diff --git a/pr-preview/pr-614/0.5.html b/pr-preview/pr-614/0.5.html index ae1ccdd291..dcac375839 100644 --- a/pr-preview/pr-614/0.5.html +++ b/pr-preview/pr-614/0.5.html @@ -13,7 +13,7 @@ - +
diff --git a/pr-preview/pr-614/0.5/architecture.html b/pr-preview/pr-614/0.5/architecture.html index 1861d59648..bd6a6c5b25 100644 --- a/pr-preview/pr-614/0.5/architecture.html +++ b/pr-preview/pr-614/0.5/architecture.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/architecture/attestation/coordinator.html b/pr-preview/pr-614/0.5/architecture/attestation/coordinator.html index d14811d6ce..f37fc6a3d2 100644 --- a/pr-preview/pr-614/0.5/architecture/attestation/coordinator.html +++ b/pr-preview/pr-614/0.5/architecture/attestation/coordinator.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/architecture/attestation/hardware.html b/pr-preview/pr-614/0.5/architecture/attestation/hardware.html index 0f19578dfa..2e9c4cb4b6 100644 --- a/pr-preview/pr-614/0.5/architecture/attestation/hardware.html +++ b/pr-preview/pr-614/0.5/architecture/attestation/hardware.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/architecture/attestation/manifest.html b/pr-preview/pr-614/0.5/architecture/attestation/manifest.html index 1bf53e7034..69dcde52a8 100644 --- a/pr-preview/pr-614/0.5/architecture/attestation/manifest.html +++ b/pr-preview/pr-614/0.5/architecture/attestation/manifest.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/architecture/attestation/pod-vm.html b/pr-preview/pr-614/0.5/architecture/attestation/pod-vm.html index 01d2461ef9..a3cb4b3099 100644 --- a/pr-preview/pr-614/0.5/architecture/attestation/pod-vm.html +++ b/pr-preview/pr-614/0.5/architecture/attestation/pod-vm.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/architecture/attestation/runtime-policies.html b/pr-preview/pr-614/0.5/architecture/attestation/runtime-policies.html index b2e149c592..9775f6a8d2 100644 --- a/pr-preview/pr-614/0.5/architecture/attestation/runtime-policies.html +++ b/pr-preview/pr-614/0.5/architecture/attestation/runtime-policies.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/architecture/certificates-and-identities/pki.html b/pr-preview/pr-614/0.5/architecture/certificates-and-identities/pki.html index 5401b2a447..eef53f74f5 100644 --- a/pr-preview/pr-614/0.5/architecture/certificates-and-identities/pki.html +++ b/pr-preview/pr-614/0.5/architecture/certificates-and-identities/pki.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/architecture/components/cli.html b/pr-preview/pr-614/0.5/architecture/components/cli.html index 79791ec543..b0978a691b 100644 --- a/pr-preview/pr-614/0.5/architecture/components/cli.html +++ b/pr-preview/pr-614/0.5/architecture/components/cli.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/architecture/components/coordinator.html b/pr-preview/pr-614/0.5/architecture/components/coordinator.html index cbd4744021..0554e98989 100644 --- a/pr-preview/pr-614/0.5/architecture/components/coordinator.html +++ b/pr-preview/pr-614/0.5/architecture/components/coordinator.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/architecture/components/init-container.html b/pr-preview/pr-614/0.5/architecture/components/init-container.html index 7968424ba7..c9c96d776a 100644 --- a/pr-preview/pr-614/0.5/architecture/components/init-container.html +++ b/pr-preview/pr-614/0.5/architecture/components/init-container.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/architecture/confidential-containers.html b/pr-preview/pr-614/0.5/architecture/confidential-containers.html index c119a6ea12..1a7679ce94 100644 --- a/pr-preview/pr-614/0.5/architecture/confidential-containers.html +++ b/pr-preview/pr-614/0.5/architecture/confidential-containers.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/architecture/network-encryption/protocols-and-keys.html b/pr-preview/pr-614/0.5/architecture/network-encryption/protocols-and-keys.html index 2f198b7177..9f350db48f 100644 --- a/pr-preview/pr-614/0.5/architecture/network-encryption/protocols-and-keys.html +++ b/pr-preview/pr-614/0.5/architecture/network-encryption/protocols-and-keys.