Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.5, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.5
Contrast
-
Welcome to the documentation of Contrast! Contrast runs confidential container deployments on Kubernetes at scale.
-
Contrast is based on the Kata Containers and
-Confidential Containers projects.
-Confidential Containers are Kubernetes pods that are executed inside a confidential micro-VM and provide strong hardware-based isolation from the surrounding environment.
-This works with unmodified containers in a lift-and-shift approach.
-Contrast currently targets the CoCo preview on AKS.
-
tip
See the 📄whitepaper for more information on confidential computing.
Contrast is designed to keep all data always encrypted and to prevent access from the infrastructure layer. It removes the infrastructure provider from the trusted computing base (TCB). This includes access from datacenter employees, privileged cloud admins, own cluster administrators, and attackers coming through the infrastructure, for example, malicious co-tenants escalating their privileges.
-
Contrast integrates fluently with the existing Kubernetes workflows. It's compatible with managed Kubernetes, can be installed as a day-2 operation and imposes only minimal changes to your deployment flow.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.5, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.5
Confidential Containers
-
Contrast uses some building blocks from Confidential Containers (CoCo), a CNCF Sandbox project that aims to standardize confidential computing at the pod level.
-The project is under active development and many of the high-level features are still in flux.
-Contrast uses the more stable, core primitive provided by CoCo: its Kubernetes runtime.
Kubernetes can be extended to use more than one container runtime with RuntimeClass objects.
-The Container Runtime Interface (CRI) implementation, for example containerd, dispatches pod management API calls to the appropriate RuntimeClass.
-RuntimeClass implementations are usually based on an OCI runtime, such as runc, runsc or crun.
-In CoCo's case, the runtime is Kata Containers with added confidential computing capabilities.
Kata Containers is an OCI runtime that runs pods in VMs.
-The guest VM spawns an agent process that accepts management commands from the Kata runtime running on the host.
-There are two options for creating pod VMs: local to the Kubernetes node, or remote VMs created with cloud provider APIs.
-Using local VMs requires either bare-metal servers or VMs with support for nested virtualization.
-Local VMs communicate with the host over a virtual socket.
-For remote VMs, host-to-agent communication is tunnelled through the cloud provider's network.
-
Kata Containers was originally designed to isolate the guest from the host, but it can also run pods in confidential VMs (CVMs) to shield pods from their underlying infrastructure.
-In confidential mode, the guest agent is configured with an Open Policy Agent (OPA) policy to authorize API calls from the host.
-This policy also contains checksums for the expected container images.
-It's derived from Kubernetes resource definitions and its checksum is included in the attestation report.
Azure Kubernetes Service (AKS) provides CoCo-enabled node pools as a preview offering.
-These node pools leverage Azure VM types capable of nested virtualization (CVM-in-VM) and the CoCo stack is pre-installed.
-Contrast can be deployed directly into a CoCo-enabled AKS cluster.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.5, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.5
Product Features
-
Contrast simplifies the deployment and management of Confidential Containers, offering optimal data security for your workloads while integrating seamlessly with your existing Kubernetes environment.
-
From a security perspective, Contrast employs the Confidential Containers concept and provides security benefits that go beyond individual containers, shielding your entire deployment from the underlying infrastructure.
-
From an operational perspective, Contrast provides the following key features:
-
-
-
Managed Kubernetes Compatibility: Initially compatible with Azure Kubernetes Service (AKS), Contrast is designed to support additional platforms such as AWS EKS and Google Cloud GKE as they begin to accommodate confidential containers.
-
-
-
Lightweight Installation: Contrast can be integrated as a day-2 operation within existing clusters, adding minimal components to your setup. This facilitates straightforward deployments using your existing YAML configurations, Helm charts, or Kustomization, enabling native Kubernetes orchestration of your applications.
-
-
-
Remote Attestation: Contrast generates a concise attestation statement that verifies the identity, authenticity, and integrity of your deployment both internally and to external parties. This architecture ensures that updates or scaling of the application don't compromise the attestation’s validity.
-
-
-
Service Mesh: Contrast securely manages a Public Key Infrastructure (PKI) for your deployments, issues workload-specific certificates, and establishes transparent mutual TLS (mTLS) connections across pods. This is done by harnessing the envoy proxy to ensure secure communications within your Kubernetes cluster.
-
-
-
-
\ No newline at end of file
diff --git a/pr-preview/pr-1071/0.5/basics/security-benefits.html b/pr-preview/pr-1071/0.5/basics/security-benefits.html
deleted file mode 100644
index 4a7d416748..0000000000
--- a/pr-preview/pr-1071/0.5/basics/security-benefits.html
+++ /dev/null
@@ -1,13 +0,0 @@
-
-
-
-
-
-security-benefits | Contrast
-
-
-
-
-
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.5, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.5
Workload deployment
-
The following instructions will guide you through the process of making an existing Kubernetes deployment
-confidential and deploying it together with Contrast.
-
A running CoCo-enabled cluster is required for these steps, see the setup guide on how to set it up.
Contrast will add annotations to your Kubernetes YAML files. If you want to keep the original files
-unchanged, you can copy the files into a separate local directory.
-You can also generate files from a Helm chart or from a Kustomization.
To specify that a workload (pod, deployment, etc.) should be deployed as confidential containers,
-add runtimeClassName: kata-cc-isolation to the pod spec (pod definition or template).
-In addition, add the Contrast Initializer as initContainers to these workloads and configure the
-workload to use the certificates written to a volumeMount named tls-certs.
Run the generate command to generate the execution policies and add them as annotations to your
-deployment files. A manifest.json with the reference values of your deployment will be created.
For the next steps, we will need to connect to the Coordinator. The released Coordinator resource
-includes a LoadBalancer definition we can use.
-
coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}')
-
Port-forwarding of Confidential Containers
kubectl port-forward uses a Container Runtime Interface (CRI) method that isn't supported by the Kata shim.
-If you can't use a public load balancer, you can deploy a port-forwarder.
-The port-forwarder relays traffic from a CoCo pod and can be accessed via kubectl port-forward.
After this step, the Coordinator will start issuing TLS certs to the workloads. The init container
-will fetch a certificate for the workload and the workload is started.
An end user (data owner) can verify the Contrast deployment using the verify command.
-
contrast verify -c"${coordinator}:1313"
-
The CLI will attest the Coordinator using embedded reference values. The CLI will write the service mesh
-root certificate and the history of manifests into the verify/ directory. In addition, the policies referenced
-in the manifest are also written to the directory.
You can securely connect to the workloads using the Coordinator's mesh-root.pem as a trusted CA certificate.
-First, expose the service on a public IP address via a LoadBalancer service:
-
kubectl patch svc ${MY_SERVICE}-p'{"spec": {"type": "LoadBalancer"}}' timeout 30s bash-c'until kubectl get service/${MY_SERVICE} --output=jsonpath='{.status.loadBalancer}' | grep "ingress"; do sleep 2 ; done' lbip=$(kubectl get svc ${MY_SERVICE}-o=jsonpath='{.status.loadBalancer.ingress[0].ip}') echo$lbip
-
Subject alternative names and LoadBalancer IP
By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed
-via load balancer IP in this demo. Tools like curl check the certificate for IP entries in the SAN field.
-Validation fails since the certificate contains no IP entries as a subject alternative name (SAN).
-For example, a connection attempt using the curl and the mesh root certificate with throw the following error:
$ curl--cacert ./verify/mesh-root.pem "https://${frontendIP}:443" curl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34'
-
Using openssl, the certificate of the service can be validated with the mesh-root.pem:
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.5, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.5
Confidential emoji voting
-
-
This tutorial guides you through deploying emojivoto as a
-confidential Contrast deployment and validating the deployment from a voters perspective.
-
Emojivoto is an example app allowing users to vote for different emojis and view votes
-on a leader board. It has a microservice architecture consisting of a
-web frontend (web), a gRPC backend for listing available emojis (emoji), and a backend for
-the voting and leader board logic (voting). The vote-bot simulates user traffic by submitting
-votes to the frontend.
Using a voting service, users' votes are considered highly sensitive data, as we require
-a secret ballot. Also, users are likely interested in the fairness of the ballot. For
-both requirements, we can use Confidential Computing and, specifically, workload attestation
-to prove to those interested in voting that the app is running in a protected environment
-where their votes are processed without leaking to the platform provider or workload owner.
Run the generate command to generate the execution policies and add them as
-annotations to your deployment files. A manifest.json file with the reference values
-of your deployment will be created:
-
contrast generate deployment/
-
Runtime class and Initializer
The deployment YAML shipped for this demo is already configured to be used with Contrast.
-A runtime class kata-cc-isolation was added to the pods to signal they should be run
-as Confidential Containers. In addition, the Contrast Initializer was added
-as an init container to these workloads to facilitate the attestation and certificate pulling
-before the actual workload is started.
Configure the coordinator with a manifest. It might take up to a few minutes
-for the load balancer to be created and the Coordinator being available.
-
coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') echo"The user API of your Contrast Coordinator is available at $coordinator:1313" contrast set-c"${coordinator}:1313" deployment/
-
The CLI will use the embedded reference values to attest the Coordinator deployment
-during the TLS handshake. If the connection succeeds, we're ensured that the Coordinator
-deployment hasn't been tampered with.
Now that the coordinator has a manifest set, which defines the emojivoto deployment as an allowed workload,
-we can deploy the application:
-
kubectl apply -f deployment/
-
Inter-deployment communication
The Contrast Coordinator issues mesh certificates after successfully validating workloads.
-These certificates can be used for secure inter-deployment communication. The Initializer
-sends an attestation report to the Coordinator, retrieves certificates and a private key in return
-and writes them to a volumeMount. The emojivoto version we're using is patched to only communicate
-via mTLS (the original app talks plain HTTP). The different parts of the workload are configured
-to use the credentials from the volumeMount when communicating with each other.
As voters, we want to verify the fairness and confidentiality of the deployment before
-deciding to vote. Regardless of the scale of our distributed deployment, Contrast only
-needs a single remote attestation step to verify the deployment. By doing remote attestation
-of the Coordinator, we transitively verify those systems the Coordinator has already attested
-or will attest in the future. Successful verification of the Coordinator means that
-we can be sure it will enforce the configured manifest.
A potential voter can verify the Contrast deployment using the verify
-command:
-
contrast verify -c"${coordinator}:1313"
-
The CLI will attest the Coordinator using embedded reference values. If the command succeeds,
-the Coordinator deployment was successfully verified to be running in the expected Confidential
-Computing environment with the expected code version. The Coordinator will then return its
-configuration over the established TLS channel. The CLI will store this information, namely the root
-certificate of the mesh (mesh-root.pem) and the history of manifests, into the verify/ directory.
-In addition, the policies referenced in the manifest history are also written into the same directory.
In the next step, the Coordinator configuration that was written by the verify command needs to be audited.
-A potential voter should inspect the manifest and the referenced policies. They could delegate
-this task to an entity they trust.
After ensuring the configuration of the Coordinator fits the expectation, you can securely connect
-to the workloads using the Coordinator's mesh-root.pem as a trusted CA certificate.
-
To access the web frontend, expose the service on a public IP address via a LoadBalancer service:
-
frontendIP=$(kubectl get svc web-svc -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') echo"Frontend is available at https://$frontendIP, you can visit it in your browser."
-
Using openssl, the certificate of the service can be validated with the mesh-root.pem:
By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed
-via load balancer IP in this demo. Tools like curl check the certificate for IP entries in the SAN field.
-Validation fails since the certificate contains no IP entries as a subject alternative name (SAN).
-For example, a connection attempt using the curl and the mesh root certificate with throw the following error:
-
$ curl--cacert ./verify/mesh-root.pem "https://${frontendIP}:443" curl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34'
The Policies section of the manifest maps policy hashes to a list of SANs. To enable certificate verification
-of the web frontend with tools like curl, edit the policy with your favorite editor and add the frontendIP to
-the list that already contains the "web" DNS entry:
Next, set the changed manifest at the coordinator with:
-
contrast set-c"${coordinator}:1313" deployment/
-
The Contrast Coordinator will rotate the mesh root certificate on the manifest update. Workload certificates issued
-after the manifest are thus issued by another certificate authority and services receiving the new CA certificate chain
-won't trust parts of the deployment that got their certificate issued before the update. This way, Contrast ensures
-that parts of the deployment that received a security update won't be infected by parts of the deployment at an older
-patch level that may have been compromised. The mesh-root.pem is updated with the new CA certificate chain.
The Coordinator has the new manifest set, but the different containers of the app are still
-using the older certificate authority. The Contrast Initializer terminates after the initial attestation
-flow and won't pull new certificates on manifest updates.
After the update has been rolled out, connecting to the frontend using curl will successfully validate
-the service certificate and return the HTML document of the voting site:
CoCo on AKS is currently in preview. An extension for the az CLI is needed to create such a cluster.
-Add the extension with the following commands:
-
az extension add\ --name aks-preview \ --allow-preview true az extension update \ --name aks-preview \ --allow-preview true
-
Then register the required feature flags in your subscription to allow access to the public preview:
-
az feature register \ --namespace"Microsoft.ContainerService"\ --name"KataCcIsolationPreview"
-
The registration can take a few minutes. The status of the operation can be checked with the following
-command, which should show the registration state as Registered:
-
az feature show \ --namespace"Microsoft.ContainerService"\ --name"KataCcIsolationPreview"\ --output table
-
Afterward, refresh the registration of the ContainerService provider:
-
az provider register \ --namespace"Microsoft.ContainerService"
# Select the name for your AKS cluster azClusterName="ContrastDemo" az aks create \ --resource-group "$azResourceGroup"\ --name"$azClusterName"\ --kubernetes-version 1.29\ --os-sku AzureLinux \ --node-vm-size Standard_DC4as_cc_v5 \ --node-count 1\ --generate-ssh-keys
After trying out Contrast, you might want to clean up the cloud resources created in this step.
-In case you've created a new resource group, you can just delete that group with
-
az group delete \ --name"$azResourceGroup"
-
Deleting the resource group will also delete the cluster and all other related resources.
-
To only cleanup the AKS cluster and node pools, run
-
az aks delete \ --resource-group "$azResourceGroup"\ --name"$azClusterName"
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.6, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.6
Contrast
-
Welcome to the documentation of Contrast! Contrast runs confidential container deployments on Kubernetes at scale.
-
Contrast is based on the Kata Containers and
-Confidential Containers projects.
-Confidential Containers are Kubernetes pods that are executed inside a confidential micro-VM and provide strong hardware-based isolation from the surrounding environment.
-This works with unmodified containers in a lift-and-shift approach.
-Contrast currently targets the CoCo preview on AKS.
-
tip
See the 📄whitepaper for more information on confidential computing.
Contrast is designed to keep all data always encrypted and to prevent access from the infrastructure layer. It removes the infrastructure provider from the trusted computing base (TCB). This includes access from datacenter employees, privileged cloud admins, own cluster administrators, and attackers coming through the infrastructure, for example, malicious co-tenants escalating their privileges.
-
Contrast integrates fluently with the existing Kubernetes workflows. It's compatible with managed Kubernetes, can be installed as a day-2 operation and imposes only minimal changes to your deployment flow.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.6, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.6
CLI telemetry
-
The Contrast CLI sends telemetry data to Edgeless Systems when you use CLI commands.
-This allows to understand how Contrast is used and to improve it.
-
The CLI sends the following data:
-
-
The CLI version
-
The CLI target OS and architecture (GOOS and GOARCH)
-
The command that was run
-
The kind of error that occurred (if any)
-
-
The CLI doesn't collect sensitive information.
-The implementation is open-source and can be reviewed.
-
IP addresses may be processed or stored for security purposes.
-
The data that the CLI collects adheres to the Edgeless Systems privacy policy.
-
You can disable telemetry by setting the environment variable DO_NOT_TRACK=1 before running the CLI.
-
-
\ No newline at end of file
diff --git a/pr-preview/pr-1071/0.6/architecture.html b/pr-preview/pr-1071/0.6/architecture.html
deleted file mode 100644
index 5f5a20dc31..0000000000
--- a/pr-preview/pr-1071/0.6/architecture.html
+++ /dev/null
@@ -1,15 +0,0 @@
-
-
-
-
-
-Architecture | Contrast
-
-
-
-
-
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.6, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.6
Attestation in Contrast
-
This document describes the attestation architecture of Contrast, adhering to the definitions of Remote ATtestation procedureS (RATS) in RFC 9334.
-The following gives a detailed description of Contrast's attestation architecture.
-At the end of this document, we included an FAQ that answers the most common questions regarding attestation in hindsight of the security benefits.
Contrast integrates with the RATS architecture, leveraging their definition of roles and processes including Attesters, Verifiers, and Relying Parties.
-
-
Figure 1: Conceptual attestation architecture. Taken from RFC 9334.
-
-
Attester: Assigned to entities that are responsible for creating Evidence which is then sent to a Verifier.
-
Verifier: These entities utilize the Evidence, Reference Values, and Endorsements. They assess the trustworthiness of the Attester by applying an Appraisal Policy for Evidence. Following this assessment, Verifiers generate Attestation Results for use by Relying Parties. The Appraisal Policy for Evidence may be provided by the Verifier Owner, programmed into the Verifier, or acquired through other means.
-
Relying Party: Assigned to entities that utilize Attestation Results, applying their own appraisal policies to make specific decisions, such as authorization decisions. This process is referred to as the "appraisal of Attestation Results." The Appraisal Policy for Attestation Results might be sourced from the Relying Party Owner, configured by the owner, embedded in the Relying Party, or obtained through other protocols or mechanisms.
This includes all Pods of the Contrast deployment that run inside Confidential Containers and generate cryptographic evidence reflecting their current configuration and state.
-Their evidence is rooted in the hardware measurements from the CPU and their confidential VM environment.
-The details of this evidence are given below in the section on evidence generation and appraisal.
-
-
Figure 2: Attestation flow of a confidential pod. Based on the layered attester graphic in RFC 9334.
-
Pods run in Contrast's runtime environment (B), effectively within a confidential VM.
-During launch, the CPU (A) measures the initial memory content of the confidential VM that contains Contrast's pod-VM image and generates the corresponding attestation evidence.
-The image is in IGVM format, encapsulating all information required to launch a virtual machine, including the kernel, the initramfs, and kernel cmdline.
-The kernel cmdline contains the root hash for dm-verity that ensures the integrity of the root filesystem.
-The root filesystem contains all components of the container's runtime environment including the guest agent (C).
-
In the userland, the guest agent takes care of enforcing the runtime policy of the pod.
-While the policy is passed in during the initialization procedure via the host, the evidence for the runtime policy is part of the CPU measurements.
-During the deployment the policy is annotated to the Kubernetes Pod resources.
-On AMD SEV-SNP the hash of the policy is then added to the attestation report via the HOSTDATA field by the hypervisor.
-When provided with the policy from the Kata host, the guest agent verifies that the policy's hash matches the one in the HOSTDATA field.
-
In summary a Pod's evidence is the attestation report of the CPU that provides evidence for runtime environment and the runtime policy.
The Coordinator acts as a verifier within the Contrast deployment, configured with a Manifest that defines the reference values and serves as an appraisal policy for all pods in the deployment.
-It also pulls endorsements from hardware vendors to verify the hardware claims.
-The Coordinator operates within the cluster as a confidential container and provides similar evidence as any other Pod when it acts as an attester.
-In RATS terminology, the Coordinator's dual role is defined as a lead attester in a composite device which spans the entire deployment: Coordinator and the workload pods.
-It collects evidence from other attesters and conveys it to a verifier, generating evidence about the layout of the whole composite device based on the Manifest as the appraisal policy.
-
-
Figure 3: Contrast deployment as a composite device. Based on the composite device in RFC 9334.
-
The CLI serves as the verifier for the Coordinator and the entire Contrast deployment, containing the reference values for the Coordinator and the endorsements from hardware vendors.
-These reference values are built into the CLI during our release process and can be reproduced offline via reproducible builds.
A relying party in the Contrast scenario could be, for example, the data owner that interacts with the application.
-The relying party can use the CLI to obtain the attestation results and Contrast's CA certificates bound to these results.
-The CA certificates can then be used by the relying party to authenticate the application, for example through TLS connections.
In Contrast, attestation evidence revolves around a hardware-generated attestation report, which contains several critical pieces of information:
-
-
The hardware attestation report: This report includes details such as the chip identifier, platform information, microcode versions, and comprehensive guest measurements. The entire report is signed by the CPU's private key, ensuring the authenticity and integrity of the data provided.
-
The launch measurements: Included within the hardware attestation report, this is a digest generated by the CPU that represents a hash of all initial guest memory pages. This includes essential components like the kernel, initramfs, and the kernel command line. Notably, it incorporates the root filesystem's dm-verity root hash, verifying the integrity of the root filesystem.
-
The runtime policy hash: Also part of the hardware attestation report, this field contains the hash of the Rego policy which dictates all expected API commands and their values from the host to the Kata guest agent. It encompasses crucial settings such as dm-verity hashes for the container image layers, environment variables, and mount points.
The appraisal of this evidence in Contrast is governed by two main components:
-
-
The Manifest: A JSON file used by the Coordinator to align with reference values. It sets the expectations for runtime policy hashes for each pod and includes what should be reported in the hardware attestation report for each component of the deployment.
-
The CLI's appraisal policy: This policy encompasses expected values of the Coordinator’s guest measurements and its runtime policy. It's embedded into the CLI during the build process and ensures that any discrepancy between the built-in values and those reported by the hardware attestation can be identified and addressed. The integrity of this policy is safeguardable through reproducible builds, allowing verification against the source code reference.
-
-
Frequently asked questions about attestation in Contrast
-
What's the purpose of remote attestation in Contrast?
-
Remote attestation in Contrast ensures that software runs within a secure, isolated confidential computing environment.
-This process certifies that the memory is encrypted and confirms the integrity and authenticity of the software running within the deployment.
-By validating the runtime environment and the policies enforced on it, Contrast ensures that the system operates in a trustworthy state and hasn't been tampered with.
-
How does Contrast ensure the security of the attestation process?
-
Contrast leverages hardware-rooted security features such as AMD SEV-SNP to generate cryptographic evidence of a pod’s current state and configuration.
-This evidence is checked against pre-defined appraisal policies to guarantee that only verified and authorized pods are part of a Contrast deployment.
Attestation confirms the integrity of the runtime environment and the identity of the workloads.
-It plays a critical role in preventing unauthorized changes and detecting potential modifications at runtime.
-The attestation provides integrity and authenticity guarantees, enabling relying parties—such as workload operators or data owners—to confirm the effective protection against potential threats, including malicious cloud insiders, co-tenants, or compromised workload operators.
-More details on the specific security benefits can be found here.
-
How can you verify the authenticity of attestation results?
-
Attestation results in Contrast are tied to cryptographic proofs generated and signed by the hardware itself.
-These proofs are then verified using public keys from trusted hardware vendors, ensuring that the results aren't only accurate but also resistant to tampering.
-For further authenticity verification, all of Contrast's code is reproducibly built, and the attestation evidence can be verified locally from the source code.
-
How are attestation results used by relying parties?
-
Relying parties use attestation results to make informed security decisions, such as allowing access to sensitive data or resources only if the attestation verifies the system's integrity.
-Thereafter, the use of Contrast's CA certificates in TLS connections provides a practical approach to communicate securely with the application.
In summary, Contrast's attestation strategy adheres to the RATS guidelines and consists of robust verification mechanisms that ensure each component of the deployment is secure and trustworthy.
-This comprehensive approach allows Contrast to provide a high level of security assurance to its users.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.6, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.6
Certificate authority
-
The Coordinator acts as a certificate authority (CA) for the workloads
-defined in the manifest.
-After a workload pod's attestation has been verified by the Coordinator,
-it receives a mesh certificate and the mesh CA certificate.
-The mesh certificate can be used for example in a TLS connection as the server or
-client certificate to proof to the other party that the workload has been
-verified by the Coordinator. The other party can verify the mesh certificate
-with the mesh CA certificate. While the certificates can be used by the workload
-developer in different ways, they're automatically used in Contrast's service
-mesh to establish mTLS connections between workloads in the same deployment.
The Coordinator establishes a public key infrastructure (PKI) for all workloads
-contained in the manifest. The Coordinator holds three certificates: the root CA
-certificate, the intermediate CA certificate, and the mesh CA certificate.
-The root CA certificate is a long-lasting certificate and its private key signs
-the intermediate CA certificate. The intermediate CA certificate and the mesh CA
-certificate share the same private key. This intermediate private key is used
-to sign the mesh certificates. Moreover, the intermediate private key and
-therefore the intermediate CA certificate and the mesh CA certificate are
-rotated when setting a new manifest.
Depending on the configuration of the first manifest, it allows the workload
-owner to update the manifest and, therefore, the deployment.
-Workload owners and data owners can be mutually untrusted parties.
-To protect against the workload owner silently introducing malicious containers,
-the Coordinator rotates the intermediate private key every time the manifest is
-updated and, therefore, the
-intermediate CA certificate and mesh CA certificate. If the user doesn't
-trust the workload owner, they use the mesh CA certificate obtained when they
-verified the Coordinator and the manifest. This ensures that the user only
-connects to workloads defined in the manifest they verified since only those
-workloads' certificates are signed with this intermediate private key.
-
Similarly, the service mesh also uses the mesh CA certificate obtained when the
-workload was started, so the workload only trusts endpoints that have been
-verified by the Coordinator based on the same manifest. Consequently, a
-manifest update requires a fresh rollout of the services in the service mesh.
The root CA certificate is returned when verifying the Coordinator.
-The data owner can use it to verify the mesh certificates of the workloads.
-This should only be used if the data owner trusts all future updates to the
-manifest and workloads. This is, for instance, the case when the workload owner is
-the same entity as the data owner.
-
The mesh CA certificate is returned when verifying the Coordinator.
-The data owner can use it to verify the mesh certificates of the workloads.
-This certificate is bound to the manifest set when the Coordinator is verified.
-If the manifest is updated, the mesh CA certificate changes.
-New workloads will receive mesh certificates signed by the new mesh CA certificate.
-The Coordinator with the new manifest needs to be verified to retrieve the new mesh CA certificate.
-The service mesh also uses the mesh CA certificate to verify the mesh certificates.
-
The intermediate CA certificate links the root CA certificate to the
-mesh certificate so that the mesh certificate can be verified with the root CA
-certificate. It's part of the certificate chain handed out by
-endpoints in the service mesh.
-
The mesh certificate is part of the certificate chain handed out by
-endpoints in the service mesh. During the startup of a pod, the Initializer
-requests a certificate from the Coordinator. This mesh certificate will be returned if the Coordinator successfully
-verifies the workload. The mesh certificate
-contains X.509 extensions with information from the workloads attestation
-document.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.6, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.6
Confidential Containers
-
Contrast uses some building blocks from Confidential Containers (CoCo), a CNCF Sandbox project that aims to standardize confidential computing at the pod level.
-The project is under active development and many of the high-level features are still in flux.
-Contrast uses the more stable core primitive provided by CoCo: its Kubernetes runtime.
Kubernetes can be extended to use more than one container runtime with RuntimeClass objects.
-The Container Runtime Interface (CRI) implementation, for example containerd, dispatches pod management API calls to the appropriate RuntimeClass.
-RuntimeClass implementations are usually based on an OCI runtime, such as runc, runsc or crun.
-In CoCo's case, the runtime is Kata Containers with added confidential computing capabilities.
Kata Containers is an OCI runtime that runs pods in VMs.
-The pod VM spawns an agent process that accepts management commands from the Kata runtime running on the host.
-There are two options for creating pod VMs: local to the Kubernetes node, or remote VMs created with cloud provider APIs.
-Using local VMs requires either bare-metal servers or VMs with support for nested virtualization.
-Local VMs communicate with the host over a virtual socket.
-For remote VMs, host-to-agent communication is tunnelled through the cloud provider's network.
-
Kata Containers was originally designed to isolate the guest from the host, but it can also run pods in confidential VMs (CVMs) to shield pods from their underlying infrastructure.
-In confidential mode, the guest agent is configured with an Open Policy Agent (OPA) policy to authorize API calls from the host.
-This policy also contains checksums for the expected container images.
-It's derived from Kubernetes resource definitions and its checksum is included in the attestation report.
Azure Kubernetes Service (AKS) provides CoCo-enabled node pools as a preview offering.
-These node pools leverage Azure VM types capable of nested virtualization (CVM-in-VM) and the CoCo stack is pre-installed.
-Contrast can be deployed directly into a CoCo-enabled AKS cluster.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.6, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.6
Product features
-
Contrast simplifies the deployment and management of Confidential Containers, offering optimal data security for your workloads while integrating seamlessly with your existing Kubernetes environment.
-
From a security perspective, Contrast employs the Confidential Containers concept and provides security benefits that go beyond individual containers, shielding your entire deployment from the underlying infrastructure.
-
From an operational perspective, Contrast provides the following key features:
-
-
-
Managed Kubernetes compatibility: Initially compatible with Azure Kubernetes Service (AKS), Contrast is designed to support additional platforms such as AWS EKS and Google Cloud GKE as they begin to accommodate confidential containers.
-
-
-
Lightweight installation: Contrast can be integrated as a day-2 operation within existing clusters, adding minimal components to your setup. This facilitates straightforward deployments using your existing YAML configurations, Helm charts, or Kustomization, enabling native Kubernetes orchestration of your applications.
-
-
-
Remote attestation: Contrast generates a concise attestation statement that verifies the identity, authenticity, and integrity of your deployment both internally and to external parties. This architecture ensures that updates or scaling of the application don't compromise the attestation’s validity.
-
-
-
Service mesh: Contrast securely manages a Public Key Infrastructure (PKI) for your deployments, issues workload-specific certificates, and establishes transparent mutual TLS (mTLS) connections across pods. This is done by harnessing the envoy proxy to ensure secure communications within your Kubernetes cluster.
-
-
-
-
\ No newline at end of file
diff --git a/pr-preview/pr-1071/0.6/basics/security-benefits.html b/pr-preview/pr-1071/0.6/basics/security-benefits.html
deleted file mode 100644
index 6a2758b375..0000000000
--- a/pr-preview/pr-1071/0.6/basics/security-benefits.html
+++ /dev/null
@@ -1,116 +0,0 @@
-
-
-
-
-
-Contrast security overview | Contrast
-
-
-
-
-
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.6, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.6
Contrast security overview
-
This document outlines the security measures of Contrast and its capability to counter various threats.
-Contrast is designed to shield entire Kubernetes deployments from the infrastructure, enabling entities to manage sensitive information (such as regulated or personally identifiable information (PII)) in the public cloud, while maintaining data confidentiality and ownership.
-
Contrast is applicable in situations where establishing trust with the workload operator or the underlying infrastructure is challenging.
-This is particularly beneficial for regulated sectors looking to transition sensitive activities to the cloud, without sacrificing security or compliance.
-It allows for cloud adoption by maintaining a hardware-based separation from the cloud service provider.
Leveraging Confidential Computing technology, Contrast provides three defining security properties:
-
-
Encryption of data in use: Contrast ensures that all data processed in memory is encrypted, making it inaccessible to unauthorized users or systems, even if they have physical access to the hardware.
-
Workload isolation: Each pod runs in its isolated runtime environment, preventing any cross-contamination between workloads, which is critical for multi-tenant infrastructures.
-
Remote attestation: This feature allows data owners and workload operators to verify that the Contrast environment executing their workloads hasn't been tampered with and is running in a secure, pre-approved configuration.
-
-
The runtime encryption is transparently provided by the confidential computing hardware during the workload's lifetime.
-The workload isolation and remote attestation involves two phases:
-
-
An attestation process detects modifications to the workload image or its runtime environment during the initialization. This protects the workload's integrity pre-attestation.
-
A protected runtime environment and a policy mechanism prevents the platform operator from accessing or compromising the instance at runtime. This protects a workload's integrity and confidentiality post-attestation.
-
-
For more details on confidential computing see our whitepaper.
-The attestation architecture describes Contrast's attestation process and the resulting chain of trust in detail.
Contrast uses the Kubernetes runtime of the Confidential Containers project.
-Confidential Containers significantly decrease the size of the trusted computing base (TCB) of a Kubernetes deployment, by isolating each pod within its own confidential micro-VM environment.
-The TCB is the totality of elements in a computing environment that must be trusted not to be compromised.
-A smaller TCB results in a smaller attack surface. The following diagram shows how Confidential Containers remove the cloud & datacenter infrastructure and the physical hosts, including the hypervisor, the host OS, the Kubernetes control plane, and other components, from the TCB (red).
-In the confidential context, depicted in green, only the workload containers along with their confidential micro-VM environment are included within the TCB.
-Their integrity is verifiable through remote attestation.
-
Contrast uses hardware-based mechanisms, specifically leveraging CPU features, such as AMD SEV or Intel TDX, to provide the isolation of the workload.
-This implies that both the CPU and its microcode are integral components of the TCB.
-However, it should be noted that the CPU microcode aspects aren't depicted in the accompanying graphic.
-
-
Contrast adds the following components to a deployment that become part of the TCB.
-The components that are part of the TCB are:
-
-
The workload containers: Container images that run the actual application.
The runtime policies: Policies that enforce the runtime environments for the workload containers during their lifetime.
-
The manifest: A manifest file defining the reference values of an entire confidential deployment. It contains the policy hashes for all pods of the deployment and the expected hardware reference values for the Confidential Container runtime.
-
The Coordinator: An attestation service that runs in a Confidential Container in the Kubernetes cluster. The Coordinator is configured with the manifest. User-facing, you can verify this service and the effective manifest using remote attestation, providing you with a concise attestation for the entire deployment. Cluster-facing, it verifies all pods and their policies based on remote attestation procedures and the manifest.
In a Contrast deployment, there are three parties:
-
-
-
The container image provider, who creates the container images that represent the application that has access to the protected data.
-
-
-
The workload operator, who runs the workload in a Kubernetes cluster. The operator typically has full administrative privileges to the deployment. The operator can manage cluster resources such as nodes, volumes, and networking rules, and the operator can interact with any Kubernetes or underlying cloud API.
-
-
-
The data owner, who owns the protected data. A data owner can verify the deployment using the Coordinator attestation service. The verification includes the identity, integrity, and confidentiality of the workloads, the runtime environment and the access permissions.
-
-
-
Contrast supports a trust model where the container image provider, workload operator, and data owner are separate, mutually distrusting parties.
-
The following diagram shows the system components and parties.
Contrast is designed to defend against five possible attacks:
-
-
A malicious cloud insider: malicious employees or third-party contractors of cloud service providers (CSPs) potentially have full access to various layers of the cloud infrastructure. That goes from the physical datacenter up to the hypervisor and Kubernetes layer. For example, they can access the physical memory of the machines, modify the hypervisor, modify disk contents, intercept network communications, and attempt to compromise the confidential container at runtime. A malicious insider can expand the attack surface or restrict the runtime environment. For example, a malicious operator can add a storage device to introduce new attack vectors. As another example, a malicious operator can constrain resources such as limiting a guest's memory size, changing its disk space, or changing firewall rules.
-
A malicious cloud co-tenant: malicious cloud user ("hackers") may break out of their tenancy and access other tenants' data. Advanced attackers may even be able to establish a permanent foothold within the infrastructure and access data over a longer period. The threats are analogous to the cloud insider access scenario, without the physical access.
-
A malicious workload operator: malicious workload operators, for example Kubernetes administrators, have full access to the workload deployment and the underlying Kubernetes platform. The threats are analogously to the cloud insider access scenario, with access to everything that's above the hypervisor level.
-
A malicious attestation client: this attacker connects to the attestation service and sends malformed request.
-
A malicious container image provider: a malicious container image provider has full control over the application development itself. This attacker might release a malicious version of the workload containing harmful operations.
Contrast shields a workload from the aforementioned threats with three main components:
-
-
The runtime environment safeguards against the physical memory and disk attack surface.
-
The runtime policies safeguard against the Kubernetes control plane and container runtime attack surface.
-
The service mesh safeguards against the network attack surface.
-
-
The following tables describe concrete threats and how they're mitigated in Contrast grouped by these categories:
-
-
Attacks on the confidential container environment
-
Attacks on the attestation service
-
Attacks on workloads
-
-
Attacks on the confidential container environment
-
This table describes potential threats and mitigation strategies related to the confidential container environment.
-
Threat
Mitigation
Mitigation implementation
An attacker intercepts the network connection of the launcher or image repository.
An attacker can change the image URL and control the workload binary. However these actions are reflected in the attestation report. The image repository isn't controlled using an access list, therefore the image is assumed to be viewable by everyone. You must ensure that the workload container image doesn't contain any secrets.
An attacker modifies a container's runtime environment configuration in the Kubernetes control plane.
The attestation process and the runtime policies detects unsafe configurations that load non-authentic images or perform any other modification to the expected runtime environment.
This table describes potential threats and mitigation strategies to the attestation service.
-
Threat
Mitigation
Mitigation implementation
An attacker intercepts the Coordinator deployment and modifies the image or hijacks the runtime environment.
This threat is mitigated by having an attestation procedure and attested, encrypted TLS connections to the Coordinator. The attestation evidence for the Coordinator image is distributed with our releases, protected by supply chain security, and fully reproducible.
An attacker intercepts the network connection between the workload and the Coordinator and reads secret keys from the wire.
This threat is mitigated by having an attested, encrypted TLS connection. This connection helps protect the secrets from passive eavesdropping. The attacker can't create valid workload certificates that would be accepted in Contrast's service mesh. An attacker can't impersonate a valid workload container because the container's identity is guaranteed by the attestation protocol.
Within the network between your workload and the Coordinator.
An attacker exploits parsing discrepancies, which leads to undetected changes in the attestation process.
This risk is mitigated by having a parsing engine written in memory-safe Go that's tested against the attestation specification of the hardware vendor. The runtime policies are available as an attestation artifact for further inspection and audits to verify their effectiveness.
An attacker reads or modifies data written to disk via persistent volumes.
Currently, persistent volumes aren't supported in Contrast. In the future, this threat is mitigated by encrypted and integrity-protected volume mounts.
An attacker publishes a new image version containing malicious code.
The attestation process and the runtime policies require a data owner to accept a specific version of the workload and any update to the workload needs to be explicitly acknowledged.
The following table describes three example use cases and how they map to the defined threat model in this document:
-
Use Case
Example Scenario
Migrate sensitive workloads to the cloud
TechSolve Inc., a software development firm, aimed to enhance its defense-in-depth strategy for its cloud-based development environment, especially for projects involving proprietary algorithms and client data. TechSolve acts as the image provider, workload operator, and data owner, combining all three personas in this scenario. In our attestation terminology, they're the workload operator and relying party in one entity. Their threat model includes a malicious cloud insider and cloud co-tenant.
Make your SaaS more trustworthy
SaaSProviderX, a company offering cloud-based project management tools, sought to enhance its platform's trustworthiness amidst growing concerns about data breaches and privacy. Here, the relying party is the SaaS customer as the data owner. The goal is to achieve a form of operator exclusion and only allow selective operations on the deployment. Hence, their threat model includes a malicious workload operator.
Simplify regulatory compliance
HealthSecure Inc. has been managing a significant volume of sensitive patient data on-premises. With the increasing demand for advanced data analytics and the need for scalable infrastructure, the firm decides to migrate its data analytics operations to the cloud. However, the primary concern is maintaining the confidentiality and security of patient data during and after the migration, in compliance with healthcare regulations. In this compliance scenario, the regulator serves as an additional relying party. HealthSecure must implement a mechanism that ensures the isolation of patient data can be verifiably guaranteed to the regulator.
-
In each scenario, Contrast ensures exclusive data access and processing capabilities are confined to the designated workloads. It achieves this by effectively isolating the workload from the infrastructure and other components of the stack. Data owners are granted the capability to audit and approve the deployment environment before submitting their data, ensuring a secure handover. Meanwhile, workload operators are equipped to manage and operate the application seamlessly, without requiring direct access to either the workload or its associated data.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.6, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.6
Components
-
Contrast is composed of several key components that work together to manage and scale confidential containers effectively within Kubernetes environments.
-This page provides an overview of the core components essential for deploying and managing Contrast.
The CLI serves as the primary management tool for Contrast deployments. It's designed to streamline the configuration and operation of Contrast in several ways:
-
-
Installation and setup: The CLI facilitates the installation of the necessary runtime classes required for Contrast to function within a Kubernetes cluster.
-
Policy generation: It allows users to generate runtime policies, adapt the deployment files, and generate the Contrast manifest.
-
Configuration management: Through the CLI, users can configure the Contrast Coordinator with the generated manifest.
-
Verification and attestation: The CLI provides tools to verify the integrity and authenticity of the Coordinator and the entire deployment via remote attestation.
The Contrast Coordinator is the central remote attestation service of a Contrast deployment.
-It runs inside a confidential container inside your cluster.
-The Coordinator can be verified via remote attestation, and a Contrast deployment is self-contained.
-The Coordinator is configured with a manifest, a configuration file containing the reference attestation values of your deployment.
-It ensures that your deployment's topology adheres to your specified manifest by verifying the identity and integrity of all confidential pods inside the deployment.
-The Coordinator is also a certificate authority and issues certificates for your workload pods during the attestation procedure.
-Your workload pods can establish secure, encrypted communication channels between themselves based on these certificates using the Coordinator as the root CA.
-As your app needs to scale, the Coordinator transparently verifies new instances and then provides them with their certificates to join the deployment.
-
To verify your deployment, the Coordinator's remote attestation statement combined with the manifest offers a concise single remote attestation statement for your entire deployment.
-A third party can use this to verify the integrity of your distributed app, making it easy to assure stakeholders of your app's identity and integrity.
The manifest is the configuration file for the Coordinator, defining your confidential deployment.
-It's automatically generated from your deployment by the Contrast CLI.
-It currently consists of the following parts:
-
-
Policies: The identities of your Pods, represented by the hashes of their respective runtime policies.
-
Reference Values: The remote attestation reference values for the Kata confidential micro-VM that's the runtime environment of your Pods.
-
WorkloadOwnerKeyDigest: The workload owner's public key digest. Used for authenticating subsequent manifest updates.
Runtime Policies are a mechanism to enable the use of the untrusted Kubernetes API for orchestration while ensuring the confidentiality and integrity of your confidential containers.
-They allow us to enforce the integrity of your containers' runtime environment as defined in your deployment files.
-The runtime policy mechanism is based on the Open Policy Agent (OPA) and translates the Kubernetes deployment YAML into the Rego policy language of OPA.
-The Kata Agent inside the confidential micro-VM then enforces the policy by only acting on permitted requests.
-The Contrast CLI provides the tooling for automatically translating Kubernetes deployment YAML into the Rego policy language of OPA.
Contrast provides an Initializer that handles the remote attestation on the workload side transparently and
-fetches the workload certificate. The Initializer runs as an init container before your workload is started.
-It provides the workload container and the service mesh sidecar with the workload certificates.
Contrast depends on a Kubernetes runtime class, which is installed
-by the node-installer DaemonSet.
-This runtime consists of a containerd runtime plugin, a virtual machine manager (cloud-hypervisor), and a podvm image (IGVM and rootFS).
-The installer takes care of provisioning every node in the cluster so it provides this runtime class.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.6, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.6
Policies
-
Kata runtime policies are an integral part of the Confidential Containers preview on AKS.
-They prescribe how a Kubernetes pod must be configured to launch successfully in a confidential VM.
-In Contrast, policies act as a workload identifier: only pods with a policy registered in the manifest receive workload certificates and may participate in the confidential deployment.
-Verification of the Contrast Coordinator and its manifest transitively guarantees that all workloads meet the owner's expectations.
The Kata agent running in the confidential micro-VM exposes an RPC service AgentService to the Kata runtime.
-This service handles potentially untrustworthy requests from outside the TCB, which need to be checked against a policy.
-
Kata runtime policies are written in the policy language Rego.
-They specify what AgentService methods can be called, and the permissible parameters for each call.
-
Policies consist of two parts: a list of rules and a data section.
-While the list of rules is static, the data section is populated with information from the PodSpec and other sources.
Runtime policies are programmatically generated from Kubernetes manifests by the Contrast CLI.
-The generate subcommand inspects pod definitions and derives rules for validating the pod at the Kata agent.
-There are two important integrity checks: container image checksums and OCI runtime parameters.
-
For each of the container images used in a pod, the CLI downloads all image layers and produces a cryptographic dm-verity checksum.
-These checksums are the basis for the policy's storage data.
-
The CLI combines information from the PodSpec, ConfigMaps, and Secrets in the provided Kubernetes manifests to derive a permissible set of command-line arguments and environment variables.
-These constitute the policy's OCI data.
The generated policy document is annotated to the pod definitions in Base64 encoding.
-This annotation is propagated to the Kata runtime, which calculates the SHA256 checksum for the policy and uses that as SNP HOSTDATA for the confidential micro-VM.
-
After the VM launched, the runtime calls the agent's SetPolicy method with the full policy document.
-If the policy doesn't match the checksum in HOSTDATA, the agent rejects the policy.
-Otherwise, it applies the policy to all future AgentService requests.
Contrast verifies its confidential containers following these steps:
-
-
The Contrast CLI generates a policy and attaches it to the pod definition.
-
Kubernetes schedules the pod on a node with the confidential computing runtime.
-
Containerd invokes the Kata runtime to create the pod sandbox.
-
The Kata runtime starts a CVM with the policy's digest as HOSTDATA.
-
The Kata runtime sets the policy using the SetPolicy method.
-
The Kata agent verifies that the incoming policy's digest matches HOSTDATA.
-
The CLI sets a manifest in the Contrast Coordinator, including a list of permitted policies.
-
The Contrast Initializer sends an attestation report to the Contrast Coordinator, asking for a mesh certificate.
-
The Contrast Coordinator verifies that the started pod has a permitted policy hash in its HOSTDATA field.
-
-
After the last step, we know that the policy hasn't been tampered with and, thus, that the workload matches expectations and may receive mesh certificates.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.6, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.6
Contrast Runtime
-
The Contrast runtime is responsible for starting pods as confidential virtual machines.
-This works by specifying the runtime class to be used in a pod spec and by registering the runtime class with the apiserver.
-The RuntimeClass resource defines a name for referencing the class and
-a handler used by the container runtime (containerd) to identify the class.
-
apiVersion: node.k8s.io/v1 kind: RuntimeClass metadata: # This name is used by pods in the runtimeClassName field name: contrast-cc-abcdef # This name is used by the # container runtime interface implementation (containerd) handler: contrast-cc-abcdef
-
Confidential pods that are part of a Contrast deployment need to specify the
-same runtime class in the runtimeClassName field, so Kubernetes uses the
-Contrast runtime instead of the default containerd / runc handler.
-
apiVersion: v1 kind: Pod spec: runtimeClassName: contrast-cc-abcdef # ...
The runtime consists of additional software components that need to be installed
-and configured on every SEV-SNP-enabled worker node.
-This installation is performed automatically by the node-installer DaemonSet.
The handler field in the Kubernetes RuntimeClass instructs containerd not to use the default runc implementation.
-Instead, containerd invokes a custom plugin called containerd-shim-contrast-cc-v2.
-This shim is described in more detail in the upstream source repository and in the containerd documentation.
The containerd shim uses cloud-hypervisor to create a confidential virtual machine for every pod.
-This requires the cloud-hypervisor binary to be installed on every node (responsibility of the node-installer).
Contrast uses a special containerd snapshotter (tardev) to provide container images as block devices to the pod-VM. This snapshotter consists of a host component that pulls container images and a guest component (kernel module) used to mount container images.
-The tardev snapshotter uses dm-verity to protect the integrity of container images.
-Expected dm-verity container image hashes are part of Contrast runtime policies and are enforced by the kata-agent.
-This enables workload attestation by specifying the allowed container image as part of the policy. Read the chapter on policies for more information.
Every pod-VM starts with the same guest image. It consists of an IGVM file and a root filesystem.
-The IGVM file describes the initial memory contents of a pod-VM and consists of:
-
-
Linux kernel image
-
initrd
-
kernel commandline
-
-
Additionally, a root filesystem image is used that contains a read-only partition with the user space of the pod-VM and a verity partition to guarantee the integrity of the root filesystem.
-The root filesystem contains systemd as the init system, and the kata agent for managing the pod.
-
This pod-VM image isn't specific to any pod workload. Instead, container images are mounted at runtime.
The RuntimeClass resource above registers the runtime with the Kubernetes api.
-The node-level installation is carried out by the Contrast node-installer
-DaemonSet that ships with every Contrast release.
-
After deploying the installer, it performs the following steps on each node:
-
-
Install the Contrast containerd shim (containerd-shim-contrast-cc-v2)
-
Install cloud-hypervisor as the virtual machine manager (VMM)
-
Install an IGVM file for pod-VMs of this class
-
Install a read only root filesystem disk image for the pod-VMs of this class
-
Reconfigure containerd by adding a runtime plugin that corresponds to the handler field of the Kubernetes RuntimeClass
-
Restart containerd to make it aware of the new plugin
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.6, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.6
Service Mesh
-
The Contrast service mesh secures the communication of the workload by automatically
-wrapping the network traffic inside mutual TLS (mTLS) connections. The
-verification of the endpoints in the connection establishment is based on
-certificates that are part of the
-PKI of the Coordinator.
-
The service mesh can be enabled on a per-pod basis by adding the service-mesh
-container as a sidecar container.
-The service mesh container first sets up iptables
-rules based on its configuration and then starts Envoy
-for TLS origination and termination.
All TCP ingress traffic is routed over Envoy by default. Since we use
-TPROXY, the destination address
-remains the same throughout the packet handling.
-
Any incoming connection is required to present a client certificate signed by the
-mesh CA certificate.
-Envoy presents a certificate chain of the mesh
-certificate of the workload and the intermediate CA certificate as the server certificate.
-
If the deployment contains workloads which should be reachable from outside the
-Service Mesh, while still handing out the certificate chain, disable client
-authentication by setting the environment variable EDG_INGRESS_PROXY_CONFIG as
-<name>#<port>#false. Separate multiple entries with ##. You can choose any
-descriptive string identifying the service on the given port for the
-informational-only field <name>.
-
Disable redirection and TLS termination altogether by specifying
-<name>#<port>#true. This can be beneficial if the workload itself handles TLS
-on that port or if the information exposed on this port is non-sensitive.
-
The following example workload exposes a web service on port 8080 and metrics on
-port 7890. The web server is exposed to a 3rd party end-user which wants to
-verify the deployment, therefore it's still required that the server hands out
-it certificate chain signed by the mesh CA certificate. The metrics should be
-exposed via TCP without TLS.
To be able to route the egress traffic of the workload through Envoy, the remote
-endpoints' IP address and port must be configurable.
-
-
Choose an IP address inside the 127.0.0.0/8 CIDR and a port not yet in use
-by the pod.
-
Configure the workload to connect to this IP address and port.
-
Set <name>#<chosen IP>:<chosen port>#<original-hostname-or-ip>:<original-port>
-as EDG_EGRESS_PROXY_CONFIG. Separate multiple entries with ##. Choose any
-string identifying the service on the given port as <name>.
-
-
This redirects the traffic over Envoy. The endpoint must present a valid
-certificate chain which must be verifiable with the
-mesh CA certificate.
-Furthermore, Envoy uses a certificate chain with the mesh certificate of the workload
-and the intermediate CA certificate as the client certificate.
-
The following example workload has no ingress connections and two egress
-connection to different microservices. The microservices are themselves part
-of the confidential deployment. One is reachable under billing-svc:8080 and
-the other under cart-svc:8080.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.6, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.6
Workload deployment
-
The following instructions will guide you through the process of making an existing Kubernetes deployment
-confidential and deploying it together with Contrast.
-
A running CoCo-enabled cluster is required for these steps, see the setup guide on how to set it up.
Contrast depends on a custom Kubernetes RuntimeClass (contrast-cc),
-which needs to be installed in the cluster prior to the Coordinator or any confidential workloads.
-This consists of a RuntimeClass resource and a DaemonSet that performs installation on worker nodes.
-This step is only required once for each version of the runtime.
-It can be shared between Contrast deployments.
Your Kubernetes resources need some modifications to run as Confidential Containers.
-This section guides you through the process and outlines the necessary changes.
Contrast will add annotations to your Kubernetes YAML files. If you want to keep the original files
-unchanged, you can copy the files into a separate local directory.
-You can also generate files from a Helm chart or from a Kustomization.
To specify that a workload (pod, deployment, etc.) should be deployed as confidential containers,
-add runtimeClassName: contrast-cc to the pod spec (pod definition or template).
-This is a placeholder name that will be replaced by a versioned runtimeClassName when generating policies.
-In addition, add the Contrast Initializer as initContainers to these workloads and configure the
-workload to use the certificates written to a volumeMount named tls-certs.
The initializer populates the shared volume with X.509 certificates for your workload.
-These certificates are used by the Contrast Service Mesh, but can also be used by your application directly.
-The following tab group explains the setup for both scenarios.
-
Drop-in service mesh
Go integration
Contrast can be configured to handle TLS in a sidecar container.
-This is useful for workloads that are hard to configure with custom certificates, like Java applications.
Configuration of the sidecar depends heavily on the application.
-The following example is for an application with these properties:
-
The app has a main application at TCP port 8001, which should be TLS-wrapped and doesn't require client authentication.
-
The app has a metrics endpoint at TCP port 8080, which should be accessible in plain text.
-
All other endpoints require client authentication.
-
The app connects to a Kubernetes service backend.default:4001, which requires client authentication.
-
Add the following sidecar definition to your workload:
The only change required to the app itself is to let it connect to 127.0.0.2:4001 to reach the backend service.
-You can find more detailed documentation in the Service Mesh chapter.
The mesh certificate contained in certChain.pem authenticates this workload, while the mesh CA certificate mesh-ca.pem authenticates its peers.
-Your app should turn on client authentication to ensure peers are running as confidential containers, too.
-See the Certificate Authority section for detailed information about these certificates.
The following example shows how to configure a Golang app, with error handling omitted for clarity.
Run the generate command to generate the execution policies and add them as annotations to your
-deployment files. A manifest.json with the reference values of your deployment will be created.
-
contrast generate resources/
-
warning
Please be aware that runtime policies currently have some blind spots. For example, they can't guarantee the starting order of containers. See the current limitations for more details.
For the next steps, we will need to connect to the Coordinator. The released Coordinator resource
-includes a LoadBalancer definition we can use.
-
coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}')
-
Port-forwarding of Confidential Containers
kubectl port-forward uses a Container Runtime Interface (CRI) method that isn't supported by the Kata shim.
-If you can't use a public load balancer, you can deploy a port-forwarder.
-The port-forwarder relays traffic from a CoCo pod and can be accessed via kubectl port-forward.
After this step, the Coordinator will start issuing TLS certs to the workloads. The init container
-will fetch a certificate for the workload and the workload is started.
An end user (data owner) can verify the Contrast deployment using the verify command.
-
contrast verify -c"${coordinator}:1313"
-
The CLI will attest the Coordinator using embedded reference values. The CLI will write the service mesh
-root certificate and the history of manifests into the verify/ directory. In addition, the policies referenced
-in the manifest are also written to the directory.
You can securely connect to the workloads using the Coordinator's mesh-ca.pem as a trusted CA certificate.
-First, expose the service on a public IP address via a LoadBalancer service:
By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed
-via load balancer IP in this demo. Tools like curl check the certificate for IP entries in the SAN field.
-Validation fails since the certificate contains no IP entries as a subject alternative name (SAN).
-For example, a connection attempt using the curl and the mesh CA certificate with throw the following error:
$ curl--cacert ./verify/mesh-ca.pem "https://${frontendIP}:443" curl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34'
-
Using openssl, the certificate of the service can be validated with the mesh-ca.pem:
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.6, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.6
Confidential emoji voting
-
-
This tutorial guides you through deploying emojivoto as a
-confidential Contrast deployment and validating the deployment from a voters perspective.
-
Emojivoto is an example app allowing users to vote for different emojis and view votes
-on a leader board. It has a microservice architecture consisting of a
-web frontend (web), a gRPC backend for listing available emojis (emoji), and a backend for
-the voting and leader board logic (voting). The vote-bot simulates user traffic by submitting
-votes to the frontend.
Using a voting service, users' votes are considered highly sensitive data, as we require
-a secret ballot. Also, users are likely interested in the fairness of the ballot. For
-both requirements, we can use Confidential Computing and, specifically, workload attestation
-to prove to those interested in voting that the app is running in a protected environment
-where their votes are processed without leaking to the platform provider or workload owner.
Contrast depends on a custom Kubernetes RuntimeClass (contrast-cc),
-which needs to be installed in the cluster prior to the Coordinator or any confidential workloads.
-This consists of a RuntimeClass resource and a DaemonSet that performs installation on worker nodes.
-This step is only required once for each version of the runtime.
-It can be shared between Contrast deployments.
Run the generate command to generate the execution policies and add them as
-annotations to your deployment files. A manifest.json file with the reference values
-of your deployment will be created:
-
contrast generate deployment/
-
Runtime class and Initializer
The deployment YAML shipped for this demo is already configured to be used with Contrast.
-A runtime classcontrast-cc-<VERSIONHASH>
-was added to the pods to signal they should be run as Confidential Containers. In addition, the Contrast
-Initializer was added as an init container to these workloads to
-facilitate the attestation and certificate pulling before the actual workload is started.
Further, the deployment YAML is also configured with the Contrast service mesh.
-The configured service mesh proxy provides transparent protection for the communication between
-the different components of emojivoto.
Configure the coordinator with a manifest. It might take up to a few minutes
-for the load balancer to be created and the Coordinator being available.
-
coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') echo"The user API of your Contrast Coordinator is available at $coordinator:1313" contrast set-c"${coordinator}:1313" deployment/
-
The CLI will use the embedded reference values to attest the Coordinator deployment
-during the TLS handshake. If the connection succeeds, we're ensured that the Coordinator
-deployment hasn't been tampered with.
Now that the coordinator has a manifest set, which defines the emojivoto deployment as an allowed workload,
-we can deploy the application:
-
kubectl apply -f deployment/
-
Inter-deployment communication
The Contrast Coordinator issues mesh certificates after successfully validating workloads.
-These certificates can be used for secure inter-deployment communication. The Initializer
-sends an attestation report to the Coordinator, retrieves certificates and a private key in return
-and writes them to a volumeMount. The service mesh sidecar is configured to use the credentials
-from the volumeMount when communicating with other parts of the deployment over mTLS.
-The public facing frontend for voting uses the mesh certificate without client authentication.
As voters, we want to verify the fairness and confidentiality of the deployment before
-deciding to vote. Regardless of the scale of our distributed deployment, Contrast only
-needs a single remote attestation step to verify the deployment. By doing remote attestation
-of the Coordinator, we transitively verify those systems the Coordinator has already attested
-or will attest in the future. Successful verification of the Coordinator means that
-we can be sure it will enforce the configured manifest.
A potential voter can verify the Contrast deployment using the verify
-command:
-
contrast verify -c"${coordinator}:1313"
-
The CLI will attest the Coordinator using embedded reference values. If the command succeeds,
-the Coordinator deployment was successfully verified to be running in the expected Confidential
-Computing environment with the expected code version. The Coordinator will then return its
-configuration over the established TLS channel. The CLI will store this information, namely the root
-certificate of the mesh (mesh-ca.pem) and the history of manifests, into the verify/ directory.
-In addition, the policies referenced in the manifest history are also written into the same directory.
In the next step, the Coordinator configuration that was written by the verify command needs to be audited.
-A potential voter should inspect the manifest and the referenced policies. They could delegate
-this task to an entity they trust.
After ensuring the configuration of the Coordinator fits the expectation, you can securely connect
-to the workloads using the Coordinator's mesh-ca.pem as a trusted CA certificate.
-
To access the web frontend, expose the service on a public IP address via a LoadBalancer service:
-
frontendIP=$(kubectl get svc web-svc -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') echo"Frontend is available at https://$frontendIP, you can visit it in your browser."
-
Using openssl, the certificate of the service can be validated with the mesh-ca.pem:
By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed
-via load balancer IP in this demo. Tools like curl check the certificate for IP entries in the SAN field.
-Validation fails since the certificate contains no IP entries as a subject alternative name (SAN).
-For example, a connection attempt using the curl and the mesh CA certificate with throw the following error:
-
$ curl--cacert ./verify/mesh-ca.pem "https://${frontendIP}:443" curl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34'
The Policies section of the manifest maps policy hashes to a list of SANs. To enable certificate verification
-of the web frontend with tools like curl, edit the policy with your favorite editor and add the frontendIP to
-the list that already contains the "web" DNS entry:
Next, set the changed manifest at the coordinator with:
-
contrast set-c"${coordinator}:1313" deployment/
-
The Contrast Coordinator will rotate the mesh ca certificate on the manifest update. Workload certificates issued
-after the manifest are thus issued by another certificate authority and services receiving the new CA certificate chain
-won't trust parts of the deployment that got their certificate issued before the update. This way, Contrast ensures
-that parts of the deployment that received a security update won't be infected by parts of the deployment at an older
-patch level that may have been compromised. The mesh-ca.pem is updated with the new CA certificate chain.
The Coordinator has the new manifest set, but the different containers of the app are still
-using the older certificate authority. The Contrast Initializer terminates after the initial attestation
-flow and won't pull new certificates on manifest updates.
After the update has been rolled out, connecting to the frontend using curl will successfully validate
-the service certificate and return the HTML document of the voting site:
CoCo on AKS is currently in preview. An extension for the az CLI is needed to create such a cluster.
-Add the extension with the following commands:
-
az extension add\ --name aks-preview \ --allow-preview true az extension update \ --name aks-preview \ --allow-preview true
-
Then register the required feature flags in your subscription to allow access to the public preview:
-
az feature register \ --namespace"Microsoft.ContainerService"\ --name"KataCcIsolationPreview"
-
The registration can take a few minutes. The status of the operation can be checked with the following
-command, which should show the registration state as Registered:
-
az feature show \ --namespace"Microsoft.ContainerService"\ --name"KataCcIsolationPreview"\ --output table
-
Afterward, refresh the registration of the ContainerService provider:
-
az provider register \ --namespace"Microsoft.ContainerService"
# Select the name for your AKS cluster azClusterName="ContrastDemo" az aks create \ --resource-group "${azResourceGroup:?}"\ --name"${azClusterName:?}"\ --kubernetes-version 1.29\ --os-sku AzureLinux \ --node-vm-size Standard_DC4as_cc_v5 \ --node-count 1\ --generate-ssh-keys
After trying out Contrast, you might want to clean up the cloud resources created in this step.
-In case you've created a new resource group, you can just delete that group with
-
az group delete \ --name"${azResourceGroup:?}"
-
Deleting the resource group will also delete the cluster and all other related resources.
-
To only cleanup the AKS cluster and node pools, run
-
az aks delete \ --resource-group "${azResourceGroup:?}"\ --name"${azClusterName:?}"
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.6, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.6
Known Limitations
-
As Contrast is currently in an early development stage, it's built on several projects that are also under active development.
-This section outlines the most significant known limitations, providing stakeholders with clear expectations and understanding of the current state.
Platform Support: At present, Contrast is exclusively available on Azure AKS, supported by the Confidential Container preview for AKS. Expansion to other cloud platforms is planned, pending the availability of necessary infrastructure enhancements.
Resource Limits: There is an existing bug on AKS where container memory limits are incorrectly applied. The current workaround involves using only memory requests instead of limits.
Coverage: While the enforcement of workload policies generally functions well, there are scenarios not yet fully covered. It's crucial to review deployments specifically for these edge cases.
-
Order of events: The current policy evaluation mechanism on API requests isn't stateful, so it can't ensure a prescribed order of events. Consequently, there's no guaranteed enforcement that the service mesh sidecar container runs before the workload container. This order ensures that all traffic between pods is securely encapsulated within TLS connections.
-
Absence of events: Policies can't ensure certain events have happened. A container, such as the service mesh sidecar, can be omitted entirely. Environment variables may be missing.
-
Volume integrity checks: While persistent volumes aren't supported yet, integrity checks don't currently cover other objects such as ConfigMaps and Secrets.
-
-
warning
The policy limitations, in particular the missing guarantee that our service mesh sidecar has been started before the workload container affects the service mesh implementation of Contrast. Currently, this requires inspecting the iptables rules on startup or terminating TLS connections in the workload directly.
CLI Availability: The CLI tool is currently only available for Linux. This limitation arises because certain upstream dependencies haven't yet been ported to other platforms.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.7, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.7
Contrast
-
Welcome to the documentation of Contrast! Contrast runs confidential container deployments on Kubernetes at scale.
-
-
Contrast is based on the Kata Containers and
-Confidential Containers projects.
-Confidential Containers are Kubernetes pods that are executed inside a confidential micro-VM and provide strong hardware-based isolation from the surrounding environment.
-This works with unmodified containers in a lift-and-shift approach.
-Contrast currently targets the CoCo preview on AKS.
-
tip
See the 📄whitepaper for more information on confidential computing.
Contrast is designed to keep all data always encrypted and to prevent access from the infrastructure layer. It removes the infrastructure provider from the trusted computing base (TCB). This includes access from datacenter employees, privileged cloud admins, own cluster administrators, and attackers coming through the infrastructure, for example, malicious co-tenants escalating their privileges.
-
Contrast integrates fluently with the existing Kubernetes workflows. It's compatible with managed Kubernetes, can be installed as a day-2 operation and imposes only minimal changes to your deployment flow.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.7, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.7
CLI telemetry
-
The Contrast CLI sends telemetry data to Edgeless Systems when you use CLI commands.
-This allows to understand how Contrast is used and to improve it.
-
The CLI sends the following data:
-
-
The CLI version
-
The CLI target OS and architecture (GOOS and GOARCH)
-
The command that was run
-
The kind of error that occurred (if any)
-
-
The CLI doesn't collect sensitive information.
-The implementation is open-source and can be reviewed.
-
IP addresses may be processed or stored for security purposes.
-
The data that the CLI collects adheres to the Edgeless Systems privacy policy.
-
You can disable telemetry by setting the environment variable DO_NOT_TRACK=1 before running the CLI.
-
-
\ No newline at end of file
diff --git a/pr-preview/pr-1071/0.7/architecture.html b/pr-preview/pr-1071/0.7/architecture.html
deleted file mode 100644
index df2491aa0d..0000000000
--- a/pr-preview/pr-1071/0.7/architecture.html
+++ /dev/null
@@ -1,15 +0,0 @@
-
-
-
-
-
-Architecture | Contrast
-
-
-
-
-
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.7, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.7
Attestation in Contrast
-
This document describes the attestation architecture of Contrast, adhering to the definitions of Remote ATtestation procedureS (RATS) in RFC 9334.
-The following gives a detailed description of Contrast's attestation architecture.
-At the end of this document, we included an FAQ that answers the most common questions regarding attestation in hindsight of the security benefits.
Contrast integrates with the RATS architecture, leveraging their definition of roles and processes including Attesters, Verifiers, and Relying Parties.
-
-
Figure 1: Conceptual attestation architecture. Taken from RFC 9334.
-
-
Attester: Assigned to entities that are responsible for creating Evidence which is then sent to a Verifier.
-
Verifier: These entities utilize the Evidence, Reference Values, and Endorsements. They assess the trustworthiness of the Attester by applying an Appraisal Policy for Evidence. Following this assessment, Verifiers generate Attestation Results for use by Relying Parties. The Appraisal Policy for Evidence may be provided by the Verifier Owner, programmed into the Verifier, or acquired through other means.
-
Relying Party: Assigned to entities that utilize Attestation Results, applying their own appraisal policies to make specific decisions, such as authorization decisions. This process is referred to as the "appraisal of Attestation Results." The Appraisal Policy for Attestation Results might be sourced from the Relying Party Owner, configured by the owner, embedded in the Relying Party, or obtained through other protocols or mechanisms.
This includes all Pods of the Contrast deployment that run inside Confidential Containers and generate cryptographic evidence reflecting their current configuration and state.
-Their evidence is rooted in the hardware measurements from the CPU and their confidential VM environment.
-The details of this evidence are given below in the section on evidence generation and appraisal.
-
-
Figure 2: Attestation flow of a confidential pod. Based on the layered attester graphic in RFC 9334.
-
Pods run in Contrast's runtime environment (B), effectively within a confidential VM.
-During launch, the CPU (A) measures the initial memory content of the confidential VM that contains Contrast's pod-VM image and generates the corresponding attestation evidence.
-The image is in IGVM format, encapsulating all information required to launch a virtual machine, including the kernel, the initramfs, and kernel cmdline.
-The kernel cmdline contains the root hash for dm-verity that ensures the integrity of the root filesystem.
-The root filesystem contains all components of the container's runtime environment including the guest agent (C).
-
In the userland, the guest agent takes care of enforcing the runtime policy of the pod.
-While the policy is passed in during the initialization procedure via the host, the evidence for the runtime policy is part of the CPU measurements.
-During the deployment the policy is annotated to the Kubernetes Pod resources.
-On AMD SEV-SNP the hash of the policy is then added to the attestation report via the HOSTDATA field by the hypervisor.
-When provided with the policy from the Kata host, the guest agent verifies that the policy's hash matches the one in the HOSTDATA field.
-
In summary a Pod's evidence is the attestation report of the CPU that provides evidence for runtime environment and the runtime policy.
The Coordinator acts as a verifier within the Contrast deployment, configured with a Manifest that defines the reference values and serves as an appraisal policy for all pods in the deployment.
-It also pulls endorsements from hardware vendors to verify the hardware claims.
-The Coordinator operates within the cluster as a confidential container and provides similar evidence as any other Pod when it acts as an attester.
-In RATS terminology, the Coordinator's dual role is defined as a lead attester in a composite device which spans the entire deployment: Coordinator and the workload pods.
-It collects evidence from other attesters and conveys it to a verifier, generating evidence about the layout of the whole composite device based on the Manifest as the appraisal policy.
-
-
Figure 3: Contrast deployment as a composite device. Based on the composite device in RFC 9334.
-
The CLI serves as the verifier for the Coordinator and the entire Contrast deployment, containing the reference values for the Coordinator and the endorsements from hardware vendors.
-These reference values are built into the CLI during our release process and can be reproduced offline via reproducible builds.
A relying party in the Contrast scenario could be, for example, the data owner that interacts with the application.
-The relying party can use the CLI to obtain the attestation results and Contrast's CA certificates bound to these results.
-The CA certificates can then be used by the relying party to authenticate the application, for example through TLS connections.
In Contrast, attestation evidence revolves around a hardware-generated attestation report, which contains several critical pieces of information:
-
-
The hardware attestation report: This report includes details such as the chip identifier, platform information, microcode versions, and comprehensive guest measurements. The entire report is signed by the CPU's private key, ensuring the authenticity and integrity of the data provided.
-
The launch measurements: Included within the hardware attestation report, this is a digest generated by the CPU that represents a hash of all initial guest memory pages. This includes essential components like the kernel, initramfs, and the kernel command line. Notably, it incorporates the root filesystem's dm-verity root hash, verifying the integrity of the root filesystem.
-
The runtime policy hash: Also part of the hardware attestation report, this field contains the hash of the Rego policy which dictates all expected API commands and their values from the host to the Kata guest agent. It encompasses crucial settings such as dm-verity hashes for the container image layers, environment variables, and mount points.
The appraisal of this evidence in Contrast is governed by two main components:
-
-
The Manifest: A JSON file used by the Coordinator to align with reference values. It sets the expectations for runtime policy hashes for each pod and includes what should be reported in the hardware attestation report for each component of the deployment.
-
The CLI's appraisal policy: This policy encompasses expected values of the Coordinator’s guest measurements and its runtime policy. It's embedded into the CLI during the build process and ensures that any discrepancy between the built-in values and those reported by the hardware attestation can be identified and addressed. The integrity of this policy is safeguardable through reproducible builds, allowing verification against the source code reference.
-
-
Frequently asked questions about attestation in Contrast
-
What's the purpose of remote attestation in Contrast?
-
Remote attestation in Contrast ensures that software runs within a secure, isolated confidential computing environment.
-This process certifies that the memory is encrypted and confirms the integrity and authenticity of the software running within the deployment.
-By validating the runtime environment and the policies enforced on it, Contrast ensures that the system operates in a trustworthy state and hasn't been tampered with.
-
How does Contrast ensure the security of the attestation process?
-
Contrast leverages hardware-rooted security features such as AMD SEV-SNP to generate cryptographic evidence of a pod’s current state and configuration.
-This evidence is checked against pre-defined appraisal policies to guarantee that only verified and authorized pods are part of a Contrast deployment.
Attestation confirms the integrity of the runtime environment and the identity of the workloads.
-It plays a critical role in preventing unauthorized changes and detecting potential modifications at runtime.
-The attestation provides integrity and authenticity guarantees, enabling relying parties—such as workload operators or data owners—to confirm the effective protection against potential threats, including malicious cloud insiders, co-tenants, or compromised workload operators.
-More details on the specific security benefits can be found here.
-
How can you verify the authenticity of attestation results?
-
Attestation results in Contrast are tied to cryptographic proofs generated and signed by the hardware itself.
-These proofs are then verified using public keys from trusted hardware vendors, ensuring that the results aren't only accurate but also resistant to tampering.
-For further authenticity verification, all of Contrast's code is reproducibly built, and the attestation evidence can be verified locally from the source code.
-
How are attestation results used by relying parties?
-
Relying parties use attestation results to make informed security decisions, such as allowing access to sensitive data or resources only if the attestation verifies the system's integrity.
-Thereafter, the use of Contrast's CA certificates in TLS connections provides a practical approach to communicate securely with the application.
In summary, Contrast's attestation strategy adheres to the RATS guidelines and consists of robust verification mechanisms that ensure each component of the deployment is secure and trustworthy.
-This comprehensive approach allows Contrast to provide a high level of security assurance to its users.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.7, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.7
Certificate authority
-
The Coordinator acts as a certificate authority (CA) for the workloads
-defined in the manifest.
-After a workload pod's attestation has been verified by the Coordinator,
-it receives a mesh certificate and the mesh CA certificate.
-The mesh certificate can be used for example in a TLS connection as the server or
-client certificate to proof to the other party that the workload has been
-verified by the Coordinator. The other party can verify the mesh certificate
-with the mesh CA certificate. While the certificates can be used by the workload
-developer in different ways, they're automatically used in Contrast's service
-mesh to establish mTLS connections between workloads in the same deployment.
The Coordinator establishes a public key infrastructure (PKI) for all workloads
-contained in the manifest. The Coordinator holds three certificates: the root CA
-certificate, the intermediate CA certificate, and the mesh CA certificate.
-The root CA certificate is a long-lasting certificate and its private key signs
-the intermediate CA certificate. The intermediate CA certificate and the mesh CA
-certificate share the same private key. This intermediate private key is used
-to sign the mesh certificates. Moreover, the intermediate private key and
-therefore the intermediate CA certificate and the mesh CA certificate are
-rotated when setting a new manifest.
Depending on the configuration of the first manifest, it allows the workload
-owner to update the manifest and, therefore, the deployment.
-Workload owners and data owners can be mutually untrusted parties.
-To protect against the workload owner silently introducing malicious containers,
-the Coordinator rotates the intermediate private key every time the manifest is
-updated and, therefore, the
-intermediate CA certificate and mesh CA certificate. If the user doesn't
-trust the workload owner, they use the mesh CA certificate obtained when they
-verified the Coordinator and the manifest. This ensures that the user only
-connects to workloads defined in the manifest they verified since only those
-workloads' certificates are signed with this intermediate private key.
-
Similarly, the service mesh also uses the mesh CA certificate obtained when the
-workload was started, so the workload only trusts endpoints that have been
-verified by the Coordinator based on the same manifest. Consequently, a
-manifest update requires a fresh rollout of the services in the service mesh.
The root CA certificate is returned when verifying the Coordinator.
-The data owner can use it to verify the mesh certificates of the workloads.
-This should only be used if the data owner trusts all future updates to the
-manifest and workloads. This is, for instance, the case when the workload owner is
-the same entity as the data owner.
-
The mesh CA certificate is returned when verifying the Coordinator.
-The data owner can use it to verify the mesh certificates of the workloads.
-This certificate is bound to the manifest set when the Coordinator is verified.
-If the manifest is updated, the mesh CA certificate changes.
-New workloads will receive mesh certificates signed by the new mesh CA certificate.
-The Coordinator with the new manifest needs to be verified to retrieve the new mesh CA certificate.
-The service mesh also uses the mesh CA certificate to verify the mesh certificates.
-
The intermediate CA certificate links the root CA certificate to the
-mesh certificate so that the mesh certificate can be verified with the root CA
-certificate. It's part of the certificate chain handed out by
-endpoints in the service mesh.
-
The mesh certificate is part of the certificate chain handed out by
-endpoints in the service mesh. During the startup of a pod, the Initializer
-requests a certificate from the Coordinator. This mesh certificate will be returned if the Coordinator successfully
-verifies the workload. The mesh certificate
-contains X.509 extensions with information from the workloads attestation
-document.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.7, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.7
Observability
-
The Contrast Coordinator can expose metrics in the
-Prometheus format. These can be monitored to quickly
-identify problems in the gRPC layer or attestation errors. Prometheus metrics
-are numerical values associated with a name and additional key/values pairs,
-called labels.
The metrics can be accessed at the Coordinator pod at the port specified in the
-CONTRAST_METRICS_PORT environment variable under the /metrics endpoint. By
-default, this environment variable isn't specified, hence no metrics will be
-exposed.
-
The Coordinator starts two gRPC servers, one for the user API on port 1313 and
-one for the mesh API on port 7777. Metrics for both servers can be accessed
-using different prefixes.
-
All metric names for the user API are prefixed with contrast_userapi_grpc_server_.
-Exposed metrics include the number of handled requests of the methods
-SetManifest and GetManifest, which get called when setting the
-manifest and verifying the
-Coordinator respectively. For each method
-you can see the gRPC status code indicating whether the request succeeded or
-not and the request latency.
-
For the mesh API, the metric names are prefixed with contrast_meshapi_grpc_server_. The
-metrics include similar data to the user API for the method NewMeshCert which
-gets called by the Initializer when starting a
-new workload. Attestation failures from workloads to the Coordinator can be
-tracked with the counter contrast_meshapi_attestation_failures.
-
The current manifest generation is exposed as a
-gauge with the metric
-name contrast_coordinator_manifest_generation. If no manifest is set at the
-Coordinator, this counter will be zero.
The Service Mesh can be configured to expose
-metrics via its Envoy admin
-interface. Be
-aware that the admin interface can expose private information and allows
-destructive operations to be performed. To enable the admin interface for the
-Service Mesh, set the annotation
-contrast.edgeless.systems/servicemesh-admin-interface-port in the configuration
-of your workload. If this annotation is set, the admin interface will be started
-on this port.
-
To access the admin interface, the ingress settings of the Service Mesh have to
-be configured to allow access to the specified port (see Configuring the
-Proxy). All metrics will be
-exposed under the /stats endpoint. Metrics in Prometheus format can be scraped
-from the /stats/prometheus endpoint.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.7, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.7
Confidential Containers
-
Contrast uses some building blocks from Confidential Containers (CoCo), a CNCF Sandbox project that aims to standardize confidential computing at the pod level.
-The project is under active development and many of the high-level features are still in flux.
-Contrast uses the more stable core primitive provided by CoCo: its Kubernetes runtime.
Kubernetes can be extended to use more than one container runtime with RuntimeClass objects.
-The Container Runtime Interface (CRI) implementation, for example containerd, dispatches pod management API calls to the appropriate RuntimeClass.
