How to remove a node from indy pool?

Question

I have an indy pool running on docker with 4 nodes. I used von-network as reference https://github.com/bcgov/von-network. Now, I need to remove a node from the pool, which I tried using indy-cli.

My initial setup was brought up with 4 validator nodes. I am trying to remove Node2. In indy-cli, I performed the below operations,

1) Connected to pool
2) Created and opened a wallet
3) Created Trustee DID inside wallet
4) Created DID for Node2 inside wallet
5) From Trustee DID, Registered Node2 as steward
6) From Node2 DID, tried registering the Node2 with empty services field like below

ledger node target=<Node2-Verification-key> alias=Node2 node_ip=<dockerhost-ip> node_port=9703 client_port=9704 client_ip=<dockerhost-ip> services= blskey=<node2-blskey> blskey_pop=<node2-blskey-pop> send=true

Getting the below error

Transaction has been rejected: existing data has conflicts with request data {'alias': 'Node2', 'blskey': '', 'blskey_pop': '<blskey_pop>', 'client_ip': '10.190.0.2', 'client_port': 9704, 'node_ip': '10.190.0.2', 'node_port': 9703, 'services': []}. Error: Node's nodestack addresses must be unique

I added new nodes (node5) to the pool after setting up initial network wit 4 nodes. I am able to demote the node5 by following the same steps mentioned above. But when I try to remove any of the nodes out of first 4, getting the error.

Can you please guide on how to remove a node from the node pool? Thanks in Advance!

Answer 1

From https://www.epfl.ch/labs/dedis/wp-content/uploads/2020/09/report-2020-1-Alexandre-Deleze-hacking_sovereign_identity.pdf

The second issue is that this genesis block contains the ten first nodes of the ledger. These nodes must be up and running to retrieve all pool transactions to find all of the ledger’s nodes. It means that these nodes cannot change their IP address, because the client can then not find them, or be revoked in the case that a node becomes malicious. We can solve this problem by writing a DNSSec record signed by the Sovrin Foundation containing the IP address of all nodes permissioned to run the ledger. The client can then contact the addresses of the DNS record to retrieve all information about the nodes.

I don't know if it is changed or not, but this article says that it was not possible to remove the genesis nodes (the first four nodes) in 2020.

The article is very good, you should read it if you want to find out more about the problems you will face while using indy.