From dd1914581ce229f6b259334c8ed44a140aaea074 Mon Sep 17 00:00:00 2001
From: miampf
Date: Fri, 14 Jun 2024 13:13:43 +0000
Subject: [PATCH] =?UTF-8?q?Deploying=20to=20gh-pages=20from=20@=20edgeless?=
=?UTF-8?q?sys/contrast@d444ba8e46e3fea10c20a8f55eb80afa43fcfef7=20?=
=?UTF-8?q?=F0=9F=9A=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
---
0.5.html | 2 +-
0.5/architecture.html | 2 +-
0.5/architecture/attestation/coordinator.html | 2 +-
0.5/architecture/attestation/hardware.html | 2 +-
0.5/architecture/attestation/manifest.html | 2 +-
0.5/architecture/attestation/pod-vm.html | 2 +-
0.5/architecture/attestation/runtime-policies.html | 2 +-
0.5/architecture/certificates-and-identities/pki.html | 2 +-
0.5/architecture/components/cli.html | 2 +-
0.5/architecture/components/coordinator.html | 2 +-
0.5/architecture/components/init-container.html | 2 +-
0.5/architecture/confidential-containers.html | 2 +-
.../network-encryption/protocols-and-keys.html | 2 +-
0.5/architecture/network-encryption/sidecar.html | 2 +-
0.5/basics/confidential-containers.html | 2 +-
0.5/basics/features.html | 2 +-
0.5/basics/security-benefits.html | 2 +-
0.5/category/attestation.html | 2 +-
0.5/category/certificates-and-identities.html | 2 +-
0.5/category/components.html | 2 +-
0.5/category/network-encryption.html | 2 +-
0.5/deployment.html | 2 +-
0.5/examples.html | 2 +-
0.5/examples/emojivoto.html | 2 +-
0.5/getting-started.html | 2 +-
0.5/getting-started/cluster-setup.html | 2 +-
0.5/getting-started/first-steps.html | 2 +-
0.5/getting-started/install.html | 2 +-
0.6.html | 2 +-
0.6/about.html | 2 +-
0.6/about/telemetry.html | 2 +-
0.6/architecture.html | 2 +-
0.6/architecture/attestation.html | 2 +-
0.6/architecture/certificates.html | 2 +-
0.6/basics/confidential-containers.html | 2 +-
0.6/basics/features.html | 2 +-
0.6/basics/security-benefits.html | 2 +-
0.6/components.html | 2 +-
0.6/components/policies.html | 2 +-
0.6/components/runtime.html | 2 +-
0.6/components/service-mesh.html | 2 +-
0.6/deployment.html | 2 +-
0.6/examples.html | 2 +-
0.6/examples/emojivoto.html | 2 +-
0.6/getting-started.html | 2 +-
0.6/getting-started/cluster-setup.html | 2 +-
0.6/getting-started/install.html | 2 +-
0.6/known-limitations.html | 2 +-
404.html | 2 +-
about.html | 2 +-
about/telemetry.html | 2 +-
architecture.html | 2 +-
architecture/attestation.html | 2 +-
architecture/certificates.html | 2 +-
architecture/observability.html | 2 +-
assets/js/ca5b6702.3d3591d2.js | 1 +
assets/js/ca5b6702.c0f8bad1.js | 1 -
...{runtime~main.770460e1.js => runtime~main.efbcb636.js} | 2 +-
basics/confidential-containers.html | 2 +-
basics/features.html | 2 +-
basics/security-benefits.html | 2 +-
components.html | 2 +-
components/policies.html | 2 +-
components/runtime.html | 2 +-
components/service-mesh.html | 2 +-
deployment.html | 2 +-
examples.html | 2 +-
examples/emojivoto.html | 2 +-
features-limitations.html | 2 +-
getting-started.html | 2 +-
getting-started/cluster-setup.html | 2 +-
getting-started/install.html | 2 +-
index.html | 2 +-
next.html | 2 +-
next/about.html | 2 +-
next/about/telemetry.html | 2 +-
next/architecture.html | 2 +-
next/architecture/attestation.html | 2 +-
next/architecture/certificates.html | 2 +-
next/architecture/observability.html | 2 +-
next/basics/confidential-containers.html | 2 +-
next/basics/features.html | 2 +-
next/basics/security-benefits.html | 2 +-
next/components.html | 2 +-
next/components/policies.html | 2 +-
next/components/runtime.html | 2 +-
next/components/service-mesh.html | 8 ++++----
next/deployment.html | 2 +-
next/examples.html | 2 +-
next/examples/emojivoto.html | 2 +-
next/features-limitations.html | 2 +-
next/getting-started.html | 2 +-
next/getting-started/cluster-setup.html | 2 +-
next/getting-started/install.html | 2 +-
next/troubleshooting.html | 2 +-
search-index-docs-default-0.5.json | 2 +-
search-index-docs-default-0.6.json | 2 +-
search-index-docs-default-current.json | 2 +-
98 files changed, 100 insertions(+), 100 deletions(-)
create mode 100644 assets/js/ca5b6702.3d3591d2.js
delete mode 100644 assets/js/ca5b6702.c0f8bad1.js
rename assets/js/{runtime~main.770460e1.js => runtime~main.efbcb636.js} (99%)
diff --git a/0.5.html b/0.5.html
index 1ec0e63864..0565c83bd1 100644
--- a/0.5.html
+++ b/0.5.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/architecture.html b/0.5/architecture.html
index d34347dd34..57adac295d 100644
--- a/0.5/architecture.html
+++ b/0.5/architecture.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/architecture/attestation/coordinator.html b/0.5/architecture/attestation/coordinator.html
index 090ee5cd77..2c79daaa9d 100644
--- a/0.5/architecture/attestation/coordinator.html
+++ b/0.5/architecture/attestation/coordinator.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/architecture/attestation/hardware.html b/0.5/architecture/attestation/hardware.html
index cb65a56618..69b9090c50 100644
--- a/0.5/architecture/attestation/hardware.html
+++ b/0.5/architecture/attestation/hardware.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/architecture/attestation/manifest.html b/0.5/architecture/attestation/manifest.html
index 7384afbb95..6270a4a0f8 100644
--- a/0.5/architecture/attestation/manifest.html
+++ b/0.5/architecture/attestation/manifest.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/architecture/attestation/pod-vm.html b/0.5/architecture/attestation/pod-vm.html
index 49e9eecba1..6fd1048c72 100644
--- a/0.5/architecture/attestation/pod-vm.html
+++ b/0.5/architecture/attestation/pod-vm.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/architecture/attestation/runtime-policies.html b/0.5/architecture/attestation/runtime-policies.html
index 0879cae200..8fa084c94c 100644
--- a/0.5/architecture/attestation/runtime-policies.html
+++ b/0.5/architecture/attestation/runtime-policies.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/architecture/certificates-and-identities/pki.html b/0.5/architecture/certificates-and-identities/pki.html
index bd07770493..b057ff47e7 100644
--- a/0.5/architecture/certificates-and-identities/pki.html
+++ b/0.5/architecture/certificates-and-identities/pki.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/architecture/components/cli.html b/0.5/architecture/components/cli.html
index 09262fb2c7..35946109c3 100644
--- a/0.5/architecture/components/cli.html
+++ b/0.5/architecture/components/cli.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/architecture/components/coordinator.html b/0.5/architecture/components/coordinator.html
index 6b3be37718..ef33988e04 100644
--- a/0.5/architecture/components/coordinator.html
+++ b/0.5/architecture/components/coordinator.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/architecture/components/init-container.html b/0.5/architecture/components/init-container.html
index ccc634afb6..996d6bd9ff 100644
--- a/0.5/architecture/components/init-container.html
+++ b/0.5/architecture/components/init-container.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/architecture/confidential-containers.html b/0.5/architecture/confidential-containers.html
index 3ec54f98f6..9f71a82ecf 100644
--- a/0.5/architecture/confidential-containers.html