-RuntimeClass implementations are usually based on an OCI runtime, such as runc, runsc or crun.
-In CoCo's case, the runtime is Kata Containers with added confidential computing capabilities.
Kata Containers is an OCI runtime that runs pods in VMs.
-The pod VM spawns an agent process that accepts management commands from the Kata runtime running on the host.
-There are two options for creating pod VMs: local to the Kubernetes node, or remote VMs created with cloud provider APIs.
-Using local VMs requires either bare-metal servers or VMs with support for nested virtualization.
-Local VMs communicate with the host over a virtual socket.
-For remote VMs, host-to-agent communication is tunnelled through the cloud provider's network.
-
Kata Containers was originally designed to isolate the guest from the host, but it can also run pods in confidential VMs (CVMs) to shield pods from their underlying infrastructure.
-In confidential mode, the guest agent is configured with an Open Policy Agent (OPA) policy to authorize API calls from the host.
-This policy also contains checksums for the expected container images.
-It's derived from Kubernetes resource definitions and its checksum is included in the attestation report.
Azure Kubernetes Service (AKS) provides CoCo-enabled node pools as a preview offering.
-These node pools leverage Azure VM types capable of nested virtualization (CVM-in-VM) and the CoCo stack is pre-installed.
-Contrast can be deployed directly into a CoCo-enabled AKS cluster.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.7, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.7
Product features
-
Contrast simplifies the deployment and management of Confidential Containers, offering optimal data security for your workloads while integrating seamlessly with your existing Kubernetes environment.
-
From a security perspective, Contrast employs the Confidential Containers concept and provides security benefits that go beyond individual containers, shielding your entire deployment from the underlying infrastructure.
-
From an operational perspective, Contrast provides the following key features:
-
-
-
Managed Kubernetes compatibility: Initially compatible with Azure Kubernetes Service (AKS), Contrast is designed to support additional platforms such as AWS EKS and Google Cloud GKE as they begin to accommodate confidential containers.
-
-
-
Lightweight installation: Contrast can be integrated as a day-2 operation within existing clusters, adding minimal components to your setup. This facilitates straightforward deployments using your existing YAML configurations, Helm charts, or Kustomization, enabling native Kubernetes orchestration of your applications.
-
-
-
Remote attestation: Contrast generates a concise attestation statement that verifies the identity, authenticity, and integrity of your deployment both internally and to external parties. This architecture ensures that updates or scaling of the application don't compromise the attestation’s validity.
-
-
-
Service mesh: Contrast securely manages a Public Key Infrastructure (PKI) for your deployments, issues workload-specific certificates, and establishes transparent mutual TLS (mTLS) connections across pods. This is done by harnessing the envoy proxy to ensure secure communications within your Kubernetes cluster.
-
-
-
-
\ No newline at end of file
diff --git a/pr-preview/pr-1071/0.7/basics/security-benefits.html b/pr-preview/pr-1071/0.7/basics/security-benefits.html
deleted file mode 100644
index 01f0b08a02..0000000000
--- a/pr-preview/pr-1071/0.7/basics/security-benefits.html
+++ /dev/null
@@ -1,116 +0,0 @@
-
-
-
-
-
-Contrast security overview | Contrast
-
-
-
-
-
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.7, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.7
Contrast security overview
-
This document outlines the security measures of Contrast and its capability to counter various threats.
-Contrast is designed to shield entire Kubernetes deployments from the infrastructure, enabling entities to manage sensitive information (such as regulated or personally identifiable information (PII)) in the public cloud, while maintaining data confidentiality and ownership.
-
Contrast is applicable in situations where establishing trust with the workload operator or the underlying infrastructure is challenging.
-This is particularly beneficial for regulated sectors looking to transition sensitive activities to the cloud, without sacrificing security or compliance.
-It allows for cloud adoption by maintaining a hardware-based separation from the cloud service provider.
Leveraging Confidential Computing technology, Contrast provides three defining security properties:
-
-
Encryption of data in use: Contrast ensures that all data processed in memory is encrypted, making it inaccessible to unauthorized users or systems, even if they have physical access to the hardware.
-
Workload isolation: Each pod runs in its isolated runtime environment, preventing any cross-contamination between workloads, which is critical for multi-tenant infrastructures.
-
Remote attestation: This feature allows data owners and workload operators to verify that the Contrast environment executing their workloads hasn't been tampered with and is running in a secure, pre-approved configuration.
-
-
The runtime encryption is transparently provided by the confidential computing hardware during the workload's lifetime.
-The workload isolation and remote attestation involves two phases:
-
-
An attestation process detects modifications to the workload image or its runtime environment during the initialization. This protects the workload's integrity pre-attestation.
-
A protected runtime environment and a policy mechanism prevents the platform operator from accessing or compromising the instance at runtime. This protects a workload's integrity and confidentiality post-attestation.
-
-
For more details on confidential computing see our whitepaper.
-The attestation architecture describes Contrast's attestation process and the resulting chain of trust in detail.
Contrast uses the Kubernetes runtime of the Confidential Containers project.
-Confidential Containers significantly decrease the size of the trusted computing base (TCB) of a Kubernetes deployment, by isolating each pod within its own confidential micro-VM environment.
-The TCB is the totality of elements in a computing environment that must be trusted not to be compromised.
-A smaller TCB results in a smaller attack surface. The following diagram shows how Confidential Containers remove the cloud & datacenter infrastructure and the physical hosts, including the hypervisor, the host OS, the Kubernetes control plane, and other components, from the TCB (red).
-In the confidential context, depicted in green, only the workload containers along with their confidential micro-VM environment are included within the TCB.
-Their integrity is verifiable through remote attestation.
-
Contrast uses hardware-based mechanisms, specifically leveraging CPU features, such as AMD SEV or Intel TDX, to provide the isolation of the workload.
-This implies that both the CPU and its microcode are integral components of the TCB.
-However, it should be noted that the CPU microcode aspects aren't depicted in the accompanying graphic.
-
-
Contrast adds the following components to a deployment that become part of the TCB.
-The components that are part of the TCB are:
-
-
The workload containers: Container images that run the actual application.
The runtime policies: Policies that enforce the runtime environments for the workload containers during their lifetime.
-
The manifest: A manifest file defining the reference values of an entire confidential deployment. It contains the policy hashes for all pods of the deployment and the expected hardware reference values for the Confidential Container runtime.
-
The Coordinator: An attestation service that runs in a Confidential Container in the Kubernetes cluster. The Coordinator is configured with the manifest. User-facing, you can verify this service and the effective manifest using remote attestation, providing you with a concise attestation for the entire deployment. Cluster-facing, it verifies all pods and their policies based on remote attestation procedures and the manifest.
In a Contrast deployment, there are three parties:
-
-
-
The container image provider, who creates the container images that represent the application that has access to the protected data.
-
-
-
The workload operator, who runs the workload in a Kubernetes cluster. The operator typically has full administrative privileges to the deployment. The operator can manage cluster resources such as nodes, volumes, and networking rules, and the operator can interact with any Kubernetes or underlying cloud API.
-
-
-
The data owner, who owns the protected data. A data owner can verify the deployment using the Coordinator attestation service. The verification includes the identity, integrity, and confidentiality of the workloads, the runtime environment and the access permissions.
-
-
-
Contrast supports a trust model where the container image provider, workload operator, and data owner are separate, mutually distrusting parties.
-
The following diagram shows the system components and parties.
Contrast is designed to defend against five possible attacks:
-
-
A malicious cloud insider: malicious employees or third-party contractors of cloud service providers (CSPs) potentially have full access to various layers of the cloud infrastructure. That goes from the physical datacenter up to the hypervisor and Kubernetes layer. For example, they can access the physical memory of the machines, modify the hypervisor, modify disk contents, intercept network communications, and attempt to compromise the confidential container at runtime. A malicious insider can expand the attack surface or restrict the runtime environment. For example, a malicious operator can add a storage device to introduce new attack vectors. As another example, a malicious operator can constrain resources such as limiting a guest's memory size, changing its disk space, or changing firewall rules.
-
A malicious cloud co-tenant: malicious cloud user ("hackers") may break out of their tenancy and access other tenants' data. Advanced attackers may even be able to establish a permanent foothold within the infrastructure and access data over a longer period. The threats are analogous to the cloud insider access scenario, without the physical access.
-
A malicious workload operator: malicious workload operators, for example Kubernetes administrators, have full access to the workload deployment and the underlying Kubernetes platform. The threats are analogously to the cloud insider access scenario, with access to everything that's above the hypervisor level.
-
A malicious attestation client: this attacker connects to the attestation service and sends malformed request.
-
A malicious container image provider: a malicious container image provider has full control over the application development itself. This attacker might release a malicious version of the workload containing harmful operations.
Contrast shields a workload from the aforementioned threats with three main components:
-
-
The runtime environment safeguards against the physical memory and disk attack surface.
-
The runtime policies safeguard against the Kubernetes control plane and container runtime attack surface.
-
The service mesh safeguards against the network attack surface.
-
-
The following tables describe concrete threats and how they're mitigated in Contrast grouped by these categories:
-
-
Attacks on the confidential container environment
-
Attacks on the attestation service
-
Attacks on workloads
-
-
Attacks on the confidential container environment
-
This table describes potential threats and mitigation strategies related to the confidential container environment.
-
Threat
Mitigation
Mitigation implementation
An attacker intercepts the network connection of the launcher or image repository.
An attacker can change the image URL and control the workload binary. However these actions are reflected in the attestation report. The image repository isn't controlled using an access list, therefore the image is assumed to be viewable by everyone. You must ensure that the workload container image doesn't contain any secrets.
An attacker modifies a container's runtime environment configuration in the Kubernetes control plane.
The attestation process and the runtime policies detects unsafe configurations that load non-authentic images or perform any other modification to the expected runtime environment.
This table describes potential threats and mitigation strategies to the attestation service.
-
Threat
Mitigation
Mitigation implementation
An attacker intercepts the Coordinator deployment and modifies the image or hijacks the runtime environment.
This threat is mitigated by having an attestation procedure and attested, encrypted TLS connections to the Coordinator. The attestation evidence for the Coordinator image is distributed with our releases, protected by supply chain security, and fully reproducible.
An attacker intercepts the network connection between the workload and the Coordinator and reads secret keys from the wire.
This threat is mitigated by having an attested, encrypted TLS connection. This connection helps protect the secrets from passive eavesdropping. The attacker can't create valid workload certificates that would be accepted in Contrast's service mesh. An attacker can't impersonate a valid workload container because the container's identity is guaranteed by the attestation protocol.
Within the network between your workload and the Coordinator.
An attacker exploits parsing discrepancies, which leads to undetected changes in the attestation process.
This risk is mitigated by having a parsing engine written in memory-safe Go that's tested against the attestation specification of the hardware vendor. The runtime policies are available as an attestation artifact for further inspection and audits to verify their effectiveness.
An attacker reads or modifies data written to disk via persistent volumes.
Currently, persistent volumes aren't supported in Contrast. In the future, this threat is mitigated by encrypted and integrity-protected volume mounts.
An attacker publishes a new image version containing malicious code.
The attestation process and the runtime policies require a data owner to accept a specific version of the workload and any update to the workload needs to be explicitly acknowledged.
The following table describes three example use cases and how they map to the defined threat model in this document:
-
Use Case
Example Scenario
Migrate sensitive workloads to the cloud
TechSolve Inc., a software development firm, aimed to enhance its defense-in-depth strategy for its cloud-based development environment, especially for projects involving proprietary algorithms and client data. TechSolve acts as the image provider, workload operator, and data owner, combining all three personas in this scenario. In our attestation terminology, they're the workload operator and relying party in one entity. Their threat model includes a malicious cloud insider and cloud co-tenant.
Make your SaaS more trustworthy
SaaSProviderX, a company offering cloud-based project management tools, sought to enhance its platform's trustworthiness amidst growing concerns about data breaches and privacy. Here, the relying party is the SaaS customer as the data owner. The goal is to achieve a form of operator exclusion and only allow selective operations on the deployment. Hence, their threat model includes a malicious workload operator.
Simplify regulatory compliance
HealthSecure Inc. has been managing a significant volume of sensitive patient data on-premises. With the increasing demand for advanced data analytics and the need for scalable infrastructure, the firm decides to migrate its data analytics operations to the cloud. However, the primary concern is maintaining the confidentiality and security of patient data during and after the migration, in compliance with healthcare regulations. In this compliance scenario, the regulator serves as an additional relying party. HealthSecure must implement a mechanism that ensures the isolation of patient data can be verifiably guaranteed to the regulator.
-
In each scenario, Contrast ensures exclusive data access and processing capabilities are confined to the designated workloads. It achieves this by effectively isolating the workload from the infrastructure and other components of the stack. Data owners are granted the capability to audit and approve the deployment environment before submitting their data, ensuring a secure handover. Meanwhile, workload operators are equipped to manage and operate the application seamlessly, without requiring direct access to either the workload or its associated data.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.7, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.7
Components
-
Contrast is composed of several key components that work together to manage and scale confidential containers effectively within Kubernetes environments.
-This page provides an overview of the core components essential for deploying and managing Contrast.
The CLI serves as the primary management tool for Contrast deployments. It's designed to streamline the configuration and operation of Contrast in several ways:
-
-
Installation and setup: The CLI facilitates the installation of the necessary runtime classes required for Contrast to function within a Kubernetes cluster.
-
Policy generation: It allows users to generate runtime policies, adapt the deployment files, and generate the Contrast manifest.
-
Configuration management: Through the CLI, users can configure the Contrast Coordinator with the generated manifest.
-
Verification and attestation: The CLI provides tools to verify the integrity and authenticity of the Coordinator and the entire deployment via remote attestation.
The Contrast Coordinator is the central remote attestation service of a Contrast deployment.
-It runs inside a confidential container inside your cluster.
-The Coordinator can be verified via remote attestation, and a Contrast deployment is self-contained.
-The Coordinator is configured with a manifest, a configuration file containing the reference attestation values of your deployment.
-It ensures that your deployment's topology adheres to your specified manifest by verifying the identity and integrity of all confidential pods inside the deployment.
-The Coordinator is also a certificate authority and issues certificates for your workload pods during the attestation procedure.
-Your workload pods can establish secure, encrypted communication channels between themselves based on these certificates using the Coordinator as the root CA.
-As your app needs to scale, the Coordinator transparently verifies new instances and then provides them with their certificates to join the deployment.
-
To verify your deployment, the Coordinator's remote attestation statement combined with the manifest offers a concise single remote attestation statement for your entire deployment.
-A third party can use this to verify the integrity of your distributed app, making it easy to assure stakeholders of your app's identity and integrity.
The manifest is the configuration file for the Coordinator, defining your confidential deployment.
-It's automatically generated from your deployment by the Contrast CLI.
-It currently consists of the following parts:
-
-
Policies: The identities of your Pods, represented by the hashes of their respective runtime policies.
-
Reference Values: The remote attestation reference values for the Kata confidential micro-VM that's the runtime environment of your Pods.
-
WorkloadOwnerKeyDigest: The workload owner's public key digest. Used for authenticating subsequent manifest updates.
Runtime Policies are a mechanism to enable the use of the untrusted Kubernetes API for orchestration while ensuring the confidentiality and integrity of your confidential containers.
-They allow us to enforce the integrity of your containers' runtime environment as defined in your deployment files.
-The runtime policy mechanism is based on the Open Policy Agent (OPA) and translates the Kubernetes deployment YAML into the Rego policy language of OPA.
-The Kata Agent inside the confidential micro-VM then enforces the policy by only acting on permitted requests.
-The Contrast CLI provides the tooling for automatically translating Kubernetes deployment YAML into the Rego policy language of OPA.
Contrast provides an Initializer that handles the remote attestation on the workload side transparently and
-fetches the workload certificate. The Initializer runs as an init container before your workload is started.
-It provides the workload container and the service mesh sidecar with the workload certificates.
Contrast depends on a Kubernetes runtime class, which is installed
-by the node-installer DaemonSet.
-This runtime consists of a containerd runtime plugin, a virtual machine manager (cloud-hypervisor), and a podvm image (IGVM and rootFS).
-The installer takes care of provisioning every node in the cluster so it provides this runtime class.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.7, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.7
Policies
-
Kata runtime policies are an integral part of the Confidential Containers preview on AKS.
-They prescribe how a Kubernetes pod must be configured to launch successfully in a confidential VM.
-In Contrast, policies act as a workload identifier: only pods with a policy registered in the manifest receive workload certificates and may participate in the confidential deployment.
-Verification of the Contrast Coordinator and its manifest transitively guarantees that all workloads meet the owner's expectations.
The Kata agent running in the confidential micro-VM exposes an RPC service AgentService to the Kata runtime.
-This service handles potentially untrustworthy requests from outside the TCB, which need to be checked against a policy.
-
Kata runtime policies are written in the policy language Rego.
-They specify what AgentService methods can be called, and the permissible parameters for each call.
-
Policies consist of two parts: a list of rules and a data section.
-While the list of rules is static, the data section is populated with information from the PodSpec and other sources.
Runtime policies are programmatically generated from Kubernetes manifests by the Contrast CLI.
-The generate subcommand inspects pod definitions and derives rules for validating the pod at the Kata agent.
-There are two important integrity checks: container image checksums and OCI runtime parameters.
-
For each of the container images used in a pod, the CLI downloads all image layers and produces a cryptographic dm-verity checksum.
-These checksums are the basis for the policy's storage data.
-
The CLI combines information from the PodSpec, ConfigMaps, and Secrets in the provided Kubernetes manifests to derive a permissible set of command-line arguments and environment variables.
-These constitute the policy's OCI data.
The generated policy document is annotated to the pod definitions in Base64 encoding.
-This annotation is propagated to the Kata runtime, which calculates the SHA256 checksum for the policy and uses that as SNP HOSTDATA for the confidential micro-VM.
-
After the VM launched, the runtime calls the agent's SetPolicy method with the full policy document.
-If the policy doesn't match the checksum in HOSTDATA, the agent rejects the policy.
-Otherwise, it applies the policy to all future AgentService requests.
Contrast verifies its confidential containers following these steps:
-
-
The Contrast CLI generates a policy and attaches it to the pod definition.
-
Kubernetes schedules the pod on a node with the confidential computing runtime.
-
Containerd invokes the Kata runtime to create the pod sandbox.
-
The Kata runtime starts a CVM with the policy's digest as HOSTDATA.
-
The Kata runtime sets the policy using the SetPolicy method.
-
The Kata agent verifies that the incoming policy's digest matches HOSTDATA.
-
The CLI sets a manifest in the Contrast Coordinator, including a list of permitted policies.
-
The Contrast Initializer sends an attestation report to the Contrast Coordinator, asking for a mesh certificate.
-
The Contrast Coordinator verifies that the started pod has a permitted policy hash in its HOSTDATA field.
-
-
After the last step, we know that the policy hasn't been tampered with and, thus, that the workload matches expectations and may receive mesh certificates.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.7, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.7
Contrast Runtime
-
The Contrast runtime is responsible for starting pods as confidential virtual machines.
-This works by specifying the runtime class to be used in a pod spec and by registering the runtime class with the apiserver.
-The RuntimeClass resource defines a name for referencing the class and
-a handler used by the container runtime (containerd) to identify the class.
-
apiVersion: node.k8s.io/v1 kind: RuntimeClass metadata: # This name is used by pods in the runtimeClassName field name: contrast-cc-abcdef # This name is used by the # container runtime interface implementation (containerd) handler: contrast-cc-abcdef
-
Confidential pods that are part of a Contrast deployment need to specify the
-same runtime class in the runtimeClassName field, so Kubernetes uses the
-Contrast runtime instead of the default containerd / runc handler.
-
apiVersion: v1 kind: Pod spec: runtimeClassName: contrast-cc-abcdef # ...
The runtime consists of additional software components that need to be installed
-and configured on every SEV-SNP-enabled worker node.
-This installation is performed automatically by the node-installer DaemonSet.
The handler field in the Kubernetes RuntimeClass instructs containerd not to use the default runc implementation.
-Instead, containerd invokes a custom plugin called containerd-shim-contrast-cc-v2.
-This shim is described in more detail in the upstream source repository and in the containerd documentation.
The containerd shim uses cloud-hypervisor to create a confidential virtual machine for every pod.
-This requires the cloud-hypervisor binary to be installed on every node (responsibility of the node-installer).
Contrast uses a special containerd snapshotter (tardev) to provide container images as block devices to the pod-VM. This snapshotter consists of a host component that pulls container images and a guest component (kernel module) used to mount container images.
-The tardev snapshotter uses dm-verity to protect the integrity of container images.
-Expected dm-verity container image hashes are part of Contrast runtime policies and are enforced by the kata-agent.
-This enables workload attestation by specifying the allowed container image as part of the policy. Read the chapter on policies for more information.
Every pod-VM starts with the same guest image. It consists of an IGVM file and a root filesystem.
-The IGVM file describes the initial memory contents of a pod-VM and consists of:
-
-
Linux kernel image
-
initrd
-
kernel commandline
-
-
Additionally, a root filesystem image is used that contains a read-only partition with the user space of the pod-VM and a verity partition to guarantee the integrity of the root filesystem.
-The root filesystem contains systemd as the init system, and the kata agent for managing the pod.
-
This pod-VM image isn't specific to any pod workload. Instead, container images are mounted at runtime.
The RuntimeClass resource above registers the runtime with the Kubernetes api.
-The node-level installation is carried out by the Contrast node-installer
-DaemonSet that ships with every Contrast release.
-
After deploying the installer, it performs the following steps on each node:
-
-
Install the Contrast containerd shim (containerd-shim-contrast-cc-v2)
-
Install cloud-hypervisor as the virtual machine manager (VMM)
-
Install an IGVM file for pod-VMs of this class
-
Install a read only root filesystem disk image for the pod-VMs of this class
-
Reconfigure containerd by adding a runtime plugin that corresponds to the handler field of the Kubernetes RuntimeClass
-
Restart containerd to make it aware of the new plugin
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.7, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.7
Service mesh
-
The Contrast service mesh secures the communication of the workload by automatically
-wrapping the network traffic inside mutual TLS (mTLS) connections. The
-verification of the endpoints in the connection establishment is based on
-certificates that are part of the
-PKI of the Coordinator.
-
The service mesh can be enabled on a per-workload basis by adding a service mesh
-configuration to the workload's object annotations. During the contrast generate
-step, the service mesh is added as a sidecar
-container to
-all workloads which have a specified configuration. The service mesh container first
-sets up iptables rules based on its configuration and then starts
-Envoy for TLS origination and termination.
The service mesh container can be configured using the following object annotations:
-
-
contrast.edgeless.systems/servicemesh-ingress to configure ingress.
-
contrast.edgeless.systems/servicemesh-egress to configure egress.
-
contrast.edgeless.systems/servicemesh-admin-interface-port to configure the Envoy
-admin interface. If not specified, no admin interface will be started.
-
-
If you aren't using the automatic service mesh injection and want to configure the
-service mesh manually, set the environment variables EDG_INGRESS_PROXY_CONFIG,
-EDG_EGRESS_PROXY_CONFIG and EDG_ADMIN_PORT in the service mesh sidecar directly.
All TCP ingress traffic is routed over Envoy by default. Since we use
-TPROXY, the destination address
-remains the same throughout the packet handling.
-
Any incoming connection is required to present a client certificate signed by the
-mesh CA certificate.
-Envoy presents a certificate chain of the mesh
-certificate of the workload and the intermediate CA certificate as the server certificate.
-
If the deployment contains workloads which should be reachable from outside the
-Service Mesh, while still handing out the certificate chain, disable client
-authentication by setting the annotation contrast.edgeless.systems/servicemesh-ingress as
-<name>#<port>#false. Separate multiple entries with ##. You can choose any
-descriptive string identifying the service on the given port for the <name> field,
-as it's only informational.
-
Disable redirection and TLS termination altogether by specifying
-<name>#<port>#true. This can be beneficial if the workload itself handles TLS
-on that port or if the information exposed on this port is non-sensitive.
-
The following example workload exposes a web service on port 8080 and metrics on
-port 7890. The web server is exposed to a 3rd party end-user which wants to
-verify the deployment, therefore it's still required that the server hands out
-it certificate chain signed by the mesh CA certificate. The metrics should be
-exposed via TCP without TLS.
Note, that changing the environment variables of the sidecar container directly will
-only have an effect if the workload isn't configured to automatically generate a
-service mesh component on contrast generate. Otherwise, the service mesh sidecar
-container will be regenerated on every invocation of the command.
To be able to route the egress traffic of the workload through Envoy, the remote
-endpoints' IP address and port must be configurable.
-
-
Choose an IP address inside the 127.0.0.0/8 CIDR and a port not yet in use
-by the pod.
-
Configure the workload to connect to this IP address and port.
-
Set <name>#<chosen IP>:<chosen port>#<original-hostname-or-ip>:<original-port>
-as the contrast.edgeless.systems/servicemesh-egress workload annotation. Separate multiple
-entries with ##. Choose any string identifying the service on the given port as
-<name>.
-
-
This redirects the traffic over Envoy. The endpoint must present a valid
-certificate chain which must be verifiable with the
-mesh CA certificate.
-Furthermore, Envoy uses a certificate chain with the mesh certificate of the workload
-and the intermediate CA certificate as the client certificate.
-
The following example workload has no ingress connections and two egress
-connection to different microservices. The microservices are part
-of the confidential deployment. One is reachable under billing-svc:8080 and
-the other under cart-svc:8080.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.7, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.7
Workload deployment
-
The following instructions will guide you through the process of making an existing Kubernetes deployment
-confidential and deploying it together with Contrast.
-
A running CoCo-enabled cluster is required for these steps, see the setup guide on how to set it up.
Contrast depends on a custom Kubernetes RuntimeClass (contrast-cc),
-which needs to be installed in the cluster prior to the Coordinator or any confidential workloads.
-This consists of a RuntimeClass resource and a DaemonSet that performs installation on worker nodes.
-This step is only required once for each version of the runtime.
-It can be shared between Contrast deployments.
Your Kubernetes resources need some modifications to run as Confidential Containers.
-This section guides you through the process and outlines the necessary changes.
Contrast will add annotations to your Kubernetes YAML files. If you want to keep the original files
-unchanged, you can copy the files into a separate local directory.
-You can also generate files from a Helm chart or from a Kustomization.
To specify that a workload (pod, deployment, etc.) should be deployed as confidential containers,
-add runtimeClassName: contrast-cc to the pod spec (pod definition or template).
-This is a placeholder name that will be replaced by a versioned runtimeClassName when generating policies.
In the initialization process, the contrast-tls-certs shared volume is populated with X.509 certificates for your workload.
-These certificates are used by the Contrast Service Mesh, but can also be used by your application directly.
-The following tab group explains the setup for both scenarios.
-
Drop-in service mesh
Go integration
Contrast can be configured to handle TLS in a sidecar container.
-This is useful for workloads that are hard to configure with custom certificates, like Java applications.
Configuration of the sidecar depends heavily on the application.
-The following example is for an application with these properties:
-
The container has a main application at TCP port 8001, which should be TLS-wrapped and doesn't require client authentication.
-
The container has a metrics endpoint at TCP port 8080, which should be accessible in plain text.
-
All other endpoints require client authentication.
-
The app connects to a Kubernetes service backend.default:4001, which requires client authentication.
During the generate step, this configuration will be translated into a Service Mesh sidecar container which handles TLS connections automatically.
-The only change required to the app itself is to let it connect to 127.0.0.2:4001 to reach the backend service.
-You can find more detailed documentation in the Service Mesh chapter.
The mesh certificate contained in certChain.pem authenticates this workload, while the mesh CA certificate mesh-ca.pem authenticates its peers.
-Your app should turn on client authentication to ensure peers are running as confidential containers, too.
-See the Certificate Authority section for detailed information about these certificates.
The following example shows how to configure a Golang app, with error handling omitted for clarity.
Run the generate command to add the necessary components to your deployment files.
-This will add the Contrast Initializer to every workload with the specified contrast-cc runtime class
-and the Contrast Service Mesh to all workloads that have a specified configuration.
-After that, it will generate the execution policies and add them as annotations to your deployment files.
-A manifest.json with the reference values of your deployment will be created.
-
contrast generate resources/
-
warning
Please be aware that runtime policies currently have some blind spots. For example, they can't guarantee the starting order of containers. See the current limitations for more details.
-
If you don't want the Contrast Initializer to automatically be added to your
-workloads, there are two ways you can skip the Initializer injection step,
-depending on how you want to customize your deployment.
-
Command-line flag
Per-workload annotation
You can disable the Initializer injection completely by specifying the
---skip-initializer flag in the generate command.
contrast generate --skip-initializer resources/
If you want to disable the Initializer injection for a specific workload with
-the contrast-cc runtime class, you can do so by adding an annotation to the workload.
When disabling the automatic Initializer injection, you can manually add the
-Initializer as a sidecar container to your workload before generating the
-policies. Configure the workload to use the certificates written to the
-contrast-tls-certsvolumeMount.
For the next steps, we will need to connect to the Coordinator. The released Coordinator resource
-includes a LoadBalancer definition we can use.
-
coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}')
-
Port-forwarding of Confidential Containers
kubectl port-forward uses a Container Runtime Interface (CRI) method that isn't supported by the Kata shim.
-If you can't use a public load balancer, you can deploy a port-forwarder.
-The port-forwarder relays traffic from a CoCo pod and can be accessed via kubectl port-forward.
After this step, the Coordinator will start issuing TLS certificates to the workloads. The init container
-will fetch a certificate for the workload and the workload is started.
An end user (data owner) can verify the Contrast deployment using the verify command.
-
contrast verify -c"${coordinator}:1313"
-
The CLI will attest the Coordinator using embedded reference values. The CLI will write the service mesh
-root certificate and the history of manifests into the verify/ directory. In addition, the policies referenced
-in the manifest are also written to the directory.
You can securely connect to the workloads using the Coordinator's mesh-ca.pem as a trusted CA certificate.
-First, expose the service on a public IP address via a LoadBalancer service:
By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed
-via load balancer IP in this demo. Tools like curl check the certificate for IP entries in the SAN field.
-Validation fails since the certificate contains no IP entries as a subject alternative name (SAN).
-For example, a connection attempt using the curl and the mesh CA certificate with throw the following error:
$ curl--cacert ./verify/mesh-ca.pem "https://${frontendIP}:443" curl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34'
-
Using openssl, the certificate of the service can be validated with the mesh-ca.pem:
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.7, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.7
Confidential emoji voting
-
-
This tutorial guides you through deploying emojivoto as a
-confidential Contrast deployment and validating the deployment from a voters perspective.
-
Emojivoto is an example app allowing users to vote for different emojis and view votes
-on a leader board. It has a microservice architecture consisting of a
-web frontend (web), a gRPC backend for listing available emojis (emoji), and a backend for
-the voting and leader board logic (voting). The vote-bot simulates user traffic by submitting
-votes to the frontend.
Using a voting service, users' votes are considered highly sensitive data, as we require
-a secret ballot. Also, users are likely interested in the fairness of the ballot. For
-both requirements, we can use Confidential Computing and, specifically, workload attestation
-to prove to those interested in voting that the app is running in a protected environment
-where their votes are processed without leaking to the platform provider or workload owner.
Contrast depends on a custom Kubernetes RuntimeClass (contrast-cc),
-which needs to be installed in the cluster prior to the Coordinator or any confidential workloads.
-This consists of a RuntimeClass resource and a DaemonSet that performs installation on worker nodes.
-This step is only required once for each version of the runtime.
-It can be shared between Contrast deployments.
Run the generate command to generate the execution policies and add them as
-annotations to your deployment files. A manifest.json file with the reference values
-of your deployment will be created:
-
contrast generate deployment/
-
Runtime class and Initializer
The deployment YAML shipped for this demo is already configured to be used with Contrast.
-A runtime classcontrast-cc-<VERSIONHASH>
-was added to the pods to signal they should be run as Confidential Containers. During the generation process,
-the Contrast Initializer will be added as an init container to these
-workloads to facilitate the attestation and certificate pulling before the actual workload is started.
Further, the deployment YAML is also configured with the Contrast service mesh.
-The configured service mesh proxy provides transparent protection for the communication between
-the different components of emojivoto.
Configure the coordinator with a manifest. It might take up to a few minutes
-for the load balancer to be created and the Coordinator being available.
-
coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') echo"The user API of your Contrast Coordinator is available at $coordinator:1313" contrast set-c"${coordinator}:1313" deployment/
-
The CLI will use the embedded reference values to attest the Coordinator deployment
-during the TLS handshake. If the connection succeeds, it's ensured that the Coordinator
-deployment hasn't been tampered with.
Now that the coordinator has a manifest set, which defines the emojivoto deployment as an allowed workload,
-we can deploy the application:
-
kubectl apply -f deployment/
-
Inter-deployment communication
The Contrast Coordinator issues mesh certificates after successfully validating workloads.
-These certificates can be used for secure inter-deployment communication. The Initializer
-sends an attestation report to the Coordinator, retrieves certificates and a private key in return
-and writes them to a volumeMount. The service mesh sidecar is configured to use the credentials
-from the volumeMount when communicating with other parts of the deployment over mTLS.
-The public facing frontend for voting uses the mesh certificate without client authentication.
As voters, we want to verify the fairness and confidentiality of the deployment before
-deciding to vote. Regardless of the scale of our distributed deployment, Contrast only
-needs a single remote attestation step to verify the deployment. By doing remote attestation
-of the Coordinator, we transitively verify those systems the Coordinator has already attested
-or will attest in the future. Successful verification of the Coordinator means that
-we can be sure it will enforce the configured manifest.
A potential voter can verify the Contrast deployment using the verify
-command:
-
contrast verify -c"${coordinator}:1313"
-
The CLI will attest the Coordinator using embedded reference values. If the command succeeds,
-the Coordinator deployment was successfully verified to be running in the expected Confidential
-Computing environment with the expected code version. The Coordinator will then return its
-configuration over the established TLS channel. The CLI will store this information, namely the root
-certificate of the mesh (mesh-ca.pem) and the history of manifests, into the verify/ directory.
-In addition, the policies referenced in the manifest history are also written into the same directory.
In the next step, the Coordinator configuration that was written by the verify command needs to be audited.
-A potential voter should inspect the manifest and the referenced policies. They could delegate
-this task to an entity they trust.
After ensuring the configuration of the Coordinator fits the expectation, you can securely connect
-to the workloads using the Coordinator's mesh-ca.pem as a trusted CA certificate.
-
To access the web frontend, expose the service on a public IP address via a LoadBalancer service:
-
frontendIP=$(kubectl get svc web-svc -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') echo"Frontend is available at https://$frontendIP, you can visit it in your browser."
-
Using openssl, the certificate of the service can be validated with the mesh-ca.pem:
By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed
-via load balancer IP in this demo. Tools like curl check the certificate for IP entries in the subject alternative name (SAN) field.
-Validation fails since the certificate contains no IP entries as a SAN.
-For example, a connection attempt using the curl and the mesh CA certificate with throw the following error:
-
$ curl--cacert ./verify/mesh-ca.pem "https://${frontendIP}:443" curl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34'
The Policies section of the manifest maps policy hashes to a list of SANs. To enable certificate verification
-of the web frontend with tools like curl, edit the policy with your favorite editor and add the frontendIP to
-the list that already contains the "web" DNS entry:
Next, set the changed manifest at the coordinator with:
-
contrast set-c"${coordinator}:1313" deployment/
-
The Contrast Coordinator will rotate the mesh ca certificate on the manifest update. Workload certificates issued
-after the manifest update are thus issued by another certificate authority and services receiving the new CA certificate chain
-won't trust parts of the deployment that got their certificate issued before the update. This way, Contrast ensures
-that parts of the deployment that received a security update won't be infected by parts of the deployment at an older
-patch level that may have been compromised. The mesh-ca.pem is updated with the new CA certificate chain.
The Coordinator has the new manifest set, but the different containers of the app are still
-using the older certificate authority. The Contrast Initializer terminates after the initial attestation
-flow and won't pull new certificates on manifest updates.
After the update has been rolled out, connecting to the frontend using curl will successfully validate
-the service certificate and return the HTML document of the voting site:
Platform support: At present, Contrast is exclusively available on Azure AKS, supported by the Confidential Container preview for AKS. Expansion to other cloud platforms is planned, pending the availability of necessary infrastructure enhancements.
-
Bare-metal support: Support for running Contrast on bare-metal Kubernetes will be available soon for AMD SEV and Intel TDX.
Resource limits: There is an existing bug on AKS where container memory limits are incorrectly applied. The current workaround involves using only memory requests instead of limits.
Coverage: While the enforcement of workload policies generally functions well, there are scenarios not yet fully covered. It's crucial to review deployments specifically for these edge cases.
-
Order of events: The current policy evaluation mechanism on API requests isn't stateful, so it can't ensure a prescribed order of events. Consequently, there's no guaranteed enforcement that the service mesh sidecar container runs before the workload container. This order ensures that all traffic between pods is securely encapsulated within TLS connections.
-
Absence of events: Policies can't ensure certain events have happened. A container, such as the service mesh sidecar, can be omitted entirely. Environment variables may be missing.
-
Volume integrity checks: While persistent volumes aren't supported yet, integrity checks don't currently cover other objects such as ConfigMaps and Secrets.
-
-
warning
The policy limitations, in particular the missing guarantee that our service mesh sidecar has been started before the workload container affects the service mesh implementation of Contrast. Currently, this requires inspecting the iptables rules on startup or terminating TLS connections in the workload directly.
CLI availability: The CLI tool is currently only available for Linux. This limitation arises because certain upstream dependencies haven't yet been ported to other platforms.
CoCo on AKS is currently in preview. An extension for the az CLI is needed to create such a cluster.
-Add the extension with the following commands:
-
az extension add\ --name aks-preview \ --allow-preview true az extension update \ --name aks-preview \ --allow-preview true
-
Then register the required feature flags in your subscription to allow access to the public preview:
-
az feature register \ --namespace"Microsoft.ContainerService"\ --name"KataCcIsolationPreview"
-
The registration can take a few minutes. The status of the operation can be checked with the following
-command, which should show the registration state as Registered:
-
az feature show \ --namespace"Microsoft.ContainerService"\ --name"KataCcIsolationPreview"\ --output table
-
Afterward, refresh the registration of the ContainerService provider:
-
az provider register \ --namespace"Microsoft.ContainerService"
First, we need to create an AKS cluster. We can't directly create a CoCo-enabled cluster, so we'll need to create a
-non-CoCo cluster first, and then add a CoCo node pool, optionally replacing the non-CoCo node pool.
-
We'll first start by creating the non-CoCo cluster:
-
# Select the name for your AKS cluster azClusterName="ContrastDemo" az aks create \ --resource-group "${azResourceGroup:?}"\ --name"${azClusterName:?}"\ --kubernetes-version 1.29\ --os-sku AzureLinux \ --node-vm-size Standard_DC4as_cc_v5 \ --node-count 1\ --generate-ssh-keys
After trying out Contrast, you might want to clean up the cloud resources created in this step.
-In case you've created a new resource group, you can just delete that group with
-
az group delete \ --name"${azResourceGroup:?}"
-
Deleting the resource group will also delete the cluster and all other related resources.
-
To only cleanup the AKS cluster and node pools, run
-
az aks delete \ --resource-group "${azResourceGroup:?}"\ --name"${azClusterName:?}"
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.8, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.8
Contrast
-
Welcome to the documentation of Contrast! Contrast runs confidential container deployments on Kubernetes at scale.
-
-
Contrast is based on the Kata Containers and
-Confidential Containers projects.
-Confidential Containers are Kubernetes pods that are executed inside a confidential micro-VM and provide strong hardware-based isolation from the surrounding environment.
-This works with unmodified containers in a lift-and-shift approach.
-Contrast currently targets the CoCo preview on AKS.
-
tip
See the 📄whitepaper for more information on confidential computing.
Contrast is designed to keep all data always encrypted and to prevent access from the infrastructure layer. It removes the infrastructure provider from the trusted computing base (TCB). This includes access from datacenter employees, privileged cloud admins, own cluster administrators, and attackers coming through the infrastructure, for example, malicious co-tenants escalating their privileges.
-
Contrast integrates fluently with the existing Kubernetes workflows. It's compatible with managed Kubernetes, can be installed as a day-2 operation and imposes only minimal changes to your deployment flow.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.8, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.8
CLI telemetry
-
The Contrast CLI sends telemetry data to Edgeless Systems when you use CLI commands.
-This allows to understand how Contrast is used and to improve it.
-
The CLI sends the following data:
-
-
The CLI version
-
The CLI target OS and architecture (GOOS and GOARCH)
-
The command that was run
-
The kind of error that occurred (if any)
-
-
The CLI doesn't collect sensitive information.
-The implementation is open-source and can be reviewed.
-
IP addresses may be processed or stored for security purposes.
-
The data that the CLI collects adheres to the Edgeless Systems privacy policy.
-
You can disable telemetry by setting the environment variable DO_NOT_TRACK=1 before running the CLI.
-
-
\ No newline at end of file
diff --git a/pr-preview/pr-1071/0.8/architecture/attestation.html b/pr-preview/pr-1071/0.8/architecture/attestation.html
deleted file mode 100644
index 4eef188299..0000000000
--- a/pr-preview/pr-1071/0.8/architecture/attestation.html
+++ /dev/null
@@ -1,95 +0,0 @@
-
-
-
-
-
-Attestation in Contrast | Contrast
-
-
-
-
-
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.8, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.8
Attestation in Contrast
-
This document describes the attestation architecture of Contrast, adhering to the definitions of Remote ATtestation procedureS (RATS) in RFC 9334.
-The following gives a detailed description of Contrast's attestation architecture.
-At the end of this document, we included an FAQ that answers the most common questions regarding attestation in hindsight of the security benefits.
Contrast integrates with the RATS architecture, leveraging their definition of roles and processes including Attesters, Verifiers, and Relying Parties.
-
-
Figure 1: Conceptual attestation architecture. Taken from RFC 9334.
-
-
Attester: Assigned to entities that are responsible for creating Evidence which is then sent to a Verifier.
-
Verifier: These entities utilize the Evidence, Reference Values, and Endorsements. They assess the trustworthiness of the Attester by applying an Appraisal Policy for Evidence. Following this assessment, Verifiers generate Attestation Results for use by Relying Parties. The Appraisal Policy for Evidence may be provided by the Verifier Owner, programmed into the Verifier, or acquired through other means.
-
Relying Party: Assigned to entities that utilize Attestation Results, applying their own appraisal policies to make specific decisions, such as authorization decisions. This process is referred to as the "appraisal of Attestation Results." The Appraisal Policy for Attestation Results might be sourced from the Relying Party Owner, configured by the owner, embedded in the Relying Party, or obtained through other protocols or mechanisms.
This includes all Pods of the Contrast deployment that run inside Confidential Containers and generate cryptographic evidence reflecting their current configuration and state.
-Their evidence is rooted in the hardware measurements from the CPU and their confidential VM environment.
-The details of this evidence are given below in the section on evidence generation and appraisal.
-
-
Figure 2: Attestation flow of a confidential pod. Based on the layered attester graphic in RFC 9334.
-
Pods run in Contrast's runtime environment (B), effectively within a confidential VM.
-During launch, the CPU (A) measures the initial memory content of the confidential VM that contains Contrast's pod-VM image and generates the corresponding attestation evidence.
-The image is in IGVM format, encapsulating all information required to launch a virtual machine, including the kernel, the initramfs, and kernel cmdline.
-The kernel cmdline contains the root hash for dm-verity that ensures the integrity of the root filesystem.
-The root filesystem contains all components of the container's runtime environment including the guest agent (C).
-
In the userland, the guest agent takes care of enforcing the runtime policy of the pod.
-While the policy is passed in during the initialization procedure via the host, the evidence for the runtime policy is part of the CPU measurements.
-During the deployment the policy is annotated to the Kubernetes Pod resources.
-On AMD SEV-SNP the hash of the policy is then added to the attestation report via the HOSTDATA field by the hypervisor.
-When provided with the policy from the Kata host, the guest agent verifies that the policy's hash matches the one in the HOSTDATA field.
-
In summary a Pod's evidence is the attestation report of the CPU that provides evidence for runtime environment and the runtime policy.
The Coordinator acts as a verifier within the Contrast deployment, configured with a Manifest that defines the reference values and serves as an appraisal policy for all pods in the deployment.
-It also pulls endorsements from hardware vendors to verify the hardware claims.
-The Coordinator operates within the cluster as a confidential container and provides similar evidence as any other Pod when it acts as an attester.
-In RATS terminology, the Coordinator's dual role is defined as a lead attester in a composite device which spans the entire deployment: Coordinator and the workload pods.
-It collects evidence from other attesters and conveys it to a verifier, generating evidence about the layout of the whole composite device based on the Manifest as the appraisal policy.
-
-
Figure 3: Contrast deployment as a composite device. Based on the composite device in RFC 9334.
-
The CLI serves as the verifier for the Coordinator and the entire Contrast deployment, containing the reference values for the Coordinator and the endorsements from hardware vendors.
-These reference values are built into the CLI during our release process and can be reproduced offline via reproducible builds.
A relying party in the Contrast scenario could be, for example, the data owner that interacts with the application.
-The relying party can use the CLI to obtain the attestation results and Contrast's CA certificates bound to these results.
-The CA certificates can then be used by the relying party to authenticate the application, for example through TLS connections.
In Contrast, attestation evidence revolves around a hardware-generated attestation report, which contains several critical pieces of information:
-
-
The hardware attestation report: This report includes details such as the chip identifier, platform information, microcode versions, and comprehensive guest measurements. The entire report is signed by the CPU's private key, ensuring the authenticity and integrity of the data provided.
-
The launch measurements: Included within the hardware attestation report, this is a digest generated by the CPU that represents a hash of all initial guest memory pages. This includes essential components like the kernel, initramfs, and the kernel command line. Notably, it incorporates the root filesystem's dm-verity root hash, verifying the integrity of the root filesystem.
-
The runtime policy hash: Also part of the hardware attestation report, this field contains the hash of the Rego policy which dictates all expected API commands and their values from the host to the Kata guest agent. It encompasses crucial settings such as dm-verity hashes for the container image layers, environment variables, and mount points.
The appraisal of this evidence in Contrast is governed by two main components:
-
-
The Manifest: A JSON file used by the Coordinator to align with reference values. It sets the expectations for runtime policy hashes for each pod and includes what should be reported in the hardware attestation report for each component of the deployment.
-
The CLI's appraisal policy: This policy encompasses expected values of the Coordinator’s guest measurements and its runtime policy. It's embedded into the CLI during the build process and ensures that any discrepancy between the built-in values and those reported by the hardware attestation can be identified and addressed. The integrity of this policy is safeguardable through reproducible builds, allowing verification against the source code reference.
-
-
Frequently asked questions about attestation in Contrast
-
What's the purpose of remote attestation in Contrast?
-
Remote attestation in Contrast ensures that software runs within a secure, isolated confidential computing environment.
-This process certifies that the memory is encrypted and confirms the integrity and authenticity of the software running within the deployment.
-By validating the runtime environment and the policies enforced on it, Contrast ensures that the system operates in a trustworthy state and hasn't been tampered with.
-
How does Contrast ensure the security of the attestation process?
-
Contrast leverages hardware-rooted security features such as AMD SEV-SNP to generate cryptographic evidence of a pod’s current state and configuration.
-This evidence is checked against pre-defined appraisal policies to guarantee that only verified and authorized pods are part of a Contrast deployment.
Attestation confirms the integrity of the runtime environment and the identity of the workloads.
-It plays a critical role in preventing unauthorized changes and detecting potential modifications at runtime.
-The attestation provides integrity and authenticity guarantees, enabling relying parties—such as workload operators or data owners—to confirm the effective protection against potential threats, including malicious cloud insiders, co-tenants, or compromised workload operators.
-More details on the specific security benefits can be found here.
-
How can you verify the authenticity of attestation results?
-
Attestation results in Contrast are tied to cryptographic proofs generated and signed by the hardware itself.
-These proofs are then verified using public keys from trusted hardware vendors, ensuring that the results aren't only accurate but also resistant to tampering.
-For further authenticity verification, all of Contrast's code is reproducibly built, and the attestation evidence can be verified locally from the source code.
-
How are attestation results used by relying parties?
-
Relying parties use attestation results to make informed security decisions, such as allowing access to sensitive data or resources only if the attestation verifies the system's integrity.
-Thereafter, the use of Contrast's CA certificates in TLS connections provides a practical approach to communicate securely with the application.
In summary, Contrast's attestation strategy adheres to the RATS guidelines and consists of robust verification mechanisms that ensure each component of the deployment is secure and trustworthy.
-This comprehensive approach allows Contrast to provide a high level of security assurance to its users.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.8, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.8
Certificate authority
-
The Coordinator acts as a certificate authority (CA) for the workloads
-defined in the manifest.
-After a workload pod's attestation has been verified by the Coordinator,
-it receives a mesh certificate and the mesh CA certificate.
-The mesh certificate can be used for example in a TLS connection as the server or
-client certificate to proof to the other party that the workload has been
-verified by the Coordinator. The other party can verify the mesh certificate
-with the mesh CA certificate. While the certificates can be used by the workload
-developer in different ways, they're automatically used in Contrast's service
-mesh to establish mTLS connections between workloads in the same deployment.
The Coordinator establishes a public key infrastructure (PKI) for all workloads
-contained in the manifest. The Coordinator holds three certificates: the root CA
-certificate, the intermediate CA certificate, and the mesh CA certificate.
-The root CA certificate is a long-lasting certificate and its private key signs
-the intermediate CA certificate. The intermediate CA certificate and the mesh CA
-certificate share the same private key. This intermediate private key is used
-to sign the mesh certificates. Moreover, the intermediate private key and
-therefore the intermediate CA certificate and the mesh CA certificate are
-rotated when setting a new manifest.
Depending on the configuration of the first manifest, it allows the workload
-owner to update the manifest and, therefore, the deployment.
-Workload owners and data owners can be mutually untrusted parties.
-To protect against the workload owner silently introducing malicious containers,
-the Coordinator rotates the intermediate private key every time the manifest is
-updated and, therefore, the
-intermediate CA certificate and mesh CA certificate. If the user doesn't
-trust the workload owner, they use the mesh CA certificate obtained when they
-verified the Coordinator and the manifest. This ensures that the user only
-connects to workloads defined in the manifest they verified since only those
-workloads' certificates are signed with this intermediate private key.
-
Similarly, the service mesh also uses the mesh CA certificate obtained when the
-workload was started, so the workload only trusts endpoints that have been
-verified by the Coordinator based on the same manifest. Consequently, a
-manifest update requires a fresh rollout of the services in the service mesh.
The root CA certificate is returned when verifying the Coordinator.
-The data owner can use it to verify the mesh certificates of the workloads.
-This should only be used if the data owner trusts all future updates to the
-manifest and workloads. This is, for instance, the case when the workload owner is
-the same entity as the data owner.
-
The mesh CA certificate is returned when verifying the Coordinator.
-The data owner can use it to verify the mesh certificates of the workloads.
-This certificate is bound to the manifest set when the Coordinator is verified.
-If the manifest is updated, the mesh CA certificate changes.
-New workloads will receive mesh certificates signed by the new mesh CA certificate.
-The Coordinator with the new manifest needs to be verified to retrieve the new mesh CA certificate.
-The service mesh also uses the mesh CA certificate to verify the mesh certificates.
-
The intermediate CA certificate links the root CA certificate to the
-mesh certificate so that the mesh certificate can be verified with the root CA
-certificate. It's part of the certificate chain handed out by
-endpoints in the service mesh.
-
The mesh certificate is part of the certificate chain handed out by
-endpoints in the service mesh. During the startup of a pod, the Initializer
-requests a certificate from the Coordinator. This mesh certificate will be returned if the Coordinator successfully
-verifies the workload. The mesh certificate
-contains X.509 extensions with information from the workloads attestation
-document.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.8, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.8
Observability
-
The Contrast Coordinator can expose metrics in the
-Prometheus format. These can be monitored to quickly
-identify problems in the gRPC layer or attestation errors. Prometheus metrics
-are numerical values associated with a name and additional key/values pairs,
-called labels.
The metrics can be accessed at the Coordinator pod at the port specified in the
-CONTRAST_METRICS_PORT environment variable under the /metrics endpoint. By
-default, this environment variable isn't specified, hence no metrics will be
-exposed.
-
The Coordinator exports gRPC metrics under the prefix contrast_grpc_server_.
-These metrics are labeled with the gRPC service name and method name.
-Metrics of interest include contrast_grpc_server_handled_total, which counts
-the number of requests by return code, and
-contrast_grpc_server_handling_seconds_bucket, which produces a histogram of
-request latency.
The meshapi.MeshAPI service records metrics for the method NewMeshCert, which
-gets called by the Initializer when starting a
-new workload. Attestation failures from workloads to the Coordinator can be
-tracked with the counter contrast_meshapi_attestation_failures.
-
The current manifest generation is exposed as a
-gauge with the metric
-name contrast_coordinator_manifest_generation. If no manifest is set at the
-Coordinator, this counter will be zero.
The Service Mesh can be configured to expose
-metrics via its Envoy admin
-interface. Be
-aware that the admin interface can expose private information and allows
-destructive operations to be performed. To enable the admin interface for the
-Service Mesh, set the annotation
-contrast.edgeless.systems/servicemesh-admin-interface-port in the configuration
-of your workload. If this annotation is set, the admin interface will be started
-on this port.
-
To access the admin interface, the ingress settings of the Service Mesh have to
-be configured to allow access to the specified port (see Configuring the
-Proxy). All metrics will be
-exposed under the /stats endpoint. Metrics in Prometheus format can be scraped
-from the /stats/prometheus endpoint.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.8, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.8
Secrets & recovery
-
When the Coordinator is configured with the initial manifest, it generates a random secret seed.
-From this seed, it uses an HKDF to derive the CA root key and a signing key for the manifest history.
-This derivation is deterministic, so the seed can be used to bring any Coordinator to this Coordinator's state.
-
The secret seed is returned to the user on the first call to contrast set, encrypted with the user's public seed share owner key.
-If no seed share owner key is provided, a key is generated and stored in the working directory.
The Coordinator runs as a StatefulSet with a dynamically provisioned persistent volume.
-This volume stores the manifest history and the associated runtime policies.
-The manifest isn't considered sensitive information, because it needs to be passed to the untrusted infrastructure in order to start workloads.
-However, the Coordinator must ensure its integrity and that the persisted data corresponds to the manifests set by authorized users.
-Thus, the manifest is stored in plain text, but is signed with a private key derived from the Coordinator's secret seed.
When a Coordinator starts up, it doesn't have access to the signing secret and can thus not verify the integrity of the persisted manifests.
-It needs to be provided with the secret seed, from which it can derive the signing key that verifies the signatures.
-This procedure is called recovery and is initiated by the workload owner.
-The CLI decrypts the secret seed using the private seed share owner key, verifies the Coordinator and sends the seed through the Recover method.
-The Coordinator recovers its key material and verifies the manifest history signature.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.8, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.8
Confidential Containers
-
Contrast uses some building blocks from Confidential Containers (CoCo), a CNCF Sandbox project that aims to standardize confidential computing at the pod level.
-The project is under active development and many of the high-level features are still in flux.
-Contrast uses the more stable core primitive provided by CoCo: its Kubernetes runtime.
Kubernetes can be extended to use more than one container runtime with RuntimeClass objects.
-The Container Runtime Interface (CRI) implementation, for example containerd, dispatches pod management API calls to the appropriate RuntimeClass.
-RuntimeClass implementations are usually based on an OCI runtime, such as runc, runsc or crun.
-In CoCo's case, the runtime is Kata Containers with added confidential computing capabilities.
Kata Containers is an OCI runtime that runs pods in VMs.
-The pod VM spawns an agent process that accepts management commands from the Kata runtime running on the host.
-There are two options for creating pod VMs: local to the Kubernetes node, or remote VMs created with cloud provider APIs.
-Using local VMs requires either bare-metal servers or VMs with support for nested virtualization.
-Local VMs communicate with the host over a virtual socket.
-For remote VMs, host-to-agent communication is tunnelled through the cloud provider's network.
-
Kata Containers was originally designed to isolate the guest from the host, but it can also run pods in confidential VMs (CVMs) to shield pods from their underlying infrastructure.
-In confidential mode, the guest agent is configured with an Open Policy Agent (OPA) policy to authorize API calls from the host.
-This policy also contains checksums for the expected container images.
-It's derived from Kubernetes resource definitions and its checksum is included in the attestation report.
Azure Kubernetes Service (AKS) provides CoCo-enabled node pools as a preview offering.
-These node pools leverage Azure VM types capable of nested virtualization (CVM-in-VM) and the CoCo stack is pre-installed.
-Contrast can be deployed directly into a CoCo-enabled AKS cluster.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.8, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.8
Product features
-
Contrast simplifies the deployment and management of Confidential Containers, offering optimal data security for your workloads while integrating seamlessly with your existing Kubernetes environment.
-
From a security perspective, Contrast employs the Confidential Containers concept and provides security benefits that go beyond individual containers, shielding your entire deployment from the underlying infrastructure.
-
From an operational perspective, Contrast provides the following key features:
-
-
-
Managed Kubernetes compatibility: Initially compatible with Azure Kubernetes Service (AKS), Contrast is designed to support additional platforms such as AWS EKS and Google Cloud GKE as they begin to accommodate confidential containers.
-
-
-
Lightweight installation: Contrast can be integrated as a day-2 operation within existing clusters, adding minimal components to your setup. This facilitates straightforward deployments using your existing YAML configurations, Helm charts, or Kustomization, enabling native Kubernetes orchestration of your applications.
-
-
-
Remote attestation: Contrast generates a concise attestation statement that verifies the identity, authenticity, and integrity of your deployment both internally and to external parties. This architecture ensures that updates or scaling of the application don't compromise the attestation’s validity.
-
-
-
Service mesh: Contrast securely manages a Public Key Infrastructure (PKI) for your deployments, issues workload-specific certificates, and establishes transparent mutual TLS (mTLS) connections across pods. This is done by harnessing the envoy proxy to ensure secure communications within your Kubernetes cluster.
-
-
-
-
\ No newline at end of file
diff --git a/pr-preview/pr-1071/0.8/basics/security-benefits.html b/pr-preview/pr-1071/0.8/basics/security-benefits.html
deleted file mode 100644
index 09af9e1fb7..0000000000
--- a/pr-preview/pr-1071/0.8/basics/security-benefits.html
+++ /dev/null
@@ -1,116 +0,0 @@
-
-
-
-
-
-Contrast security overview | Contrast
-
-
-
-
-
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.8, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.8
Contrast security overview
-
This document outlines the security measures of Contrast and its capability to counter various threats.
-Contrast is designed to shield entire Kubernetes deployments from the infrastructure, enabling entities to manage sensitive information (such as regulated or personally identifiable information (PII)) in the public cloud, while maintaining data confidentiality and ownership.
-
Contrast is applicable in situations where establishing trust with the workload operator or the underlying infrastructure is challenging.
-This is particularly beneficial for regulated sectors looking to transition sensitive activities to the cloud, without sacrificing security or compliance.
-It allows for cloud adoption by maintaining a hardware-based separation from the cloud service provider.
Leveraging Confidential Computing technology, Contrast provides three defining security properties:
-
-
Encryption of data in use: Contrast ensures that all data processed in memory is encrypted, making it inaccessible to unauthorized users or systems, even if they have physical access to the hardware.
-
Workload isolation: Each pod runs in its isolated runtime environment, preventing any cross-contamination between workloads, which is critical for multi-tenant infrastructures.
-
Remote attestation: This feature allows data owners and workload operators to verify that the Contrast environment executing their workloads hasn't been tampered with and is running in a secure, pre-approved configuration.
-
-
The runtime encryption is transparently provided by the confidential computing hardware during the workload's lifetime.
-The workload isolation and remote attestation involves two phases:
-
-
An attestation process detects modifications to the workload image or its runtime environment during the initialization. This protects the workload's integrity pre-attestation.
-
A protected runtime environment and a policy mechanism prevents the platform operator from accessing or compromising the instance at runtime. This protects a workload's integrity and confidentiality post-attestation.
-
-
For more details on confidential computing see our whitepaper.
-The attestation architecture describes Contrast's attestation process and the resulting chain of trust in detail.
Contrast uses the Kubernetes runtime of the Confidential Containers project.
-Confidential Containers significantly decrease the size of the trusted computing base (TCB) of a Kubernetes deployment, by isolating each pod within its own confidential micro-VM environment.
-The TCB is the totality of elements in a computing environment that must be trusted not to be compromised.
-A smaller TCB results in a smaller attack surface. The following diagram shows how Confidential Containers remove the cloud & datacenter infrastructure and the physical hosts, including the hypervisor, the host OS, the Kubernetes control plane, and other components, from the TCB (red).
-In the confidential context, depicted in green, only the workload containers along with their confidential micro-VM environment are included within the TCB.
-Their integrity is verifiable through remote attestation.
-
Contrast uses hardware-based mechanisms, specifically leveraging CPU features, such as AMD SEV or Intel TDX, to provide the isolation of the workload.
-This implies that both the CPU and its microcode are integral components of the TCB.
-However, it should be noted that the CPU microcode aspects aren't depicted in the accompanying graphic.
-
-
Contrast adds the following components to a deployment that become part of the TCB.
-The components that are part of the TCB are:
-
-
The workload containers: Container images that run the actual application.
The runtime policies: Policies that enforce the runtime environments for the workload containers during their lifetime.
-
The manifest: A manifest file defining the reference values of an entire confidential deployment. It contains the policy hashes for all pods of the deployment and the expected hardware reference values for the Confidential Container runtime.
-
The Coordinator: An attestation service that runs in a Confidential Container in the Kubernetes cluster. The Coordinator is configured with the manifest. User-facing, you can verify this service and the effective manifest using remote attestation, providing you with a concise attestation for the entire deployment. Cluster-facing, it verifies all pods and their policies based on remote attestation procedures and the manifest.
In a Contrast deployment, there are three parties:
-
-
-
The container image provider, who creates the container images that represent the application that has access to the protected data.
-
-
-
The workload operator, who runs the workload in a Kubernetes cluster. The operator typically has full administrative privileges to the deployment. The operator can manage cluster resources such as nodes, volumes, and networking rules, and the operator can interact with any Kubernetes or underlying cloud API.
-
-
-
The data owner, who owns the protected data. A data owner can verify the deployment using the Coordinator attestation service. The verification includes the identity, integrity, and confidentiality of the workloads, the runtime environment and the access permissions.
-
-
-
Contrast supports a trust model where the container image provider, workload operator, and data owner are separate, mutually distrusting parties.
-
The following diagram shows the system components and parties.
Contrast is designed to defend against five possible attacks:
-
-
A malicious cloud insider: malicious employees or third-party contractors of cloud service providers (CSPs) potentially have full access to various layers of the cloud infrastructure. That goes from the physical datacenter up to the hypervisor and Kubernetes layer. For example, they can access the physical memory of the machines, modify the hypervisor, modify disk contents, intercept network communications, and attempt to compromise the confidential container at runtime. A malicious insider can expand the attack surface or restrict the runtime environment. For example, a malicious operator can add a storage device to introduce new attack vectors. As another example, a malicious operator can constrain resources such as limiting a guest's memory size, changing its disk space, or changing firewall rules.
-
A malicious cloud co-tenant: malicious cloud user ("hackers") may break out of their tenancy and access other tenants' data. Advanced attackers may even be able to establish a permanent foothold within the infrastructure and access data over a longer period. The threats are analogous to the cloud insider access scenario, without the physical access.
-
A malicious workload operator: malicious workload operators, for example Kubernetes administrators, have full access to the workload deployment and the underlying Kubernetes platform. The threats are analogously to the cloud insider access scenario, with access to everything that's above the hypervisor level.
-
A malicious attestation client: this attacker connects to the attestation service and sends malformed request.
-
A malicious container image provider: a malicious container image provider has full control over the application development itself. This attacker might release a malicious version of the workload containing harmful operations.
Contrast shields a workload from the aforementioned threats with three main components:
-
-
The runtime environment safeguards against the physical memory and disk attack surface.
-
The runtime policies safeguard against the Kubernetes control plane and container runtime attack surface.
-
The service mesh safeguards against the network attack surface.
-
-
The following tables describe concrete threats and how they're mitigated in Contrast grouped by these categories:
-
-
Attacks on the confidential container environment
-
Attacks on the attestation service
-
Attacks on workloads
-
-
Attacks on the confidential container environment
-
This table describes potential threats and mitigation strategies related to the confidential container environment.
-
Threat
Mitigation
Mitigation implementation
An attacker intercepts the network connection of the launcher or image repository.
An attacker can change the image URL and control the workload binary. However these actions are reflected in the attestation report. The image repository isn't controlled using an access list, therefore the image is assumed to be viewable by everyone. You must ensure that the workload container image doesn't contain any secrets.
An attacker modifies a container's runtime environment configuration in the Kubernetes control plane.
The attestation process and the runtime policies detects unsafe configurations that load non-authentic images or perform any other modification to the expected runtime environment.
This table describes potential threats and mitigation strategies to the attestation service.
-
Threat
Mitigation
Mitigation implementation
An attacker intercepts the Coordinator deployment and modifies the image or hijacks the runtime environment.
This threat is mitigated by having an attestation procedure and attested, encrypted TLS connections to the Coordinator. The attestation evidence for the Coordinator image is distributed with our releases, protected by supply chain security, and fully reproducible.
An attacker intercepts the network connection between the workload and the Coordinator and reads secret keys from the wire.
This threat is mitigated by having an attested, encrypted TLS connection. This connection helps protect the secrets from passive eavesdropping. The attacker can't create valid workload certificates that would be accepted in Contrast's service mesh. An attacker can't impersonate a valid workload container because the container's identity is guaranteed by the attestation protocol.
Within the network between your workload and the Coordinator.
An attacker exploits parsing discrepancies, which leads to undetected changes in the attestation process.
This risk is mitigated by having a parsing engine written in memory-safe Go that's tested against the attestation specification of the hardware vendor. The runtime policies are available as an attestation artifact for further inspection and audits to verify their effectiveness.
An attacker reads or modifies data written to disk via persistent volumes.
Currently, persistent volumes aren't supported in Contrast. In the future, this threat is mitigated by encrypted and integrity-protected volume mounts.
An attacker publishes a new image version containing malicious code.
The attestation process and the runtime policies require a data owner to accept a specific version of the workload and any update to the workload needs to be explicitly acknowledged.
The following table describes three example use cases and how they map to the defined threat model in this document:
-
Use Case
Example Scenario
Migrate sensitive workloads to the cloud
TechSolve Inc., a software development firm, aimed to enhance its defense-in-depth strategy for its cloud-based development environment, especially for projects involving proprietary algorithms and client data. TechSolve acts as the image provider, workload operator, and data owner, combining all three personas in this scenario. In our attestation terminology, they're the workload operator and relying party in one entity. Their threat model includes a malicious cloud insider and cloud co-tenant.
Make your SaaS more trustworthy
SaaSProviderX, a company offering cloud-based project management tools, sought to enhance its platform's trustworthiness amidst growing concerns about data breaches and privacy. Here, the relying party is the SaaS customer as the data owner. The goal is to achieve a form of operator exclusion and only allow selective operations on the deployment. Hence, their threat model includes a malicious workload operator.
Simplify regulatory compliance
HealthSecure Inc. has been managing a significant volume of sensitive patient data on-premises. With the increasing demand for advanced data analytics and the need for scalable infrastructure, the firm decides to migrate its data analytics operations to the cloud. However, the primary concern is maintaining the confidentiality and security of patient data during and after the migration, in compliance with healthcare regulations. In this compliance scenario, the regulator serves as an additional relying party. HealthSecure must implement a mechanism that ensures the isolation of patient data can be verifiably guaranteed to the regulator.
-
In each scenario, Contrast ensures exclusive data access and processing capabilities are confined to the designated workloads. It achieves this by effectively isolating the workload from the infrastructure and other components of the stack. Data owners are granted the capability to audit and approve the deployment environment before submitting their data, ensuring a secure handover. Meanwhile, workload operators are equipped to manage and operate the application seamlessly, without requiring direct access to either the workload or its associated data.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.8, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.8
Components
-
Contrast is composed of several key components that work together to manage and scale confidential containers effectively within Kubernetes environments.
-This page provides an overview of the core components essential for deploying and managing Contrast.
The CLI serves as the primary management tool for Contrast deployments. It's designed to streamline the configuration and operation of Contrast in several ways:
-
-
Installation and setup: The CLI facilitates the installation of the necessary runtime classes required for Contrast to function within a Kubernetes cluster.
-
Policy generation: It allows users to generate runtime policies, adapt the deployment files, and generate the Contrast manifest.
-
Configuration management: Through the CLI, users can configure the Contrast Coordinator with the generated manifest.
-
Verification and attestation: The CLI provides tools to verify the integrity and authenticity of the Coordinator and the entire deployment via remote attestation.
The Contrast Coordinator is the central remote attestation service of a Contrast deployment.
-It runs inside a confidential container inside your cluster.
-The Coordinator can be verified via remote attestation, and a Contrast deployment is self-contained.
-The Coordinator is configured with a manifest, a configuration file containing the reference attestation values of your deployment.
-It ensures that your deployment's topology adheres to your specified manifest by verifying the identity and integrity of all confidential pods inside the deployment.
-The Coordinator is also a certificate authority and issues certificates for your workload pods during the attestation procedure.
-Your workload pods can establish secure, encrypted communication channels between themselves based on these certificates using the Coordinator as the root CA.
-As your app needs to scale, the Coordinator transparently verifies new instances and then provides them with their certificates to join the deployment.
-
To verify your deployment, the Coordinator's remote attestation statement combined with the manifest offers a concise single remote attestation statement for your entire deployment.
-A third party can use this to verify the integrity of your distributed app, making it easy to assure stakeholders of your app's identity and integrity.
The manifest is the configuration file for the Coordinator, defining your confidential deployment.
-It's automatically generated from your deployment by the Contrast CLI.
-It currently consists of the following parts:
-
-
Policies: The identities of your Pods, represented by the hashes of their respective runtime policies.
-
Reference Values: The remote attestation reference values for the Kata confidential micro-VM that's the runtime environment of your Pods.
-
WorkloadOwnerKeyDigest: The workload owner's public key digest. Used for authenticating subsequent manifest updates.
Runtime Policies are a mechanism to enable the use of the untrusted Kubernetes API for orchestration while ensuring the confidentiality and integrity of your confidential containers.
-They allow us to enforce the integrity of your containers' runtime environment as defined in your deployment files.
-The runtime policy mechanism is based on the Open Policy Agent (OPA) and translates the Kubernetes deployment YAML into the Rego policy language of OPA.
-The Kata Agent inside the confidential micro-VM then enforces the policy by only acting on permitted requests.
-The Contrast CLI provides the tooling for automatically translating Kubernetes deployment YAML into the Rego policy language of OPA.
Contrast provides an Initializer that handles the remote attestation on the workload side transparently and
-fetches the workload certificate. The Initializer runs as an init container before your workload is started.
-It provides the workload container and the service mesh sidecar with the workload certificates.
Contrast depends on a Kubernetes runtime class, which is installed
-by the node-installer DaemonSet.
-This runtime consists of a containerd runtime plugin, a virtual machine manager (cloud-hypervisor), and a podvm image (IGVM and rootFS).
-The installer takes care of provisioning every node in the cluster so it provides this runtime class.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.8, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.8
Policies
-
Kata runtime policies are an integral part of the Confidential Containers preview on AKS.
-They prescribe how a Kubernetes pod must be configured to launch successfully in a confidential VM.
-In Contrast, policies act as a workload identifier: only pods with a policy registered in the manifest receive workload certificates and may participate in the confidential deployment.
-Verification of the Contrast Coordinator and its manifest transitively guarantees that all workloads meet the owner's expectations.
The Kata agent running in the confidential micro-VM exposes an RPC service AgentService to the Kata runtime.
-This service handles potentially untrustworthy requests from outside the TCB, which need to be checked against a policy.
-
Kata runtime policies are written in the policy language Rego.
-They specify what AgentService methods can be called, and the permissible parameters for each call.
-
Policies consist of two parts: a list of rules and a data section.
-While the list of rules is static, the data section is populated with information from the PodSpec and other sources.
Runtime policies are programmatically generated from Kubernetes manifests by the Contrast CLI.
-The generate subcommand inspects pod definitions and derives rules for validating the pod at the Kata agent.
-There are two important integrity checks: container image checksums and OCI runtime parameters.
-
For each of the container images used in a pod, the CLI downloads all image layers and produces a cryptographic dm-verity checksum.
-These checksums are the basis for the policy's storage data.
-
The CLI combines information from the PodSpec, ConfigMaps, and Secrets in the provided Kubernetes manifests to derive a permissible set of command-line arguments and environment variables.
-These constitute the policy's OCI data.
The generated policy document is annotated to the pod definitions in Base64 encoding.
-This annotation is propagated to the Kata runtime, which calculates the SHA256 checksum for the policy and uses that as SNP HOSTDATA for the confidential micro-VM.
-
After the VM launched, the runtime calls the agent's SetPolicy method with the full policy document.
-If the policy doesn't match the checksum in HOSTDATA, the agent rejects the policy.
-Otherwise, it applies the policy to all future AgentService requests.
Contrast verifies its confidential containers following these steps:
-
-
The Contrast CLI generates a policy and attaches it to the pod definition.
-
Kubernetes schedules the pod on a node with the confidential computing runtime.
-
Containerd invokes the Kata runtime to create the pod sandbox.
-
The Kata runtime starts a CVM with the policy's digest as HOSTDATA.
-
The Kata runtime sets the policy using the SetPolicy method.
-
The Kata agent verifies that the incoming policy's digest matches HOSTDATA.
-
The CLI sets a manifest in the Contrast Coordinator, including a list of permitted policies.
-
The Contrast Initializer sends an attestation report to the Contrast Coordinator, asking for a mesh certificate.
-
The Contrast Coordinator verifies that the started pod has a permitted policy hash in its HOSTDATA field.
-
-
After the last step, we know that the policy hasn't been tampered with and, thus, that the workload matches expectations and may receive mesh certificates.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.8, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.8
Contrast Runtime
-
The Contrast runtime is responsible for starting pods as confidential virtual machines.
-This works by specifying the runtime class to be used in a pod spec and by registering the runtime class with the apiserver.
-The RuntimeClass resource defines a name for referencing the class and
-a handler used by the container runtime (containerd) to identify the class.
-
apiVersion: node.k8s.io/v1 kind: RuntimeClass metadata: # This name is used by pods in the runtimeClassName field name: contrast-cc-abcdef # This name is used by the # container runtime interface implementation (containerd) handler: contrast-cc-abcdef
-
Confidential pods that are part of a Contrast deployment need to specify the
-same runtime class in the runtimeClassName field, so Kubernetes uses the
-Contrast runtime instead of the default containerd / runc handler.
-
apiVersion: v1 kind: Pod spec: runtimeClassName: contrast-cc-abcdef # ...
The runtime consists of additional software components that need to be installed
-and configured on every SEV-SNP-enabled worker node.
-This installation is performed automatically by the node-installer DaemonSet.
The handler field in the Kubernetes RuntimeClass instructs containerd not to use the default runc implementation.
-Instead, containerd invokes a custom plugin called containerd-shim-contrast-cc-v2.
-This shim is described in more detail in the upstream source repository and in the containerd documentation.
The containerd shim uses cloud-hypervisor to create a confidential virtual machine for every pod.
-This requires the cloud-hypervisor binary to be installed on every node (responsibility of the node-installer).
Contrast uses a special containerd snapshotter (tardev) to provide container images as block devices to the pod-VM. This snapshotter consists of a host component that pulls container images and a guest component (kernel module) used to mount container images.
-The tardev snapshotter uses dm-verity to protect the integrity of container images.
-Expected dm-verity container image hashes are part of Contrast runtime policies and are enforced by the kata-agent.
-This enables workload attestation by specifying the allowed container image as part of the policy. Read the chapter on policies for more information.
Every pod-VM starts with the same guest image. It consists of an IGVM file and a root filesystem.
-The IGVM file describes the initial memory contents of a pod-VM and consists of:
-
-
Linux kernel image
-
initrd
-
kernel commandline
-
-
Additionally, a root filesystem image is used that contains a read-only partition with the user space of the pod-VM and a verity partition to guarantee the integrity of the root filesystem.
-The root filesystem contains systemd as the init system, and the kata agent for managing the pod.
-
This pod-VM image isn't specific to any pod workload. Instead, container images are mounted at runtime.
The RuntimeClass resource above registers the runtime with the Kubernetes api.
-The node-level installation is carried out by the Contrast node-installer
-DaemonSet that ships with every Contrast release.
-
After deploying the installer, it performs the following steps on each node:
-
-
Install the Contrast containerd shim (containerd-shim-contrast-cc-v2)
-
Install cloud-hypervisor as the virtual machine manager (VMM)
-
Install an IGVM file for pod-VMs of this class
-
Install a read only root filesystem disk image for the pod-VMs of this class
-
Reconfigure containerd by adding a runtime plugin that corresponds to the handler field of the Kubernetes RuntimeClass
-
Restart containerd to make it aware of the new plugin
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.8, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.8
Service mesh
-
The Contrast service mesh secures the communication of the workload by automatically
-wrapping the network traffic inside mutual TLS (mTLS) connections. The
-verification of the endpoints in the connection establishment is based on
-certificates that are part of the
-PKI of the Coordinator.
-
The service mesh can be enabled on a per-workload basis by adding a service mesh
-configuration to the workload's object annotations. During the contrast generate
-step, the service mesh is added as a sidecar
-container to
-all workloads which have a specified configuration. The service mesh container first
-sets up iptables rules based on its configuration and then starts
-Envoy for TLS origination and termination.
The service mesh container can be configured using the following object annotations:
-
-
contrast.edgeless.systems/servicemesh-ingress to configure ingress.
-
contrast.edgeless.systems/servicemesh-egress to configure egress.
-
contrast.edgeless.systems/servicemesh-admin-interface-port to configure the Envoy
-admin interface. If not specified, no admin interface will be started.
-
-
If you aren't using the automatic service mesh injection and want to configure the
-service mesh manually, set the environment variables CONTRAST_INGRESS_PROXY_CONFIG,
-CONTRAST_EGRESS_PROXY_CONFIG and CONTRAST_ADMIN_PORT in the service mesh sidecar directly.
All TCP ingress traffic is routed over Envoy by default. Since we use
-TPROXY, the destination address
-remains the same throughout the packet handling.
-
Any incoming connection is required to present a client certificate signed by the
-mesh CA certificate.
-Envoy presents a certificate chain of the mesh
-certificate of the workload and the intermediate CA certificate as the server certificate.
-
If the deployment contains workloads which should be reachable from outside the
-Service Mesh, while still handing out the certificate chain, disable client
-authentication by setting the annotation contrast.edgeless.systems/servicemesh-ingress as
-<name>#<port>#false. Separate multiple entries with ##. You can choose any
-descriptive string identifying the service on the given port for the <name> field,
-as it's only informational.
-
Disable redirection and TLS termination altogether by specifying
-<name>#<port>#true. This can be beneficial if the workload itself handles TLS
-on that port or if the information exposed on this port is non-sensitive.
-
The following example workload exposes a web service on port 8080 and metrics on
-port 7890. The web server is exposed to a 3rd party end-user which wants to
-verify the deployment, therefore it's still required that the server hands out
-it certificate chain signed by the mesh CA certificate. The metrics should be
-exposed via TCP without TLS.