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/architecture/network-encryption/sidecar.html b/pr-preview/pr-614/0.5/architecture/network-encryption/sidecar.html index 1775a82b30..f2e9d0ed39 100644 --- a/pr-preview/pr-614/0.5/architecture/network-encryption/sidecar.html +++ b/pr-preview/pr-614/0.5/architecture/network-encryption/sidecar.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/basics/confidential-containers.html b/pr-preview/pr-614/0.5/basics/confidential-containers.html index 724dcf7a2f..383e878fa2 100644 --- a/pr-preview/pr-614/0.5/basics/confidential-containers.html +++ b/pr-preview/pr-614/0.5/basics/confidential-containers.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/basics/features.html b/pr-preview/pr-614/0.5/basics/features.html index 647de89abf..7f8d0eed2c 100644 --- a/pr-preview/pr-614/0.5/basics/features.html +++ b/pr-preview/pr-614/0.5/basics/features.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/basics/security-benefits.html b/pr-preview/pr-614/0.5/basics/security-benefits.html index 48d42c2942..6f19311cf3 100644 --- a/pr-preview/pr-614/0.5/basics/security-benefits.html +++ b/pr-preview/pr-614/0.5/basics/security-benefits.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/category/attestation.html b/pr-preview/pr-614/0.5/category/attestation.html index 9a5c3334d3..ad702bcc53 100644 --- a/pr-preview/pr-614/0.5/category/attestation.html +++ b/pr-preview/pr-614/0.5/category/attestation.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/category/certificates-and-identities.html b/pr-preview/pr-614/0.5/category/certificates-and-identities.html index 8bf57b3263..321dc4f4fa 100644 --- a/pr-preview/pr-614/0.5/category/certificates-and-identities.html +++ b/pr-preview/pr-614/0.5/category/certificates-and-identities.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/category/components.html b/pr-preview/pr-614/0.5/category/components.html index 174679e18c..542abd290d 100644 --- a/pr-preview/pr-614/0.5/category/components.html +++ b/pr-preview/pr-614/0.5/category/components.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/category/network-encryption.html b/pr-preview/pr-614/0.5/category/network-encryption.html index e8f680ddc9..736c7f4e87 100644 --- a/pr-preview/pr-614/0.5/category/network-encryption.html +++ b/pr-preview/pr-614/0.5/category/network-encryption.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/deployment.html b/pr-preview/pr-614/0.5/deployment.html index 040396a9a1..9a8285de54 100644 --- a/pr-preview/pr-614/0.5/deployment.html +++ b/pr-preview/pr-614/0.5/deployment.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/examples.html b/pr-preview/pr-614/0.5/examples.html index 143e685ea7..6fe0d63dbe 100644 --- a/pr-preview/pr-614/0.5/examples.html +++ b/pr-preview/pr-614/0.5/examples.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/examples/emojivoto.html b/pr-preview/pr-614/0.5/examples/emojivoto.html index 3b0ed50d3d..59698071e4 100644 --- a/pr-preview/pr-614/0.5/examples/emojivoto.html +++ b/pr-preview/pr-614/0.5/examples/emojivoto.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/getting-started.html b/pr-preview/pr-614/0.5/getting-started.html index 75b494e2f5..7405972c97 100644 --- a/pr-preview/pr-614/0.5/getting-started.html +++ b/pr-preview/pr-614/0.5/getting-started.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/getting-started/cluster-setup.html b/pr-preview/pr-614/0.5/getting-started/cluster-setup.html index 6e5c2648cf..d0d57a9472 100644 --- a/pr-preview/pr-614/0.5/getting-started/cluster-setup.html +++ b/pr-preview/pr-614/0.5/getting-started/cluster-setup.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/getting-started/first-steps.html b/pr-preview/pr-614/0.5/getting-started/first-steps.html index e0056948c4..e579b7ff8c 100644 --- a/pr-preview/pr-614/0.5/getting-started/first-steps.html +++ b/pr-preview/pr-614/0.5/getting-started/first-steps.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.5/getting-started/install.html b/pr-preview/pr-614/0.5/getting-started/install.html index f7133721fd..8ab2ba2b9a 100644 --- a/pr-preview/pr-614/0.5/getting-started/install.html +++ b/pr-preview/pr-614/0.5/getting-started/install.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6.html b/pr-preview/pr-614/0.6.html index f9432aaad8..ba955fd1fa 100644 --- a/pr-preview/pr-614/0.6.html +++ b/pr-preview/pr-614/0.6.