hyperledger fabric 2.2 ,Failed to add an orderer to an existing network

Question

I'm having a strange problem with adding an orderer.Modify system-channel config,commit transaction successfully(called Mode 1).However, the warning log appears when the orderer is started. The running orderer logs are as follows:

orderer1-Bank    | 2021-01-25 09:22:07.942 UTC [common.deliver] deliverBlocks -> WARN 086 [channel: system-channel] Client 192.168.1.112:49642 is not authorized: implicit policy evaluation failed - 0 sub-policies were satisfied, but this policy requires 1 of the 'Readers' sub-policies to be satisfied: permission denied

The new orderer logs are as follows:

2021-01-25 09:22:07.935 UTC [orderer.common.cluster.replication] fetchLastBlockSeq -> WARN 00d Received status:FORBIDDEN  from orderer1-ProCoop:7050: forbidden pulling the channel channel=system-channel
orderer1-CBRC    | 2021-01-25 09:22:07.935 UTC [orderer.common.cluster.replication] fetchLastBlockSeq -> WARN 00e Received status:FORBIDDEN  from orderer1-Bank:7050: forbidden pulling the channel channel=system-channel
orderer1-CBRC    | 2021-01-25 09:22:07.935 UTC [orderer.common.cluster.replication] func1 -> WARN 00f Received error of type 'forbidden pulling the channel' from {"CAs":[{"Expired":false,"Issuer":"self","Subject":"CN=ca-tls,OU=Fabric,O=Hyperledger,ST=North Carolina,C=US"}],"Endpoint":"orderer1-Bank:7050"} channel=system-channel
orderer1-CBRC    | 2021-01-25 09:22:07.936 UTC [orderer.common.cluster.replication] func1 -> WARN 010 Received error of type 'forbidden pulling the channel' from {"CAs":[{"Expired":false,"Issuer":"self","Subject":"CN=ca-tls,OU=Fabric,O=Hyperledger,ST=North Carolina,C=US"}],"Endpoint":"orderer1-ProCoop:7050"} channel=system-channel
orderer1-CBRC    | 2021-01-25 09:22:14.924 UTC [orderer.common.cluster.replication] probeEndpoint -> WARN 011 Failed connecting to {"CAs":[{"Expired":false,"Issuer":"self","Subject":"CN=ca-tls,OU=Fabric,O=Hyperledger,ST=North Carolina,C=US"}],"Endpoint":"orderer1-CBRC:7050"}: failed to create new connection: context deadline exceeded channel=system-channel
orderer1-CBRC    | 2021-01-25 09:22:14.924 UTC [orderer.common.cluster.replication] func1 -> WARN 012 Received error of type 'failed to create new connection: context deadline exceeded' from {"CAs":[{"Expired":false,"Issuer":"self","Subject":"CN=ca-tls,OU=Fabric,O=Hyperledger,ST=North Carolina,C=US"}],"Endpoint":"orderer1-CBRC:7050"} channel=system-channel
orderer1-CBRC    | 2021-01-25 09:22:14.925 UTC [orderer.common.cluster.replication] connectToSomeEndpoint -> WARN 013 Could not connect to any endpoint of [{"CAs":[{"Expired":false,"Issuer":"self","Subject":"CN=ca-tls,OU=Fabric,O=Hyperledger,ST=North Carolina,C=US"}],"Endpoint":"orderer1-CBRC:7050"} {"CAs":[{"Expired":false,"Issuer":"self","Subject":"CN=ca-tls,OU=Fabric,O=Hyperledger,ST=North Carolina,C=US"}],"Endpoint":"orderer1-ProCoop:7050"} {"CAs":[{"Expired":false,"Issuer":"self","Subject":"CN=ca-tls,OU=Fabric,O=Hyperledger,ST=North Carolina,C=US"}],"Endpoint":"orderer1-Bank:7050"}] channel=system-channel
orderer1-CBRC    | 2021-01-25 09:22:19.938 UTC [orderer.common.cluster.replication] fetchLastBlockSeq -> WARN 014 Received status:FORBIDDEN  from orderer1-Bank:7050: forbidden pulling the channel channel=system-channel
orderer1-CBRC    | 2021-01-25 09:22:19.939 UTC [orderer.common.cluster.replication] func1 -> WARN 015 Received error of type 'forbidden pulling the channel' from {"CAs":[{"Expired":false,"Issuer":"self","Subject":"CN=ca-tls,OU=Fabric,O=Hyperledger,ST=North Carolina,C=US"}],"Endpoint":"orderer1-Bank:7050"} channel=system-channel

If I set the same three orderers (same MSP files) as above when initializing the creation block(called Mode 2).the orderer will start normally.I have compared the most recent config block after the successful modification in mode 1 with the config block in mode 2, and they are identical except for the last_update property.

question from:https://stackoverflow.com/questions/65882453/hyperledger-fabric-2-2-failed-to-add-an-orderer-to-an-existing-network

Answer 1

Adding an orderer takes a lot of steps. I have written one article on the same you can follow this guide

Edit1: steps you need to follow

1. Create crypto-material for the new ordered.
2. then you have to Add TLS to System Channel
3. Fetch the Latest Configuration Block
4. Bring the new orderer container up.
5. Adding new Orderers End Point to System Channel
6. Add TLS to Application Channel
7. Adding new Orderer Endpoint to Application Channel

That's all you have to do.