Note, that changing the environment variables of the sidecar container directly will
-only have an effect if the workload isn't configured to automatically generate a
-service mesh component on contrast generate. Otherwise, the service mesh sidecar
-container will be regenerated on every invocation of the command.
To be able to route the egress traffic of the workload through Envoy, the remote
-endpoints' IP address and port must be configurable.
-
-
Choose an IP address inside the 127.0.0.0/8 CIDR and a port not yet in use
-by the pod.
-
Configure the workload to connect to this IP address and port.
-
Set <name>#<chosen IP>:<chosen port>#<original-hostname-or-ip>:<original-port>
-as the contrast.edgeless.systems/servicemesh-egress workload annotation. Separate multiple
-entries with ##. Choose any string identifying the service on the given port as
-<name>.
-
-
This redirects the traffic over Envoy. The endpoint must present a valid
-certificate chain which must be verifiable with the
-mesh CA certificate.
-Furthermore, Envoy uses a certificate chain with the mesh certificate of the workload
-and the intermediate CA certificate as the client certificate.
-
The following example workload has no ingress connections and two egress
-connection to different microservices. The microservices are part
-of the confidential deployment. One is reachable under billing-svc:8080 and
-the other under cart-svc:8080.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.8, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.8
Workload deployment
-
The following instructions will guide you through the process of making an existing Kubernetes deployment
-confidential and deploying it together with Contrast.
-
A running CoCo-enabled cluster is required for these steps, see the setup guide on how to set it up.
Contrast depends on a custom Kubernetes RuntimeClass (contrast-cc),
-which needs to be installed in the cluster prior to the Coordinator or any confidential workloads.
-This consists of a RuntimeClass resource and a DaemonSet that performs installation on worker nodes.
-This step is only required once for each version of the runtime.
-It can be shared between Contrast deployments.
Your Kubernetes resources need some modifications to run as Confidential Containers.
-This section guides you through the process and outlines the necessary changes.
Contrast will add annotations to your Kubernetes YAML files. If you want to keep the original files
-unchanged, you can copy the files into a separate local directory.
-You can also generate files from a Helm chart or from a Kustomization.
To specify that a workload (pod, deployment, etc.) should be deployed as confidential containers,
-add runtimeClassName: contrast-cc to the pod spec (pod definition or template).
-This is a placeholder name that will be replaced by a versioned runtimeClassName when generating policies.
In the initialization process, the contrast-tls-certs shared volume is populated with X.509 certificates for your workload.
-These certificates are used by the Contrast Service Mesh, but can also be used by your application directly.
-The following tab group explains the setup for both scenarios.
-
Drop-in service mesh
Go integration
Contrast can be configured to handle TLS in a sidecar container.
-This is useful for workloads that are hard to configure with custom certificates, like Java applications.
Configuration of the sidecar depends heavily on the application.
-The following example is for an application with these properties:
-
The container has a main application at TCP port 8001, which should be TLS-wrapped and doesn't require client authentication.
-
The container has a metrics endpoint at TCP port 8080, which should be accessible in plain text.
-
All other endpoints require client authentication.
-
The app connects to a Kubernetes service backend.default:4001, which requires client authentication.
During the generate step, this configuration will be translated into a Service Mesh sidecar container which handles TLS connections automatically.
-The only change required to the app itself is to let it connect to 127.0.0.2:4001 to reach the backend service.
-You can find more detailed documentation in the Service Mesh chapter.
The mesh certificate contained in certChain.pem authenticates this workload, while the mesh CA certificate mesh-ca.pem authenticates its peers.
-Your app should turn on client authentication to ensure peers are running as confidential containers, too.
-See the Certificate Authority section for detailed information about these certificates.
The following example shows how to configure a Golang app, with error handling omitted for clarity.
Run the generate command to add the necessary components to your deployment files.
-This will add the Contrast Initializer to every workload with the specified contrast-cc runtime class
-and the Contrast Service Mesh to all workloads that have a specified configuration.
-After that, it will generate the execution policies and add them as annotations to your deployment files.
-A manifest.json with the reference values of your deployment will be created.
Please be aware that runtime policies currently have some blind spots. For example, they can't guarantee the starting order of containers. See the current limitations for more details.
-
If you don't want the Contrast Initializer to automatically be added to your
-workloads, there are two ways you can skip the Initializer injection step,
-depending on how you want to customize your deployment.
-
Command-line flag
Per-workload annotation
You can disable the Initializer injection completely by specifying the
---skip-initializer flag in the generate command.
If you want to disable the Initializer injection for a specific workload with
-the contrast-cc runtime class, you can do so by adding an annotation to the workload.
When disabling the automatic Initializer injection, you can manually add the
-Initializer as a sidecar container to your workload before generating the
-policies. Configure the workload to use the certificates written to the
-contrast-tls-certsvolumeMount.
For the next steps, we will need to connect to the Coordinator. The released Coordinator resource
-includes a LoadBalancer definition we can use.
-
coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}')
-
Port-forwarding of Confidential Containers
kubectl port-forward uses a Container Runtime Interface (CRI) method that isn't supported by the Kata shim.
-If you can't use a public load balancer, you can deploy a port-forwarder.
-The port-forwarder relays traffic from a CoCo pod and can be accessed via kubectl port-forward.
This will use the reference values from the manifest file to attest the Coordinator.
-After this step, the Coordinator will start issuing TLS certificates to the workloads. The init container
-will fetch a certificate for the workload and the workload is started.
An end user (data owner) can verify the Contrast deployment using the verify command.
-
contrast verify -c"${coordinator}:1313"
-
The CLI will attest the Coordinator using the reference values from the given manifest file. It will then write the
-service mesh root certificate and the history of manifests into the verify/ directory. In addition, the policies
-referenced in the active manifest are also written to the directory. The verification will fail if the active
-manifest at the Coordinator doesn't match the manifest passed to the CLI.
You can securely connect to the workloads using the Coordinator's mesh-ca.pem as a trusted CA certificate.
-First, expose the service on a public IP address via a LoadBalancer service:
By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed
-via load balancer IP in this demo. Tools like curl check the certificate for IP entries in the SAN field.
-Validation fails since the certificate contains no IP entries as a subject alternative name (SAN).
-For example, a connection attempt using the curl and the mesh CA certificate with throw the following error:
$ curl--cacert ./verify/mesh-ca.pem "https://${frontendIP}:443" curl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34'
-
Using openssl, the certificate of the service can be validated with the mesh-ca.pem:
If the Contrast Coordinator restarts, it enters recovery mode and waits for an operator to provide key material.
-For demonstration purposes, you can simulate this scenario by deleting the Coordinator pod.
-
kubectl delete pod -l app.kubernetes.io/name=coordinator
-
Kubernetes schedules a new pod, but that pod doesn't have access to the key material the previous pod held in memory and can't issue certificates for workloads yet.
-You can confirm this by running verify again, or you can restart a workload pod, which should stay in the initialization phase.
-However, the secret seed in your working directory is sufficient to recover the coordinator.
-
contrast recover -c"${coordinator}:1313"
-
Now that the Coordinator is recovered, all workloads should pass initialization and enter the running state.
-You can now verify the Coordinator again, which should return the same manifest you set before.
-
warning
The recovery process invalidates the mesh CA certificate:
-existing workloads won't be able to communicate with workloads newly spawned.
-All workloads should be restarted after the recovery succeeded.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.8, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.8
Confidential emoji voting
-
-
This tutorial guides you through deploying emojivoto as a
-confidential Contrast deployment and validating the deployment from a voters perspective.
-
Emojivoto is an example app allowing users to vote for different emojis and view votes
-on a leader board. It has a microservice architecture consisting of a
-web frontend (web), a gRPC backend for listing available emojis (emoji), and a backend for
-the voting and leader board logic (voting). The vote-bot simulates user traffic by submitting
-votes to the frontend.
Using a voting service, users' votes are considered highly sensitive data, as we require
-a secret ballot. Also, users are likely interested in the fairness of the ballot. For
-both requirements, we can use Confidential Computing and, specifically, workload attestation
-to prove to those interested in voting that the app is running in a protected environment
-where their votes are processed without leaking to the platform provider or workload owner.
Contrast depends on a custom Kubernetes RuntimeClass (contrast-cc),
-which needs to be installed in the cluster prior to the Coordinator or any confidential workloads.
-This consists of a RuntimeClass resource and a DaemonSet that performs installation on worker nodes.
-This step is only required once for each version of the runtime.
-It can be shared between Contrast deployments.
Run the generate command to generate the execution policies and add them as
-annotations to your deployment files. A manifest.json file with the reference values
-of your deployment will be created:
The deployment YAML shipped for this demo is already configured to be used with Contrast.
-A runtime classcontrast-cc-<VERSIONHASH>
-was added to the pods to signal they should be run as Confidential Containers. During the generation process,
-the Contrast Initializer will be added as an init container to these
-workloads to facilitate the attestation and certificate pulling before the actual workload is started.
Further, the deployment YAML is also configured with the Contrast service mesh.
-The configured service mesh proxy provides transparent protection for the communication between
-the different components of emojivoto.
Configure the coordinator with a manifest. It might take up to a few minutes
-for the load balancer to be created and the Coordinator being available.
-
coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') echo"The user API of your Contrast Coordinator is available at $coordinator:1313" contrast set-c"${coordinator}:1313" deployment/
-
The CLI will use the reference values from the manifest to attest the Coordinator deployment
-during the TLS handshake. If the connection succeeds, it's ensured that the Coordinator
-deployment hasn't been tampered with.
Now that the coordinator has a manifest set, which defines the emojivoto deployment as an allowed workload,
-we can deploy the application:
-
kubectl apply -f deployment/
-
Inter-deployment communication
The Contrast Coordinator issues mesh certificates after successfully validating workloads.
-These certificates can be used for secure inter-deployment communication. The Initializer
-sends an attestation report to the Coordinator, retrieves certificates and a private key in return
-and writes them to a volumeMount. The service mesh sidecar is configured to use the credentials
-from the volumeMount when communicating with other parts of the deployment over mTLS.
-The public facing frontend for voting uses the mesh certificate without client authentication.
As voters, we want to verify the fairness and confidentiality of the deployment before
-deciding to vote. Regardless of the scale of our distributed deployment, Contrast only
-needs a single remote attestation step to verify the deployment. By doing remote attestation
-of the Coordinator, we transitively verify those systems the Coordinator has already attested
-or will attest in the future. Successful verification of the Coordinator means that
-we can be sure it will enforce the configured manifest.
The CLI will attest the Coordinator using the reference values from a given manifest. This manifest needs
-to be communicated out of band to everyone wanting to verify the deployment, as the verify command checks
-if the currently active manifest at the Coordinator matches the manifest given to the CLI. If the command succeeds,
-the Coordinator deployment was successfully verified to be running in the expected Confidential
-Computing environment with the expected code version. The Coordinator will then return its
-configuration over the established TLS channel. The CLI will store this information, namely the root
-certificate of the mesh (mesh-ca.pem) and the history of manifests, into the verify/ directory.
-In addition, the policies referenced in the manifest history are also written into the same directory.
In the next step, the Coordinator configuration that was written by the verify command needs to be audited.
-A potential voter should inspect the manifest and the referenced policies. They could delegate
-this task to an entity they trust.
After ensuring the configuration of the Coordinator fits the expectation, you can securely connect
-to the workloads using the Coordinator's mesh-ca.pem as a trusted CA certificate.
-
To access the web frontend, expose the service on a public IP address via a LoadBalancer service:
-
frontendIP=$(kubectl get svc web-svc -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') echo"Frontend is available at https://$frontendIP, you can visit it in your browser."
-
Using openssl, the certificate of the service can be validated with the mesh-ca.pem:
By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed
-via load balancer IP in this demo. Tools like curl check the certificate for IP entries in the subject alternative name (SAN) field.
-Validation fails since the certificate contains no IP entries as a SAN.
-For example, a connection attempt using the curl and the mesh CA certificate with throw the following error:
-
$ curl--cacert ./verify/mesh-ca.pem "https://${frontendIP}:443" curl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34'
The Policies section of the manifest maps policy hashes to a list of SANs. To enable certificate verification
-of the web frontend with tools like curl, edit the policy with your favorite editor and add the frontendIP to
-the list that already contains the "web" DNS entry:
Next, set the changed manifest at the coordinator with:
-
contrast set-c"${coordinator}:1313" deployment/
-
The Contrast Coordinator will rotate the mesh ca certificate on the manifest update. Workload certificates issued
-after the manifest update are thus issued by another certificate authority and services receiving the new CA certificate chain
-won't trust parts of the deployment that got their certificate issued before the update. This way, Contrast ensures
-that parts of the deployment that received a security update won't be infected by parts of the deployment at an older
-patch level that may have been compromised. The mesh-ca.pem is updated with the new CA certificate chain.
The Coordinator has the new manifest set, but the different containers of the app are still
-using the older certificate authority. The Contrast Initializer terminates after the initial attestation
-flow and won't pull new certificates on manifest updates.
After the update has been rolled out, connecting to the frontend using curl will successfully validate
-the service certificate and return the HTML document of the voting site:
Platform support: At present, Contrast is exclusively available on Azure AKS, supported by the Confidential Container preview for AKS. Expansion to other cloud platforms is planned, pending the availability of necessary infrastructure enhancements.
-
Bare-metal support: Support for running Contrast on bare-metal Kubernetes will be available soon for AMD SEV and Intel TDX.
Persistent volumes: Contrast only supports volumes with volumeMode: Block. These block devices are provided by the untrusted environment and should be treated accordingly. We plan to provide transparent encryption on top of block devices in a future release.
Resource limits: There is an existing bug on AKS where container memory limits are incorrectly applied. The current workaround involves using only memory requests instead of limits.
Coverage: While the enforcement of workload policies generally functions well, there are scenarios not yet fully covered. It's crucial to review deployments specifically for these edge cases.
-
Order of events: The current policy evaluation mechanism on API requests isn't stateful, so it can't ensure a prescribed order of events. Consequently, there's no guaranteed enforcement that the service mesh sidecar container runs before the workload container. This order ensures that all traffic between pods is securely encapsulated within TLS connections.
-
Absence of events: Policies can't ensure certain events have happened. A container, such as the service mesh sidecar, can be omitted entirely. Environment variables may be missing.
-
Volume integrity checks: While persistent volumes aren't supported yet, integrity checks don't currently cover other objects such as ConfigMaps and Secrets.
-
-
warning
The policy limitations, in particular the missing guarantee that our service mesh sidecar has been started before the workload container affects the service mesh implementation of Contrast. Currently, this requires inspecting the iptables rules on startup or terminating TLS connections in the workload directly.
CLI availability: The CLI tool is currently only available for Linux. This limitation arises because certain upstream dependencies haven't yet been ported to other platforms.
The Contrast Coordinator is a singleton and can't be scaled to more than one instance.
-When this instance's pod is restarted, for example for node maintenance, it needs to be recovered manually.
-In a future release, we plan to support distributed Coordinator instances that can recover automatically.
CoCo on AKS is currently in preview. An extension for the az CLI is needed to create such a cluster.
-Add the extension with the following commands:
-
az extension add\ --name aks-preview \ --allow-preview true az extension update \ --name aks-preview \ --allow-preview true
-
Then register the required feature flags in your subscription to allow access to the public preview:
-
az feature register \ --namespace"Microsoft.ContainerService"\ --name"KataCcIsolationPreview"
-
The registration can take a few minutes. The status of the operation can be checked with the following
-command, which should show the registration state as Registered:
-
az feature show \ --namespace"Microsoft.ContainerService"\ --name"KataCcIsolationPreview"\ --output table
-
Afterward, refresh the registration of the ContainerService provider:
-
az provider register \ --namespace"Microsoft.ContainerService"
First, we need to create an AKS cluster. We can't directly create a CoCo-enabled cluster, so we'll need to create a
-non-CoCo cluster first, and then add a CoCo node pool, optionally replacing the non-CoCo node pool.
-
We'll first start by creating the non-CoCo cluster:
-
# Select the name for your AKS cluster azClusterName="ContrastDemo" az aks create \ --resource-group "${azResourceGroup:?}"\ --name"${azClusterName:?}"\ --kubernetes-version 1.29\ --os-sku AzureLinux \ --node-vm-size Standard_DC4as_cc_v5 \ --node-count 1\ --generate-ssh-keys
After trying out Contrast, you might want to clean up the cloud resources created in this step.
-In case you've created a new resource group, you can just delete that group with
-
az group delete \ --name"${azResourceGroup:?}"
-
Deleting the resource group will also delete the cluster and all other related resources.
-
To only cleanup the AKS cluster and node pools, run
-
az aks delete \ --resource-group "${azResourceGroup:?}"\ --name"${azClusterName:?}"
Collecting logs can be a good first step to identify problems in your
-deployment. Both the CLI and the Contrast Coordinator as well as the Initializer
-can be configured to emit additional logs.
The CLI logs can be configured with the --log-level command-line flag, which
-can be set to either debug, info, warn or error. The default is info.
-Setting this to debug can get more fine-grained information as to where the
-problem lies.
The logs from the Coordinator and the Initializer can be configured via the
-environment variables CONTRAST_LOG_LEVEL, CONTRAST_LOG_FORMAT and
-CONTRAST_LOG_SUBSYSTEMS.
-
-
CONTRAST_LOG_LEVEL can be set to one of either debug, info, warn, or
-error, similar to the CLI (defaults to info).
-
CONTRAST_LOG_FORMAT can be set to text or json, determining the output
-format (defaults to text).
-
CONTRAST_LOG_SUBSYSTEMS is a comma-seperated list of subsystems that should
-be enabled for logging, which are disabled by default. Subsystems include:
-snp-issuer, kds-getter, and snp-validator. To enable all subsystems, use
-* as the value for this environment variable.
-Warnings and error messages from subsystems get printed regardless of whether
-the subsystem is listed in the CONTRAST_LOG_SUBSYSTEMS environment variable.
-
-
To configure debug logging with all subsystems for your Coordinator, add the
-following variables to your container definition.
While the Contrast Coordinator has a policy that allows certain configurations,
-the Initializer and service mesh don't. When changing environment variables of other
-parts than the Coordinator, ensure to rerun contrast generate to update the policy.
-
To access the logs generated by the Coordinator, you can use kubectl with the
-following command:
If the Coordinator or a workload pod fails to even start, it can be helpful to
-look at the events of the pod during the startup process using the describe
-command.
LAST SEEN TYPE REASON OBJECT MESSAGE 32m Warning Failed Pod/coordinator-0 kubelet Error: failed to create containerd task: failed to create shim task: "CreateContainerRequest is blocked by policy: ...
-
A common error, as in this example, is that the container creation was blocked by the
-policy. Potential reasons are a modification of the deployment YAML without updating
-the policies afterward, or a version mismatch between Contrast components.
When generating the policies, Contrast will download the images specified in your deployment
-YAML and include their cryptographic identity. If the image tag is moved to another
-container image after the policy has been generated, the image downloaded at deploy time
-will differ from the one at generation time, and the policy enforcement won't allow the
-container to be started in the pod VM.
-
To ensure the correct image is always used, pin the container image to a fixed sha256:
A version mismatch between Contrast components can cause policy validation or attestation
-to fail. Each Contrast runtime is identifiable based on its (shortened) measurement value
-used to name the runtime class version.
-
First, analyze which runtime class is currently installed in your cluster by running
-
kubectl get runtimeclasses
-
This should give you output similar to the following one.
-
NAME HANDLER AGE contrast-cc-30bfa8706b542271ec9b7762bbb400af contrast-cc-30bfa8706b542271ec9b7762bbb400af 23d contrast-cc-4d70a6e266cca46dfa8e41d92874e638 contrast-cc-4d70a6e266cca46dfa8e41d92874e638 7d contrast-cc-b817659e094106f61bf6c178c27153ba contrast-cc-b817659e094106f61bf6c178c27153ba 2d19h contrast-cc-beee79ca916b9e5dc59602788cbfb097 contrast-cc-beee79ca916b9e5dc59602788cbfb097 121m kata-cc-isolation kata-cc 45d
-
The output shows that there are four Contrast runtime classes installed (as well as the runtime class provided
-by the AKS CoCo preview, which isn't used by Contrast).
-
Next, check if the pod that won't start has the correct runtime class configured, and the
-Coordinator uses the exact same runtime:
-
kubectl -n<namespace> get -o=jsonpath='{.spec.runtimeClassName}' pod/<pod-name> kubectl -n<namespace> get -o=jsonpath='{.spec.runtimeClassName}' pod/<coordinator-pod-name>
-
The output should list the runtime class the pod is using:
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.9, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.9
Contrast
-
Welcome to the documentation of Contrast! Contrast runs confidential container deployments on Kubernetes at scale.
-
-
Contrast is based on the Kata Containers and
-Confidential Containers projects.
-Confidential Containers are Kubernetes pods that are executed inside a confidential micro-VM and provide strong hardware-based isolation from the surrounding environment.
-This works with unmodified containers in a lift-and-shift approach.
-Contrast currently targets the CoCo preview on AKS.
-
tip
See the 📄whitepaper for more information on confidential computing.
Contrast is designed to keep all data always encrypted and to prevent access from the infrastructure layer. It removes the infrastructure provider from the trusted computing base (TCB). This includes access from datacenter employees, privileged cloud admins, own cluster administrators, and attackers coming through the infrastructure, for example, malicious co-tenants escalating their privileges.
-
Contrast integrates fluently with the existing Kubernetes workflows. It's compatible with managed Kubernetes, can be installed as a day-2 operation and imposes only minimal changes to your deployment flow.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.9, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.9
CLI telemetry
-
The Contrast CLI sends telemetry data to Edgeless Systems when you use CLI commands.
-This allows to understand how Contrast is used and to improve it.
-
The CLI sends the following data:
-
-
The CLI version
-
The CLI target OS and architecture (GOOS and GOARCH)
-
The command that was run
-
The kind of error that occurred (if any)
-
-
The CLI doesn't collect sensitive information.
-The implementation is open-source and can be reviewed.
-
IP addresses may be processed or stored for security purposes.
-
The data that the CLI collects adheres to the Edgeless Systems privacy policy.
-
You can disable telemetry by setting the environment variable DO_NOT_TRACK=1 before running the CLI.
-
-
\ No newline at end of file
diff --git a/pr-preview/pr-1071/0.9/architecture/attestation.html b/pr-preview/pr-1071/0.9/architecture/attestation.html
deleted file mode 100644
index ea59376844..0000000000
--- a/pr-preview/pr-1071/0.9/architecture/attestation.html
+++ /dev/null
@@ -1,95 +0,0 @@
-
-
-
-
-
-Attestation in Contrast | Contrast
-
-
-
-
-
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.9, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.9
Attestation in Contrast
-
This document describes the attestation architecture of Contrast, adhering to the definitions of Remote ATtestation procedureS (RATS) in RFC 9334.
-The following gives a detailed description of Contrast's attestation architecture.
-At the end of this document, we included an FAQ that answers the most common questions regarding attestation in hindsight of the security benefits.
Contrast integrates with the RATS architecture, leveraging their definition of roles and processes including Attesters, Verifiers, and Relying Parties.
-
-
Figure 1: Conceptual attestation architecture. Taken from RFC 9334.
-
-
Attester: Assigned to entities that are responsible for creating Evidence which is then sent to a Verifier.
-
Verifier: These entities utilize the Evidence, Reference Values, and Endorsements. They assess the trustworthiness of the Attester by applying an Appraisal Policy for Evidence. Following this assessment, Verifiers generate Attestation Results for use by Relying Parties. The Appraisal Policy for Evidence may be provided by the Verifier Owner, programmed into the Verifier, or acquired through other means.
-
Relying Party: Assigned to entities that utilize Attestation Results, applying their own appraisal policies to make specific decisions, such as authorization decisions. This process is referred to as the "appraisal of Attestation Results." The Appraisal Policy for Attestation Results might be sourced from the Relying Party Owner, configured by the owner, embedded in the Relying Party, or obtained through other protocols or mechanisms.
This includes all Pods of the Contrast deployment that run inside Confidential Containers and generate cryptographic evidence reflecting their current configuration and state.
-Their evidence is rooted in the hardware measurements from the CPU and their confidential VM environment.
-The details of this evidence are given below in the section on evidence generation and appraisal.
-
-
Figure 2: Attestation flow of a confidential pod. Based on the layered attester graphic in RFC 9334.
-
Pods run in Contrast's runtime environment (B), effectively within a confidential VM.
-During launch, the CPU (A) measures the initial memory content of the confidential VM that contains Contrast's pod-VM image and generates the corresponding attestation evidence.
-The image is in IGVM format, encapsulating all information required to launch a virtual machine, including the kernel, the initramfs, and kernel cmdline.
-The kernel cmdline contains the root hash for dm-verity that ensures the integrity of the root filesystem.
-The root filesystem contains all components of the container's runtime environment including the guest agent (C).
-
In the userland, the guest agent takes care of enforcing the runtime policy of the pod.
-While the policy is passed in during the initialization procedure via the host, the evidence for the runtime policy is part of the CPU measurements.
-During the deployment the policy is annotated to the Kubernetes Pod resources.
-On AMD SEV-SNP the hash of the policy is then added to the attestation report via the HOSTDATA field by the hypervisor.
-When provided with the policy from the Kata host, the guest agent verifies that the policy's hash matches the one in the HOSTDATA field.
-
In summary a Pod's evidence is the attestation report of the CPU that provides evidence for runtime environment and the runtime policy.
The Coordinator acts as a verifier within the Contrast deployment, configured with a Manifest that defines the reference values and serves as an appraisal policy for all pods in the deployment.
-It also pulls endorsements from hardware vendors to verify the hardware claims.
-The Coordinator operates within the cluster as a confidential container and provides similar evidence as any other Pod when it acts as an attester.
-In RATS terminology, the Coordinator's dual role is defined as a lead attester in a composite device which spans the entire deployment: Coordinator and the workload pods.
-It collects evidence from other attesters and conveys it to a verifier, generating evidence about the layout of the whole composite device based on the Manifest as the appraisal policy.
-
-
Figure 3: Contrast deployment as a composite device. Based on the composite device in RFC 9334.
-
The CLI serves as the verifier for the Coordinator and the entire Contrast deployment, containing the reference values for the Coordinator and the endorsements from hardware vendors.
-These reference values are built into the CLI during our release process and can be reproduced offline via reproducible builds.
A relying party in the Contrast scenario could be, for example, the data owner that interacts with the application.
-The relying party can use the CLI to obtain the attestation results and Contrast's CA certificates bound to these results.
-The CA certificates can then be used by the relying party to authenticate the application, for example through TLS connections.
In Contrast, attestation evidence revolves around a hardware-generated attestation report, which contains several critical pieces of information:
-
-
The hardware attestation report: This report includes details such as the chip identifier, platform information, microcode versions, and comprehensive guest measurements. The entire report is signed by the CPU's private key, ensuring the authenticity and integrity of the data provided.
-
The launch measurements: Included within the hardware attestation report, this is a digest generated by the CPU that represents a hash of all initial guest memory pages. This includes essential components like the kernel, initramfs, and the kernel command line. Notably, it incorporates the root filesystem's dm-verity root hash, verifying the integrity of the root filesystem.
-
The runtime policy hash: Also part of the hardware attestation report, this field contains the hash of the Rego policy which dictates all expected API commands and their values from the host to the Kata guest agent. It encompasses crucial settings such as dm-verity hashes for the container image layers, environment variables, and mount points.
The appraisal of this evidence in Contrast is governed by two main components:
-
-
The Manifest: A JSON file used by the Coordinator to align with reference values. It sets the expectations for runtime policy hashes for each pod and includes what should be reported in the hardware attestation report for each component of the deployment.
-
The CLI's appraisal policy: This policy encompasses expected values of the Coordinator’s guest measurements and its runtime policy. It's embedded into the CLI during the build process and ensures that any discrepancy between the built-in values and those reported by the hardware attestation can be identified and addressed. The integrity of this policy is safeguardable through reproducible builds, allowing verification against the source code reference.
-
-
Frequently asked questions about attestation in Contrast
-
What's the purpose of remote attestation in Contrast?
-
Remote attestation in Contrast ensures that software runs within a secure, isolated confidential computing environment.
-This process certifies that the memory is encrypted and confirms the integrity and authenticity of the software running within the deployment.
-By validating the runtime environment and the policies enforced on it, Contrast ensures that the system operates in a trustworthy state and hasn't been tampered with.
-
How does Contrast ensure the security of the attestation process?
-
Contrast leverages hardware-rooted security features such as AMD SEV-SNP to generate cryptographic evidence of a pod’s current state and configuration.
-This evidence is checked against pre-defined appraisal policies to guarantee that only verified and authorized pods are part of a Contrast deployment.
Attestation confirms the integrity of the runtime environment and the identity of the workloads.
-It plays a critical role in preventing unauthorized changes and detecting potential modifications at runtime.
-The attestation provides integrity and authenticity guarantees, enabling relying parties—such as workload operators or data owners—to confirm the effective protection against potential threats, including malicious cloud insiders, co-tenants, or compromised workload operators.
-More details on the specific security benefits can be found here.
-
How can you verify the authenticity of attestation results?
-
Attestation results in Contrast are tied to cryptographic proofs generated and signed by the hardware itself.
-These proofs are then verified using public keys from trusted hardware vendors, ensuring that the results aren't only accurate but also resistant to tampering.
-For further authenticity verification, all of Contrast's code is reproducibly built, and the attestation evidence can be verified locally from the source code.
-
How are attestation results used by relying parties?
-
Relying parties use attestation results to make informed security decisions, such as allowing access to sensitive data or resources only if the attestation verifies the system's integrity.
-Thereafter, the use of Contrast's CA certificates in TLS connections provides a practical approach to communicate securely with the application.
In summary, Contrast's attestation strategy adheres to the RATS guidelines and consists of robust verification mechanisms that ensure each component of the deployment is secure and trustworthy.
-This comprehensive approach allows Contrast to provide a high level of security assurance to its users.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.9, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.9
Certificate authority
-
The Coordinator acts as a certificate authority (CA) for the workloads
-defined in the manifest.
-After a workload pod's attestation has been verified by the Coordinator,
-it receives a mesh certificate and the mesh CA certificate.
-The mesh certificate can be used for example in a TLS connection as the server or
-client certificate to proof to the other party that the workload has been
-verified by the Coordinator. The other party can verify the mesh certificate
-with the mesh CA certificate. While the certificates can be used by the workload
-developer in different ways, they're automatically used in Contrast's service
-mesh to establish mTLS connections between workloads in the same deployment.
The Coordinator establishes a public key infrastructure (PKI) for all workloads
-contained in the manifest. The Coordinator holds three certificates: the root CA
-certificate, the intermediate CA certificate, and the mesh CA certificate.
-The root CA certificate is a long-lasting certificate and its private key signs
-the intermediate CA certificate. The intermediate CA certificate and the mesh CA
-certificate share the same private key. This intermediate private key is used
-to sign the mesh certificates. Moreover, the intermediate private key and
-therefore the intermediate CA certificate and the mesh CA certificate are
-rotated when setting a new manifest.
Depending on the configuration of the first manifest, it allows the workload
-owner to update the manifest and, therefore, the deployment.
-Workload owners and data owners can be mutually untrusted parties.
-To protect against the workload owner silently introducing malicious containers,
-the Coordinator rotates the intermediate private key every time the manifest is
-updated and, therefore, the
-intermediate CA certificate and mesh CA certificate. If the user doesn't
-trust the workload owner, they use the mesh CA certificate obtained when they
-verified the Coordinator and the manifest. This ensures that the user only
-connects to workloads defined in the manifest they verified since only those
-workloads' certificates are signed with this intermediate private key.
-
Similarly, the service mesh also uses the mesh CA certificate obtained when the
-workload was started, so the workload only trusts endpoints that have been
-verified by the Coordinator based on the same manifest. Consequently, a
-manifest update requires a fresh rollout of the services in the service mesh.
The root CA certificate is returned when verifying the Coordinator.
-The data owner can use it to verify the mesh certificates of the workloads.
-This should only be used if the data owner trusts all future updates to the
-manifest and workloads. This is, for instance, the case when the workload owner is
-the same entity as the data owner.
-
The mesh CA certificate is returned when verifying the Coordinator.
-The data owner can use it to verify the mesh certificates of the workloads.
-This certificate is bound to the manifest set when the Coordinator is verified.
-If the manifest is updated, the mesh CA certificate changes.
-New workloads will receive mesh certificates signed by the new mesh CA certificate.
-The Coordinator with the new manifest needs to be verified to retrieve the new mesh CA certificate.
-The service mesh also uses the mesh CA certificate to verify the mesh certificates.
-
The intermediate CA certificate links the root CA certificate to the
-mesh certificate so that the mesh certificate can be verified with the root CA
-certificate. It's part of the certificate chain handed out by
-endpoints in the service mesh.
-
The mesh certificate is part of the certificate chain handed out by
-endpoints in the service mesh. During the startup of a pod, the Initializer
-requests a certificate from the Coordinator. This mesh certificate will be returned if the Coordinator successfully
-verifies the workload. The mesh certificate
-contains X.509 extensions with information from the workloads attestation
-document.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.9, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.9
Observability
-
The Contrast Coordinator can expose metrics in the
-Prometheus format. These can be monitored to quickly
-identify problems in the gRPC layer or attestation errors. Prometheus metrics
-are numerical values associated with a name and additional key/values pairs,
-called labels.
The metrics can be accessed at the Coordinator pod at the port specified in the
-CONTRAST_METRICS_PORT environment variable under the /metrics endpoint. By
-default, this environment variable isn't specified, hence no metrics will be
-exposed.
-
The Coordinator exports gRPC metrics under the prefix contrast_grpc_server_.
-These metrics are labeled with the gRPC service name and method name.
-Metrics of interest include contrast_grpc_server_handled_total, which counts
-the number of requests by return code, and
-contrast_grpc_server_handling_seconds_bucket, which produces a histogram of
-request latency.
The meshapi.MeshAPI service records metrics for the method NewMeshCert, which
-gets called by the Initializer when starting a
-new workload. Attestation failures from workloads to the Coordinator can be
-tracked with the counter contrast_meshapi_attestation_failures_total.
-
The current manifest generation is exposed as a
-gauge with the metric
-name contrast_coordinator_manifest_generation. If no manifest is set at the
-Coordinator, this counter will be zero.
The Service Mesh can be configured to expose
-metrics via its Envoy admin
-interface. Be
-aware that the admin interface can expose private information and allows
-destructive operations to be performed. To enable the admin interface for the
-Service Mesh, set the annotation
-contrast.edgeless.systems/servicemesh-admin-interface-port in the configuration
-of your workload. If this annotation is set, the admin interface will be started
-on this port.
-
To access the admin interface, the ingress settings of the Service Mesh have to
-be configured to allow access to the specified port (see Configuring the
-Proxy). All metrics will be
-exposed under the /stats endpoint. Metrics in Prometheus format can be scraped
-from the /stats/prometheus endpoint.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.9, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.9
Secrets & recovery
-
When the Coordinator is configured with the initial manifest, it generates a random secret seed.
-From this seed, it uses an HKDF to derive the CA root key and a signing key for the manifest history.
-This derivation is deterministic, so the seed can be used to bring any Coordinator to this Coordinator's state.
-
The secret seed is returned to the user on the first call to contrast set, encrypted with the user's public seed share owner key.
-If no seed share owner key is provided, a key is generated and stored in the working directory.
The Coordinator runs as a StatefulSet with a dynamically provisioned persistent volume.
-This volume stores the manifest history and the associated runtime policies.
-The manifest isn't considered sensitive information, because it needs to be passed to the untrusted infrastructure in order to start workloads.
-However, the Coordinator must ensure its integrity and that the persisted data corresponds to the manifests set by authorized users.
-Thus, the manifest is stored in plain text, but is signed with a private key derived from the Coordinator's secret seed.
When a Coordinator starts up, it doesn't have access to the signing secret and can thus not verify the integrity of the persisted manifests.
-It needs to be provided with the secret seed, from which it can derive the signing key that verifies the signatures.
-This procedure is called recovery and is initiated by the workload owner.
-The CLI decrypts the secret seed using the private seed share owner key, verifies the Coordinator and sends the seed through the Recover method.
-The Coordinator recovers its key material and verifies the manifest history signature.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.9, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.9
Confidential Containers
-
Contrast uses some building blocks from Confidential Containers (CoCo), a CNCF Sandbox project that aims to standardize confidential computing at the pod level.
-The project is under active development and many of the high-level features are still in flux.
-Contrast uses the more stable core primitive provided by CoCo: its Kubernetes runtime.
Kubernetes can be extended to use more than one container runtime with RuntimeClass objects.
-The Container Runtime Interface (CRI) implementation, for example containerd, dispatches pod management API calls to the appropriate RuntimeClass.
-RuntimeClass implementations are usually based on an OCI runtime, such as runc, runsc or crun.
-In CoCo's case, the runtime is Kata Containers with added confidential computing capabilities.
Kata Containers is an OCI runtime that runs pods in VMs.
-The pod VM spawns an agent process that accepts management commands from the Kata runtime running on the host.
-There are two options for creating pod VMs: local to the Kubernetes node, or remote VMs created with cloud provider APIs.
-Using local VMs requires either bare-metal servers or VMs with support for nested virtualization.
-Local VMs communicate with the host over a virtual socket.
-For remote VMs, host-to-agent communication is tunnelled through the cloud provider's network.
-
Kata Containers was originally designed to isolate the guest from the host, but it can also run pods in confidential VMs (CVMs) to shield pods from their underlying infrastructure.
-In confidential mode, the guest agent is configured with an Open Policy Agent (OPA) policy to authorize API calls from the host.
-This policy also contains checksums for the expected container images.
-It's derived from Kubernetes resource definitions and its checksum is included in the attestation report.
Azure Kubernetes Service (AKS) provides CoCo-enabled node pools as a preview offering.
-These node pools leverage Azure VM types capable of nested virtualization (CVM-in-VM) and the CoCo stack is pre-installed.
-Contrast can be deployed directly into a CoCo-enabled AKS cluster.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.9, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.9
Product features
-
Contrast simplifies the deployment and management of Confidential Containers, offering optimal data security for your workloads while integrating seamlessly with your existing Kubernetes environment.
-
From a security perspective, Contrast employs the Confidential Containers concept and provides security benefits that go beyond individual containers, shielding your entire deployment from the underlying infrastructure.
-
From an operational perspective, Contrast provides the following key features:
-
-
-
Managed Kubernetes compatibility: Initially compatible with Azure Kubernetes Service (AKS), Contrast is designed to support additional platforms such as AWS EKS and Google Cloud GKE as they begin to accommodate confidential containers.
-
-
-
Lightweight installation: Contrast can be integrated as a day-2 operation within existing clusters, adding minimal components to your setup. This facilitates straightforward deployments using your existing YAML configurations, Helm charts, or Kustomization, enabling native Kubernetes orchestration of your applications.
-
-
-
Remote attestation: Contrast generates a concise attestation statement that verifies the identity, authenticity, and integrity of your deployment both internally and to external parties. This architecture ensures that updates or scaling of the application don't compromise the attestation’s validity.
-
-
-
Service mesh: Contrast securely manages a Public Key Infrastructure (PKI) for your deployments, issues workload-specific certificates, and establishes transparent mutual TLS (mTLS) connections across pods. This is done by harnessing the envoy proxy to ensure secure communications within your Kubernetes cluster.
-
-
-
-
\ No newline at end of file
diff --git a/pr-preview/pr-1071/0.9/basics/security-benefits.html b/pr-preview/pr-1071/0.9/basics/security-benefits.html
deleted file mode 100644
index 9ac90e269e..0000000000
--- a/pr-preview/pr-1071/0.9/basics/security-benefits.html
+++ /dev/null
@@ -1,116 +0,0 @@
-
-
-
-
-
-Contrast security overview | Contrast
-
-
-
-
-
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.9, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.9
Contrast security overview
-
This document outlines the security measures of Contrast and its capability to counter various threats.
-Contrast is designed to shield entire Kubernetes deployments from the infrastructure, enabling entities to manage sensitive information (such as regulated or personally identifiable information (PII)) in the public cloud, while maintaining data confidentiality and ownership.
-
Contrast is applicable in situations where establishing trust with the workload operator or the underlying infrastructure is challenging.
-This is particularly beneficial for regulated sectors looking to transition sensitive activities to the cloud, without sacrificing security or compliance.
-It allows for cloud adoption by maintaining a hardware-based separation from the cloud service provider.
Leveraging Confidential Computing technology, Contrast provides three defining security properties:
-
-
Encryption of data in use: Contrast ensures that all data processed in memory is encrypted, making it inaccessible to unauthorized users or systems, even if they have physical access to the hardware.
-
Workload isolation: Each pod runs in its isolated runtime environment, preventing any cross-contamination between workloads, which is critical for multi-tenant infrastructures.
-
Remote attestation: This feature allows data owners and workload operators to verify that the Contrast environment executing their workloads hasn't been tampered with and is running in a secure, pre-approved configuration.
-
-
The runtime encryption is transparently provided by the confidential computing hardware during the workload's lifetime.
-The workload isolation and remote attestation involves two phases:
-
-
An attestation process detects modifications to the workload image or its runtime environment during the initialization. This protects the workload's integrity pre-attestation.
-
A protected runtime environment and a policy mechanism prevents the platform operator from accessing or compromising the instance at runtime. This protects a workload's integrity and confidentiality post-attestation.
-
-
For more details on confidential computing see our whitepaper.
-The attestation architecture describes Contrast's attestation process and the resulting chain of trust in detail.
Contrast uses the Kubernetes runtime of the Confidential Containers project.
-Confidential Containers significantly decrease the size of the trusted computing base (TCB) of a Kubernetes deployment, by isolating each pod within its own confidential micro-VM environment.
-The TCB is the totality of elements in a computing environment that must be trusted not to be compromised.
-A smaller TCB results in a smaller attack surface. The following diagram shows how Confidential Containers remove the cloud & datacenter infrastructure and the physical hosts, including the hypervisor, the host OS, the Kubernetes control plane, and other components, from the TCB (red).
-In the confidential context, depicted in green, only the workload containers along with their confidential micro-VM environment are included within the TCB.
-Their integrity is verifiable through remote attestation.
-
Contrast uses hardware-based mechanisms, specifically leveraging CPU features, such as AMD SEV or Intel TDX, to provide the isolation of the workload.
-This implies that both the CPU and its microcode are integral components of the TCB.
-However, it should be noted that the CPU microcode aspects aren't depicted in the accompanying graphic.
-
-
Contrast adds the following components to a deployment that become part of the TCB.
-The components that are part of the TCB are:
-
-
The workload containers: Container images that run the actual application.
The runtime policies: Policies that enforce the runtime environments for the workload containers during their lifetime.
-
The manifest: A manifest file defining the reference values of an entire confidential deployment. It contains the policy hashes for all pods of the deployment and the expected hardware reference values for the Confidential Container runtime.
-
The Coordinator: An attestation service that runs in a Confidential Container in the Kubernetes cluster. The Coordinator is configured with the manifest. User-facing, you can verify this service and the effective manifest using remote attestation, providing you with a concise attestation for the entire deployment. Cluster-facing, it verifies all pods and their policies based on remote attestation procedures and the manifest.
In a Contrast deployment, there are three parties:
-
-
-
The container image provider, who creates the container images that represent the application that has access to the protected data.
-
-
-
The workload operator, who runs the workload in a Kubernetes cluster. The operator typically has full administrative privileges to the deployment. The operator can manage cluster resources such as nodes, volumes, and networking rules, and the operator can interact with any Kubernetes or underlying cloud API.
-
-
-
The data owner, who owns the protected data. A data owner can verify the deployment using the Coordinator attestation service. The verification includes the identity, integrity, and confidentiality of the workloads, the runtime environment and the access permissions.
-
-
-
Contrast supports a trust model where the container image provider, workload operator, and data owner are separate, mutually distrusting parties.
-
The following diagram shows the system components and parties.
Contrast is designed to defend against five possible attacks:
-
-
A malicious cloud insider: malicious employees or third-party contractors of cloud service providers (CSPs) potentially have full access to various layers of the cloud infrastructure. That goes from the physical datacenter up to the hypervisor and Kubernetes layer. For example, they can access the physical memory of the machines, modify the hypervisor, modify disk contents, intercept network communications, and attempt to compromise the confidential container at runtime. A malicious insider can expand the attack surface or restrict the runtime environment. For example, a malicious operator can add a storage device to introduce new attack vectors. As another example, a malicious operator can constrain resources such as limiting a guest's memory size, changing its disk space, or changing firewall rules.
-
A malicious cloud co-tenant: malicious cloud user ("hackers") may break out of their tenancy and access other tenants' data. Advanced attackers may even be able to establish a permanent foothold within the infrastructure and access data over a longer period. The threats are analogous to the cloud insider access scenario, without the physical access.
-
A malicious workload operator: malicious workload operators, for example Kubernetes administrators, have full access to the workload deployment and the underlying Kubernetes platform. The threats are analogously to the cloud insider access scenario, with access to everything that's above the hypervisor level.
-
A malicious attestation client: this attacker connects to the attestation service and sends malformed request.
-
A malicious container image provider: a malicious container image provider has full control over the application development itself. This attacker might release a malicious version of the workload containing harmful operations.
Contrast shields a workload from the aforementioned threats with three main components:
-
-
The runtime environment safeguards against the physical memory and disk attack surface.
-
The runtime policies safeguard against the Kubernetes control plane and container runtime attack surface.
-
The service mesh safeguards against the network attack surface.
-
-
The following tables describe concrete threats and how they're mitigated in Contrast grouped by these categories:
-
-
Attacks on the confidential container environment
-
Attacks on the attestation service
-
Attacks on workloads
-
-
Attacks on the confidential container environment
-
This table describes potential threats and mitigation strategies related to the confidential container environment.
-
Threat
Mitigation
Mitigation implementation
An attacker intercepts the network connection of the launcher or image repository.
An attacker can change the image URL and control the workload binary. However these actions are reflected in the attestation report. The image repository isn't controlled using an access list, therefore the image is assumed to be viewable by everyone. You must ensure that the workload container image doesn't contain any secrets.
An attacker modifies a container's runtime environment configuration in the Kubernetes control plane.
The attestation process and the runtime policies detects unsafe configurations that load non-authentic images or perform any other modification to the expected runtime environment.
This table describes potential threats and mitigation strategies to the attestation service.
-
Threat
Mitigation
Mitigation implementation
An attacker intercepts the Coordinator deployment and modifies the image or hijacks the runtime environment.
This threat is mitigated by having an attestation procedure and attested, encrypted TLS connections to the Coordinator. The attestation evidence for the Coordinator image is distributed with our releases, protected by supply chain security, and fully reproducible.
An attacker intercepts the network connection between the workload and the Coordinator and reads secret keys from the wire.
This threat is mitigated by having an attested, encrypted TLS connection. This connection helps protect the secrets from passive eavesdropping. The attacker can't create valid workload certificates that would be accepted in Contrast's service mesh. An attacker can't impersonate a valid workload container because the container's identity is guaranteed by the attestation protocol.
Within the network between your workload and the Coordinator.
An attacker exploits parsing discrepancies, which leads to undetected changes in the attestation process.
This risk is mitigated by having a parsing engine written in memory-safe Go that's tested against the attestation specification of the hardware vendor. The runtime policies are available as an attestation artifact for further inspection and audits to verify their effectiveness.
An attacker reads or modifies data written to disk via persistent volumes.
Currently, persistent volumes aren't supported in Contrast. In the future, this threat is mitigated by encrypted and integrity-protected volume mounts.
An attacker publishes a new image version containing malicious code.
The attestation process and the runtime policies require a data owner to accept a specific version of the workload and any update to the workload needs to be explicitly acknowledged.
The following table describes three example use cases and how they map to the defined threat model in this document:
-
Use Case
Example Scenario
Migrate sensitive workloads to the cloud
TechSolve Inc., a software development firm, aimed to enhance its defense-in-depth strategy for its cloud-based development environment, especially for projects involving proprietary algorithms and client data. TechSolve acts as the image provider, workload operator, and data owner, combining all three personas in this scenario. In our attestation terminology, they're the workload operator and relying party in one entity. Their threat model includes a malicious cloud insider and cloud co-tenant.
Make your SaaS more trustworthy
SaaSProviderX, a company offering cloud-based project management tools, sought to enhance its platform's trustworthiness amidst growing concerns about data breaches and privacy. Here, the relying party is the SaaS customer as the data owner. The goal is to achieve a form of operator exclusion and only allow selective operations on the deployment. Hence, their threat model includes a malicious workload operator.
Simplify regulatory compliance
HealthSecure Inc. has been managing a significant volume of sensitive patient data on-premises. With the increasing demand for advanced data analytics and the need for scalable infrastructure, the firm decides to migrate its data analytics operations to the cloud. However, the primary concern is maintaining the confidentiality and security of patient data during and after the migration, in compliance with healthcare regulations. In this compliance scenario, the regulator serves as an additional relying party. HealthSecure must implement a mechanism that ensures the isolation of patient data can be verifiably guaranteed to the regulator.
-
In each scenario, Contrast ensures exclusive data access and processing capabilities are confined to the designated workloads. It achieves this by effectively isolating the workload from the infrastructure and other components of the stack. Data owners are granted the capability to audit and approve the deployment environment before submitting their data, ensuring a secure handover. Meanwhile, workload operators are equipped to manage and operate the application seamlessly, without requiring direct access to either the workload or its associated data.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.9, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.9
Components
-
Contrast is composed of several key components that work together to manage and scale confidential containers effectively within Kubernetes environments.
-This page provides an overview of the core components essential for deploying and managing Contrast.
The CLI serves as the primary management tool for Contrast deployments. It's designed to streamline the configuration and operation of Contrast in several ways:
-
-
Installation and setup: The CLI facilitates the installation of the necessary runtime classes required for Contrast to function within a Kubernetes cluster.
-
Policy generation: It allows users to generate runtime policies, adapt the deployment files, and generate the Contrast manifest.
-
Configuration management: Through the CLI, users can configure the Contrast Coordinator with the generated manifest.
-
Verification and attestation: The CLI provides tools to verify the integrity and authenticity of the Coordinator and the entire deployment via remote attestation.
The Contrast Coordinator is the central remote attestation service of a Contrast deployment.
-It runs inside a confidential container inside your cluster.
-The Coordinator can be verified via remote attestation, and a Contrast deployment is self-contained.
-The Coordinator is configured with a manifest, a configuration file containing the reference attestation values of your deployment.
-It ensures that your deployment's topology adheres to your specified manifest by verifying the identity and integrity of all confidential pods inside the deployment.
-The Coordinator is also a certificate authority and issues certificates for your workload pods during the attestation procedure.
-Your workload pods can establish secure, encrypted communication channels between themselves based on these certificates using the Coordinator as the root CA.
-As your app needs to scale, the Coordinator transparently verifies new instances and then provides them with their certificates to join the deployment.
-
To verify your deployment, the Coordinator's remote attestation statement combined with the manifest offers a concise single remote attestation statement for your entire deployment.
-A third party can use this to verify the integrity of your distributed app, making it easy to assure stakeholders of your app's identity and integrity.
The manifest is the configuration file for the Coordinator, defining your confidential deployment.
-It's automatically generated from your deployment by the Contrast CLI.
-It currently consists of the following parts:
-
-
Policies: The identities of your Pods, represented by the hashes of their respective runtime policies.
-
Reference Values: The remote attestation reference values for the Kata confidential micro-VM that's the runtime environment of your Pods.
-
WorkloadOwnerKeyDigest: The workload owner's public key digest. Used for authenticating subsequent manifest updates.
Runtime Policies are a mechanism to enable the use of the untrusted Kubernetes API for orchestration while ensuring the confidentiality and integrity of your confidential containers.
-They allow us to enforce the integrity of your containers' runtime environment as defined in your deployment files.
-The runtime policy mechanism is based on the Open Policy Agent (OPA) and translates the Kubernetes deployment YAML into the Rego policy language of OPA.
-The Kata Agent inside the confidential micro-VM then enforces the policy by only acting on permitted requests.
-The Contrast CLI provides the tooling for automatically translating Kubernetes deployment YAML into the Rego policy language of OPA.
Contrast provides an Initializer that handles the remote attestation on the workload side transparently and
-fetches the workload certificate. The Initializer runs as an init container before your workload is started.
-It provides the workload container and the service mesh sidecar with the workload certificates.
Contrast depends on a Kubernetes runtime class, which is installed
-by the node-installer DaemonSet.
-This runtime consists of a containerd runtime plugin, a virtual machine manager (cloud-hypervisor), and a podvm image (IGVM and rootFS).
-The installer takes care of provisioning every node in the cluster so it provides this runtime class.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.9, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.9
Policies
-
Kata runtime policies are an integral part of the Confidential Containers preview on AKS.
-They prescribe how a Kubernetes pod must be configured to launch successfully in a confidential VM.
-In Contrast, policies act as a workload identifier: only pods with a policy registered in the manifest receive workload certificates and may participate in the confidential deployment.
-Verification of the Contrast Coordinator and its manifest transitively guarantees that all workloads meet the owner's expectations.
The Kata agent running in the confidential micro-VM exposes an RPC service AgentService to the Kata runtime.
-This service handles potentially untrustworthy requests from outside the TCB, which need to be checked against a policy.
-
Kata runtime policies are written in the policy language Rego.
-They specify what AgentService methods can be called, and the permissible parameters for each call.
-
Policies consist of two parts: a list of rules and a data section.
-While the list of rules is static, the data section is populated with information from the PodSpec and other sources.
Runtime policies are programmatically generated from Kubernetes manifests by the Contrast CLI.
-The generate subcommand inspects pod definitions and derives rules for validating the pod at the Kata agent.
-There are two important integrity checks: container image checksums and OCI runtime parameters.
-
For each of the container images used in a pod, the CLI downloads all image layers and produces a cryptographic dm-verity checksum.
-These checksums are the basis for the policy's storage data.
-
The CLI combines information from the PodSpec, ConfigMaps, and Secrets in the provided Kubernetes manifests to derive a permissible set of command-line arguments and environment variables.
-These constitute the policy's OCI data.
The generated policy document is annotated to the pod definitions in Base64 encoding.
-This annotation is propagated to the Kata runtime, which calculates the SHA256 checksum for the policy and uses that as SNP HOSTDATA for the confidential micro-VM.
-
After the VM launched, the runtime calls the agent's SetPolicy method with the full policy document.
-If the policy doesn't match the checksum in HOSTDATA, the agent rejects the policy.
-Otherwise, it applies the policy to all future AgentService requests.
Contrast verifies its confidential containers following these steps:
-
-
The Contrast CLI generates a policy and attaches it to the pod definition.
-
Kubernetes schedules the pod on a node with the confidential computing runtime.
-
Containerd invokes the Kata runtime to create the pod sandbox.
-
The Kata runtime starts a CVM with the policy's digest as HOSTDATA.
-
The Kata runtime sets the policy using the SetPolicy method.
-
The Kata agent verifies that the incoming policy's digest matches HOSTDATA.
-
The CLI sets a manifest in the Contrast Coordinator, including a list of permitted policies.
-
The Contrast Initializer sends an attestation report to the Contrast Coordinator, asking for a mesh certificate.
-
The Contrast Coordinator verifies that the started pod has a permitted policy hash in its HOSTDATA field.
-
-
After the last step, we know that the policy hasn't been tampered with and, thus, that the workload matches expectations and may receive mesh certificates.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.9, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.9
Contrast Runtime
-
The Contrast runtime is responsible for starting pods as confidential virtual machines.
-This works by specifying the runtime class to be used in a pod spec and by registering the runtime class with the apiserver.
-The RuntimeClass resource defines a name for referencing the class and
-a handler used by the container runtime (containerd) to identify the class.
-
apiVersion: node.k8s.io/v1 kind: RuntimeClass metadata: # This name is used by pods in the runtimeClassName field name: contrast-cc-abcdef # This name is used by the # container runtime interface implementation (containerd) handler: contrast-cc-abcdef
-
Confidential pods that are part of a Contrast deployment need to specify the
-same runtime class in the runtimeClassName field, so Kubernetes uses the
-Contrast runtime instead of the default containerd / runc handler.
-
apiVersion: v1 kind: Pod spec: runtimeClassName: contrast-cc-abcdef # ...
The runtime consists of additional software components that need to be installed
-and configured on every SEV-SNP-enabled worker node.
-This installation is performed automatically by the node-installer DaemonSet.
The handler field in the Kubernetes RuntimeClass instructs containerd not to use the default runc implementation.
-Instead, containerd invokes a custom plugin called containerd-shim-contrast-cc-v2.
-This shim is described in more detail in the upstream source repository and in the containerd documentation.
The containerd shim uses cloud-hypervisor to create a confidential virtual machine for every pod.
-This requires the cloud-hypervisor binary to be installed on every node (responsibility of the node-installer).
Contrast uses a special containerd snapshotter (tardev) to provide container images as block devices to the pod-VM. This snapshotter consists of a host component that pulls container images and a guest component (kernel module) used to mount container images.
-The tardev snapshotter uses dm-verity to protect the integrity of container images.
-Expected dm-verity container image hashes are part of Contrast runtime policies and are enforced by the kata-agent.
-This enables workload attestation by specifying the allowed container image as part of the policy. Read the chapter on policies for more information.
Every pod-VM starts with the same guest image. It consists of an IGVM file and a root filesystem.
-The IGVM file describes the initial memory contents of a pod-VM and consists of:
-
-
Linux kernel image
-
initrd
-
kernel commandline
-
-
Additionally, a root filesystem image is used that contains a read-only partition with the user space of the pod-VM and a verity partition to guarantee the integrity of the root filesystem.
-The root filesystem contains systemd as the init system, and the kata agent for managing the pod.
-
This pod-VM image isn't specific to any pod workload. Instead, container images are mounted at runtime.
The RuntimeClass resource above registers the runtime with the Kubernetes api.
-The node-level installation is carried out by the Contrast node-installer
-DaemonSet that ships with every Contrast release.
-
After deploying the installer, it performs the following steps on each node:
-
-
Install the Contrast containerd shim (containerd-shim-contrast-cc-v2)
-
Install cloud-hypervisor as the virtual machine manager (VMM)
-
Install an IGVM file for pod-VMs of this class
-
Install a read only root filesystem disk image for the pod-VMs of this class
-
Reconfigure containerd by adding a runtime plugin that corresponds to the handler field of the Kubernetes RuntimeClass
-
Restart containerd to make it aware of the new plugin
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.9, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.9
Service mesh
-
The Contrast service mesh secures the communication of the workload by automatically
-wrapping the network traffic inside mutual TLS (mTLS) connections. The
-verification of the endpoints in the connection establishment is based on
-certificates that are part of the
-PKI of the Coordinator.
-
The service mesh can be enabled on a per-workload basis by adding a service mesh
-configuration to the workload's object annotations. During the contrast generate
-step, the service mesh is added as a sidecar
-container to
-all workloads which have a specified configuration. The service mesh container first
-sets up iptables rules based on its configuration and then starts
-Envoy for TLS origination and termination.
The service mesh container can be configured using the following object annotations:
-
-
contrast.edgeless.systems/servicemesh-ingress to configure ingress.
-
contrast.edgeless.systems/servicemesh-egress to configure egress.
-
contrast.edgeless.systems/servicemesh-admin-interface-port to configure the Envoy
-admin interface. If not specified, no admin interface will be started.
-
-
If you aren't using the automatic service mesh injection and want to configure the
-service mesh manually, set the environment variables CONTRAST_INGRESS_PROXY_CONFIG,
-CONTRAST_EGRESS_PROXY_CONFIG and CONTRAST_ADMIN_PORT in the service mesh sidecar directly.
All TCP ingress traffic is routed over Envoy by default. Since we use
-TPROXY, the destination address
-remains the same throughout the packet handling.
-
Any incoming connection is required to present a client certificate signed by the
-mesh CA certificate.
-Envoy presents a certificate chain of the mesh
-certificate of the workload and the intermediate CA certificate as the server certificate.
-
If the deployment contains workloads which should be reachable from outside the
-Service Mesh, while still handing out the certificate chain, disable client
-authentication by setting the annotation contrast.edgeless.systems/servicemesh-ingress as
-<name>#<port>#false. Separate multiple entries with ##. You can choose any
-descriptive string identifying the service on the given port for the <name> field,
-as it's only informational.
-
Disable redirection and TLS termination altogether by specifying
-<name>#<port>#true. This can be beneficial if the workload itself handles TLS
-on that port or if the information exposed on this port is non-sensitive.
-
The following example workload exposes a web service on port 8080 and metrics on
-port 7890. The web server is exposed to a 3rd party end-user which wants to
-verify the deployment, therefore it's still required that the server hands out
-it certificate chain signed by the mesh CA certificate. The metrics should be
-exposed via TCP without TLS.
Note, that changing the environment variables of the sidecar container directly will
-only have an effect if the workload isn't configured to automatically generate a
-service mesh component on contrast generate. Otherwise, the service mesh sidecar
-container will be regenerated on every invocation of the command.
To be able to route the egress traffic of the workload through Envoy, the remote
-endpoints' IP address and port must be configurable.
-
-
Choose an IP address inside the 127.0.0.0/8 CIDR and a port not yet in use
-by the pod.
-
Configure the workload to connect to this IP address and port.
-
Set <name>#<chosen IP>:<chosen port>#<original-hostname-or-ip>:<original-port>
-as the contrast.edgeless.systems/servicemesh-egress workload annotation. Separate multiple
-entries with ##. Choose any string identifying the service on the given port as
-<name>.
-
-
This redirects the traffic over Envoy. The endpoint must present a valid
-certificate chain which must be verifiable with the
-mesh CA certificate.
-Furthermore, Envoy uses a certificate chain with the mesh certificate of the workload
-and the intermediate CA certificate as the client certificate.
-
The following example workload has no ingress connections and two egress
-connection to different microservices. The microservices are part
-of the confidential deployment. One is reachable under billing-svc:8080 and
-the other under cart-svc:8080.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.9, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.9
Workload deployment
-
The following instructions will guide you through the process of making an existing Kubernetes deployment
-confidential and deploying it together with Contrast.
-
A running CoCo-enabled cluster is required for these steps, see the setup guide on how to set it up.
Contrast depends on a custom Kubernetes RuntimeClass (contrast-cc),
-which needs to be installed in the cluster prior to the Coordinator or any confidential workloads.
-This consists of a RuntimeClass resource and a DaemonSet that performs installation on worker nodes.
-This step is only required once for each version of the runtime.
-It can be shared between Contrast deployments.
Your Kubernetes resources need some modifications to run as Confidential Containers.
-This section guides you through the process and outlines the necessary changes.
Contrast will add annotations to your Kubernetes YAML files. If you want to keep the original files
-unchanged, you can copy the files into a separate local directory.
-You can also generate files from a Helm chart or from a Kustomization.
To specify that a workload (pod, deployment, etc.) should be deployed as confidential containers,
-add runtimeClassName: contrast-cc to the pod spec (pod definition or template).
-This is a placeholder name that will be replaced by a versioned runtimeClassName when generating policies.
In the initialization process, the contrast-tls-certs shared volume is populated with X.509 certificates for your workload.
-These certificates are used by the Contrast Service Mesh, but can also be used by your application directly.
-The following tab group explains the setup for both scenarios.
-
Drop-in service mesh
Go integration
Contrast can be configured to handle TLS in a sidecar container.
-This is useful for workloads that are hard to configure with custom certificates, like Java applications.
Configuration of the sidecar depends heavily on the application.
-The following example is for an application with these properties:
-
The container has a main application at TCP port 8001, which should be TLS-wrapped and doesn't require client authentication.
-
The container has a metrics endpoint at TCP port 8080, which should be accessible in plain text.
-
All other endpoints require client authentication.
-
The app connects to a Kubernetes service backend.default:4001, which requires client authentication.
During the generate step, this configuration will be translated into a Service Mesh sidecar container which handles TLS connections automatically.
-The only change required to the app itself is to let it connect to 127.0.0.2:4001 to reach the backend service.
-You can find more detailed documentation in the Service Mesh chapter.
The mesh certificate contained in certChain.pem authenticates this workload, while the mesh CA certificate mesh-ca.pem authenticates its peers.
-Your app should turn on client authentication to ensure peers are running as confidential containers, too.
-See the Certificate Authority section for detailed information about these certificates.
The following example shows how to configure a Golang app, with error handling omitted for clarity.
Run the generate command to add the necessary components to your deployment files.
-This will add the Contrast Initializer to every workload with the specified contrast-cc runtime class
-and the Contrast Service Mesh to all workloads that have a specified configuration.
-After that, it will generate the execution policies and add them as annotations to your deployment files.
-A manifest.json with the reference values of your deployment will be created.
Please be aware that runtime policies currently have some blind spots. For example, they can't guarantee the starting order of containers. See the current limitations for more details.
-
If you don't want the Contrast Initializer to automatically be added to your
-workloads, there are two ways you can skip the Initializer injection step,
-depending on how you want to customize your deployment.
-
Command-line flag
Per-workload annotation
You can disable the Initializer injection completely by specifying the
---skip-initializer flag in the generate command.
If you want to disable the Initializer injection for a specific workload with
-the contrast-cc runtime class, you can do so by adding an annotation to the workload.
When disabling the automatic Initializer injection, you can manually add the
-Initializer as a sidecar container to your workload before generating the
-policies. Configure the workload to use the certificates written to the
-contrast-tls-certsvolumeMount.
For the next steps, we will need to connect to the Coordinator. The released Coordinator resource
-includes a LoadBalancer definition we can use.
-
coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}')
-
Port-forwarding of Confidential Containers
kubectl port-forward uses a Container Runtime Interface (CRI) method that isn't supported by the Kata shim.
-If you can't use a public load balancer, you can deploy a port-forwarder.
-The port-forwarder relays traffic from a CoCo pod and can be accessed via kubectl port-forward.
This will use the reference values from the manifest file to attest the Coordinator.
-After this step, the Coordinator will start issuing TLS certificates to the workloads. The init container
-will fetch a certificate for the workload and the workload is started.
An end user (data owner) can verify the Contrast deployment using the verify command.
-
contrast verify -c"${coordinator}:1313"
-
The CLI will attest the Coordinator using the reference values from the given manifest file. It will then write the
-service mesh root certificate and the history of manifests into the verify/ directory. In addition, the policies
-referenced in the active manifest are also written to the directory. The verification will fail if the active
-manifest at the Coordinator doesn't match the manifest passed to the CLI.
You can securely connect to the workloads using the Coordinator's mesh-ca.pem as a trusted CA certificate.
-First, expose the service on a public IP address via a LoadBalancer service:
By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed
-via load balancer IP in this demo. Tools like curl check the certificate for IP entries in the SAN field.
-Validation fails since the certificate contains no IP entries as a subject alternative name (SAN).
-For example, a connection attempt using the curl and the mesh CA certificate with throw the following error:
$ curl--cacert ./verify/mesh-ca.pem "https://${frontendIP}:443" curl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34'
-
Using openssl, the certificate of the service can be validated with the mesh-ca.pem:
If the Contrast Coordinator restarts, it enters recovery mode and waits for an operator to provide key material.
-For demonstration purposes, you can simulate this scenario by deleting the Coordinator pod.
-
kubectl delete pod -l app.kubernetes.io/name=coordinator
-
Kubernetes schedules a new pod, but that pod doesn't have access to the key material the previous pod held in memory and can't issue certificates for workloads yet.
-You can confirm this by running verify again, or you can restart a workload pod, which should stay in the initialization phase.
-However, the secret seed in your working directory is sufficient to recover the coordinator.
-
contrast recover -c"${coordinator}:1313"
-
Now that the Coordinator is recovered, all workloads should pass initialization and enter the running state.
-You can now verify the Coordinator again, which should return the same manifest you set before.
-
warning
The recovery process invalidates the mesh CA certificate:
-existing workloads won't be able to communicate with workloads newly spawned.
-All workloads should be restarted after the recovery succeeded.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 0.9, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 0.9
Confidential emoji voting
-
-
This tutorial guides you through deploying emojivoto as a
-confidential Contrast deployment and validating the deployment from a voters perspective.
-
Emojivoto is an example app allowing users to vote for different emojis and view votes
-on a leader board. It has a microservice architecture consisting of a
-web frontend (web), a gRPC backend for listing available emojis (emoji), and a backend for
-the voting and leader board logic (voting). The vote-bot simulates user traffic by submitting
-votes to the frontend.
Using a voting service, users' votes are considered highly sensitive data, as we require
-a secret ballot. Also, users are likely interested in the fairness of the ballot. For
-both requirements, we can use Confidential Computing and, specifically, workload attestation
-to prove to those interested in voting that the app is running in a protected environment
-where their votes are processed without leaking to the platform provider or workload owner.
Contrast depends on a custom Kubernetes RuntimeClass (contrast-cc),
-which needs to be installed in the cluster prior to the Coordinator or any confidential workloads.
-This consists of a RuntimeClass resource and a DaemonSet that performs installation on worker nodes.
-This step is only required once for each version of the runtime.
-It can be shared between Contrast deployments.
Run the generate command to generate the execution policies and add them as
-annotations to your deployment files. A manifest.json file with the reference values
-of your deployment will be created:
The deployment YAML shipped for this demo is already configured to be used with Contrast.
-A runtime classcontrast-cc-<platform>-<runtime-hash>
-was added to the pods to signal they should be run as Confidential Containers. During the generation process,
-the Contrast Initializer will be added as an init container to these
-workloads to facilitate the attestation and certificate pulling before the actual workload is started.
Further, the deployment YAML is also configured with the Contrast service mesh.
-The configured service mesh proxy provides transparent protection for the communication between
-the different components of emojivoto.
Configure the coordinator with a manifest. It might take up to a few minutes
-for the load balancer to be created and the Coordinator being available.
-
coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') echo"The user API of your Contrast Coordinator is available at $coordinator:1313" contrast set-c"${coordinator}:1313" deployment/
-
The CLI will use the reference values from the manifest to attest the Coordinator deployment
-during the TLS handshake. If the connection succeeds, it's ensured that the Coordinator
-deployment hasn't been tampered with.
Now that the coordinator has a manifest set, which defines the emojivoto deployment as an allowed workload,
-we can deploy the application:
-
kubectl apply -f deployment/
-
Inter-deployment communication
The Contrast Coordinator issues mesh certificates after successfully validating workloads.
-These certificates can be used for secure inter-deployment communication. The Initializer
-sends an attestation report to the Coordinator, retrieves certificates and a private key in return
-and writes them to a volumeMount. The service mesh sidecar is configured to use the credentials
-from the volumeMount when communicating with other parts of the deployment over mTLS.
-The public facing frontend for voting uses the mesh certificate without client authentication.
As voters, we want to verify the fairness and confidentiality of the deployment before
-deciding to vote. Regardless of the scale of our distributed deployment, Contrast only
-needs a single remote attestation step to verify the deployment. By doing remote attestation
-of the Coordinator, we transitively verify those systems the Coordinator has already attested
-or will attest in the future. Successful verification of the Coordinator means that
-we can be sure it will enforce the configured manifest.
The CLI will attest the Coordinator using the reference values from a given manifest. This manifest needs
-to be communicated out of band to everyone wanting to verify the deployment, as the verify command checks
-if the currently active manifest at the Coordinator matches the manifest given to the CLI. If the command succeeds,
-the Coordinator deployment was successfully verified to be running in the expected Confidential
-Computing environment with the expected code version. The Coordinator will then return its
-configuration over the established TLS channel. The CLI will store this information, namely the root
-certificate of the mesh (mesh-ca.pem) and the history of manifests, into the verify/ directory.
-In addition, the policies referenced in the manifest history are also written into the same directory.
In the next step, the Coordinator configuration that was written by the verify command needs to be audited.
-A potential voter should inspect the manifest and the referenced policies. They could delegate
-this task to an entity they trust.
After ensuring the configuration of the Coordinator fits the expectation, you can securely connect
-to the workloads using the Coordinator's mesh-ca.pem as a trusted CA certificate.
-
To access the web frontend, expose the service on a public IP address via a LoadBalancer service:
-
frontendIP=$(kubectl get svc web-svc -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') echo"Frontend is available at https://$frontendIP, you can visit it in your browser."
-
Using openssl, the certificate of the service can be validated with the mesh-ca.pem:
By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed
-via load balancer IP in this demo. Tools like curl check the certificate for IP entries in the subject alternative name (SAN) field.
-Validation fails since the certificate contains no IP entries as a SAN.
-For example, a connection attempt using the curl and the mesh CA certificate with throw the following error:
-
$ curl--cacert ./verify/mesh-ca.pem "https://${frontendIP}:443" curl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34'
The Policies section of the manifest maps policy hashes to a list of SANs. To enable certificate verification
-of the web frontend with tools like curl, edit the policy with your favorite editor and add the frontendIP to
-the list that already contains the "web" DNS entry:
Next, set the changed manifest at the coordinator with:
-
contrast set-c"${coordinator}:1313" deployment/
-
The Contrast Coordinator will rotate the mesh ca certificate on the manifest update. Workload certificates issued
-after the manifest update are thus issued by another certificate authority and services receiving the new CA certificate chain
-won't trust parts of the deployment that got their certificate issued before the update. This way, Contrast ensures
-that parts of the deployment that received a security update won't be infected by parts of the deployment at an older
-patch level that may have been compromised. The mesh-ca.pem is updated with the new CA certificate chain.
The Coordinator has the new manifest set, but the different containers of the app are still
-using the older certificate authority. The Contrast Initializer terminates after the initial attestation
-flow and won't pull new certificates on manifest updates.
After the update has been rolled out, connecting to the frontend using curl will successfully validate
-the service certificate and return the HTML document of the voting site:
Platform support: At present, Contrast is exclusively available on Azure AKS, supported by the Confidential Container preview for AKS. Expansion to other cloud platforms is planned, pending the availability of necessary infrastructure enhancements.
-
Bare-metal support: Support for running Contrast on bare-metal Kubernetes will be available soon for AMD SEV and Intel TDX.
Persistent volumes: Contrast only supports volumes with volumeMode: Block. These block devices are provided by the untrusted environment and should be treated accordingly. We plan to provide transparent encryption on top of block devices in a future release.
Resource limits: There is an existing bug on AKS where container memory limits are incorrectly applied. The current workaround involves using only memory requests instead of limits.
Coverage: While the enforcement of workload policies generally functions well, there are scenarios not yet fully covered. It's crucial to review deployments specifically for these edge cases.
-
Order of events: The current policy evaluation mechanism on API requests isn't stateful, so it can't ensure a prescribed order of events. Consequently, there's no guaranteed enforcement that the service mesh sidecar container runs before the workload container. This order ensures that all traffic between pods is securely encapsulated within TLS connections.
-
Absence of events: Policies can't ensure certain events have happened. A container, such as the service mesh sidecar, can be omitted entirely. Environment variables may be missing.
-
Volume integrity checks: While persistent volumes aren't supported yet, integrity checks don't currently cover other objects such as ConfigMaps and Secrets.
-
-
warning
The policy limitations, in particular the missing guarantee that our service mesh sidecar has been started before the workload container affects the service mesh implementation of Contrast. Currently, this requires inspecting the iptables rules on startup or terminating TLS connections in the workload directly.
CLI availability: The CLI tool is currently only available for Linux. This limitation arises because certain upstream dependencies haven't yet been ported to other platforms.
The Contrast Coordinator is a singleton and can't be scaled to more than one instance.
-When this instance's pod is restarted, for example for node maintenance, it needs to be recovered manually.
-In a future release, we plan to support distributed Coordinator instances that can recover automatically.
CoCo on AKS is currently in preview. An extension for the az CLI is needed to create such a cluster.
-Add the extension with the following commands:
-
az extension add\ --name aks-preview \ --allow-preview true az extension update \ --name aks-preview \ --allow-preview true
-
Then register the required feature flags in your subscription to allow access to the public preview:
-
az feature register \ --namespace"Microsoft.ContainerService"\ --name"KataCcIsolationPreview"
-
The registration can take a few minutes. The status of the operation can be checked with the following
-command, which should show the registration state as Registered:
-
az feature show \ --namespace"Microsoft.ContainerService"\ --name"KataCcIsolationPreview"\ --output table
-
Afterward, refresh the registration of the ContainerService provider:
-
az provider register \ --namespace"Microsoft.ContainerService"
First, we need to create an AKS cluster. We can't directly create a CoCo-enabled cluster, so we'll need to create a
-non-CoCo cluster first, and then add a CoCo node pool, optionally replacing the non-CoCo node pool.
-
We'll first start by creating the non-CoCo cluster:
-
# Select the name for your AKS cluster azClusterName="ContrastDemo" az aks create \ --resource-group "${azResourceGroup:?}"\ --name"${azClusterName:?}"\ --kubernetes-version 1.29\ --os-sku AzureLinux \ --node-vm-size Standard_DC4as_cc_v5 \ --node-count 1\ --generate-ssh-keys
After trying out Contrast, you might want to clean up the cloud resources created in this step.
-In case you've created a new resource group, you can just delete that group with
-
az group delete \ --name"${azResourceGroup:?}"
-
Deleting the resource group will also delete the cluster and all other related resources.
-
To only cleanup the AKS cluster and node pools, run
-
az aks delete \ --resource-group "${azResourceGroup:?}"\ --name"${azClusterName:?}"
Collecting logs can be a good first step to identify problems in your
-deployment. Both the CLI and the Contrast Coordinator as well as the Initializer
-can be configured to emit additional logs.
The CLI logs can be configured with the --log-level command-line flag, which
-can be set to either debug, info, warn or error. The default is info.
-Setting this to debug can get more fine-grained information as to where the
-problem lies.
The logs from the Coordinator and the Initializer can be configured via the
-environment variables CONTRAST_LOG_LEVEL, CONTRAST_LOG_FORMAT and
-CONTRAST_LOG_SUBSYSTEMS.
-
-
CONTRAST_LOG_LEVEL can be set to one of either debug, info, warn, or
-error, similar to the CLI (defaults to info).
-
CONTRAST_LOG_FORMAT can be set to text or json, determining the output
-format (defaults to text).
-
CONTRAST_LOG_SUBSYSTEMS is a comma-seperated list of subsystems that should
-be enabled for logging, which are disabled by default. Subsystems include:
-kds-getter, issuer and validator.
-To enable all subsystems, use * as the value for this environment variable.
-Warnings and error messages from subsystems get printed regardless of whether
-the subsystem is listed in the CONTRAST_LOG_SUBSYSTEMS environment variable.
-
-
To configure debug logging with all subsystems for your Coordinator, add the
-following variables to your container definition.
While the Contrast Coordinator has a policy that allows certain configurations,
-the Initializer and service mesh don't. When changing environment variables of other
-parts than the Coordinator, ensure to rerun contrast generate to update the policy.
-
To access the logs generated by the Coordinator, you can use kubectl with the
-following command:
If the Coordinator or a workload pod fails to even start, it can be helpful to
-look at the events of the pod during the startup process using the describe
-command.
LAST SEEN TYPE REASON OBJECT MESSAGE 32m Warning Failed Pod/coordinator-0 kubelet Error: failed to create containerd task: failed to create shim task: "CreateContainerRequest is blocked by policy: ...
-
A common error, as in this example, is that the container creation was blocked by the
-policy. Potential reasons are a modification of the deployment YAML without updating
-the policies afterward, or a version mismatch between Contrast components.