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/about.html b/pr-preview/pr-614/0.6/about.html index 197684eeb4..46c0c9b9ea 100644 --- a/pr-preview/pr-614/0.6/about.html +++ b/pr-preview/pr-614/0.6/about.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/about/telemetry.html b/pr-preview/pr-614/0.6/about/telemetry.html index 5dae29700e..147f802bac 100644 --- a/pr-preview/pr-614/0.6/about/telemetry.html +++ b/pr-preview/pr-614/0.6/about/telemetry.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/architecture.html b/pr-preview/pr-614/0.6/architecture.html index b80efdb5d7..fbaf75b785 100644 --- a/pr-preview/pr-614/0.6/architecture.html +++ b/pr-preview/pr-614/0.6/architecture.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/architecture/attestation.html b/pr-preview/pr-614/0.6/architecture/attestation.html index b5f085a1ce..982ff0f39f 100644 --- a/pr-preview/pr-614/0.6/architecture/attestation.html +++ b/pr-preview/pr-614/0.6/architecture/attestation.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/architecture/certificates.html b/pr-preview/pr-614/0.6/architecture/certificates.html index 69866dd178..00224cda2e 100644 --- a/pr-preview/pr-614/0.6/architecture/certificates.html +++ b/pr-preview/pr-614/0.6/architecture/certificates.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/basics/confidential-containers.html b/pr-preview/pr-614/0.6/basics/confidential-containers.html index 54ebe75783..a170cddad2 100644 --- a/pr-preview/pr-614/0.6/basics/confidential-containers.html +++ b/pr-preview/pr-614/0.6/basics/confidential-containers.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/basics/features.html b/pr-preview/pr-614/0.6/basics/features.html index bcafd52199..a783a6330d 100644 --- a/pr-preview/pr-614/0.6/basics/features.html +++ b/pr-preview/pr-614/0.6/basics/features.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/basics/security-benefits.html b/pr-preview/pr-614/0.6/basics/security-benefits.html index 88fd3f1e51..cc4c14be30 100644 --- a/pr-preview/pr-614/0.6/basics/security-benefits.html +++ b/pr-preview/pr-614/0.6/basics/security-benefits.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/components.html b/pr-preview/pr-614/0.6/components.html index 171ee94243..7d2ef82d65 100644 --- a/pr-preview/pr-614/0.6/components.html +++ b/pr-preview/pr-614/0.6/components.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/components/policies.html b/pr-preview/pr-614/0.6/components/policies.html index 992674b190..6ad4c1b203 100644 --- a/pr-preview/pr-614/0.6/components/policies.html +++ b/pr-preview/pr-614/0.6/components/policies.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/components/runtime.html b/pr-preview/pr-614/0.6/components/runtime.html index fbbe122233..2e3e4343e7 100644 --- a/pr-preview/pr-614/0.6/components/runtime.html +++ b/pr-preview/pr-614/0.6/components/runtime.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/components/service-mesh.html b/pr-preview/pr-614/0.6/components/service-mesh.html index 0a89c143d4..c5eb957132 100644 --- a/pr-preview/pr-614/0.6/components/service-mesh.html +++ b/pr-preview/pr-614/0.6/components/service-mesh.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/deployment.html b/pr-preview/pr-614/0.6/deployment.html index 556b078ca2..e1e3939cd2 100644 --- a/pr-preview/pr-614/0.6/deployment.html +++ b/pr-preview/pr-614/0.6/deployment.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/examples.html b/pr-preview/pr-614/0.6/examples.html index c1ac9a33e5..39dd1cf8ae 100644 --- a/pr-preview/pr-614/0.6/examples.html +++ b/pr-preview/pr-614/0.6/examples.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/examples/emojivoto.html b/pr-preview/pr-614/0.6/examples/emojivoto.html index 33fd6851a1..f5ae81dfdc 100644 --- a/pr-preview/pr-614/0.6/examples/emojivoto.html +++ b/pr-preview/pr-614/0.6/examples/emojivoto.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/getting-started.html b/pr-preview/pr-614/0.6/getting-started.html index 694f5b64e2..081cde6963 100644 --- a/pr-preview/pr-614/0.6/getting-started.html +++ b/pr-preview/pr-614/0.6/getting-started.