+++ b/0.5/architecture/confidential-containers.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/architecture/network-encryption/protocols-and-keys.html b/0.5/architecture/network-encryption/protocols-and-keys.html
index fea0520402..f57f4a823a 100644
--- a/0.5/architecture/network-encryption/protocols-and-keys.html
+++ b/0.5/architecture/network-encryption/protocols-and-keys.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/architecture/network-encryption/sidecar.html b/0.5/architecture/network-encryption/sidecar.html
index ef6aa89dfe..ad4d68836d 100644
--- a/0.5/architecture/network-encryption/sidecar.html
+++ b/0.5/architecture/network-encryption/sidecar.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/basics/confidential-containers.html b/0.5/basics/confidential-containers.html
index 9a5e3988e2..c4504ac48d 100644
--- a/0.5/basics/confidential-containers.html
+++ b/0.5/basics/confidential-containers.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/basics/features.html b/0.5/basics/features.html
index 9b7112828a..06c9f2270a 100644
--- a/0.5/basics/features.html
+++ b/0.5/basics/features.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/basics/security-benefits.html b/0.5/basics/security-benefits.html
index 60c8d161ab..57aee1f727 100644
--- a/0.5/basics/security-benefits.html
+++ b/0.5/basics/security-benefits.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/category/attestation.html b/0.5/category/attestation.html
index d52952bd05..9b38e9e5b4 100644
--- a/0.5/category/attestation.html
+++ b/0.5/category/attestation.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/category/certificates-and-identities.html b/0.5/category/certificates-and-identities.html
index 3cddb4d93b..3d5841fc6f 100644
--- a/0.5/category/certificates-and-identities.html
+++ b/0.5/category/certificates-and-identities.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/category/components.html b/0.5/category/components.html
index 9a9e1d3707..ca2d067ce2 100644
--- a/0.5/category/components.html
+++ b/0.5/category/components.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/category/network-encryption.html b/0.5/category/network-encryption.html
index e2238e49c9..29825ef50d 100644
--- a/0.5/category/network-encryption.html
+++ b/0.5/category/network-encryption.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/deployment.html b/0.5/deployment.html
index 63860e595e..913d1269aa 100644
--- a/0.5/deployment.html
+++ b/0.5/deployment.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/examples.html b/0.5/examples.html
index 5ff6d319fb..b504a910df 100644
--- a/0.5/examples.html
+++ b/0.5/examples.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/examples/emojivoto.html b/0.5/examples/emojivoto.html
index a290cf64fd..72e5597cc7 100644
--- a/0.5/examples/emojivoto.html
+++ b/0.5/examples/emojivoto.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/getting-started.html b/0.5/getting-started.html
index 8231bd63c7..949b16ab6c 100644
--- a/0.5/getting-started.html
+++ b/0.5/getting-started.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/getting-started/cluster-setup.html b/0.5/getting-started/cluster-setup.html
index e81b266a80..35a22cff48 100644
--- a/0.5/getting-started/cluster-setup.html
+++ b/0.5/getting-started/cluster-setup.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/getting-started/first-steps.html b/0.5/getting-started/first-steps.html
index 1d1c7c3883..8d186c9872 100644
--- a/0.5/getting-started/first-steps.html
+++ b/0.5/getting-started/first-steps.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.5/getting-started/install.html b/0.5/getting-started/install.html
index de0e4139b1..076c975d47 100644
--- a/0.5/getting-started/install.html
+++ b/0.5/getting-started/install.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6.html b/0.6.html
index 81b9f98ff1..4564e55524 100644
--- a/0.6.html
+++ b/0.6.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/about.html b/0.6/about.html
index 1c85cddce3..497c3b5033 100644
--- a/0.6/about.html
+++ b/0.6/about.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/about/telemetry.html b/0.6/about/telemetry.html
index 9a6418578c..543ddadb12 100644
--- a/0.6/about/telemetry.html
+++ b/0.6/about/telemetry.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/architecture.html b/0.6/architecture.html
index b106e3dba1..c8be286bc4 100644
--- a/0.6/architecture.html
+++ b/0.6/architecture.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/architecture/attestation.html b/0.6/architecture/attestation.html
index e5a7b369ce..5a428101df 100644
--- a/0.6/architecture/attestation.html
+++ b/0.6/architecture/attestation.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/architecture/certificates.html b/0.6/architecture/certificates.html
index e8a8d5d002..f2cc8057b2 100644
--- a/0.6/architecture/certificates.html
+++ b/0.6/architecture/certificates.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/basics/confidential-containers.html b/0.6/basics/confidential-containers.html
index ef8dc12161..949d0e1e11 100644
--- a/0.6/basics/confidential-containers.html
+++ b/0.6/basics/confidential-containers.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/basics/features.html b/0.6/basics/features.html
index 0edff995fa..a4512df3af 100644
--- a/0.6/basics/features.html
+++ b/0.6/basics/features.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/basics/security-benefits.html b/0.6/basics/security-benefits.html
index 000864e5c8..a6127f3c2a 100644
--- a/0.6/basics/security-benefits.html
+++ b/0.6/basics/security-benefits.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/components.html b/0.6/components.html
index a568edc4fd..5e3b95ed2a 100644
--- a/0.6/components.html
+++ b/0.6/components.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/components/policies.html b/0.6/components/policies.html
index 5d033a27e2..7354bd4324 100644
--- a/0.6/components/policies.html
+++ b/0.6/components/policies.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/components/runtime.html b/0.6/components/runtime.html
index 508b2eddf3..7765ed97c4 100644
--- a/0.6/components/runtime.html
+++ b/0.6/components/runtime.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/components/service-mesh.html b/0.6/components/service-mesh.html
index 30c07ce0f9..c594954692 100644
--- a/0.6/components/service-mesh.html
+++ b/0.6/components/service-mesh.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/deployment.html b/0.6/deployment.html
index 030113af61..ad5d64f379 100644
--- a/0.6/deployment.html
+++ b/0.6/deployment.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/examples.html b/0.6/examples.html
index f96b408695..01f8e93b8e 100644
--- a/0.6/examples.html
+++ b/0.6/examples.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/examples/emojivoto.html b/0.6/examples/emojivoto.html
index 512578f69b..8e0aed478c 100644
--- a/0.6/examples/emojivoto.html
+++ b/0.6/examples/emojivoto.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/getting-started.html b/0.6/getting-started.html
index 3e5dedfaaf..f1b27644ef 100644
--- a/0.6/getting-started.html