When generating the policies, Contrast will download the images specified in your deployment
-YAML and include their cryptographic identity. If the image tag is moved to another
-container image after the policy has been generated, the image downloaded at deploy time
-will differ from the one at generation time, and the policy enforcement won't allow the
-container to be started in the pod VM.
-
To ensure the correct image is always used, pin the container image to a fixed sha256:
A version mismatch between Contrast components can cause policy validation or attestation
-to fail. Each Contrast runtime is identifiable based on its (shortened) measurement value
-used to name the runtime class version.
-
First, analyze which runtime class is currently installed in your cluster by running
-
kubectl get runtimeclasses
-
This should give you output similar to the following one.
-
NAME HANDLER AGE contrast-cc-aks-clh-snp-7173acb5 contrast-cc-aks-clh-snp-7173acb5 23h kata-cc-isolation kata-cc 45d
-
The output shows that there are four Contrast runtime classes installed (as well as the runtime class provided
-by the AKS CoCo preview, which isn't used by Contrast).
-
Next, check if the pod that won't start has the correct runtime class configured, and the
-Coordinator uses the exact same runtime:
-
kubectl -n<namespace> get -o=jsonpath='{.spec.runtimeClassName}' pod/<pod-name> kubectl -n<namespace> get -o=jsonpath='{.spec.runtimeClassName}' pod/<coordinator-pod-name>
-
The output should list the runtime class the pod is using:
-
contrast-cc-aks-clh-snp-7173acb5
-
Version information about the currently used CLI can be obtained via the version flag:
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.0, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.0
Contrast
-
Welcome to the documentation of Contrast! Contrast runs confidential container deployments on Kubernetes at scale.
-
-
Contrast is based on the Kata Containers and
-Confidential Containers projects.
-Confidential Containers are Kubernetes pods that are executed inside a confidential micro-VM and provide strong hardware-based isolation from the surrounding environment.
-This works with unmodified containers in a lift-and-shift approach.
-Contrast currently targets the CoCo preview on AKS.
-
tip
See the 📄whitepaper for more information on confidential computing.
Contrast is designed to keep all data always encrypted and to prevent access from the infrastructure layer. It removes the infrastructure provider from the trusted computing base (TCB). This includes access from datacenter employees, privileged cloud admins, own cluster administrators, and attackers coming through the infrastructure, for example, malicious co-tenants escalating their privileges.
-
Contrast integrates fluently with the existing Kubernetes workflows. It's compatible with managed Kubernetes, can be installed as a day-2 operation and imposes only minimal changes to your deployment flow.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.0, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.0
CLI telemetry
-
The Contrast CLI sends telemetry data to Edgeless Systems when you use CLI commands.
-This allows to understand how Contrast is used and to improve it.
-
The CLI sends the following data:
-
-
The CLI version
-
The CLI target OS and architecture (GOOS and GOARCH)
-
The command that was run
-
The kind of error that occurred (if any)
-
-
The CLI doesn't collect sensitive information.
-The implementation is open-source and can be reviewed.
-
IP addresses may be processed or stored for security purposes.
-
The data that the CLI collects adheres to the Edgeless Systems privacy policy.
-
You can disable telemetry by setting the environment variable DO_NOT_TRACK=1 before running the CLI.
-
-
\ No newline at end of file
diff --git a/pr-preview/pr-1071/1.0/architecture/attestation.html b/pr-preview/pr-1071/1.0/architecture/attestation.html
deleted file mode 100644
index 5590a9a805..0000000000
--- a/pr-preview/pr-1071/1.0/architecture/attestation.html
+++ /dev/null
@@ -1,95 +0,0 @@
-
-
-
-
-
-Attestation in Contrast | Contrast
-
-
-
-
-
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.0, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.0
Attestation in Contrast
-
This document describes the attestation architecture of Contrast, adhering to the definitions of Remote ATtestation procedureS (RATS) in RFC 9334.
-The following gives a detailed description of Contrast's attestation architecture.
-At the end of this document, we included an FAQ that answers the most common questions regarding attestation in hindsight of the security benefits.
Contrast integrates with the RATS architecture, leveraging their definition of roles and processes including Attesters, Verifiers, and Relying Parties.
-
-
Figure 1: Conceptual attestation architecture. Taken from RFC 9334.
-
-
Attester: Assigned to entities that are responsible for creating Evidence which is then sent to a Verifier.
-
Verifier: These entities utilize the Evidence, Reference Values, and Endorsements. They assess the trustworthiness of the Attester by applying an Appraisal Policy for Evidence. Following this assessment, Verifiers generate Attestation Results for use by Relying Parties. The Appraisal Policy for Evidence may be provided by the Verifier Owner, programmed into the Verifier, or acquired through other means.
-
Relying Party: Assigned to entities that utilize Attestation Results, applying their own appraisal policies to make specific decisions, such as authorization decisions. This process is referred to as the "appraisal of Attestation Results." The Appraisal Policy for Attestation Results might be sourced from the Relying Party Owner, configured by the owner, embedded in the Relying Party, or obtained through other protocols or mechanisms.
This includes all Pods of the Contrast deployment that run inside Confidential Containers and generate cryptographic evidence reflecting their current configuration and state.
-Their evidence is rooted in the hardware measurements from the CPU and their confidential VM environment.
-The details of this evidence are given below in the section on evidence generation and appraisal.
-
-
Figure 2: Attestation flow of a confidential pod. Based on the layered attester graphic in RFC 9334.
-
Pods run in Contrast's runtime environment (B), effectively within a confidential VM.
-During launch, the CPU (A) measures the initial memory content of the confidential VM that contains Contrast's pod-VM image and generates the corresponding attestation evidence.
-The image is in IGVM format, encapsulating all information required to launch a virtual machine, including the kernel, the initramfs, and kernel cmdline.
-The kernel cmdline contains the root hash for dm-verity that ensures the integrity of the root filesystem.
-The root filesystem contains all components of the container's runtime environment including the guest agent (C).
-
In the userland, the guest agent takes care of enforcing the runtime policy of the pod.
-While the policy is passed in during the initialization procedure via the host, the evidence for the runtime policy is part of the CPU measurements.
-During the deployment the policy is annotated to the Kubernetes Pod resources.
-On AMD SEV-SNP the hash of the policy is then added to the attestation report via the HOSTDATA field by the hypervisor.
-When provided with the policy from the Kata host, the guest agent verifies that the policy's hash matches the one in the HOSTDATA field.
-
In summary a Pod's evidence is the attestation report of the CPU that provides evidence for runtime environment and the runtime policy.
The Coordinator acts as a verifier within the Contrast deployment, configured with a Manifest that defines the reference values and serves as an appraisal policy for all pods in the deployment.
-It also pulls endorsements from hardware vendors to verify the hardware claims.
-The Coordinator operates within the cluster as a confidential container and provides similar evidence as any other Pod when it acts as an attester.
-In RATS terminology, the Coordinator's dual role is defined as a lead attester in a composite device which spans the entire deployment: Coordinator and the workload pods.
-It collects evidence from other attesters and conveys it to a verifier, generating evidence about the layout of the whole composite device based on the Manifest as the appraisal policy.
-
-
Figure 3: Contrast deployment as a composite device. Based on the composite device in RFC 9334.
-
The CLI serves as the verifier for the Coordinator and the entire Contrast deployment, containing the reference values for the Coordinator and the endorsements from hardware vendors.
-These reference values are built into the CLI during our release process and can be reproduced offline via reproducible builds.
A relying party in the Contrast scenario could be, for example, the data owner that interacts with the application.
-The relying party can use the CLI to obtain the attestation results and Contrast's CA certificates bound to these results.
-The CA certificates can then be used by the relying party to authenticate the application, for example through TLS connections.
In Contrast, attestation evidence revolves around a hardware-generated attestation report, which contains several critical pieces of information:
-
-
The hardware attestation report: This report includes details such as the chip identifier, platform information, microcode versions, and comprehensive guest measurements. The entire report is signed by the CPU's private key, ensuring the authenticity and integrity of the data provided.
-
The launch measurements: Included within the hardware attestation report, this is a digest generated by the CPU that represents a hash of all initial guest memory pages. This includes essential components like the kernel, initramfs, and the kernel command line. Notably, it incorporates the root filesystem's dm-verity root hash, verifying the integrity of the root filesystem.
-
The runtime policy hash: Also part of the hardware attestation report, this field contains the hash of the Rego policy which dictates all expected API commands and their values from the host to the Kata guest agent. It encompasses crucial settings such as dm-verity hashes for the container image layers, environment variables, and mount points.
The appraisal of this evidence in Contrast is governed by two main components:
-
-
The Manifest: A JSON file used by the Coordinator to align with reference values. It sets the expectations for runtime policy hashes for each pod and includes what should be reported in the hardware attestation report for each component of the deployment.
-
The CLI's appraisal policy: This policy encompasses expected values of the Coordinator’s guest measurements and its runtime policy. It's embedded into the CLI during the build process and ensures that any discrepancy between the built-in values and those reported by the hardware attestation can be identified and addressed. The integrity of this policy is safeguardable through reproducible builds, allowing verification against the source code reference.
-
-
Frequently asked questions about attestation in Contrast
-
What's the purpose of remote attestation in Contrast?
-
Remote attestation in Contrast ensures that software runs within a secure, isolated confidential computing environment.
-This process certifies that the memory is encrypted and confirms the integrity and authenticity of the software running within the deployment.
-By validating the runtime environment and the policies enforced on it, Contrast ensures that the system operates in a trustworthy state and hasn't been tampered with.
-
How does Contrast ensure the security of the attestation process?
-
Contrast leverages hardware-rooted security features such as AMD SEV-SNP to generate cryptographic evidence of a pod’s current state and configuration.
-This evidence is checked against pre-defined appraisal policies to guarantee that only verified and authorized pods are part of a Contrast deployment.
Attestation confirms the integrity of the runtime environment and the identity of the workloads.
-It plays a critical role in preventing unauthorized changes and detecting potential modifications at runtime.
-The attestation provides integrity and authenticity guarantees, enabling relying parties—such as workload operators or data owners—to confirm the effective protection against potential threats, including malicious cloud insiders, co-tenants, or compromised workload operators.
-More details on the specific security benefits can be found here.
-
How can you verify the authenticity of attestation results?
-
Attestation results in Contrast are tied to cryptographic proofs generated and signed by the hardware itself.
-These proofs are then verified using public keys from trusted hardware vendors, ensuring that the results aren't only accurate but also resistant to tampering.
-For further authenticity verification, all of Contrast's code is reproducibly built, and the attestation evidence can be verified locally from the source code.
-
How are attestation results used by relying parties?
-
Relying parties use attestation results to make informed security decisions, such as allowing access to sensitive data or resources only if the attestation verifies the system's integrity.
-Thereafter, the use of Contrast's CA certificates in TLS connections provides a practical approach to communicate securely with the application.
In summary, Contrast's attestation strategy adheres to the RATS guidelines and consists of robust verification mechanisms that ensure each component of the deployment is secure and trustworthy.
-This comprehensive approach allows Contrast to provide a high level of security assurance to its users.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.0, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.0
Certificate authority
-
The Coordinator acts as a certificate authority (CA) for the workloads
-defined in the manifest.
-After a workload pod's attestation has been verified by the Coordinator,
-it receives a mesh certificate and the mesh CA certificate.
-The mesh certificate can be used for example in a TLS connection as the server or
-client certificate to proof to the other party that the workload has been
-verified by the Coordinator. The other party can verify the mesh certificate
-with the mesh CA certificate. While the certificates can be used by the workload
-developer in different ways, they're automatically used in Contrast's service
-mesh to establish mTLS connections between workloads in the same deployment.
The Coordinator establishes a public key infrastructure (PKI) for all workloads
-contained in the manifest. The Coordinator holds three certificates: the root CA
-certificate, the intermediate CA certificate, and the mesh CA certificate.
-The root CA certificate is a long-lasting certificate and its private key signs
-the intermediate CA certificate. The intermediate CA certificate and the mesh CA
-certificate share the same private key. This intermediate private key is used
-to sign the mesh certificates. Moreover, the intermediate private key and
-therefore the intermediate CA certificate and the mesh CA certificate are
-rotated when setting a new manifest.
Depending on the configuration of the first manifest, it allows the workload
-owner to update the manifest and, therefore, the deployment.
-Workload owners and data owners can be mutually untrusted parties.
-To protect against the workload owner silently introducing malicious containers,
-the Coordinator rotates the intermediate private key every time the manifest is
-updated and, therefore, the
-intermediate CA certificate and mesh CA certificate. If the user doesn't
-trust the workload owner, they use the mesh CA certificate obtained when they
-verified the Coordinator and the manifest. This ensures that the user only
-connects to workloads defined in the manifest they verified since only those
-workloads' certificates are signed with this intermediate private key.
-
Similarly, the service mesh also uses the mesh CA certificate obtained when the
-workload was started, so the workload only trusts endpoints that have been
-verified by the Coordinator based on the same manifest. Consequently, a
-manifest update requires a fresh rollout of the services in the service mesh.
The root CA certificate is returned when verifying the Coordinator.
-The data owner can use it to verify the mesh certificates of the workloads.
-This should only be used if the data owner trusts all future updates to the
-manifest and workloads. This is, for instance, the case when the workload owner is
-the same entity as the data owner.
-
The mesh CA certificate is returned when verifying the Coordinator.
-The data owner can use it to verify the mesh certificates of the workloads.
-This certificate is bound to the manifest set when the Coordinator is verified.
-If the manifest is updated, the mesh CA certificate changes.
-New workloads will receive mesh certificates signed by the new mesh CA certificate.
-The Coordinator with the new manifest needs to be verified to retrieve the new mesh CA certificate.
-The service mesh also uses the mesh CA certificate to verify the mesh certificates.
-
The intermediate CA certificate links the root CA certificate to the
-mesh certificate so that the mesh certificate can be verified with the root CA
-certificate. It's part of the certificate chain handed out by
-endpoints in the service mesh.
-
The mesh certificate is part of the certificate chain handed out by
-endpoints in the service mesh. During the startup of a pod, the Initializer
-requests a certificate from the Coordinator. This mesh certificate will be returned if the Coordinator successfully
-verifies the workload. The mesh certificate
-contains X.509 extensions with information from the workloads attestation
-document.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.0, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.0
Observability
-
The Contrast Coordinator can expose metrics in the
-Prometheus format. These can be monitored to quickly
-identify problems in the gRPC layer or attestation errors. Prometheus metrics
-are numerical values associated with a name and additional key/values pairs,
-called labels.
The metrics can be accessed at the Coordinator pod at the port specified in the
-CONTRAST_METRICS_PORT environment variable under the /metrics endpoint. By
-default, this environment variable isn't specified, hence no metrics will be
-exposed.
-
The Coordinator exports gRPC metrics under the prefix contrast_grpc_server_.
-These metrics are labeled with the gRPC service name and method name.
-Metrics of interest include contrast_grpc_server_handled_total, which counts
-the number of requests by return code, and
-contrast_grpc_server_handling_seconds_bucket, which produces a histogram of
-request latency.
The meshapi.MeshAPI service records metrics for the method NewMeshCert, which
-gets called by the Initializer when starting a
-new workload. Attestation failures from workloads to the Coordinator can be
-tracked with the counter contrast_meshapi_attestation_failures_total.
-
The current manifest generation is exposed as a
-gauge with the metric
-name contrast_coordinator_manifest_generation. If no manifest is set at the
-Coordinator, this counter will be zero.
The Service Mesh can be configured to expose
-metrics via its Envoy admin
-interface. Be
-aware that the admin interface can expose private information and allows
-destructive operations to be performed. To enable the admin interface for the
-Service Mesh, set the annotation
-contrast.edgeless.systems/servicemesh-admin-interface-port in the configuration
-of your workload. If this annotation is set, the admin interface will be started
-on this port.
-
To access the admin interface, the ingress settings of the Service Mesh have to
-be configured to allow access to the specified port (see Configuring the
-Proxy). All metrics will be
-exposed under the /stats endpoint. Metrics in Prometheus format can be scraped
-from the /stats/prometheus endpoint.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.0, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.0
Secrets & recovery
-
When the Coordinator is configured with the initial manifest, it generates a random secret seed.
-From this seed, it uses an HKDF to derive the CA root key and a signing key for the manifest history.
-This derivation is deterministic, so the seed can be used to bring any Coordinator to this Coordinator's state.
-
The secret seed is returned to the user on the first call to contrast set, encrypted with the user's public seed share owner key.
-If no seed share owner key is provided, a key is generated and stored in the working directory.
The Coordinator runs as a StatefulSet with a dynamically provisioned persistent volume.
-This volume stores the manifest history and the associated runtime policies.
-The manifest isn't considered sensitive information, because it needs to be passed to the untrusted infrastructure in order to start workloads.
-However, the Coordinator must ensure its integrity and that the persisted data corresponds to the manifests set by authorized users.
-Thus, the manifest is stored in plain text, but is signed with a private key derived from the Coordinator's secret seed.
When a Coordinator starts up, it doesn't have access to the signing secret and can thus not verify the integrity of the persisted manifests.
-It needs to be provided with the secret seed, from which it can derive the signing key that verifies the signatures.
-This procedure is called recovery and is initiated by the workload owner.
-The CLI decrypts the secret seed using the private seed share owner key, verifies the Coordinator and sends the seed through the Recover method.
-The Coordinator recovers its key material and verifies the manifest history signature.
The Coordinator provides each workload a secret seed during attestation. This secret can be used by the workload to derive additional secrets for example to
-encrypt persistent data. Like the workload certificates it's mounted in the shared Kubernetes volume contrast-secrets in the path <mountpoint>/secrets/workload-secret-seed.
-
warning
The workload owner can decrypt data encrypted with secrets derived from the workload secret.
-The workload owner can derive the workload secret themselves, since it's derived from the secret seed known to the workload owner.
-If the data owner and the workload owner is the same entity, then they can safely use the workload secrets.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.0, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.0
Confidential Containers
-
Contrast uses some building blocks from Confidential Containers (CoCo), a CNCF Sandbox project that aims to standardize confidential computing at the pod level.
-The project is under active development and many of the high-level features are still in flux.
-Contrast uses the more stable core primitive provided by CoCo: its Kubernetes runtime.
Kubernetes can be extended to use more than one container runtime with RuntimeClass objects.
-The Container Runtime Interface (CRI) implementation, for example containerd, dispatches pod management API calls to the appropriate RuntimeClass.
-RuntimeClass implementations are usually based on an OCI runtime, such as runc, runsc or crun.
-In CoCo's case, the runtime is Kata Containers with added confidential computing capabilities.
Kata Containers is an OCI runtime that runs pods in VMs.
-The pod VM spawns an agent process that accepts management commands from the Kata runtime running on the host.
-There are two options for creating pod VMs: local to the Kubernetes node, or remote VMs created with cloud provider APIs.
-Using local VMs requires either bare-metal servers or VMs with support for nested virtualization.
-Local VMs communicate with the host over a virtual socket.
-For remote VMs, host-to-agent communication is tunnelled through the cloud provider's network.
-
Kata Containers was originally designed to isolate the guest from the host, but it can also run pods in confidential VMs (CVMs) to shield pods from their underlying infrastructure.
-In confidential mode, the guest agent is configured with an Open Policy Agent (OPA) policy to authorize API calls from the host.
-This policy also contains checksums for the expected container images.
-It's derived from Kubernetes resource definitions and its checksum is included in the attestation report.
Azure Kubernetes Service (AKS) provides CoCo-enabled node pools as a preview offering.
-These node pools leverage Azure VM types capable of nested virtualization (CVM-in-VM) and the CoCo stack is pre-installed.
-Contrast can be deployed directly into a CoCo-enabled AKS cluster.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.0, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.0
Product features
-
Contrast simplifies the deployment and management of Confidential Containers, offering optimal data security for your workloads while integrating seamlessly with your existing Kubernetes environment.
-
From a security perspective, Contrast employs the Confidential Containers concept and provides security benefits that go beyond individual containers, shielding your entire deployment from the underlying infrastructure.
-
From an operational perspective, Contrast provides the following key features:
-
-
-
Managed Kubernetes compatibility: Initially compatible with Azure Kubernetes Service (AKS), Contrast is designed to support additional platforms such as AWS EKS and Google Cloud GKE as they begin to accommodate confidential containers.
-
-
-
Lightweight installation: Contrast can be integrated as a day-2 operation within existing clusters, adding minimal components to your setup. This facilitates straightforward deployments using your existing YAML configurations, Helm charts, or Kustomization, enabling native Kubernetes orchestration of your applications.
-
-
-
Remote attestation: Contrast generates a concise attestation statement that verifies the identity, authenticity, and integrity of your deployment both internally and to external parties. This architecture ensures that updates or scaling of the application don't compromise the attestation’s validity.
-
-
-
Service mesh: Contrast securely manages a Public Key Infrastructure (PKI) for your deployments, issues workload-specific certificates, and establishes transparent mutual TLS (mTLS) connections across pods. This is done by harnessing the envoy proxy to ensure secure communications within your Kubernetes cluster.
-
-
-
-
\ No newline at end of file
diff --git a/pr-preview/pr-1071/1.0/basics/security-benefits.html b/pr-preview/pr-1071/1.0/basics/security-benefits.html
deleted file mode 100644
index bebabbea8f..0000000000
--- a/pr-preview/pr-1071/1.0/basics/security-benefits.html
+++ /dev/null
@@ -1,116 +0,0 @@
-
-
-
-
-
-Contrast security overview | Contrast
-
-
-
-
-
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.0, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.0
Contrast security overview
-
This document outlines the security measures of Contrast and its capability to counter various threats.
-Contrast is designed to shield entire Kubernetes deployments from the infrastructure, enabling entities to manage sensitive information (such as regulated or personally identifiable information (PII)) in the public cloud, while maintaining data confidentiality and ownership.
-
Contrast is applicable in situations where establishing trust with the workload operator or the underlying infrastructure is challenging.
-This is particularly beneficial for regulated sectors looking to transition sensitive activities to the cloud, without sacrificing security or compliance.
-It allows for cloud adoption by maintaining a hardware-based separation from the cloud service provider.
Leveraging Confidential Computing technology, Contrast provides three defining security properties:
-
-
Encryption of data in use: Contrast ensures that all data processed in memory is encrypted, making it inaccessible to unauthorized users or systems, even if they have physical access to the hardware.
-
Workload isolation: Each pod runs in its isolated runtime environment, preventing any cross-contamination between workloads, which is critical for multi-tenant infrastructures.
-
Remote attestation: This feature allows data owners and workload operators to verify that the Contrast environment executing their workloads hasn't been tampered with and is running in a secure, pre-approved configuration.
-
-
The runtime encryption is transparently provided by the confidential computing hardware during the workload's lifetime.
-The workload isolation and remote attestation involves two phases:
-
-
An attestation process detects modifications to the workload image or its runtime environment during the initialization. This protects the workload's integrity pre-attestation.
-
A protected runtime environment and a policy mechanism prevents the platform operator from accessing or compromising the instance at runtime. This protects a workload's integrity and confidentiality post-attestation.
-
-
For more details on confidential computing see our whitepaper.
-The attestation architecture describes Contrast's attestation process and the resulting chain of trust in detail.
Contrast uses the Kubernetes runtime of the Confidential Containers project.
-Confidential Containers significantly decrease the size of the trusted computing base (TCB) of a Kubernetes deployment, by isolating each pod within its own confidential micro-VM environment.
-The TCB is the totality of elements in a computing environment that must be trusted not to be compromised.
-A smaller TCB results in a smaller attack surface. The following diagram shows how Confidential Containers remove the cloud & datacenter infrastructure and the physical hosts, including the hypervisor, the host OS, the Kubernetes control plane, and other components, from the TCB (red).
-In the confidential context, depicted in green, only the workload containers along with their confidential micro-VM environment are included within the TCB.
-Their integrity is verifiable through remote attestation.
-
Contrast uses hardware-based mechanisms, specifically leveraging CPU features, such as AMD SEV or Intel TDX, to provide the isolation of the workload.
-This implies that both the CPU and its microcode are integral components of the TCB.
-However, it should be noted that the CPU microcode aspects aren't depicted in the accompanying graphic.
-
-
Contrast adds the following components to a deployment that become part of the TCB.
-The components that are part of the TCB are:
-
-
The workload containers: Container images that run the actual application.
The runtime policies: Policies that enforce the runtime environments for the workload containers during their lifetime.
-
The manifest: A manifest file defining the reference values of an entire confidential deployment. It contains the policy hashes for all pods of the deployment and the expected hardware reference values for the Confidential Container runtime.
-
The Coordinator: An attestation service that runs in a Confidential Container in the Kubernetes cluster. The Coordinator is configured with the manifest. User-facing, you can verify this service and the effective manifest using remote attestation, providing you with a concise attestation for the entire deployment. Cluster-facing, it verifies all pods and their policies based on remote attestation procedures and the manifest.
In a Contrast deployment, there are three parties:
-
-
-
The container image provider, who creates the container images that represent the application that has access to the protected data.
-
-
-
The workload operator, who runs the workload in a Kubernetes cluster. The operator typically has full administrative privileges to the deployment. The operator can manage cluster resources such as nodes, volumes, and networking rules, and the operator can interact with any Kubernetes or underlying cloud API.
-
-
-
The data owner, who owns the protected data. A data owner can verify the deployment using the Coordinator attestation service. The verification includes the identity, integrity, and confidentiality of the workloads, the runtime environment and the access permissions.
-
-
-
Contrast supports a trust model where the container image provider, workload operator, and data owner are separate, mutually distrusting parties.
-
The following diagram shows the system components and parties.
Contrast is designed to defend against five possible attacks:
-
-
A malicious cloud insider: malicious employees or third-party contractors of cloud service providers (CSPs) potentially have full access to various layers of the cloud infrastructure. That goes from the physical datacenter up to the hypervisor and Kubernetes layer. For example, they can access the physical memory of the machines, modify the hypervisor, modify disk contents, intercept network communications, and attempt to compromise the confidential container at runtime. A malicious insider can expand the attack surface or restrict the runtime environment. For example, a malicious operator can add a storage device to introduce new attack vectors. As another example, a malicious operator can constrain resources such as limiting a guest's memory size, changing its disk space, or changing firewall rules.
-
A malicious cloud co-tenant: malicious cloud user ("hackers") may break out of their tenancy and access other tenants' data. Advanced attackers may even be able to establish a permanent foothold within the infrastructure and access data over a longer period. The threats are analogous to the cloud insider access scenario, without the physical access.
-
A malicious workload operator: malicious workload operators, for example Kubernetes administrators, have full access to the workload deployment and the underlying Kubernetes platform. The threats are analogously to the cloud insider access scenario, with access to everything that's above the hypervisor level.
-
A malicious attestation client: this attacker connects to the attestation service and sends malformed request.
-
A malicious container image provider: a malicious container image provider has full control over the application development itself. This attacker might release a malicious version of the workload containing harmful operations.
Contrast shields a workload from the aforementioned threats with three main components:
-
-
The runtime environment safeguards against the physical memory and disk attack surface.
-
The runtime policies safeguard against the Kubernetes control plane and container runtime attack surface.
-
The service mesh safeguards against the network attack surface.
-
-
The following tables describe concrete threats and how they're mitigated in Contrast grouped by these categories:
-
-
Attacks on the confidential container environment
-
Attacks on the attestation service
-
Attacks on workloads
-
-
Attacks on the confidential container environment
-
This table describes potential threats and mitigation strategies related to the confidential container environment.
-
Threat
Mitigation
Mitigation implementation
An attacker intercepts the network connection of the launcher or image repository.
An attacker can change the image URL and control the workload binary. However these actions are reflected in the attestation report. The image repository isn't controlled using an access list, therefore the image is assumed to be viewable by everyone. You must ensure that the workload container image doesn't contain any secrets.
An attacker modifies a container's runtime environment configuration in the Kubernetes control plane.
The attestation process and the runtime policies detects unsafe configurations that load non-authentic images or perform any other modification to the expected runtime environment.
This table describes potential threats and mitigation strategies to the attestation service.
-
Threat
Mitigation
Mitigation implementation
An attacker intercepts the Coordinator deployment and modifies the image or hijacks the runtime environment.
This threat is mitigated by having an attestation procedure and attested, encrypted TLS connections to the Coordinator. The attestation evidence for the Coordinator image is distributed with our releases, protected by supply chain security, and fully reproducible.
An attacker intercepts the network connection between the workload and the Coordinator and reads secret keys from the wire.
This threat is mitigated by having an attested, encrypted TLS connection. This connection helps protect the secrets from passive eavesdropping. The attacker can't create valid workload certificates that would be accepted in Contrast's service mesh. An attacker can't impersonate a valid workload container because the container's identity is guaranteed by the attestation protocol.
Within the network between your workload and the Coordinator.
An attacker exploits parsing discrepancies, which leads to undetected changes in the attestation process.
This risk is mitigated by having a parsing engine written in memory-safe Go that's tested against the attestation specification of the hardware vendor. The runtime policies are available as an attestation artifact for further inspection and audits to verify their effectiveness.
An attacker reads or modifies data written to disk via persistent volumes.
Currently, persistent volumes aren't supported in Contrast. In the future, this threat is mitigated by encrypted and integrity-protected volume mounts.
An attacker publishes a new image version containing malicious code.
The attestation process and the runtime policies require a data owner to accept a specific version of the workload and any update to the workload needs to be explicitly acknowledged.
The following table describes three example use cases and how they map to the defined threat model in this document:
-
Use Case
Example Scenario
Migrate sensitive workloads to the cloud
TechSolve Inc., a software development firm, aimed to enhance its defense-in-depth strategy for its cloud-based development environment, especially for projects involving proprietary algorithms and client data. TechSolve acts as the image provider, workload operator, and data owner, combining all three personas in this scenario. In our attestation terminology, they're the workload operator and relying party in one entity. Their threat model includes a malicious cloud insider and cloud co-tenant.
Make your SaaS more trustworthy
SaaSProviderX, a company offering cloud-based project management tools, sought to enhance its platform's trustworthiness amidst growing concerns about data breaches and privacy. Here, the relying party is the SaaS customer as the data owner. The goal is to achieve a form of operator exclusion and only allow selective operations on the deployment. Hence, their threat model includes a malicious workload operator.
Simplify regulatory compliance
HealthSecure Inc. has been managing a significant volume of sensitive patient data on-premises. With the increasing demand for advanced data analytics and the need for scalable infrastructure, the firm decides to migrate its data analytics operations to the cloud. However, the primary concern is maintaining the confidentiality and security of patient data during and after the migration, in compliance with healthcare regulations. In this compliance scenario, the regulator serves as an additional relying party. HealthSecure must implement a mechanism that ensures the isolation of patient data can be verifiably guaranteed to the regulator.
-
In each scenario, Contrast ensures exclusive data access and processing capabilities are confined to the designated workloads. It achieves this by effectively isolating the workload from the infrastructure and other components of the stack. Data owners are granted the capability to audit and approve the deployment environment before submitting their data, ensuring a secure handover. Meanwhile, workload operators are equipped to manage and operate the application seamlessly, without requiring direct access to either the workload or its associated data.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.0, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.0
Components
-
Contrast is composed of several key components that work together to manage and scale confidential containers effectively within Kubernetes environments.
-This page provides an overview of the core components essential for deploying and managing Contrast.
The CLI serves as the primary management tool for Contrast deployments. It's designed to streamline the configuration and operation of Contrast in several ways:
-
-
Installation and setup: The CLI facilitates the installation of the necessary runtime classes required for Contrast to function within a Kubernetes cluster.
-
Policy generation: It allows users to generate runtime policies, adapt the deployment files, and generate the Contrast manifest.
-
Configuration management: Through the CLI, users can configure the Contrast Coordinator with the generated manifest.
-
Verification and attestation: The CLI provides tools to verify the integrity and authenticity of the Coordinator and the entire deployment via remote attestation.
The Contrast Coordinator is the central remote attestation service of a Contrast deployment.
-It runs inside a confidential container inside your cluster.
-The Coordinator can be verified via remote attestation, and a Contrast deployment is self-contained.
-The Coordinator is configured with a manifest, a configuration file containing the reference attestation values of your deployment.
-It ensures that your deployment's topology adheres to your specified manifest by verifying the identity and integrity of all confidential pods inside the deployment.
-The Coordinator is also a certificate authority and issues certificates for your workload pods during the attestation procedure.
-Your workload pods can establish secure, encrypted communication channels between themselves based on these certificates using the Coordinator as the root CA.
-As your app needs to scale, the Coordinator transparently verifies new instances and then provides them with their certificates to join the deployment.
-
To verify your deployment, the Coordinator's remote attestation statement combined with the manifest offers a concise single remote attestation statement for your entire deployment.
-A third party can use this to verify the integrity of your distributed app, making it easy to assure stakeholders of your app's identity and integrity.
The manifest is the configuration file for the Coordinator, defining your confidential deployment.
-It's automatically generated from your deployment by the Contrast CLI.
-It currently consists of the following parts:
-
-
Policies: The identities of your Pods, represented by the hashes of their respective runtime policies.
-
Reference Values: The remote attestation reference values for the Kata confidential micro-VM that's the runtime environment of your Pods.
-
WorkloadOwnerKeyDigest: The workload owner's public key digest. Used for authenticating subsequent manifest updates.
Runtime Policies are a mechanism to enable the use of the untrusted Kubernetes API for orchestration while ensuring the confidentiality and integrity of your confidential containers.
-They allow us to enforce the integrity of your containers' runtime environment as defined in your deployment files.
-The runtime policy mechanism is based on the Open Policy Agent (OPA) and translates the Kubernetes deployment YAML into the Rego policy language of OPA.
-The Kata Agent inside the confidential micro-VM then enforces the policy by only acting on permitted requests.
-The Contrast CLI provides the tooling for automatically translating Kubernetes deployment YAML into the Rego policy language of OPA.
Contrast provides an Initializer that handles the remote attestation on the workload side transparently and
-fetches the workload certificate. The Initializer runs as an init container before your workload is started.
-It provides the workload container and the service mesh sidecar with the workload certificates.
Contrast depends on a Kubernetes runtime class, which is installed
-by the node-installer DaemonSet.
-This runtime consists of a containerd runtime plugin, a virtual machine manager (cloud-hypervisor), and a podvm image (IGVM and rootFS).
-The installer takes care of provisioning every node in the cluster so it provides this runtime class.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.0, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.0
Policies
-
Kata runtime policies are an integral part of the Confidential Containers preview on AKS.
-They prescribe how a Kubernetes pod must be configured to launch successfully in a confidential VM.
-In Contrast, policies act as a workload identifier: only pods with a policy registered in the manifest receive workload certificates and may participate in the confidential deployment.
-Verification of the Contrast Coordinator and its manifest transitively guarantees that all workloads meet the owner's expectations.
The Kata agent running in the confidential micro-VM exposes an RPC service AgentService to the Kata runtime.
-This service handles potentially untrustworthy requests from outside the TCB, which need to be checked against a policy.
-
Kata runtime policies are written in the policy language Rego.
-They specify what AgentService methods can be called, and the permissible parameters for each call.
-
Policies consist of two parts: a list of rules and a data section.
-While the list of rules is static, the data section is populated with information from the PodSpec and other sources.
Runtime policies are programmatically generated from Kubernetes manifests by the Contrast CLI.
-The generate subcommand inspects pod definitions and derives rules for validating the pod at the Kata agent.
-There are two important integrity checks: container image checksums and OCI runtime parameters.
-
For each of the container images used in a pod, the CLI downloads all image layers and produces a cryptographic dm-verity checksum.
-These checksums are the basis for the policy's storage data.
-
The CLI combines information from the PodSpec, ConfigMaps, and Secrets in the provided Kubernetes manifests to derive a permissible set of command-line arguments and environment variables.
-These constitute the policy's OCI data.
The generated policy document is annotated to the pod definitions in Base64 encoding.
-This annotation is propagated to the Kata runtime, which calculates the SHA256 checksum for the policy and uses that as SNP HOSTDATA for the confidential micro-VM.
-
After the VM launched, the runtime calls the agent's SetPolicy method with the full policy document.
-If the policy doesn't match the checksum in HOSTDATA, the agent rejects the policy.
-Otherwise, it applies the policy to all future AgentService requests.
Contrast verifies its confidential containers following these steps:
-
-
The Contrast CLI generates a policy and attaches it to the pod definition.
-
Kubernetes schedules the pod on a node with the confidential computing runtime.
-
Containerd invokes the Kata runtime to create the pod sandbox.
-
The Kata runtime starts a CVM with the policy's digest as HOSTDATA.
-
The Kata runtime sets the policy using the SetPolicy method.
-
The Kata agent verifies that the incoming policy's digest matches HOSTDATA.
-
The CLI sets a manifest in the Contrast Coordinator, including a list of permitted policies.
-
The Contrast Initializer sends an attestation report to the Contrast Coordinator, asking for a mesh certificate.
-
The Contrast Coordinator verifies that the started pod has a permitted policy hash in its HOSTDATA field.
-
-
After the last step, we know that the policy hasn't been tampered with and, thus, that the workload matches expectations and may receive mesh certificates.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.0, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.0
Contrast Runtime
-
The Contrast runtime is responsible for starting pods as confidential virtual machines.
-This works by specifying the runtime class to be used in a pod spec and by registering the runtime class with the apiserver.
-The RuntimeClass resource defines a name for referencing the class and
-a handler used by the container runtime (containerd) to identify the class.
-
apiVersion: node.k8s.io/v1 kind: RuntimeClass metadata: # This name is used by pods in the runtimeClassName field name: contrast-cc-abcdef # This name is used by the # container runtime interface implementation (containerd) handler: contrast-cc-abcdef
-
Confidential pods that are part of a Contrast deployment need to specify the
-same runtime class in the runtimeClassName field, so Kubernetes uses the
-Contrast runtime instead of the default containerd / runc handler.
-
apiVersion: v1 kind: Pod spec: runtimeClassName: contrast-cc-abcdef # ...
The runtime consists of additional software components that need to be installed
-and configured on every SEV-SNP-enabled worker node.
-This installation is performed automatically by the node-installer DaemonSet.
The handler field in the Kubernetes RuntimeClass instructs containerd not to use the default runc implementation.
-Instead, containerd invokes a custom plugin called containerd-shim-contrast-cc-v2.
-This shim is described in more detail in the upstream source repository and in the containerd documentation.
The containerd shim uses cloud-hypervisor to create a confidential virtual machine for every pod.
-This requires the cloud-hypervisor binary to be installed on every node (responsibility of the node-installer).
Contrast uses a special containerd snapshotter (tardev) to provide container images as block devices to the pod-VM. This snapshotter consists of a host component that pulls container images and a guest component (kernel module) used to mount container images.
-The tardev snapshotter uses dm-verity to protect the integrity of container images.
-Expected dm-verity container image hashes are part of Contrast runtime policies and are enforced by the kata-agent.
-This enables workload attestation by specifying the allowed container image as part of the policy. Read the chapter on policies for more information.
Every pod-VM starts with the same guest image. It consists of an IGVM file and a root filesystem.
-The IGVM file describes the initial memory contents of a pod-VM and consists of:
-
-
Linux kernel image
-
initrd
-
kernel commandline
-
-
Additionally, a root filesystem image is used that contains a read-only partition with the user space of the pod-VM and a verity partition to guarantee the integrity of the root filesystem.
-The root filesystem contains systemd as the init system, and the kata agent for managing the pod.
-
This pod-VM image isn't specific to any pod workload. Instead, container images are mounted at runtime.
The RuntimeClass resource above registers the runtime with the Kubernetes api.
-The node-level installation is carried out by the Contrast node-installer
-DaemonSet that ships with every Contrast release.
-
After deploying the installer, it performs the following steps on each node:
-
-
Install the Contrast containerd shim (containerd-shim-contrast-cc-v2)
-
Install cloud-hypervisor as the virtual machine manager (VMM)
-
Install an IGVM file for pod-VMs of this class
-
Install a read only root filesystem disk image for the pod-VMs of this class
-
Reconfigure containerd by adding a runtime plugin that corresponds to the handler field of the Kubernetes RuntimeClass
-
Restart containerd to make it aware of the new plugin
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.0, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.0
Service mesh
-
The Contrast service mesh secures the communication of the workload by automatically
-wrapping the network traffic inside mutual TLS (mTLS) connections. The
-verification of the endpoints in the connection establishment is based on
-certificates that are part of the
-PKI of the Coordinator.
-
The service mesh can be enabled on a per-workload basis by adding a service mesh
-configuration to the workload's object annotations. During the contrast generate
-step, the service mesh is added as a sidecar
-container to
-all workloads which have a specified configuration. The service mesh container first
-sets up iptables rules based on its configuration and then starts
-Envoy for TLS origination and termination.
The service mesh container can be configured using the following object annotations:
-
-
contrast.edgeless.systems/servicemesh-ingress to configure ingress.
-
contrast.edgeless.systems/servicemesh-egress to configure egress.
-
contrast.edgeless.systems/servicemesh-admin-interface-port to configure the Envoy
-admin interface. If not specified, no admin interface will be started.
-
-
If you aren't using the automatic service mesh injection and want to configure the
-service mesh manually, set the environment variables CONTRAST_INGRESS_PROXY_CONFIG,
-CONTRAST_EGRESS_PROXY_CONFIG and CONTRAST_ADMIN_PORT in the service mesh sidecar directly.
All TCP ingress traffic is routed over Envoy by default. Since we use
-TPROXY, the destination address
-remains the same throughout the packet handling.
-
Any incoming connection is required to present a client certificate signed by the
-mesh CA certificate.
-Envoy presents a certificate chain of the mesh
-certificate of the workload and the intermediate CA certificate as the server certificate.
-
If the deployment contains workloads which should be reachable from outside the
-Service Mesh, while still handing out the certificate chain, disable client
-authentication by setting the annotation contrast.edgeless.systems/servicemesh-ingress as
-<name>#<port>#false. Separate multiple entries with ##. You can choose any
-descriptive string identifying the service on the given port for the <name> field,
-as it's only informational.
-
Disable redirection and TLS termination altogether by specifying
-<name>#<port>#true. This can be beneficial if the workload itself handles TLS
-on that port or if the information exposed on this port is non-sensitive.
-
The following example workload exposes a web service on port 8080 and metrics on
-port 7890. The web server is exposed to a 3rd party end-user which wants to
-verify the deployment, therefore it's still required that the server hands out
-it certificate chain signed by the mesh CA certificate. The metrics should be
-exposed via TCP without TLS.
Note, that changing the environment variables of the sidecar container directly will
-only have an effect if the workload isn't configured to automatically generate a
-service mesh component on contrast generate. Otherwise, the service mesh sidecar
-container will be regenerated on every invocation of the command.
To be able to route the egress traffic of the workload through Envoy, the remote
-endpoints' IP address and port must be configurable.
-
-
Choose an IP address inside the 127.0.0.0/8 CIDR and a port not yet in use
-by the pod.
-
Configure the workload to connect to this IP address and port.
-
Set <name>#<chosen IP>:<chosen port>#<original-hostname-or-ip>:<original-port>
-as the contrast.edgeless.systems/servicemesh-egress workload annotation. Separate multiple
-entries with ##. Choose any string identifying the service on the given port as
-<name>.
-
-
This redirects the traffic over Envoy. The endpoint must present a valid
-certificate chain which must be verifiable with the
-mesh CA certificate.
-Furthermore, Envoy uses a certificate chain with the mesh certificate of the workload
-and the intermediate CA certificate as the client certificate.
-
The following example workload has no ingress connections and two egress
-connection to different microservices. The microservices are part
-of the confidential deployment. One is reachable under billing-svc:8080 and
-the other under cart-svc:8080.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.0, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.0
Workload deployment
-
The following instructions will guide you through the process of making an existing Kubernetes deployment
-confidential and deploying it together with Contrast.
-
A running CoCo-enabled cluster is required for these steps, see the setup guide on how to set it up.
Contrast depends on a custom Kubernetes RuntimeClass (contrast-cc),
-which needs to be installed in the cluster prior to the Coordinator or any confidential workloads.
-This consists of a RuntimeClass resource and a DaemonSet that performs installation on worker nodes.
-This step is only required once for each version of the runtime.
-It can be shared between Contrast deployments.
Your Kubernetes resources need some modifications to run as Confidential Containers.
-This section guides you through the process and outlines the necessary changes.
Contrast will add annotations to your Kubernetes YAML files. If you want to keep the original files
-unchanged, you can copy the files into a separate local directory.
-You can also generate files from a Helm chart or from a Kustomization.
To specify that a workload (pod, deployment, etc.) should be deployed as confidential containers,
-add runtimeClassName: contrast-cc to the pod spec (pod definition or template).
-This is a placeholder name that will be replaced by a versioned runtimeClassName when generating policies.
In the initialization process, the contrast-secrets shared volume is populated with X.509 certificates for your workload.
-These certificates are used by the Contrast Service Mesh, but can also be used by your application directly.
-The following tab group explains the setup for both scenarios.
-
Drop-in service mesh
Go integration
Contrast can be configured to handle TLS in a sidecar container.
-This is useful for workloads that are hard to configure with custom certificates, like Java applications.
Configuration of the sidecar depends heavily on the application.
-The following example is for an application with these properties:
-
The container has a main application at TCP port 8001, which should be TLS-wrapped and doesn't require client authentication.
-
The container has a metrics endpoint at TCP port 8080, which should be accessible in plain text.
-
All other endpoints require client authentication.
-
The app connects to a Kubernetes service backend.default:4001, which requires client authentication.
During the generate step, this configuration will be translated into a Service Mesh sidecar container which handles TLS connections automatically.
-The only change required to the app itself is to let it connect to 127.0.0.2:4001 to reach the backend service.
-You can find more detailed documentation in the Service Mesh chapter.
The mesh certificate contained in certChain.pem authenticates this workload, while the mesh CA certificate mesh-ca.pem authenticates its peers.
-Your app should turn on client authentication to ensure peers are running as confidential containers, too.
-See the Certificate Authority section for detailed information about these certificates.
The following example shows how to configure a Golang app, with error handling omitted for clarity.
Run the generate command to add the necessary components to your deployment files.
-This will add the Contrast Initializer to every workload with the specified contrast-cc runtime class
-and the Contrast Service Mesh to all workloads that have a specified configuration.
-After that, it will generate the execution policies and add them as annotations to your deployment files.
-A manifest.json with the reference values of your deployment will be created.
Please be aware that runtime policies currently have some blind spots. For example, they can't guarantee the starting order of containers. See the current limitations for more details.
-
If you don't want the Contrast Initializer to automatically be added to your
-workloads, there are two ways you can skip the Initializer injection step,
-depending on how you want to customize your deployment.
-
Command-line flag
Per-workload annotation
You can disable the Initializer injection completely by specifying the
---skip-initializer flag in the generate command.
If you want to disable the Initializer injection for a specific workload with
-the contrast-cc runtime class, you can do so by adding an annotation to the workload.
When disabling the automatic Initializer injection, you can manually add the
-Initializer as a sidecar container to your workload before generating the
-policies. Configure the workload to use the certificates written to the
-contrast-secretsvolumeMount.
For the next steps, we will need to connect to the Coordinator. The released Coordinator resource
-includes a LoadBalancer definition we can use.
-
coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}')
-
Port-forwarding of Confidential Containers
kubectl port-forward uses a Container Runtime Interface (CRI) method that isn't supported by the Kata shim.
-If you can't use a public load balancer, you can deploy a port-forwarder.
-The port-forwarder relays traffic from a CoCo pod and can be accessed via kubectl port-forward.
This will use the reference values from the manifest file to attest the Coordinator.
-After this step, the Coordinator will start issuing TLS certificates to the workloads. The init container
-will fetch a certificate for the workload and the workload is started.
An end user (data owner) can verify the Contrast deployment using the verify command.
-
contrast verify -c"${coordinator}:1313"
-
The CLI will attest the Coordinator using the reference values from the given manifest file. It will then write the
-service mesh root certificate and the history of manifests into the verify/ directory. In addition, the policies
-referenced in the active manifest are also written to the directory. The verification will fail if the active
-manifest at the Coordinator doesn't match the manifest passed to the CLI.
You can securely connect to the workloads using the Coordinator's mesh-ca.pem as a trusted CA certificate.
-First, expose the service on a public IP address via a LoadBalancer service:
By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed
-via load balancer IP in this demo. Tools like curl check the certificate for IP entries in the SAN field.
-Validation fails since the certificate contains no IP entries as a subject alternative name (SAN).
-For example, a connection attempt using the curl and the mesh CA certificate with throw the following error:
$ curl--cacert ./verify/mesh-ca.pem "https://${frontendIP}:443" curl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34'
-
Using openssl, the certificate of the service can be validated with the mesh-ca.pem:
If the Contrast Coordinator restarts, it enters recovery mode and waits for an operator to provide key material.
-For demonstration purposes, you can simulate this scenario by deleting the Coordinator pod.
-
kubectl delete pod -l app.kubernetes.io/name=coordinator
-
Kubernetes schedules a new pod, but that pod doesn't have access to the key material the previous pod held in memory and can't issue certificates for workloads yet.
-You can confirm this by running verify again, or you can restart a workload pod, which should stay in the initialization phase.
-However, the secret seed in your working directory is sufficient to recover the coordinator.
-
contrast recover -c"${coordinator}:1313"
-
Now that the Coordinator is recovered, all workloads should pass initialization and enter the running state.
-You can now verify the Coordinator again, which should return the same manifest you set before.
-
warning
The recovery process invalidates the mesh CA certificate:
-existing workloads won't be able to communicate with workloads newly spawned.
-All workloads should be restarted after the recovery succeeded.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.0, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.0
Confidential emoji voting
-
-
This tutorial guides you through deploying emojivoto as a
-confidential Contrast deployment and validating the deployment from a voters perspective.
-
Emojivoto is an example app allowing users to vote for different emojis and view votes
-on a leader board. It has a microservice architecture consisting of a
-web frontend (web), a gRPC backend for listing available emojis (emoji), and a backend for
-the voting and leader board logic (voting). The vote-bot simulates user traffic by submitting
-votes to the frontend.
Using a voting service, users' votes are considered highly sensitive data, as we require
-a secret ballot. Also, users are likely interested in the fairness of the ballot. For
-both requirements, we can use Confidential Computing and, specifically, workload attestation
-to prove to those interested in voting that the app is running in a protected environment
-where their votes are processed without leaking to the platform provider or workload owner.
Contrast depends on a custom Kubernetes RuntimeClass (contrast-cc),
-which needs to be installed in the cluster prior to the Coordinator or any confidential workloads.
-This consists of a RuntimeClass resource and a DaemonSet that performs installation on worker nodes.
-This step is only required once for each version of the runtime.
-It can be shared between Contrast deployments.
Run the generate command to generate the execution policies and add them as
-annotations to your deployment files. A manifest.json file with the reference values
-of your deployment will be created:
The deployment YAML shipped for this demo is already configured to be used with Contrast.
-A runtime classcontrast-cc-<platform>-<runtime-hash>
-was added to the pods to signal they should be run as Confidential Containers. During the generation process,
-the Contrast Initializer will be added as an init container to these
-workloads to facilitate the attestation and certificate pulling before the actual workload is started.
Further, the deployment YAML is also configured with the Contrast service mesh.
-The configured service mesh proxy provides transparent protection for the communication between
-the different components of emojivoto.
Configure the coordinator with a manifest. It might take up to a few minutes
-for the load balancer to be created and the Coordinator being available.
-
coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') echo"The user API of your Contrast Coordinator is available at $coordinator:1313" contrast set-c"${coordinator}:1313" deployment/
-
The CLI will use the reference values from the manifest to attest the Coordinator deployment
-during the TLS handshake. If the connection succeeds, it's ensured that the Coordinator
-deployment hasn't been tampered with.
Now that the coordinator has a manifest set, which defines the emojivoto deployment as an allowed workload,
-we can deploy the application:
-
kubectl apply -f deployment/
-
Inter-deployment communication
The Contrast Coordinator issues mesh certificates after successfully validating workloads.
-These certificates can be used for secure inter-deployment communication. The Initializer
-sends an attestation report to the Coordinator, retrieves certificates and a private key in return
-and writes them to a volumeMount. The service mesh sidecar is configured to use the credentials
-from the volumeMount when communicating with other parts of the deployment over mTLS.
-The public facing frontend for voting uses the mesh certificate without client authentication.
As voters, we want to verify the fairness and confidentiality of the deployment before
-deciding to vote. Regardless of the scale of our distributed deployment, Contrast only
-needs a single remote attestation step to verify the deployment. By doing remote attestation
-of the Coordinator, we transitively verify those systems the Coordinator has already attested
-or will attest in the future. Successful verification of the Coordinator means that
-we can be sure it will enforce the configured manifest.
The CLI will attest the Coordinator using the reference values from a given manifest. This manifest needs
-to be communicated out of band to everyone wanting to verify the deployment, as the verify command checks
-if the currently active manifest at the Coordinator matches the manifest given to the CLI. If the command succeeds,
-the Coordinator deployment was successfully verified to be running in the expected Confidential
-Computing environment with the expected code version. The Coordinator will then return its
-configuration over the established TLS channel. The CLI will store this information, namely the root
-certificate of the mesh (mesh-ca.pem) and the history of manifests, into the verify/ directory.
-In addition, the policies referenced in the manifest history are also written into the same directory.
In the next step, the Coordinator configuration that was written by the verify command needs to be audited.
-A potential voter should inspect the manifest and the referenced policies. They could delegate
-this task to an entity they trust.
After ensuring the configuration of the Coordinator fits the expectation, you can securely connect
-to the workloads using the Coordinator's mesh-ca.pem as a trusted CA certificate.
-
To access the web frontend, expose the service on a public IP address via a LoadBalancer service:
-
frontendIP=$(kubectl get svc web-svc -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') echo"Frontend is available at https://$frontendIP, you can visit it in your browser."
-
Using openssl, the certificate of the service can be validated with the mesh-ca.pem:
By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed
-via load balancer IP in this demo. Tools like curl check the certificate for IP entries in the subject alternative name (SAN) field.
-Validation fails since the certificate contains no IP entries as a SAN.
-For example, a connection attempt using the curl and the mesh CA certificate with throw the following error:
-
$ curl--cacert ./verify/mesh-ca.pem "https://${frontendIP}:443" curl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34'
The Policies section of the manifest maps policy hashes to a list of SANs. To enable certificate verification
-of the web frontend with tools like curl, edit the policy with your favorite editor and add the frontendIP to
-the list that already contains the "web" DNS entry:
Next, set the changed manifest at the coordinator with:
-
contrast set-c"${coordinator}:1313" deployment/
-
The Contrast Coordinator will rotate the mesh ca certificate on the manifest update. Workload certificates issued
-after the manifest update are thus issued by another certificate authority and services receiving the new CA certificate chain
-won't trust parts of the deployment that got their certificate issued before the update. This way, Contrast ensures
-that parts of the deployment that received a security update won't be infected by parts of the deployment at an older
-patch level that may have been compromised. The mesh-ca.pem is updated with the new CA certificate chain.
The Coordinator has the new manifest set, but the different containers of the app are still
-using the older certificate authority. The Contrast Initializer terminates after the initial attestation
-flow and won't pull new certificates on manifest updates.
After the update has been rolled out, connecting to the frontend using curl will successfully validate
-the service certificate and return the HTML document of the voting site:
Platform support: At present, Contrast is exclusively available on Azure AKS, supported by the Confidential Container preview for AKS. Expansion to other cloud platforms is planned, pending the availability of necessary infrastructure enhancements.
-
Bare-metal support: Support for running Contrast on bare-metal Kubernetes will be available soon for AMD SEV and Intel TDX.
Persistent volumes: Contrast only supports volumes with volumeMode: Block. These block devices are provided by the untrusted environment and should be treated accordingly. We plan to provide transparent encryption on top of block devices in a future release.
Resource limits: There is an existing bug on AKS where container memory limits are incorrectly applied. The current workaround involves using only memory requests instead of limits.
Coverage: While the enforcement of workload policies generally functions well, there are scenarios not yet fully covered. It's crucial to review deployments specifically for these edge cases.
-
Order of events: The current policy evaluation mechanism on API requests isn't stateful, so it can't ensure a prescribed order of events. Consequently, there's no guaranteed enforcement that the service mesh sidecar container runs before the workload container. This order ensures that all traffic between pods is securely encapsulated within TLS connections.
-
Absence of events: Policies can't ensure certain events have happened. A container, such as the service mesh sidecar, can be omitted entirely. Environment variables may be missing.
-
Volume integrity checks: While persistent volumes aren't supported yet, integrity checks don't currently cover other objects such as ConfigMaps and Secrets.
-
-
warning
The policy limitations, in particular the missing guarantee that our service mesh sidecar has been started before the workload container affects the service mesh implementation of Contrast. Currently, this requires inspecting the iptables rules on startup or terminating TLS connections in the workload directly.
CLI availability: The CLI tool is currently only available for Linux. This limitation arises because certain upstream dependencies haven't yet been ported to other platforms.
The Contrast Coordinator is a singleton and can't be scaled to more than one instance.
-When this instance's pod is restarted, for example for node maintenance, it needs to be recovered manually.
-In a future release, we plan to support distributed Coordinator instances that can recover automatically.
CoCo on AKS is currently in preview. An extension for the az CLI is needed to create such a cluster.
-Add the extension with the following commands:
-
az extension add\ --name aks-preview \ --allow-preview true az extension update \ --name aks-preview \ --allow-preview true
-
Then register the required feature flags in your subscription to allow access to the public preview:
-
az feature register \ --namespace"Microsoft.ContainerService"\ --name"KataCcIsolationPreview"
-
The registration can take a few minutes. The status of the operation can be checked with the following
-command, which should show the registration state as Registered:
-
az feature show \ --namespace"Microsoft.ContainerService"\ --name"KataCcIsolationPreview"\ --output table
-
Afterward, refresh the registration of the ContainerService provider:
-
az provider register \ --namespace"Microsoft.ContainerService"
First, we need to create an AKS cluster. We can't directly create a CoCo-enabled cluster, so we'll need to create a
-non-CoCo cluster first, and then add a CoCo node pool, optionally replacing the non-CoCo node pool.
-
We'll first start by creating the non-CoCo cluster:
-
# Select the name for your AKS cluster azClusterName="ContrastDemo" az aks create \ --resource-group "${azResourceGroup:?}"\ --name"${azClusterName:?}"\ --kubernetes-version 1.29\ --os-sku AzureLinux \ --node-vm-size Standard_DC4as_cc_v5 \ --node-count 1\ --generate-ssh-keys
After trying out Contrast, you might want to clean up the cloud resources created in this step.
-In case you've created a new resource group, you can just delete that group with
-
az group delete \ --name"${azResourceGroup:?}"
-
Deleting the resource group will also delete the cluster and all other related resources.
-
To only cleanup the AKS cluster and node pools, run
-
az aks delete \ --resource-group "${azResourceGroup:?}"\ --name"${azClusterName:?}"
Collecting logs can be a good first step to identify problems in your
-deployment. Both the CLI and the Contrast Coordinator as well as the Initializer
-can be configured to emit additional logs.
The CLI logs can be configured with the --log-level command-line flag, which
-can be set to either debug, info, warn or error. The default is info.
-Setting this to debug can get more fine-grained information as to where the
-problem lies.
The logs from the Coordinator and the Initializer can be configured via the
-environment variables CONTRAST_LOG_LEVEL, CONTRAST_LOG_FORMAT and
-CONTRAST_LOG_SUBSYSTEMS.
-
-
CONTRAST_LOG_LEVEL can be set to one of either debug, info, warn, or
-error, similar to the CLI (defaults to info).
-
CONTRAST_LOG_FORMAT can be set to text or json, determining the output
-format (defaults to text).
-
CONTRAST_LOG_SUBSYSTEMS is a comma-seperated list of subsystems that should
-be enabled for logging, which are disabled by default. Subsystems include:
-kds-getter, issuer and validator.
-To enable all subsystems, use * as the value for this environment variable.
-Warnings and error messages from subsystems get printed regardless of whether
-the subsystem is listed in the CONTRAST_LOG_SUBSYSTEMS environment variable.
-
-
To configure debug logging with all subsystems for your Coordinator, add the
-following variables to your container definition.
While the Contrast Coordinator has a policy that allows certain configurations,
-the Initializer and service mesh don't. When changing environment variables of other
-parts than the Coordinator, ensure to rerun contrast generate to update the policy.
-
To access the logs generated by the Coordinator, you can use kubectl with the
-following command:
If the Coordinator or a workload pod fails to even start, it can be helpful to
-look at the events of the pod during the startup process using the describe
-command.
LAST SEEN TYPE REASON OBJECT MESSAGE 32m Warning Failed Pod/coordinator-0 kubelet Error: failed to create containerd task: failed to create shim task: "CreateContainerRequest is blocked by policy: ...
-
A common error, as in this example, is that the container creation was blocked by the
-policy. Potential reasons are a modification of the deployment YAML without updating
-the policies afterward, or a version mismatch between Contrast components.
When generating the policies, Contrast will download the images specified in your deployment
-YAML and include their cryptographic identity. If the image tag is moved to another
-container image after the policy has been generated, the image downloaded at deploy time
-will differ from the one at generation time, and the policy enforcement won't allow the
-container to be started in the pod VM.
-
To ensure the correct image is always used, pin the container image to a fixed sha256:
A version mismatch between Contrast components can cause policy validation or attestation
-to fail. Each Contrast runtime is identifiable based on its (shortened) measurement value
-used to name the runtime class version.
-
First, analyze which runtime class is currently installed in your cluster by running
-
kubectl get runtimeclasses
-
This should give you output similar to the following one.
-
NAME HANDLER AGE contrast-cc-aks-clh-snp-7173acb5 contrast-cc-aks-clh-snp-7173acb5 23h kata-cc-isolation kata-cc 45d
-
The output shows that there are four Contrast runtime classes installed (as well as the runtime class provided
-by the AKS CoCo preview, which isn't used by Contrast).
-
Next, check if the pod that won't start has the correct runtime class configured, and the
-Coordinator uses the exact same runtime:
-
kubectl -n<namespace> get -o=jsonpath='{.spec.runtimeClassName}' pod/<pod-name> kubectl -n<namespace> get -o=jsonpath='{.spec.runtimeClassName}' pod/<coordinator-pod-name>
-
The output should list the runtime class the pod is using:
-
contrast-cc-aks-clh-snp-7173acb5
-
Version information about the currently used CLI can be obtained via the version flag:
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.1, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.1
Contrast
-
Welcome to the documentation of Contrast! Contrast runs confidential container deployments on Kubernetes at scale.
-
-
Contrast is based on the Kata Containers and
-Confidential Containers projects.
-Confidential Containers are Kubernetes pods that are executed inside a confidential micro-VM and provide strong hardware-based isolation from the surrounding environment.
-This works with unmodified containers in a lift-and-shift approach.
-Contrast currently targets the CoCo preview on AKS.
-
tip
See the 📄whitepaper for more information on confidential computing.
Contrast is designed to keep all data always encrypted and to prevent access from the infrastructure layer. It removes the infrastructure provider from the trusted computing base (TCB). This includes access from datacenter employees, privileged cloud admins, own cluster administrators, and attackers coming through the infrastructure, for example, malicious co-tenants escalating their privileges.
-
Contrast integrates fluently with the existing Kubernetes workflows. It's compatible with managed Kubernetes, can be installed as a day-2 operation and imposes only minimal changes to your deployment flow.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.1, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.1
CLI telemetry
-
The Contrast CLI sends telemetry data to Edgeless Systems when you use CLI commands.
-This allows to understand how Contrast is used and to improve it.
-
The CLI sends the following data:
-
-
The CLI version
-
The CLI target OS and architecture (GOOS and GOARCH)
-
The command that was run
-
The kind of error that occurred (if any)
-
-
The CLI doesn't collect sensitive information.
-The implementation is open-source and can be reviewed.
-
IP addresses may be processed or stored for security purposes.
-
The data that the CLI collects adheres to the Edgeless Systems privacy policy.
-
You can disable telemetry by setting the environment variable DO_NOT_TRACK=1 before running the CLI.
-
-
\ No newline at end of file
diff --git a/pr-preview/pr-1071/1.1/architecture/attestation.html b/pr-preview/pr-1071/1.1/architecture/attestation.html
deleted file mode 100644
index d68ccc2d39..0000000000
--- a/pr-preview/pr-1071/1.1/architecture/attestation.html
+++ /dev/null
@@ -1,95 +0,0 @@
-
-
-
-
-
-Attestation in Contrast | Contrast
-
-
-
-
-
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.1, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.1
Attestation in Contrast
-
This document describes the attestation architecture of Contrast, adhering to the definitions of Remote ATtestation procedureS (RATS) in RFC 9334.
-The following gives a detailed description of Contrast's attestation architecture.
-At the end of this document, we included an FAQ that answers the most common questions regarding attestation in hindsight of the security benefits.
Contrast integrates with the RATS architecture, leveraging their definition of roles and processes including Attesters, Verifiers, and Relying Parties.
-
-
Figure 1: Conceptual attestation architecture. Taken from RFC 9334.
-
-
Attester: Assigned to entities that are responsible for creating Evidence which is then sent to a Verifier.
-
Verifier: These entities utilize the Evidence, Reference Values, and Endorsements. They assess the trustworthiness of the Attester by applying an Appraisal Policy for Evidence. Following this assessment, Verifiers generate Attestation Results for use by Relying Parties. The Appraisal Policy for Evidence may be provided by the Verifier Owner, programmed into the Verifier, or acquired through other means.
-
Relying Party: Assigned to entities that utilize Attestation Results, applying their own appraisal policies to make specific decisions, such as authorization decisions. This process is referred to as the "appraisal of Attestation Results." The Appraisal Policy for Attestation Results might be sourced from the Relying Party Owner, configured by the owner, embedded in the Relying Party, or obtained through other protocols or mechanisms.
This includes all Pods of the Contrast deployment that run inside Confidential Containers and generate cryptographic evidence reflecting their current configuration and state.
-Their evidence is rooted in the hardware measurements from the CPU and their confidential VM environment.
-The details of this evidence are given below in the section on evidence generation and appraisal.
-
-
Figure 2: Attestation flow of a confidential pod. Based on the layered attester graphic in RFC 9334.
-
Pods run in Contrast's runtime environment (B), effectively within a confidential VM.
-During launch, the CPU (A) measures the initial memory content of the confidential VM that contains Contrast's pod-VM image and generates the corresponding attestation evidence.
-The image is in IGVM format, encapsulating all information required to launch a virtual machine, including the kernel, the initramfs, and kernel cmdline.
-The kernel cmdline contains the root hash for dm-verity that ensures the integrity of the root filesystem.
-The root filesystem contains all components of the container's runtime environment including the guest agent (C).
-
In the userland, the guest agent takes care of enforcing the runtime policy of the pod.
-While the policy is passed in during the initialization procedure via the host, the evidence for the runtime policy is part of the CPU measurements.
-During the deployment the policy is annotated to the Kubernetes Pod resources.
-The hypervisor adds the hash of the policy to the attestation report via the HOSTDATA (on AMD SEV-SNP) or MRCONFIGID (Intel TDX) fields.
-When provided with the policy from the Kata host, the guest agent verifies that the policy's hash matches the one in the HOSTDATA/MRCONFIGID field.
-
In summary a Pod's evidence is the attestation report of the CPU that provides evidence for runtime environment and the runtime policy.
The Coordinator acts as a verifier within the Contrast deployment, configured with a Manifest that defines the reference values and serves as an appraisal policy for all pods in the deployment.
-It also pulls endorsements from hardware vendors to verify the hardware claims.
-The Coordinator operates within the cluster as a confidential container and provides similar evidence as any other Pod when it acts as an attester.
-In RATS terminology, the Coordinator's dual role is defined as a lead attester in a composite device which spans the entire deployment: Coordinator and the workload pods.
-It collects evidence from other attesters and conveys it to a verifier, generating evidence about the layout of the whole composite device based on the Manifest as the appraisal policy.
-
-
Figure 3: Contrast deployment as a composite device. Based on the composite device in RFC 9334.
-
The CLI serves as the verifier for the Coordinator and the entire Contrast deployment, containing the reference values for the Coordinator and the endorsements from hardware vendors.
-These reference values are built into the CLI during our release process and can be reproduced offline via reproducible builds.
A relying party in the Contrast scenario could be, for example, the data owner that interacts with the application.
-The relying party can use the CLI to obtain the attestation results and Contrast's CA certificates bound to these results.
-The CA certificates can then be used by the relying party to authenticate the application, for example through TLS connections.
In Contrast, attestation evidence revolves around a hardware-generated attestation report, which contains several critical pieces of information:
-
-
The hardware attestation report: This report includes details such as the chip identifier, platform information, microcode versions, and comprehensive guest measurements. The entire report is signed by the CPU's private key, ensuring the authenticity and integrity of the data provided.
-
The launch measurements: Included within the hardware attestation report, this is a digest generated by the CPU that represents a hash of all initial guest memory pages. This includes essential components like the kernel, initramfs, and the kernel command line. Notably, it incorporates the root filesystem's dm-verity root hash, verifying the integrity of the root filesystem.
-
The runtime policy hash: Also part of the hardware attestation report, this field contains the hash of the Rego policy which dictates all expected API commands and their values from the host to the Kata guest agent. It encompasses crucial settings such as dm-verity hashes for the container image layers, environment variables, and mount points.
The appraisal of this evidence in Contrast is governed by two main components:
-
-
The Manifest: A JSON file used by the Coordinator to align with reference values. It sets the expectations for runtime policy hashes for each pod and includes what should be reported in the hardware attestation report for each component of the deployment.
-
The CLI's appraisal policy: This policy encompasses expected values of the Coordinator’s guest measurements and its runtime policy. It's embedded into the CLI during the build process and ensures that any discrepancy between the built-in values and those reported by the hardware attestation can be identified and addressed. The integrity of this policy is safeguardable through reproducible builds, allowing verification against the source code reference.
-
-
Frequently asked questions about attestation in Contrast
-
What's the purpose of remote attestation in Contrast?
-
Remote attestation in Contrast ensures that software runs within a secure, isolated confidential computing environment.
-This process certifies that the memory is encrypted and confirms the integrity and authenticity of the software running within the deployment.
-By validating the runtime environment and the policies enforced on it, Contrast ensures that the system operates in a trustworthy state and hasn't been tampered with.
-
How does Contrast ensure the security of the attestation process?
-
Contrast leverages hardware-rooted security features such as AMD SEV-SNP or Intel TDX to generate cryptographic evidence of a pod’s current state and configuration.
-This evidence is checked against pre-defined appraisal policies to guarantee that only verified and authorized pods are part of a Contrast deployment.
Attestation confirms the integrity of the runtime environment and the identity of the workloads.
-It plays a critical role in preventing unauthorized changes and detecting potential modifications at runtime.
-The attestation provides integrity and authenticity guarantees, enabling relying parties—such as workload operators or data owners—to confirm the effective protection against potential threats, including malicious cloud insiders, co-tenants, or compromised workload operators.
-More details on the specific security benefits can be found here.
-
How can you verify the authenticity of attestation results?
-
Attestation results in Contrast are tied to cryptographic proofs generated and signed by the hardware itself.
-These proofs are then verified using public keys from trusted hardware vendors, ensuring that the results aren't only accurate but also resistant to tampering.
-For further authenticity verification, all of Contrast's code is reproducibly built, and the attestation evidence can be verified locally from the source code.
-
How are attestation results used by relying parties?
-
Relying parties use attestation results to make informed security decisions, such as allowing access to sensitive data or resources only if the attestation verifies the system's integrity.
-Thereafter, the use of Contrast's CA certificates in TLS connections provides a practical approach to communicate securely with the application.
In summary, Contrast's attestation strategy adheres to the RATS guidelines and consists of robust verification mechanisms that ensure each component of the deployment is secure and trustworthy.
-This comprehensive approach allows Contrast to provide a high level of security assurance to its users.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.1, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.1
Certificate authority
-
The Coordinator acts as a certificate authority (CA) for the workloads
-defined in the manifest.
-After a workload pod's attestation has been verified by the Coordinator,
-it receives a mesh certificate and the mesh CA certificate.
-The mesh certificate can be used for example in a TLS connection as the server or
-client certificate to proof to the other party that the workload has been
-verified by the Coordinator. The other party can verify the mesh certificate
-with the mesh CA certificate. While the certificates can be used by the workload
-developer in different ways, they're automatically used in Contrast's service
-mesh to establish mTLS connections between workloads in the same deployment.
The Coordinator establishes a public key infrastructure (PKI) for all workloads
-contained in the manifest. The Coordinator holds three certificates: the root CA
-certificate, the intermediate CA certificate, and the mesh CA certificate.
-The root CA certificate is a long-lasting certificate and its private key signs
-the intermediate CA certificate. The intermediate CA certificate and the mesh CA
-certificate share the same private key. This intermediate private key is used
-to sign the mesh certificates. Moreover, the intermediate private key and
-therefore the intermediate CA certificate and the mesh CA certificate are
-rotated when setting a new manifest.
Depending on the configuration of the first manifest, it allows the workload
-owner to update the manifest and, therefore, the deployment.
-Workload owners and data owners can be mutually untrusted parties.
-To protect against the workload owner silently introducing malicious containers,
-the Coordinator rotates the intermediate private key every time the manifest is
-updated and, therefore, the
-intermediate CA certificate and mesh CA certificate. If the user doesn't
-trust the workload owner, they use the mesh CA certificate obtained when they
-verified the Coordinator and the manifest. This ensures that the user only
-connects to workloads defined in the manifest they verified since only those
-workloads' certificates are signed with this intermediate private key.
-
Similarly, the service mesh also uses the mesh CA certificate obtained when the
-workload was started, so the workload only trusts endpoints that have been
-verified by the Coordinator based on the same manifest. Consequently, a
-manifest update requires a fresh rollout of the services in the service mesh.
The root CA certificate is returned when verifying the Coordinator.
-The data owner can use it to verify the mesh certificates of the workloads.
-This should only be used if the data owner trusts all future updates to the
-manifest and workloads. This is, for instance, the case when the workload owner is
-the same entity as the data owner.
-
The mesh CA certificate is returned when verifying the Coordinator.
-The data owner can use it to verify the mesh certificates of the workloads.
-This certificate is bound to the manifest set when the Coordinator is verified.
-If the manifest is updated, the mesh CA certificate changes.
-New workloads will receive mesh certificates signed by the new mesh CA certificate.
-The Coordinator with the new manifest needs to be verified to retrieve the new mesh CA certificate.
-The service mesh also uses the mesh CA certificate to verify the mesh certificates.
-
The intermediate CA certificate links the root CA certificate to the
-mesh certificate so that the mesh certificate can be verified with the root CA
-certificate. It's part of the certificate chain handed out by
-endpoints in the service mesh.
-
The mesh certificate is part of the certificate chain handed out by
-endpoints in the service mesh. During the startup of a pod, the Initializer
-requests a certificate from the Coordinator. This mesh certificate will be returned if the Coordinator successfully
-verifies the workload. The mesh certificate
-contains X.509 extensions with information from the workloads attestation
-document.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.1, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.1
Observability
-
The Contrast Coordinator can expose metrics in the
-Prometheus format. These can be monitored to quickly
-identify problems in the gRPC layer or attestation errors. Prometheus metrics
-are numerical values associated with a name and additional key/values pairs,
-called labels.
The metrics can be accessed at the Coordinator pod at the port specified in the
-CONTRAST_METRICS_PORT environment variable under the /metrics endpoint. By
-default, this environment variable isn't specified, hence no metrics will be
-exposed.
-
The Coordinator exports gRPC metrics under the prefix contrast_grpc_server_.
-These metrics are labeled with the gRPC service name and method name.
-Metrics of interest include contrast_grpc_server_handled_total, which counts
-the number of requests by return code, and
-contrast_grpc_server_handling_seconds_bucket, which produces a histogram of
-request latency.
The meshapi.MeshAPI service records metrics for the method NewMeshCert, which
-gets called by the Initializer when starting a
-new workload. Attestation failures from workloads to the Coordinator can be
-tracked with the counter contrast_meshapi_attestation_failures_total.
-
The current manifest generation is exposed as a
-gauge with the metric
-name contrast_coordinator_manifest_generation. If no manifest is set at the
-Coordinator, this counter will be zero.
The Service Mesh can be configured to expose
-metrics via its Envoy admin
-interface. Be
-aware that the admin interface can expose private information and allows
-destructive operations to be performed. To enable the admin interface for the
-Service Mesh, set the annotation
-contrast.edgeless.systems/servicemesh-admin-interface-port in the configuration
-of your workload. If this annotation is set, the admin interface will be started
-on this port.
-
To access the admin interface, the ingress settings of the Service Mesh have to
-be configured to allow access to the specified port (see Configuring the
-Proxy). All metrics will be
-exposed under the /stats endpoint. Metrics in Prometheus format can be scraped
-from the /stats/prometheus endpoint.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.1, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.1
Secrets & recovery
-
When the Coordinator is configured with the initial manifest, it generates a random secret seed.
-From this seed, it uses an HKDF to derive the CA root key and a signing key for the manifest history.
-This derivation is deterministic, so the seed can be used to bring any Coordinator to this Coordinator's state.
-
The secret seed is returned to the user on the first call to contrast set, encrypted with the user's public seed share owner key.
-If no seed share owner key is provided, a key is generated and stored in the working directory.
The Coordinator runs as a StatefulSet with a dynamically provisioned persistent volume.
-This volume stores the manifest history and the associated runtime policies.
-The manifest isn't considered sensitive information, because it needs to be passed to the untrusted infrastructure in order to start workloads.
-However, the Coordinator must ensure its integrity and that the persisted data corresponds to the manifests set by authorized users.
-Thus, the manifest is stored in plain text, but is signed with a private key derived from the Coordinator's secret seed.
When a Coordinator starts up, it doesn't have access to the signing secret and can thus not verify the integrity of the persisted manifests.
-It needs to be provided with the secret seed, from which it can derive the signing key that verifies the signatures.
-This procedure is called recovery and is initiated by the workload owner.
-The CLI decrypts the secret seed using the private seed share owner key, verifies the Coordinator and sends the seed through the Recover method.
-The Coordinator recovers its key material and verifies the manifest history signature.
The Coordinator provides each workload a secret seed during attestation. This secret can be used by the workload to derive additional secrets for example to
-encrypt persistent data. Like the workload certificates it's mounted in the shared Kubernetes volume contrast-secrets in the path <mountpoint>/secrets/workload-secret-seed.
-
warning
The workload owner can decrypt data encrypted with secrets derived from the workload secret.
-The workload owner can derive the workload secret themselves, since it's derived from the secret seed known to the workload owner.
-If the data owner and the workload owner is the same entity, then they can safely use the workload secrets.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.1, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.1
Security Considerations
-
Contrast ensures application integrity and provides secure means of communication and bootstrapping (see security benefits).
-However, care must be taken when interacting with the outside of Contrast's confidential environment.
-This page presents some tips for writing secure applications and outlines the trust boundaries app developers need to know.
The application receives credentials from the Contrast Coordinator during initialization.
-This allows to authenticate towards peers and to verify credentials received from peers.
-The application should use the certificate bundle to authenticate incoming requests and be wary of unauthenticated requests or requests with a different root of trust (for example the internet PKI).
-
The recommendation to authenticate not only applies to network traffic, but also to volumes, GPUs and other devices.