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/getting-started/cluster-setup.html b/pr-preview/pr-614/0.6/getting-started/cluster-setup.html index 5c05169ed8..d22bd031ca 100644 --- a/pr-preview/pr-614/0.6/getting-started/cluster-setup.html +++ b/pr-preview/pr-614/0.6/getting-started/cluster-setup.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/getting-started/install.html b/pr-preview/pr-614/0.6/getting-started/install.html index a0ae414ed5..90ddba37a8 100644 --- a/pr-preview/pr-614/0.6/getting-started/install.html +++ b/pr-preview/pr-614/0.6/getting-started/install.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/0.6/known-limitations.html b/pr-preview/pr-614/0.6/known-limitations.html index b32a0b3686..71c7fc4cf6 100644 --- a/pr-preview/pr-614/0.6/known-limitations.html +++ b/pr-preview/pr-614/0.6/known-limitations.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/404.html b/pr-preview/pr-614/404.html index 6f7cc008c7..34b3a4e35f 100644 --- a/pr-preview/pr-614/404.html +++ b/pr-preview/pr-614/404.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/about.html b/pr-preview/pr-614/about.html index 8537f962a4..498c755d0b 100644 --- a/pr-preview/pr-614/about.html +++ b/pr-preview/pr-614/about.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/about/telemetry.html b/pr-preview/pr-614/about/telemetry.html index d6e6e4630c..18156cef32 100644 --- a/pr-preview/pr-614/about/telemetry.html +++ b/pr-preview/pr-614/about/telemetry.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/architecture.html b/pr-preview/pr-614/architecture.html index cb8bbdf032..bd6bffd180 100644 --- a/pr-preview/pr-614/architecture.html +++ b/pr-preview/pr-614/architecture.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/architecture/attestation.html b/pr-preview/pr-614/architecture/attestation.html index 3e6df82021..0d4a83dc1b 100644 --- a/pr-preview/pr-614/architecture/attestation.html +++ b/pr-preview/pr-614/architecture/attestation.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/architecture/certificates.html b/pr-preview/pr-614/architecture/certificates.html index 321d47ed32..22a9ee082c 100644 --- a/pr-preview/pr-614/architecture/certificates.html +++ b/pr-preview/pr-614/architecture/certificates.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/architecture/observability.html b/pr-preview/pr-614/architecture/observability.html index f48d400a6c..66e5bd2b4d 100644 --- a/pr-preview/pr-614/architecture/observability.html +++ b/pr-preview/pr-614/architecture/observability.html @@ -13,7 +13,7 @@ - + diff --git a/pr-preview/pr-614/assets/js/9d9f8394.b055e9b7.js b/pr-preview/pr-614/assets/js/9d9f8394.b055e9b7.js deleted file mode 100644 index f5f7d80037..0000000000 --- a/pr-preview/pr-614/assets/js/9d9f8394.b055e9b7.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[9013],{7726:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>s,metadata:()=>r,toc:()=>d});var o=t(4848),i=t(8453);const s={},a="Troubleshooting",r={id:"troubleshooting",title:"Troubleshooting",description:"This section contains information on how to debug your Contrast deployment.",source:"@site/docs/troubleshooting.md",sourceDirName:".",slug:"/troubleshooting",permalink:"/contrast/pr-preview/pr-614/next/troubleshooting",draft:!1,unlisted:!1,editUrl:"https://github.com/edgelesssys/contrast/edit/main/docs/docs/troubleshooting.md",tags:[],version:"current",frontMatter:{},sidebar:"docs",previous:{title:"Workload deployment",permalink:"/contrast/pr-preview/pr-614/next/deployment"},next:{title:"Components",permalink:"/contrast/pr-preview/pr-614/next/components/"}},c={},d=[{value:"Logging",id:"logging",level:2},{value:"CLI",id:"cli",level:3},{value:"Coordinator and Initializer",id:"coordinator-and-initializer",level:3},{value:"Pod fails to start",id:"pod-fails-to-start",level:2},{value:"Regenerating the policies",id:"regenerating-the-policies",level:3},{value:"Pin container images",id:"pin-container-images",level:3},{value:"Validate Contrast components match",id:"validate-contrast-components-match",level:3}];function l(e){const n={admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",ul:"ul",...(0,i.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(n.h1,{id:"troubleshooting",children:"Troubleshooting"}),"\n",(0,o.jsx)(n.p,{children:"This section contains information on how to debug your Contrast deployment."