+++ b/0.6/getting-started.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/getting-started/cluster-setup.html b/0.6/getting-started/cluster-setup.html
index f6634c7c4d..cdc0fef8ca 100644
--- a/0.6/getting-started/cluster-setup.html
+++ b/0.6/getting-started/cluster-setup.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/getting-started/install.html b/0.6/getting-started/install.html
index be1ab11e10..f979bac1c0 100644
--- a/0.6/getting-started/install.html
+++ b/0.6/getting-started/install.html
@@ -13,7 +13,7 @@
-
+
diff --git a/0.6/known-limitations.html b/0.6/known-limitations.html
index 0cff194545..87e64642d0 100644
--- a/0.6/known-limitations.html
+++ b/0.6/known-limitations.html
@@ -13,7 +13,7 @@
-
+
diff --git a/404.html b/404.html
index f0cb575aec..ac09120cd5 100644
--- a/404.html
+++ b/404.html
@@ -13,7 +13,7 @@
-
+
diff --git a/about.html b/about.html
index 55fae75538..4cca43f47d 100644
--- a/about.html
+++ b/about.html
@@ -13,7 +13,7 @@
-
+
diff --git a/about/telemetry.html b/about/telemetry.html
index 956d790f2b..90f1fce753 100644
--- a/about/telemetry.html
+++ b/about/telemetry.html
@@ -13,7 +13,7 @@
-
+
diff --git a/architecture.html b/architecture.html
index cede89d12c..e3e33a58aa 100644
--- a/architecture.html
+++ b/architecture.html
@@ -13,7 +13,7 @@
-
+
diff --git a/architecture/attestation.html b/architecture/attestation.html
index 6b7be1d8c1..5d18ee0b97 100644
--- a/architecture/attestation.html
+++ b/architecture/attestation.html
@@ -13,7 +13,7 @@
-
+
diff --git a/architecture/certificates.html b/architecture/certificates.html
index 1c2748a664..45c6050d92 100644
--- a/architecture/certificates.html
+++ b/architecture/certificates.html
@@ -13,7 +13,7 @@
-
+
diff --git a/architecture/observability.html b/architecture/observability.html
index 6c3425683e..a5810ae247 100644
--- a/architecture/observability.html
+++ b/architecture/observability.html
@@ -13,7 +13,7 @@
-
+
diff --git a/assets/js/ca5b6702.3d3591d2.js b/assets/js/ca5b6702.3d3591d2.js
new file mode 100644
index 0000000000..e9708992fd
--- /dev/null
+++ b/assets/js/ca5b6702.3d3591d2.js
@@ -0,0 +1 @@
+"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[5945],{6022:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>a,contentTitle:()=>o,default:()=>l,frontMatter:()=>r,metadata:()=>c,toc:()=>h});var s=t(4848),i=t(8453);const r={},o="Service Mesh",c={id:"components/service-mesh",title:"Service Mesh",description:"The Contrast service mesh secures the communication of the workload by automatically",source:"@site/docs/components/service-mesh.md",sourceDirName:"components",slug:"/components/service-mesh",permalink:"/contrast/next/components/service-mesh",draft:!1,unlisted:!1,editUrl:"https://github.com/edgelesssys/contrast/edit/main/docs/docs/components/service-mesh.md",tags:[],version:"current",frontMatter:{},sidebar:"docs",previous:{title:"Policies",permalink:"/contrast/next/components/policies"},next:{title:"Architecture",permalink:"/contrast/next/architecture/"}},a={},h=[{value:"Configuring the Proxy",id:"configuring-the-proxy",level:2},{value:"Ingress",id:"ingress",level:3},{value:"Egress",id:"egress",level:3}];function d(e){const n={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",ul:"ul",...(0,i.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.h1,{id:"service-mesh",children:"Service Mesh"}),"\n",(0,s.jsxs)(n.p,{children:["The Contrast service mesh secures the communication of the workload by automatically\nwrapping the network traffic inside mutual TLS (mTLS) connections. The\nverification of the endpoints in the connection establishment is based on\ncertificates that are part of the\n",(0,s.jsx)(n.a,{href:"/contrast/next/architecture/certificates",children:"PKI of the Coordinator"}),"."]}),"\n",(0,s.jsxs)(n.p,{children:["The service mesh can be enabled on a per-workload basis by adding a service mesh\nconfiguration to the workload's object annotations. During the ",(0,s.jsx)(n.code,{children:"contrast generate"}),"\nstep, the service mesh is added as a ",(0,s.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/",children:"sidecar\ncontainer"})," to\nall workloads which have a specified configuration. The service mesh container first\nsets up ",(0,s.jsx)(n.code,{children:"iptables"})," rules based on its configuration and then starts\n",(0,s.jsx)(n.a,{href:"https://www.envoyproxy.io/",children:"Envoy"})," for TLS origination and termination."]}),"\n",(0,s.jsx)(n.h2,{id:"configuring-the-proxy",children:"Configuring the Proxy"}),"\n",(0,s.jsx)(n.p,{children:"The service mesh container can be configured using the following object annotations:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"contrast.edgeless.systems/servicemesh-ingress"})," to configure ingress."]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"contrast.edgeless.systems/servicemesh-egress"})," to configure egress."]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"contrast.edgeless.systems/servicemesh-admin-interface-port"})," to configure the Envoy\nadmin interface. If not specified, no admin interface will be started."]}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["If you aren't using the automatic service mesh injection and want to configure the\nservice mesh manually, set the environment variables ",(0,s.jsx)(n.code,{children:"CONTRAST_INGRESS_PROXY_CONFIG"}),",\n",(0,s.jsx)(n.code,{children:"CONTRAST_EGRESS_PROXY_CONFIG"})," and ",(0,s.jsx)(n.code,{children:"CONTRAST_ADMIN_PORT"})," in the service mesh sidecar directly."]}),"\n",(0,s.jsx)(n.h3,{id:"ingress",children:"Ingress"}),"\n",(0,s.jsxs)(n.p,{children:["All TCP ingress traffic is routed over Envoy by default. Since we use\n",(0,s.jsx)(n.a,{href:"https://docs.kernel.org/networking/tproxy.html",children:"TPROXY"}),", the destination address\nremains the same throughout the packet handling."]}),"\n",(0,s.jsxs)(n.p,{children:["Any incoming connection is required to present a client certificate signed by the\n",(0,s.jsx)(n.a,{href:"/contrast/next/architecture/certificates#usage-of-the-different-certificates",children:"mesh CA certificate"}),".\nEnvoy presents a certificate chain of the mesh\ncertificate of the workload and the intermediate CA certificate as the server certificate."]}),"\n",(0,s.jsxs)(n.p,{children:["If the deployment contains workloads which should be reachable from outside the\nService Mesh, while still handing out the certificate chain, disable client\nauthentication by setting the annotation ",(0,s.jsx)(n.code,{children:"contrast.edgeless.systems/servicemesh-ingress"})," as\n",(0,s.jsx)(n.code,{children:"##false"}),". Separate multiple entries with ",(0,s.jsx)(n.code,{children:"##"}),". You can choose any\ndescriptive string identifying the service on the given port for the ",(0,s.jsx)(n.code,{children:""})," field,\nas it's only informational."]}),"\n",(0,s.jsxs)(n.p,{children:["Disable redirection and TLS termination altogether by specifying\n",(0,s.jsx)(n.code,{children:"##true"}),". This can be beneficial if the workload itself handles TLS\non that port or if the information exposed on this port is non-sensitive."]