-Generally speaking, all information provided by the world outside the confidential VM should be treated with due scepticism, especially if it's not authenticated.
-Common cases where Kubernetes apps interact with external services include DNS, Kubernetes API clients and cloud storage endpoints.
Any external persistence should be encrypted with an authenticated cipher.
-This recommendation applies to block devices or filesystems mounted into the container, but also to cloud blob storage or external databases.
Workload policies serve as workload identities.
-From the perspective of the Contrast Coordinator, all workloads that authenticate with the same policy are equal.
-Thus, it's not possible to disambiguate, for example, pods spawned from a deployment or to limit the amount of certificates issued per policy.
-
Container image references from Kubernetes resource definitions are taken into account when generating the policy.
-A mutable reference may lead to policy failures or unverified image content, depending on the Contrast runtime.
-Reliability and security can only be ensured with a full image reference, including digest.
-The docker pull documentation explains pinned image references in detail.
-
Policies can only verify what can be inferred at generation time.
-Some attributes of Kubernetes pods can't be predicted and thus can't be verified.
-Particularly the downward API contains many fields that are dynamic or depend on the host environment, rendering it unsafe for process environment or arguments.
-The same goes for ConfigMap and Secret resources, which can also be used to populate container fields.
-If the application requires such external information, it should be injected as a mount point and carefully inspected before use.
-
Another type of dynamic content are persistent volumes.
-Any volumes mounted to the pod need to be scrutinized, and sensitive data must not be written to unprotected volumes.
-Ideally, a volume is mounted as a raw block device and authenticated encryption is added within the confidential container.
By default, container logs are visible to the host.
-Sensitive information shouldn't be logged.
-
As of right now, hiding logs isn't natively supported.
-If ReadStreamRequest is denied in the policy, the Kata Agent stops reading the logs.
-This causes the pipes used for standard out and standard error to fill up and potentially deadlock the container.
-If absolutely required, standard out and standard error should be manually redirected to /dev/null inside the container.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.1, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.1
Confidential Containers
-
Contrast uses some building blocks from Confidential Containers (CoCo), a CNCF Sandbox project that aims to standardize confidential computing at the pod level.
-The project is under active development and many of the high-level features are still in flux.
-Contrast uses the more stable core primitive provided by CoCo: its Kubernetes runtime.
Kubernetes can be extended to use more than one container runtime with RuntimeClass objects.
-The Container Runtime Interface (CRI) implementation, for example containerd, dispatches pod management API calls to the appropriate RuntimeClass.
-RuntimeClass implementations are usually based on an OCI runtime, such as runc, runsc or crun.
-In CoCo's case, the runtime is Kata Containers with added confidential computing capabilities.
Kata Containers is an OCI runtime that runs pods in VMs.
-The pod VM spawns an agent process that accepts management commands from the Kata runtime running on the host.
-There are two options for creating pod VMs: local to the Kubernetes node, or remote VMs created with cloud provider APIs.
-Using local VMs requires either bare-metal servers or VMs with support for nested virtualization.
-Local VMs communicate with the host over a virtual socket.
-For remote VMs, host-to-agent communication is tunnelled through the cloud provider's network.
-
Kata Containers was originally designed to isolate the guest from the host, but it can also run pods in confidential VMs (CVMs) to shield pods from their underlying infrastructure.
-In confidential mode, the guest agent is configured with an Open Policy Agent (OPA) policy to authorize API calls from the host.
-This policy also contains checksums for the expected container images.
-It's derived from Kubernetes resource definitions and its checksum is included in the attestation report.
Azure Kubernetes Service (AKS) provides CoCo-enabled node pools as a preview offering.
-These node pools leverage Azure VM types capable of nested virtualization (CVM-in-VM) and the CoCo stack is pre-installed.
-Contrast can be deployed directly into a CoCo-enabled AKS cluster.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.1, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.1
Product features
-
Contrast simplifies the deployment and management of Confidential Containers, offering optimal data security for your workloads while integrating seamlessly with your existing Kubernetes environment.
-
From a security perspective, Contrast employs the Confidential Containers concept and provides security benefits that go beyond individual containers, shielding your entire deployment from the underlying infrastructure.
-
From an operational perspective, Contrast provides the following key features:
-
-
-
Managed Kubernetes compatibility: Initially compatible with Azure Kubernetes Service (AKS), Contrast is designed to support additional platforms such as AWS EKS and Google Cloud GKE as they begin to accommodate confidential containers.
-
-
-
Lightweight installation: Contrast can be integrated as a day-2 operation within existing clusters, adding minimal components to your setup. This facilitates straightforward deployments using your existing YAML configurations, Helm charts, or Kustomization, enabling native Kubernetes orchestration of your applications.
-
-
-
Remote attestation: Contrast generates a concise attestation statement that verifies the identity, authenticity, and integrity of your deployment both internally and to external parties. This architecture ensures that updates or scaling of the application don't compromise the attestation’s validity.
-
-
-
Service mesh: Contrast securely manages a Public Key Infrastructure (PKI) for your deployments, issues workload-specific certificates, and establishes transparent mutual TLS (mTLS) connections across pods. This is done by harnessing the envoy proxy to ensure secure communications within your Kubernetes cluster.
-
-
-
-
\ No newline at end of file
diff --git a/pr-preview/pr-1071/1.1/basics/security-benefits.html b/pr-preview/pr-1071/1.1/basics/security-benefits.html
deleted file mode 100644
index dc70b341f8..0000000000
--- a/pr-preview/pr-1071/1.1/basics/security-benefits.html
+++ /dev/null
@@ -1,116 +0,0 @@
-
-
-
-
-
-Contrast security overview | Contrast
-
-
-
-
-
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.1, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.1
Contrast security overview
-
This document outlines the security measures of Contrast and its capability to counter various threats.
-Contrast is designed to shield entire Kubernetes deployments from the infrastructure, enabling entities to manage sensitive information (such as regulated or personally identifiable information (PII)) in the public cloud, while maintaining data confidentiality and ownership.
-
Contrast is applicable in situations where establishing trust with the workload operator or the underlying infrastructure is challenging.
-This is particularly beneficial for regulated sectors looking to transition sensitive activities to the cloud, without sacrificing security or compliance.
-It allows for cloud adoption by maintaining a hardware-based separation from the cloud service provider.
Leveraging Confidential Computing technology, Contrast provides three defining security properties:
-
-
Encryption of data in use: Contrast ensures that all data processed in memory is encrypted, making it inaccessible to unauthorized users or systems, even if they have physical access to the hardware.
-
Workload isolation: Each pod runs in its isolated runtime environment, preventing any cross-contamination between workloads, which is critical for multi-tenant infrastructures.
-
Remote attestation: This feature allows data owners and workload operators to verify that the Contrast environment executing their workloads hasn't been tampered with and is running in a secure, pre-approved configuration.
-
-
The runtime encryption is transparently provided by the confidential computing hardware during the workload's lifetime.
-The workload isolation and remote attestation involves two phases:
-
-
An attestation process detects modifications to the workload image or its runtime environment during the initialization. This protects the workload's integrity pre-attestation.
-
A protected runtime environment and a policy mechanism prevents the platform operator from accessing or compromising the instance at runtime. This protects a workload's integrity and confidentiality post-attestation.
-
-
For more details on confidential computing see our whitepaper.
-The attestation architecture describes Contrast's attestation process and the resulting chain of trust in detail.
Contrast uses the Kubernetes runtime of the Confidential Containers project.
-Confidential Containers significantly decrease the size of the trusted computing base (TCB) of a Kubernetes deployment, by isolating each pod within its own confidential micro-VM environment.
-The TCB is the totality of elements in a computing environment that must be trusted not to be compromised.
-A smaller TCB results in a smaller attack surface. The following diagram shows how Confidential Containers remove the cloud & datacenter infrastructure and the physical hosts, including the hypervisor, the host OS, the Kubernetes control plane, and other components, from the TCB (red).
-In the confidential context, depicted in green, only the workload containers along with their confidential micro-VM environment are included within the TCB.
-Their integrity is verifiable through remote attestation.
-
Contrast uses hardware-based mechanisms, specifically leveraging CPU features, such as AMD SEV or Intel TDX, to provide the isolation of the workload.
-This implies that both the CPU and its microcode are integral components of the TCB.
-However, it should be noted that the CPU microcode aspects aren't depicted in the accompanying graphic.
-
-
Contrast adds the following components to a deployment that become part of the TCB.
-The components that are part of the TCB are:
-
-
The workload containers: Container images that run the actual application.
The runtime policies: Policies that enforce the runtime environments for the workload containers during their lifetime.
-
The manifest: A manifest file defining the reference values of an entire confidential deployment. It contains the policy hashes for all pods of the deployment and the expected hardware reference values for the Confidential Container runtime.
-
The Coordinator: An attestation service that runs in a Confidential Container in the Kubernetes cluster. The Coordinator is configured with the manifest. User-facing, you can verify this service and the effective manifest using remote attestation, providing you with a concise attestation for the entire deployment. Cluster-facing, it verifies all pods and their policies based on remote attestation procedures and the manifest.
In a Contrast deployment, there are three parties:
-
-
-
The container image provider, who creates the container images that represent the application that has access to the protected data.
-
-
-
The workload operator, who runs the workload in a Kubernetes cluster. The operator typically has full administrative privileges to the deployment. The operator can manage cluster resources such as nodes, volumes, and networking rules, and the operator can interact with any Kubernetes or underlying cloud API.
-
-
-
The data owner, who owns the protected data. A data owner can verify the deployment using the Coordinator attestation service. The verification includes the identity, integrity, and confidentiality of the workloads, the runtime environment and the access permissions.
-
-
-
Contrast supports a trust model where the container image provider, workload operator, and data owner are separate, mutually distrusting parties.
-
The following diagram shows the system components and parties.
Contrast is designed to defend against five possible attacks:
-
-
A malicious cloud insider: malicious employees or third-party contractors of cloud service providers (CSPs) potentially have full access to various layers of the cloud infrastructure. That goes from the physical datacenter up to the hypervisor and Kubernetes layer. For example, they can access the physical memory of the machines, modify the hypervisor, modify disk contents, intercept network communications, and attempt to compromise the confidential container at runtime. A malicious insider can expand the attack surface or restrict the runtime environment. For example, a malicious operator can add a storage device to introduce new attack vectors. As another example, a malicious operator can constrain resources such as limiting a guest's memory size, changing its disk space, or changing firewall rules.
-
A malicious cloud co-tenant: malicious cloud user ("hackers") may break out of their tenancy and access other tenants' data. Advanced attackers may even be able to establish a permanent foothold within the infrastructure and access data over a longer period. The threats are analogous to the cloud insider access scenario, without the physical access.
-
A malicious workload operator: malicious workload operators, for example Kubernetes administrators, have full access to the workload deployment and the underlying Kubernetes platform. The threats are analogously to the cloud insider access scenario, with access to everything that's above the hypervisor level.
-
A malicious attestation client: this attacker connects to the attestation service and sends malformed request.
-
A malicious container image provider: a malicious container image provider has full control over the application development itself. This attacker might release a malicious version of the workload containing harmful operations.
Contrast shields a workload from the aforementioned threats with three main components:
-
-
The runtime environment safeguards against the physical memory and disk attack surface.
-
The runtime policies safeguard against the Kubernetes control plane and container runtime attack surface.
-
The service mesh safeguards against the network attack surface.
-
-
The following tables describe concrete threats and how they're mitigated in Contrast grouped by these categories:
-
-
Attacks on the confidential container environment
-
Attacks on the attestation service
-
Attacks on workloads
-
-
Attacks on the confidential container environment
-
This table describes potential threats and mitigation strategies related to the confidential container environment.
-
Threat
Mitigation
Mitigation implementation
An attacker intercepts the network connection of the launcher or image repository.
An attacker can change the image URL and control the workload binary. However these actions are reflected in the attestation report. The image repository isn't controlled using an access list, therefore the image is assumed to be viewable by everyone. You must ensure that the workload container image doesn't contain any secrets.
An attacker modifies a container's runtime environment configuration in the Kubernetes control plane.
The attestation process and the runtime policies detects unsafe configurations that load non-authentic images or perform any other modification to the expected runtime environment.
This table describes potential threats and mitigation strategies to the attestation service.
-
Threat
Mitigation
Mitigation implementation
An attacker intercepts the Coordinator deployment and modifies the image or hijacks the runtime environment.
This threat is mitigated by having an attestation procedure and attested, encrypted TLS connections to the Coordinator. The attestation evidence for the Coordinator image is distributed with our releases, protected by supply chain security, and fully reproducible.
An attacker intercepts the network connection between the workload and the Coordinator and reads secret keys from the wire.
This threat is mitigated by having an attested, encrypted TLS connection. This connection helps protect the secrets from passive eavesdropping. The attacker can't create valid workload certificates that would be accepted in Contrast's service mesh. An attacker can't impersonate a valid workload container because the container's identity is guaranteed by the attestation protocol.
Within the network between your workload and the Coordinator.
An attacker exploits parsing discrepancies, which leads to undetected changes in the attestation process.
This risk is mitigated by having a parsing engine written in memory-safe Go that's tested against the attestation specification of the hardware vendor. The runtime policies are available as an attestation artifact for further inspection and audits to verify their effectiveness.
An attacker reads or modifies data written to disk via persistent volumes.
Currently, persistent volumes aren't supported in Contrast. In the future, this threat is mitigated by encrypted and integrity-protected volume mounts.
An attacker publishes a new image version containing malicious code.
The attestation process and the runtime policies require a data owner to accept a specific version of the workload and any update to the workload needs to be explicitly acknowledged.
The following table describes three example use cases and how they map to the defined threat model in this document:
-
Use Case
Example Scenario
Migrate sensitive workloads to the cloud
TechSolve Inc., a software development firm, aimed to enhance its defense-in-depth strategy for its cloud-based development environment, especially for projects involving proprietary algorithms and client data. TechSolve acts as the image provider, workload operator, and data owner, combining all three personas in this scenario. In our attestation terminology, they're the workload operator and relying party in one entity. Their threat model includes a malicious cloud insider and cloud co-tenant.
Make your SaaS more trustworthy
SaaSProviderX, a company offering cloud-based project management tools, sought to enhance its platform's trustworthiness amidst growing concerns about data breaches and privacy. Here, the relying party is the SaaS customer as the data owner. The goal is to achieve a form of operator exclusion and only allow selective operations on the deployment. Hence, their threat model includes a malicious workload operator.
Simplify regulatory compliance
HealthSecure Inc. has been managing a significant volume of sensitive patient data on-premises. With the increasing demand for advanced data analytics and the need for scalable infrastructure, the firm decides to migrate its data analytics operations to the cloud. However, the primary concern is maintaining the confidentiality and security of patient data during and after the migration, in compliance with healthcare regulations. In this compliance scenario, the regulator serves as an additional relying party. HealthSecure must implement a mechanism that ensures the isolation of patient data can be verifiably guaranteed to the regulator.
-
In each scenario, Contrast ensures exclusive data access and processing capabilities are confined to the designated workloads. It achieves this by effectively isolating the workload from the infrastructure and other components of the stack. Data owners are granted the capability to audit and approve the deployment environment before submitting their data, ensuring a secure handover. Meanwhile, workload operators are equipped to manage and operate the application seamlessly, without requiring direct access to either the workload or its associated data.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.1, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.1
Components
-
Contrast is composed of several key components that work together to manage and scale confidential containers effectively within Kubernetes environments.
-This page provides an overview of the core components essential for deploying and managing Contrast.
The CLI serves as the primary management tool for Contrast deployments. It's designed to streamline the configuration and operation of Contrast in several ways:
-
-
Installation and setup: The CLI facilitates the installation of the necessary runtime classes required for Contrast to function within a Kubernetes cluster.
-
Policy generation: It allows users to generate runtime policies, adapt the deployment files, and generate the Contrast manifest.
-
Configuration management: Through the CLI, users can configure the Contrast Coordinator with the generated manifest.
-
Verification and attestation: The CLI provides tools to verify the integrity and authenticity of the Coordinator and the entire deployment via remote attestation.
The Contrast Coordinator is the central remote attestation service of a Contrast deployment.
-It runs inside a confidential container inside your cluster.
-The Coordinator can be verified via remote attestation, and a Contrast deployment is self-contained.
-The Coordinator is configured with a manifest, a configuration file containing the reference attestation values of your deployment.
-It ensures that your deployment's topology adheres to your specified manifest by verifying the identity and integrity of all confidential pods inside the deployment.
-The Coordinator is also a certificate authority and issues certificates for your workload pods during the attestation procedure.
-Your workload pods can establish secure, encrypted communication channels between themselves based on these certificates using the Coordinator as the root CA.
-As your app needs to scale, the Coordinator transparently verifies new instances and then provides them with their certificates to join the deployment.
-
To verify your deployment, the Coordinator's remote attestation statement combined with the manifest offers a concise single remote attestation statement for your entire deployment.
-A third party can use this to verify the integrity of your distributed app, making it easy to assure stakeholders of your app's identity and integrity.
The manifest is the configuration file for the Coordinator, defining your confidential deployment.
-It's automatically generated from your deployment by the Contrast CLI.
-It currently consists of the following parts:
-
-
Policies: The identities of your Pods, represented by the hashes of their respective runtime policies.
-
Reference Values: The remote attestation reference values for the Kata confidential micro-VM that's the runtime environment of your Pods.
-
WorkloadOwnerKeyDigest: The workload owner's public key digest. Used for authenticating subsequent manifest updates.
Runtime Policies are a mechanism to enable the use of the untrusted Kubernetes API for orchestration while ensuring the confidentiality and integrity of your confidential containers.
-They allow us to enforce the integrity of your containers' runtime environment as defined in your deployment files.
-The runtime policy mechanism is based on the Open Policy Agent (OPA) and translates the Kubernetes deployment YAML into the Rego policy language of OPA.
-The Kata Agent inside the confidential micro-VM then enforces the policy by only acting on permitted requests.
-The Contrast CLI provides the tooling for automatically translating Kubernetes deployment YAML into the Rego policy language of OPA.
Contrast provides an Initializer that handles the remote attestation on the workload side transparently and
-fetches the workload certificate. The Initializer runs as an init container before your workload is started.
-It provides the workload container and the service mesh sidecar with the workload certificates.
Contrast depends on a Kubernetes runtime class, which is installed
-by the node-installer DaemonSet.
-This runtime consists of a containerd runtime plugin, a virtual machine manager (cloud-hypervisor), and a podvm image (IGVM and rootFS).
-The installer takes care of provisioning every node in the cluster so it provides this runtime class.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.1, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.1
Policies
-
Kata runtime policies are an integral part of the Confidential Containers preview on AKS.
-They prescribe how a Kubernetes pod must be configured to launch successfully in a confidential VM.
-In Contrast, policies act as a workload identifier: only pods with a policy registered in the manifest receive workload certificates and may participate in the confidential deployment.
-Verification of the Contrast Coordinator and its manifest transitively guarantees that all workloads meet the owner's expectations.
The Kata agent running in the confidential micro-VM exposes an RPC service AgentService to the Kata runtime.
-This service handles potentially untrustworthy requests from outside the TCB, which need to be checked against a policy.
-
Kata runtime policies are written in the policy language Rego.
-They specify what AgentService methods can be called, and the permissible parameters for each call.
-
Policies consist of two parts: a list of rules and a data section.
-While the list of rules is static, the data section is populated with information from the PodSpec and other sources.
Runtime policies are programmatically generated from Kubernetes manifests by the Contrast CLI.
-The generate subcommand inspects pod definitions and derives rules for validating the pod at the Kata agent.
-There are two important integrity checks: container image checksums and OCI runtime parameters.
-
For each of the container images used in a pod, the CLI downloads all image layers and produces a cryptographic dm-verity checksum.
-These checksums are the basis for the policy's storage data.
-
The CLI combines information from the PodSpec, ConfigMaps, and Secrets in the provided Kubernetes manifests to derive a permissible set of command-line arguments and environment variables.
-These constitute the policy's OCI data.
The generated policy document is annotated to the pod definitions in Base64 encoding.
-This annotation is propagated to the Kata runtime, which calculates the SHA256 checksum for the policy and uses that as SNP HOSTDATA or TDX MRCONFIGID for the confidential micro-VM.
-
After the VM launched, the runtime calls the agent's SetPolicy method with the full policy document.
-If the policy doesn't match the checksum in HOSTDATA or MRCONFIGID, the agent rejects the policy.
-Otherwise, it applies the policy to all future AgentService requests.
Contrast verifies its confidential containers following these steps:
-
-
The Contrast CLI generates a policy and attaches it to the pod definition.
-
Kubernetes schedules the pod on a node with the confidential computing runtime.
-
Containerd invokes the Kata runtime to create the pod sandbox.
-
The Kata runtime starts a CVM with the policy's digest as HOSTDATA/MRCONFIGID.
-
The Kata runtime sets the policy using the SetPolicy method.
-
The Kata agent verifies that the incoming policy's digest matches HOSTDATA/MRCONFIGID.
-
The CLI sets a manifest in the Contrast Coordinator, including a list of permitted policies.
-
The Contrast Initializer sends an attestation report to the Contrast Coordinator, asking for a mesh certificate.
-
The Contrast Coordinator verifies that the started pod has a permitted policy hash in its HOSTDATA/MRCONFIGID field.
-
-
After the last step, we know that the policy hasn't been tampered with and, thus, that the workload matches expectations and may receive mesh certificates.
Contrast uses different rules and data sections for different platforms.
-This results in different policy hashes for different platforms.
-
The generate command automatically derives the correct set of rules and data sections from the reference-values flag.
-
The verify, set, and recover commands need to know the coordinator's expected policy hash to verify its identity.
-By default these commands assume that the coordinator is using the policy for the AKS-CLH-SNP platform.
-If the coordinator is running on a different platform, the correct policy hash can be looked up in the coordinator-policy.hash file bundled with the Contrast release.
-The coordinator policy hash can be overwritten using the --coordinator-policy-hash flag.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.1, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.1
Contrast Runtime
-
The Contrast runtime is responsible for starting pods as confidential virtual machines.
-This works by specifying the runtime class to be used in a pod spec and by registering the runtime class with the apiserver.
-The RuntimeClass resource defines a name for referencing the class and
-a handler used by the container runtime (containerd) to identify the class.
-
apiVersion: node.k8s.io/v1 kind: RuntimeClass metadata: # This name is used by pods in the runtimeClassName field name: contrast-cc-abcdef # This name is used by the # container runtime interface implementation (containerd) handler: contrast-cc-abcdef
-
Confidential pods that are part of a Contrast deployment need to specify the
-same runtime class in the runtimeClassName field, so Kubernetes uses the
-Contrast runtime instead of the default containerd / runc handler.
-
apiVersion: v1 kind: Pod spec: runtimeClassName: contrast-cc-abcdef # ...
The runtime consists of additional software components that need to be installed
-and configured on every SEV-SNP-enabled/TDX-enabled worker node.
-This installation is performed automatically by the node-installer DaemonSet.
The handler field in the Kubernetes RuntimeClass instructs containerd not to use the default runc implementation.
-Instead, containerd invokes a custom plugin called containerd-shim-contrast-cc-v2.
-This shim is described in more detail in the upstream source repository and in the containerd documentation.
The containerd shim uses a virtual machine monitor to create a confidential virtual machine for every pod.
-On AKS, Contrast uses cloud-hypervisor.
-On bare metal, Contrast uses QEMU.
-The appropriate files are installed on every node by the node-installer.
Contrast uses containerd snapshotters to provide container images to the pod-VM.
-Each snapshotter consists of a host component that pulls container images and a guest component used to mount/pull container images.
-
On AKS, Contrast uses the tardev snapshotter to provide container images as block devices to the pod-VM.
-The tardev snapshotter uses dm-verity to protect the integrity of container images.
-Expected dm-verity container image hashes are part of Contrast runtime policies and are enforced by the kata-agent.
-This enables workload attestation by specifying the allowed container image as part of the policy. Read the chapter on policies for more information.
-
On bare metal, Contrast uses the nydus snapshotter to store metadata about the images. This metadata is communicated to the guest, so that it can pull the images itself.
Every pod-VM starts with the same guest image. It consists of an IGVM file and a root filesystem.
-The IGVM file describes the initial memory contents of a pod-VM and consists of:
-
-
Linux kernel image
-
initrd
-
kernel commandline
-
-
Additionally, a root filesystem image is used that contains a read-only partition with the user space of the pod-VM and a verity partition to guarantee the integrity of the root filesystem.
-The root filesystem contains systemd as the init system, and the kata agent for managing the pod.
-
This pod-VM image isn't specific to any pod workload. Instead, container images are mounted at runtime.
The RuntimeClass resource above registers the runtime with the Kubernetes api.
-The node-level installation is carried out by the Contrast node-installer
-DaemonSet that ships with every Contrast release.
-
After deploying the installer, it performs the following steps on each node:
-
-
Install the Contrast containerd shim (containerd-shim-contrast-cc-v2)
-
Install cloud-hypervisor or QEMU as the virtual machine manager (VMM)
-
Install an IGVM file or separate firmware and kernel files for pod-VMs of this class
-
Install a read only root filesystem disk image for the pod-VMs of this class
-
Reconfigure containerd by adding a runtime plugin that corresponds to the handler field of the Kubernetes RuntimeClass
-
Restart containerd to make it aware of the new plugin
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.1, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.1
Service mesh
-
The Contrast service mesh secures the communication of the workload by automatically
-wrapping the network traffic inside mutual TLS (mTLS) connections. The
-verification of the endpoints in the connection establishment is based on
-certificates that are part of the
-PKI of the Coordinator.
-
The service mesh can be enabled on a per-workload basis by adding a service mesh
-configuration to the workload's object annotations. During the contrast generate
-step, the service mesh is added as a sidecar
-container to
-all workloads which have a specified configuration. The service mesh container first
-sets up iptables rules based on its configuration and then starts
-Envoy for TLS origination and termination.
The service mesh container can be configured using the following object annotations:
-
-
contrast.edgeless.systems/servicemesh-ingress to configure ingress.
-
contrast.edgeless.systems/servicemesh-egress to configure egress.
-
contrast.edgeless.systems/servicemesh-admin-interface-port to configure the Envoy
-admin interface. If not specified, no admin interface will be started.
-
-
If you aren't using the automatic service mesh injection and want to configure the
-service mesh manually, set the environment variables CONTRAST_INGRESS_PROXY_CONFIG,
-CONTRAST_EGRESS_PROXY_CONFIG and CONTRAST_ADMIN_PORT in the service mesh sidecar directly.
All TCP ingress traffic is routed over Envoy by default. Since we use
-TPROXY, the destination address
-remains the same throughout the packet handling.
-
Any incoming connection is required to present a client certificate signed by the
-mesh CA certificate.
-Envoy presents a certificate chain of the mesh
-certificate of the workload and the intermediate CA certificate as the server certificate.
-
If the deployment contains workloads which should be reachable from outside the
-Service Mesh, while still handing out the certificate chain, disable client
-authentication by setting the annotation contrast.edgeless.systems/servicemesh-ingress as
-<name>#<port>#false. Separate multiple entries with ##. You can choose any
-descriptive string identifying the service on the given port for the <name> field,
-as it's only informational.
-
Disable redirection and TLS termination altogether by specifying
-<name>#<port>#true. This can be beneficial if the workload itself handles TLS
-on that port or if the information exposed on this port is non-sensitive.
-
The following example workload exposes a web service on port 8080 and metrics on
-port 7890. The web server is exposed to a 3rd party end-user which wants to
-verify the deployment, therefore it's still required that the server hands out
-it certificate chain signed by the mesh CA certificate. The metrics should be
-exposed via TCP without TLS.
Note, that changing the environment variables of the sidecar container directly will
-only have an effect if the workload isn't configured to automatically generate a
-service mesh component on contrast generate. Otherwise, the service mesh sidecar
-container will be regenerated on every invocation of the command.
To be able to route the egress traffic of the workload through Envoy, the remote
-endpoints' IP address and port must be configurable.
-
-
Choose an IP address inside the 127.0.0.0/8 CIDR and a port not yet in use
-by the pod.
-
Configure the workload to connect to this IP address and port.
-
Set <name>#<chosen IP>:<chosen port>#<original-hostname-or-ip>:<original-port>
-as the contrast.edgeless.systems/servicemesh-egress workload annotation. Separate multiple
-entries with ##. Choose any string identifying the service on the given port as
-<name>.
-
-
This redirects the traffic over Envoy. The endpoint must present a valid
-certificate chain which must be verifiable with the
-mesh CA certificate.
-Furthermore, Envoy uses a certificate chain with the mesh certificate of the workload
-and the intermediate CA certificate as the client certificate.
-
The following example workload has no ingress connections and two egress
-connection to different microservices. The microservices are part
-of the confidential deployment. One is reachable under billing-svc:8080 and
-the other under cart-svc:8080.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.1, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.1
Workload deployment
-
The following instructions will guide you through the process of making an existing Kubernetes deployment
-confidential and deploying it together with Contrast.
-
AKS
Bare metal (SEV-SNP)
Bare metal (TDX)
A running CoCo-enabled cluster is required for these steps, see the setup guide on how to set up a cluster on AKS.
A running CoCo-enabled cluster is required for these steps, see the setup guide on how to set up a bare-metal cluster.
A running CoCo-enabled cluster is required for these steps, see the setup guide on how to set up a bare-metal cluster.
Contrast depends on a custom Kubernetes RuntimeClass (contrast-cc),
-which needs to be installed in the cluster prior to the Coordinator or any confidential workloads.
-This consists of a RuntimeClass resource and a DaemonSet that performs installation on worker nodes.
-This step is only required once for each version of the runtime.
-It can be shared between Contrast deployments.
Your Kubernetes resources need some modifications to run as Confidential Containers.
-This section guides you through the process and outlines the necessary changes.
Contrast ensures integrity and confidentiality of the applications, but interactions with untrusted systems require the developers' attention.
-Review the security considerations and the certificates section for writing secure Contrast application.
Contrast will add annotations to your Kubernetes YAML files. If you want to keep the original files
-unchanged, you can copy the files into a separate local directory.
-You can also generate files from a Helm chart or from a Kustomization.
To specify that a workload (pod, deployment, etc.) should be deployed as confidential containers,
-add runtimeClassName: contrast-cc to the pod spec (pod definition or template).
-This is a placeholder name that will be replaced by a versioned runtimeClassName when generating policies.
In the initialization process, the contrast-secrets shared volume is populated with X.509 certificates for your workload.
-These certificates are used by the Contrast Service Mesh, but can also be used by your application directly.
-The following tab group explains the setup for both scenarios.
-
Drop-in service mesh
Go integration
Contrast can be configured to handle TLS in a sidecar container.
-This is useful for workloads that are hard to configure with custom certificates, like Java applications.
Configuration of the sidecar depends heavily on the application.
-The following example is for an application with these properties:
-
The container has a main application at TCP port 8001, which should be TLS-wrapped and doesn't require client authentication.
-
The container has a metrics endpoint at TCP port 8080, which should be accessible in plain text.
-
All other endpoints require client authentication.
-
The app connects to a Kubernetes service backend.default:4001, which requires client authentication.
During the generate step, this configuration will be translated into a Service Mesh sidecar container which handles TLS connections automatically.
-The only change required to the app itself is to let it connect to 127.0.0.2:4001 to reach the backend service.
-You can find more detailed documentation in the Service Mesh chapter.
The mesh certificate contained in certChain.pem authenticates this workload, while the mesh CA certificate mesh-ca.pem authenticates its peers.
-Your app should turn on client authentication to ensure peers are running as confidential containers, too.
-See the Certificate Authority section for detailed information about these certificates.
The following example shows how to configure a Golang app, with error handling omitted for clarity.
Run the generate command to add the necessary components to your deployment files.
-This will add the Contrast Initializer to every workload with the specified contrast-cc runtime class
-and the Contrast Service Mesh to all workloads that have a specified configuration.
-After that, it will generate the execution policies and add them as annotations to your deployment files.
-A manifest.json with the reference values of your deployment will be created.
On bare-metal SEV-SNP, contrast generate is unable to fill in the MinimumTCB values as they can vary between platforms.
-They will have to be filled in manually.
-If you don't know the correct values use {"BootloaderVersion":255,"TEEVersion":255,"SNPVersion":255,"MicrocodeVersion":255} and observe the real values in the error messages in the following steps. This should only be done in a secure environment. Note that the values will differ between CPU models.
On bare-metal TDX, contrast generate is unable to fill in the MinimumTeeTcbSvn and MrSeam TCB values as they can vary between platforms.
-They will have to be filled in manually.
-If you don't know the correct values use ffffffffffffffffffffffffffffffff and 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 respectively and observe the real values in the error messages in the following steps. This should only be done in a secure environment.
-
warning
Please be aware that runtime policies currently have some blind spots. For example, they can't guarantee the starting order of containers. See the current limitations for more details.
-
If you don't want the Contrast Initializer to automatically be added to your
-workloads, there are two ways you can skip the Initializer injection step,
-depending on how you want to customize your deployment.
-
Command-line flag
Per-workload annotation
You can disable the Initializer injection completely by specifying the
---skip-initializer flag in the generate command.
If you want to disable the Initializer injection for a specific workload with
-the contrast-cc runtime class, you can do so by adding an annotation to the workload.
When disabling the automatic Initializer injection, you can manually add the
-Initializer as a sidecar container to your workload before generating the
-policies. Configure the workload to use the certificates written to the
-contrast-secretsvolumeMount.
For the next steps, we will need to connect to the Coordinator. The released Coordinator resource
-includes a LoadBalancer definition we can use.
-
coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}')
-
Port-forwarding of Confidential Containers
kubectl port-forward uses a Container Runtime Interface (CRI) method that isn't supported by the Kata shim.
-If you can't use a public load balancer, you can deploy a port-forwarder.
-The port-forwarder relays traffic from a CoCo pod and can be accessed via kubectl port-forward.
This will use the reference values from the manifest file to attest the Coordinator.
-After this step, the Coordinator will start issuing TLS certificates to the workloads. The init container
-will fetch a certificate for the workload and the workload is started.
-
warning
On bare metal, the coordinator policy hash must be overwritten using --coordinator-policy-hash.
An end user (data owner) can verify the Contrast deployment using the verify command.
-
contrast verify -c"${coordinator}:1313"
-
The CLI will attest the Coordinator using the reference values from the given manifest file. It will then write the
-service mesh root certificate and the history of manifests into the verify/ directory. In addition, the policies
-referenced in the active manifest are also written to the directory. The verification will fail if the active
-manifest at the Coordinator doesn't match the manifest passed to the CLI.
-
warning
On bare metal, the coordinator policy hash must be overwritten using --coordinator-policy-hash.
You can securely connect to the workloads using the Coordinator's mesh-ca.pem as a trusted CA certificate.
-First, expose the service on a public IP address via a LoadBalancer service:
By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed
-via load balancer IP in this demo. Tools like curl check the certificate for IP entries in the SAN field.
-Validation fails since the certificate contains no IP entries as a subject alternative name (SAN).
-For example, a connection attempt using the curl and the mesh CA certificate with throw the following error:
$ curl--cacert ./verify/mesh-ca.pem "https://${frontendIP}:443" curl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34'
-
Using openssl, the certificate of the service can be validated with the mesh-ca.pem:
If the Contrast Coordinator restarts, it enters recovery mode and waits for an operator to provide key material.
-For demonstration purposes, you can simulate this scenario by deleting the Coordinator pod.
-
kubectl delete pod -l app.kubernetes.io/name=coordinator
-
Kubernetes schedules a new pod, but that pod doesn't have access to the key material the previous pod held in memory and can't issue certificates for workloads yet.
-You can confirm this by running verify again, or you can restart a workload pod, which should stay in the initialization phase.
-However, the secret seed in your working directory is sufficient to recover the coordinator.
-
contrast recover -c"${coordinator}:1313"
-
Now that the Coordinator is recovered, all workloads should pass initialization and enter the running state.
-You can now verify the Coordinator again, which should return the same manifest you set before.
-
warning
The recovery process invalidates the mesh CA certificate:
-existing workloads won't be able to communicate with workloads newly spawned.
-All workloads should be restarted after the recovery succeeded.
-
warning
On bare metal, the coordinator policy hash must be overwritten using --coordinator-policy-hash.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
This is documentation for Contrast 1.1, which is no longer actively maintained.
For up-to-date documentation, see the latest version (1.2).
Version: 1.1
Confidential emoji voting
-
-
This tutorial guides you through deploying emojivoto as a
-confidential Contrast deployment and validating the deployment from a voter's perspective.
-
Emojivoto is an example app allowing users to vote for different emojis and view votes
-on a leader board. It has a microservice architecture consisting of a
-web frontend (web), a gRPC backend for listing available emojis (emoji), and a backend for
-the voting and leader board logic (voting). The vote-bot simulates user traffic by submitting
-votes to the frontend.
-
Emojivoto can be seen as a lighthearted example of an app dealing with sensitive data.
-Contrast protects emojivoto in two ways. First, it shields emojivoto as a whole from the infrastructure, for example, Azure.
-Second, it can be configured to also prevent data access even from the administrator of the app. In the case of emojivoto, this gives assurance to users that their votes remain secret.
Contrast depends on a custom Kubernetes RuntimeClass,
-which needs to be installed to the cluster initially.
-This consists of a RuntimeClass resource and a DaemonSet that performs installation on worker nodes.
-This step is only required once for each version of the runtime.
-It can be shared between Contrast deployments.
Run the generate command to generate the execution policies and add them as
-annotations to your deployment files. A manifest.json file with the reference values
-of your deployment will be created:
On bare-metal SEV-SNP, contrast generate is unable to fill in the MinimumTCB values as they can vary between platforms.
-They will have to be filled in manually.
-If you don't know the correct values use {"BootloaderVersion":255,"TEEVersion":255,"SNPVersion":255,"MicrocodeVersion":255} and observe the real values in the error messages in the following steps. This should only be done in a secure environment. Note that the values will differ between CPU models.
On bare-metal TDX, contrast generate is unable to fill in the MinimumTeeTcbSvn and MrSeam TCB values as they can vary between platforms.
-They will have to be filled in manually.
-If you don't know the correct values use ffffffffffffffffffffffffffffffff and 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 respectively and observe the real values in the error messages in the following steps. This should only be done in a secure environment.
-
Runtime class and Initializer
The deployment YAML shipped for this demo is already configured to be used with Contrast.
-A runtime classcontrast-cc-<platform>-<runtime-hash>
-was added to the pods to signal they should be run as Confidential Containers. During the generation process,
-the Contrast Initializer will be added as an init container to these
-workloads to facilitate the attestation and certificate pulling before the actual workload is started.
Further, the deployment YAML is also configured with the Contrast service mesh.
-The configured service mesh proxy provides transparent protection for the communication between
-the different components of emojivoto.
Configure the coordinator with a manifest. It might take up to a few minutes
-for the load balancer to be created and the Coordinator being available.
-
coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') echo"The user API of your Contrast Coordinator is available at $coordinator:1313" contrast set-c"${coordinator}:1313" deployment/
-
The CLI will use the reference values from the manifest to attest the Coordinator deployment
-during the TLS handshake. If the connection succeeds, it's ensured that the Coordinator
-deployment hasn't been tampered with.
-
warning
On bare metal, the coordinator policy hash must be overwritten using --coordinator-policy-hash.
Now that the coordinator has a manifest set, which defines the emojivoto deployment as an allowed workload,
-we can deploy the application:
-
kubectl apply -f deployment/
-
Inter-deployment communication
The Contrast Coordinator issues mesh certificates after successfully validating workloads.
-These certificates can be used for secure inter-deployment communication. The Initializer
-sends an attestation report to the Coordinator, retrieves certificates and a private key in return
-and writes them to a volumeMount. The service mesh sidecar is configured to use the credentials
-from the volumeMount when communicating with other parts of the deployment over mTLS.
-The public facing frontend for voting uses the mesh certificate without client authentication.
In different scenarios, users of an app may want to verify its security and identity before sharing data, for example, before casting a vote.
-With Contrast, a user only needs a single remote-attestation step to verify the deployment - regardless of the size or scale of the deployment.
-Contrast is designed such that, by verifying the Coordinator, the user transitively verifies those systems the Coordinator has already verified or will verify in the future.
-Successful verification of the Coordinator means that the user can be sure that the given manifest will be enforced.
The CLI will verify the Coordinator via remote attestation using the reference values from a given manifest. This manifest needs
-to be communicated out of band to everyone wanting to verify the deployment, as the verify command checks
-if the currently active manifest at the Coordinator matches the manifest given to the CLI. If the command succeeds,
-the Coordinator deployment was successfully verified to be running in the expected Confidential
-Computing environment with the expected code version. The Coordinator will then return its
-configuration over the established TLS channel. The CLI will store this information, namely the root
-certificate of the mesh (mesh-ca.pem) and the history of manifests, into the verify/ directory.
-In addition, the policies referenced in the manifest history are also written into the same directory.
-
warning
On bare metal, the coordinator policy hash must be overwritten using --coordinator-policy-hash.
In the next step, the Coordinator configuration that was written by the verify command needs to be audited.
-A potential voter should inspect the manifest and the referenced policies. They could delegate
-this task to an entity they trust.
After ensuring the configuration of the Coordinator fits the expectation, the user can securely connect
-to the application using the Coordinator's mesh-ca.pem as a trusted CA certificate.
-
To access the web frontend, expose the service on a public IP address via a LoadBalancer service:
-
frontendIP=$(kubectl get svc web-svc -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') echo"Frontend is available at https://$frontendIP, you can visit it in your browser."
-
Using openssl, the certificate of the service can be validated with the mesh-ca.pem:
Updating the certificate SAN and the manifest (optional)
-
By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed
-via load balancer IP in this demo. Tools like curl check the certificate for IP entries in the subject alternative name (SAN) field.
-Validation fails since the certificate contains no IP entries as a SAN.
-For example, a connection attempt using the curl and the mesh CA certificate with throw the following error:
-
$ curl--cacert ./verify/mesh-ca.pem "https://${frontendIP}:443" curl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34'
The Policies section of the manifest maps policy hashes to a list of SANs. To enable certificate verification
-of the web frontend with tools like curl, edit the policy with your favorite editor and add the frontendIP to
-the list that already contains the "web" DNS entry:
Next, set the changed manifest at the coordinator with:
-
contrast set-c"${coordinator}:1313" deployment/
-
The Contrast Coordinator will rotate the mesh ca certificate on the manifest update. Workload certificates issued
-after the manifest update are thus issued by another certificate authority and services receiving the new CA certificate chain
-won't trust parts of the deployment that got their certificate issued before the update. This way, Contrast ensures
-that parts of the deployment that received a security update won't be infected by parts of the deployment at an older
-patch level that may have been compromised. The mesh-ca.pem is updated with the new CA certificate chain.
-
warning
On bare metal, the coordinator policy hash must be overwritten using --coordinator-policy-hash.
The Coordinator has the new manifest set, but the different containers of the app are still
-using the older certificate authority. The Contrast Initializer terminates after the initial attestation
-flow and won't pull new certificates on manifest updates.
After the update has been rolled out, connecting to the frontend using curl will successfully validate
-the service certificate and return the HTML document of the voting site:
Platform support: At present, Contrast is exclusively available on Azure AKS, supported by the Confidential Container preview for AKS. Expansion to other cloud platforms is planned, pending the availability of necessary infrastructure enhancements.
Persistent volumes: Contrast only supports volumes with volumeMode: Block. These block devices are provided by the untrusted environment and should be treated accordingly. We plan to provide transparent encryption on top of block devices in a future release.
Resource limits: There is an existing bug on AKS where container memory limits are incorrectly applied. The current workaround involves using only memory requests instead of limits.
Coverage: While the enforcement of workload policies generally functions well, there are scenarios not yet fully covered. It's crucial to review deployments specifically for these edge cases.
-
Order of events: The current policy evaluation mechanism on API requests isn't stateful, so it can't ensure a prescribed order of events. Consequently, there's no guaranteed enforcement that the service mesh sidecar container runs before the workload container. This order ensures that all traffic between pods is securely encapsulated within TLS connections.
-
Absence of events: Policies can't ensure certain events have happened. A container, such as the service mesh sidecar, can be omitted entirely. Environment variables may be missing.
-
Volume integrity checks: While persistent volumes aren't supported yet, integrity checks don't currently cover other objects such as ConfigMaps and Secrets.
-
-
warning
The policy limitations, in particular the missing guarantee that our service mesh sidecar has been started before the workload container affects the service mesh implementation of Contrast. Currently, this requires inspecting the iptables rules on startup or terminating TLS connections in the workload directly.
CLI availability: The CLI tool is currently only available for Linux. This limitation arises because certain upstream dependencies haven't yet been ported to other platforms.
The Contrast Coordinator is a singleton and can't be scaled to more than one instance.
-When this instance's pod is restarted, for example for node maintenance, it needs to be recovered manually.
-In a future release, we plan to support distributed Coordinator instances that can recover automatically.
Update your BIOS to a version that supports AMD SEV-SNP. Updating to the latest available version is recommended as newer versions will likely contain security patches for AMD SEV-SNP.
-
Enter BIOS setup to enable SMEE, IOMMU, RMP coverage, and SEV-SNP. Set the SEV-ES ASID Space Limit to a non-zero number (higher is better).
-
Download the latest firmware version for your processor from AMD, unpack it, and place it in /lib/firmware/amd.
Install a kernel with version 6.11 or greater. If you're following this guide before 6.11 has been released, use 6.11-rc3. Don't use 6.11-rc4 - 6.11-rc6 as they contain a regression. 6.11-rc7+ might work.
Follow Canonical's instructions on setting up Intel TDX on Ubuntu 24.04. Note that Contrast currently only supports Intel TDX with Ubuntu 24.04.
-
Increase the user.max_inotify_instances sysctl limit by adding user.max_inotify_instances=8192 to /etc/sysctl.d/99-sysctl.conf and running sysctl --system.
CoCo on AKS is currently in preview. An extension for the az CLI is needed to create such a cluster.
-Add the extension with the following commands:
-
az extension add\ --name aks-preview \ --allow-preview true az extension update \ --name aks-preview \ --allow-preview true
-
Then register the required feature flags in your subscription to allow access to the public preview:
-
az feature register \ --namespace"Microsoft.ContainerService"\ --name"KataCcIsolationPreview"
-
The registration can take a few minutes. The status of the operation can be checked with the following
-command, which should show the registration state as Registered:
-
az feature show \ --namespace"Microsoft.ContainerService"\ --name"KataCcIsolationPreview"\ --output table
-
Afterward, refresh the registration of the ContainerService provider:
-
az provider register \ --namespace"Microsoft.ContainerService"
# Select the name for your AKS cluster azClusterName="ContrastDemo" az aks create \ --resource-group "${azResourceGroup:?}"\ --name"${azClusterName:?}"\ --kubernetes-version 1.30\ --os-sku AzureLinux \ --node-vm-size Standard_DC4as_cc_v5 \ --workload-runtime KataCcIsolation \ --node-count 1\ --generate-ssh-keys
-
Finally, update your kubeconfig with the credentials to access the cluster:
-
az aks get-credentials \ --resource-group "${azResourceGroup:?}"\ --name"${azClusterName:?}"
-
For validation, list the available nodes using kubectl:
-
kubectl get nodes
-
It should show a single node:
-
NAME STATUS ROLES AGE VERSION aks-nodepool1-32049705-vmss000000 Ready <none> 9m47s v1.29.0
-
🥳 Congratulations. You're now ready to set up your first application with Contrast. Follow this example to learn how.
After trying out Contrast, you might want to clean up the cloud resources created in this step.
-In case you've created a new resource group, you can just delete that group with
-
az group delete \ --name"${azResourceGroup:?}"
-
Deleting the resource group will also delete the cluster and all other related resources.
-
To only cleanup the AKS cluster and node pools, run
-
az aks delete \ --resource-group "${azResourceGroup:?}"\ --name"${azClusterName:?}"
Collecting logs can be a good first step to identify problems in your
-deployment. Both the CLI and the Contrast Coordinator as well as the Initializer
-can be configured to emit additional logs.
The CLI logs can be configured with the --log-level command-line flag, which
-can be set to either debug, info, warn or error. The default is info.
-Setting this to debug can get more fine-grained information as to where the
-problem lies.
The logs from the Coordinator and the Initializer can be configured via the
-environment variables CONTRAST_LOG_LEVEL, CONTRAST_LOG_FORMAT and
-CONTRAST_LOG_SUBSYSTEMS.
-
-
CONTRAST_LOG_LEVEL can be set to one of either debug, info, warn, or
-error, similar to the CLI (defaults to info).
-
CONTRAST_LOG_FORMAT can be set to text or json, determining the output
-format (defaults to text).
-
CONTRAST_LOG_SUBSYSTEMS is a comma-seperated list of subsystems that should
-be enabled for logging, which are disabled by default. Subsystems include:
-kds-getter, issuer and validator.
-To enable all subsystems, use * as the value for this environment variable.
-Warnings and error messages from subsystems get printed regardless of whether
-the subsystem is listed in the CONTRAST_LOG_SUBSYSTEMS environment variable.
-
-
To configure debug logging with all subsystems for your Coordinator, add the
-following variables to your container definition.
While the Contrast Coordinator has a policy that allows certain configurations,
-the Initializer and service mesh don't. When changing environment variables of other
-parts than the Coordinator, ensure to rerun contrast generate to update the policy.
-
To access the logs generated by the Coordinator, you can use kubectl with the
-following command:
If the Coordinator or a workload pod fails to even start, it can be helpful to
-look at the events of the pod during the startup process using the describe
-command.
LAST SEEN TYPE REASON OBJECT MESSAGE 32m Warning Failed Pod/coordinator-0 kubelet Error: failed to create containerd task: failed to create shim task: "CreateContainerRequest is blocked by policy: ...
-
A common error, as in this example, is that the container creation was blocked by the
-policy. Potential reasons are a modification of the deployment YAML without updating
-the policies afterward, or a version mismatch between Contrast components.
When generating the policies, Contrast will download the images specified in your deployment
-YAML and include their cryptographic identity. If the image tag is moved to another
-container image after the policy has been generated, the image downloaded at deploy time
-will differ from the one at generation time, and the policy enforcement won't allow the
-container to be started in the pod VM.
-
To ensure the correct image is always used, pin the container image to a fixed sha256:
A version mismatch between Contrast components can cause policy validation or attestation
-to fail. Each Contrast runtime is identifiable based on its (shortened) measurement value
-used to name the runtime class version.
-
First, analyze which runtime class is currently installed in your cluster by running
-
kubectl get runtimeclasses
-
This should give you output similar to the following one.
-
NAME HANDLER AGE contrast-cc-aks-clh-snp-7173acb5 contrast-cc-aks-clh-snp-7173acb5 23h kata-cc-isolation kata-cc 45d
-
The output shows that there are four Contrast runtime classes installed (as well as the runtime class provided
-by the AKS CoCo preview, which isn't used by Contrast).
-
Next, check if the pod that won't start has the correct runtime class configured, and the
-Coordinator uses the exact same runtime:
-
kubectl -n<namespace> get -o=jsonpath='{.spec.runtimeClassName}' pod/<pod-name> kubectl -n<namespace> get -o=jsonpath='{.spec.runtimeClassName}' pod/<coordinator-pod-name>
-
The output should list the runtime class the pod is using:
-
contrast-cc-aks-clh-snp-7173acb5
-
Version information about the currently used CLI can be obtained via the version flag:
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
Version: 1.2
CLI telemetry
-
The Contrast CLI sends telemetry data to Edgeless Systems when you use CLI commands.
-This allows to understand how Contrast is used and to improve it.
-
The CLI sends the following data:
-
-
The CLI version
-
The CLI target OS and architecture (GOOS and GOARCH)
-
The command that was run
-
The kind of error that occurred (if any)
-
-
The CLI doesn't collect sensitive information.
-The implementation is open-source and can be reviewed.
-
IP addresses may be processed or stored for security purposes.
-
The data that the CLI collects adheres to the Edgeless Systems privacy policy.
-
You can disable telemetry by setting the environment variable DO_NOT_TRACK=1 before running the CLI.
-
-
\ No newline at end of file
diff --git a/pr-preview/pr-1071/architecture/attestation.html b/pr-preview/pr-1071/architecture/attestation.html
deleted file mode 100644
index 4e841b508f..0000000000
--- a/pr-preview/pr-1071/architecture/attestation.html
+++ /dev/null
@@ -1,95 +0,0 @@
-
-
-
-
-
-Attestation in Contrast | Contrast
-
-
-
-
-
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
Version: 1.2
Attestation in Contrast
-
This document describes the attestation architecture of Contrast, adhering to the definitions of Remote ATtestation procedureS (RATS) in RFC 9334.
-The following gives a detailed description of Contrast's attestation architecture.
-At the end of this document, we included an FAQ that answers the most common questions regarding attestation in hindsight of the security benefits.
Contrast integrates with the RATS architecture, leveraging their definition of roles and processes including Attesters, Verifiers, and Relying Parties.
-
-
Figure 1: Conceptual attestation architecture. Taken from RFC 9334.
-
-
Attester: Assigned to entities that are responsible for creating Evidence which is then sent to a Verifier.
-
Verifier: These entities utilize the Evidence, Reference Values, and Endorsements. They assess the trustworthiness of the Attester by applying an Appraisal Policy for Evidence. Following this assessment, Verifiers generate Attestation Results for use by Relying Parties. The Appraisal Policy for Evidence may be provided by the Verifier Owner, programmed into the Verifier, or acquired through other means.
-
Relying Party: Assigned to entities that utilize Attestation Results, applying their own appraisal policies to make specific decisions, such as authorization decisions. This process is referred to as the "appraisal of Attestation Results." The Appraisal Policy for Attestation Results might be sourced from the Relying Party Owner, configured by the owner, embedded in the Relying Party, or obtained through other protocols or mechanisms.
This includes all Pods of the Contrast deployment that run inside Confidential Containers and generate cryptographic evidence reflecting their current configuration and state.
-Their evidence is rooted in the hardware measurements from the CPU and their confidential VM environment.
-The details of this evidence are given below in the section on evidence generation and appraisal.
-
-
Figure 2: Attestation flow of a confidential pod. Based on the layered attester graphic in RFC 9334.
-
Pods run in Contrast's runtime environment (B), effectively within a confidential VM.
-During launch, the CPU (A) measures the initial memory content of the confidential VM that contains Contrast's pod-VM image and generates the corresponding attestation evidence.
-The image is in IGVM format, encapsulating all information required to launch a virtual machine, including the kernel, the initramfs, and kernel cmdline.
-The kernel cmdline contains the root hash for dm-verity that ensures the integrity of the root filesystem.
-The root filesystem contains all components of the container's runtime environment including the guest agent (C).
-
In the userland, the guest agent takes care of enforcing the runtime policy of the pod.
-While the policy is passed in during the initialization procedure via the host, the evidence for the runtime policy is part of the CPU measurements.
-During the deployment the policy is annotated to the Kubernetes Pod resources.
-The hypervisor adds the hash of the policy to the attestation report via the HOSTDATA (on AMD SEV-SNP) or MRCONFIGID (Intel TDX) fields.
-When provided with the policy from the Kata host, the guest agent verifies that the policy's hash matches the one in the HOSTDATA/MRCONFIGID field.
-
In summary a Pod's evidence is the attestation report of the CPU that provides evidence for runtime environment and the runtime policy.
The Coordinator acts as a verifier within the Contrast deployment, configured with a Manifest that defines the reference values and serves as an appraisal policy for all pods in the deployment.
-It also pulls endorsements from hardware vendors to verify the hardware claims.
-The Coordinator operates within the cluster as a confidential container and provides similar evidence as any other Pod when it acts as an attester.
-In RATS terminology, the Coordinator's dual role is defined as a lead attester in a composite device which spans the entire deployment: Coordinator and the workload pods.
-It collects evidence from other attesters and conveys it to a verifier, generating evidence about the layout of the whole composite device based on the Manifest as the appraisal policy.
-
-
Figure 3: Contrast deployment as a composite device. Based on the composite device in RFC 9334.
-
The CLI serves as the verifier for the Coordinator and the entire Contrast deployment, containing the reference values for the Coordinator and the endorsements from hardware vendors.
-These reference values are built into the CLI during our release process and can be reproduced offline via reproducible builds.
A relying party in the Contrast scenario could be, for example, the data owner that interacts with the application.
-The relying party can use the CLI to obtain the attestation results and Contrast's CA certificates bound to these results.
-The CA certificates can then be used by the relying party to authenticate the application, for example through TLS connections.
In Contrast, attestation evidence revolves around a hardware-generated attestation report, which contains several critical pieces of information:
-
-
The hardware attestation report: This report includes details such as the chip identifier, platform information, microcode versions, and comprehensive guest measurements. The entire report is signed by the CPU's private key, ensuring the authenticity and integrity of the data provided.
-
The launch measurements: Included within the hardware attestation report, this is a digest generated by the CPU that represents a hash of all initial guest memory pages. This includes essential components like the kernel, initramfs, and the kernel command line. Notably, it incorporates the root filesystem's dm-verity root hash, verifying the integrity of the root filesystem.
-
The runtime policy hash: Also part of the hardware attestation report, this field contains the hash of the Rego policy which dictates all expected API commands and their values from the host to the Kata guest agent. It encompasses crucial settings such as dm-verity hashes for the container image layers, environment variables, and mount points.
The appraisal of this evidence in Contrast is governed by two main components:
-
-
The Manifest: A JSON file used by the Coordinator to align with reference values. It sets the expectations for runtime policy hashes for each pod and includes what should be reported in the hardware attestation report for each component of the deployment.
-
The CLI's appraisal policy: This policy encompasses expected values of the Coordinator’s guest measurements and its runtime policy. It's embedded into the CLI during the build process and ensures that any discrepancy between the built-in values and those reported by the hardware attestation can be identified and addressed. The integrity of this policy is safeguardable through reproducible builds, allowing verification against the source code reference.
-
-
Frequently asked questions about attestation in Contrast
-
What's the purpose of remote attestation in Contrast?
-
Remote attestation in Contrast ensures that software runs within a secure, isolated confidential computing environment.
-This process certifies that the memory is encrypted and confirms the integrity and authenticity of the software running within the deployment.
-By validating the runtime environment and the policies enforced on it, Contrast ensures that the system operates in a trustworthy state and hasn't been tampered with.
-
How does Contrast ensure the security of the attestation process?
-
Contrast leverages hardware-rooted security features such as AMD SEV-SNP or Intel TDX to generate cryptographic evidence of a pod’s current state and configuration.
-This evidence is checked against pre-defined appraisal policies to guarantee that only verified and authorized pods are part of a Contrast deployment.
Attestation confirms the integrity of the runtime environment and the identity of the workloads.
-It plays a critical role in preventing unauthorized changes and detecting potential modifications at runtime.
-The attestation provides integrity and authenticity guarantees, enabling relying parties—such as workload operators or data owners—to confirm the effective protection against potential threats, including malicious cloud insiders, co-tenants, or compromised workload operators.
-More details on the specific security benefits can be found here.
-
How can you verify the authenticity of attestation results?
-
Attestation results in Contrast are tied to cryptographic proofs generated and signed by the hardware itself.
-These proofs are then verified using public keys from trusted hardware vendors, ensuring that the results aren't only accurate but also resistant to tampering.
-For further authenticity verification, all of Contrast's code is reproducibly built, and the attestation evidence can be verified locally from the source code.
-
How are attestation results used by relying parties?
-
Relying parties use attestation results to make informed security decisions, such as allowing access to sensitive data or resources only if the attestation verifies the system's integrity.
-Thereafter, the use of Contrast's CA certificates in TLS connections provides a practical approach to communicate securely with the application.
In summary, Contrast's attestation strategy adheres to the RATS guidelines and consists of robust verification mechanisms that ensure each component of the deployment is secure and trustworthy.
-This comprehensive approach allows Contrast to provide a high level of security assurance to its users.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
Version: 1.2
Certificate authority
-
The Coordinator acts as a certificate authority (CA) for the workloads
-defined in the manifest.
-After a workload pod's attestation has been verified by the Coordinator,
-it receives a mesh certificate and the mesh CA certificate.
-The mesh certificate can be used for example in a TLS connection as the server or
-client certificate to proof to the other party that the workload has been
-verified by the Coordinator. The other party can verify the mesh certificate
-with the mesh CA certificate. While the certificates can be used by the workload
-developer in different ways, they're automatically used in Contrast's service
-mesh to establish mTLS connections between workloads in the same deployment.
The Coordinator establishes a public key infrastructure (PKI) for all workloads
-contained in the manifest. The Coordinator holds three certificates: the root CA
-certificate, the intermediate CA certificate, and the mesh CA certificate.
-The root CA certificate is a long-lasting certificate and its private key signs
-the intermediate CA certificate. The intermediate CA certificate and the mesh CA
-certificate share the same private key. This intermediate private key is used
-to sign the mesh certificates. Moreover, the intermediate private key and
-therefore the intermediate CA certificate and the mesh CA certificate are
-rotated when setting a new manifest.
Depending on the configuration of the first manifest, it allows the workload
-owner to update the manifest and, therefore, the deployment.
-Workload owners and data owners can be mutually untrusted parties.
-To protect against the workload owner silently introducing malicious containers,
-the Coordinator rotates the intermediate private key every time the manifest is
-updated and, therefore, the
-intermediate CA certificate and mesh CA certificate. If the user doesn't
-trust the workload owner, they use the mesh CA certificate obtained when they
-verified the Coordinator and the manifest. This ensures that the user only
-connects to workloads defined in the manifest they verified since only those
-workloads' certificates are signed with this intermediate private key.
-
Similarly, the service mesh also uses the mesh CA certificate obtained when the
-workload was started, so the workload only trusts endpoints that have been
-verified by the Coordinator based on the same manifest. Consequently, a
-manifest update requires a fresh rollout of the services in the service mesh.
The root CA certificate is returned when verifying the Coordinator.
-The data owner can use it to verify the mesh certificates of the workloads.
-This should only be used if the data owner trusts all future updates to the
-manifest and workloads. This is, for instance, the case when the workload owner is
-the same entity as the data owner.
-
The mesh CA certificate is returned when verifying the Coordinator.
-The data owner can use it to verify the mesh certificates of the workloads.
-This certificate is bound to the manifest set when the Coordinator is verified.
-If the manifest is updated, the mesh CA certificate changes.
-New workloads will receive mesh certificates signed by the new mesh CA certificate.
-The Coordinator with the new manifest needs to be verified to retrieve the new mesh CA certificate.
-The service mesh also uses the mesh CA certificate to verify the mesh certificates.
-
The intermediate CA certificate links the root CA certificate to the
-mesh certificate so that the mesh certificate can be verified with the root CA
-certificate. It's part of the certificate chain handed out by
-endpoints in the service mesh.
-
The mesh certificate is part of the certificate chain handed out by
-endpoints in the service mesh. During the startup of a pod, the Initializer
-requests a certificate from the Coordinator. This mesh certificate will be returned if the Coordinator successfully
-verifies the workload. The mesh certificate
-contains X.509 extensions with information from the workloads attestation
-document.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
Version: 1.2
Observability
-
The Contrast Coordinator can expose metrics in the
-Prometheus format. These can be monitored to quickly
-identify problems in the gRPC layer or attestation errors. Prometheus metrics
-are numerical values associated with a name and additional key/values pairs,
-called labels.
The metrics can be accessed at the Coordinator pod at the port specified in the
-CONTRAST_METRICS_PORT environment variable under the /metrics endpoint. By
-default, this environment variable isn't specified, hence no metrics will be
-exposed.
-
The Coordinator exports gRPC metrics under the prefix contrast_grpc_server_.
-These metrics are labeled with the gRPC service name and method name.
-Metrics of interest include contrast_grpc_server_handled_total, which counts
-the number of requests by return code, and
-contrast_grpc_server_handling_seconds_bucket, which produces a histogram of
-request latency.
The meshapi.MeshAPI service records metrics for the method NewMeshCert, which
-gets called by the Initializer when starting a
-new workload. Attestation failures from workloads to the Coordinator can be
-tracked with the counter contrast_meshapi_attestation_failures_total.
-
The current manifest generation is exposed as a
-gauge with the metric
-name contrast_coordinator_manifest_generation. If no manifest is set at the
-Coordinator, this counter will be zero.
The Service Mesh can be configured to expose
-metrics via its Envoy admin
-interface. Be
-aware that the admin interface can expose private information and allows
-destructive operations to be performed. To enable the admin interface for the
-Service Mesh, set the annotation
-contrast.edgeless.systems/servicemesh-admin-interface-port in the configuration
-of your workload. If this annotation is set, the admin interface will be started
-on this port.
-
To access the admin interface, the ingress settings of the Service Mesh have to
-be configured to allow access to the specified port (see Configuring the
-Proxy). All metrics will be
-exposed under the /stats endpoint. Metrics in Prometheus format can be scraped
-from the /stats/prometheus endpoint.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
Version: 1.2
Secrets & recovery
-
When the Coordinator is configured with the initial manifest, it generates a random secret seed.
-From this seed, it uses an HKDF to derive the CA root key and a signing key for the manifest history.
-This derivation is deterministic, so the seed can be used to bring any Coordinator to this Coordinator's state.
-
The secret seed is returned to the user on the first call to contrast set, encrypted with the user's public seed share owner key.
-If no seed share owner key is provided, a key is generated and stored in the working directory.
The Coordinator runs as a StatefulSet with a dynamically provisioned persistent volume.
-This volume stores the manifest history and the associated runtime policies.
-The manifest isn't considered sensitive information, because it needs to be passed to the untrusted infrastructure in order to start workloads.
-However, the Coordinator must ensure its integrity and that the persisted data corresponds to the manifests set by authorized users.
-Thus, the manifest is stored in plain text, but is signed with a private key derived from the Coordinator's secret seed.
When a Coordinator starts up, it doesn't have access to the signing secret and can thus not verify the integrity of the persisted manifests.
-It needs to be provided with the secret seed, from which it can derive the signing key that verifies the signatures.
-This procedure is called recovery and is initiated by the workload owner.
-The CLI decrypts the secret seed using the private seed share owner key, verifies the Coordinator and sends the seed through the Recover method.
-The Coordinator recovers its key material and verifies the manifest history signature.
The Coordinator provides each workload a secret seed during attestation.
-This secret can be used by the workload to derive additional secrets for example to encrypt persistent data.
-Like the workload certificates, it's written to the secrets/workload-secret-seed path under the shared Kubernetes volume contrast-secrets.
-
warning
The workload owner can decrypt data encrypted with secrets derived from the workload secret.
-The workload owner can derive the workload secret themselves, since it's derived from the secret seed known to the workload owner.
-If the data owner and the workload owner is the same entity, then they can safely use the workload secrets.
Remember that persistent volumes from the cloud provider are untrusted.
-Using the workload secret, applications can set up trusted storage on top of untrusted block devices.
-The following, slightly abbreviated resource outlines how this could be realized:
-
warning
This configuration snippet is intended to be educational and needs to be refined and adapted to your production environment.
-Using it as-is may result in data corruption or data loss.
-
apiVersion: apps/v1 kind: StatefulSet metadata: name: volume-tester spec: template: spec: containers: -name: main image: my.registry/my-image@sha256:0123... command: - /bin/sh --ec -|# <-- Custom script that mounts the encrypted disk and then calls the original application. device=/dev/csi0 if ! cryptsetup isLuks $device; then cryptsetup luksFormat $device /contrast/secrets/workload-secret-seed cryptsetup open $device state -d /contrast/secrets/workload-secret-seed mkfs.ext4 /dev/mapper/state cryptsetup close state fi cryptsetup open $device state -d /contrast/secrets/workload-secret-seed /path/to/original/app name: volume-tester volumeDevices: -name: state devicePath: /dev/csi0 securityContext: privileged:true# <-- This is necessary for mounting devices. runtimeClassName: contrast-cc volumeClaimTemplates: -apiVersion: v1 kind: PersistentVolumeClaim metadata: name: state spec: accessModes: - ReadWriteOnce resources: requests: storage: 1Gi volumeMode: Block # <-- The requested volume needs to be a raw block device.
-
note
This example assumes that you can modify the container image to include a shell and the cryptsetup utility.
-Alternatively, you can set up a secure mount from a sidecar container inside an emptyDir mount shared with the main container.
-The Contrast end-to-end tests include an example of this type of mount.
Contrast is now open source! Check it out on GitHub and leave us a ⭐️ if you like it!
Version: 1.2
Security Considerations
-
Contrast ensures application integrity and provides secure means of communication and bootstrapping (see security benefits).
-However, care must be taken when interacting with the outside of Contrast's confidential environment.
-This page presents some tips for writing secure applications and outlines the trust boundaries app developers need to know.
The application receives credentials from the Contrast Coordinator during initialization.
-This allows to authenticate towards peers and to verify credentials received from peers.
-The application should use the certificate bundle to authenticate incoming requests and be wary of unauthenticated requests or requests with a different root of trust (for example the internet PKI).
-
The recommendation to authenticate not only applies to network traffic, but also to volumes, GPUs and other devices.
-Generally speaking, all information provided by the world outside the confidential VM should be treated with due scepticism, especially if it's not authenticated.
-Common cases where Kubernetes apps interact with external services include DNS, Kubernetes API clients and cloud storage endpoints.
Any external persistence should be encrypted with an authenticated cipher.
-This recommendation applies to block devices or filesystems mounted into the container, but also to cloud blob storage or external databases.
Workload policies serve as workload identities.
-From the perspective of the Contrast Coordinator, all workloads that authenticate with the same policy are equal.
-Thus, it's not possible to disambiguate, for example, pods spawned from a deployment or to limit the amount of certificates issued per policy.
-
Container image references from Kubernetes resource definitions are taken into account when generating the policy.
-A mutable reference may lead to policy failures or unverified image content, depending on the Contrast runtime.
-Reliability and security can only be ensured with a full image reference, including digest.
-The docker pull documentation explains pinned image references in detail.
-
Policies can only verify what can be inferred at generation time.
-Some attributes of Kubernetes pods can't be predicted and thus can't be verified.
-Particularly the downward API contains many fields that are dynamic or depend on the host environment, rendering it unsafe for process environment or arguments.
-The same goes for ConfigMap and Secret resources, which can also be used to populate container fields.
-If the application requires such external information, it should be injected as a mount point and carefully inspected before use.
-
Another type of dynamic content are persistent volumes.
-Any volumes mounted to the pod need to be scrutinized, and sensitive data must not be written to unprotected volumes.
-Ideally, a volume is mounted as a raw block device and authenticated encryption is added within the confidential container.
By default, container logs are visible to the host.
-Sensitive information shouldn't be logged.
-
As of right now, hiding logs isn't natively supported.
-If ReadStreamRequest is denied in the policy, the Kata Agent stops reading the logs.
-This causes the pipes used for standard out and standard error to fill up and potentially deadlock the container.
-If absolutely required, standard out and standard error should be manually redirected to /dev/null inside the container.