}),"\n",(0,o.jsx)(n.h2,{id:"logging",children:"Logging"}),"\n",(0,o.jsx)(n.p,{children:"Collecting logs can be a good first step to identify problems in your\ndeployment. Both the CLI and the Contrast Coordinator as well as the Initializer\ncan be configured to emit additional logs."}),"\n",(0,o.jsx)(n.h3,{id:"cli",children:"CLI"}),"\n",(0,o.jsxs)(n.p,{children:["The CLI logs can be configured with the ",(0,o.jsx)(n.code,{children:"--log-level"})," command-line flag, which\ncan be set to either ",(0,o.jsx)(n.code,{children:"debug"}),", ",(0,o.jsx)(n.code,{children:"info"}),", ",(0,o.jsx)(n.code,{children:"warn"})," or ",(0,o.jsx)(n.code,{children:"error"}),". The default is ",(0,o.jsx)(n.code,{children:"info"}),".\nSetting this to ",(0,o.jsx)(n.code,{children:"debug"})," can get more fine-grained information as to where the\nproblem lies."]}),"\n",(0,o.jsx)(n.h3,{id:"coordinator-and-initializer",children:"Coordinator and Initializer"}),"\n",(0,o.jsxs)(n.p,{children:["The logs from the Coordinator and the Initializer can be configured via the\nenvironment variables ",(0,o.jsx)(n.code,{children:"CONTRAST_LOG_LEVEL"}),", ",(0,o.jsx)(n.code,{children:"CONTRAST_LOG_FORMAT"})," and\n",(0,o.jsx)(n.code,{children:"CONTRAST_LOG_SUBSYSTEMS"}),"."]}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.code,{children:"CONTRAST_LOG_LEVEL"})," can be set to one of either ",(0,o.jsx)(n.code,{children:"debug"}),", ",(0,o.jsx)(n.code,{children:"info"}),", ",(0,o.jsx)(n.code,{children:"warn"}),", or\n",(0,o.jsx)(n.code,{children:"error"}),", similar to the CLI (defaults to ",(0,o.jsx)(n.code,{children:"info"}),")."]}),"\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.code,{children:"CONTRAST_LOG_FORMAT"})," can be set to ",(0,o.jsx)(n.code,{children:"text"})," or ",(0,o.jsx)(n.code,{children:"json"}),", determining the output\nformat (defaults to ",(0,o.jsx)(n.code,{children:"text"}),")."]}),"\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.code,{children:"CONTRAST_LOG_SUBSYSTEMS"})," is a comma-seperated list of subsystems that should\nbe enabled for logging, which are disabled by default. Subsystems include:\n",(0,o.jsx)(n.code,{children:"snp-issuer"}),", ",(0,o.jsx)(n.code,{children:"kds-getter"}),", and ",(0,o.jsx)(n.code,{children:"snp-validator"}),". To enable all subsystems, use\n",(0,o.jsx)(n.code,{children:"*"})," as the value for this environment variable.\nWarnings and error messages from subsystems get printed regardless of whether\nthe subsystem is listed in the ",(0,o.jsx)(n.code,{children:"CONTRAST_LOG_SUBSYSTEMS"})," environment variable."]}),"\n"]}),"\n",(0,o.jsx)(n.p,{children:"To configure debug logging with all subsystems for your Coordinator, add the\nfollowing variables to your container definition."}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-yaml",children:'spec: # v1.PodSpec\n containers:\n image: "ghcr.io/edgelesssys/contrast/coordinator:latest"\n name: coordinator\n env:\n - name: CONTRAST_LOG_LEVEL\n value: debug\n - name: CONTRAST_LOG_SUBSYSTEMS\n value: "*"\n # ...\n'})}),"\n",(0,o.jsx)(n.admonition,{type:"info",children:(0,o.jsxs)(n.p,{children:["While the Contrast Coordinator has a policy that allows configuring the manifest\nthe Initializer and service mesh don't. When changing environment variables, ensure\nto rerun ",(0,o.jsx)(n.code,{children:"contrast generate"})," to update the policy to allow the environment change."]})}),"\n",(0,o.jsxs)(n.p,{children:["To access the logs generated by the Coordinator, you can use ",(0,o.jsx)(n.code,{children:"kubectl"})," with the\nfollowing command:"]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-sh",children:"kubectl logsAttest the Coordinator and set the manifest:
contrast set -c "${coordinator}:1313" resources/
After this step, the Coordinator will start issuing TLS certificates to the workloads. The init container +
This will use the reference values from the manifest file to attest the Coordinator. +After this step, the Coordinator will start issuing TLS certificates to the workloads. The init container will fetch a certificate for the workload and the workload is started.
