I'm attempting to build a network on a k8s worker with tls connection.

Develop in a cloud sandbox https://github.com/IBM-Blockchain/ibm-container-service

Provide a sample deployment and topology for Kubernetes https://jira.hyperledger.org/browse/FAB-3339?focusedCommentId=28519&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-28519

Following the websites above, I tried to set variables to surface the peer's endpoint.

  - name: CORE_PEER_TLS_ENABLED
    value: "true"
  - name: CORE_PEER_TLS_CERT_FILE
    value: "/shared/crypto-config/peerOrganizations/org2.example.com/peers/org2peer0.org2.example.com/tls/server.crt"
  - name: CORE_PEER_TLS_KEY_FILE
    value: "/shared/crypto-config/peerOrganizations/org2.example.com/peers/org2peer0.org2.example.com/tls/server.key"
  - name: CORE_PEER_TLS_ROOTCERT_FILE
    value: "/shared/crypto-config/peerOrganizations/org2.example.com/peers/org2peer0.org2.example.com/tls/ca.crt"
  - name: CORE_PEER_TLS_SERVERHOSTOVERRIDE
    value: "org2peer0.org2.example.com"
  - name: CORE_PEER_ADDRESSAUTODETECT
    value: "true"

Now I readjust hostname fields in crypto-config.yaml and generate these certs by cryptogen.

But I got the logs below from the peer "org2peer0" when I execute command peer chaincode instantiate.

[36m2017-10-30 09:28:02.366 UTC [chaincode] launchAndWaitForRegister -> DEBU 6e2[0m start container with env:
CORE_CHAINCODE_ID_NAME=mychaincode:v1
CORE_PEER_TLS_ENABLED=true
CORE_PEER_TLS_SERVERHOSTOVERRIDE=org2peer0.org2.example.com
CORE_CHAINCODE_LOGGING_LEVEL=debug
CORE_CHAINCODE_LOGGING_SHIM=debug
CORE_CHAINCODE_LOGGING_FORMAT=%{color}%{time:2006-01-02 15:04:05.000 MST} [%{module}] %{shortfunc} -> %{level:.4s} %{id:03x}%{color:reset} %{message}
[36m2017-10-30 09:28:02.367 UTC [container] lockContainer -> DEBU 6e3[0m waiting for container(nid1-org2peer0-mychaincode-v1) lock
[36m2017-10-30 09:28:02.367 UTC [container] lockContainer -> DEBU 6e4[0m got container (nid1-org2peer0-mychaincode-v1) lock
[36m2017-10-30 09:28:02.367 UTC [dockercontroller] Start -> DEBU 6e5[0m Cleanup container nid1-org2peer0-mychaincode-v1
[36m2017-10-30 09:28:02.368 UTC [dockercontroller] stopInternal -> DEBU 6e6[0m Stop container nid1-org2peer0-mychaincode-v1(No such container: nid1-org2peer0-mychaincode-v1)
[36m2017-10-30 09:28:02.369 UTC [dockercontroller] stopInternal -> DEBU 6e7[0m Kill container nid1-org2peer0-mychaincode-v1 (No such container: nid1-org2peer0-mychaincode-v1)
[36m2017-10-30 09:28:02.370 UTC [dockercontroller] stopInternal -> DEBU 6e8[0m Remove container nid1-org2peer0-mychaincode-v1 (No such container: nid1-org2peer0-mychaincode-v1)
[36m2017-10-30 09:28:02.370 UTC [dockercontroller] Start -> DEBU 6e9[0m Start container nid1-org2peer0-mychaincode-v1
[36m2017-10-30 09:28:02.370 UTC [dockercontroller] getDockerHostConfig -> DEBU 6ea[0m docker container hostconfig NetworkMode: host
[36m2017-10-30 09:28:02.372 UTC [dockercontroller] createContainer -> DEBU 6eb[0m Create container: nid1-org2peer0-mychaincode-v1
[36m2017-10-30 09:28:02.414 UTC [dockercontroller] createContainer -> DEBU 6ec[0m Created container: nid1-org2peer0-mychaincode-v1-e17013fc680a6e7f1f22ff0e5ea3c05ad8317076178f1b1d02f1810716f96d24
[36m2017-10-30 09:28:02.474 UTC [msp] GetLocalMSP -> DEBU 6ed[0m Returning existing local MSP
[36m2017-10-30 09:28:02.474 UTC [msp] GetDefaultSigningIdentity -> DEBU 6ee[0m Obtaining default signing identity
[36m2017-10-30 09:28:02.474 UTC [msp/identity] Sign -> DEBU 6ef[0m Sign: plaintext: 18012A420A320A0E6F72673270656572...A5D2120C08A2EA82808ADB93F914104B
[36m2017-10-30 09:28:02.474 UTC [msp/identity] Sign -> DEBU 6f0[0m Sign: digest: 5386439CFAD132CEA3E5A6AEE5E54E80AC0C06A67B12804AD8BB38F9AF272FE5
[36m2017-10-30 09:28:02.474 UTC [msp] GetLocalMSP -> DEBU 6f1[0m Returning existing local MSP
[36m2017-10-30 09:28:02.474 UTC [msp] GetDefaultSigningIdentity -> DEBU 6f2[0m Obtaining default signing identity
[36m2017-10-30 09:28:02.475 UTC [msp/identity] Sign -> DEBU 6f3[0m Sign: plaintext: 0A123137322E33302E3232302E33333A35303130
[36m2017-10-30 09:28:02.475 UTC [msp/identity] Sign -> DEBU 6f4[0m Sign: digest: D4A6169ADE383CAF5A82AD5EAF501E835C325F5B71E0EC03115DE206F09CC07D
[36m2017-10-30 09:28:02.475 UTC [gossip/discovery] periodicalSendAlive -> DEBU 6f5[0m Sleeping 5s
[36m2017-10-30 09:28:02.508 UTC [msp] GetLocalMSP -> DEBU 6f6[0m Returning existing local MSP
2017-10-30 09:28:02.508 UTC [msp] DeserializeIdentity -> INFO 6f7[0m Obtaining identity
[36m2017-10-30 09:28:02.509 UTC [msp/identity] newIdentity -> DEBU 6f8[0m Creating identity instance for ID &{Org2MSP d07627fee16276b3a09c530d8e78715917cd0f89e5acc3256bb854465a81f8ca}
[36m2017-10-30 09:28:02.654 UTC [dockercontroller] Start -> DEBU 6f9[0m Started container nid1-org2peer0-mychaincode-v1
[36m2017-10-30 09:28:02.684 UTC [container] unlockContainer -> DEBU 6fa[0m container lock deleted(nid1-org2peer0-mychaincode-v1)
[36m2017-10-30 09:28:02.717 UTC [grpc] Printf -> DEBU 6fb[0m grpc: Server.Serve failed to complete security handshake from " <<NODE_PRIVATE_IP>> :49840": read tcp <<POD_CLUSTER_IP>>:5010 -> <<NODE_PRIVATE_IP>>:49840: read: connection reset by peer

Then the command timed out in 5 minutes.

Error: Error endorsing chaincode: rpc error: code = Unknown desc = Timeout expired while starting chaincode

I also tried to set CORE_PEER_CHAINCODELISTENADDRESS but it doesn't work.

The last line means that the connection was canceled by the chaincode container? Or the endpoint of the peer is still invisible to the container?

I use the ibmblockchain images v1.0.1 and bluemix container service. I'll appreciate any comments.