes Secret containing the GitHub App private key

​
DAR Repository

FieldDescription
ownerGitHub organization containing the DAR repository
repoRepository name
branchOptional branch (defaults to main)
dirOptional directory containing DAR files

​
Participant

FieldDescription
idParticipant identifier
issuerUriOIDC issuer URI
audienceOIDC audience
clientIdOIDC client ID
clientSecretKubernetes Secret containing the OIDC client secret
ledgerApiLedger API endpoint
adminApiAdmin API endpoint

​
Replication

FieldDescription
primaryPrimary validator participant ID
covalidatorsAdditional covalidator participant IDs

​
Monitoring

FieldDescription
endpointURLOTEL monitoring URL and port

​
Log

FieldDescription
formatFormat of the logger (text, json, auto)
levelLevel of logger (debug, info, warning, error)

​
Kubernetes Secrets

The chart expects existing Kubernetes Secrets.

​
GitHub Private Key

privateKey:
  secretKeyRef:
    name: github-app-private-key
    key: private-key.pem

​
Participant Client Secret

clientSecret:
  secretKeyRef:
    name: participant-oidc-secret
    key: client-secret

​
Deployment Flow

​
Uninstall

Remove the deployment with Helm. 
helm uninstall covalidation-service -n some-namespace
This removes the Kubernetes resources created by the chart but does not delete Kubernetes Secrets or the GitHub App.