}),"\n",(0,s.jsx)(n.p,{children:"The following example workload exposes a web service on port 8080 and metrics on\nport 7890. The web server is exposed to a 3rd party end-user which wants to\nverify the deployment, therefore it's still required that the server hands out\nit certificate chain signed by the mesh CA certificate. The metrics should be\nexposed via TCP without TLS."}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'apiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: web\n annotations:\n contrast.edgeless.systems/servicemesh-ingress: "web#8080#false##metrics#7890#true"\nspec:\n replicas: 1\n template:\n spec:\n runtimeClassName: contrast-cc\n containers:\n - name: web-svc\n image: ghcr.io/edgelesssys/frontend:v1.2.3@...\n ports:\n - containerPort: 8080\n name: web\n - containerPort: 7890\n name: metrics\n'})}),"\n",(0,s.jsxs)(n.p,{children:["When invoking ",(0,s.jsx)(n.code,{children:"contrast generate"}),", the resulting deployment will be injected with the\nContrast service mesh as an init container."]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'# ...\n initContainers:\n - env:\n - name: CONTRAST_INGRESS_PROXY_CONFIG\n value: "web#8080#false##metrics#7890#true"\n image: "ghcr.io/edgelesssys/contrast/service-mesh-proxy:latest"\n name: contrast-service-mesh\n restartPolicy: Always\n securityContext:\n capabilities:\n add:\n - NET_ADMIN\n privileged: true\n volumeMounts:\n - name: contrast-tls-certs\n mountPath: /tls-config\n'})}),"\n",(0,s.jsxs)(n.p,{children:["Note, that changing the environment variables of the sidecar container directly will\nonly have an effect if the workload isn't configured to automatically generate a\nservice mesh component on ",(0,s.jsx)(n.code,{children:"contrast generate"}),". Otherwise, the service mesh sidecar\ncontainer will be regenerated on every invocation of the command."]}),"\n",(0,s.jsx)(n.h3,{id:"egress",children:"Egress"}),"\n",(0,s.jsx)(n.p,{children:"To be able to route the egress traffic of the workload through Envoy, the remote\nendpoints' IP address and port must be configurable."}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Choose an IP address inside the ",(0,s.jsx)(n.code,{children:"127.0.0.0/8"})," CIDR and a port not yet in use\nby the pod."]}),"\n",(0,s.jsx)(n.li,{children:"Configure the workload to connect to this IP address and port."}),"\n",(0,s.jsxs)(n.li,{children:["Set ",(0,s.jsx)(n.code,{children:"#:#:"}),"\nas the ",(0,s.jsx)(n.code,{children:"contrast.edgeless.systems/servicemesh-egress"})," workload annotation. Separate multiple\nentries with ",(0,s.jsx)(n.code,{children:"##"}),". Choose any string identifying the service on the given port as\n",(0,s.jsx)(n.code,{children:""}),"."]}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["This redirects the traffic over Envoy. The endpoint must present a valid\ncertificate chain which must be verifiable with the\n",(0,s.jsx)(n.a,{href:"/contrast/next/architecture/certificates#usage-of-the-different-certificates",children:"mesh CA certificate"}),".\nFurthermore, Envoy uses a certificate chain with the mesh certificate of the workload\nand the intermediate CA certificate as the client certificate."]}),"\n",(0,s.jsxs)(n.p,{children:["The following example workload has no ingress connections and two egress\nconnection to different microservices. The microservices are part\nof the confidential deployment. One is reachable under ",(0,s.jsx)(n.code,{children:"billing-svc:8080"})," and\nthe other under ",(0,s.jsx)(n.code,{children:"cart-svc:8080"}),"."]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'apiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: web\n annotations:\n contrast.edgeless.systems/servicemesh-egress: "billing#127.137.0.1:8081#billing-svc:8080##cart#127.137.0.2:8081#cart-svc:8080"\nspec:\n replicas: 1\n template:\n spec:\n runtimeClassName: contrast-cc\n containers:\n - name: currency-conversion\n image: ghcr.io/edgelesssys/conversion:v1.2.3@...\n'})})]})}function l(e={}){const{wrapper:n}={...(0,i.R)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},8453:(e,n,t)=>{t.d(n,{R:()=>o,x:()=>c});var s=t(6540);const i={},r=s.createContext(i);function o(e){const n=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function c(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:o(e.components),s.createElement(r.Provider,{value:n},e.children)}}}]);
\ No newline at end of file
diff --git a/assets/js/ca5b6702.c0f8bad1.js b/assets/js/ca5b6702.c0f8bad1.js
deleted file mode 100644
index 90919a7886..0000000000
--- a/assets/js/ca5b6702.c0f8bad1.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[5945],{6022:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>a,contentTitle:()=>o,default:()=>l,frontMatter:()=>r,metadata:()=>c,toc:()=>h});var s=t(4848),i=t(8453);const r={},o="Service Mesh",c={id:"components/service-mesh",title:"Service Mesh",description:"The Contrast service mesh secures the communication of the workload by automatically",source:"@site/docs/components/service-mesh.md",sourceDirName:"components",slug:"/components/service-mesh",permalink:"/contrast/next/components/service-mesh",draft:!1,unlisted:!1,editUrl:"https://github.com/edgelesssys/contrast/edit/main/docs/docs/components/service-mesh.md",tags:[],version:"current",frontMatter:{},sidebar:"docs",previous:{title:"Policies",permalink:"/contrast/next/components/policies"},next:{title:"Architecture",permalink:"/contrast/next/architecture/"}},a={},h=[{value:"Configuring the Proxy",id:"configuring-the-proxy",level:2},{value:"Ingress",id:"ingress",level:3},{value:"Egress",id:"egress",level:3}];function d(e){const n={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",ul:"ul",...(0,i.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.h1,{id:"service-mesh",children:"Service Mesh"}),"\n",(0,s.jsxs)(n.p,{children:["The Contrast service mesh secures the communication of the workload by automatically\nwrapping the network traffic inside mutual TLS (mTLS) connections. The\nverification of the endpoints in the connection establishment is based on\ncertificates that are part of the\n",(0,s.jsx)(n.a,{href:"/contrast/next/architecture/certificates",children:"PKI of the Coordinator"}),"."]}),"\n",(0,s.jsxs)(n.p,{children:["The service mesh can be enabled on a per-workload basis by adding a service mesh\nconfiguration to the workload's object annotations. During the ",(0,s.jsx)(n.code,{children:"contrast generate"}),"\nstep, the service mesh is added as a ",(0,s.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/",children:"sidecar\ncontainer"})," to\nall workloads which have a specified configuration. The service mesh container first\nsets up ",(0,s.jsx)(n.code,{children:"iptables"})," rules based on its configuration and then starts\n",(0,s.jsx)(n.a,{href:"https://www.envoyproxy.io/",children:"Envoy"})," for TLS origination and termination."]}),"\n",(0,s.jsx)(n.h2,{id:"configuring-the-proxy",children:"Configuring the Proxy"}),"\n",(0,s.jsx)(n.p,{children:"The service mesh container can be configured using the following object annotations:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"contrast.edgeless.systems/servicemesh-ingress"})," to configure ingress."]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"contrast.edgeless.systems/servicemesh-egress"})," to configure egress."]