-
-
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/css/styles.e9486642.css b/pr-preview/pr-1071/assets/css/styles.e9486642.css
deleted file mode 100644
index f8f10faf4c..0000000000
--- a/pr-preview/pr-1071/assets/css/styles.e9486642.css
+++ /dev/null
@@ -1 +0,0 @@
-@import url(https://fonts.googleapis.com/css2?family=Inter:wght@100..900&display=swap);.col,.container{padding:0 var(--ifm-spacing-horizontal);width:100%}.markdown>h2,.markdown>h3,.markdown>h4,.markdown>h5,.markdown>h6{margin-bottom:calc(var(--ifm-heading-vertical-rhythm-bottom)*var(--ifm-leading))}.markdown li,body{word-wrap:break-word}body,ol ol,ol ul,ul ol,ul ul{margin:0}pre,table{overflow:auto}blockquote,pre{margin:0 0 var(--ifm-spacing-vertical)}.breadcrumbs__link,.button{transition-timing-function:var(--ifm-transition-timing-default)}.button,code{vertical-align:middle}.button--outline.button--active,.button--outline:active,.button--outline:hover,:root{--ifm-button-color:var(--ifm-font-color-base-inverse)}.menu__link:hover,a{transition:color var(--ifm-transition-fast) var(--ifm-transition-timing-default)}.navbar--dark,:root{--ifm-navbar-link-hover-color:var(--ifm-color-primary)}.menu,.navbar-sidebar{overflow-x:hidden}:root,html[data-theme=dark]{--ifm-color-emphasis-500:var(--ifm-color-gray-500)}.toggleButton_gllP,html{-webkit-tap-highlight-color:transparent}:root,body.dark,body[data-theme=dark]{--aa-icon-color-rgb:119,119,163;--aa-scrollbar-thumb-background-color-rgb:var(--aa-background-color-rgb)}.aa-List,.clean-list,.containsTaskList_mC6p,.details_lb9f>summary,.dropdown__menu,.menu__list{list-style:none}:root{--ifm-color-scheme:light;--ifm-dark-value:10%;--ifm-darker-value:15%;--ifm-darkest-value:30%;--ifm-light-value:15%;--ifm-lighter-value:30%;--ifm-lightest-value:50%;--ifm-contrast-background-value:90%;--ifm-contrast-foreground-value:70%;--ifm-contrast-background-dark-value:70%;--ifm-contrast-foreground-dark-value:90%;--ifm-color-primary:#3578e5;--ifm-color-secondary:#ebedf0;--ifm-color-success:#00a400;--ifm-color-info:#54c7ec;--ifm-color-warning:#ffba00;--ifm-color-danger:#fa383e;--ifm-color-primary-dark:#306cce;--ifm-color-primary-darker:#2d66c3;--ifm-color-primary-darkest:#2554a0;--ifm-color-primary-light:#538ce9;--ifm-color-primary-lighter:#72a1ed;--ifm-color-primary-lightest:#9abcf2;--ifm-color-primary-contrast-background:#ebf2fc;--ifm-color-primary-contrast-foreground:#102445;--ifm-color-secondary-dark:#d4d5d8;--ifm-color-secondary-darker:#c8c9cc;--ifm-color-secondary-darkest:#a4a6a8;--ifm-color-secondary-light:#eef0f2;--ifm-color-secondary-lighter:#f1f2f5;--ifm-color-secondary-lightest:#f5f6f8;--ifm-color-secondary-contrast-background:#fdfdfe;--ifm-color-secondary-contrast-foreground:#474748;--ifm-color-success-dark:#009400;--ifm-color-success-darker:#008b00;--ifm-color-success-darkest:#007300;--ifm-color-success-light:#26b226;--ifm-color-success-lighter:#4dbf4d;--ifm-color-success-lightest:#80d280;--ifm-color-success-contrast-background:#e6f6e6;--ifm-color-success-contrast-foreground:#003100;--ifm-color-info-dark:#4cb3d4;--ifm-color-info-darker:#47a9c9;--ifm-color-info-darkest:#3b8ba5;--ifm-color-info-light:#6ecfef;--ifm-color-info-lighter:#87d8f2;--ifm-color-info-lightest:#aae3f6;--ifm-color-info-contrast-background:#eef9fd;--ifm-color-info-contrast-foreground:#193c47;--ifm-color-warning-dark:#e6a700;--ifm-color-warning-darker:#d99e00;--ifm-color-warning-darkest:#b38200;--ifm-color-warning-light:#ffc426;--ifm-color-warning-lighter:#ffcf4d;--ifm-color-warning-lightest:#ffdd80;--ifm-color-warning-contrast-background:#fff8e6;--ifm-color-warning-contrast-foreground:#4d3800;--ifm-color-danger-dark:#e13238;--ifm-color-danger-darker:#d53035;--ifm-color-danger-darkest:#af272b;--ifm-color-danger-light:#fb565b;--ifm-color-danger-lighter:#fb7478;--ifm-color-danger-lightest:#fd9c9f;--ifm-color-danger-contrast-background:#ffebec;--ifm-color-danger-contrast-foreground:#4b1113;--ifm-color-white:#fff;--ifm-color-black:#000;--ifm-color-gray-0:var(--ifm-color-white);--ifm-color-gray-100:#f5f6f7;--ifm-color-gray-200:#ebedf0;--ifm-color-gray-300:#dadde1;--ifm-color-gray-400:#ccd0d5;--ifm-color-gray-500:#bec3c9;--ifm-color-gray-600:#8d949e;--ifm-color-gray-700:#606770;--ifm-color-gray-800:#444950;--ifm-color-gray-900:#1c1e21;--ifm-color-gray-1000:var(--ifm-color-black);--ifm-color-emphasis-0:var(--ifm-color-gray-0);--ifm-color-emphasis-100:var(--ifm-color-gray-100);--ifm-color-emphasis-200:var(--ifm-color-gray-200);--ifm-color-emphasis-300:var(--ifm-color-gray-300);--ifm-color-emphasis-400:var(--ifm-color-gray-400);--ifm-color-emphasis-600:var(--ifm-color-gray-600);--ifm-color-emphasis-700:var(--ifm-color-gray-700);--ifm-color-emphasis-800:var(--ifm-color-gray-800);--ifm-color-emphasis-900:var(--ifm-color-gray-900);--ifm-color-emphasis-1000:var(--ifm-color-gray-1000);--ifm-color-content:var(--ifm-color-emphasis-900);--ifm-color-content-inverse:var(--ifm-color-emphasis-0);--ifm-color-content-secondary:#525860;--ifm-background-color:#0000;--ifm-background-surface-color:var(--ifm-color-content-inverse);--ifm-global-border-width:1px;--ifm-global-radius:0.4rem;--ifm-hover-overlay:#0000000d;--ifm-font-color-base:var(--ifm-color-content);--ifm-font-color-base-inverse:var(--ifm-color-content-inverse);--ifm-font-color-secondary:var(--ifm-color-content-secondary);--ifm-font-family-base:system-ui,-apple-system,Segoe UI,Roboto,Ubuntu,Cantarell,Noto Sans,sans-serif,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";--ifm-font-family-monospace:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",monospace;--ifm-font-size-base:100%;--ifm-font-weight-light:300;--ifm-font-weight-normal:400;--ifm-font-weight-semibold:500;--ifm-font-weight-bold:700;--ifm-font-weight-base:var(--ifm-font-weight-normal);--ifm-line-height-base:1.65;--ifm-global-spacing:1rem;--ifm-spacing-vertical:var(--ifm-global-spacing);--ifm-spacing-horizontal:var(--ifm-global-spacing);--ifm-transition-fast:200ms;--ifm-transition-slow:400ms;--ifm-transition-timing-default:cubic-bezier(0.08,0.52,0.52,1);--ifm-global-shadow-lw:0 1px 2px 0 #0000001a;--ifm-global-shadow-md:0 5px 40px #0003;--ifm-global-shadow-tl:0 12px 28px 0 #0003,0 2px 4px 0 #0000001a;--ifm-z-index-dropdown:100;--ifm-z-index-fixed:200;--ifm-z-index-overlay:400;--ifm-container-width:1140px;--ifm-container-width-xl:1320px;--ifm-code-background:#f6f7f8;--ifm-code-border-radius:var(--ifm-global-radius);--ifm-code-font-size:90%;--ifm-code-padding-horizontal:0.1rem;--ifm-code-padding-vertical:0.1rem;--ifm-pre-background:var(--ifm-code-background);--ifm-pre-border-radius:var(--ifm-code-border-radius);--ifm-pre-color:inherit;--ifm-pre-line-height:1.45;--ifm-pre-padding:1rem;--ifm-heading-color:inherit;--ifm-heading-margin-top:0;--ifm-heading-margin-bottom:var(--ifm-spacing-vertical);--ifm-heading-font-family:var(--ifm-font-family-base);--ifm-heading-font-weight:var(--ifm-font-weight-bold);--ifm-heading-line-height:1.25;--ifm-h1-font-size:2rem;--ifm-h2-font-size:1.5rem;--ifm-h3-font-size:1.25rem;--ifm-h4-font-size:1rem;--ifm-h5-font-size:0.875rem;--ifm-h6-font-size:0.85rem;--ifm-image-alignment-padding:1.25rem;--ifm-leading-desktop:1.25;--ifm-leading:calc(var(--ifm-leading-desktop)*1rem);--ifm-list-left-padding:2rem;--ifm-list-margin:1rem;--ifm-list-item-margin:0.25rem;--ifm-list-paragraph-margin:1rem;--ifm-table-cell-padding:0.75rem;--ifm-table-background:#0000;--ifm-table-stripe-background:#00000008;--ifm-table-border-width:1px;--ifm-table-border-color:var(--ifm-color-emphasis-300);--ifm-table-head-background:inherit;--ifm-table-head-color:inherit;--ifm-table-head-font-weight:var(--ifm-font-weight-bold);--ifm-table-cell-color:inherit;--ifm-link-color:var(--ifm-color-primary);--ifm-link-decoration:none;--ifm-link-hover-color:var(--ifm-link-color);--ifm-link-hover-decoration:underline;--ifm-paragraph-margin-bottom:var(--ifm-leading);--ifm-blockquote-font-size:var(--ifm-font-size-base);--ifm-blockquote-border-left-width:2px;--ifm-blockquote-padding-horizontal:var(--ifm-spacing-horizontal);--ifm-blockquote-padding-vertical:0;--ifm-blockquote-shadow:none;--ifm-blockquote-color:var(--ifm-color-emphasis-800);--ifm-blockquote-border-color:var(--ifm-color-emphasis-300);--ifm-hr-background-color:var(--ifm-color-emphasis-500);--ifm-hr-height:1px;--ifm-hr-margin-vertical:1.5rem;--ifm-scrollbar-size:7px;--ifm-scrollbar-track-background-color:#f1f1f1;--ifm-scrollbar-thumb-background-color:silver;--ifm-scrollbar-thumb-hover-background-color:#a7a7a7;--ifm-alert-background-color:inherit;--ifm-alert-border-color:inherit;--ifm-alert-border-radius:var(--ifm-global-radius);--ifm-alert-border-width:0px;--ifm-alert-border-left-width:5px;--ifm-alert-color:var(--ifm-font-color-base);--ifm-alert-padding-horizontal:var(--ifm-spacing-horizontal);--ifm-alert-padding-vertical:var(--ifm-spacing-vertical);--ifm-alert-shadow:var(--ifm-global-shadow-lw);--ifm-avatar-intro-margin:1rem;--ifm-avatar-intro-alignment:inherit;--ifm-avatar-photo-size:3rem;--ifm-badge-background-color:inherit;--ifm-badge-border-color:inherit;--ifm-badge-border-radius:var(--ifm-global-radius);--ifm-badge-border-width:var(--ifm-global-border-width);--ifm-badge-color:var(--ifm-color-white);--ifm-badge-padding-horizontal:calc(var(--ifm-spacing-horizontal)*0.5);--ifm-badge-padding-vertical:calc(var(--ifm-spacing-vertical)*0.25);--ifm-breadcrumb-border-radius:1.5rem;--ifm-breadcrumb-spacing:0.5rem;--ifm-breadcrumb-color-active:var(--ifm-color-primary);--ifm-breadcrumb-item-background-active:var(--ifm-hover-overlay);--ifm-breadcrumb-padding-horizontal:0.8rem;--ifm-breadcrumb-padding-vertical:0.4rem;--ifm-breadcrumb-size-multiplier:1;--ifm-breadcrumb-separator:url('data:image/svg+xml;utf8,');--ifm-breadcrumb-separator-filter:none;--ifm-breadcrumb-separator-size:0.5rem;--ifm-breadcrumb-separator-size-multiplier:1.25;--ifm-button-background-color:inherit;--ifm-button-border-color:var(--ifm-button-background-color);--ifm-button-border-width:var(--ifm-global-border-width);--ifm-button-font-weight:var(--ifm-font-weight-bold);--ifm-button-padding-horizontal:1.5rem;--ifm-button-padding-vertical:0.375rem;--ifm-button-size-multiplier:1;--ifm-button-transition-duration:var(--ifm-transition-fast);--ifm-button-border-radius:calc(var(--ifm-global-radius)*var(--ifm-button-size-multiplier));--ifm-button-group-spacing:2px;--ifm-card-background-color:var(--ifm-background-surface-color);--ifm-card-border-radius:calc(var(--ifm-global-radius)*2);--ifm-card-horizontal-spacing:var(--ifm-global-spacing);--ifm-card-vertical-spacing:var(--ifm-global-spacing);--ifm-toc-border-color:var(--ifm-color-emphasis-300);--ifm-toc-link-color:var(--ifm-color-content-secondary);--ifm-toc-padding-vertical:0.5rem;--ifm-toc-padding-horizontal:0.5rem;--ifm-dropdown-background-color:var(--ifm-background-surface-color);--ifm-dropdown-font-weight:var(--ifm-font-weight-semibold);--ifm-dropdown-link-color:var(--ifm-font-color-base);--ifm-dropdown-hover-background-color:var(--ifm-hover-overlay);--ifm-footer-background-color:var(--ifm-color-emphasis-100);--ifm-footer-color:inherit;--ifm-footer-link-color:var(--ifm-color-emphasis-700);--ifm-footer-link-hover-color:var(--ifm-color-primary);--ifm-footer-link-horizontal-spacing:0.5rem;--ifm-footer-padding-horizontal:calc(var(--ifm-spacing-horizontal)*2);--ifm-footer-padding-vertical:calc(var(--ifm-spacing-vertical)*2);--ifm-footer-title-color:inherit;--ifm-footer-logo-max-width:min(30rem,90vw);--ifm-hero-background-color:var(--ifm-background-surface-color);--ifm-hero-text-color:var(--ifm-color-emphasis-800);--ifm-menu-color:var(--ifm-color-emphasis-700);--ifm-menu-color-active:var(--ifm-color-primary);--ifm-menu-color-background-active:var(--ifm-hover-overlay);--ifm-menu-color-background-hover:var(--ifm-hover-overlay);--ifm-menu-link-padding-horizontal:0.75rem;--ifm-menu-link-padding-vertical:0.375rem;--ifm-menu-link-sublist-icon:url('data:image/svg+xml;utf8,');--ifm-menu-link-sublist-icon-filter:none;--ifm-navbar-background-color:var(--ifm-background-surface-color);--ifm-navbar-height:3.75rem;--ifm-navbar-item-padding-horizontal:0.75rem;--ifm-navbar-item-padding-vertical:0.25rem;--ifm-navbar-link-color:var(--ifm-font-color-base);--ifm-navbar-link-active-color:var(--ifm-link-color);--ifm-navbar-padding-horizontal:var(--ifm-spacing-horizontal);--ifm-navbar-padding-vertical:calc(var(--ifm-spacing-vertical)*0.5);--ifm-navbar-shadow:var(--ifm-global-shadow-lw);--ifm-navbar-search-input-background-color:var(--ifm-color-emphasis-200);--ifm-navbar-search-input-color:var(--ifm-color-emphasis-800);--ifm-navbar-search-input-placeholder-color:var(--ifm-color-emphasis-500);--ifm-navbar-search-input-icon:url('data:image/svg+xml;utf8,');--ifm-navbar-sidebar-width:83vw;--ifm-pagination-border-radius:var(--ifm-global-radius);--ifm-pagination-color-active:var(--ifm-color-primary);--ifm-pagination-font-size:1rem;--ifm-pagination-item-active-background:var(--ifm-hover-overlay);--ifm-pagination-page-spacing:0.2em;--ifm-pagination-padding-horizontal:calc(var(--ifm-spacing-horizontal)*1);--ifm-pagination-padding-vertical:calc(var(--ifm-spacing-vertical)*0.25);--ifm-pagination-nav-border-radius:var(--ifm-global-radius);--ifm-pagination-nav-color-hover:var(--ifm-color-primary);--ifm-pills-color-active:var(--ifm-color-primary);--ifm-pills-color-background-active:var(--ifm-hover-overlay);--ifm-pills-spacing:0.125rem;--ifm-tabs-color:var(--ifm-font-color-secondary);--ifm-tabs-color-active:var(--ifm-color-primary);--ifm-tabs-color-active-border:var(--ifm-tabs-color-active);--ifm-tabs-padding-horizontal:1rem;--ifm-tabs-padding-vertical:1rem;--docusaurus-progress-bar-color:var(--ifm-color-primary);--ifm-color-primary:#8b04dd;--ifm-color-primary-dark:#58089e;--ifm-color-primary-darker:#330663;--ifm-color-primary-darkest:#1c033c;--ifm-color-primary-light:#8b04dd;--ifm-color-primary-lighter:#b873f4;--ifm-color-primary-lightest:#e3d2ff;--ifm-font-family-base:"Inter",sans-serif;--ifm-code-font-size:95%;--docusaurus-highlighted-code-line-bg:#0000001a;--docusaurus-tag-list-border:var(--ifm-color-emphasis-300);--docusaurus-collapse-button-bg:#0000;--docusaurus-collapse-button-bg-hover:#0000001a;--doc-sidebar-width:300px;--doc-sidebar-hidden-width:30px;--docusaurus-announcement-bar-height:auto;--aa-search-input-height:44px;--aa-input-icon-size:20px;--aa-base-unit:16;--aa-spacing-factor:1;--aa-spacing:calc(var(--aa-base-unit)*var(--aa-spacing-factor)*1px);--aa-spacing-half:calc(var(--aa-spacing)/2);--aa-panel-max-height:650px;--aa-base-z-index:9999;--aa-font-size:calc(var(--aa-base-unit)*1px);--aa-font-family:inherit;--aa-font-weight-medium:500;--aa-font-weight-semibold:600;--aa-font-weight-bold:700;--aa-icon-size:20px;--aa-icon-stroke-width:1.6;--aa-icon-color-alpha:1;--aa-action-icon-size:20px;--aa-text-color-rgb:38,38,39;--aa-text-color-alpha:1;--aa-primary-color-rgb:62,52,211;--aa-primary-color-alpha:0.2;--aa-muted-color-rgb:128,126,163;--aa-muted-color-alpha:0.6;--aa-panel-border-color-rgb:128,126,163;--aa-panel-border-color-alpha:0.3;--aa-input-border-color-rgb:128,126,163;--aa-input-border-color-alpha:0.8;--aa-background-color-rgb:255,255,255;--aa-background-color-alpha:1;--aa-input-background-color-rgb:255,255,255;--aa-input-background-color-alpha:1;--aa-selected-color-rgb:179,173,214;--aa-selected-color-alpha:0.205;--aa-description-highlight-background-color-rgb:245,223,77;--aa-description-highlight-background-color-alpha:0.5;--aa-detached-media-query:(max-width:680px);--aa-detached-modal-media-query:(min-width:680px);--aa-detached-modal-max-width:680px;--aa-detached-modal-max-height:500px;--aa-overlay-color-rgb:115,114,129;--aa-overlay-color-alpha:0.4;--aa-panel-shadow:0 0 0 1px #23263b1a,0 6px 16px -4px #23263b26;--aa-scrollbar-width:13px;--aa-scrollbar-track-background-color-rgb:234,234,234;--aa-scrollbar-track-background-color-alpha:1;--aa-scrollbar-thumb-background-color-alpha:1;--aa-search-input-height:36px}.badge--danger,.badge--info,.badge--primary,.badge--secondary,.badge--success,.badge--warning{--ifm-badge-border-color:var(--ifm-badge-background-color)}.button--link,.button--outline{--ifm-button-background-color:#0000}*,.aa-Autocomplete *,.aa-DetachedFormContainer *,.aa-Panel *{box-sizing:border-box}html{background-color:var(--ifm-background-color);color:var(--ifm-font-color-base);color-scheme:var(--ifm-color-scheme);font:var(--ifm-font-size-base)/var(--ifm-line-height-base) var(--ifm-font-family-base);-webkit-font-smoothing:antialiased;text-rendering:optimizelegibility;-webkit-text-size-adjust:100%;text-size-adjust:100%}iframe{border:0;color-scheme:auto}.container{margin:0 auto;max-width:var(--ifm-container-width)}.container--fluid{max-width:inherit}.row{display:flex;flex-wrap:wrap;margin:0 calc(var(--ifm-spacing-horizontal)*-1)}.list_eTzJ article:last-child,.margin-bottom--none,.margin-vert--none,.markdown>:last-child{margin-bottom:0!important}.margin-top--none,.margin-vert--none,.tabItem_LNqP{margin-top:0!important}.row--no-gutters{margin-left:0;margin-right:0}.margin-horiz--none,.margin-right--none{margin-right:0!important}.row--no-gutters>.col{padding-left:0;padding-right:0}.row--align-top{align-items:flex-start}.row--align-bottom{align-items:flex-end}.menuExternalLink_NmtK,.row--align-center{align-items:center}.row--align-stretch{align-items:stretch}.row--align-baseline{align-items:baseline}.col{--ifm-col-width:100%;flex:1 0;margin-left:0;max-width:var(--ifm-col-width)}.padding-bottom--none,.padding-vert--none{padding-bottom:0!important}.padding-top--none,.padding-vert--none{padding-top:0!important}.padding-horiz--none,.padding-left--none{padding-left:0!important}.padding-horiz--none,.padding-right--none{padding-right:0!important}.col[class*=col--]{flex:0 0 var(--ifm-col-width)}.col--1{--ifm-col-width:8.33333%}.col--offset-1{margin-left:8.33333%}.col--2{--ifm-col-width:16.66667%}.col--offset-2{margin-left:16.66667%}.col--3{--ifm-col-width:25%}.col--offset-3{margin-left:25%}.col--4{--ifm-col-width:33.33333%}.col--offset-4{margin-left:33.33333%}.col--5{--ifm-col-width:41.66667%}.col--offset-5{margin-left:41.66667%}.col--6{--ifm-col-width:50%}.col--offset-6{margin-left:50%}.col--7{--ifm-col-width:58.33333%}.col--offset-7{margin-left:58.33333%}.col--8{--ifm-col-width:66.66667%}.col--offset-8{margin-left:66.66667%}.col--9{--ifm-col-width:75%}.col--offset-9{margin-left:75%}.col--10{--ifm-col-width:83.33333%}.col--offset-10{margin-left:83.33333%}.col--11{--ifm-col-width:91.66667%}.col--offset-11{margin-left:91.66667%}.col--12{--ifm-col-width:100%}.col--offset-12{margin-left:100%}.margin-horiz--none,.margin-left--none{margin-left:0!important}.margin--none{margin:0!important}.margin-bottom--xs,.margin-vert--xs{margin-bottom:.25rem!important}.margin-top--xs,.margin-vert--xs{margin-top:.25rem!important}.margin-horiz--xs,.margin-left--xs{margin-left:.25rem!important}.margin-horiz--xs,.margin-right--xs{margin-right:.25rem!important}.margin--xs{margin:.25rem!important}.margin-bottom--sm,.margin-vert--sm{margin-bottom:.5rem!important}.margin-top--sm,.margin-vert--sm{margin-top:.5rem!important}.margin-horiz--sm,.margin-left--sm{margin-left:.5rem!important}.margin-horiz--sm,.margin-right--sm{margin-right:.5rem!important}.margin--sm{margin:.5rem!important}.margin-bottom--md,.margin-vert--md{margin-bottom:1rem!important}.margin-top--md,.margin-vert--md{margin-top:1rem!important}.margin-horiz--md,.margin-left--md{margin-left:1rem!important}.margin-horiz--md,.margin-right--md{margin-right:1rem!important}.margin--md{margin:1rem!important}.margin-bottom--lg,.margin-vert--lg{margin-bottom:2rem!important}.margin-top--lg,.margin-vert--lg{margin-top:2rem!important}.margin-horiz--lg,.margin-left--lg{margin-left:2rem!important}.margin-horiz--lg,.margin-right--lg{margin-right:2rem!important}.margin--lg{margin:2rem!important}.margin-bottom--xl,.margin-vert--xl{margin-bottom:5rem!important}.margin-top--xl,.margin-vert--xl{margin-top:5rem!important}.margin-horiz--xl,.margin-left--xl{margin-left:5rem!important}.margin-horiz--xl,.margin-right--xl{margin-right:5rem!important}.margin--xl{margin:5rem!important}.padding--none{padding:0!important}.padding-bottom--xs,.padding-vert--xs{padding-bottom:.25rem!important}.padding-top--xs,.padding-vert--xs{padding-top:.25rem!important}.padding-horiz--xs,.padding-left--xs{padding-left:.25rem!important}.padding-horiz--xs,.padding-right--xs{padding-right:.25rem!important}.padding--xs{padding:.25rem!important}.padding-bottom--sm,.padding-vert--sm{padding-bottom:.5rem!important}.padding-top--sm,.padding-vert--sm{padding-top:.5rem!important}.padding-horiz--sm,.padding-left--sm{padding-left:.5rem!important}.padding-horiz--sm,.padding-right--sm{padding-right:.5rem!important}.padding--sm{padding:.5rem!important}.padding-bottom--md,.padding-vert--md{padding-bottom:1rem!important}.padding-top--md,.padding-vert--md{padding-top:1rem!important}.padding-horiz--md,.padding-left--md{padding-left:1rem!important}.padding-horiz--md,.padding-right--md{padding-right:1rem!important}.padding--md{padding:1rem!important}.padding-bottom--lg,.padding-vert--lg{padding-bottom:2rem!important}.padding-top--lg,.padding-vert--lg{padding-top:2rem!important}.padding-horiz--lg,.padding-left--lg{padding-left:2rem!important}.padding-horiz--lg,.padding-right--lg{padding-right:2rem!important}.padding--lg{padding:2rem!important}.padding-bottom--xl,.padding-vert--xl{padding-bottom:5rem!important}.padding-top--xl,.padding-vert--xl{padding-top:5rem!important}.padding-horiz--xl,.padding-left--xl{padding-left:5rem!important}.padding-horiz--xl,.padding-right--xl{padding-right:5rem!important}.padding--xl{padding:5rem!important}code{background-color:var(--ifm-code-background);border:.1rem solid #0000001a;border-radius:var(--ifm-code-border-radius);font-family:var(--ifm-font-family-monospace);font-size:var(--ifm-code-font-size);padding:var(--ifm-code-padding-vertical) var(--ifm-code-padding-horizontal)}a code{color:inherit}pre{background-color:var(--ifm-pre-background);border-radius:var(--ifm-pre-border-radius);color:var(--ifm-pre-color);font:var(--ifm-code-font-size)/var(--ifm-pre-line-height) var(--ifm-font-family-monospace);padding:var(--ifm-pre-padding)}pre code{background-color:initial;border:none;font-size:100%;line-height:inherit;padding:0}kbd{background-color:var(--ifm-color-emphasis-0);border:1px solid var(--ifm-color-emphasis-400);border-radius:.2rem;box-shadow:inset 0 -1px 0 var(--ifm-color-emphasis-400);color:var(--ifm-color-emphasis-800);font:80% var(--ifm-font-family-monospace);padding:.15rem .3rem}h1,h2,h3,h4,h5,h6{color:var(--ifm-heading-color);font-family:var(--ifm-heading-font-family);font-weight:var(--ifm-heading-font-weight);line-height:var(--ifm-heading-line-height);margin:var(--ifm-heading-margin-top) 0 var(--ifm-heading-margin-bottom) 0}h1{font-size:var(--ifm-h1-font-size)}h2{font-size:var(--ifm-h2-font-size)}h3{font-size:var(--ifm-h3-font-size)}h4{font-size:var(--ifm-h4-font-size)}h5{font-size:var(--ifm-h5-font-size)}h6{font-size:var(--ifm-h6-font-size)}.container_lyt7,.container_lyt7>svg,img{max-width:100%}img[align=right]{padding-left:var(--image-alignment-padding)}img[align=left]{padding-right:var(--image-alignment-padding)}.markdown{--ifm-h1-vertical-rhythm-top:3;--ifm-h2-vertical-rhythm-top:2;--ifm-h3-vertical-rhythm-top:1.5;--ifm-heading-vertical-rhythm-top:1.25;--ifm-h1-vertical-rhythm-bottom:1.25;--ifm-heading-vertical-rhythm-bottom:1}.markdown:after,.markdown:before{content:"";display:table}.markdown:after{clear:both}.markdown h1:first-child{--ifm-h1-font-size:3rem;margin-bottom:calc(var(--ifm-h1-vertical-rhythm-bottom)*var(--ifm-leading))}.markdown>h2{--ifm-h2-font-size:2rem;margin-top:calc(var(--ifm-h2-vertical-rhythm-top)*var(--ifm-leading))}.markdown>h3{--ifm-h3-font-size:1.5rem;margin-top:calc(var(--ifm-h3-vertical-rhythm-top)*var(--ifm-leading))}.markdown>h4,.markdown>h5,.markdown>h6{margin-top:calc(var(--ifm-heading-vertical-rhythm-top)*var(--ifm-leading))}.markdown>p,.markdown>pre,.markdown>ul,.tabList__CuJ{margin-bottom:var(--ifm-leading)}.markdown li>p{margin-top:var(--ifm-list-paragraph-margin)}.markdown li+li{margin-top:var(--ifm-list-item-margin)}ol,ul{margin:0 0 var(--ifm-list-margin);padding-left:var(--ifm-list-left-padding)}ol ol,ul ol{list-style-type:lower-roman}ol ol ol,ol ul ol,ul ol ol,ul ul ol{list-style-type:lower-alpha}table{border-collapse:collapse;display:block;margin-bottom:var(--ifm-spacing-vertical)}table thead tr{border-bottom:2px solid var(--ifm-table-border-color)}table thead,table tr:nth-child(2n){background-color:var(--ifm-table-stripe-background)}table tr{background-color:var(--ifm-table-background);border-top:var(--ifm-table-border-width) solid var(--ifm-table-border-color)}table td,table th{border:var(--ifm-table-border-width) solid var(--ifm-table-border-color);padding:var(--ifm-table-cell-padding)}table th{background-color:var(--ifm-table-head-background);color:var(--ifm-table-head-color);font-weight:var(--ifm-table-head-font-weight)}table td{color:var(--ifm-table-cell-color)}strong{font-weight:var(--ifm-font-weight-bold)}a{color:var(--ifm-link-color);text-decoration:var(--ifm-link-decoration)}a:hover{color:var(--ifm-link-hover-color);text-decoration:var(--ifm-link-hover-decoration)}.button:hover,.text--no-decoration,.text--no-decoration:hover,a:not([href]){-webkit-text-decoration:none;text-decoration:none}p{margin:0 0 var(--ifm-paragraph-margin-bottom)}blockquote{border-left:var(--ifm-blockquote-border-left-width) solid var(--ifm-blockquote-border-color);box-shadow:var(--ifm-blockquote-shadow);color:var(--ifm-blockquote-color);font-size:var(--ifm-blockquote-font-size);padding:var(--ifm-blockquote-padding-vertical) var(--ifm-blockquote-padding-horizontal)}.docItemContainer_Djhp article>:first-child,.docItemContainer_Djhp header+*,.footer__item,blockquote>:first-child{margin-top:0}blockquote>:last-child{margin-bottom:0}hr{background-color:var(--ifm-hr-background-color);border:0;height:var(--ifm-hr-height);margin:var(--ifm-hr-margin-vertical) 0}.shadow--lw{box-shadow:var(--ifm-global-shadow-lw)!important}.shadow--md{box-shadow:var(--ifm-global-shadow-md)!important}.shadow--tl{box-shadow:var(--ifm-global-shadow-tl)!important}.text--primary,.wordWrapButtonEnabled_EoeP .wordWrapButtonIcon_Bwma{color:var(--ifm-color-primary)}.text--secondary{color:var(--ifm-color-secondary)}.text--success{color:var(--ifm-color-success)}.text--info{color:var(--ifm-color-info)}.text--warning{color:var(--ifm-color-warning)}.text--danger{color:var(--ifm-color-danger)}.text--center{text-align:center}.text--left{text-align:left}.text--justify{text-align:justify}.text--right{text-align:right}.text--capitalize{text-transform:capitalize}.text--lowercase{text-transform:lowercase}.admonitionHeading_Gvgb,.alert__heading,.text--uppercase{text-transform:uppercase}.text--light{font-weight:var(--ifm-font-weight-light)}.text--normal{font-weight:var(--ifm-font-weight-normal)}.text--semibold{font-weight:var(--ifm-font-weight-semibold)}.text--bold{font-weight:var(--ifm-font-weight-bold)}.text--italic{font-style:italic}.text--truncate{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.text--break{word-wrap:break-word!important;word-break:break-word!important}.clean-btn{background:none;border:none;color:inherit;cursor:pointer;font-family:inherit;padding:0}.alert,.alert .close{color:var(--ifm-alert-foreground-color)}.clean-list{padding-left:0}.alert--primary{--ifm-alert-background-color:var(--ifm-color-primary-contrast-background);--ifm-alert-background-color-highlight:#3578e526;--ifm-alert-foreground-color:var(--ifm-color-primary-contrast-foreground);--ifm-alert-border-color:var(--ifm-color-primary-dark)}.alert--secondary{--ifm-alert-background-color:var(--ifm-color-secondary-contrast-background);--ifm-alert-background-color-highlight:#ebedf026;--ifm-alert-foreground-color:var(--ifm-color-secondary-contrast-foreground);--ifm-alert-border-color:var(--ifm-color-secondary-dark)}.alert--success{--ifm-alert-background-color:var(--ifm-color-success-contrast-background);--ifm-alert-background-color-highlight:#00a40026;--ifm-alert-foreground-color:var(--ifm-color-success-contrast-foreground);--ifm-alert-border-color:var(--ifm-color-success-dark)}.alert--info{--ifm-alert-background-color:var(--ifm-color-info-contrast-background);--ifm-alert-background-color-highlight:#54c7ec26;--ifm-alert-foreground-color:var(--ifm-color-info-contrast-foreground);--ifm-alert-border-color:var(--ifm-color-info-dark)}.alert--warning{--ifm-alert-background-color:var(--ifm-color-warning-contrast-background);--ifm-alert-background-color-highlight:#ffba0026;--ifm-alert-foreground-color:var(--ifm-color-warning-contrast-foreground);--ifm-alert-border-color:var(--ifm-color-warning-dark)}.alert--danger{--ifm-alert-background-color:var(--ifm-color-danger-contrast-background);--ifm-alert-background-color-highlight:#fa383e26;--ifm-alert-foreground-color:var(--ifm-color-danger-contrast-foreground);--ifm-alert-border-color:var(--ifm-color-danger-dark)}.alert{--ifm-code-background:var(--ifm-alert-background-color-highlight);--ifm-link-color:var(--ifm-alert-foreground-color);--ifm-link-hover-color:var(--ifm-alert-foreground-color);--ifm-link-decoration:underline;--ifm-tabs-color:var(--ifm-alert-foreground-color);--ifm-tabs-color-active:var(--ifm-alert-foreground-color);--ifm-tabs-color-active-border:var(--ifm-alert-border-color);background-color:var(--ifm-alert-background-color);border:var(--ifm-alert-border-width) solid var(--ifm-alert-border-color);border-left-width:var(--ifm-alert-border-left-width);border-radius:var(--ifm-alert-border-radius);box-shadow:var(--ifm-alert-shadow);padding:var(--ifm-alert-padding-vertical) var(--ifm-alert-padding-horizontal)}.alert__heading{align-items:center;display:flex;font:700 var(--ifm-h5-font-size)/var(--ifm-heading-line-height) var(--ifm-heading-font-family);margin-bottom:.5rem}.alert__icon{display:inline-flex;margin-right:.4em}.alert__icon svg{fill:var(--ifm-alert-foreground-color);stroke:var(--ifm-alert-foreground-color);stroke-width:0}.alert .close{margin:calc(var(--ifm-alert-padding-vertical)*-1) calc(var(--ifm-alert-padding-horizontal)*-1) 0 0;opacity:.75}.alert .close:focus,.alert .close:hover{opacity:1}.alert a{text-decoration-color:var(--ifm-alert-border-color)}.alert a:hover{text-decoration-thickness:2px}.avatar{column-gap:var(--ifm-avatar-intro-margin);display:flex}.avatar__photo{border-radius:50%;display:block;height:var(--ifm-avatar-photo-size);overflow:hidden;width:var(--ifm-avatar-photo-size)}.card--full-height,.navbar__logo img,body,html{height:100%}.avatar__photo--sm{--ifm-avatar-photo-size:2rem}.avatar__photo--lg{--ifm-avatar-photo-size:4rem}.avatar__photo--xl{--ifm-avatar-photo-size:6rem}.avatar__intro{display:flex;flex:1 1;flex-direction:column;justify-content:center;text-align:var(--ifm-avatar-intro-alignment)}.badge,.breadcrumbs__item,.breadcrumbs__link,.button,.dropdown>.navbar__link:after{display:inline-block}.avatar__name{font:700 var(--ifm-h4-font-size)/var(--ifm-heading-line-height) var(--ifm-font-family-base)}.avatar__subtitle{margin-top:.25rem}.avatar--vertical{--ifm-avatar-intro-alignment:center;--ifm-avatar-intro-margin:0.5rem;align-items:center;flex-direction:column}.badge{background-color:var(--ifm-badge-background-color);border:var(--ifm-badge-border-width) solid var(--ifm-badge-border-color);border-radius:var(--ifm-badge-border-radius);color:var(--ifm-badge-color);font-size:75%;font-weight:var(--ifm-font-weight-bold);line-height:1;padding:var(--ifm-badge-padding-vertical) var(--ifm-badge-padding-horizontal)}.badge--primary{--ifm-badge-background-color:var(--ifm-color-primary)}.badge--secondary{--ifm-badge-background-color:var(--ifm-color-secondary);color:var(--ifm-color-black)}.breadcrumbs__link,.button.button--secondary.button--outline:not(.button--active):not(:hover){color:var(--ifm-font-color-base)}.badge--success{--ifm-badge-background-color:var(--ifm-color-success)}.badge--info{--ifm-badge-background-color:var(--ifm-color-info)}.badge--warning{--ifm-badge-background-color:var(--ifm-color-warning)}.badge--danger{--ifm-badge-background-color:var(--ifm-color-danger)}.breadcrumbs{margin-bottom:0;padding-left:0}.breadcrumbs__item:not(:last-child):after{background:var(--ifm-breadcrumb-separator) center;content:" ";display:inline-block;filter:var(--ifm-breadcrumb-separator-filter);height:calc(var(--ifm-breadcrumb-separator-size)*var(--ifm-breadcrumb-size-multiplier)*var(--ifm-breadcrumb-separator-size-multiplier));margin:0 var(--ifm-breadcrumb-spacing);opacity:.5;width:calc(var(--ifm-breadcrumb-separator-size)*var(--ifm-breadcrumb-size-multiplier)*var(--ifm-breadcrumb-separator-size-multiplier))}.breadcrumbs__item--active .breadcrumbs__link{background:var(--ifm-breadcrumb-item-background-active);color:var(--ifm-breadcrumb-color-active)}.breadcrumbs__link{border-radius:var(--ifm-breadcrumb-border-radius);font-size:calc(1rem*var(--ifm-breadcrumb-size-multiplier));padding:calc(var(--ifm-breadcrumb-padding-vertical)*var(--ifm-breadcrumb-size-multiplier)) calc(var(--ifm-breadcrumb-padding-horizontal)*var(--ifm-breadcrumb-size-multiplier));transition-duration:var(--ifm-transition-fast);transition-property:background,color}.breadcrumbs__link:any-link:hover,.breadcrumbs__link:link:hover,.breadcrumbs__link:visited:hover,area[href].breadcrumbs__link:hover{background:var(--ifm-breadcrumb-item-background-active);-webkit-text-decoration:none;text-decoration:none}.breadcrumbs--sm{--ifm-breadcrumb-size-multiplier:0.8}.breadcrumbs--lg{--ifm-breadcrumb-size-multiplier:1.2}.button{background-color:var(--ifm-button-background-color);border:var(--ifm-button-border-width) solid var(--ifm-button-border-color);border-radius:var(--ifm-button-border-radius);cursor:pointer;font-size:calc(.875rem*var(--ifm-button-size-multiplier));font-weight:var(--ifm-button-font-weight);line-height:1.5;padding:calc(var(--ifm-button-padding-vertical)*var(--ifm-button-size-multiplier)) calc(var(--ifm-button-padding-horizontal)*var(--ifm-button-size-multiplier));text-align:center;transition-duration:var(--ifm-button-transition-duration);transition-property:color,background,border-color;-webkit-user-select:none;user-select:none;white-space:nowrap}.button,.button:hover{color:var(--ifm-button-color)}.button--outline{--ifm-button-color:var(--ifm-button-border-color)}.button--outline:hover{--ifm-button-background-color:var(--ifm-button-border-color)}.button--link{--ifm-button-border-color:#0000;color:var(--ifm-link-color);text-decoration:var(--ifm-link-decoration)}.button--link.button--active,.button--link:active,.button--link:hover{color:var(--ifm-link-hover-color);text-decoration:var(--ifm-link-hover-decoration)}.aa-ItemLink,.aa-SourceFooterSeeAll,.dropdown__link--active,.dropdown__link:hover,.menu__link:hover,.navbar__brand:hover,.navbar__link--active,.navbar__link:hover,.pagination-nav__link:hover,.pagination__link:hover,.tag_zVej:hover{-webkit-text-decoration:none;text-decoration:none}.button.disabled,.button:disabled,.button[disabled]{opacity:.65;pointer-events:none}.button--sm{--ifm-button-size-multiplier:0.8}.button--lg{--ifm-button-size-multiplier:1.35}.button--block{display:block;width:100%}.button.button--secondary{color:var(--ifm-color-gray-900)}:where(.button--primary){--ifm-button-background-color:var(--ifm-color-primary);--ifm-button-border-color:var(--ifm-color-primary)}:where(.button--primary):not(.button--outline):hover{--ifm-button-background-color:var(--ifm-color-primary-dark);--ifm-button-border-color:var(--ifm-color-primary-dark)}.button--primary.button--active,.button--primary:active{--ifm-button-background-color:var(--ifm-color-primary-darker);--ifm-button-border-color:var(--ifm-color-primary-darker)}:where(.button--secondary){--ifm-button-background-color:var(--ifm-color-secondary);--ifm-button-border-color:var(--ifm-color-secondary)}:where(.button--secondary):not(.button--outline):hover{--ifm-button-background-color:var(--ifm-color-secondary-dark);--ifm-button-border-color:var(--ifm-color-secondary-dark)}.button--secondary.button--active,.button--secondary:active{--ifm-button-background-color:var(--ifm-color-secondary-darker);--ifm-button-border-color:var(--ifm-color-secondary-darker)}:where(.button--success){--ifm-button-background-color:var(--ifm-color-success);--ifm-button-border-color:var(--ifm-color-success)}:where(.button--success):not(.button--outline):hover{--ifm-button-background-color:var(--ifm-color-success-dark);--ifm-button-border-color:var(--ifm-color-success-dark)}.button--success.button--active,.button--success:active{--ifm-button-background-color:var(--ifm-color-success-darker);--ifm-button-border-color:var(--ifm-color-success-darker)}:where(.button--info){--ifm-button-background-color:var(--ifm-color-info);--ifm-button-border-color:var(--ifm-color-info)}:where(.button--info):not(.button--outline):hover{--ifm-button-background-color:var(--ifm-color-info-dark);--ifm-button-border-color:var(--ifm-color-info-dark)}.button--info.button--active,.button--info:active{--ifm-button-background-color:var(--ifm-color-info-darker);--ifm-button-border-color:var(--ifm-color-info-darker)}:where(.button--warning){--ifm-button-background-color:var(--ifm-color-warning);--ifm-button-border-color:var(--ifm-color-warning)}:where(.button--warning):not(.button--outline):hover{--ifm-button-background-color:var(--ifm-color-warning-dark);--ifm-button-border-color:var(--ifm-color-warning-dark)}.button--warning.button--active,.button--warning:active{--ifm-button-background-color:var(--ifm-color-warning-darker);--ifm-button-border-color:var(--ifm-color-warning-darker)}:where(.button--danger){--ifm-button-background-color:var(--ifm-color-danger);--ifm-button-border-color:var(--ifm-color-danger)}:where(.button--danger):not(.button--outline):hover{--ifm-button-background-color:var(--ifm-color-danger-dark);--ifm-button-border-color:var(--ifm-color-danger-dark)}.button--danger.button--active,.button--danger:active{--ifm-button-background-color:var(--ifm-color-danger-darker);--ifm-button-border-color:var(--ifm-color-danger-darker)}.button-group{display:inline-flex;gap:var(--ifm-button-group-spacing)}.button-group>.button:not(:first-child){border-bottom-left-radius:0;border-top-left-radius:0}.button-group>.button:not(:last-child){border-bottom-right-radius:0;border-top-right-radius:0}.button-group--block{display:flex;justify-content:stretch}.button-group--block>.button{flex-grow:1}.card{background-color:var(--ifm-card-background-color);border-radius:var(--ifm-card-border-radius);box-shadow:var(--ifm-global-shadow-lw);display:flex;flex-direction:column;overflow:hidden}.card__image{padding-top:var(--ifm-card-vertical-spacing)}.card__image:first-child{padding-top:0}.card__body,.card__footer,.card__header{padding:var(--ifm-card-vertical-spacing) var(--ifm-card-horizontal-spacing)}.card__body:not(:last-child),.card__footer:not(:last-child),.card__header:not(:last-child){padding-bottom:0}.card__body>:last-child,.card__footer>:last-child,.card__header>:last-child{margin-bottom:0}.card__footer{margin-top:auto}.table-of-contents{font-size:.8rem;margin-bottom:0;padding:var(--ifm-toc-padding-vertical) 0}.table-of-contents,.table-of-contents ul{list-style:none;padding-left:var(--ifm-toc-padding-horizontal)}.table-of-contents li{margin:var(--ifm-toc-padding-vertical) var(--ifm-toc-padding-horizontal)}.table-of-contents__left-border{border-left:1px solid var(--ifm-toc-border-color)}.table-of-contents__link{color:var(--ifm-toc-link-color);display:block}.table-of-contents__link--active,.table-of-contents__link--active code,.table-of-contents__link:hover,.table-of-contents__link:hover code{color:var(--ifm-color-primary);-webkit-text-decoration:none;text-decoration:none}.close{color:var(--ifm-color-black);float:right;font-size:1.5rem;font-weight:var(--ifm-font-weight-bold);line-height:1;opacity:.5;padding:1rem;transition:opacity var(--ifm-transition-fast) var(--ifm-transition-timing-default)}.close:hover{opacity:.7}.close:focus,.theme-code-block-highlighted-line .codeLineNumber_Tfdd:before{opacity:.8}.dropdown{display:inline-flex;font-weight:var(--ifm-dropdown-font-weight);position:relative;vertical-align:top}.dropdown--hoverable:hover .dropdown__menu,.dropdown--show .dropdown__menu{opacity:1;pointer-events:all;transform:translateY(-1px);visibility:visible}#nprogress,.dropdown__menu,.navbar__item.dropdown .navbar__link:not([href]){pointer-events:none}.dropdown--right .dropdown__menu{left:inherit;right:0}.dropdown--nocaret .navbar__link:after{content:none!important}.dropdown__menu{background-color:var(--ifm-dropdown-background-color);border-radius:var(--ifm-global-radius);box-shadow:var(--ifm-global-shadow-md);left:0;max-height:80vh;min-width:10rem;opacity:0;overflow-y:auto;padding:.5rem;position:absolute;top:calc(100% - var(--ifm-navbar-item-padding-vertical) + .3rem);transform:translateY(-.625rem);transition-duration:var(--ifm-transition-fast);transition-property:opacity,transform,visibility;transition-timing-function:var(--ifm-transition-timing-default);visibility:hidden;z-index:var(--ifm-z-index-dropdown)}.menu__caret,.menu__link,.menu__list-item-collapsible{border-radius:.25rem;transition:background var(--ifm-transition-fast) var(--ifm-transition-timing-default)}.dropdown__link{border-radius:.25rem;color:var(--ifm-dropdown-link-color);display:block;font-size:.875rem;margin-top:.2rem;padding:.25rem .5rem;white-space:nowrap}.dropdown__link--active,.dropdown__link:hover{background-color:var(--ifm-dropdown-hover-background-color);color:var(--ifm-dropdown-link-color)}.dropdown__link--active,.dropdown__link--active:hover{--ifm-dropdown-link-color:var(--ifm-link-color)}.dropdown>.navbar__link:after{border-color:currentcolor #0000;border-style:solid;border-width:.4em .4em 0;content:"";margin-left:.3em;position:relative;top:2px;transform:translateY(-50%)}.footer{background-color:var(--ifm-footer-background-color);color:var(--ifm-footer-color);padding:var(--ifm-footer-padding-vertical) var(--ifm-footer-padding-horizontal)}.footer__links{margin-bottom:1rem}.footer__link-item{color:var(--ifm-footer-link-color);line-height:2}.footer__link-item:hover{color:var(--ifm-footer-link-hover-color)}.footer__link-separator{margin:0 var(--ifm-footer-link-horizontal-spacing)}.footer__logo{margin-top:1rem;max-width:var(--ifm-footer-logo-max-width)}.footer__title{color:var(--ifm-footer-title-color);font:700 var(--ifm-h4-font-size)/var(--ifm-heading-line-height) var(--ifm-font-family-base);margin-bottom:var(--ifm-heading-margin-bottom)}.menu,.navbar__link{font-weight:var(--ifm-font-weight-semibold)}.admonitionContent_BuS1>:last-child,.cardContainer_fWXF :last-child,.collapsibleContent_i85q p:last-child,.details_lb9f>summary>p:last-child,.footer__items,.tabItem_Ymn6>:last-child{margin-bottom:0}.codeBlockStandalone_MEMb,[type=checkbox]{padding:0}.hero{align-items:center;background-color:var(--ifm-hero-background-color);color:var(--ifm-hero-text-color);display:flex;padding:4rem 2rem}.hero--primary{--ifm-hero-background-color:var(--ifm-color-primary);--ifm-hero-text-color:var(--ifm-font-color-base-inverse)}.hero--dark{--ifm-hero-background-color:#303846;--ifm-hero-text-color:var(--ifm-color-white)}.hero__title{font-size:3rem}.hero__subtitle{font-size:1.5rem}.menu__list{margin:0;padding-left:0}.menu__caret,.menu__link{padding:var(--ifm-menu-link-padding-vertical) var(--ifm-menu-link-padding-horizontal)}.menu__list .menu__list{flex:0 0 100%;margin-top:.25rem;padding-left:var(--ifm-menu-link-padding-horizontal)}.menu__list-item:not(:first-child){margin-top:.25rem}.menu__list-item--collapsed .menu__list{height:0;overflow:hidden}.details_lb9f[data-collapsed=false].isBrowser_bmU9>summary:before,.details_lb9f[open]:not(.isBrowser_bmU9)>summary:before,.menu__list-item--collapsed .menu__caret:before,.menu__list-item--collapsed .menu__link--sublist:after{transform:rotate(90deg)}.menu__list-item-collapsible{display:flex;flex-wrap:wrap;position:relative}.menu__caret:hover,.menu__link:hover,.menu__list-item-collapsible--active,.menu__list-item-collapsible:hover{background:var(--ifm-menu-color-background-hover)}.menu__list-item-collapsible .menu__link--active,.menu__list-item-collapsible .menu__link:hover{background:none!important}.menu__caret,.menu__link{align-items:center;display:flex}.navbar-sidebar,.navbar-sidebar__backdrop{bottom:0;opacity:0;transition-duration:var(--ifm-transition-fast);transition-timing-function:ease-in-out;top:0;visibility:hidden;left:0}.menu__link{color:var(--ifm-menu-color);flex:1;line-height:1.25}.menu__link:hover{color:var(--ifm-menu-color)}.menu__caret:before,.menu__link--sublist-caret:after{height:1.25rem;transform:rotate(180deg);transition:transform var(--ifm-transition-fast) linear;width:1.25rem;filter:var(--ifm-menu-link-sublist-icon-filter);content:""}.menu__link--sublist-caret:after{background:var(--ifm-menu-link-sublist-icon) 50%/2rem 2rem;margin-left:auto;min-width:1.25rem}.menu__link--active,.menu__link--active:hover{color:var(--ifm-menu-color-active)}.navbar__brand,.navbar__link{color:var(--ifm-navbar-link-color)}.menu__link--active:not(.menu__link--sublist){background-color:var(--ifm-menu-color-background-active)}.menu__caret:before{background:var(--ifm-menu-link-sublist-icon) 50%/2rem 2rem}.navbar--dark,html[data-theme=dark]{--ifm-menu-link-sublist-icon-filter:invert(100%) sepia(94%) saturate(17%) hue-rotate(223deg) brightness(104%) contrast(98%)}.navbar{background-color:var(--ifm-navbar-background-color);box-shadow:var(--ifm-navbar-shadow);height:var(--ifm-navbar-height);padding:var(--ifm-navbar-padding-vertical) var(--ifm-navbar-padding-horizontal)}.navbar,.navbar>.container,.navbar>.container-fluid{display:flex}.navbar--fixed-top{position:sticky;top:0;z-index:var(--ifm-z-index-fixed)}.navbar__inner{display:flex;flex-wrap:wrap;justify-content:space-between;width:100%}.navbar__brand{align-items:center;display:flex;margin-right:1rem;min-width:0}.navbar__brand:hover{color:var(--ifm-navbar-link-hover-color)}.announcementBarContent_xLdY,.navbar__title{flex:1 1 auto}.navbar__toggle{display:none;margin-right:.5rem}.navbar__logo{flex:0 0 auto;height:2rem;margin-right:.5rem}.navbar__items{align-items:center;display:flex;flex:1;min-width:0}.navbar__items--center{flex:0 0 auto}.navbar__items--center .navbar__brand{margin:0}.navbar__items--center+.navbar__items--right{flex:1}.navbar__items--right{flex:0 0 auto;justify-content:flex-end}.navbar__items--right>:last-child{padding-right:0}.navbar__item{display:inline-block;padding:var(--ifm-navbar-item-padding-vertical) var(--ifm-navbar-item-padding-horizontal)}.navbar__link--active,.navbar__link:hover{color:var(--ifm-navbar-link-hover-color)}.navbar--dark,.navbar--primary{--ifm-menu-color:var(--ifm-color-gray-300);--ifm-navbar-link-color:var(--ifm-color-gray-100);--ifm-navbar-search-input-background-color:#ffffff1a;--ifm-navbar-search-input-placeholder-color:#ffffff80;color:var(--ifm-color-white)}.navbar--dark{--ifm-navbar-background-color:#242526;--ifm-menu-color-background-active:#ffffff0d;--ifm-navbar-search-input-color:var(--ifm-color-white)}.navbar--primary{--ifm-navbar-background-color:var(--ifm-color-primary);--ifm-navbar-link-hover-color:var(--ifm-color-white);--ifm-menu-color-active:var(--ifm-color-white);--ifm-navbar-search-input-color:var(--ifm-color-emphasis-500)}.navbar__search-input{appearance:none;background:var(--ifm-navbar-search-input-background-color) var(--ifm-navbar-search-input-icon) no-repeat .75rem center/1rem 1rem;border:none;border-radius:2rem;color:var(--ifm-navbar-search-input-color);cursor:text;display:inline-block;font-size:1rem;height:2rem;padding:0 .5rem 0 2.25rem;width:12.5rem}.navbar__search-input::placeholder{color:var(--ifm-navbar-search-input-placeholder-color)}.navbar-sidebar{background-color:var(--ifm-navbar-background-color);box-shadow:var(--ifm-global-shadow-md);position:fixed;transform:translate3d(-100%,0,0);transition-property:opacity,visibility,transform;width:var(--ifm-navbar-sidebar-width)}.navbar-sidebar--show .navbar-sidebar,.navbar-sidebar__items{transform:translateZ(0)}.navbar-sidebar--show .navbar-sidebar,.navbar-sidebar--show .navbar-sidebar__backdrop{opacity:1;visibility:visible}.navbar-sidebar__backdrop{background-color:#0009;position:fixed;right:0;transition-property:opacity,visibility}.navbar-sidebar__brand{align-items:center;box-shadow:var(--ifm-navbar-shadow);display:flex;flex:1;height:var(--ifm-navbar-height);padding:var(--ifm-navbar-padding-vertical) var(--ifm-navbar-padding-horizontal)}.navbar-sidebar__items{display:flex;height:calc(100% - var(--ifm-navbar-height));transition:transform var(--ifm-transition-fast) ease-in-out}.navbar-sidebar__items--show-secondary{transform:translate3d(calc((var(--ifm-navbar-sidebar-width))*-1),0,0)}.navbar-sidebar__item{flex-shrink:0;padding:.5rem;width:calc(var(--ifm-navbar-sidebar-width))}.navbar-sidebar__back{background:var(--ifm-menu-color-background-active);font-size:15px;font-weight:var(--ifm-button-font-weight);margin:0 0 .2rem -.5rem;padding:.6rem 1.5rem;position:relative;text-align:left;top:-.5rem;width:calc(100% + 1rem)}.navbar-sidebar__close{display:flex;margin-left:auto}.pagination{column-gap:var(--ifm-pagination-page-spacing);display:flex;font-size:var(--ifm-pagination-font-size);padding-left:0}.pagination--sm{--ifm-pagination-font-size:0.8rem;--ifm-pagination-padding-horizontal:0.8rem;--ifm-pagination-padding-vertical:0.2rem}.pagination--lg{--ifm-pagination-font-size:1.2rem;--ifm-pagination-padding-horizontal:1.2rem;--ifm-pagination-padding-vertical:0.3rem}.pagination__item{display:inline-flex}.pagination__item>span{padding:var(--ifm-pagination-padding-vertical)}.pagination__item--active .pagination__link{color:var(--ifm-pagination-color-active)}.pagination__item--active .pagination__link,.pagination__item:not(.pagination__item--active):hover .pagination__link{background:var(--ifm-pagination-item-active-background)}.pagination__item--disabled,.pagination__item[disabled]{opacity:.25;pointer-events:none}.pagination__link{border-radius:var(--ifm-pagination-border-radius);color:var(--ifm-font-color-base);display:inline-block;padding:var(--ifm-pagination-padding-vertical) var(--ifm-pagination-padding-horizontal);transition:background var(--ifm-transition-fast) var(--ifm-transition-timing-default)}.pagination-nav{display:grid;grid-gap:var(--ifm-spacing-horizontal);gap:var(--ifm-spacing-horizontal);grid-template-columns:repeat(2,1fr)}.pagination-nav__link{border:1px solid var(--ifm-color-emphasis-300);border-radius:var(--ifm-pagination-nav-border-radius);display:block;height:100%;line-height:var(--ifm-heading-line-height);padding:var(--ifm-global-spacing);transition:border-color var(--ifm-transition-fast) var(--ifm-transition-timing-default)}.pagination-nav__link:hover{border-color:var(--ifm-pagination-nav-color-hover)}.pagination-nav__link--next{grid-column:2/3;text-align:right}.pagination-nav__label{font-size:var(--ifm-h4-font-size);font-weight:var(--ifm-heading-font-weight);word-break:break-word}.pagination-nav__link--prev .pagination-nav__label:before{content:"« "}.pagination-nav__link--next .pagination-nav__label:after{content:" »"}.pagination-nav__sublabel{color:var(--ifm-color-content-secondary);font-size:var(--ifm-h5-font-size);font-weight:var(--ifm-font-weight-semibold);margin-bottom:.25rem}.pills__item,.tabs{font-weight:var(--ifm-font-weight-bold)}.pills{display:flex;gap:var(--ifm-pills-spacing);padding-left:0}.pills__item{border-radius:.5rem;cursor:pointer;display:inline-block;padding:.25rem 1rem;transition:background var(--ifm-transition-fast) var(--ifm-transition-timing-default)}.tabs,:not(.containsTaskList_mC6p>li)>.containsTaskList_mC6p{padding-left:0}.pills__item--active{color:var(--ifm-pills-color-active)}.pills__item--active,.pills__item:not(.pills__item--active):hover{background:var(--ifm-pills-color-background-active)}.pills--block{justify-content:stretch}.pills--block .pills__item{flex-grow:1;text-align:center}.tabs{color:var(--ifm-tabs-color);display:flex;margin-bottom:0;overflow-x:auto}.tabs__item{border-bottom:3px solid #0000;border-radius:var(--ifm-global-radius);cursor:pointer;display:inline-flex;padding:var(--ifm-tabs-padding-vertical) var(--ifm-tabs-padding-horizontal);transition:background-color var(--ifm-transition-fast) var(--ifm-transition-timing-default)}.tabs__item--active{border-bottom-color:var(--ifm-tabs-color-active-border);border-bottom-left-radius:0;border-bottom-right-radius:0;color:var(--ifm-tabs-color-active)}.tabs__item:hover{background-color:var(--ifm-hover-overlay)}.tabs--block{justify-content:stretch}.tabs--block .tabs__item{flex-grow:1;justify-content:center}html[data-theme=dark]{--ifm-color-scheme:dark;--ifm-color-emphasis-0:var(--ifm-color-gray-1000);--ifm-color-emphasis-100:var(--ifm-color-gray-900);--ifm-color-emphasis-200:var(--ifm-color-gray-800);--ifm-color-emphasis-300:var(--ifm-color-gray-700);--ifm-color-emphasis-400:var(--ifm-color-gray-600);--ifm-color-emphasis-600:var(--ifm-color-gray-400);--ifm-color-emphasis-700:var(--ifm-color-gray-300);--ifm-color-emphasis-800:var(--ifm-color-gray-200);--ifm-color-emphasis-900:var(--ifm-color-gray-100);--ifm-color-emphasis-1000:var(--ifm-color-gray-0);--ifm-background-color:#1b1b1d;--ifm-background-surface-color:#242526;--ifm-hover-overlay:#ffffff0d;--ifm-color-content:#e3e3e3;--ifm-color-content-secondary:#fff;--ifm-breadcrumb-separator-filter:invert(64%) sepia(11%) saturate(0%) hue-rotate(149deg) brightness(99%) contrast(95%);--ifm-code-background:#ffffff1a;--ifm-scrollbar-track-background-color:#444;--ifm-scrollbar-thumb-background-color:#686868;--ifm-scrollbar-thumb-hover-background-color:#7a7a7a;--ifm-table-stripe-background:#ffffff12;--ifm-toc-border-color:var(--ifm-color-emphasis-200);--ifm-color-primary-contrast-background:#102445;--ifm-color-primary-contrast-foreground:#ebf2fc;--ifm-color-secondary-contrast-background:#474748;--ifm-color-secondary-contrast-foreground:#fdfdfe;--ifm-color-success-contrast-background:#003100;--ifm-color-success-contrast-foreground:#e6f6e6;--ifm-color-info-contrast-background:#193c47;--ifm-color-info-contrast-foreground:#eef9fd;--ifm-color-warning-contrast-background:#4d3800;--ifm-color-warning-contrast-foreground:#fff8e6;--ifm-color-danger-contrast-background:#4b1113;--ifm-color-danger-contrast-foreground:#ffebec}#nprogress .bar{background:var(--docusaurus-progress-bar-color);height:2px;left:0;position:fixed;top:0;width:100%;z-index:1031}#nprogress .peg{box-shadow:0 0 10px var(--docusaurus-progress-bar-color),0 0 5px var(--docusaurus-progress-bar-color);height:100%;opacity:1;position:absolute;right:0;transform:rotate(3deg) translateY(-4px);width:100px}[data-theme=dark]{--ifm-color-primary:#90ff99;--ifm-color-primary-dark:#5bc95b;--ifm-color-primary-darker:#238723;--ifm-color-primary-darkest:#124c12;--ifm-color-primary-light:#90ff99;--ifm-color-primary-lighter:#d2ffd3;--ifm-color-primary-lightest:#d2ffd3;--docusaurus-highlighted-code-line-bg:#0000004d}.header-github-link:hover{opacity:.6}.header-github-link:before{background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Cpath d='M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12'/%3E%3C/svg%3E") no-repeat;content:"";display:flex;height:24px;width:24px}html[data-theme=dark] .header-github-link:before{background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Cpath fill='%23fff' d='M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12'/%3E%3C/svg%3E") no-repeat}.tabs-container{border:1px solid var(--ifm-color-emphasis-300);border-radius:var(--ifm-pagination-nav-border-radius);padding:var(--ifm-global-spacing)}.tabs{border-bottom:1px solid var(--ifm-color-emphasis-300)}.footer--dark{--ifm-footer-background-color:#303846;--ifm-footer-color:var(--ifm-footer-link-color);--ifm-footer-link-color:var(--ifm-color-secondary);--ifm-footer-title-color:var(--ifm-color-white);background-color:#000}.asciinema-theme-edgeless .asciinema-terminal{background-color:#000;border-color:#000;color:#fff}.asciinema-theme-edgeless .fg-bg{color:#000}.asciinema-theme-edgeless .bg-fg{background-color:#fff}.tag_zVej{border:1px solid var(--docusaurus-tag-list-border);transition:border var(--ifm-transition-fast)}.tag_zVej:hover{--docusaurus-tag-list-border:var(--ifm-link-color)}.tagRegular_sFm0{border-radius:var(--ifm-global-radius);font-size:90%;padding:.2rem .5rem .3rem}.tagWithCount_h2kH{align-items:center;border-left:0;display:flex;padding:0 .5rem 0 1rem;position:relative}.tagWithCount_h2kH:after,.tagWithCount_h2kH:before{border:1px solid var(--docusaurus-tag-list-border);content:"";position:absolute;top:50%;transition:inherit}.tagWithCount_h2kH:before{border-bottom:0;border-right:0;height:1.18rem;right:100%;transform:translate(50%,-50%) rotate(-45deg);width:1.18rem}.tagWithCount_h2kH:after{border-radius:50%;height:.5rem;left:0;transform:translateY(-50%);width:.5rem}.tagWithCount_h2kH span{background:var(--ifm-color-secondary);border-radius:var(--ifm-global-radius);color:var(--ifm-color-black);font-size:.7rem;line-height:1.2;margin-left:.3rem;padding:.1rem .4rem}.tags_jXut{display:inline}.tag_QGVx{display:inline-block;margin:0 .4rem .5rem 0}.iconEdit_Z9Sw{margin-right:.3em;vertical-align:sub}.lastUpdated_JAkA{font-size:smaller;font-style:italic;margin-top:.2rem}.tocCollapsibleButton_TO0P{align-items:center;display:flex;font-size:inherit;justify-content:space-between;padding:.4rem .8rem;width:100%}.tocCollapsibleButton_TO0P:after{background:var(--ifm-menu-link-sublist-icon) 50% 50%/2rem 2rem no-repeat;content:"";filter:var(--ifm-menu-link-sublist-icon-filter);height:1.25rem;transform:rotate(180deg);transition:transform var(--ifm-transition-fast);width:1.25rem}.tocCollapsibleButtonExpanded_MG3E:after,.tocCollapsibleExpanded_sAul{transform:none}.tocCollapsible_ETCw{background-color:var(--ifm-menu-color-background-active);border-radius:var(--ifm-global-radius);margin:1rem 0}.tocCollapsibleContent_vkbj>ul{border-left:none;border-top:1px solid var(--ifm-color-emphasis-300);font-size:15px;padding:.2rem 0}.tocCollapsibleContent_vkbj ul li{margin:.4rem .8rem}.tocCollapsibleContent_vkbj a{display:block}.tableOfContents_bqdL{max-height:calc(100vh - var(--ifm-navbar-height) - 2rem);overflow-y:auto;position:sticky;top:calc(var(--ifm-navbar-height) + 1rem)}.backToTopButton_sjWU{background-color:var(--ifm-color-emphasis-200);border-radius:50%;bottom:1.3rem;box-shadow:var(--ifm-global-shadow-lw);height:3rem;opacity:0;position:fixed;right:1.3rem;transform:scale(0);transition:all var(--ifm-transition-fast) var(--ifm-transition-timing-default);visibility:hidden;width:3rem;z-index:calc(var(--ifm-z-index-fixed) - 1)}.buttonGroup__atx button,.codeBlockContainer_Ckt0{background:var(--prism-background-color);color:var(--prism-color)}.backToTopButton_sjWU:after{background-color:var(--ifm-color-emphasis-1000);content:" ";display:inline-block;height:100%;-webkit-mask:var(--ifm-menu-link-sublist-icon) 50%/2rem 2rem no-repeat;mask:var(--ifm-menu-link-sublist-icon) 50%/2rem 2rem no-repeat;width:100%}.backToTopButtonShow_xfvO{opacity:1;transform:scale(1);visibility:visible}.docSidebarContainer_YfHR,.sidebarLogo_isFc,.themedComponent_mlkZ{display:none}[data-theme=dark] .themedComponent--dark_xIcU,[data-theme=light] .themedComponent--light_NVdE,html:not([data-theme]) .themedComponent--light_NVdE{display:initial}[data-theme=dark]:root{--docusaurus-collapse-button-bg:#ffffff0d;--docusaurus-collapse-button-bg-hover:#ffffff1a}.collapseSidebarButton_PEFL{display:none;margin:0}.iconExternalLink_nPIU{margin-left:.3rem}.docMainContainer_TBSr,.docRoot_UBD9{display:flex;width:100%}.docsWrapper_hBAB{display:flex;flex:1 0 auto}.anchorWithStickyNavbar_LWe7{scroll-margin-top:calc(var(--ifm-navbar-height) + .5rem)}.anchorWithHideOnScrollNavbar_WYt5{scroll-margin-top:.5rem}.hash-link{opacity:0;padding-left:.5rem;transition:opacity var(--ifm-transition-fast);-webkit-user-select:none;user-select:none}.hash-link:before{content:"#"}.footerLogoLink_BH7S:hover,.hash-link:focus,:hover>.hash-link{opacity:1}.cardContainer_fWXF{--ifm-link-color:var(--ifm-color-emphasis-800);--ifm-link-hover-color:var(--ifm-color-emphasis-700);--ifm-link-hover-decoration:none;border:1px solid var(--ifm-color-emphasis-200);box-shadow:0 1.5px 3px 0 #00000026;transition:all var(--ifm-transition-fast) ease;transition-property:border,box-shadow}.cardContainer_fWXF:hover{border-color:var(--ifm-color-primary);box-shadow:0 3px 6px 0 #0003}.cardTitle_rnsV{font-size:1.2rem}.cardDescription_PWke{font-size:.8rem}.codeBlockContainer_Ckt0{border-radius:var(--ifm-code-border-radius);box-shadow:var(--ifm-global-shadow-lw);margin-bottom:var(--ifm-leading)}.codeBlockContent_biex{border-radius:inherit;direction:ltr;position:relative}.codeBlockTitle_Ktv7{border-bottom:1px solid var(--ifm-color-emphasis-300);border-top-left-radius:inherit;border-top-right-radius:inherit;font-size:var(--ifm-code-font-size);font-weight:500;padding:.75rem var(--ifm-pre-padding)}.codeBlock_bY9V{--ifm-pre-background:var(--prism-background-color);margin:0;padding:0}.codeBlockTitle_Ktv7+.codeBlockContent_biex .codeBlock_bY9V{border-top-left-radius:0;border-top-right-radius:0}.codeBlockLines_e6Vv{float:left;font:inherit;min-width:100%;padding:var(--ifm-pre-padding)}.codeBlockLinesWithNumbering_o6Pm{display:table;padding:var(--ifm-pre-padding) 0}.buttonGroup__atx{column-gap:.2rem;display:flex;position:absolute;right:calc(var(--ifm-pre-padding)/2);top:calc(var(--ifm-pre-padding)/2)}.buttonGroup__atx button{align-items:center;border:1px solid var(--ifm-color-emphasis-300);border-radius:var(--ifm-global-radius);display:flex;line-height:0;opacity:0;padding:.4rem;transition:opacity var(--ifm-transition-fast) ease-in-out}.buttonGroup__atx button:focus-visible,.buttonGroup__atx button:hover{opacity:1!important}.theme-code-block:hover .buttonGroup__atx button{opacity:.4}:where(:root){--docusaurus-highlighted-code-line-bg:#484d5b}:where([data-theme=dark]){--docusaurus-highlighted-code-line-bg:#646464}.theme-code-block-highlighted-line{background-color:var(--docusaurus-highlighted-code-line-bg);display:block;margin:0 calc(var(--ifm-pre-padding)*-1);padding:0 var(--ifm-pre-padding)}.codeLine_lJS_{counter-increment:a;display:table-row}.codeLineNumber_Tfdd{background:var(--ifm-pre-background);display:table-cell;left:0;overflow-wrap:normal;padding:0 var(--ifm-pre-padding);position:sticky;text-align:right;width:1%}.codeLineNumber_Tfdd:before{content:counter(a);opacity:.4}.codeLineContent_feaV{padding-right:var(--ifm-pre-padding)}.theme-code-block:hover .copyButtonCopied_obH4{opacity:1!important}.copyButtonIcons_eSgA{height:1.125rem;position:relative;width:1.125rem}.copyButtonIcon_y97N,.copyButtonSuccessIcon_LjdS{left:0;position:absolute;top:0;fill:currentColor;height:inherit;opacity:inherit;transition:all var(--ifm-transition-fast) ease;width:inherit}.copyButtonSuccessIcon_LjdS{color:#00d600;left:50%;opacity:0;top:50%;transform:translate(-50%,-50%) scale(.33)}.copyButtonCopied_obH4 .copyButtonIcon_y97N{opacity:0;transform:scale(.33)}.copyButtonCopied_obH4 .copyButtonSuccessIcon_LjdS{opacity:1;transform:translate(-50%,-50%) scale(1);transition-delay:75ms}.wordWrapButtonIcon_Bwma{height:1.2rem;width:1.2rem}.details_lb9f{--docusaurus-details-summary-arrow-size:0.38rem;--docusaurus-details-transition:transform 200ms ease;--docusaurus-details-decoration-color:grey}.details_lb9f>summary{cursor:pointer;padding-left:1rem;position:relative}.details_lb9f>summary::-webkit-details-marker{display:none}.details_lb9f>summary:before{border-color:#0000 #0000 #0000 var(--docusaurus-details-decoration-color);border-style:solid;border-width:var(--docusaurus-details-summary-arrow-size);content:"";left:0;position:absolute;top:.45rem;transform:rotate(0);transform-origin:calc(var(--docusaurus-details-summary-arrow-size)/2) 50%;transition:var(--docusaurus-details-transition)}.collapsibleContent_i85q{border-top:1px solid var(--docusaurus-details-decoration-color);margin-top:1rem;padding-top:1rem}.details_b_Ee{--docusaurus-details-decoration-color:var(--ifm-alert-border-color);--docusaurus-details-transition:transform var(--ifm-transition-fast) ease;border:1px solid var(--ifm-alert-border-color);margin:0 0 var(--ifm-spacing-vertical)}.img_ev3q{height:auto}.admonition_xJq3{margin-bottom:1em}.admonitionHeading_Gvgb{font:var(--ifm-heading-font-weight) var(--ifm-h5-font-size)/var(--ifm-heading-line-height) var(--ifm-heading-font-family)}.admonitionHeading_Gvgb:not(:last-child){margin-bottom:.3rem}.admonitionHeading_Gvgb code{text-transform:none}.admonitionIcon_Rf37{display:inline-block;margin-right:.4em;vertical-align:middle}.admonitionIcon_Rf37 svg{display:inline-block;height:1.6em;width:1.6em;fill:var(--ifm-alert-foreground-color)}.skipToContent_fXgn{background-color:var(--ifm-background-surface-color);color:var(--ifm-color-emphasis-900);left:100%;padding:calc(var(--ifm-global-spacing)/2) var(--ifm-global-spacing);position:fixed;top:1rem;z-index:calc(var(--ifm-z-index-fixed) + 1)}.skipToContent_fXgn:focus{box-shadow:var(--ifm-global-shadow-md);left:1rem}.closeButton_CVFx{line-height:0;padding:0}.content_knG7{font-size:85%;padding:5px 0;text-align:center}.content_knG7 a{color:inherit;-webkit-text-decoration:underline;text-decoration:underline}.announcementBar_mb4j{align-items:center;background-color:var(--ifm-color-white);border-bottom:1px solid var(--ifm-color-emphasis-100);color:var(--ifm-color-black);display:flex;height:var(--docusaurus-announcement-bar-height)}.aa-ClearButton[hidden],.aa-ItemContent:empty,.aa-LoadingIndicator[hidden],.aa-Source:empty,.aa-SourceHeader:empty,[data-theme=dark] .lightToggleIcon_pyhR,[data-theme=light] .darkToggleIcon_wfgR,html[data-announcement-bar-initially-dismissed=true] .announcementBar_mb4j{display:none}.announcementBarPlaceholder_vyr4{flex:0 0 10px}.announcementBarClose_gvF7{align-self:stretch;flex:0 0 30px}.toggle_vylO{height:2rem;width:2rem}.aa-Form,.toggleButton_gllP{align-items:center;width:100%;display:flex}.toggleButton_gllP{border-radius:50%;height:100%;justify-content:center;transition:background var(--ifm-transition-fast)}.toggleButton_gllP:hover{background:var(--ifm-color-emphasis-200)}.toggleButtonDisabled_aARS{cursor:not-allowed}.darkNavbarColorModeToggle_X3D1:hover{background:var(--ifm-color-gray-800)}.dropdownNavbarItemMobile_S0Fm{cursor:pointer}.iconLanguage_nlXk{margin-right:5px;vertical-align:text-bottom}body.dark,body[data-theme=dark]{--aa-text-color-rgb:183,192,199;--aa-primary-color-rgb:146,138,255;--aa-muted-color-rgb:146,138,255;--aa-input-background-color-rgb:0,3,9;--aa-background-color-rgb:21,24,42;--aa-selected-color-rgb:146,138,255;--aa-selected-color-alpha:0.25;--aa-description-highlight-background-color-rgb:0 255 255;--aa-description-highlight-background-color-alpha:0.25;--aa-panel-shadow:inset 1px 1px 0 0 #2c2e40,0 3px 8px 0 #000309;--aa-scrollbar-track-background-color-rgb:44,46,64;--aa-muted-color-alpha:1}.aa-Autocomplete,.aa-DetachedFormContainer,.aa-Panel{color:#262627;color:rgba(var(--aa-text-color-rgb),var(--aa-text-color-alpha));font-family:inherit;font-family:var(--aa-font-family);font-size:16px;font-size:var(--aa-font-size);font-weight:400;line-height:1em;margin:0;padding:0;text-align:left}.aa-Form{background-color:#fff;background-color:rgba(var(--aa-input-background-color-rgb),var(--aa-input-background-color-alpha));border:1px solid #807ea3cc;border:1px solid rgba(var(--aa-input-border-color-rgb),var(--aa-input-border-color-alpha));border-radius:3px;line-height:1em;margin:0;position:relative}.aa-ClearButton,.aa-Input,.aa-SubmitButton{border:0;background:none}.aa-Form:focus-within{border-color:#3e34d3;border-color:rgba(var(--aa-primary-color-rgb),1);box-shadow:0 0 0 2px #3e34d333,inset 0 0 0 2px #3e34d333;box-shadow:rgba(var(--aa-primary-color-rgb),var(--aa-primary-color-alpha)) 0 0 0 2px,inset rgba(var(--aa-primary-color-rgb),var(--aa-primary-color-alpha)) 0 0 0 2px;outline:currentColor}.aa-InputWrapperPrefix{align-items:center;display:flex;flex-shrink:0;height:44px;height:var(--aa-search-input-height);order:1}.aa-Label,.aa-LoadingIndicator{cursor:auto;flex-shrink:0;height:100%;padding:0;text-align:left}.aa-Label svg,.aa-LoadingIndicator svg{color:#3e34d3;color:rgba(var(--aa-primary-color-rgb),1);height:auto;max-height:20px;max-height:var(--aa-input-icon-size);stroke-width:1.6;stroke-width:var(--aa-icon-stroke-width);width:20px;width:var(--aa-input-icon-size)}.aa-LoadingIndicator,.aa-SubmitButton{height:100%;padding-left:11px;padding-left:calc(var(--aa-spacing)*.75 - 1px);padding-right:8px;padding-right:var(--aa-spacing-half);width:47px;width:calc(var(--aa-spacing)*1.75 + var(--aa-icon-size) - 1px)}.aa-SubmitButton{appearance:none;margin:0}.aa-LoadingIndicator{align-items:center;display:flex;justify-content:center}.aa-InputWrapper{order:3;position:relative;width:100%}.aa-Input{appearance:none;color:#262627;color:rgba(var(--aa-text-color-rgb),var(--aa-text-color-alpha));font:inherit;height:44px;height:var(--aa-search-input-height);padding:0;width:100%}.aa-Input::placeholder{color:#807ea399;color:rgba(var(--aa-muted-color-rgb),var(--aa-muted-color-alpha));opacity:1}.aa-Input:focus{border-color:none;box-shadow:none;outline:0}.aa-Input::-webkit-search-cancel-button,.aa-Input::-webkit-search-decoration,.aa-Input::-webkit-search-results-button,.aa-Input::-webkit-search-results-decoration{appearance:none}.aa-InputWrapperSuffix{align-items:center;display:flex;height:44px;height:var(--aa-search-input-height);order:4}.aa-ClearButton{align-items:center;color:#807ea399;color:rgba(var(--aa-muted-color-rgb),var(--aa-muted-color-alpha));cursor:pointer;display:flex;height:100%;margin:0;padding:0 12.83328px;padding:0 calc(var(--aa-spacing)*.83333 - .5px)}.aa-Item,.aa-ItemIcon{align-items:center;border-radius:3px}.aa-ClearButton:focus,.aa-ClearButton:hover,.aa-ItemActionButton:focus svg,.aa-ItemActionButton:hover svg{color:#262627;color:rgba(var(--aa-text-color-rgb),var(--aa-text-color-alpha))}.aa-ClearButton svg{stroke-width:1.6;stroke-width:var(--aa-icon-stroke-width);width:20px;width:var(--aa-icon-size)}.aa-Panel{background-color:#fff;background-color:rgba(var(--aa-background-color-rgb),var(--aa-background-color-alpha));border-radius:4px;border-radius:calc(var(--aa-spacing)/4);box-shadow:0 0 0 1px #23263b1a,0 6px 16px -4px #23263b26;box-shadow:var(--aa-panel-shadow);margin:8px 0 0;overflow:hidden;position:absolute;transition:opacity .2s ease-in,filter .2s ease-in}.aa-Panel button{appearance:none;background:none;border:0;margin:0;padding:0}.aa-PanelLayout{height:100%;margin:0;max-height:650px;max-height:var(--aa-panel-max-height);overflow-y:auto;padding:0;position:relative;text-align:left}.aa-PanelLayoutColumns--twoGolden{display:grid;grid-template-columns:39.2% auto;overflow:hidden;padding:0}.aa-PanelLayoutColumns--two{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));overflow:hidden;padding:0}.aa-PanelLayoutColumns--three{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));overflow:hidden;padding:0}.aa-Panel--stalled .aa-Source{filter:grayscale(1);opacity:.8}.aa-Panel--scrollable{margin:0;max-height:650px;max-height:var(--aa-panel-max-height);overflow-x:hidden;overflow-y:auto;padding:8px;padding:var(--aa-spacing-half);scrollbar-color:#fff #eaeaea;scrollbar-color:rgba(var(--aa-scrollbar-thumb-background-color-rgb),var(--aa-scrollbar-thumb-background-color-alpha)) rgba(var(--aa-scrollbar-track-background-color-rgb),var(--aa-scrollbar-track-background-color-alpha));scrollbar-width:thin}.aa-Panel--scrollable::-webkit-scrollbar{width:13px;width:var(--aa-scrollbar-width)}.aa-Panel--scrollable::-webkit-scrollbar-track{background-color:#eaeaea;background-color:rgba(var(--aa-scrollbar-track-background-color-rgb),var(--aa-scrollbar-track-background-color-alpha))}.aa-Panel--scrollable::-webkit-scrollbar-thumb{background-color:#fff;background-color:rgba(var(--aa-scrollbar-thumb-background-color-rgb),var(--aa-scrollbar-thumb-background-color-alpha));border:3px solid #eaeaea;border:3px solid rgba(var(--aa-scrollbar-track-background-color-rgb),var(--aa-scrollbar-track-background-color-alpha));border-radius:9999px;border-right-width:2px}.aa-Source{margin:0;padding:0;position:relative;width:100%}.aa-SourceNoResults{font-size:1em;margin:0;padding:16px;padding:var(--aa-spacing)}.aa-List{margin:0}.aa-List,.aa-SourceHeader{padding:0;position:relative}.aa-SourceHeader{margin:8px .5em 8px 0;margin:var(--aa-spacing-half) .5em var(--aa-spacing-half) 0}.aa-SourceHeaderTitle{background:#fff;background:rgba(var(--aa-background-color-rgb),var(--aa-background-color-alpha));color:#3e34d3;color:rgba(var(--aa-primary-color-rgb),1);display:inline-block;font-size:.8em;font-weight:600;font-weight:var(--aa-font-weight-semibold);margin:0;padding:0 8px 0 0;padding:0 var(--aa-spacing-half) 0 0;position:relative;z-index:9999;z-index:var(--aa-base-z-index)}.aa-SourceHeaderLine{border-bottom:1px solid #3e34d3;border-bottom:1px solid rgba(var(--aa-primary-color-rgb),1);display:block;height:2px;left:0;margin:0;opacity:.3;padding:0;position:absolute;right:0;top:8px;top:var(--aa-spacing-half);z-index:9998;z-index:calc(var(--aa-base-z-index) - 1)}.aa-SourceFooterSeeAll{background:linear-gradient(180deg,#fff,#807ea324);background:linear-gradient(180deg,rgba(var(--aa-background-color-rgb),var(--aa-background-color-alpha)),#807ea324);border:1px solid #807ea399;border:1px solid rgba(var(--aa-muted-color-rgb),var(--aa-muted-color-alpha));border-radius:5px;box-shadow:inset 0 0 2px #fff,0 2px 2px -1px #4c455826;color:inherit;font-size:.95em;font-weight:500;font-weight:var(--aa-font-weight-medium);padding:.475em 1em .6em}.aa-SourceFooterSeeAll:focus,.aa-SourceFooterSeeAll:hover{border:1px solid #3e34d3;border:1px solid rgba(var(--aa-primary-color-rgb),1);color:#3e34d3;color:rgba(var(--aa-primary-color-rgb),1)}.aa-Item{cursor:pointer;display:grid;min-height:40px;min-height:calc(var(--aa-spacing)*2.5);padding:4px;padding:calc(var(--aa-spacing-half)/2)}.aa-Item[aria-selected=true]{background-color:rgba(179,173,214,.205);background-color:rgba(var(--aa-selected-color-rgb),var(--aa-selected-color-alpha))}.aa-Item[aria-selected=true] .aa-ActiveOnly,.aa-Item[aria-selected=true] .aa-ItemActionButton{visibility:visible}.aa-ItemIcon{background:#fff;background:rgba(var(--aa-background-color-rgb),var(--aa-background-color-alpha));box-shadow:inset 0 0 0 1px #807ea34d;box-shadow:inset 0 0 0 1px rgba(var(--aa-panel-border-color-rgb),var(--aa-panel-border-color-alpha));color:#7777a3;color:rgba(var(--aa-icon-color-rgb),var(--aa-icon-color-alpha));display:flex;flex-shrink:0;font-size:.7em;height:28px;height:calc(var(--aa-icon-size) + var(--aa-spacing-half));justify-content:center;overflow:hidden;stroke-width:1.6;stroke-width:var(--aa-icon-stroke-width);text-align:center;width:28px;width:calc(var(--aa-icon-size) + var(--aa-spacing-half))}.aa-ItemIcon img{height:auto;max-height:20px;max-height:calc(var(--aa-icon-size) + var(--aa-spacing-half) - 8px);max-width:20px;max-width:calc(var(--aa-icon-size) + var(--aa-spacing-half) - 8px);width:auto}.aa-ItemIcon svg{height:20px;height:var(--aa-icon-size);width:20px;width:var(--aa-icon-size)}.aa-ItemIcon--alignTop{align-self:flex-start}.aa-ItemIcon--noBorder{background:none;box-shadow:none}.aa-ItemIcon--picture{height:96px;width:96px}.aa-ItemIcon--picture img{max-height:100%;max-width:100%;padding:8px;padding:var(--aa-spacing-half)}.aa-ItemContent{align-items:center;cursor:pointer;display:grid;gap:8px;grid-gap:8px;grid-gap:var(--aa-spacing-half);gap:var(--aa-spacing-half);grid-auto-flow:column;line-height:1.25em;overflow:hidden}.aa-ItemContent mark{background:none;color:#262627;color:rgba(var(--aa-text-color-rgb),var(--aa-text-color-alpha));font-style:normal;font-weight:700;font-weight:var(--aa-font-weight-bold)}.aa-ItemContent--dual{display:flex;flex-direction:column;justify-content:space-between;text-align:left}.aa-ItemContent--dual .aa-ItemContentSubtitle,.aa-ItemContent--dual .aa-ItemContentTitle{display:block}.aa-ItemContent--indented{padding-left:36px;padding-left:calc(var(--aa-icon-size) + var(--aa-spacing))}.aa-ItemContentBody{display:grid;gap:4px;grid-gap:4px;grid-gap:calc(var(--aa-spacing-half)/2);gap:calc(var(--aa-spacing-half)/2)}.aa-ItemContentTitle{display:inline-block;margin:0 .5em 0 0;max-width:100%;overflow:hidden;padding:0;text-overflow:ellipsis;white-space:nowrap}.aa-ItemContentSubtitle{font-size:.92em}.aa-ItemContentSubtitleIcon:before{border-color:#807ea3a3;border-color:rgba(var(--aa-muted-color-rgb),.64);border-style:solid;content:"";display:inline-block;left:1px;position:relative;top:-3px}.aa-PanelFooter:after,.aa-PanelHeader:after{content:"";position:absolute;left:0;pointer-events:none;right:0}.aa-ItemContentSubtitle--inline .aa-ItemContentSubtitleIcon:before{border-width:0 0 1.5px;margin-left:8px;margin-left:var(--aa-spacing-half);margin-right:4px;margin-right:calc(var(--aa-spacing-half)/2);width:10px;width:calc(var(--aa-spacing-half) + 2px)}.aa-ItemContentSubtitle--standalone{align-items:center;color:#262627;color:rgba(var(--aa-text-color-rgb),var(--aa-text-color-alpha));display:grid;gap:8px;grid-gap:8px;grid-gap:var(--aa-spacing-half);gap:var(--aa-spacing-half);grid-auto-flow:column;justify-content:start}#__docusaurus-base-url-issue-banner-container,.aa-DetachedContainer--modal .aa-PanelLayout:empty,.aa-DetachedSearchButtonPlaceholder[hidden],.aa-ItemContentDescription:empty,.navbarSearchContainer_Bca1:empty{display:none}.aa-ItemContentSubtitle--standalone .aa-ItemContentSubtitleIcon:before{border-radius:0 0 0 3px;border-width:0 0 1.5px 1.5px;height:8px;height:var(--aa-spacing-half);width:8px;width:var(--aa-spacing-half)}.aa-ItemContentSubtitleCategory{color:#807ea3;color:rgba(var(--aa-muted-color-rgb),1);font-weight:500}.aa-ItemContentDescription{color:#262627;color:rgba(var(--aa-text-color-rgb),var(--aa-text-color-alpha));font-size:.85em;max-width:100%;overflow-x:hidden;text-overflow:ellipsis}.aa-ItemContentDescription mark{background:#f5df4d80;background:rgba(var(--aa-description-highlight-background-color-rgb),var(--aa-description-highlight-background-color-alpha));color:#262627;color:rgba(var(--aa-text-color-rgb),var(--aa-text-color-alpha));font-style:normal;font-weight:500;font-weight:var(--aa-font-weight-medium)}.aa-ItemContentDash{color:#807ea399;color:rgba(var(--aa-muted-color-rgb),var(--aa-muted-color-alpha));display:none;opacity:.4}.aa-ItemContentTag{background-color:#3e34d333;background-color:rgba(var(--aa-primary-color-rgb),var(--aa-primary-color-alpha));border-radius:3px;margin:0 .4em 0 0;padding:.08em .3em}.aa-ItemLink,.aa-ItemWrapper{align-items:center;color:inherit;display:grid;gap:4px;grid-gap:4px;grid-gap:calc(var(--aa-spacing-half)/2);gap:calc(var(--aa-spacing-half)/2);grid-auto-flow:column;justify-content:space-between;width:100%}.aa-ItemLink{color:inherit}.aa-ItemActions{display:grid;grid-auto-flow:column;height:100%;justify-self:end;margin:0 -5.33333px;margin:0 calc(var(--aa-spacing)/-3);padding:0 2px 0 0}.aa-ItemActionButton{align-items:center;background:none;border:0;color:#807ea399;color:rgba(var(--aa-muted-color-rgb),var(--aa-muted-color-alpha));cursor:pointer;display:flex;flex-shrink:0;padding:0}.aa-ItemActionButton svg{color:#807ea399;color:rgba(var(--aa-muted-color-rgb),var(--aa-muted-color-alpha));margin:5.33333px;margin:calc(var(--aa-spacing)/3);stroke-width:1.6;stroke-width:var(--aa-icon-stroke-width);width:20px;width:var(--aa-action-icon-size)}.aa-ActiveOnly{visibility:hidden}.aa-PanelHeader{align-items:center;background:#3e34d3;background:rgba(var(--aa-primary-color-rgb),1);color:#fff;display:grid;height:var(--aa-modal-header-height);margin:0;padding:8px 16px;padding:var(--aa-spacing-half) var(--aa-spacing);position:relative}.aa-PanelHeader:after{background-image:linear-gradient(#fff,#fff0);background-image:linear-gradient(rgba(var(--aa-background-color-rgb),1),rgba(var(--aa-background-color-rgb),0));bottom:-8px;bottom:calc(var(--aa-spacing-half)*-1);height:8px;height:var(--aa-spacing-half)}.aa-PanelFooter,.aa-PanelHeader:after{z-index:9999;z-index:var(--aa-base-z-index)}.aa-PanelFooter{background-color:#fff;background-color:rgba(var(--aa-background-color-rgb),var(--aa-background-color-alpha));box-shadow:inset 0 1px 0 #807ea34d;box-shadow:inset 0 1px 0 rgba(var(--aa-panel-border-color-rgb),var(--aa-panel-border-color-alpha));display:flex;justify-content:space-between;margin:0;padding:16px;padding:var(--aa-spacing);position:relative}.aa-PanelFooter:after{background-image:linear-gradient(#fff0,#807ea399);background-image:linear-gradient(rgba(var(--aa-background-color-rgb),0),rgba(var(--aa-muted-color-rgb),var(--aa-muted-color-alpha)));height:16px;height:var(--aa-spacing);opacity:.12;top:-16px;top:calc(var(--aa-spacing)*-1);z-index:9998;z-index:calc(var(--aa-base-z-index) - 1)}.aa-DetachedContainer{background:#fff;background:rgba(var(--aa-background-color-rgb),var(--aa-background-color-alpha));bottom:0;box-shadow:0 0 0 1px #23263b1a,0 6px 16px -4px #23263b26;box-shadow:var(--aa-panel-shadow);display:flex;flex-direction:column;left:0;margin:0;overflow:hidden;padding:0;position:fixed;right:0;top:0;z-index:9999;z-index:var(--aa-base-z-index)}.aa-DetachedContainer:after{height:32px}.aa-DetachedContainer .aa-SourceHeader{margin:8px 0 8px 2px;margin:var(--aa-spacing-half) 0 var(--aa-spacing-half) 2px}.aa-DetachedContainer .aa-Panel{background-color:#fff;background-color:rgba(var(--aa-background-color-rgb),var(--aa-background-color-alpha));border-radius:0;box-shadow:none;flex-grow:1;margin:0;padding:0;position:relative}.aa-DetachedContainer .aa-PanelLayout{bottom:0;box-shadow:none;left:0;margin:0;max-height:none;overflow-y:auto;position:absolute;right:0;top:0;width:100%}.aa-DetachedFormContainer{border-bottom:1px solid #807ea34d;border-bottom:1px solid rgba(var(--aa-panel-border-color-rgb),var(--aa-panel-border-color-alpha));display:flex;flex-direction:row;justify-content:space-between;margin:0;padding:8px;padding:var(--aa-spacing-half)}.aa-DetachedCancelButton{background:none;border:0;border-radius:3px;color:#262627;color:rgba(var(--aa-text-color-rgb),var(--aa-text-color-alpha));cursor:pointer;font:inherit;margin:0 0 0 8px;margin:0 0 0 var(--aa-spacing-half);padding:0 8px;padding:0 var(--aa-spacing-half)}.aa-DetachedCancelButton:focus,.aa-DetachedCancelButton:hover{box-shadow:inset 0 0 0 1px #807ea34d;box-shadow:inset 0 0 0 1px rgba(var(--aa-panel-border-color-rgb),var(--aa-panel-border-color-alpha))}.aa-DetachedContainer--modal{border-radius:6px;bottom:inherit;height:auto;margin:0 auto;max-width:680px;max-width:var(--aa-detached-modal-max-width);position:absolute;top:3%}.aa-DetachedContainer--modal .aa-PanelLayout{max-height:500px;max-height:var(--aa-detached-modal-max-height);padding-bottom:8px;padding-bottom:var(--aa-spacing-half);position:static}.aa-DetachedSearchButton{align-items:center;background-color:#fff;background-color:rgba(var(--aa-input-background-color-rgb),var(--aa-input-background-color-alpha));border:1px solid #807ea3cc;border:1px solid rgba(var(--aa-input-border-color-rgb),var(--aa-input-border-color-alpha));border-radius:3px;color:#807ea399;color:rgba(var(--aa-muted-color-rgb),var(--aa-muted-color-alpha));cursor:pointer;display:flex;font:inherit;font-family:inherit;font-family:var(--aa-font-family);font-size:16px;font-size:var(--aa-font-size);height:44px;height:var(--aa-search-input-height);margin:0;padding:0 5.5px;padding:0 calc(var(--aa-search-input-height)/8);position:relative;text-align:left;width:100%}.aa-DetachedSearchButton:focus{border-color:#3e34d3;border-color:rgba(var(--aa-primary-color-rgb),1);box-shadow:0 0 0 3px #3e34d333,inset 0 0 0 2px #3e34d333;box-shadow:rgba(var(--aa-primary-color-rgb),var(--aa-primary-color-alpha)) 0 0 0 3px,inset rgba(var(--aa-primary-color-rgb),var(--aa-primary-color-alpha)) 0 0 0 2px;outline:currentColor}.aa-DetachedSearchButtonIcon{align-items:center;color:#3e34d3;color:rgba(var(--aa-primary-color-rgb),1);cursor:auto;display:flex;flex-shrink:0;height:100%;justify-content:center;width:36px;width:calc(var(--aa-icon-size) + var(--aa-spacing))}.aa-DetachedSearchButtonQuery{color:#262627;color:rgba(var(--aa-text-color-rgb),1);line-height:1.25em;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.aa-Detached{height:100vh;overflow:hidden}.aa-DetachedOverlay{background-color:#73728166;background-color:rgba(var(--aa-overlay-color-rgb),var(--aa-overlay-color-alpha));height:100vh;left:0;margin:0;padding:0;position:fixed;right:0;top:0;z-index:9998;z-index:calc(var(--aa-base-z-index) - 1)}.aa-GradientBottom,.aa-GradientTop{height:8px;height:var(--aa-spacing-half);left:0;pointer-events:none;position:absolute;right:0;z-index:9999;z-index:var(--aa-base-z-index)}.aa-GradientTop{background-image:linear-gradient(#fff,#fff0);background-image:linear-gradient(rgba(var(--aa-background-color-rgb),1),rgba(var(--aa-background-color-rgb),0));top:0}.aa-GradientBottom{background-image:linear-gradient(#fff0,#fff);background-image:linear-gradient(rgba(var(--aa-background-color-rgb),0),rgba(var(--aa-background-color-rgb),1));border-bottom-left-radius:4px;border-bottom-left-radius:calc(var(--aa-spacing)/4);border-bottom-right-radius:4px;border-bottom-right-radius:calc(var(--aa-spacing)/4);bottom:0}.navbarHideable_m1mJ{transition:transform var(--ifm-transition-fast) ease}.navbarHidden_jGov{transform:translate3d(0,calc(-100% - 2px),0)}.errorBoundaryError_a6uf{color:red;white-space:pre-wrap}.errorBoundaryFallback_VBag{color:red;padding:.55rem}body:not(.navigation-with-keyboard) :not(input):focus{outline:0}.footerLogoLink_BH7S{opacity:.5;transition:opacity var(--ifm-transition-fast) var(--ifm-transition-timing-default)}.mainWrapper_z2l0{display:flex;flex:1 0 auto;flex-direction:column}.docusaurus-mt-lg{margin-top:3rem}#__docusaurus{display:flex;flex-direction:column;min-height:100%}.breadcrumbHomeIcon_YNFT{height:1.1rem;position:relative;top:1px;vertical-align:top;width:1.1rem}.breadcrumbsContainer_Z_bl{--ifm-breadcrumb-size-multiplier:0.8;margin-bottom:.8rem}.title_kItE{--ifm-h1-font-size:3rem;margin-bottom:calc(var(--ifm-leading)*1.25)}@media (min-width:997px){.collapseSidebarButton_PEFL,.expandButton_TmdG{background-color:var(--docusaurus-collapse-button-bg)}.lastUpdated_JAkA{text-align:right}.tocMobile_ITEo{display:none}.collapseSidebarButton_PEFL{border:1px solid var(--ifm-toc-border-color);border-radius:0;bottom:0;display:block!important;height:40px;position:sticky}.collapseSidebarButtonIcon_kv0_{margin-top:4px;transform:rotate(180deg)}.expandButtonIcon_i1dp,[dir=rtl] .collapseSidebarButtonIcon_kv0_{transform:rotate(0)}.collapseSidebarButton_PEFL:focus,.collapseSidebarButton_PEFL:hover,.expandButton_TmdG:focus,.expandButton_TmdG:hover{background-color:var(--docusaurus-collapse-button-bg-hover)}.menuHtmlItem_M9Kj{padding:var(--ifm-menu-link-padding-vertical) var(--ifm-menu-link-padding-horizontal)}.menu_SIkG{flex-grow:1;padding:.5rem}@supports (scrollbar-gutter:stable){.menu_SIkG{padding:.5rem 0 .5rem .5rem;scrollbar-gutter:stable}}.menuWithAnnouncementBar_GW3s{margin-bottom:var(--docusaurus-announcement-bar-height)}.sidebar_njMd{display:flex;flex-direction:column;height:100%;padding-top:var(--ifm-navbar-height);width:var(--doc-sidebar-width)}.sidebarWithHideableNavbar_wUlq{padding-top:0}.sidebarHidden_VK0M{opacity:0;visibility:hidden}.sidebarLogo_isFc{align-items:center;color:inherit!important;display:flex!important;margin:0 var(--ifm-navbar-padding-horizontal);max-height:var(--ifm-navbar-height);min-height:var(--ifm-navbar-height);-webkit-text-decoration:none!important;text-decoration:none!important}.sidebarLogo_isFc img{height:2rem;margin-right:.5rem}.expandButton_TmdG{align-items:center;display:flex;height:100%;justify-content:center;position:absolute;right:0;top:0;transition:background-color var(--ifm-transition-fast) ease;width:100%}[dir=rtl] .expandButtonIcon_i1dp{transform:rotate(180deg)}.docSidebarContainer_YfHR{border-right:1px solid var(--ifm-toc-border-color);clip-path:inset(0);display:block;margin-top:calc(var(--ifm-navbar-height)*-1);transition:width var(--ifm-transition-fast) ease;width:var(--doc-sidebar-width);will-change:width}.docSidebarContainerHidden_DPk8{cursor:pointer;width:var(--doc-sidebar-hidden-width)}.sidebarViewport_aRkj{height:100%;max-height:100vh;position:sticky;top:0}.docMainContainer_TBSr{flex-grow:1;max-width:calc(100% - var(--doc-sidebar-width))}.docMainContainerEnhanced_lQrH{max-width:calc(100% - var(--doc-sidebar-hidden-width))}.docItemWrapperEnhanced_JWYK{max-width:calc(var(--ifm-container-width) + var(--doc-sidebar-width))!important}:root{--docusaurus-announcement-bar-height:30px}.announcementBarClose_gvF7,.announcementBarPlaceholder_vyr4{flex-basis:50px}.navbarSearchContainer_Bca1{padding:var(--ifm-navbar-item-padding-vertical) var(--ifm-navbar-item-padding-horizontal)}.docItemCol_VOVn,.generatedIndexPage_vN6x{max-width:75%!important}.list_eTzJ article:nth-last-child(-n+2){margin-bottom:0!important}}@media (min-width:1440px){.container{max-width:var(--ifm-container-width-xl)}}@media (max-width:996px){.col{--ifm-col-width:100%;flex-basis:var(--ifm-col-width);margin-left:0}.footer{--ifm-footer-padding-horizontal:0}.colorModeToggle_DEke,.footer__link-separator,.navbar__item,.tableOfContents_bqdL{display:none}.footer__col{margin-bottom:calc(var(--ifm-spacing-vertical)*3)}.footer__link-item{display:block;width:max-content}.hero{padding-left:0;padding-right:0}.navbar>.container,.navbar>.container-fluid{padding:0}.navbar__toggle{display:inherit}.navbar__search-input{width:9rem}.pills--block,.tabs--block{flex-direction:column}.docItemContainer_F8PC{padding:0 .3rem}.navbarSearchContainer_Bca1{position:absolute;right:var(--ifm-navbar-padding-horizontal)}}@media (max-width:576px){.markdown h1:first-child{--ifm-h1-font-size:2rem}.markdown>h2{--ifm-h2-font-size:1.5rem}.markdown>h3{--ifm-h3-font-size:1.25rem}}@media (hover:hover){.backToTopButton_sjWU:hover{background-color:var(--ifm-color-emphasis-300)}.aa-TouchOnly{display:none}}@media (hover:none) and (pointer:coarse){:root{--aa-spacing-factor:1.2;--aa-action-icon-size:22px}.aa-LoadingIndicator,.aa-SubmitButton{padding-left:3px;padding-left:calc(var(--aa-spacing-half)/ 2 - 1px);width:39px;width:calc(var(--aa-icon-size) + var(--aa-spacing)*1.25 - 1px)}.aa-ClearButton{padding:0 10.16672px;padding:0 calc(var(--aa-spacing)*.66667 - .5px)}.aa-ItemActionButton:focus svg,.aa-ItemActionButton:hover svg{color:inherit}.aa-DesktopOnly{display:none}}@media (pointer:fine){.thin-scrollbar{scrollbar-width:thin}.thin-scrollbar::-webkit-scrollbar{height:var(--ifm-scrollbar-size);width:var(--ifm-scrollbar-size)}.thin-scrollbar::-webkit-scrollbar-track{background:var(--ifm-scrollbar-track-background-color);border-radius:10px}.thin-scrollbar::-webkit-scrollbar-thumb{background:var(--ifm-scrollbar-thumb-background-color);border-radius:10px}.thin-scrollbar::-webkit-scrollbar-thumb:hover{background:var(--ifm-scrollbar-thumb-hover-background-color)}}@media (prefers-reduced-motion:reduce){:root{--ifm-transition-fast:0ms;--ifm-transition-slow:0ms}}@media screen and (prefers-reduced-motion){.aa-Panel{transition:none}}@media print{.announcementBar_mb4j,.footer,.menu,.navbar,.pagination-nav,.table-of-contents,.tocMobile_ITEo{display:none}.tabs{page-break-inside:avoid}.codeBlockLines_e6Vv{white-space:pre-wrap}}