An end user (data owner) can verify the Contrast deployment using the verify
command.
contrast verify -c "${coordinator}:1313"
The CLI will attest the Coordinator using embedded reference values. The CLI will write the service mesh
-root certificate and the history of manifests into the verify/
directory. In addition, the policies referenced
-in the manifest are also written to the directory.
The CLI will attest the Coordinator using the reference values from the given manifest file. It will then write the
+service mesh root certificate and the history of manifests into the verify/
directory. In addition, the policies
+referenced in the active manifest are also written to the directory. The verification will fail if the active
+manifest at the Coordinator doesn't match the manifest passed to the CLI.
You can securely connect to the workloads using the Coordinator's mesh-ca.pem
as a trusted CA certificate.
First, expose the service on a public IP address via a LoadBalancer service:
Configure the coordinator with a manifest. It might take up to a few minutes for the load balancer to be created and the Coordinator being available.
coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}')
echo "The user API of your Contrast Coordinator is available at $coordinator:1313"
contrast set -c "${coordinator}:1313" deployment/
The CLI will use the embedded reference values to attest the Coordinator deployment +
The CLI will use the reference values from the manifest to attest the Coordinator deployment during the TLS handshake. If the connection succeeds, it's ensured that the Coordinator deployment hasn't been tampered with.
A potential voter can verify the Contrast deployment using the verify command:
-contrast verify -c "${coordinator}:1313"
The CLI will attest the Coordinator using embedded reference values. If the command succeeds, +
contrast verify -c "${coordinator}:1313" -m manifest.json
The CLI will attest the Coordinator using the reference values from a given manifest. This manifest needs
+to be communicated out of band to everyone wanting to verify the deployment, as the verify
command checks
+if the currently active manifest at the Coordinator matches the manifest given to the CLI. If the command succeeds,
the Coordinator deployment was successfully verified to be running in the expected Confidential
Computing environment with the expected code version. The Coordinator will then return its
configuration over the established TLS channel. The CLI will store this information, namely the root
diff --git a/pr-preview/pr-614/next/features-limitations.html b/pr-preview/pr-614/next/features-limitations.html
index 6e3fd77c54..eeba377c62 100644
--- a/pr-preview/pr-614/next/features-limitations.html
+++ b/pr-preview/pr-614/next/features-limitations.html
@@ -13,7 +13,7 @@
-
+
To configure debug logging with all subsystems for your Coordinator, add the following variables to your container definition.
spec: # v1.PodSpec
containers:
image: "ghcr.io/edgelesssys/contrast/coordinator:latest"
name: coordinator
env:
- name: CONTRAST_LOG_LEVEL
value: debug
- name: CONTRAST_LOG_SUBSYSTEMS
value: "*"
# ...
While the Contrast Coordinator has a policy that allows configuring the manifest
-the Initializer and service mesh don't. When changing environment variables, ensure
-to rerun contrast generate
to update the policy to allow the environment change.
While the Contrast Coordinator has a policy that allows certain configurations,
+the Initializer and service mesh don't. When changing environment variables of other
+parts than the Coordinator, ensure to rerun contrast generate
to update the policy.
To access the logs generated by the Coordinator, you can use kubectl
with the
following command:
kubectl logs <coordinator-pod-name>
contrast-cc-beee79ca916b9e5dc59602788cbfb097
contrast-cc-beee79ca916b9e5dc59602788cbfb097
Version information about the currently used CLI can be obtained via the version
flag:
contrast --version
contrast version v0.X.0
runtime handler: contrast-cc-beee79ca916b9e5dc59602788cbfb097
launch digest: beee79ca916b9e5dc59602788cbfb097721cde34943e1583a3918f21011a71c47f371f68e883f5e474a6d4053d931a35
genpolicy version: 3.2.0.azl1.genpolicy0
image versions: ghcr.io/edgelesssys/contrast/coordinator@sha256:...
ghcr.io/katexochen/contrast/initializer@sha256:...
contrast version v0.X.0
runtime handler: contrast-cc-beee79ca916b9e5dc59602788cbfb097
launch digest: beee79ca916b9e5dc59602788cbfb097721cde34943e1583a3918f21011a71c47f371f68e883f5e474a6d4053d931a35
genpolicy version: 3.2.0.azl1.genpolicy0
image versions: ghcr.io/edgelesssys/contrast/coordinator@sha256:...
ghcr.io/edgelesssys/contrast/initializer@sha256:...