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"contrast.edgeless.systems/servicemesh-admin-interface-port"})," to configure the Envoy\nadmin interface. If not specified, no admin interface will be started."]}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["If you aren't using the automatic service mesh injection and want to configure the\nservice mesh manually, set the environment variables ",(0,s.jsx)(n.code,{children:"EDG_INGRESS_PROXY_CONFIG"}),",\n",(0,s.jsx)(n.code,{children:"EDG_EGRESS_PROXY_CONFIG"})," and ",(0,s.jsx)(n.code,{children:"EDG_ADMIN_PORT"})," in the service mesh sidecar directly."]}),"\n",(0,s.jsx)(n.h3,{id:"ingress",children:"Ingress"}),"\n",(0,s.jsxs)(n.p,{children:["All TCP ingress traffic is routed over Envoy by default. Since we use\n",(0,s.jsx)(n.a,{href:"https://docs.kernel.org/networking/tproxy.html",children:"TPROXY"}),", the destination address\nremains the same throughout the packet handling."]}),"\n",(0,s.jsxs)(n.p,{children:["Any incoming connection is required to present a client certificate signed by the\n",(0,s.jsx)(n.a,{href:"/contrast/next/architecture/certificates#usage-of-the-different-certificates",children:"mesh CA certificate"}),".\nEnvoy presents a certificate chain of the mesh\ncertificate of the workload and the intermediate CA certificate as the server certificate."]}),"\n",(0,s.jsxs)(n.p,{children:["If the deployment contains workloads which should be reachable from outside the\nService Mesh, while still handing out the certificate chain, disable client\nauthentication by setting the annotation ",(0,s.jsx)(n.code,{children:"contrast.edgeless.systems/servicemesh-ingress"})," as\n",(0,s.jsx)(n.code,{children:"##false"}),". Separate multiple entries with ",(0,s.jsx)(n.code,{children:"##"}),". You can choose any\ndescriptive string identifying the service on the given port for the ",(0,s.jsx)(n.code,{children:""})," field,\nas it's only informational."]}),"\n",(0,s.jsxs)(n.p,{children:["Disable redirection and TLS termination altogether by specifying\n",(0,s.jsx)(n.code,{children:"##true"}),". This can be beneficial if the workload itself handles TLS\non that port or if the information exposed on this port is non-sensitive."]}),"\n",(0,s.jsx)(n.p,{children:"The following example workload exposes a web service on port 8080 and metrics on\nport 7890. The web server is exposed to a 3rd party end-user which wants to\nverify the deployment, therefore it's still required that the server hands out\nit certificate chain signed by the mesh CA certificate. The metrics should be\nexposed via TCP without TLS."}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'apiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: web\n annotations:\n contrast.edgeless.systems/servicemesh-ingress: "web#8080#false##metrics#7890#true"\nspec:\n replicas: 1\n template:\n spec:\n runtimeClassName: contrast-cc\n containers:\n - name: web-svc\n image: ghcr.io/edgelesssys/frontend:v1.2.3@...\n ports:\n - containerPort: 8080\n name: web\n - containerPort: 7890\n name: metrics\n'})}),"\n",(0,s.jsxs)(n.p,{children:["When invoking ",(0,s.jsx)(n.code,{children:"contrast generate"}),", the resulting deployment will be injected with the\nContrast service mesh as an init container."]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'# ...\n initContainers:\n - env:\n - name: EDG_INGRESS_PROXY_CONFIG\n value: "web#8080#false##metrics#7890#true"\n image: "ghcr.io/edgelesssys/contrast/service-mesh-proxy:latest"\n name: contrast-service-mesh\n restartPolicy: Always\n securityContext:\n capabilities:\n add:\n - NET_ADMIN\n privileged: true\n volumeMounts:\n - name: contrast-tls-certs\n mountPath: /tls-config\n'})}),"\n",(0,s.jsxs)(n.p,{children:["Note, that changing the environment variables of the sidecar container directly will\nonly have an effect if the workload isn't configured to automatically generate a\nservice mesh component on ",(0,s.jsx)(n.code,{children:"contrast generate"}),". Otherwise, the service mesh sidecar\ncontainer will be regenerated on every invocation of the command."]}),"\n",(0,s.jsx)(n.h3,{id:"egress",children:"Egress"}),"\n",(0,s.jsx)(n.p,{children:"To be able to route the egress traffic of the workload through Envoy, the remote\nendpoints' IP address and port must be configurable."}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Choose an IP address inside the ",(0,s.jsx)(n.code,{children:"127.0.0.0/8"})," CIDR and a port not yet in use\nby the pod."]}),"\n",(0,s.jsx)(n.li,{children:"Configure the workload to connect to this IP address and port."}),"\n",(0,s.jsxs)(n.li,{children:["Set ",(0,s.jsx)(n.code,{children:"#:#:"}),"\nas the ",(0,s.jsx)(n.code,{children:"contrast.edgeless.systems/servicemesh-egress"})," workload annotation. Separate multiple\nentries with ",(0,s.jsx)(n.code,{children:"##"}),". Choose any string identifying the service on the given port as\n",(0,s.jsx)(n.code,{children:""}),"."]}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["This redirects the traffic over Envoy. The endpoint must present a valid\ncertificate chain which must be verifiable with the\n",(0,s.jsx)(n.a,{href:"/contrast/next/architecture/certificates#usage-of-the-different-certificates",children:"mesh CA certificate"}),".\nFurthermore, Envoy uses a certificate chain with the mesh certificate of the workload\nand the intermediate CA certificate as the client certificate."]}),"\n",(0,s.jsxs)(n.p,{children:["The following example workload has no ingress connections and two egress\nconnection to different microservices. The microservices are part\nof the confidential deployment. One is reachable under ",(0,s.jsx)(n.code,{children:"billing-svc:8080"})," and\nthe other under ",(0,s.jsx)(n.code,{children:"cart-svc:8080"}),"."]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'apiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: web\n annotations:\n contrast.edgeless.systems/servicemesh-egress: "billing#127.137.0.1:8081#billing-svc:8080##cart#127.137.0.2:8081#cart-svc:8080"\nspec:\n replicas: 1\n template:\n spec:\n runtimeClassName: contrast-cc\n containers:\n - name: currency-conversion\n image: ghcr.io/edgelesssys/conversion:v1.2.3@...\n'})})]})}function l(e={}){const{wrapper:n}={...(0,i.R)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},8453:(e,n,t)=>{t.d(n,{R:()=>o,x:()=>c});var s=t(6540);const i={},r=s.createContext(i);function o(e){const n=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function c(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:o(e.components),s.createElement(r.Provider,{value:n},e.children)}}}]);
\ No newline at end of file
diff --git a/assets/js/runtime~main.770460e1.js b/assets/js/runtime~main.efbcb636.js
similarity index 99%
rename from assets/js/runtime~main.770460e1.js
rename to assets/js/runtime~main.efbcb636.js
index 0f920e082f..8a0534b742 100644
--- a/assets/js/runtime~main.770460e1.js
+++ b/assets/js/runtime~main.efbcb636.js
@@ -1 +1 @@
