Issue with Multi-Cluster Fabric Network: Channel Creation Fails with Multi-CA and Multi-Orderer Setup

[hamidrgholipour]

Hi I have issue with Multi-Cluster Fabric Network: Channel Creation Fails with Multi-CA and Multi-Orderer Setup in two cluster

Environment Details
Platform: Kubernetes (two separate clusters)
Operator: Hyperledger Fabric Operator (installed via Bevel)
Fabric Version: v2.5.x (via HLF Operator)
CNI: (Cilium)
TLS: Enabled
Channel Config YAML: fabricmainchannel.yaml

Network Topology
I’m setting up a multi-cluster Hyperledger Fabric network using Bevel’s HLF Operator.
Cluster 1:
Organization: Org1
One Orderer node + its CA
the pods are as following :
ord1-ca,ord1-node,org1-ca,org1-peer01

Cluster 2:
Two Orderers node + their CA
The pods are as following :
ord1-ca,ord1-node,ord2-ca,ord2-node

Each cluster is managed by its own Kubernetes control plane, and communication between them is available via DNS (resolvable service names) and mutual TLS certificates. I've Deployed with one CA and 3 Orderer node but in 3CA with 3Orderes I faced error as following:

Status:
Conditions:
Last Transition Time: 2025-11-08T11:46:40Z
Message: failed to get config block after creating channel: failed to query config block from all orderers, last error: Orderer Server Status Code: (503) SERVICE_UNAVAILABLE. Description: error status from ordering service
Reason: failed to get config block after creating channel: failed to query config block from all orderers, last error: Orderer Server Status Code: (503) SERVICE_UNAVAILABLE. Description: error status from ordering service
Status: False
Type: FAILED
Message: failed to get config block after creating channel: failed to query config block from all orderers, last error: Orderer Server Status Code: (503) SERVICE_UNAVAILABLE. Description: error status from ordering service
Status: FAILED
Events:

and the yaml file as below:

apiVersion: hlf.kungfusoftware.es/v1alpha1
kind: FabricMainChannel
metadata:
  name: channel_name
spec:
  name: channel_name
  adminOrdererOrganizations:
    - mspID: OrdererMSP1
    - mspID: OrdererMSP2
    - mspID: OrdererMSP3
  adminPeerOrganizations:
    - mspID: Org1MSP
  channelConfig:
    application:
      acls: null
      capabilities:
        - V2_0
        - V2_5
      policies: null
    capabilities:
      - V2_0
    orderer:
      batchSize:
        absoluteMaxBytes: 1048576
        maxMessageCount: 10
        preferredMaxBytes: 524288
      batchTimeout: 2s
      capabilities:
        - V2_0
      etcdRaft:
        options:
          electionTick: 10
          heartbeatTick: 1
          maxInflightBlocks: 5
          snapshotIntervalSize: 16777216
          tickInterval: 500ms
      ordererType: etcdraft
      policies: null
      state: STATE_NORMAL
    policies: null
  externalOrdererOrganizations:
    - mspID: OrdererMSP2
      ordererEndpoints: 
        - orderer2-ord.DNS_NAME:443
      signRootCert: |-

      tlsRootCert: |-

    - mspID: OrdererMSP3
      ordererEndpoints: 
        - orderer3-ord.DNS_NAME:443
      signRootCert: |-

      tlsRootCert: |-

  externalPeerOrganizations: []
  peerOrganizations:
    - mspID: Org1MSP
      caName: "org1-ca"
      caNamespace: hlf

  identities:
    OrdererMSP1:
      secretKey: orderermsp1.yaml
      secretName: wallet
      secretNamespace: hlf
    OrdererMSP2:
      secretKey: orderermsp3.yaml
      secretName: wallet
      secretNamespace: hlf
    OrdererMSP3:
      secretKey: orderermsp3.yaml
      secretName: wallet
      secretNamespace: hlf
    Org1MSP:
      secretKey: org1msp.yaml
      secretName: wallet
      secretNamespace: hlf

  ordererOrganizations:
    - caName: "ord1-ca"
      caNamespace: hlf
      externalOrderersToJoin:
        - host: admin-orderer1-ord.DNS_NAME
          port: 443
      mspID: OrdererMSP1
      ordererEndpoints:
        - orderer1-ord.DNS_NAME:443
      orderersToJoin: []
 
  orderers:
    - host: orderer1-ord.DNS_NAME
      port: 443
      tlsCert: |-

    - host: orderer2-ord.DNS_NAME
      port: 443
      tlsCert: |-

    - host: orderer3-ord.DNS_NAME
      port: 443
      tlsCert: |-

[adityajoshi12]

QQ: Do you have 2 ordering orgs? Also, you have 2 Ord CA; I'm not sure if they are bootstrapped with the same root certificates.