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/images/attestation-composite-device-b91e917a07f0f2bb082989317a9b053f.svg b/pr-preview/pr-1071/assets/images/attestation-composite-device-b91e917a07f0f2bb082989317a9b053f.svg
deleted file mode 100644
index f76b674710..0000000000
--- a/pr-preview/pr-1071/assets/images/attestation-composite-device-b91e917a07f0f2bb082989317a9b053f.svg
+++ /dev/null
@@ -1,1127 +0,0 @@
-
-
diff --git a/pr-preview/pr-1071/assets/images/attestation-pod-af4fc34dd97b1fdc20f66ecfa4fdeb1a.svg b/pr-preview/pr-1071/assets/images/attestation-pod-af4fc34dd97b1fdc20f66ecfa4fdeb1a.svg
deleted file mode 100644
index 4149941117..0000000000
--- a/pr-preview/pr-1071/assets/images/attestation-pod-af4fc34dd97b1fdc20f66ecfa4fdeb1a.svg
+++ /dev/null
@@ -1,1737 +0,0 @@
-
-
diff --git a/pr-preview/pr-1071/assets/images/attestation-rats-architecture-1a05fc2165e5c75a171e7b7832186bc3.svg b/pr-preview/pr-1071/assets/images/attestation-rats-architecture-1a05fc2165e5c75a171e7b7832186bc3.svg
deleted file mode 100644
index 7e291b4696..0000000000
--- a/pr-preview/pr-1071/assets/images/attestation-rats-architecture-1a05fc2165e5c75a171e7b7832186bc3.svg
+++ /dev/null
@@ -1,1417 +0,0 @@
-
-
diff --git a/pr-preview/pr-1071/assets/images/components-dd64f006e7d6b6facb9eb16f1af59d39.svg b/pr-preview/pr-1071/assets/images/components-dd64f006e7d6b6facb9eb16f1af59d39.svg
deleted file mode 100644
index 33f1df4223..0000000000
--- a/pr-preview/pr-1071/assets/images/components-dd64f006e7d6b6facb9eb16f1af59d39.svg
+++ /dev/null
@@ -1,798 +0,0 @@
-
-
diff --git a/pr-preview/pr-1071/assets/images/components-ea3fb9800d5718d6ab96607ee817c104.svg b/pr-preview/pr-1071/assets/images/components-ea3fb9800d5718d6ab96607ee817c104.svg
deleted file mode 100644
index bd65c768ef..0000000000
--- a/pr-preview/pr-1071/assets/images/components-ea3fb9800d5718d6ab96607ee817c104.svg
+++ /dev/null
@@ -1,766 +0,0 @@
-
-
diff --git a/pr-preview/pr-1071/assets/images/concept-c1792eb1b8f3959308512d1e518b0176.svg b/pr-preview/pr-1071/assets/images/concept-c1792eb1b8f3959308512d1e518b0176.svg
deleted file mode 100644
index af04ecafab..0000000000
--- a/pr-preview/pr-1071/assets/images/concept-c1792eb1b8f3959308512d1e518b0176.svg
+++ /dev/null
@@ -1,127 +0,0 @@
-
diff --git a/pr-preview/pr-1071/assets/images/contrast_pki.drawio-a2442a1eeb081612c5ad587a58589ad4.svg b/pr-preview/pr-1071/assets/images/contrast_pki.drawio-a2442a1eeb081612c5ad587a58589ad4.svg
deleted file mode 100644
index 386d2215c2..0000000000
--- a/pr-preview/pr-1071/assets/images/contrast_pki.drawio-a2442a1eeb081612c5ad587a58589ad4.svg
+++ /dev/null
@@ -1,4 +0,0 @@
-
-
-
-
diff --git a/pr-preview/pr-1071/assets/images/emoijvoto-3fb48da575d6d4adf76cc90caa35d762.png b/pr-preview/pr-1071/assets/images/emoijvoto-3fb48da575d6d4adf76cc90caa35d762.png
deleted file mode 100644
index 9779306e04..0000000000
Binary files a/pr-preview/pr-1071/assets/images/emoijvoto-3fb48da575d6d4adf76cc90caa35d762.png and /dev/null differ
diff --git a/pr-preview/pr-1071/assets/images/personas-0d51d0cc03b37c9f45b914bbea163646.svg b/pr-preview/pr-1071/assets/images/personas-0d51d0cc03b37c9f45b914bbea163646.svg
deleted file mode 100644
index c14341047f..0000000000
--- a/pr-preview/pr-1071/assets/images/personas-0d51d0cc03b37c9f45b914bbea163646.svg
+++ /dev/null
@@ -1,568 +0,0 @@
-
-
diff --git a/pr-preview/pr-1071/assets/images/personas-1c9f2b217e0b94e0c3057df96d96b3f0.svg b/pr-preview/pr-1071/assets/images/personas-1c9f2b217e0b94e0c3057df96d96b3f0.svg
deleted file mode 100644
index 19988f631c..0000000000
--- a/pr-preview/pr-1071/assets/images/personas-1c9f2b217e0b94e0c3057df96d96b3f0.svg
+++ /dev/null
@@ -1,573 +0,0 @@
-
-
diff --git a/pr-preview/pr-1071/assets/images/runtime-c41c29928f42a90474f03213074a5f97.svg b/pr-preview/pr-1071/assets/images/runtime-c41c29928f42a90474f03213074a5f97.svg
deleted file mode 100644
index b13d79e3ae..0000000000
--- a/pr-preview/pr-1071/assets/images/runtime-c41c29928f42a90474f03213074a5f97.svg
+++ /dev/null
@@ -1,1376 +0,0 @@
-
-
diff --git a/pr-preview/pr-1071/assets/images/tcb-eebc94816125417eaf55b0e5e96bba37.svg b/pr-preview/pr-1071/assets/images/tcb-eebc94816125417eaf55b0e5e96bba37.svg
deleted file mode 100644
index b20ac5284c..0000000000
--- a/pr-preview/pr-1071/assets/images/tcb-eebc94816125417eaf55b0e5e96bba37.svg
+++ /dev/null
@@ -1,547 +0,0 @@
-
-
diff --git a/pr-preview/pr-1071/assets/js/014daffb.aacfa15a.js b/pr-preview/pr-1071/assets/js/014daffb.aacfa15a.js
deleted file mode 100644
index c3da45e3e4..0000000000
--- a/pr-preview/pr-1071/assets/js/014daffb.aacfa15a.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[1955],{89204:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>l,frontMatter:()=>o,metadata:()=>n,toc:()=>d});const n=JSON.parse('{"id":"architecture/secrets","title":"Secrets & recovery","description":"When the Coordinator is configured with the initial manifest, it generates a random secret seed.","source":"@site/docs/architecture/secrets.md","sourceDirName":"architecture","slug":"/architecture/secrets","permalink":"/contrast/pr-preview/pr-1071/next/architecture/secrets","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/docs/architecture/secrets.md","tags":[],"version":"current","frontMatter":{},"sidebar":"docs","previous":{"title":"Attestation","permalink":"/contrast/pr-preview/pr-1071/next/architecture/attestation"},"next":{"title":"Certificate authority","permalink":"/contrast/pr-preview/pr-1071/next/architecture/certificates"}}');var r=s(74848),i=s(28453);const o={},a="Secrets & recovery",c={},d=[{value:"Persistence",id:"persistence",level:2},{value:"Recovery",id:"recovery",level:2},{value:"Workload Secrets",id:"workload-secrets",level:2},{value:"Secure persistence",id:"secure-persistence",level:3}];function h(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",p:"p",pre:"pre",...(0,i.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.header,{children:(0,r.jsx)(t.h1,{id:"secrets--recovery",children:"Secrets & recovery"})}),"\n",(0,r.jsx)(t.p,{children:"When the Coordinator is configured with the initial manifest, it generates a random secret seed.\nFrom this seed, it uses an HKDF to derive the CA root key and a signing key for the manifest history.\nThis derivation is deterministic, so the seed can be used to bring any Coordinator to this Coordinator's state."}),"\n",(0,r.jsxs)(t.p,{children:["The secret seed is returned to the user on the first call to ",(0,r.jsx)(t.code,{children:"contrast set"}),", encrypted with the user's public seed share owner key.\nIf no seed share owner key is provided, a key is generated and stored in the working directory."]}),"\n",(0,r.jsx)(t.h2,{id:"persistence",children:"Persistence"}),"\n",(0,r.jsxs)(t.p,{children:["The Coordinator runs as a ",(0,r.jsx)(t.code,{children:"StatefulSet"})," with a dynamically provisioned persistent volume.\nThis volume stores the manifest history and the associated runtime policies.\nThe manifest isn't considered sensitive information, because it needs to be passed to the untrusted infrastructure in order to start workloads.\nHowever, the Coordinator must ensure its integrity and that the persisted data corresponds to the manifests set by authorized users.\nThus, the manifest is stored in plain text, but is signed with a private key derived from the Coordinator's secret seed."]}),"\n",(0,r.jsx)(t.h2,{id:"recovery",children:"Recovery"}),"\n",(0,r.jsxs)(t.p,{children:["When a Coordinator starts up, it doesn't have access to the signing secret and can thus not verify the integrity of the persisted manifests.\nIt needs to be provided with the secret seed, from which it can derive the signing key that verifies the signatures.\nThis procedure is called recovery and is initiated by the workload owner.\nThe CLI decrypts the secret seed using the private seed share owner key, verifies the Coordinator and sends the seed through the ",(0,r.jsx)(t.code,{children:"Recover"})," method.\nThe Coordinator recovers its key material and verifies the manifest history signature."]}),"\n",(0,r.jsx)(t.h2,{id:"workload-secrets",children:"Workload Secrets"}),"\n",(0,r.jsxs)(t.p,{children:["The Coordinator provides each workload a secret seed during attestation.\nThis secret can be used by the workload to derive additional secrets for example to encrypt persistent data.\nLike the workload certificates, it's written to the ",(0,r.jsx)(t.code,{children:"secrets/workload-secret-seed"})," path under the shared Kubernetes volume ",(0,r.jsx)(t.code,{children:"contrast-secrets"}),"."]}),"\n",(0,r.jsx)(t.admonition,{type:"warning",children:(0,r.jsx)(t.p,{children:"The workload owner can decrypt data encrypted with secrets derived from the workload secret.\nThe workload owner can derive the workload secret themselves, since it's derived from the secret seed known to the workload owner.\nIf the data owner and the workload owner is the same entity, then they can safely use the workload secrets."})}),"\n",(0,r.jsx)(t.h3,{id:"secure-persistence",children:"Secure persistence"}),"\n",(0,r.jsx)(t.p,{children:"Remember that persistent volumes from the cloud provider are untrusted.\nUsing the workload secret, applications can set up trusted storage on top of untrusted block devices.\nThe following, slightly abbreviated resource outlines how this could be realized:"}),"\n",(0,r.jsx)(t.admonition,{type:"warning",children:(0,r.jsx)(t.p,{children:"This configuration snippet is intended to be educational and needs to be refined and adapted to your production environment.\nUsing it as-is may result in data corruption or data loss."})}),"\n",(0,r.jsx)(t.pre,{children:(0,r.jsx)(t.code,{className:"language-yaml",children:"apiVersion: apps/v1\nkind: StatefulSet\nmetadata:\n name: volume-tester\nspec:\n template:\n spec:\n containers:\n - name: main\n image: my.registry/my-image@sha256:0123...\n command:\n - /bin/sh\n - -ec\n - | # <-- Custom script that mounts the encrypted disk and then calls the original application.\n device=/dev/csi0\n if ! cryptsetup isLuks $device; then\n cryptsetup luksFormat $device /contrast/secrets/workload-secret-seed\n cryptsetup open $device state -d /contrast/secrets/workload-secret-seed\n mkfs.ext4 /dev/mapper/state\n cryptsetup close state\n fi\n cryptsetup open $device state -d /contrast/secrets/workload-secret-seed\n /path/to/original/app\n name: volume-tester\n volumeDevices:\n - name: state\n devicePath: /dev/csi0\n securityContext:\n privileged: true # <-- This is necessary for mounting devices.\n runtimeClassName: contrast-cc\n volumeClaimTemplates:\n - apiVersion: v1\n kind: PersistentVolumeClaim\n metadata:\n name: state\n spec:\n accessModes:\n - ReadWriteOnce\n resources:\n requests:\n storage: 1Gi\n volumeMode: Block # <-- The requested volume needs to be a raw block device.\n"})}),"\n",(0,r.jsx)(t.admonition,{type:"note",children:(0,r.jsxs)(t.p,{children:["This example assumes that you can modify the container image to include a shell and the ",(0,r.jsx)(t.code,{children:"cryptsetup"})," utility.\nAlternatively, you can set up a secure mount from a sidecar container inside an ",(0,r.jsx)(t.code,{children:"emptyDir"})," mount shared with the main container.\nThe Contrast end-to-end tests include ",(0,r.jsx)(t.a,{href:"https://github.com/edgelesssys/contrast/blob/0662a2e/internal/kuberesource/sets.go#L504",children:"an example"})," of this type of mount."]})})]})}function l(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(h,{...e})}):h(e)}},28453:(e,t,s)=>{s.d(t,{R:()=>o,x:()=>a});var n=s(96540);const r={},i=n.createContext(r);function o(e){const t=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),n.createElement(i.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/018595b3.6fec9739.js b/pr-preview/pr-1071/assets/js/018595b3.6fec9739.js
deleted file mode 100644
index 29312c637b..0000000000
--- a/pr-preview/pr-1071/assets/js/018595b3.6fec9739.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[3876],{59763:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>a,contentTitle:()=>l,default:()=>m,frontMatter:()=>c,metadata:()=>r,toc:()=>u});const r=JSON.parse('{"id":"examples/index","title":"Examples","description":"","source":"@site/versioned_docs/version-0.5/examples/index.md","sourceDirName":"examples","slug":"/examples/","permalink":"/contrast/pr-preview/pr-1071/0.5/examples/","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.5/examples/index.md","tags":[],"version":"0.5","frontMatter":{},"sidebar":"docs","previous":{"title":"First steps","permalink":"/contrast/pr-preview/pr-1071/0.5/getting-started/first-steps"},"next":{"title":"Confidential emoji voting","permalink":"/contrast/pr-preview/pr-1071/0.5/examples/emojivoto"}}');var s=n(74848),o=n(28453),i=n(44074);const c={},l="Examples",a={},u=[];function d(e){const t={h1:"h1",header:"header",...(0,o.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.header,{children:(0,s.jsx)(t.h1,{id:"examples",children:"Examples"})}),"\n","\n",(0,s.jsx)(i.A,{})]})}function m(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},44074:(e,t,n)=>{n.d(t,{A:()=>b});var r=n(96540),s=n(34164),o=n(45357),i=n(14783),c=n(97639);const l=["zero","one","two","few","many","other"];function a(e){return l.filter((t=>e.includes(t)))}const u={locale:"en",pluralForms:a(["one","other"]),select:e=>1===e?"one":"other"};function d(){const{i18n:{currentLocale:e}}=(0,c.A)();return(0,r.useMemo)((()=>{try{return function(e){const t=new Intl.PluralRules(e);return{locale:e,pluralForms:a(t.resolvedOptions().pluralCategories),select:e=>t.select(e)}}(e)}catch(t){return console.error(`Failed to use Intl.PluralRules for locale "${e}".\nDocusaurus will fallback to the default (English) implementation.\nError: ${t.message}\n`),u}}),[e])}function m(){const e=d();return{selectMessage:(t,n)=>function(e,t,n){const r=e.split("|");if(1===r.length)return r[0];r.length>n.pluralForms.length&&console.error(`For locale=${n.locale}, a maximum of ${n.pluralForms.length} plural forms are expected (${n.pluralForms.join(",")}), but the message contains ${r.length}: ${e}`);const s=n.select(t),o=n.pluralForms.indexOf(s);return r[Math.min(o,r.length-1)]}(n,t,e)}}var p=n(40877),f=n(23230),h=n(85225);const x={cardContainer:"cardContainer_fWXF",cardTitle:"cardTitle_rnsV",cardDescription:"cardDescription_PWke"};var g=n(74848);function j(e){let{href:t,children:n}=e;return(0,g.jsx)(i.A,{href:t,className:(0,s.A)("card padding--lg",x.cardContainer),children:n})}function v(e){let{href:t,icon:n,title:r,description:o}=e;return(0,g.jsxs)(j,{href:t,children:[(0,g.jsxs)(h.A,{as:"h2",className:(0,s.A)("text--truncate",x.cardTitle),title:r,children:[n," ",r]}),o&&(0,g.jsx)("p",{className:(0,s.A)("text--truncate",x.cardDescription),title:o,children:o})]})}function w(e){let{item:t}=e;const n=(0,o.Nr)(t),r=function(){const{selectMessage:e}=m();return t=>e(t,(0,f.T)({message:"1 item|{count} items",id:"theme.docs.DocCard.categoryDescription.plurals",description:"The default description for a category card in the generated index about how many items this category includes"},{count:t}))}();return n?(0,g.jsx)(v,{href:n,icon:"\ud83d\uddc3\ufe0f",title:t.label,description:t.description??r(t.items.length)}):null}function y(e){let{item:t}=e;const n=(0,p.A)(t.href)?"\ud83d\udcc4\ufe0f":"\ud83d\udd17",r=(0,o.cC)(t.docId??void 0);return(0,g.jsx)(v,{href:t.href,icon:n,title:t.label,description:t.description??r?.description})}function C(e){let{item:t}=e;switch(t.type){case"link":return(0,g.jsx)(y,{item:t});case"category":return(0,g.jsx)(w,{item:t});default:throw new Error(`unknown item type ${JSON.stringify(t)}`)}}function N(e){let{className:t}=e;const n=(0,o.$S)();return(0,g.jsx)(b,{items:n.items,className:t})}function b(e){const{items:t,className:n}=e;if(!t)return(0,g.jsx)(N,{...e});const r=(0,o.d1)(t);return(0,g.jsx)("section",{className:(0,s.A)("row",n),children:r.map(((e,t)=>(0,g.jsx)("article",{className:"col col--6 margin-bottom--lg",children:(0,g.jsx)(C,{item:e})},t)))})}},28453:(e,t,n)=>{n.d(t,{R:()=>i,x:()=>c});var r=n(96540);const s={},o=r.createContext(s);function i(e){const t=r.useContext(o);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:i(e.components),r.createElement(o.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/04102e85.9c299feb.js b/pr-preview/pr-1071/assets/js/04102e85.9c299feb.js
deleted file mode 100644
index b29dd70f50..0000000000
--- a/pr-preview/pr-1071/assets/js/04102e85.9c299feb.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[1158],{30612:(t,e,r)=>{r.r(e),r.d(e,{assets:()=>i,contentTitle:()=>c,default:()=>p,frontMatter:()=>s,metadata:()=>n,toc:()=>d});const n=JSON.parse('{"id":"architecture/attestation/hardware","title":"hardware","description":"","source":"@site/versioned_docs/version-0.5/architecture/attestation/hardware.md","sourceDirName":"architecture/attestation","slug":"/architecture/attestation/hardware","permalink":"/contrast/pr-preview/pr-1071/0.5/architecture/attestation/hardware","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.5/architecture/attestation/hardware.md","tags":[],"version":"0.5","frontMatter":{},"sidebar":"docs","previous":{"title":"Attestation","permalink":"/contrast/pr-preview/pr-1071/0.5/category/attestation"},"next":{"title":"Pod VM","permalink":"/contrast/pr-preview/pr-1071/0.5/architecture/attestation/pod-vm"}}');var a=r(74848),o=r(28453);const s={},c=void 0,i={},d=[];function u(t){return(0,a.jsx)(a.Fragment,{})}function p(t={}){const{wrapper:e}={...(0,o.R)(),...t.components};return e?(0,a.jsx)(e,{...t,children:(0,a.jsx)(u,{...t})}):u()}},28453:(t,e,r)=>{r.d(e,{R:()=>s,x:()=>c});var n=r(96540);const a={},o=n.createContext(a);function s(t){const e=n.useContext(o);return n.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function c(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(a):t.components||a:s(t.components),n.createElement(o.Provider,{value:e},t.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/046575a6.0f7f0430.js b/pr-preview/pr-1071/assets/js/046575a6.0f7f0430.js
deleted file mode 100644
index 11851f0b08..0000000000
--- a/pr-preview/pr-1071/assets/js/046575a6.0f7f0430.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[2285],{30182:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>i,metadata:()=>s,toc:()=>d});const s=JSON.parse('{"id":"about/telemetry","title":"CLI telemetry","description":"The Contrast CLI sends telemetry data to Edgeless Systems when you use CLI commands.","source":"@site/versioned_docs/version-1.2/about/telemetry.md","sourceDirName":"about","slug":"/about/telemetry","permalink":"/contrast/pr-preview/pr-1071/about/telemetry","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-1.2/about/telemetry.md","tags":[],"version":"1.2","frontMatter":{},"sidebar":"docs","previous":{"title":"Planned features and limitations","permalink":"/contrast/pr-preview/pr-1071/features-limitations"}}');var r=n(74848),o=n(28453);const i={},a="CLI telemetry",c={},d=[];function l(e){const t={a:"a",code:"code",em:"em",h1:"h1",header:"header",li:"li",p:"p",ul:"ul",...(0,o.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.header,{children:(0,r.jsx)(t.h1,{id:"cli-telemetry",children:"CLI telemetry"})}),"\n",(0,r.jsx)(t.p,{children:"The Contrast CLI sends telemetry data to Edgeless Systems when you use CLI commands.\nThis allows to understand how Contrast is used and to improve it."}),"\n",(0,r.jsx)(t.p,{children:"The CLI sends the following data:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"The CLI version"}),"\n",(0,r.jsx)(t.li,{children:"The CLI target OS and architecture (GOOS and GOARCH)"}),"\n",(0,r.jsx)(t.li,{children:"The command that was run"}),"\n",(0,r.jsx)(t.li,{children:"The kind of error that occurred (if any)"}),"\n"]}),"\n",(0,r.jsxs)(t.p,{children:["The CLI ",(0,r.jsx)(t.em,{children:"doesn't"})," collect sensitive information.\nThe implementation is open-source and can be reviewed."]}),"\n",(0,r.jsx)(t.p,{children:"IP addresses may be processed or stored for security purposes."}),"\n",(0,r.jsxs)(t.p,{children:["The data that the CLI collects adheres to the Edgeless Systems ",(0,r.jsx)(t.a,{href:"https://www.edgeless.systems/privacy",children:"privacy policy"}),"."]}),"\n",(0,r.jsxs)(t.p,{children:["You can disable telemetry by setting the environment variable ",(0,r.jsx)(t.code,{children:"DO_NOT_TRACK=1"})," before running the CLI."]})]})}function h(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(l,{...e})}):l(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>i,x:()=>a});var s=n(96540);const r={},o=s.createContext(r);function i(e){const t=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:i(e.components),s.createElement(o.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/06354bbe.69f65616.js b/pr-preview/pr-1071/assets/js/06354bbe.69f65616.js
deleted file mode 100644
index b774508a23..0000000000
--- a/pr-preview/pr-1071/assets/js/06354bbe.69f65616.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[8204],{18733:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>s,metadata:()=>i,toc:()=>l});const i=JSON.parse('{"id":"components/overview","title":"Components","description":"Contrast is composed of several key components that work together to manage and scale confidential containers effectively within Kubernetes environments.","source":"@site/versioned_docs/version-0.9/components/overview.md","sourceDirName":"components","slug":"/components/overview","permalink":"/contrast/pr-preview/pr-1071/0.9/components/overview","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.9/components/overview.md","tags":[],"version":"0.9","frontMatter":{},"sidebar":"docs","previous":{"title":"Troubleshooting","permalink":"/contrast/pr-preview/pr-1071/0.9/troubleshooting"},"next":{"title":"Runtime","permalink":"/contrast/pr-preview/pr-1071/0.9/components/runtime"}}');var o=n(74848),r=n(28453);const s={},a="Components",c={},l=[{value:"The CLI (Command Line Interface)",id:"the-cli-command-line-interface",level:2},{value:"The Coordinator",id:"the-coordinator",level:2},{value:"The Manifest",id:"the-manifest",level:2},{value:"Runtime policies",id:"runtime-policies",level:2},{value:"The Initializer",id:"the-initializer",level:2},{value:"The Contrast runtime",id:"the-contrast-runtime",level:2}];function d(e){const t={a:"a",code:"code",em:"em",h1:"h1",h2:"h2",header:"header",img:"img",li:"li",p:"p",ul:"ul",...(0,r.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.header,{children:(0,o.jsx)(t.h1,{id:"components",children:"Components"})}),"\n",(0,o.jsx)(t.p,{children:"Contrast is composed of several key components that work together to manage and scale confidential containers effectively within Kubernetes environments.\nThis page provides an overview of the core components essential for deploying and managing Contrast."}),"\n",(0,o.jsx)(t.p,{children:(0,o.jsx)(t.img,{alt:"components overview",src:n(77998).A+"",width:"3387",height:"1866"})}),"\n",(0,o.jsx)(t.h2,{id:"the-cli-command-line-interface",children:"The CLI (Command Line Interface)"}),"\n",(0,o.jsx)(t.p,{children:"The CLI serves as the primary management tool for Contrast deployments. It's designed to streamline the configuration and operation of Contrast in several ways:"}),"\n",(0,o.jsxs)(t.ul,{children:["\n",(0,o.jsx)(t.li,{children:"Installation and setup: The CLI facilitates the installation of the necessary runtime classes required for Contrast to function within a Kubernetes cluster."}),"\n",(0,o.jsx)(t.li,{children:"Policy generation: It allows users to generate runtime policies, adapt the deployment files, and generate the Contrast manifest."}),"\n",(0,o.jsx)(t.li,{children:"Configuration management: Through the CLI, users can configure the Contrast Coordinator with the generated manifest."}),"\n",(0,o.jsx)(t.li,{children:"Verification and attestation: The CLI provides tools to verify the integrity and authenticity of the Coordinator and the entire deployment via remote attestation."}),"\n"]}),"\n",(0,o.jsx)(t.h2,{id:"the-coordinator",children:"The Coordinator"}),"\n",(0,o.jsxs)(t.p,{children:["The Contrast Coordinator is the central remote attestation service of a Contrast deployment.\nIt runs inside a confidential container inside your cluster.\nThe Coordinator can be verified via remote attestation, and a Contrast deployment is self-contained.\nThe Coordinator is configured with a ",(0,o.jsx)(t.em,{children:"manifest"}),", a configuration file containing the reference attestation values of your deployment.\nIt ensures that your deployment's topology adheres to your specified manifest by verifying the identity and integrity of all confidential pods inside the deployment.\nThe Coordinator is also a certificate authority and issues certificates for your workload pods during the attestation procedure.\nYour workload pods can establish secure, encrypted communication channels between themselves based on these certificates using the Coordinator as the root CA.\nAs your app needs to scale, the Coordinator transparently verifies new instances and then provides them with their certificates to join the deployment."]}),"\n",(0,o.jsx)(t.p,{children:"To verify your deployment, the Coordinator's remote attestation statement combined with the manifest offers a concise single remote attestation statement for your entire deployment.\nA third party can use this to verify the integrity of your distributed app, making it easy to assure stakeholders of your app's identity and integrity."}),"\n",(0,o.jsx)(t.h2,{id:"the-manifest",children:"The Manifest"}),"\n",(0,o.jsx)(t.p,{children:"The manifest is the configuration file for the Coordinator, defining your confidential deployment.\nIt's automatically generated from your deployment by the Contrast CLI.\nIt currently consists of the following parts:"}),"\n",(0,o.jsxs)(t.ul,{children:["\n",(0,o.jsxs)(t.li,{children:[(0,o.jsx)(t.em,{children:"Policies"}),": The identities of your Pods, represented by the hashes of their respective runtime policies."]}),"\n",(0,o.jsxs)(t.li,{children:[(0,o.jsx)(t.em,{children:"Reference Values"}),": The remote attestation reference values for the Kata confidential micro-VM that's the runtime environment of your Pods."]}),"\n",(0,o.jsxs)(t.li,{children:[(0,o.jsx)(t.em,{children:"WorkloadOwnerKeyDigest"}),": The workload owner's public key digest. Used for authenticating subsequent manifest updates."]}),"\n"]}),"\n",(0,o.jsx)(t.h2,{id:"runtime-policies",children:"Runtime policies"}),"\n",(0,o.jsx)(t.p,{children:"Runtime Policies are a mechanism to enable the use of the untrusted Kubernetes API for orchestration while ensuring the confidentiality and integrity of your confidential containers.\nThey allow us to enforce the integrity of your containers' runtime environment as defined in your deployment files.\nThe runtime policy mechanism is based on the Open Policy Agent (OPA) and translates the Kubernetes deployment YAML into the Rego policy language of OPA.\nThe Kata Agent inside the confidential micro-VM then enforces the policy by only acting on permitted requests.\nThe Contrast CLI provides the tooling for automatically translating Kubernetes deployment YAML into the Rego policy language of OPA."}),"\n",(0,o.jsx)(t.h2,{id:"the-initializer",children:"The Initializer"}),"\n",(0,o.jsxs)(t.p,{children:["Contrast provides an Initializer that handles the remote attestation on the workload side transparently and\nfetches the workload certificate. The Initializer runs as an init container before your workload is started.\nIt provides the workload container and the ",(0,o.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.9/components/service-mesh",children:"service mesh sidecar"})," with the workload certificates."]}),"\n",(0,o.jsx)(t.h2,{id:"the-contrast-runtime",children:"The Contrast runtime"}),"\n",(0,o.jsxs)(t.p,{children:["Contrast depends on a Kubernetes ",(0,o.jsx)(t.a,{href:"https://kubernetes.io/docs/concepts/containers/runtime-class/",children:"runtime class"}),", which is installed\nby the ",(0,o.jsx)(t.code,{children:"node-installer"})," DaemonSet.\nThis runtime consists of a containerd runtime plugin, a virtual machine manager (cloud-hypervisor), and a podvm image (IGVM and rootFS).\nThe installer takes care of provisioning every node in the cluster so it provides this runtime class."]})]})}function h(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},77998:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/components-ea3fb9800d5718d6ab96607ee817c104.svg"},28453:(e,t,n)=>{n.d(t,{R:()=>s,x:()=>a});var i=n(96540);const o={},r=i.createContext(o);function s(e){const t=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:s(e.components),i.createElement(r.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/06eada7a.2bde985a.js b/pr-preview/pr-1071/assets/js/06eada7a.2bde985a.js
deleted file mode 100644
index dfb43d25ae..0000000000
--- a/pr-preview/pr-1071/assets/js/06eada7a.2bde985a.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[6470],{28601:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>r,metadata:()=>i,toc:()=>l});const i=JSON.parse('{"id":"components/policies","title":"Policies","description":"Kata runtime policies are an integral part of the Confidential Containers preview on AKS.","source":"@site/versioned_docs/version-0.7/components/policies.md","sourceDirName":"components","slug":"/components/policies","permalink":"/contrast/pr-preview/pr-1071/0.7/components/policies","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.7/components/policies.md","tags":[],"version":"0.7","frontMatter":{},"sidebar":"docs","previous":{"title":"Runtime","permalink":"/contrast/pr-preview/pr-1071/0.7/components/runtime"},"next":{"title":"Service mesh","permalink":"/contrast/pr-preview/pr-1071/0.7/components/service-mesh"}}');var s=n(74848),o=n(28453);const r={},a="Policies",c={},l=[{value:"Structure",id:"structure",level:2},{value:"Generation",id:"generation",level:2},{value:"Evaluation",id:"evaluation",level:2},{value:"Guarantees",id:"guarantees",level:2},{value:"Trust",id:"trust",level:2}];function d(e){const t={a:"a",code:"code",em:"em",h1:"h1",h2:"h2",header:"header",li:"li",ol:"ol",p:"p",ul:"ul",...(0,o.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.header,{children:(0,s.jsx)(t.h1,{id:"policies",children:"Policies"})}),"\n",(0,s.jsx)(t.p,{children:"Kata runtime policies are an integral part of the Confidential Containers preview on AKS.\nThey prescribe how a Kubernetes pod must be configured to launch successfully in a confidential VM.\nIn Contrast, policies act as a workload identifier: only pods with a policy registered in the manifest receive workload certificates and may participate in the confidential deployment.\nVerification of the Contrast Coordinator and its manifest transitively guarantees that all workloads meet the owner's expectations."}),"\n",(0,s.jsx)(t.h2,{id:"structure",children:"Structure"}),"\n",(0,s.jsxs)(t.p,{children:["The Kata agent running in the confidential micro-VM exposes an RPC service ",(0,s.jsx)(t.a,{href:"https://github.com/kata-containers/kata-containers/blob/e5e0983/src/libs/protocols/protos/agent.proto#L21-L76",children:(0,s.jsx)(t.code,{children:"AgentService"})})," to the Kata runtime.\nThis service handles potentially untrustworthy requests from outside the TCB, which need to be checked against a policy."]}),"\n",(0,s.jsxs)(t.p,{children:["Kata runtime policies are written in the policy language ",(0,s.jsx)(t.a,{href:"https://www.openpolicyagent.org/docs/latest/policy-language/",children:"Rego"}),".\nThey specify what ",(0,s.jsx)(t.code,{children:"AgentService"})," methods can be called, and the permissible parameters for each call."]}),"\n",(0,s.jsxs)(t.p,{children:["Policies consist of two parts: a list of rules and a data section.\nWhile the list of rules is static, the data section is populated with information from the ",(0,s.jsx)(t.code,{children:"PodSpec"})," and other sources."]}),"\n",(0,s.jsx)(t.h2,{id:"generation",children:"Generation"}),"\n",(0,s.jsxs)(t.p,{children:["Runtime policies are programmatically generated from Kubernetes manifests by the Contrast CLI.\nThe ",(0,s.jsx)(t.code,{children:"generate"})," subcommand inspects pod definitions and derives rules for validating the pod at the Kata agent.\nThere are two important integrity checks: container image checksums and OCI runtime parameters."]}),"\n",(0,s.jsxs)(t.p,{children:["For each of the container images used in a pod, the CLI downloads all image layers and produces a cryptographic ",(0,s.jsx)(t.a,{href:"https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/verity.html",children:"dm-verity"})," checksum.\nThese checksums are the basis for the policy's ",(0,s.jsx)(t.em,{children:"storage data"}),"."]}),"\n",(0,s.jsxs)(t.p,{children:["The CLI combines information from the ",(0,s.jsx)(t.code,{children:"PodSpec"}),", ",(0,s.jsx)(t.code,{children:"ConfigMaps"}),", and ",(0,s.jsx)(t.code,{children:"Secrets"})," in the provided Kubernetes manifests to derive a permissible set of command-line arguments and environment variables.\nThese constitute the policy's ",(0,s.jsx)(t.em,{children:"OCI data"}),"."]}),"\n",(0,s.jsx)(t.h2,{id:"evaluation",children:"Evaluation"}),"\n",(0,s.jsxs)(t.p,{children:["The generated policy document is annotated to the pod definitions in Base64 encoding.\nThis annotation is propagated to the Kata runtime, which calculates the SHA256 checksum for the policy and uses that as SNP ",(0,s.jsx)(t.code,{children:"HOSTDATA"})," for the confidential micro-VM."]}),"\n",(0,s.jsxs)(t.p,{children:["After the VM launched, the runtime calls the agent's ",(0,s.jsx)(t.code,{children:"SetPolicy"})," method with the full policy document.\nIf the policy doesn't match the checksum in ",(0,s.jsx)(t.code,{children:"HOSTDATA"}),", the agent rejects the policy.\nOtherwise, it applies the policy to all future ",(0,s.jsx)(t.code,{children:"AgentService"})," requests."]}),"\n",(0,s.jsx)(t.h2,{id:"guarantees",children:"Guarantees"}),"\n",(0,s.jsx)(t.p,{children:"The policy evaluation provides the following guarantees for pods launched with the correct generated policy:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"Command and its arguments are set as specified in the resources."}),"\n",(0,s.jsx)(t.li,{children:"There are no unexpected additional environment variables."}),"\n",(0,s.jsx)(t.li,{children:"The container image layers correspond to the layers observed at policy generation time.\nThus, only the expected workload image can be instantiated."}),"\n",(0,s.jsx)(t.li,{children:"Executing additional processes in a container is prohibited."}),"\n",(0,s.jsx)(t.li,{children:"Sending data to a container's standard input is prohibited."}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:"The current implementation of policy checking has some blind spots:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"Containers can be started in any order, or be omitted entirely."}),"\n",(0,s.jsx)(t.li,{children:"Environment variables may be missing."}),"\n",(0,s.jsxs)(t.li,{children:["Volumes other than the container root volume don't have integrity checks (particularly relevant for mounted ",(0,s.jsx)(t.code,{children:"ConfigMaps"})," and ",(0,s.jsx)(t.code,{children:"Secrets"}),")."]}),"\n"]}),"\n",(0,s.jsx)(t.h2,{id:"trust",children:"Trust"}),"\n",(0,s.jsx)(t.p,{children:"Contrast verifies its confidential containers following these steps:"}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsx)(t.li,{children:"The Contrast CLI generates a policy and attaches it to the pod definition."}),"\n",(0,s.jsx)(t.li,{children:"Kubernetes schedules the pod on a node with the confidential computing runtime."}),"\n",(0,s.jsx)(t.li,{children:"Containerd invokes the Kata runtime to create the pod sandbox."}),"\n",(0,s.jsxs)(t.li,{children:["The Kata runtime starts a CVM with the policy's digest as ",(0,s.jsx)(t.code,{children:"HOSTDATA"}),"."]}),"\n",(0,s.jsxs)(t.li,{children:["The Kata runtime sets the policy using the ",(0,s.jsx)(t.code,{children:"SetPolicy"})," method."]}),"\n",(0,s.jsxs)(t.li,{children:["The Kata agent verifies that the incoming policy's digest matches ",(0,s.jsx)(t.code,{children:"HOSTDATA"}),"."]}),"\n",(0,s.jsx)(t.li,{children:"The CLI sets a manifest in the Contrast Coordinator, including a list of permitted policies."}),"\n",(0,s.jsx)(t.li,{children:"The Contrast Initializer sends an attestation report to the Contrast Coordinator, asking for a mesh certificate."}),"\n",(0,s.jsxs)(t.li,{children:["The Contrast Coordinator verifies that the started pod has a permitted policy hash in its ",(0,s.jsx)(t.code,{children:"HOSTDATA"})," field."]}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:"After the last step, we know that the policy hasn't been tampered with and, thus, that the workload matches expectations and may receive mesh certificates."})]})}function h(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>r,x:()=>a});var i=n(96540);const s={},o=i.createContext(s);function r(e){const t=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),i.createElement(o.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/078f57bf.102e2128.js b/pr-preview/pr-1071/assets/js/078f57bf.102e2128.js
deleted file mode 100644
index 88af743c20..0000000000
--- a/pr-preview/pr-1071/assets/js/078f57bf.102e2128.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[1690],{30569:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>a,contentTitle:()=>c,default:()=>l,frontMatter:()=>o,metadata:()=>n,toc:()=>d});const n=JSON.parse('{"id":"architecture/observability","title":"Observability","description":"The Contrast Coordinator can expose metrics in the","source":"@site/versioned_docs/version-0.9/architecture/observability.md","sourceDirName":"architecture","slug":"/architecture/observability","permalink":"/contrast/pr-preview/pr-1071/0.9/architecture/observability","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.9/architecture/observability.md","tags":[],"version":"0.9","frontMatter":{},"sidebar":"docs","previous":{"title":"Certificate authority","permalink":"/contrast/pr-preview/pr-1071/0.9/architecture/certificates"},"next":{"title":"Planned features and limitations","permalink":"/contrast/pr-preview/pr-1071/0.9/features-limitations"}}');var s=r(74848),i=r(28453);const o={},c="Observability",a={},d=[{value:"Exposed metrics",id:"exposed-metrics",level:2},{value:"Service mesh metrics",id:"service-mesh-metrics",level:2}];function h(e){const t={a:"a",br:"br",code:"code",h1:"h1",h2:"h2",header:"header",p:"p",...(0,i.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.header,{children:(0,s.jsx)(t.h1,{id:"observability",children:"Observability"})}),"\n",(0,s.jsxs)(t.p,{children:["The Contrast Coordinator can expose metrics in the\n",(0,s.jsx)(t.a,{href:"https://prometheus.io/",children:"Prometheus"})," format. These can be monitored to quickly\nidentify problems in the gRPC layer or attestation errors. Prometheus metrics\nare numerical values associated with a name and additional key/values pairs,\ncalled labels."]}),"\n",(0,s.jsx)(t.h2,{id:"exposed-metrics",children:"Exposed metrics"}),"\n",(0,s.jsxs)(t.p,{children:["The metrics can be accessed at the Coordinator pod at the port specified in the\n",(0,s.jsx)(t.code,{children:"CONTRAST_METRICS_PORT"})," environment variable under the ",(0,s.jsx)(t.code,{children:"/metrics"})," endpoint. By\ndefault, this environment variable isn't specified, hence no metrics will be\nexposed."]}),"\n",(0,s.jsxs)(t.p,{children:["The Coordinator exports gRPC metrics under the prefix ",(0,s.jsx)(t.code,{children:"contrast_grpc_server_"}),".\nThese metrics are labeled with the gRPC service name and method name.\nMetrics of interest include ",(0,s.jsx)(t.code,{children:"contrast_grpc_server_handled_total"}),", which counts\nthe number of requests by return code, and\n",(0,s.jsx)(t.code,{children:"contrast_grpc_server_handling_seconds_bucket"}),", which produces a histogram of",(0,s.jsx)(t.br,{}),"\n","request latency."]}),"\n",(0,s.jsxs)(t.p,{children:["The gRPC service ",(0,s.jsx)(t.code,{children:"userapi.UserAPI"})," records metrics for the methods\n",(0,s.jsx)(t.code,{children:"SetManifest"})," and ",(0,s.jsx)(t.code,{children:"GetManifest"}),", which get called when ",(0,s.jsx)(t.a,{href:"../deployment#set-the-manifest",children:"setting the\nmanifest"})," and ",(0,s.jsx)(t.a,{href:"../deployment#verify-the-coordinator",children:"verifying the\nCoordinator"})," respectively."]}),"\n",(0,s.jsxs)(t.p,{children:["The ",(0,s.jsx)(t.code,{children:"meshapi.MeshAPI"})," service records metrics for the method ",(0,s.jsx)(t.code,{children:"NewMeshCert"}),", which\ngets called by the ",(0,s.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.9/components/overview#the-initializer",children:"Initializer"})," when starting a\nnew workload. Attestation failures from workloads to the Coordinator can be\ntracked with the counter ",(0,s.jsx)(t.code,{children:"contrast_meshapi_attestation_failures_total"}),"."]}),"\n",(0,s.jsxs)(t.p,{children:["The current manifest generation is exposed as a\n",(0,s.jsx)(t.a,{href:"https://prometheus.io/docs/concepts/metric_types/#gauge",children:"gauge"})," with the metric\nname ",(0,s.jsx)(t.code,{children:"contrast_coordinator_manifest_generation"}),". If no manifest is set at the\nCoordinator, this counter will be zero."]}),"\n",(0,s.jsx)(t.h2,{id:"service-mesh-metrics",children:"Service mesh metrics"}),"\n",(0,s.jsxs)(t.p,{children:["The ",(0,s.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.9/components/service-mesh",children:"Service Mesh"})," can be configured to expose\nmetrics via its ",(0,s.jsx)(t.a,{href:"https://www.envoyproxy.io/docs/envoy/latest/operations/admin",children:"Envoy admin\ninterface"}),". Be\naware that the admin interface can expose private information and allows\ndestructive operations to be performed. To enable the admin interface for the\nService Mesh, set the annotation\n",(0,s.jsx)(t.code,{children:"contrast.edgeless.systems/servicemesh-admin-interface-port"})," in the configuration\nof your workload. If this annotation is set, the admin interface will be started\non this port."]}),"\n",(0,s.jsxs)(t.p,{children:["To access the admin interface, the ingress settings of the Service Mesh have to\nbe configured to allow access to the specified port (see ",(0,s.jsx)(t.a,{href:"../components/service-mesh#configuring-the-proxy",children:"Configuring the\nProxy"}),"). All metrics will be\nexposed under the ",(0,s.jsx)(t.code,{children:"/stats"})," endpoint. Metrics in Prometheus format can be scraped\nfrom the ",(0,s.jsx)(t.code,{children:"/stats/prometheus"})," endpoint."]})]})}function l(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(h,{...e})}):h(e)}},28453:(e,t,r)=>{r.d(t,{R:()=>o,x:()=>c});var n=r(96540);const s={},i=n.createContext(s);function o(e){const t=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),n.createElement(i.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/098bf236.7fb3130f.js b/pr-preview/pr-1071/assets/js/098bf236.7fb3130f.js
deleted file mode 100644
index 1b754a8d4d..0000000000
--- a/pr-preview/pr-1071/assets/js/098bf236.7fb3130f.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[8259],{32284:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>s,toc:()=>d});const s=JSON.parse('{"id":"intro","title":"Contrast","description":"Welcome to the documentation of Contrast! Contrast runs confidential container deployments on Kubernetes at scale.","source":"@site/versioned_docs/version-0.8/intro.md","sourceDirName":".","slug":"/","permalink":"/contrast/pr-preview/pr-1071/0.8/","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.8/intro.md","tags":[],"version":"0.8","frontMatter":{"slug":"/","id":"intro"},"sidebar":"docs","next":{"title":"Confidential Containers","permalink":"/contrast/pr-preview/pr-1071/0.8/basics/confidential-containers"}}');var r=n(74848),i=n(28453);const o={slug:"/",id:"intro"},a="Contrast",c={},d=[{value:"Goal",id:"goal",level:2},{value:"Use Cases",id:"use-cases",level:2},{value:"Next steps",id:"next-steps",level:2}];function l(e){const t={a:"a",admonition:"admonition",em:"em",h1:"h1",h2:"h2",header:"header",img:"img",li:"li",p:"p",ul:"ul",...(0,i.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.header,{children:(0,r.jsx)(t.h1,{id:"contrast",children:"Contrast"})}),"\n",(0,r.jsx)(t.p,{children:"Welcome to the documentation of Contrast! Contrast runs confidential container deployments on Kubernetes at scale."}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Contrast concept",src:n(96274).A+"",width:"1644",height:"764"})}),"\n",(0,r.jsxs)(t.p,{children:["Contrast is based on the ",(0,r.jsx)(t.a,{href:"https://github.com/kata-containers/kata-containers",children:"Kata Containers"})," and\n",(0,r.jsx)(t.a,{href:"https://github.com/confidential-containers",children:"Confidential Containers"})," projects.\nConfidential Containers are Kubernetes pods that are executed inside a confidential micro-VM and provide strong hardware-based isolation from the surrounding environment.\nThis works with unmodified containers in a lift-and-shift approach.\nContrast currently targets the ",(0,r.jsx)(t.a,{href:"https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers-on-aks-preview",children:"CoCo preview on AKS"}),"."]}),"\n",(0,r.jsx)(t.admonition,{type:"tip",children:(0,r.jsxs)(t.p,{children:["See the \ud83d\udcc4",(0,r.jsx)(t.a,{href:"https://content.edgeless.systems/hubfs/Confidential%20Computing%20Whitepaper.pdf",children:"whitepaper"})," for more information on confidential computing."]})}),"\n",(0,r.jsx)(t.h2,{id:"goal",children:"Goal"}),"\n",(0,r.jsx)(t.p,{children:"Contrast is designed to keep all data always encrypted and to prevent access from the infrastructure layer. It removes the infrastructure provider from the trusted computing base (TCB). This includes access from datacenter employees, privileged cloud admins, own cluster administrators, and attackers coming through the infrastructure, for example, malicious co-tenants escalating their privileges."}),"\n",(0,r.jsx)(t.p,{children:"Contrast integrates fluently with the existing Kubernetes workflows. It's compatible with managed Kubernetes, can be installed as a day-2 operation and imposes only minimal changes to your deployment flow."}),"\n",(0,r.jsx)(t.h2,{id:"use-cases",children:"Use Cases"}),"\n",(0,r.jsxs)(t.p,{children:["Contrast provides unique security ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/basics/features",children:"features"})," and ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/basics/security-benefits",children:"benefits"}),". The core use cases are:"]}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"Increasing the security of your containers"}),"\n",(0,r.jsx)(t.li,{children:"Moving sensitive workloads from on-prem to the cloud with Confidential Computing"}),"\n",(0,r.jsx)(t.li,{children:"Shielding the code and data even from the own cluster administrators"}),"\n",(0,r.jsx)(t.li,{children:"Increasing the trustworthiness of your SaaS offerings"}),"\n",(0,r.jsx)(t.li,{children:"Simplifying regulatory compliance"}),"\n",(0,r.jsx)(t.li,{children:"Multi-party computation for data collaboration"}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"next-steps",children:"Next steps"}),"\n",(0,r.jsxs)(t.p,{children:["You can learn more about the concept of ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/basics/confidential-containers",children:"Confidential Containers"}),", ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/basics/features",children:"features"}),", and ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/basics/security-benefits",children:"security benefits"})," of Contrast in this section. To jump right into the action head to ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/getting-started/install",children:(0,r.jsx)(t.em,{children:"Getting started"})}),"."]})]})}function h(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(l,{...e})}):l(e)}},96274:(e,t,n)=>{n.d(t,{A:()=>s});const s=n.p+"assets/images/concept-c1792eb1b8f3959308512d1e518b0176.svg"},28453:(e,t,n)=>{n.d(t,{R:()=>o,x:()=>a});var s=n(96540);const r={},i=s.createContext(r);function o(e){const t=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),s.createElement(i.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/0a09f1f2.8c4c401c.js b/pr-preview/pr-1071/assets/js/0a09f1f2.8c4c401c.js
deleted file mode 100644
index 5dfc340e76..0000000000
--- a/pr-preview/pr-1071/assets/js/0a09f1f2.8c4c401c.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[7e3],{35787:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>i,metadata:()=>s,toc:()=>c});const s=JSON.parse('{"id":"deployment","title":"Workload deployment","description":"The following instructions will guide you through the process of making an existing Kubernetes deployment","source":"@site/versioned_docs/version-1.1/deployment.md","sourceDirName":".","slug":"/deployment","permalink":"/contrast/pr-preview/pr-1071/1.1/deployment","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-1.1/deployment.md","tags":[],"version":"1.1","frontMatter":{},"sidebar":"docs","previous":{"title":"Confidential emoji voting","permalink":"/contrast/pr-preview/pr-1071/1.1/examples/emojivoto"},"next":{"title":"Troubleshooting","permalink":"/contrast/pr-preview/pr-1071/1.1/troubleshooting"}}');var r=t(74848),a=t(28453);const i={},o="Workload deployment",l={},c=[{value:"Deploy the Contrast runtime",id:"deploy-the-contrast-runtime",level:2},{value:"Deploy the Contrast Coordinator",id:"deploy-the-contrast-coordinator",level:2},{value:"Prepare your Kubernetes resources",id:"prepare-your-kubernetes-resources",level:2},{value:"Security review",id:"security-review",level:3},{value:"RuntimeClass",id:"runtimeclass",level:3},{value:"Handling TLS",id:"handling-tls",level:3},{value:"Generate policy annotations and manifest",id:"generate-policy-annotations-and-manifest",level:2},{value:"Apply the resources",id:"apply-the-resources",level:2},{value:"Connect to the Contrast Coordinator",id:"connect-to-the-contrast-coordinator",level:2},{value:"Set the manifest",id:"set-the-manifest",level:2},{value:"Verify the Coordinator",id:"verify-the-coordinator",level:2},{value:"Communicate with workloads",id:"communicate-with-workloads",level:2},{value:"Recover the Coordinator",id:"recover-the-coordinator",level:2}];function d(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",p:"p",pre:"pre",ul:"ul",...(0,a.R)(),...e.components},{TabItem:t,Tabs:s}=n;return t||u("TabItem",!0),s||u("Tabs",!0),(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.header,{children:(0,r.jsx)(n.h1,{id:"workload-deployment",children:"Workload deployment"})}),"\n",(0,r.jsx)(n.p,{children:"The following instructions will guide you through the process of making an existing Kubernetes deployment\nconfidential and deploying it together with Contrast."}),"\n",(0,r.jsxs)(s,{queryString:"platform",children:[(0,r.jsx)(t,{value:"aks-clh-snp",label:"AKS",default:!0,children:(0,r.jsxs)(n.p,{children:["A running CoCo-enabled cluster is required for these steps, see the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/1.1/getting-started/cluster-setup",children:"setup guide"})," on how to set up a cluster on AKS."]})}),(0,r.jsx)(t,{value:"k3s-qemu-snp",label:"Bare metal (SEV-SNP)",children:(0,r.jsxs)(n.p,{children:["A running CoCo-enabled cluster is required for these steps, see the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/1.1/getting-started/bare-metal",children:"setup guide"})," on how to set up a bare-metal cluster."]})}),(0,r.jsx)(t,{value:"k3s-qemu-tdx",label:"Bare metal (TDX)",children:(0,r.jsxs)(n.p,{children:["A running CoCo-enabled cluster is required for these steps, see the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/1.1/getting-started/bare-metal",children:"setup guide"})," on how to set up a bare-metal cluster."]})})]}),"\n",(0,r.jsx)(n.h2,{id:"deploy-the-contrast-runtime",children:"Deploy the Contrast runtime"}),"\n",(0,r.jsxs)(n.p,{children:["Contrast depends on a ",(0,r.jsxs)(n.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/runtime",children:["custom Kubernetes ",(0,r.jsx)(n.code,{children:"RuntimeClass"})," (",(0,r.jsx)(n.code,{children:"contrast-cc"}),")"]}),",\nwhich needs to be installed in the cluster prior to the Coordinator or any confidential workloads.\nThis consists of a ",(0,r.jsx)(n.code,{children:"RuntimeClass"})," resource and a ",(0,r.jsx)(n.code,{children:"DaemonSet"})," that performs installation on worker nodes.\nThis step is only required once for each version of the runtime.\nIt can be shared between Contrast deployments."]}),"\n",(0,r.jsxs)(s,{queryString:"platform",children:[(0,r.jsx)(t,{value:"aks-clh-snp",label:"AKS",default:!0,children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.1.1/runtime-aks-clh-snp.yml\n"})})}),(0,r.jsx)(t,{value:"k3s-qemu-snp",label:"Bare metal (SEV-SNP)",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.1.1/runtime-k3s-qemu-snp.yml\n"})})}),(0,r.jsx)(t,{value:"k3s-qemu-tdx",label:"Bare metal (TDX)",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.1.1/runtime-k3s-qemu-tdx.yml\n"})})})]}),"\n",(0,r.jsx)(n.h2,{id:"deploy-the-contrast-coordinator",children:"Deploy the Contrast Coordinator"}),"\n",(0,r.jsx)(n.p,{children:"Install the latest Contrast Coordinator release, comprising a single replica deployment and a\nLoadBalancer service, into your cluster."}),"\n",(0,r.jsxs)(s,{queryString:"platform",children:[(0,r.jsx)(t,{value:"aks-clh-snp",label:"AKS",default:!0,children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.1.1/coordinator-aks-clh-snp.yml\n"})})}),(0,r.jsx)(t,{value:"k3s-qemu-snp",label:"Bare metal (SEV-SNP)",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.1.1/coordinator-k3s-qemu-snp.yml\n"})})}),(0,r.jsx)(t,{value:"k3s-qemu-tdx",label:"Bare metal (TDX)",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.1.1/coordinator-k3s-qemu-tdx.yml\n"})})})]}),"\n",(0,r.jsx)(n.h2,{id:"prepare-your-kubernetes-resources",children:"Prepare your Kubernetes resources"}),"\n",(0,r.jsx)(n.p,{children:"Your Kubernetes resources need some modifications to run as Confidential Containers.\nThis section guides you through the process and outlines the necessary changes."}),"\n",(0,r.jsx)(n.h3,{id:"security-review",children:"Security review"}),"\n",(0,r.jsxs)(n.p,{children:["Contrast ensures integrity and confidentiality of the applications, but interactions with untrusted systems require the developers' attention.\nReview the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/1.1/architecture/security-considerations",children:"security considerations"})," and the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/1.1/architecture/certificates",children:"certificates"})," section for writing secure Contrast application."]}),"\n",(0,r.jsx)(n.h3,{id:"runtimeclass",children:"RuntimeClass"}),"\n",(0,r.jsx)(n.p,{children:"Contrast will add annotations to your Kubernetes YAML files. If you want to keep the original files\nunchanged, you can copy the files into a separate local directory.\nYou can also generate files from a Helm chart or from a Kustomization."}),"\n",(0,r.jsxs)(s,{groupId:"yaml-source",children:[(0,r.jsx)(t,{value:"kustomize",label:"kustomize",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"mkdir resources\nkustomize build $MY_RESOURCE_DIR > resources/all.yml\n"})})}),(0,r.jsx)(t,{value:"helm",label:"helm",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"mkdir resources\nhelm template $RELEASE_NAME $CHART_NAME > resources/all.yml\n"})})}),(0,r.jsx)(t,{value:"copy",label:"copy",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"cp -R $MY_RESOURCE_DIR resources/\n"})})})]}),"\n",(0,r.jsxs)(n.p,{children:["To specify that a workload (pod, deployment, etc.) should be deployed as confidential containers,\nadd ",(0,r.jsx)(n.code,{children:"runtimeClassName: contrast-cc"})," to the pod spec (pod definition or template).\nThis is a placeholder name that will be replaced by a versioned ",(0,r.jsx)(n.code,{children:"runtimeClassName"})," when generating policies."]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-yaml",children:"spec: # v1.PodSpec\n runtimeClassName: contrast-cc\n"})}),"\n",(0,r.jsx)(n.h3,{id:"handling-tls",children:"Handling TLS"}),"\n",(0,r.jsxs)(n.p,{children:["In the initialization process, the ",(0,r.jsx)(n.code,{children:"contrast-secrets"})," shared volume is populated with X.509 certificates for your workload.\nThese certificates are used by the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/service-mesh",children:"Contrast Service Mesh"}),", but can also be used by your application directly.\nThe following tab group explains the setup for both scenarios."]}),"\n",(0,r.jsxs)(s,{groupId:"tls",children:[(0,r.jsxs)(t,{value:"mesh",label:"Drop-in service mesh",children:[(0,r.jsx)(n.p,{children:"Contrast can be configured to handle TLS in a sidecar container.\nThis is useful for workloads that are hard to configure with custom certificates, like Java applications."}),(0,r.jsx)(n.p,{children:"Configuration of the sidecar depends heavily on the application.\nThe following example is for an application with these properties:"}),(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"The container has a main application at TCP port 8001, which should be TLS-wrapped and doesn't require client authentication."}),"\n",(0,r.jsx)(n.li,{children:"The container has a metrics endpoint at TCP port 8080, which should be accessible in plain text."}),"\n",(0,r.jsx)(n.li,{children:"All other endpoints require client authentication."}),"\n",(0,r.jsxs)(n.li,{children:["The app connects to a Kubernetes service ",(0,r.jsx)(n.code,{children:"backend.default:4001"}),", which requires client authentication."]}),"\n"]}),(0,r.jsx)(n.p,{children:"Add the following annotations to your workload:"}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-yaml",children:'metadata: # apps/v1.Deployment, apps/v1.DaemonSet, ...\n annotations:\n contrast.edgeless.systems/servicemesh-ingress: "main#8001#false##metrics#8080#true"\n contrast.edgeless.systems/servicemesh-egress: "backend#127.0.0.2:4001#backend.default:4001"\n'})}),(0,r.jsxs)(n.p,{children:["During the ",(0,r.jsx)(n.code,{children:"generate"})," step, this configuration will be translated into a Service Mesh sidecar container which handles TLS connections automatically.\nThe only change required to the app itself is to let it connect to ",(0,r.jsx)(n.code,{children:"127.0.0.2:4001"})," to reach the backend service.\nYou can find more detailed documentation in the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/service-mesh",children:"Service Mesh chapter"}),"."]})]}),(0,r.jsxs)(t,{value:"go",label:"Go integration",children:[(0,r.jsxs)(n.p,{children:["The mesh certificate contained in ",(0,r.jsx)(n.code,{children:"certChain.pem"})," authenticates this workload, while the mesh CA certificate ",(0,r.jsx)(n.code,{children:"mesh-ca.pem"})," authenticates its peers.\nYour app should turn on client authentication to ensure peers are running as confidential containers, too.\nSee the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/1.1/architecture/certificates",children:"Certificate Authority"})," section for detailed information about these certificates."]}),(0,r.jsx)(n.p,{children:"The following example shows how to configure a Golang app, with error handling omitted for clarity."}),(0,r.jsxs)(s,{groupId:"golang-tls-setup",children:[(0,r.jsx)(t,{value:"client",label:"Client",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-go",children:'caCerts := x509.NewCertPool()\ncaCert, _ := os.ReadFile("/contrast/tls-config/mesh-ca.pem")\ncaCerts.AppendCertsFromPEM(caCert)\ncert, _ := tls.LoadX509KeyPair("/contrast/tls-config/certChain.pem", "/contrast/tls-config/key.pem")\ncfg := &tls.Config{\n Certificates: []tls.Certificate{cert},\n RootCAs: caCerts,\n}\n'})})}),(0,r.jsx)(t,{value:"server",label:"Server",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-go",children:'caCerts := x509.NewCertPool()\ncaCert, _ := os.ReadFile("/contrast/tls-config/mesh-ca.pem")\ncaCerts.AppendCertsFromPEM(caCert)\ncert, _ := tls.LoadX509KeyPair("/contrast/tls-config/certChain.pem", "/contrast/tls-config/key.pem")\ncfg := &tls.Config{\n Certificates: []tls.Certificate{cert},\n ClientAuth: tls.RequireAndVerifyClientCert,\n ClientCAs: caCerts,\n}\n'})})})]})]})]}),"\n",(0,r.jsx)(n.h2,{id:"generate-policy-annotations-and-manifest",children:"Generate policy annotations and manifest"}),"\n",(0,r.jsxs)(n.p,{children:["Run the ",(0,r.jsx)(n.code,{children:"generate"})," command to add the necessary components to your deployment files.\nThis will add the Contrast Initializer to every workload with the specified ",(0,r.jsx)(n.code,{children:"contrast-cc"})," runtime class\nand the Contrast Service Mesh to all workloads that have a specified configuration.\nAfter that, it will generate the execution policies and add them as annotations to your deployment files.\nA ",(0,r.jsx)(n.code,{children:"manifest.json"})," with the reference values of your deployment will be created."]}),"\n",(0,r.jsxs)(s,{queryString:"platform",children:[(0,r.jsx)(t,{value:"aks-clh-snp",label:"AKS",default:!0,children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"contrast generate --reference-values aks-clh-snp resources/\n"})})}),(0,r.jsxs)(t,{value:"k3s-qemu-snp",label:"Bare metal (SEV-SNP)",children:[(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"contrast generate --reference-values k3s-qemu-snp resources/\n"})}),(0,r.jsx)(n.admonition,{title:"Missing TCB values",type:"note",children:(0,r.jsxs)(n.p,{children:["On bare-metal SEV-SNP, ",(0,r.jsx)(n.code,{children:"contrast generate"})," is unable to fill in the ",(0,r.jsx)(n.code,{children:"MinimumTCB"})," values as they can vary between platforms.\nThey will have to be filled in manually.\nIf you don't know the correct values use ",(0,r.jsx)(n.code,{children:'{"BootloaderVersion":255,"TEEVersion":255,"SNPVersion":255,"MicrocodeVersion":255}'})," and observe the real values in the error messages in the following steps. This should only be done in a secure environment. Note that the values will differ between CPU models."]})})]}),(0,r.jsxs)(t,{value:"k3s-qemu-tdx",label:"Bare metal (TDX)",children:[(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"contrast generate --reference-values k3s-qemu-tdx resources/\n"})}),(0,r.jsx)(n.admonition,{title:"Missing TCB values",type:"note",children:(0,r.jsxs)(n.p,{children:["On bare-metal TDX, ",(0,r.jsx)(n.code,{children:"contrast generate"})," is unable to fill in the ",(0,r.jsx)(n.code,{children:"MinimumTeeTcbSvn"})," and ",(0,r.jsx)(n.code,{children:"MrSeam"})," TCB values as they can vary between platforms.\nThey will have to be filled in manually.\nIf you don't know the correct values use ",(0,r.jsx)(n.code,{children:"ffffffffffffffffffffffffffffffff"})," and ",(0,r.jsx)(n.code,{children:"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"})," respectively and observe the real values in the error messages in the following steps. This should only be done in a secure environment."]})})]})]}),"\n",(0,r.jsx)(n.admonition,{type:"warning",children:(0,r.jsxs)(n.p,{children:["Please be aware that runtime policies currently have some blind spots. For example, they can't guarantee the starting order of containers. See the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/1.1/features-limitations#runtime-policies",children:"current limitations"})," for more details."]})}),"\n",(0,r.jsx)(n.p,{children:"If you don't want the Contrast Initializer to automatically be added to your\nworkloads, there are two ways you can skip the Initializer injection step,\ndepending on how you want to customize your deployment."}),"\n",(0,r.jsxs)(s,{groupId:"injection",children:[(0,r.jsxs)(t,{value:"flag",label:"Command-line flag",children:[(0,r.jsxs)(n.p,{children:["You can disable the Initializer injection completely by specifying the\n",(0,r.jsx)(n.code,{children:"--skip-initializer"})," flag in the ",(0,r.jsx)(n.code,{children:"generate"})," command."]}),(0,r.jsxs)(s,{queryString:"platform",children:[(0,r.jsx)(t,{value:"aks-clh-snp",label:"AKS",default:!0,children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"contrast generate --reference-values aks-clh-snp --skip-initializer resources/\n"})})}),(0,r.jsx)(t,{value:"k3s-qemu-snp",label:"Bare metal (SEV-SNP)",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"contrast generate --reference-values k3s-qemu-snp --skip-initializer resources/\n"})})}),(0,r.jsx)(t,{value:"k3s-qemu-tdx",label:"Bare metal (TDX)",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"contrast generate --reference-values k3s-qemu-tdx --skip-initializer resources/\n"})})})]})]}),(0,r.jsxs)(t,{value:"annotation",label:"Per-workload annotation",children:[(0,r.jsxs)(n.p,{children:["If you want to disable the Initializer injection for a specific workload with\nthe ",(0,r.jsx)(n.code,{children:"contrast-cc"})," runtime class, you can do so by adding an annotation to the workload."]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-yaml",children:'metadata: # apps/v1.Deployment, apps/v1.DaemonSet, ...\n annotations:\n contrast.edgeless.systems/skip-initializer: "true"\n'})})]})]}),"\n",(0,r.jsxs)(n.p,{children:["When disabling the automatic Initializer injection, you can manually add the\nInitializer as a sidecar container to your workload before generating the\npolicies. Configure the workload to use the certificates written to the\n",(0,r.jsx)(n.code,{children:"contrast-secrets"})," ",(0,r.jsx)(n.code,{children:"volumeMount"}),"."]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-yaml",children:'# v1.PodSpec\nspec:\n initContainers:\n - env:\n - name: COORDINATOR_HOST\n value: coordinator\n image: "ghcr.io/edgelesssys/contrast/initializer:v1.1.1@sha256:d89d4f5113c8869088ff3a28e02802d7b72304d4bbb50fb664f1c6cba7fcb722"\n name: contrast-initializer\n volumeMounts:\n - mountPath: /contrast\n name: contrast-secrets\n volumes:\n - emptyDir: {}\n name: contrast-secrets\n'})}),"\n",(0,r.jsx)(n.h2,{id:"apply-the-resources",children:"Apply the resources"}),"\n",(0,r.jsx)(n.p,{children:"Apply the resources to the cluster. Your workloads will block in the initialization phase until a\nmanifest is set at the Coordinator."}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"kubectl apply -f resources/\n"})}),"\n",(0,r.jsx)(n.h2,{id:"connect-to-the-contrast-coordinator",children:"Connect to the Contrast Coordinator"}),"\n",(0,r.jsx)(n.p,{children:"For the next steps, we will need to connect to the Coordinator. The released Coordinator resource\nincludes a LoadBalancer definition we can use."}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}')\n"})}),"\n",(0,r.jsxs)(n.admonition,{title:"Port-forwarding of Confidential Containers",type:"info",children:[(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.code,{children:"kubectl port-forward"})," uses a Container Runtime Interface (CRI) method that isn't supported by the Kata shim.\nIf you can't use a public load balancer, you can deploy a ",(0,r.jsx)(n.a,{href:"https://github.com/edgelesssys/contrast/blob/ddc371b/deployments/emojivoto/portforwarder.yml",children:"port-forwarder"}),".\nThe port-forwarder relays traffic from a CoCo pod and can be accessed via ",(0,r.jsx)(n.code,{children:"kubectl port-forward"}),"."]}),(0,r.jsxs)(n.p,{children:["Upstream tracking issue: ",(0,r.jsx)(n.a,{href:"https://github.com/kata-containers/kata-containers/issues/1693",children:"https://github.com/kata-containers/kata-containers/issues/1693"}),"."]})]}),"\n",(0,r.jsx)(n.h2,{id:"set-the-manifest",children:"Set the manifest"}),"\n",(0,r.jsx)(n.p,{children:"Attest the Coordinator and set the manifest:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:'contrast set -c "${coordinator}:1313" resources/\n'})}),"\n",(0,r.jsx)(n.p,{children:"This will use the reference values from the manifest file to attest the Coordinator.\nAfter this step, the Coordinator will start issuing TLS certificates to the workloads. The init container\nwill fetch a certificate for the workload and the workload is started."}),"\n",(0,r.jsx)(n.admonition,{type:"warning",children:(0,r.jsxs)(n.p,{children:["On bare metal, the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/policies#platform-differences",children:"coordinator policy hash"})," must be overwritten using ",(0,r.jsx)(n.code,{children:"--coordinator-policy-hash"}),"."]})}),"\n",(0,r.jsx)(n.h2,{id:"verify-the-coordinator",children:"Verify the Coordinator"}),"\n",(0,r.jsxs)(n.p,{children:["An end user (data owner) can verify the Contrast deployment using the ",(0,r.jsx)(n.code,{children:"verify"})," command."]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:'contrast verify -c "${coordinator}:1313"\n'})}),"\n",(0,r.jsxs)(n.p,{children:["The CLI will attest the Coordinator using the reference values from the given manifest file. It will then write the\nservice mesh root certificate and the history of manifests into the ",(0,r.jsx)(n.code,{children:"verify/"})," directory. In addition, the policies\nreferenced in the active manifest are also written to the directory. The verification will fail if the active\nmanifest at the Coordinator doesn't match the manifest passed to the CLI."]}),"\n",(0,r.jsx)(n.admonition,{type:"warning",children:(0,r.jsxs)(n.p,{children:["On bare metal, the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/policies#platform-differences",children:"coordinator policy hash"})," must be overwritten using ",(0,r.jsx)(n.code,{children:"--coordinator-policy-hash"}),"."]})}),"\n",(0,r.jsx)(n.h2,{id:"communicate-with-workloads",children:"Communicate with workloads"}),"\n",(0,r.jsxs)(n.p,{children:["You can securely connect to the workloads using the Coordinator's ",(0,r.jsx)(n.code,{children:"mesh-ca.pem"})," as a trusted CA certificate.\nFirst, expose the service on a public IP address via a LoadBalancer service:"]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"kubectl patch svc ${MY_SERVICE} -p '{\"spec\": {\"type\": \"LoadBalancer\"}}'\nkubectl wait --timeout=30s --for=jsonpath='{.status.loadBalancer.ingress}' service/${MY_SERVICE}\nlbip=$(kubectl get svc ${MY_SERVICE} -o=jsonpath='{.status.loadBalancer.ingress[0].ip}')\necho $lbip\n"})}),"\n",(0,r.jsxs)(n.admonition,{title:"Subject alternative names and LoadBalancer IP",type:"info",children:[(0,r.jsx)(n.p,{children:"By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed\nvia load balancer IP in this demo. Tools like curl check the certificate for IP entries in the SAN field.\nValidation fails since the certificate contains no IP entries as a subject alternative name (SAN).\nFor example, a connection attempt using the curl and the mesh CA certificate with throw the following error:"}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"$ curl --cacert ./verify/mesh-ca.pem \"https://${frontendIP}:443\"\ncurl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34'\n"})})]}),"\n",(0,r.jsxs)(n.p,{children:["Using ",(0,r.jsx)(n.code,{children:"openssl"}),", the certificate of the service can be validated with the ",(0,r.jsx)(n.code,{children:"mesh-ca.pem"}),":"]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"openssl s_client -CAfile verify/mesh-ca.pem -verify_return_error -connect ${frontendIP}:443 < /dev/null\n"})}),"\n",(0,r.jsx)(n.h2,{id:"recover-the-coordinator",children:"Recover the Coordinator"}),"\n",(0,r.jsx)(n.p,{children:"If the Contrast Coordinator restarts, it enters recovery mode and waits for an operator to provide key material.\nFor demonstration purposes, you can simulate this scenario by deleting the Coordinator pod."}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"kubectl delete pod -l app.kubernetes.io/name=coordinator\n"})}),"\n",(0,r.jsxs)(n.p,{children:["Kubernetes schedules a new pod, but that pod doesn't have access to the key material the previous pod held in memory and can't issue certificates for workloads yet.\nYou can confirm this by running ",(0,r.jsx)(n.code,{children:"verify"})," again, or you can restart a workload pod, which should stay in the initialization phase.\nHowever, the secret seed in your working directory is sufficient to recover the coordinator."]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:'contrast recover -c "${coordinator}:1313"\n'})}),"\n",(0,r.jsx)(n.p,{children:"Now that the Coordinator is recovered, all workloads should pass initialization and enter the running state.\nYou can now verify the Coordinator again, which should return the same manifest you set before."}),"\n",(0,r.jsx)(n.admonition,{type:"warning",children:(0,r.jsx)(n.p,{children:"The recovery process invalidates the mesh CA certificate:\nexisting workloads won't be able to communicate with workloads newly spawned.\nAll workloads should be restarted after the recovery succeeded."})}),"\n",(0,r.jsx)(n.admonition,{type:"warning",children:(0,r.jsxs)(n.p,{children:["On bare metal, the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/policies#platform-differences",children:"coordinator policy hash"})," must be overwritten using ",(0,r.jsx)(n.code,{children:"--coordinator-policy-hash"}),"."]})})]})}function h(e={}){const{wrapper:n}={...(0,a.R)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}function u(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},28453:(e,n,t)=>{t.d(n,{R:()=>i,x:()=>o});var s=t(96540);const r={},a=s.createContext(r);function i(e){const n=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function o(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:i(e.components),s.createElement(a.Provider,{value:n},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/0a7a212e.cb47d607.js b/pr-preview/pr-1071/assets/js/0a7a212e.cb47d607.js