-(()=>{"use strict";var e,a,d,c,b,f={},t={};function r(e){var a=t[e];if(void 0!==a)return a.exports;var d=t[e]={exports:{}};return f[e].call(d.exports,d,d.exports,r),d.exports}r.m=f,e=[],r.O=(a,d,c,b)=>{if(!d){var f=1/0;for(i=0;i=b)&&Object.keys(r.O).every((e=>r.O[e](d[o])))?d.splice(o--,1):(t=!1,b0&&e[i-1][2]>b;i--)e[i]=e[i-1];e[i]=[d,c,b]},r.n=e=>{var a=e&&e.__esModule?()=>e.default:()=>e;return r.d(a,{a:a}),a},d=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,r.t=function(e,c){if(1&c&&(e=this(e)),8&c)return e;if("object"==typeof e&&e){if(4&c&&e.__esModule)return e;if(16&c&&"function"==typeof e.then)return e}var b=Object.create(null);r.r(b);var f={};a=a||[null,d({}),d([]),d(d)];for(var t=2&c&&e;"object"==typeof t&&!~a.indexOf(t);t=d(t))Object.getOwnPropertyNames(t).forEach((a=>f[a]=()=>e[a]));return f.default=()=>e,r.d(b,f),b},r.d=(e,a)=>{for(var d in a)r.o(a,d)&&!r.o(e,d)&&Object.defineProperty(e,d,{enumerable:!0,get:a[d]})},r.f={},r.e=e=>Promise.all(Object.keys(r.f).reduce(((a,d)=>(r.f[d](e,a),a)),[])),r.u=e=>"assets/js/"+({89:"b3916dd3",95:"35dd9928",221:"e446d98f",390:"c09e49b9",430:"207bb774",495:"bf614533",594:"6903d0da",780:"1f60d0d4",782:"989c6d03",801:"9a99019d",995:"2496d21b",1037:"598d1ce7",1112:"966b9f47",1158:"04102e85",1226:"927cf76e",1450:"eb2a2fd7",1514:"173fd1a8",1560:"1c9b88ee",1575:"a161c24f",1632:"e277c26a",1658:"fbad2ec0",1734:"d580a1fd",1739:"896da145",1751:"327db732",1841:"8132774f",1889:"3a77bb3e",1956:"f593d43a",1965:"841d5349",2005:"64d58a39",2045:"abfbdc79",2254:"54c82979",2454:"dfd9c366",2472:"f65fea7a",2550:"4fb24623",2564:"c4b4ced0",2623:"e1e441c9",2700:"2dbe31cc",2772:"5eab7755",2841:"e2b3b970",2912:"9a06ae3d",2941:"9397123b",3116:"8dca39c2",3357:"20382dd7",3459:"39db4684",3506:"6478b99f",3690:"b27c3275",3702:"de615ffd",3712:"69ec948c",3876:"018595b3",3976:"0e384e19",4158:"42e97ff0",4206:"c1fac065",4352:"a0103954",4670:"9d9e06f4",4687:"89a4f0ca",4972:"dc1d895a",5225:"bf823012",5231:"7edb0f0d",5233:"dc7abf1f",5310:"3d9be0cc",5316:"ee8b52db",5335:"8c9a8791",5388:"15b9bf06",5390:"21d7c4d4",5541:"642ed902",5742:"aba21aa0",5945:"ca5b6702",5999:"54c6367b",6408:"f47dd6e5",6440:"567e04ee",6470:"06eada7a",6733:"f31967d8",6739:"0c24bc66",6969:"14eb3368",7061:"50474e10",7098:"a7bd4aaa",7292:"2a2a0c40",7682:"640cb024",7697:"27d05faa",7882:"75100f0d",8001:"bced0f3c",8117:"3e02a241",8170:"4f453872",8245:"bd783ed9",8295:"aa0f7abf",8346:"2a3b4dc0",8401:"17896441",8403:"20e0cfa9",8597:"75d659e1",8683:"ab09c42c",8921:"90af0d0d",9013:"9d9f8394",9025:"7680d80e",9048:"a94703ab",9103:"baef5027",9119:"cdb2b1a5",9361:"45c98560",9588:"a3713279",9634:"d2630e76",9647:"5e95c892",9707:"6bc29321"}[e]||e)+"."+{89:"9f2475ce",95:"b2cea67a",221:"9951f6ff",390:"30b2ec2b",430:"01e30e7c",495:"43ade151",594:"bf8e0465",780:"d2d03ab5",782:"bea4c395",801:"d95716b0",995:"b2ac349f",1037:"74577bcf",1112:"851d9232",1158:"9c58110b",1169:"5ad87170",1176:"d5e4a8eb",1226:"8e6be213",1245:"e4b990e2",1303:"69079068",1331:"77b06ddb",1398:"c3d343ed",1450:"3a7ab9fa",1514:"0c567742",1560:"b526326a",1575:"97edb17c",1632:"0292e2dd",1658:"b63c541d",1734:"ea255aea",1739:"7dbe520b",1751:"15f83beb",1841:"1de38313",1889:"e8e024aa",1946:"3eadd52b",1956:"523e84a5",1965:"ed168979",2005:"26e71bd3",2045:"184a9187",2130:"0922f94a",2254:"3fe1ca37",2376:"6a3d85a9",2453:"de37ff7f",2454:"d6927a3f",2472:"f9d2ff7f",2548:"a1ae0e8e",2550:"eafb1f5e",2560:"573da3e3",2564:"1ba53d19",2623:"7c448aee",2700:"23ed6e24",2772:"a8159fc5",2841:"e0254c45",2843:"540ef626",2912:"fb47fc7f",2925:"4f48a163",2941:"66a6a5bd",2983:"8d3f13e7",3068:"ae17e6ec",3116:"5b49b417",3357:"cf2ae035",3459:"2491f983",3506:"bfc4dc80",3626:"d3a9ca53",3690:"e426fee9",3702:"72df5799",3706:"778627d4",3712:"12d30d5a",3876:"1f3dcdbe",3976:"eefd1923",4158:"97145702",4162:"b6a1d3de",4206:"9d37cc0f",4352:"09f74159",4670:"6a2fc3a7",4687:"e69b634d",4741:"630605fe",4943:"eb3e33a1",4972:"f9c25581",5225:"0270529d",5231:"8c1d3c96",5233:"f88495c9",5310:"af7e4d80",5316:"bc9682d5",5335:"ba05df96",5388:"cf08bc04",5390:"d99748b8",5541:"03ec88dd",5742:"72b927eb",5945:"c0f8bad1",5999:"89604fca",6408:"c3d644a6",6420:"53d2d624",6440:"87e0d371",6470:"718c5fe4",6733:"02fdd324",6739:"a88d4a1d",6788:"7ebf2cc6",6803:"6f997804",6969:"6521ceb4",7061:"cbefe06e",7065:"d6876adc",7098:"37c95d8f",7292:"2c8af26c",7426:"5a4249c1",7560:"551b947d",7682:"e3132bff",7697:"e2cc044b",7882:"c1fffa51",8001:"288afdd2",8055:"5cc9cc7b",8117:"12d7f0b0",8170:"d3fc9f7b",8245:"9fe9e0e3",8295:"4f33ae47",8346:"94d15a4b",8401:"e9a4109b",8403:"9a3e8059",8478:"15c18555",8597:"80248816",8635:"6d8b9c52",8683:"eec1572a",8810:"6a1249f4",8869:"6a040d5e",8921:"bf7ec2fa",9013:"df86b600",9025:"9843e408",9048:"48e05a10",9103:"1f6cfe86",9119:"da9892fb",9361:"3cd52ec1",9588:"6cd13a23",9634:"aa3eb948",9647:"854f55ea",9689:"4b868b29",9707:"f428198b"}[e]+".js",r.miniCssF=e=>{},r.g=function(){if("object"==typeof globalThis)return globalThis;try{return this||new Function("return this")()}catch(e){if("object"==typeof window)return window}}(),r.o=(e,a)=>Object.prototype.hasOwnProperty.call(e,a),c={},b="contrast-docs:",r.l=(e,a,d,f)=>{if(c[e])c[e].push(a);else{var t,o;if(void 0!==d)for(var n=document.getElementsByTagName("script"),i=0;i{t.onerror=t.onload=null,clearTimeout(l);var b=c[e];if(delete c[e],t.parentNode&&t.parentNode.removeChild(t),b&&b.forEach((e=>e(d))),a)return a(d)},l=setTimeout(s.bind(null,void 0,{type:"timeout",target:t}),12e4);t.onerror=s.bind(null,t.onerror),t.onload=s.bind(null,t.onload),o&&document.head.appendChild(t)}},r.r=e=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},r.p="/contrast/",r.gca=function(e){return e={17896441:"8401",b3916dd3:"89","35dd9928":"95",e446d98f:"221",c09e49b9:"390","207bb774":"430",bf614533:"495","6903d0da":"594","1f60d0d4":"780","989c6d03":"782","9a99019d":"801","2496d21b":"995","598d1ce7":"1037","966b9f47":"1112","04102e85":"1158","927cf76e":"1226",eb2a2fd7:"1450","173fd1a8":"1514","1c9b88ee":"1560",a161c24f:"1575",e277c26a:"1632",fbad2ec0:"1658",d580a1fd:"1734","896da145":"1739","327db732":"1751","8132774f":"1841","3a77bb3e":"1889",f593d43a:"1956","841d5349":"1965","64d58a39":"2005",abfbdc79:"2045","54c82979":"2254",dfd9c366:"2454",f65fea7a:"2472","4fb24623":"2550",c4b4ced0:"2564",e1e441c9:"2623","2dbe31cc":"2700","5eab7755":"2772",e2b3b970:"2841","9a06ae3d":"2912","9397123b":"2941","8dca39c2":"3116","20382dd7":"3357","39db4684":"3459","6478b99f":"3506",b27c3275:"3690",de615ffd:"3702","69ec948c":"3712","018595b3":"3876","0e384e19":"3976","42e97ff0":"4158",c1fac065:"4206",a0103954:"4352","9d9e06f4":"4670","89a4f0ca":"4687",dc1d895a:"4972",bf823012:"5225","7edb0f0d":"5231",dc7abf1f:"5233","3d9be0cc":"5310",ee8b52db:"5316","8c9a8791":"5335","15b9bf06":"5388","21d7c4d4":"5390","642ed902":"5541",aba21aa0:"5742",ca5b6702:"5945","54c6367b":"5999",f47dd6e5:"6408","567e04ee":"6440","06eada7a":"6470",f31967d8:"6733","0c24bc66":"6739","14eb3368":"6969","50474e10":"7061",a7bd4aaa:"7098","2a2a0c40":"7292","640cb024":"7682","27d05faa":"7697","75100f0d":"7882",bced0f3c:"8001","3e02a241":"8117","4f453872":"8170",bd783ed9:"8245",aa0f7abf:"8295","2a3b4dc0":"8346","20e0cfa9":"8403","75d659e1":"8597",ab09c42c:"8683","90af0d0d":"8921","9d9f8394":"9013","7680d80e":"9025",a94703ab:"9048",baef5027:"9103",cdb2b1a5:"9119","45c98560":"9361",a3713279:"9588",d2630e76:"9634","5e95c892":"9647","6bc29321":"9707"}[e]||e,r.p+r.u(e)},(()=>{var e={5354:0,1869:0};r.f.j=(a,d)=>{var c=r.o(e,a)?e[a]:void 0;if(0!==c)if(c)d.push(c[2]);else if(/^(1869|5354)$/.test(a))e[a]=0;else{var b=new Promise(((d,b)=>c=e[a]=[d,b]));d.push(c[2]=b);var f=r.p+r.u(a),t=new Error;r.l(f,(d=>{if(r.o(e,a)&&(0!==(c=e[a])&&(e[a]=void 0),c)){var b=d&&("load"===d.type?"missing":d.type),f=d&&d.target&&d.target.src;t.message="Loading chunk "+a+" failed.\n("+b+": "+f+")",t.name="ChunkLoadError",t.type=b,t.request=f,c[1](t)}}),"chunk-"+a,a)}},r.O.j=a=>0===e[a];var a=(a,d)=>{var c,b,f=d[0],t=d[1],o=d[2],n=0;if(f.some((a=>0!==e[a]))){for(c in t)r.o(t,c)&&(r.m[c]=t[c]);if(o)var i=o(r)}for(a&&a(d);n{"use strict";var e,a,d,c,b,f={},t={};function r(e){var a=t[e];if(void 0!==a)return a.exports;var d=t[e]={exports:{}};return f[e].call(d.exports,d,d.exports,r),d.exports}r.m=f,e=[],r.O=(a,d,c,b)=>{if(!d){var f=1/0;for(i=0;i=b)&&Object.keys(r.O).every((e=>r.O[e](d[o])))?d.splice(o--,1):(t=!1,b0&&e[i-1][2]>b;i--)e[i]=e[i-1];e[i]=[d,c,b]},r.n=e=>{var a=e&&e.__esModule?()=>e.default:()=>e;return r.d(a,{a:a}),a},d=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,r.t=function(e,c){if(1&c&&(e=this(e)),8&c)return e;if("object"==typeof e&&e){if(4&c&&e.__esModule)return e;if(16&c&&"function"==typeof e.then)return e}var b=Object.create(null);r.r(b);var f={};a=a||[null,d({}),d([]),d(d)];for(var t=2&c&&e;"object"==typeof t&&!~a.indexOf(t);t=d(t))Object.getOwnPropertyNames(t).forEach((a=>f[a]=()=>e[a]));return f.default=()=>e,r.d(b,f),b},r.d=(e,a)=>{for(var d in a)r.o(a,d)&&!r.o(e,d)&&Object.defineProperty(e,d,{enumerable:!0,get:a[d]})},r.f={},r.e=e=>Promise.all(Object.keys(r.f).reduce(((a,d)=>(r.f[d](e,a),a)),[])),r.u=e=>"assets/js/"+({89:"b3916dd3",95:"35dd9928",221:"e446d98f",390:"c09e49b9",430:"207bb774",495:"bf614533",594:"6903d0da",780:"1f60d0d4",782:"989c6d03",801:"9a99019d",995:"2496d21b",1037:"598d1ce7",1112:"966b9f47",1158:"04102e85",1226:"927cf76e",1450:"eb2a2fd7",1514:"173fd1a8",1560:"1c9b88ee",1575:"a161c24f",1632:"e277c26a",1658:"fbad2ec0",1734:"d580a1fd",1739:"896da145",1751:"327db732",1841:"8132774f",1889:"3a77bb3e",1956:"f593d43a",1965:"841d5349",2005:"64d58a39",2045:"abfbdc79",2254:"54c82979",2454:"dfd9c366",2472:"f65fea7a",2550:"4fb24623",2564:"c4b4ced0",2623:"e1e441c9",2700:"2dbe31cc",2772:"5eab7755",2841:"e2b3b970",2912:"9a06ae3d",2941:"9397123b",3116:"8dca39c2",3357:"20382dd7",3459:"39db4684",3506:"6478b99f",3690:"b27c3275",3702:"de615ffd",3712:"69ec948c",3876:"018595b3",3976:"0e384e19",4158:"42e97ff0",4206:"c1fac065",4352:"a0103954",4670:"9d9e06f4",4687:"89a4f0ca",4972:"dc1d895a",5225:"bf823012",5231:"7edb0f0d",5233:"dc7abf1f",5310:"3d9be0cc",5316:"ee8b52db",5335:"8c9a8791",5388:"15b9bf06",5390:"21d7c4d4",5541:"642ed902",5742:"aba21aa0",5945:"ca5b6702",5999:"54c6367b",6408:"f47dd6e5",6440:"567e04ee",6470:"06eada7a",6733:"f31967d8",6739:"0c24bc66",6969:"14eb3368",7061:"50474e10",7098:"a7bd4aaa",7292:"2a2a0c40",7682:"640cb024",7697:"27d05faa",7882:"75100f0d",8001:"bced0f3c",8117:"3e02a241",8170:"4f453872",8245:"bd783ed9",8295:"aa0f7abf",8346:"2a3b4dc0",8401:"17896441",8403:"20e0cfa9",8597:"75d659e1",8683:"ab09c42c",8921:"90af0d0d",9013:"9d9f8394",9025:"7680d80e",9048:"a94703ab",9103:"baef5027",9119:"cdb2b1a5",9361:"45c98560",9588:"a3713279",9634:"d2630e76",9647:"5e95c892",9707:"6bc29321"}[e]||e)+"."+{89:"9f2475ce",95:"b2cea67a",221:"9951f6ff",390:"30b2ec2b",430:"01e30e7c",495:"43ade151",594:"bf8e0465",780:"d2d03ab5",782:"bea4c395",801:"d95716b0",995:"b2ac349f",1037:"74577bcf",1112:"851d9232",1158:"9c58110b",1169:"5ad87170",1176:"d5e4a8eb",1226:"8e6be213",1245:"e4b990e2",1303:"69079068",1331:"77b06ddb",1398:"c3d343ed",1450:"3a7ab9fa",1514:"0c567742",1560:"b526326a",1575:"97edb17c",1632:"0292e2dd",1658:"b63c541d",1734:"ea255aea",1739:"7dbe520b",1751:"15f83beb",1841:"1de38313",1889:"e8e024aa",1946:"3eadd52b",1956:"523e84a5",1965:"ed168979",2005:"26e71bd3",2045:"184a9187",2130:"0922f94a",2254:"3fe1ca37",2376:"6a3d85a9",2453:"de37ff7f",2454:"d6927a3f",2472:"f9d2ff7f",2548:"a1ae0e8e",2550:"eafb1f5e",2560:"573da3e3",2564:"1ba53d19",2623:"7c448aee",2700:"23ed6e24",2772:"a8159fc5",2841:"e0254c45",2843:"540ef626",2912:"fb47fc7f",2925:"4f48a163",2941:"66a6a5bd",2983:"8d3f13e7",3068:"ae17e6ec",3116:"5b49b417",3357:"cf2ae035",3459:"2491f983",3506:"bfc4dc80",3626:"d3a9ca53",3690:"e426fee9",3702:"72df5799",3706:"778627d4",3712:"12d30d5a",3876:"1f3dcdbe",3976:"eefd1923",4158:"97145702",4162:"b6a1d3de",4206:"9d37cc0f",4352:"09f74159",4670:"6a2fc3a7",4687:"e69b634d",4741:"630605fe",4943:"eb3e33a1",4972:"f9c25581",5225:"0270529d",5231:"8c1d3c96",5233:"f88495c9",5310:"af7e4d80",5316:"bc9682d5",5335:"ba05df96",5388:"cf08bc04",5390:"d99748b8",5541:"03ec88dd",5742:"72b927eb",5945:"3d3591d2",5999:"89604fca",6408:"c3d644a6",6420:"53d2d624",6440:"87e0d371",6470:"718c5fe4",6733:"02fdd324",6739:"a88d4a1d",6788:"7ebf2cc6",6803:"6f997804",6969:"6521ceb4",7061:"cbefe06e",7065:"d6876adc",7098:"37c95d8f",7292:"2c8af26c",7426:"5a4249c1",7560:"551b947d",7682:"e3132bff",7697:"e2cc044b",7882:"c1fffa51",8001:"288afdd2",8055:"5cc9cc7b",8117:"12d7f0b0",8170:"d3fc9f7b",8245:"9fe9e0e3",8295:"4f33ae47",8346:"94d15a4b",8401:"e9a4109b",8403:"9a3e8059",8478:"15c18555",8597:"80248816",8635:"6d8b9c52",8683:"eec1572a",8810:"6a1249f4",8869:"6a040d5e",8921:"bf7ec2fa",9013:"df86b600",9025:"9843e408",9048:"48e05a10",9103:"1f6cfe86",9119:"da9892fb",9361:"3cd52ec1",9588:"6cd13a23",9634:"aa3eb948",9647:"854f55ea",9689:"4b868b29",9707:"f428198b"}[e]+".js",r.miniCssF=e=>{},r.g=function(){if("object"==typeof globalThis)return globalThis;try{return this||new Function("return this")()}catch(e){if("object"==typeof window)return window}}(),r.o=(e,a)=>Object.prototype.hasOwnProperty.call(e,a),c={},b="contrast-docs:",r.l=(e,a,d,f)=>{if(c[e])c[e].push(a);else{var t,o;if(void 0!==d)for(var n=document.getElementsByTagName("script"),i=0;i{t.onerror=t.onload=null,clearTimeout(l);var b=c[e];if(delete c[e],t.parentNode&&t.parentNode.removeChild(t),b&&b.forEach((e=>e(d))),a)return a(d)},l=setTimeout(s.bind(null,void 0,{type:"timeout",target:t}),12e4);t.onerror=s.bind(null,t.onerror),t.onload=s.bind(null,t.onload),o&&document.head.appendChild(t)}},r.r=e=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},r.p="/contrast/",r.gca=function(e){return e={17896441:"8401",b3916dd3:"89","35dd9928":"95",e446d98f:"221",c09e49b9:"390","207bb774":"430",bf614533:"495","6903d0da":"594","1f60d0d4":"780","989c6d03":"782","9a99019d":"801","2496d21b":"995","598d1ce7":"1037","966b9f47":"1112","04102e85":"1158","927cf76e":"1226",eb2a2fd7:"1450","173fd1a8":"1514","1c9b88ee":"1560",a161c24f:"1575",e277c26a:"1632",fbad2ec0:"1658",d580a1fd:"1734","896da145":"1739","327db732":"1751","8132774f":"1841","3a77bb3e":"1889",f593d43a:"1956","841d5349":"1965","64d58a39":"2005",abfbdc79:"2045","54c82979":"2254",dfd9c366:"2454",f65fea7a:"2472","4fb24623":"2550",c4b4ced0:"2564",e1e441c9:"2623","2dbe31cc":"2700","5eab7755":"2772",e2b3b970:"2841","9a06ae3d":"2912","9397123b":"2941","8dca39c2":"3116","20382dd7":"3357","39db4684":"3459","6478b99f":"3506",b27c3275:"3690",de615ffd:"3702","69ec948c":"3712","018595b3":"3876","0e384e19":"3976","42e97ff0":"4158",c1fac065:"4206",a0103954:"4352","9d9e06f4":"4670","89a4f0ca":"4687",dc1d895a:"4972",bf823012:"5225","7edb0f0d":"5231",dc7abf1f:"5233","3d9be0cc":"5310",ee8b52db:"5316","8c9a8791":"5335","15b9bf06":"5388","21d7c4d4":"5390","642ed902":"5541",aba21aa0:"5742",ca5b6702:"5945","54c6367b":"5999",f47dd6e5:"6408","567e04ee":"6440","06eada7a":"6470",f31967d8:"6733","0c24bc66":"6739","14eb3368":"6969","50474e10":"7061",a7bd4aaa:"7098","2a2a0c40":"7292","640cb024":"7682","27d05faa":"7697","75100f0d":"7882",bced0f3c:"8001","3e02a241":"8117","4f453872":"8170",bd783ed9:"8245",aa0f7abf:"8295","2a3b4dc0":"8346","20e0cfa9":"8403","75d659e1":"8597",ab09c42c:"8683","90af0d0d":"8921","9d9f8394":"9013","7680d80e":"9025",a94703ab:"9048",baef5027:"9103",cdb2b1a5:"9119","45c98560":"9361",a3713279:"9588",d2630e76:"9634","5e95c892":"9647","6bc29321":"9707"}[e]||e,r.p+r.u(e)},(()=>{var e={5354:0,1869:0};r.f.j=(a,d)=>{var c=r.o(e,a)?e[a]:void 0;if(0!==c)if(c)d.push(c[2]);else if(/^(1869|5354)$/.test(a))e[a]=0;else{var b=new Promise(((d,b)=>c=e[a]=[d,b]));d.push(c[2]=b);var f=r.p+r.u(a),t=new Error;r.l(f,(d=>{if(r.o(e,a)&&(0!==(c=e[a])&&(e[a]=void 0),c)){var b=d&&("load"===d.type?"missing":d.type),f=d&&d.target&&d.target.src;t.message="Loading chunk "+a+" failed.\n("+b+": "+f+")",t.name="ChunkLoadError",t.type=b,t.request=f,c[1](t)}}),"chunk-"+a,a)}},r.O.j=a=>0===e[a];var a=(a,d)=>{var c,b,f=d[0],t=d[1],o=d[2],n=0;if(f.some((a=>0!==e[a]))){for(c in t)r.o(t,c)&&(r.m[c]=t[c]);if(o)var i=o(r)}for(a&&a(d);n
-
+
diff --git a/basics/features.html b/basics/features.html
index 207e2cb37a..534dbe6362 100644
--- a/basics/features.html
+++ b/basics/features.html
@@ -13,7 +13,7 @@
-
+
diff --git a/basics/security-benefits.html b/basics/security-benefits.html
index 24b776d93e..1226088901 100644
--- a/basics/security-benefits.html
+++ b/basics/security-benefits.html
@@ -13,7 +13,7 @@
-
+
diff --git a/components.html b/components.html
index 40b8d12627..b8cf69a86f 100644
--- a/components.html
+++ b/components.html
@@ -13,7 +13,7 @@
-
+
diff --git a/components/policies.html b/components/policies.html
index 1d93bae2cc..701586df25 100644
--- a/components/policies.html
+++ b/components/policies.html
@@ -13,7 +13,7 @@
-
+
diff --git a/components/runtime.html b/components/runtime.html
index 07e0eb0e62..f770fa076b 100644
--- a/components/runtime.html
+++ b/components/runtime.html
@@ -13,7 +13,7 @@
-
+
diff --git a/components/service-mesh.html b/components/service-mesh.html
index 7f81559609..069233acb7 100644
--- a/components/service-mesh.html
+++ b/components/service-mesh.html
@@ -13,7 +13,7 @@
-
+
diff --git a/deployment.html b/deployment.html
index 54e2d062cd..8c05de64e5 100644
--- a/deployment.html
+++ b/deployment.html
@@ -13,7 +13,7 @@
-
+
diff --git a/examples.html b/examples.html
index 60b37d195f..8651c95629 100644
--- a/examples.html
+++ b/examples.html
@@ -13,7 +13,7 @@
-
+
diff --git a/examples/emojivoto.html b/examples/emojivoto.html
index e4f599e21f..2d34d550af 100644
--- a/examples/emojivoto.html
+++ b/examples/emojivoto.html
@@ -13,7 +13,7 @@
-
+
diff --git a/features-limitations.html b/features-limitations.html
index b7f3348f6f..c132e48377 100644
--- a/features-limitations.html
+++ b/features-limitations.html
@@ -13,7 +13,7 @@
-
+
diff --git a/getting-started.html b/getting-started.html
index 27314ef651..43025d6ebf 100644
--- a/getting-started.html
+++ b/getting-started.html
@@ -13,7 +13,7 @@
-
+
diff --git a/getting-started/cluster-setup.html b/getting-started/cluster-setup.html
index f9cfb877ba..933bc6cc0f 100644
--- a/getting-started/cluster-setup.html
+++ b/getting-started/cluster-setup.html
@@ -13,7 +13,7 @@
-
+
diff --git a/getting-started/install.html b/getting-started/install.html
index 9b1bbc4075..dd739a7ed2 100644
--- a/getting-started/install.html
+++ b/getting-started/install.html
@@ -13,7 +13,7 @@
-
+
diff --git a/index.html b/index.html
index 08fd076009..40b5a21913 100644
--- a/index.html
+++ b/index.html
@@ -13,7 +13,7 @@
-
+
diff --git a/next.html b/next.html
index a28a552501..4600fad108 100644
--- a/next.html
+++ b/next.html
@@ -13,7 +13,7 @@
-
+
diff --git a/next/about.html b/next/about.html
index b8d3298587..2bbc740611 100644
--- a/next/about.html
+++ b/next/about.html
@@ -13,7 +13,7 @@
-
+
diff --git a/next/about/telemetry.html b/next/about/telemetry.html
index 4fe1767b85..344200b28f 100644
--- a/next/about/telemetry.html
+++ b/next/about/telemetry.html
@@ -13,7 +13,7 @@
-
+
diff --git a/next/architecture.html b/next/architecture.html
index 00ffa9c7a0..d2531c4573 100644
--- a/next/architecture.html
+++ b/next/architecture.html
@@ -13,7 +13,7 @@
-
+
diff --git a/next/architecture/attestation.html b/next/architecture/attestation.html
index d804c5f167..024b50e815 100644
--- a/next/architecture/attestation.html
+++ b/next/architecture/attestation.html
@@ -13,7 +13,7 @@
-
+
diff --git a/next/architecture/certificates.html b/next/architecture/certificates.html
index a2f88ed69d..ca33188209 100644
--- a/next/architecture/certificates.html
+++ b/next/architecture/certificates.html
@@ -13,7 +13,7 @@
-
+
diff --git a/next/architecture/observability.html b/next/architecture/observability.html
index b156662a25..e368866569 100644
--- a/next/architecture/observability.html
+++ b/next/architecture/observability.html
@@ -13,7 +13,7 @@
-
+
diff --git a/next/basics/confidential-containers.html b/next/basics/confidential-containers.html
index 0b14cf822e..e925b5f6c7 100644
--- a/next/basics/confidential-containers.html
+++ b/next/basics/confidential-containers.html
@@ -13,7 +13,7 @@
-
+
diff --git a/next/basics/features.html b/next/basics/features.html
index 3b88104c28..04e85b943e 100644
--- a/next/basics/features.html
+++ b/next/basics/features.html
@@ -13,7 +13,7 @@
-
+
diff --git a/next/basics/security-benefits.html b/next/basics/security-benefits.html
index e0385e80d4..d39195a716 100644
--- a/next/basics/security-benefits.html
+++ b/next/basics/security-benefits.html
@@ -13,7 +13,7 @@
-
+
diff --git a/next/components.html b/next/components.html
index 6713c7d155..eac74d361a 100644
--- a/next/components.html
+++ b/next/components.html
@@ -13,7 +13,7 @@
-
+
diff --git a/next/components/policies.html b/next/components/policies.html
index 5f92ee1961..8e2de3ad75 100644
--- a/next/components/policies.html
+++ b/next/components/policies.html
@@ -13,7 +13,7 @@
-
+
diff --git a/next/components/runtime.html b/next/components/runtime.html
index 091be594b7..a434a9abc4 100644
--- a/next/components/runtime.html
+++ b/next/components/runtime.html
@@ -13,7 +13,7 @@
-
+
diff --git a/next/components/service-mesh.html b/next/components/service-mesh.html
index f459e9f583..c738cd8d7a 100644
--- a/next/components/service-mesh.html
+++ b/next/components/service-mesh.html
@@ -13,7 +13,7 @@
-
+
@@ -39,8 +39,8 @@
Config
admin interface. If not specified, no admin interface will be started.
If you aren't using the automatic service mesh injection and want to configure the
-service mesh manually, set the environment variables EDG_INGRESS_PROXY_CONFIG,
-EDG_EGRESS_PROXY_CONFIG and EDG_ADMIN_PORT in the service mesh sidecar directly.
+service mesh manually, set the environment variables CONTRAST_INGRESS_PROXY_CONFIG,
+CONTRAST_EGRESS_PROXY_CONFIG and CONTRAST_ADMIN_PORT in the service mesh sidecar directly.