deleted file mode 100644
index bd1e306df0..0000000000
--- a/pr-preview/pr-1071/assets/js/0a7a212e.cb47d607.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[3702],{4949:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>r,metadata:()=>s,toc:()=>d});const s=JSON.parse('{"id":"basics/confidential-containers","title":"Confidential Containers","description":"Contrast uses some building blocks from Confidential Containers (CoCo), a CNCF Sandbox project that aims to standardize confidential computing at the pod level.","source":"@site/versioned_docs/version-0.8/basics/confidential-containers.md","sourceDirName":"basics","slug":"/basics/confidential-containers","permalink":"/contrast/pr-preview/pr-1071/0.8/basics/confidential-containers","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.8/basics/confidential-containers.md","tags":[],"version":"0.8","frontMatter":{},"sidebar":"docs","previous":{"title":"What is Contrast?","permalink":"/contrast/pr-preview/pr-1071/0.8/"},"next":{"title":"Security benefits","permalink":"/contrast/pr-preview/pr-1071/0.8/basics/security-benefits"}}');var i=t(74848),o=t(28453);const r={},a="Confidential Containers",c={},d=[{value:"Kubernetes RuntimeClass",id:"kubernetes-runtimeclass",level:2},{value:"Kata Containers",id:"kata-containers",level:2},{value:"AKS CoCo preview",id:"aks-coco-preview",level:2}];function l(e){const n={a:"a",code:"code",h1:"h1",h2:"h2",header:"header",p:"p",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.header,{children:(0,i.jsx)(n.h1,{id:"confidential-containers",children:"Confidential Containers"})}),"\n",(0,i.jsxs)(n.p,{children:["Contrast uses some building blocks from ",(0,i.jsx)(n.a,{href:"https://confidentialcontainers.org",children:"Confidential Containers"})," (CoCo), a ",(0,i.jsx)(n.a,{href:"https://www.cncf.io/projects/confidential-containers/",children:"CNCF Sandbox project"})," that aims to standardize confidential computing at the pod level.\nThe project is under active development and many of the high-level features are still in flux.\nContrast uses the more stable core primitive provided by CoCo: its Kubernetes runtime."]}),"\n",(0,i.jsx)(n.h2,{id:"kubernetes-runtimeclass",children:"Kubernetes RuntimeClass"}),"\n",(0,i.jsxs)(n.p,{children:["Kubernetes can be extended to use more than one container runtime with ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/containers/runtime-class/",children:(0,i.jsx)(n.code,{children:"RuntimeClass"})})," objects.\nThe ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/architecture/cri/",children:"Container Runtime Interface"})," (CRI) implementation, for example containerd, dispatches pod management API calls to the appropriate ",(0,i.jsx)(n.code,{children:"RuntimeClass"}),".\n",(0,i.jsx)(n.code,{children:"RuntimeClass"})," implementations are usually based on an ",(0,i.jsx)(n.a,{href:"https://github.com/opencontainers/runtime-spec",children:"OCI runtime"}),", such as ",(0,i.jsx)(n.code,{children:"runc"}),", ",(0,i.jsx)(n.code,{children:"runsc"})," or ",(0,i.jsx)(n.code,{children:"crun"}),".\nIn CoCo's case, the runtime is Kata Containers with added confidential computing capabilities."]}),"\n",(0,i.jsx)(n.h2,{id:"kata-containers",children:"Kata Containers"}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"https://katacontainers.io/",children:"Kata Containers"})," is an OCI runtime that runs pods in VMs.\nThe pod VM spawns an agent process that accepts management commands from the Kata runtime running on the host.\nThere are two options for creating pod VMs: local to the Kubernetes node, or remote VMs created with cloud provider APIs.\nUsing local VMs requires either bare-metal servers or VMs with support for nested virtualization.\nLocal VMs communicate with the host over a virtual socket.\nFor remote VMs, host-to-agent communication is tunnelled through the cloud provider's network."]}),"\n",(0,i.jsxs)(n.p,{children:["Kata Containers was originally designed to isolate the guest from the host, but it can also run pods in confidential VMs (CVMs) to shield pods from their underlying infrastructure.\nIn confidential mode, the guest agent is configured with an ",(0,i.jsx)(n.a,{href:"https://www.openpolicyagent.org/",children:"Open Policy Agent"})," (OPA) policy to authorize API calls from the host.\nThis policy also contains checksums for the expected container images.\nIt's derived from Kubernetes resource definitions and its checksum is included in the attestation report."]}),"\n",(0,i.jsx)(n.h2,{id:"aks-coco-preview",children:"AKS CoCo preview"}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/azure/aks/",children:"Azure Kubernetes Service"})," (AKS) provides CoCo-enabled node pools as a ",(0,i.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/azure/aks/confidential-containers-overview",children:"preview offering"}),".\nThese node pools leverage Azure VM types capable of nested virtualization (CVM-in-VM) and the CoCo stack is pre-installed.\nContrast can be deployed directly into a CoCo-enabled AKS cluster."]})]})}function h(e={}){const{wrapper:n}={...(0,o.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},28453:(e,n,t)=>{t.d(n,{R:()=>r,x:()=>a});var s=t(96540);const i={},o=s.createContext(i);function r(e){const n=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),s.createElement(o.Provider,{value:n},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/0b1c872d.46cf372e.js b/pr-preview/pr-1071/assets/js/0b1c872d.46cf372e.js
deleted file mode 100644
index 6871a830c7..0000000000
--- a/pr-preview/pr-1071/assets/js/0b1c872d.46cf372e.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[3188],{25776:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>i,toc:()=>l});const i=JSON.parse('{"id":"components/policies","title":"Policies","description":"Kata runtime policies are an integral part of the Confidential Containers preview on AKS.","source":"@site/versioned_docs/version-1.1/components/policies.md","sourceDirName":"components","slug":"/components/policies","permalink":"/contrast/pr-preview/pr-1071/1.1/components/policies","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-1.1/components/policies.md","tags":[],"version":"1.1","frontMatter":{},"sidebar":"docs","previous":{"title":"Runtime","permalink":"/contrast/pr-preview/pr-1071/1.1/components/runtime"},"next":{"title":"Service mesh","permalink":"/contrast/pr-preview/pr-1071/1.1/components/service-mesh"}}');var s=n(74848),r=n(28453);const o={},a="Policies",c={},l=[{value:"Structure",id:"structure",level:2},{value:"Generation",id:"generation",level:2},{value:"Evaluation",id:"evaluation",level:2},{value:"Guarantees",id:"guarantees",level:2},{value:"Trust",id:"trust",level:2},{value:"Platform Differences",id:"platform-differences",level:2}];function d(e){const t={a:"a",code:"code",em:"em",h1:"h1",h2:"h2",header:"header",li:"li",ol:"ol",p:"p",ul:"ul",...(0,r.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.header,{children:(0,s.jsx)(t.h1,{id:"policies",children:"Policies"})}),"\n",(0,s.jsx)(t.p,{children:"Kata runtime policies are an integral part of the Confidential Containers preview on AKS.\nThey prescribe how a Kubernetes pod must be configured to launch successfully in a confidential VM.\nIn Contrast, policies act as a workload identifier: only pods with a policy registered in the manifest receive workload certificates and may participate in the confidential deployment.\nVerification of the Contrast Coordinator and its manifest transitively guarantees that all workloads meet the owner's expectations."}),"\n",(0,s.jsx)(t.h2,{id:"structure",children:"Structure"}),"\n",(0,s.jsxs)(t.p,{children:["The Kata agent running in the confidential micro-VM exposes an RPC service ",(0,s.jsx)(t.a,{href:"https://github.com/kata-containers/kata-containers/blob/e5e0983/src/libs/protocols/protos/agent.proto#L21-L76",children:(0,s.jsx)(t.code,{children:"AgentService"})})," to the Kata runtime.\nThis service handles potentially untrustworthy requests from outside the TCB, which need to be checked against a policy."]}),"\n",(0,s.jsxs)(t.p,{children:["Kata runtime policies are written in the policy language ",(0,s.jsx)(t.a,{href:"https://www.openpolicyagent.org/docs/latest/policy-language/",children:"Rego"}),".\nThey specify what ",(0,s.jsx)(t.code,{children:"AgentService"})," methods can be called, and the permissible parameters for each call."]}),"\n",(0,s.jsxs)(t.p,{children:["Policies consist of two parts: a list of rules and a data section.\nWhile the list of rules is static, the data section is populated with information from the ",(0,s.jsx)(t.code,{children:"PodSpec"})," and other sources."]}),"\n",(0,s.jsx)(t.h2,{id:"generation",children:"Generation"}),"\n",(0,s.jsxs)(t.p,{children:["Runtime policies are programmatically generated from Kubernetes manifests by the Contrast CLI.\nThe ",(0,s.jsx)(t.code,{children:"generate"})," subcommand inspects pod definitions and derives rules for validating the pod at the Kata agent.\nThere are two important integrity checks: container image checksums and OCI runtime parameters."]}),"\n",(0,s.jsxs)(t.p,{children:["For each of the container images used in a pod, the CLI downloads all image layers and produces a cryptographic ",(0,s.jsx)(t.a,{href:"https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/verity.html",children:"dm-verity"})," checksum.\nThese checksums are the basis for the policy's ",(0,s.jsx)(t.em,{children:"storage data"}),"."]}),"\n",(0,s.jsxs)(t.p,{children:["The CLI combines information from the ",(0,s.jsx)(t.code,{children:"PodSpec"}),", ",(0,s.jsx)(t.code,{children:"ConfigMaps"}),", and ",(0,s.jsx)(t.code,{children:"Secrets"})," in the provided Kubernetes manifests to derive a permissible set of command-line arguments and environment variables.\nThese constitute the policy's ",(0,s.jsx)(t.em,{children:"OCI data"}),"."]}),"\n",(0,s.jsx)(t.h2,{id:"evaluation",children:"Evaluation"}),"\n",(0,s.jsxs)(t.p,{children:["The generated policy document is annotated to the pod definitions in Base64 encoding.\nThis annotation is propagated to the Kata runtime, which calculates the SHA256 checksum for the policy and uses that as SNP ",(0,s.jsx)(t.code,{children:"HOSTDATA"})," or TDX ",(0,s.jsx)(t.code,{children:"MRCONFIGID"})," for the confidential micro-VM."]}),"\n",(0,s.jsxs)(t.p,{children:["After the VM launched, the runtime calls the agent's ",(0,s.jsx)(t.code,{children:"SetPolicy"})," method with the full policy document.\nIf the policy doesn't match the checksum in ",(0,s.jsx)(t.code,{children:"HOSTDATA"})," or ",(0,s.jsx)(t.code,{children:"MRCONFIGID"}),", the agent rejects the policy.\nOtherwise, it applies the policy to all future ",(0,s.jsx)(t.code,{children:"AgentService"})," requests."]}),"\n",(0,s.jsx)(t.h2,{id:"guarantees",children:"Guarantees"}),"\n",(0,s.jsx)(t.p,{children:"The policy evaluation provides the following guarantees for pods launched with the correct generated policy:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"Command and its arguments are set as specified in the resources."}),"\n",(0,s.jsx)(t.li,{children:"There are no unexpected additional environment variables."}),"\n",(0,s.jsx)(t.li,{children:"The container image layers correspond to the layers observed at policy generation time.\nThus, only the expected workload image can be instantiated."}),"\n",(0,s.jsx)(t.li,{children:"Executing additional processes in a container is prohibited."}),"\n",(0,s.jsx)(t.li,{children:"Sending data to a container's standard input is prohibited."}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:"The current implementation of policy checking has some blind spots:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"Containers can be started in any order, or be omitted entirely."}),"\n",(0,s.jsx)(t.li,{children:"Environment variables may be missing."}),"\n",(0,s.jsxs)(t.li,{children:["Volumes other than the container root volume don't have integrity checks (particularly relevant for mounted ",(0,s.jsx)(t.code,{children:"ConfigMaps"})," and ",(0,s.jsx)(t.code,{children:"Secrets"}),")."]}),"\n"]}),"\n",(0,s.jsx)(t.h2,{id:"trust",children:"Trust"}),"\n",(0,s.jsx)(t.p,{children:"Contrast verifies its confidential containers following these steps:"}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsx)(t.li,{children:"The Contrast CLI generates a policy and attaches it to the pod definition."}),"\n",(0,s.jsx)(t.li,{children:"Kubernetes schedules the pod on a node with the confidential computing runtime."}),"\n",(0,s.jsx)(t.li,{children:"Containerd invokes the Kata runtime to create the pod sandbox."}),"\n",(0,s.jsxs)(t.li,{children:["The Kata runtime starts a CVM with the policy's digest as ",(0,s.jsx)(t.code,{children:"HOSTDATA"}),"/",(0,s.jsx)(t.code,{children:"MRCONFIGID"}),"."]}),"\n",(0,s.jsxs)(t.li,{children:["The Kata runtime sets the policy using the ",(0,s.jsx)(t.code,{children:"SetPolicy"})," method."]}),"\n",(0,s.jsxs)(t.li,{children:["The Kata agent verifies that the incoming policy's digest matches ",(0,s.jsx)(t.code,{children:"HOSTDATA"}),"/",(0,s.jsx)(t.code,{children:"MRCONFIGID"}),"."]}),"\n",(0,s.jsx)(t.li,{children:"The CLI sets a manifest in the Contrast Coordinator, including a list of permitted policies."}),"\n",(0,s.jsx)(t.li,{children:"The Contrast Initializer sends an attestation report to the Contrast Coordinator, asking for a mesh certificate."}),"\n",(0,s.jsxs)(t.li,{children:["The Contrast Coordinator verifies that the started pod has a permitted policy hash in its ",(0,s.jsx)(t.code,{children:"HOSTDATA"}),"/",(0,s.jsx)(t.code,{children:"MRCONFIGID"})," field."]}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:"After the last step, we know that the policy hasn't been tampered with and, thus, that the workload matches expectations and may receive mesh certificates."}),"\n",(0,s.jsx)(t.h2,{id:"platform-differences",children:"Platform Differences"}),"\n",(0,s.jsx)(t.p,{children:"Contrast uses different rules and data sections for different platforms.\nThis results in different policy hashes for different platforms."}),"\n",(0,s.jsxs)(t.p,{children:["The ",(0,s.jsx)(t.code,{children:"generate"})," command automatically derives the correct set of rules and data sections from the ",(0,s.jsx)(t.code,{children:"reference-values"})," flag."]}),"\n",(0,s.jsxs)(t.p,{children:["The ",(0,s.jsx)(t.code,{children:"verify"}),", ",(0,s.jsx)(t.code,{children:"set"}),", and ",(0,s.jsx)(t.code,{children:"recover"})," commands need to know the coordinator's expected policy hash to verify its identity.\nBy default these commands assume that the coordinator is using the policy for the ",(0,s.jsx)(t.code,{children:"AKS-CLH-SNP"})," platform.\nIf the coordinator is running on a different platform, the correct policy hash can be looked up in the ",(0,s.jsx)(t.code,{children:"coordinator-policy.hash"})," file bundled with the ",(0,s.jsx)(t.a,{href:"https://github.com/edgelesssys/contrast/releases",children:"Contrast release"}),".\nThe coordinator policy hash can be overwritten using the ",(0,s.jsx)(t.code,{children:"--coordinator-policy-hash"})," flag."]})]})}function h(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>o,x:()=>a});var i=n(96540);const s={},r=i.createContext(s);function o(e){const t=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),i.createElement(r.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/0ba7602a.036d984e.js b/pr-preview/pr-1071/assets/js/0ba7602a.036d984e.js
deleted file mode 100644
index e232e39b84..0000000000
--- a/pr-preview/pr-1071/assets/js/0ba7602a.036d984e.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[7368],{37154:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>l,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>i,toc:()=>c});const i=JSON.parse('{"id":"features-limitations","title":"Planned features and limitations","description":"This section lists planned features and current limitations of Contrast.","source":"@site/versioned_docs/version-0.9/features-limitations.md","sourceDirName":".","slug":"/features-limitations","permalink":"/contrast/pr-preview/pr-1071/0.9/features-limitations","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.9/features-limitations.md","tags":[],"version":"0.9","frontMatter":{},"sidebar":"docs","previous":{"title":"Observability","permalink":"/contrast/pr-preview/pr-1071/0.9/architecture/observability"},"next":{"title":"Telemetry","permalink":"/contrast/pr-preview/pr-1071/0.9/about/telemetry"}}');var r=t(74848),s=t(28453);const o={},a="Planned features and limitations",l={},c=[{value:"Availability",id:"availability",level:2},{value:"Kubernetes features",id:"kubernetes-features",level:2},{value:"Runtime policies",id:"runtime-policies",level:2},{value:"Tooling integration",id:"tooling-integration",level:2},{value:"Automatic recovery and high availability",id:"automatic-recovery-and-high-availability",level:2}];function d(e){const n={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",header:"header",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.header,{children:(0,r.jsx)(n.h1,{id:"planned-features-and-limitations",children:"Planned features and limitations"})}),"\n",(0,r.jsx)(n.p,{children:"This section lists planned features and current limitations of Contrast."}),"\n",(0,r.jsx)(n.h2,{id:"availability",children:"Availability"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Platform support"}),": At present, Contrast is exclusively available on Azure AKS, supported by the ",(0,r.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers-on-aks-preview",children:"Confidential Container preview for AKS"}),". Expansion to other cloud platforms is planned, pending the availability of necessary infrastructure enhancements."]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Bare-metal support"}),": Support for running Contrast on bare-metal Kubernetes will be available soon for AMD SEV and Intel TDX."]}),"\n"]}),"\n",(0,r.jsx)(n.h2,{id:"kubernetes-features",children:"Kubernetes features"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Persistent volumes"}),": Contrast only supports volumes with ",(0,r.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/storage/persistent-volumes/#volume-mode",children:(0,r.jsx)(n.code,{children:"volumeMode: Block"})}),". These block devices are provided by the untrusted environment and should be treated accordingly. We plan to provide transparent encryption on top of block devices in a future release."]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Port forwarding"}),": This feature ",(0,r.jsx)(n.a,{href:"https://github.com/kata-containers/kata-containers/issues/1693",children:"isn't yet supported by Kata Containers"}),". You can ",(0,r.jsx)(n.a,{href:"https://docs.edgeless.systems/contrast/deployment#connect-to-the-contrast-coordinator",children:"deploy a port-forwarder"})," as a workaround."]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Resource limits"}),": There is an existing bug on AKS where container memory limits are incorrectly applied. The current workaround involves using only memory requests instead of limits."]}),"\n"]}),"\n",(0,r.jsx)(n.h2,{id:"runtime-policies",children:"Runtime policies"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Coverage"}),": While the enforcement of workload policies generally functions well, ",(0,r.jsx)(n.a,{href:"https://github.com/microsoft/kata-containers/releases/tag/3.2.0.azl0.genpolicy",children:"there are scenarios not yet fully covered"}),". It's crucial to review deployments specifically for these edge cases."]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Order of events"}),": The current policy evaluation mechanism on API requests isn't stateful, so it can't ensure a prescribed order of events. Consequently, there's no guaranteed enforcement that the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/0.9/components/service-mesh",children:"service mesh sidecar"})," container runs ",(0,r.jsx)(n.em,{children:"before"})," the workload container. This order ensures that all traffic between pods is securely encapsulated within TLS connections."]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Absence of events"}),": Policies can't ensure certain events have happened. A container, such as the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/0.9/components/service-mesh",children:"service mesh sidecar"}),", can be omitted entirely. Environment variables may be missing."]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Volume integrity checks"}),": While persistent volumes aren't supported yet, integrity checks don't currently cover other objects such as ",(0,r.jsx)(n.code,{children:"ConfigMaps"})," and ",(0,r.jsx)(n.code,{children:"Secrets"}),"."]}),"\n"]}),"\n",(0,r.jsx)(n.admonition,{type:"warning",children:(0,r.jsx)(n.p,{children:"The policy limitations, in particular the missing guarantee that our service mesh sidecar has been started before the workload container affects the service mesh implementation of Contrast. Currently, this requires inspecting the iptables rules on startup or terminating TLS connections in the workload directly."})}),"\n",(0,r.jsx)(n.h2,{id:"tooling-integration",children:"Tooling integration"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"CLI availability"}),": The CLI tool is currently only available for Linux. This limitation arises because certain upstream dependencies haven't yet been ported to other platforms."]}),"\n"]}),"\n",(0,r.jsx)(n.h2,{id:"automatic-recovery-and-high-availability",children:"Automatic recovery and high availability"}),"\n",(0,r.jsx)(n.p,{children:"The Contrast Coordinator is a singleton and can't be scaled to more than one instance.\nWhen this instance's pod is restarted, for example for node maintenance, it needs to be recovered manually.\nIn a future release, we plan to support distributed Coordinator instances that can recover automatically."})]})}function h(e={}){const{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},28453:(e,n,t)=>{t.d(n,{R:()=>o,x:()=>a});var i=t(96540);const r={},s=i.createContext(r);function o(e){const n=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),i.createElement(s.Provider,{value:n},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/0c24bc66.c5075be6.js b/pr-preview/pr-1071/assets/js/0c24bc66.c5075be6.js
deleted file mode 100644
index 9a268c8fbd..0000000000
--- a/pr-preview/pr-1071/assets/js/0c24bc66.c5075be6.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[6739],{73521:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>o,default:()=>l,frontMatter:()=>s,metadata:()=>i,toc:()=>d});const i=JSON.parse('{"id":"basics/security-benefits","title":"Contrast security overview","description":"This document outlines the security measures of Contrast and its capability to counter various threats.","source":"@site/versioned_docs/version-0.6/basics/security-benefits.md","sourceDirName":"basics","slug":"/basics/security-benefits","permalink":"/contrast/pr-preview/pr-1071/0.6/basics/security-benefits","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.6/basics/security-benefits.md","tags":[],"version":"0.6","frontMatter":{},"sidebar":"docs","previous":{"title":"Confidential Containers","permalink":"/contrast/pr-preview/pr-1071/0.6/basics/confidential-containers"},"next":{"title":"Features","permalink":"/contrast/pr-preview/pr-1071/0.6/basics/features"}}');var r=n(74848),a=n(28453);const s={},o="Contrast security overview",c={},d=[{value:"Confidential computing foundation",id:"confidential-computing-foundation",level:2},{value:"Components of a Contrast deployment",id:"components-of-a-contrast-deployment",level:2},{value:"Personas in a Contrast deployment",id:"personas-in-a-contrast-deployment",level:2},{value:"Threat model and mitigations",id:"threat-model-and-mitigations",level:2},{value:"Possible attacks",id:"possible-attacks",level:3},{value:"Attack surfaces",id:"attack-surfaces",level:3},{value:"Threats and mitigations",id:"threats-and-mitigations",level:3},{value:"Attacks on the confidential container environment",id:"attacks-on-the-confidential-container-environment",level:4},{value:"Attacks on the Coordinator attestation service",id:"attacks-on-the-coordinator-attestation-service",level:4},{value:"Attacks on workloads",id:"attacks-on-workloads",level:4},{value:"Examples of Contrast's threat model in practice",id:"examples-of-contrasts-threat-model-in-practice",level:2}];function h(e){const t={a:"a",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",header:"header",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,a.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.header,{children:(0,r.jsx)(t.h1,{id:"contrast-security-overview",children:"Contrast security overview"})}),"\n",(0,r.jsx)(t.p,{children:"This document outlines the security measures of Contrast and its capability to counter various threats.\nContrast is designed to shield entire Kubernetes deployments from the infrastructure, enabling entities to manage sensitive information (such as regulated or personally identifiable information (PII)) in the public cloud, while maintaining data confidentiality and ownership."}),"\n",(0,r.jsx)(t.p,{children:"Contrast is applicable in situations where establishing trust with the workload operator or the underlying infrastructure is challenging.\nThis is particularly beneficial for regulated sectors looking to transition sensitive activities to the cloud, without sacrificing security or compliance.\nIt allows for cloud adoption by maintaining a hardware-based separation from the cloud service provider."}),"\n",(0,r.jsx)(t.h2,{id:"confidential-computing-foundation",children:"Confidential computing foundation"}),"\n",(0,r.jsx)(t.p,{children:"Leveraging Confidential Computing technology, Contrast provides three defining security properties:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Encryption of data in use"}),": Contrast ensures that all data processed in memory is encrypted, making it inaccessible to unauthorized users or systems, even if they have physical access to the hardware."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Workload isolation"}),": Each pod runs in its isolated runtime environment, preventing any cross-contamination between workloads, which is critical for multi-tenant infrastructures."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Remote attestation"}),": This feature allows data owners and workload operators to verify that the Contrast environment executing their workloads hasn't been tampered with and is running in a secure, pre-approved configuration."]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"The runtime encryption is transparently provided by the confidential computing hardware during the workload's lifetime.\nThe workload isolation and remote attestation involves two phases:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"An attestation process detects modifications to the workload image or its runtime environment during the initialization. This protects the workload's integrity pre-attestation."}),"\n",(0,r.jsx)(t.li,{children:"A protected runtime environment and a policy mechanism prevents the platform operator from accessing or compromising the instance at runtime. This protects a workload's integrity and confidentiality post-attestation."}),"\n"]}),"\n",(0,r.jsxs)(t.p,{children:["For more details on confidential computing see our ",(0,r.jsx)(t.a,{href:"https://content.edgeless.systems/hubfs/Confidential%20Computing%20Whitepaper.pdf",children:"whitepaper"}),".\nThe ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/architecture/attestation",children:"attestation architecture"})," describes Contrast's attestation process and the resulting chain of trust in detail."]}),"\n",(0,r.jsx)(t.h2,{id:"components-of-a-contrast-deployment",children:"Components of a Contrast deployment"}),"\n",(0,r.jsxs)(t.p,{children:["Contrast uses the Kubernetes runtime of the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/basics/confidential-containers",children:"Confidential Containers"})," project.\nConfidential Containers significantly decrease the size of the trusted computing base (TCB) of a Kubernetes deployment, by isolating each pod within its own confidential micro-VM environment.\nThe TCB is the totality of elements in a computing environment that must be trusted not to be compromised.\nA smaller TCB results in a smaller attack surface. The following diagram shows how Confidential Containers remove the ",(0,r.jsx)(t.em,{children:"cloud & datacenter infrastructure"})," and the ",(0,r.jsx)(t.em,{children:"physical hosts"}),", including the hypervisor, the host OS, the Kubernetes control plane, and other components, from the TCB (red).\nIn the confidential context, depicted in green, only the workload containers along with their confidential micro-VM environment are included within the TCB.\nTheir integrity is ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/architecture/attestation",children:"verifiable through remote attestation"}),"."]}),"\n",(0,r.jsxs)(t.p,{children:["Contrast uses ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/basics/confidential-containers",children:"hardware-based mechanisms"}),", specifically leveraging CPU features, such as AMD SEV or Intel TDX, to provide the isolation of the workload.\nThis implies that both the CPU and its microcode are integral components of the TCB.\nHowever, it should be noted that the CPU microcode aspects aren't depicted in the accompanying graphic."]}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"TCB comparison",src:n(34696).A+"",width:"4052",height:"1380"})}),"\n",(0,r.jsx)(t.p,{children:"Contrast adds the following components to a deployment that become part of the TCB.\nThe components that are part of the TCB are:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"The workload containers"}),": Container images that run the actual application."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/runtime",children:"The runtime environment"})}),": The confidential micro-VM that acts as the container runtime."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/service-mesh",children:"The sidecar containers"})}),": Containers that provide additional functionality such as ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/#the-initializer",children:"initialization"})," and ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/service-mesh",children:"service mesh"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/policies",children:"The runtime policies"})}),": Policies that enforce the runtime environments for the workload containers during their lifetime."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/#the-manifest",children:"The manifest"})}),": A manifest file defining the reference values of an entire confidential deployment. It contains the policy hashes for all pods of the deployment and the expected hardware reference values for the Confidential Container runtime."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/#the-coordinator",children:"The Coordinator"})}),": An attestation service that runs in a Confidential Container in the Kubernetes cluster. The Coordinator is configured with the manifest. User-facing, you can verify this service and the effective manifest using remote attestation, providing you with a concise attestation for the entire deployment. Cluster-facing, it verifies all pods and their policies based on remote attestation procedures and the manifest."]}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"personas-in-a-contrast-deployment",children:"Personas in a Contrast deployment"}),"\n",(0,r.jsx)(t.p,{children:"In a Contrast deployment, there are three parties:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"The container image provider"}),", who creates the container images that represent the application that has access to the protected data."]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"The workload operator"}),", who runs the workload in a Kubernetes cluster. The operator typically has full administrative privileges to the deployment. The operator can manage cluster resources such as nodes, volumes, and networking rules, and the operator can interact with any Kubernetes or underlying cloud API."]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"The data owner"}),", who owns the protected data. A data owner can verify the deployment using the Coordinator attestation service. The verification includes the identity, integrity, and confidentiality of the workloads, the runtime environment and the access permissions."]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Contrast supports a trust model where the container image provider, workload operator, and data owner are separate, mutually distrusting parties."}),"\n",(0,r.jsx)(t.p,{children:"The following diagram shows the system components and parties."}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Components and parties",src:n(95662).A+"",width:"3588",height:"2017"})}),"\n",(0,r.jsx)(t.h2,{id:"threat-model-and-mitigations",children:"Threat model and mitigations"}),"\n",(0,r.jsx)(t.p,{children:"This section describes the threat vectors that Contrast helps to mitigate."}),"\n",(0,r.jsx)(t.p,{children:"The following attacks are out of scope for this document:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"Attacks on the application code itself, such as insufficient access controls."}),"\n",(0,r.jsx)(t.li,{children:"Attacks on the Confidential Computing hardware directly, such as side-channel attacks."}),"\n",(0,r.jsx)(t.li,{children:"Attacks on the availability, such as denial-of-service (DOS) attacks."}),"\n"]}),"\n",(0,r.jsx)(t.h3,{id:"possible-attacks",children:"Possible attacks"}),"\n",(0,r.jsx)(t.p,{children:"Contrast is designed to defend against five possible attacks:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"A malicious cloud insider"}),": malicious employees or third-party contractors of cloud service providers (CSPs) potentially have full access to various layers of the cloud infrastructure. That goes from the physical datacenter up to the hypervisor and Kubernetes layer. For example, they can access the physical memory of the machines, modify the hypervisor, modify disk contents, intercept network communications, and attempt to compromise the confidential container at runtime. A malicious insider can expand the attack surface or restrict the runtime environment. For example, a malicious operator can add a storage device to introduce new attack vectors. As another example, a malicious operator can constrain resources such as limiting a guest's memory size, changing its disk space, or changing firewall rules."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"A malicious cloud co-tenant"}),': malicious cloud user ("hackers") may break out of their tenancy and access other tenants\' data. Advanced attackers may even be able to establish a permanent foothold within the infrastructure and access data over a longer period. The threats are analogous to the ',(0,r.jsx)(t.em,{children:"cloud insider access"})," scenario, without the physical access."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"A malicious workload operator"}),": malicious workload operators, for example Kubernetes administrators, have full access to the workload deployment and the underlying Kubernetes platform. The threats are analogously to the ",(0,r.jsx)(t.em,{children:"cloud insider access"})," scenario, with access to everything that's above the hypervisor level."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"A malicious attestation client"}),": this attacker connects to the attestation service and sends malformed request."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"A malicious container image provider"}),": a malicious container image provider has full control over the application development itself. This attacker might release a malicious version of the workload containing harmful operations."]}),"\n"]}),"\n",(0,r.jsx)(t.h3,{id:"attack-surfaces",children:"Attack surfaces"}),"\n",(0,r.jsx)(t.p,{children:"The following table describes the attack surfaces that are available to attackers."}),"\n",(0,r.jsxs)(t.table,{children:[(0,r.jsx)(t.thead,{children:(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.th,{children:"Attacker"}),(0,r.jsx)(t.th,{children:"Target"}),(0,r.jsx)(t.th,{children:"Attack surface"}),(0,r.jsx)(t.th,{children:"Risks"})]})}),(0,r.jsxs)(t.tbody,{children:[(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Cloud insider"}),(0,r.jsx)(t.td,{children:"Confidential Container, Workload"}),(0,r.jsx)(t.td,{children:"Physical memory"}),(0,r.jsx)(t.td,{children:"Attacker can dump the physical memory of the workloads."})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Cloud insider, cloud hacker, workload operator"}),(0,r.jsx)(t.td,{children:"Confidential Container, Workload"}),(0,r.jsx)(t.td,{children:"Disk reads"}),(0,r.jsx)(t.td,{children:"Anything read from the disk is within the attacker's control."})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Cloud insider, cloud hacker, workload operator"}),(0,r.jsx)(t.td,{children:"Confidential Container, Workload"}),(0,r.jsx)(t.td,{children:"Disk writes"}),(0,r.jsx)(t.td,{children:"Anything written to disk is visible to an attacker."})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Cloud insider, cloud hacker, workload operator"}),(0,r.jsx)(t.td,{children:"Confidential Container, Workload"}),(0,r.jsx)(t.td,{children:"Kubernetes Control Plane"}),(0,r.jsx)(t.td,{children:"Instance attributes read from the Kubernetes control plane, including mount points and environment variables, are within the attacker's control."})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Cloud insider, cloud hacker, workload operator"}),(0,r.jsx)(t.td,{children:"Confidential Container, Workload"}),(0,r.jsx)(t.td,{children:"Container Runtime"}),(0,r.jsx)(t.td,{children:'The attacker can use container runtime APIs (for example "kubectl exec") to perform operations on the workload container.'})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Cloud insider, cloud hacker, workload operator"}),(0,r.jsx)(t.td,{children:"Confidential Container, Workload"}),(0,r.jsx)(t.td,{children:"Network"}),(0,r.jsx)(t.td,{children:"Intra-deployment (between containers) as well as external network connections to the image repository or attestation service can be intercepted."})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Attestation client"}),(0,r.jsx)(t.td,{children:"Coordinator attestation service"}),(0,r.jsx)(t.td,{children:"Attestation requests"}),(0,r.jsx)(t.td,{children:"The attestation service has complex, crypto-heavy logic that's challenging to write defensively."})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Container image provider"}),(0,r.jsx)(t.td,{children:"Workload"}),(0,r.jsx)(t.td,{children:"Workload"}),(0,r.jsx)(t.td,{children:"This attacker might release an upgrade to the workload containing harmful changes, such as a backdoor."})]})]})]}),"\n",(0,r.jsx)(t.h3,{id:"threats-and-mitigations",children:"Threats and mitigations"}),"\n",(0,r.jsx)(t.p,{children:"Contrast shields a workload from the aforementioned threats with three main components:"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["The ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/runtime",children:"runtime environment"})," safeguards against the physical memory and disk attack surface."]}),"\n",(0,r.jsxs)(t.li,{children:["The ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/policies",children:"runtime policies"})," safeguard against the Kubernetes control plane and container runtime attack surface."]}),"\n",(0,r.jsxs)(t.li,{children:["The ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/service-mesh",children:"service mesh"})," safeguards against the network attack surface."]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"The following tables describe concrete threats and how they're mitigated in Contrast grouped by these categories:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"Attacks on the confidential container environment"}),"\n",(0,r.jsx)(t.li,{children:"Attacks on the attestation service"}),"\n",(0,r.jsx)(t.li,{children:"Attacks on workloads"}),"\n"]}),"\n",(0,r.jsx)(t.h4,{id:"attacks-on-the-confidential-container-environment",children:"Attacks on the confidential container environment"}),"\n",(0,r.jsx)(t.p,{children:"This table describes potential threats and mitigation strategies related to the confidential container environment."}),"\n",(0,r.jsxs)(t.table,{children:[(0,r.jsx)(t.thead,{children:(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.th,{children:"Threat"}),(0,r.jsx)(t.th,{children:"Mitigation"}),(0,r.jsx)(t.th,{children:"Mitigation implementation"})]})}),(0,r.jsxs)(t.tbody,{children:[(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker intercepts the network connection of the launcher or image repository."}),(0,r.jsx)(t.td,{children:"An attacker can change the image URL and control the workload binary. However these actions are reflected in the attestation report. The image repository isn't controlled using an access list, therefore the image is assumed to be viewable by everyone. You must ensure that the workload container image doesn't contain any secrets."}),(0,r.jsxs)(t.td,{children:["Within the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/policies",children:"runtime policies"})," and ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/architecture/attestation",children:"attestation"})]})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker modifies the workload image on disk after it was downloaded and measured."}),(0,r.jsx)(t.td,{children:"This threat is mitigated by a read-only partition that's integrity-protected. The workload image is protected by dm-verity."}),(0,r.jsxs)(t.td,{children:["Within the Contrast ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/runtime",children:"runtime environment"})]})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker modifies a container's runtime environment configuration in the Kubernetes control plane."}),(0,r.jsx)(t.td,{children:"The attestation process and the runtime policies detects unsafe configurations that load non-authentic images or perform any other modification to the expected runtime environment."}),(0,r.jsxs)(t.td,{children:["Within the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/policies",children:"runtime policies"})," and ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/architecture/attestation",children:"attestation"})]})]})]})]}),"\n",(0,r.jsx)(t.h4,{id:"attacks-on-the-coordinator-attestation-service",children:"Attacks on the Coordinator attestation service"}),"\n",(0,r.jsx)(t.p,{children:"This table describes potential threats and mitigation strategies to the attestation service."}),"\n",(0,r.jsxs)(t.table,{children:[(0,r.jsx)(t.thead,{children:(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.th,{children:"Threat"}),(0,r.jsx)(t.th,{children:"Mitigation"}),(0,r.jsx)(t.th,{children:"Mitigation implementation"})]})}),(0,r.jsxs)(t.tbody,{children:[(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker intercepts the Coordinator deployment and modifies the image or hijacks the runtime environment."}),(0,r.jsx)(t.td,{children:"This threat is mitigated by having an attestation procedure and attested, encrypted TLS connections to the Coordinator. The attestation evidence for the Coordinator image is distributed with our releases, protected by supply chain security, and fully reproducible."}),(0,r.jsxs)(t.td,{children:["Within the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/architecture/attestation",children:"attestation"})]})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker intercepts the network connection between the workload and the Coordinator and reads secret keys from the wire."}),(0,r.jsx)(t.td,{children:"This threat is mitigated by having an attested, encrypted TLS connection. This connection helps protect the secrets from passive eavesdropping. The attacker can't create valid workload certificates that would be accepted in Contrast's service mesh. An attacker can't impersonate a valid workload container because the container's identity is guaranteed by the attestation protocol."}),(0,r.jsx)(t.td,{children:"Within the network between your workload and the Coordinator."})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker exploits parsing discrepancies, which leads to undetected changes in the attestation process."}),(0,r.jsx)(t.td,{children:"This risk is mitigated by having a parsing engine written in memory-safe Go that's tested against the attestation specification of the hardware vendor. The runtime policies are available as an attestation artifact for further inspection and audits to verify their effectiveness."}),(0,r.jsxs)(t.td,{children:["Within the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/#the-coordinator",children:"Coordinator"})]})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker uses all service resources, which brings the Coordinator down in a denial of service (DoS) attack."}),(0,r.jsx)(t.td,{children:"In the future, this reliability risk is mitigated by having a distributed Coordinator service that can be easily replicated and scaled out as needed."}),(0,r.jsxs)(t.td,{children:["Within the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/#the-coordinator",children:"Coordinator"})]})]})]})]}),"\n",(0,r.jsx)(t.h4,{id:"attacks-on-workloads",children:"Attacks on workloads"}),"\n",(0,r.jsx)(t.p,{children:"This table describes potential threats and mitigation strategies related to workloads."}),"\n",(0,r.jsxs)(t.table,{children:[(0,r.jsx)(t.thead,{children:(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.th,{children:"Threat"}),(0,r.jsx)(t.th,{children:"Mitigation"}),(0,r.jsx)(t.th,{children:"Mitigation implementation"})]})}),(0,r.jsxs)(t.tbody,{children:[(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker intercepts the network connection between two workload containers."}),(0,r.jsx)(t.td,{children:"This threat is mitigated by having transparently encrypted TLS connections between the containers in your deployment."}),(0,r.jsxs)(t.td,{children:["Within the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/service-mesh",children:"service mesh"})]})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker reads or modifies data written to disk via persistent volumes."}),(0,r.jsx)(t.td,{children:"Currently, persistent volumes aren't supported in Contrast. In the future, this threat is mitigated by encrypted and integrity-protected volume mounts."}),(0,r.jsxs)(t.td,{children:["Within the Contrast ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/runtime",children:"runtime environment"})]})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker publishes a new image version containing malicious code."}),(0,r.jsx)(t.td,{children:"The attestation process and the runtime policies require a data owner to accept a specific version of the workload and any update to the workload needs to be explicitly acknowledged."}),(0,r.jsxs)(t.td,{children:["Within the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/architecture/attestation",children:"attestation"})]})]})]})]}),"\n",(0,r.jsx)(t.h2,{id:"examples-of-contrasts-threat-model-in-practice",children:"Examples of Contrast's threat model in practice"}),"\n",(0,r.jsx)(t.p,{children:"The following table describes three example use cases and how they map to the defined threat model in this document:"}),"\n",(0,r.jsxs)(t.table,{children:[(0,r.jsx)(t.thead,{children:(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.th,{children:"Use Case"}),(0,r.jsx)(t.th,{children:"Example Scenario"})]})}),(0,r.jsxs)(t.tbody,{children:[(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Migrate sensitive workloads to the cloud"}),(0,r.jsxs)(t.td,{children:["TechSolve Inc., a software development firm, aimed to enhance its defense-in-depth strategy for its cloud-based development environment, especially for projects involving proprietary algorithms and client data. TechSolve acts as the image provider, workload operator, and data owner, combining all three personas in this scenario. In our ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/architecture/attestation",children:"attestation terminology"}),", they're the workload operator and relying party in one entity. Their threat model includes a malicious cloud insider and cloud co-tenant."]})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Make your SaaS more trustworthy"}),(0,r.jsxs)(t.td,{children:["SaaSProviderX, a company offering cloud-based project management tools, sought to enhance its platform's trustworthiness amidst growing concerns about data breaches and privacy. Here, the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/architecture/attestation",children:"relying party"})," is the SaaS customer as the data owner. The goal is to achieve a form of operator exclusion and only allow selective operations on the deployment. Hence, their threat model includes a malicious workload operator."]})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Simplify regulatory compliance"}),(0,r.jsx)(t.td,{children:"HealthSecure Inc. has been managing a significant volume of sensitive patient data on-premises. With the increasing demand for advanced data analytics and the need for scalable infrastructure, the firm decides to migrate its data analytics operations to the cloud. However, the primary concern is maintaining the confidentiality and security of patient data during and after the migration, in compliance with healthcare regulations. In this compliance scenario, the regulator serves as an additional relying party. HealthSecure must implement a mechanism that ensures the isolation of patient data can be verifiably guaranteed to the regulator."})]})]})]}),"\n",(0,r.jsx)(t.p,{children:"In each scenario, Contrast ensures exclusive data access and processing capabilities are confined to the designated workloads. It achieves this by effectively isolating the workload from the infrastructure and other components of the stack. Data owners are granted the capability to audit and approve the deployment environment before submitting their data, ensuring a secure handover. Meanwhile, workload operators are equipped to manage and operate the application seamlessly, without requiring direct access to either the workload or its associated data."})]})}function l(e={}){const{wrapper:t}={...(0,a.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(h,{...e})}):h(e)}},95662:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/personas-1c9f2b217e0b94e0c3057df96d96b3f0.svg"},34696:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/tcb-eebc94816125417eaf55b0e5e96bba37.svg"},28453:(e,t,n)=>{n.d(t,{R:()=>s,x:()=>o});var i=n(96540);const r={},a=i.createContext(r);function s(e){const t=i.useContext(a);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:s(e.components),i.createElement(a.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/0e384e19.68c56d44.js b/pr-preview/pr-1071/assets/js/0e384e19.68c56d44.js
deleted file mode 100644
index 1f895a816e..0000000000
--- a/pr-preview/pr-1071/assets/js/0e384e19.68c56d44.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[3976],{73700:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>s,toc:()=>d});const s=JSON.parse('{"id":"intro","title":"Contrast","description":"Welcome to the documentation of Contrast! Contrast runs confidential container deployments on Kubernetes at scale.","source":"@site/docs/intro.md","sourceDirName":".","slug":"/","permalink":"/contrast/pr-preview/pr-1071/next/","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/docs/intro.md","tags":[],"version":"current","frontMatter":{"slug":"/","id":"intro"},"sidebar":"docs","next":{"title":"Confidential Containers","permalink":"/contrast/pr-preview/pr-1071/next/basics/confidential-containers"}}');var r=n(74848),i=n(28453);const o={slug:"/",id:"intro"},a="Contrast",c={},d=[{value:"Goal",id:"goal",level:2},{value:"Use Cases",id:"use-cases",level:2},{value:"Next steps",id:"next-steps",level:2}];function l(e){const t={a:"a",admonition:"admonition",em:"em",h1:"h1",h2:"h2",header:"header",img:"img",li:"li",p:"p",ul:"ul",...(0,i.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.header,{children:(0,r.jsx)(t.h1,{id:"contrast",children:"Contrast"})}),"\n",(0,r.jsx)(t.p,{children:"Welcome to the documentation of Contrast! Contrast runs confidential container deployments on Kubernetes at scale."}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Contrast concept",src:n(96274).A+"",width:"1644",height:"764"})}),"\n",(0,r.jsxs)(t.p,{children:["Contrast is based on the ",(0,r.jsx)(t.a,{href:"https://github.com/kata-containers/kata-containers",children:"Kata Containers"})," and\n",(0,r.jsx)(t.a,{href:"https://github.com/confidential-containers",children:"Confidential Containers"})," projects.\nConfidential Containers are Kubernetes pods that are executed inside a confidential micro-VM and provide strong hardware-based isolation from the surrounding environment.\nThis works with unmodified containers in a lift-and-shift approach.\nContrast currently targets the ",(0,r.jsx)(t.a,{href:"https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers-on-aks-preview",children:"CoCo preview on AKS"}),"."]}),"\n",(0,r.jsx)(t.admonition,{type:"tip",children:(0,r.jsxs)(t.p,{children:["See the \ud83d\udcc4",(0,r.jsx)(t.a,{href:"https://content.edgeless.systems/hubfs/Confidential%20Computing%20Whitepaper.pdf",children:"whitepaper"})," for more information on confidential computing."]})}),"\n",(0,r.jsx)(t.h2,{id:"goal",children:"Goal"}),"\n",(0,r.jsx)(t.p,{children:"Contrast is designed to keep all data always encrypted and to prevent access from the infrastructure layer. It removes the infrastructure provider from the trusted computing base (TCB). This includes access from datacenter employees, privileged cloud admins, own cluster administrators, and attackers coming through the infrastructure, for example, malicious co-tenants escalating their privileges."}),"\n",(0,r.jsx)(t.p,{children:"Contrast integrates fluently with the existing Kubernetes workflows. It's compatible with managed Kubernetes, can be installed as a day-2 operation and imposes only minimal changes to your deployment flow."}),"\n",(0,r.jsx)(t.h2,{id:"use-cases",children:"Use Cases"}),"\n",(0,r.jsxs)(t.p,{children:["Contrast provides unique security ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/next/basics/features",children:"features"})," and ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/next/basics/security-benefits",children:"benefits"}),". The core use cases are:"]}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"Increasing the security of your containers"}),"\n",(0,r.jsx)(t.li,{children:"Moving sensitive workloads from on-prem to the cloud with Confidential Computing"}),"\n",(0,r.jsx)(t.li,{children:"Shielding the code and data even from the own cluster administrators"}),"\n",(0,r.jsx)(t.li,{children:"Increasing the trustworthiness of your SaaS offerings"}),"\n",(0,r.jsx)(t.li,{children:"Simplifying regulatory compliance"}),"\n",(0,r.jsx)(t.li,{children:"Multi-party computation for data collaboration"}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"next-steps",children:"Next steps"}),"\n",(0,r.jsxs)(t.p,{children:["You can learn more about the concept of ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/next/basics/confidential-containers",children:"Confidential Containers"}),", ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/next/basics/features",children:"features"}),", and ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/next/basics/security-benefits",children:"security benefits"})," of Contrast in this section. To jump right into the action head to ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/next/getting-started/install",children:(0,r.jsx)(t.em,{children:"Getting started"})}),"."]})]})}function h(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(l,{...e})}):l(e)}},96274:(e,t,n)=>{n.d(t,{A:()=>s});const s=n.p+"assets/images/concept-c1792eb1b8f3959308512d1e518b0176.svg"},28453:(e,t,n)=>{n.d(t,{R:()=>o,x:()=>a});var s=n(96540);const r={},i=s.createContext(r);function o(e){const t=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),s.createElement(i.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/10257d90.4ab1db5d.js b/pr-preview/pr-1071/assets/js/10257d90.4ab1db5d.js
deleted file mode 100644
index 7babb8edbe..0000000000
--- a/pr-preview/pr-1071/assets/js/10257d90.4ab1db5d.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[3477],{45013:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>o,default:()=>l,frontMatter:()=>s,metadata:()=>i,toc:()=>d});const i=JSON.parse('{"id":"basics/security-benefits","title":"Contrast security overview","description":"This document outlines the security measures of Contrast and its capability to counter various threats.","source":"@site/versioned_docs/version-1.1/basics/security-benefits.md","sourceDirName":"basics","slug":"/basics/security-benefits","permalink":"/contrast/pr-preview/pr-1071/1.1/basics/security-benefits","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-1.1/basics/security-benefits.md","tags":[],"version":"1.1","frontMatter":{},"sidebar":"docs","previous":{"title":"Confidential Containers","permalink":"/contrast/pr-preview/pr-1071/1.1/basics/confidential-containers"},"next":{"title":"Features","permalink":"/contrast/pr-preview/pr-1071/1.1/basics/features"}}');var r=n(74848),a=n(28453);const s={},o="Contrast security overview",c={},d=[{value:"Confidential computing foundation",id:"confidential-computing-foundation",level:2},{value:"Components of a Contrast deployment",id:"components-of-a-contrast-deployment",level:2},{value:"Personas in a Contrast deployment",id:"personas-in-a-contrast-deployment",level:2},{value:"Threat model and mitigations",id:"threat-model-and-mitigations",level:2},{value:"Possible attacks",id:"possible-attacks",level:3},{value:"Attack surfaces",id:"attack-surfaces",level:3},{value:"Threats and mitigations",id:"threats-and-mitigations",level:3},{value:"Attacks on the confidential container environment",id:"attacks-on-the-confidential-container-environment",level:4},{value:"Attacks on the Coordinator attestation service",id:"attacks-on-the-coordinator-attestation-service",level:4},{value:"Attacks on workloads",id:"attacks-on-workloads",level:4},{value:"Examples of Contrast's threat model in practice",id:"examples-of-contrasts-threat-model-in-practice",level:2}];function h(e){const t={a:"a",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",header:"header",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,a.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.header,{children:(0,r.jsx)(t.h1,{id:"contrast-security-overview",children:"Contrast security overview"})}),"\n",(0,r.jsx)(t.p,{children:"This document outlines the security measures of Contrast and its capability to counter various threats.\nContrast is designed to shield entire Kubernetes deployments from the infrastructure, enabling entities to manage sensitive information (such as regulated or personally identifiable information (PII)) in the public cloud, while maintaining data confidentiality and ownership."}),"\n",(0,r.jsx)(t.p,{children:"Contrast is applicable in situations where establishing trust with the workload operator or the underlying infrastructure is challenging.\nThis is particularly beneficial for regulated sectors looking to transition sensitive activities to the cloud, without sacrificing security or compliance.\nIt allows for cloud adoption by maintaining a hardware-based separation from the cloud service provider."}),"\n",(0,r.jsx)(t.h2,{id:"confidential-computing-foundation",children:"Confidential computing foundation"}),"\n",(0,r.jsx)(t.p,{children:"Leveraging Confidential Computing technology, Contrast provides three defining security properties:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Encryption of data in use"}),": Contrast ensures that all data processed in memory is encrypted, making it inaccessible to unauthorized users or systems, even if they have physical access to the hardware."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Workload isolation"}),": Each pod runs in its isolated runtime environment, preventing any cross-contamination between workloads, which is critical for multi-tenant infrastructures."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Remote attestation"}),": This feature allows data owners and workload operators to verify that the Contrast environment executing their workloads hasn't been tampered with and is running in a secure, pre-approved configuration."]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"The runtime encryption is transparently provided by the confidential computing hardware during the workload's lifetime.\nThe workload isolation and remote attestation involves two phases:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"An attestation process detects modifications to the workload image or its runtime environment during the initialization. This protects the workload's integrity pre-attestation."}),"\n",(0,r.jsx)(t.li,{children:"A protected runtime environment and a policy mechanism prevents the platform operator from accessing or compromising the instance at runtime. This protects a workload's integrity and confidentiality post-attestation."}),"\n"]}),"\n",(0,r.jsxs)(t.p,{children:["For more details on confidential computing see our ",(0,r.jsx)(t.a,{href:"https://content.edgeless.systems/hubfs/Confidential%20Computing%20Whitepaper.pdf",children:"whitepaper"}),".\nThe ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/architecture/attestation",children:"attestation architecture"})," describes Contrast's attestation process and the resulting chain of trust in detail."]}),"\n",(0,r.jsx)(t.h2,{id:"components-of-a-contrast-deployment",children:"Components of a Contrast deployment"}),"\n",(0,r.jsxs)(t.p,{children:["Contrast uses the Kubernetes runtime of the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/basics/confidential-containers",children:"Confidential Containers"})," project.\nConfidential Containers significantly decrease the size of the trusted computing base (TCB) of a Kubernetes deployment, by isolating each pod within its own confidential micro-VM environment.\nThe TCB is the totality of elements in a computing environment that must be trusted not to be compromised.\nA smaller TCB results in a smaller attack surface. The following diagram shows how Confidential Containers remove the ",(0,r.jsx)(t.em,{children:"cloud & datacenter infrastructure"})," and the ",(0,r.jsx)(t.em,{children:"physical hosts"}),", including the hypervisor, the host OS, the Kubernetes control plane, and other components, from the TCB (red).\nIn the confidential context, depicted in green, only the workload containers along with their confidential micro-VM environment are included within the TCB.\nTheir integrity is ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/architecture/attestation",children:"verifiable through remote attestation"}),"."]}),"\n",(0,r.jsxs)(t.p,{children:["Contrast uses ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/basics/confidential-containers",children:"hardware-based mechanisms"}),", specifically leveraging CPU features, such as AMD SEV or Intel TDX, to provide the isolation of the workload.\nThis implies that both the CPU and its microcode are integral components of the TCB.\nHowever, it should be noted that the CPU microcode aspects aren't depicted in the accompanying graphic."]}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"TCB comparison",src:n(94074).A+"",width:"4052",height:"1380"})}),"\n",(0,r.jsx)(t.p,{children:"Contrast adds the following components to a deployment that become part of the TCB.\nThe components that are part of the TCB are:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"The workload containers"}),": Container images that run the actual application."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/runtime",children:"The runtime environment"})}),": The confidential micro-VM that acts as the container runtime."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/service-mesh",children:"The sidecar containers"})}),": Containers that provide additional functionality such as ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/overview#the-initializer",children:"initialization"})," and ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/service-mesh",children:"service mesh"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/policies",children:"The runtime policies"})}),": Policies that enforce the runtime environments for the workload containers during their lifetime."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/overview#the-manifest",children:"The manifest"})}),": A manifest file defining the reference values of an entire confidential deployment. It contains the policy hashes for all pods of the deployment and the expected hardware reference values for the Confidential Container runtime."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/overview#the-coordinator",children:"The Coordinator"})}),": An attestation service that runs in a Confidential Container in the Kubernetes cluster. The Coordinator is configured with the manifest. User-facing, you can verify this service and the effective manifest using remote attestation, providing you with a concise attestation for the entire deployment. Cluster-facing, it verifies all pods and their policies based on remote attestation procedures and the manifest."]}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"personas-in-a-contrast-deployment",children:"Personas in a Contrast deployment"}),"\n",(0,r.jsx)(t.p,{children:"In a Contrast deployment, there are three parties:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"The container image provider"}),", who creates the container images that represent the application that has access to the protected data."]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"The workload operator"}),", who runs the workload in a Kubernetes cluster. The operator typically has full administrative privileges to the deployment. The operator can manage cluster resources such as nodes, volumes, and networking rules, and the operator can interact with any Kubernetes or underlying cloud API."]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"The data owner"}),", who owns the protected data. A data owner can verify the deployment using the Coordinator attestation service. The verification includes the identity, integrity, and confidentiality of the workloads, the runtime environment and the access permissions."]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Contrast supports a trust model where the container image provider, workload operator, and data owner are separate, mutually distrusting parties."}),"\n",(0,r.jsx)(t.p,{children:"The following diagram shows the system components and parties."}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Components and parties",src:n(72168).A+"",width:"3588",height:"2017"})}),"\n",(0,r.jsx)(t.h2,{id:"threat-model-and-mitigations",children:"Threat model and mitigations"}),"\n",(0,r.jsx)(t.p,{children:"This section describes the threat vectors that Contrast helps to mitigate."}),"\n",(0,r.jsx)(t.p,{children:"The following attacks are out of scope for this document:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"Attacks on the application code itself, such as insufficient access controls."}),"\n",(0,r.jsx)(t.li,{children:"Attacks on the Confidential Computing hardware directly, such as side-channel attacks."}),"\n",(0,r.jsx)(t.li,{children:"Attacks on the availability, such as denial-of-service (DOS) attacks."}),"\n"]}),"\n",(0,r.jsx)(t.h3,{id:"possible-attacks",children:"Possible attacks"}),"\n",(0,r.jsx)(t.p,{children:"Contrast is designed to defend against five possible attacks:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"A malicious cloud insider"}),": malicious employees or third-party contractors of cloud service providers (CSPs) potentially have full access to various layers of the cloud infrastructure. That goes from the physical datacenter up to the hypervisor and Kubernetes layer. For example, they can access the physical memory of the machines, modify the hypervisor, modify disk contents, intercept network communications, and attempt to compromise the confidential container at runtime. A malicious insider can expand the attack surface or restrict the runtime environment. For example, a malicious operator can add a storage device to introduce new attack vectors. As another example, a malicious operator can constrain resources such as limiting a guest's memory size, changing its disk space, or changing firewall rules."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"A malicious cloud co-tenant"}),': malicious cloud user ("hackers") may break out of their tenancy and access other tenants\' data. Advanced attackers may even be able to establish a permanent foothold within the infrastructure and access data over a longer period. The threats are analogous to the ',(0,r.jsx)(t.em,{children:"cloud insider access"})," scenario, without the physical access."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"A malicious workload operator"}),": malicious workload operators, for example Kubernetes administrators, have full access to the workload deployment and the underlying Kubernetes platform. The threats are analogously to the ",(0,r.jsx)(t.em,{children:"cloud insider access"})," scenario, with access to everything that's above the hypervisor level."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"A malicious attestation client"}),": this attacker connects to the attestation service and sends malformed request."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"A malicious container image provider"}),": a malicious container image provider has full control over the application development itself. This attacker might release a malicious version of the workload containing harmful operations."]}),"\n"]}),"\n",(0,r.jsx)(t.h3,{id:"attack-surfaces",children:"Attack surfaces"}),"\n",(0,r.jsx)(t.p,{children:"The following table describes the attack surfaces that are available to attackers."}),"\n",(0,r.jsxs)(t.table,{children:[(0,r.jsx)(t.thead,{children:(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.th,{children:"Attacker"}),(0,r.jsx)(t.th,{children:"Target"}),(0,r.jsx)(t.th,{children:"Attack surface"}),(0,r.jsx)(t.th,{children:"Risks"})]})}),(0,r.jsxs)(t.tbody,{children:[(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Cloud insider"}),(0,r.jsx)(t.td,{children:"Confidential Container, Workload"}),(0,r.jsx)(t.td,{children:"Physical memory"}),(0,r.jsx)(t.td,{children:"Attacker can dump the physical memory of the workloads."})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Cloud insider, cloud hacker, workload operator"}),(0,r.jsx)(t.td,{children:"Confidential Container, Workload"}),(0,r.jsx)(t.td,{children:"Disk reads"}),(0,r.jsx)(t.td,{children:"Anything read from the disk is within the attacker's control."})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Cloud insider, cloud hacker, workload operator"}),(0,r.jsx)(t.td,{children:"Confidential Container, Workload"}),(0,r.jsx)(t.td,{children:"Disk writes"}),(0,r.jsx)(t.td,{children:"Anything written to disk is visible to an attacker."})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Cloud insider, cloud hacker, workload operator"}),(0,r.jsx)(t.td,{children:"Confidential Container, Workload"}),(0,r.jsx)(t.td,{children:"Kubernetes Control Plane"}),(0,r.jsx)(t.td,{children:"Instance attributes read from the Kubernetes control plane, including mount points and environment variables, are within the attacker's control."})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Cloud insider, cloud hacker, workload operator"}),(0,r.jsx)(t.td,{children:"Confidential Container, Workload"}),(0,r.jsx)(t.td,{children:"Container Runtime"}),(0,r.jsx)(t.td,{children:'The attacker can use container runtime APIs (for example "kubectl exec") to perform operations on the workload container.'})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Cloud insider, cloud hacker, workload operator"}),(0,r.jsx)(t.td,{children:"Confidential Container, Workload"}),(0,r.jsx)(t.td,{children:"Network"}),(0,r.jsx)(t.td,{children:"Intra-deployment (between containers) as well as external network connections to the image repository or attestation service can be intercepted."})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Attestation client"}),(0,r.jsx)(t.td,{children:"Coordinator attestation service"}),(0,r.jsx)(t.td,{children:"Attestation requests"}),(0,r.jsx)(t.td,{children:"The attestation service has complex, crypto-heavy logic that's challenging to write defensively."})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Container image provider"}),(0,r.jsx)(t.td,{children:"Workload"}),(0,r.jsx)(t.td,{children:"Workload"}),(0,r.jsx)(t.td,{children:"This attacker might release an upgrade to the workload containing harmful changes, such as a backdoor."})]})]})]}),"\n",(0,r.jsx)(t.h3,{id:"threats-and-mitigations",children:"Threats and mitigations"}),"\n",(0,r.jsx)(t.p,{children:"Contrast shields a workload from the aforementioned threats with three main components:"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["The ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/runtime",children:"runtime environment"})," safeguards against the physical memory and disk attack surface."]}),"\n",(0,r.jsxs)(t.li,{children:["The ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/policies",children:"runtime policies"})," safeguard against the Kubernetes control plane and container runtime attack surface."]}),"\n",(0,r.jsxs)(t.li,{children:["The ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/service-mesh",children:"service mesh"})," safeguards against the network attack surface."]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"The following tables describe concrete threats and how they're mitigated in Contrast grouped by these categories:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"Attacks on the confidential container environment"}),"\n",(0,r.jsx)(t.li,{children:"Attacks on the attestation service"}),"\n",(0,r.jsx)(t.li,{children:"Attacks on workloads"}),"\n"]}),"\n",(0,r.jsx)(t.h4,{id:"attacks-on-the-confidential-container-environment",children:"Attacks on the confidential container environment"}),"\n",(0,r.jsx)(t.p,{children:"This table describes potential threats and mitigation strategies related to the confidential container environment."}),"\n",(0,r.jsxs)(t.table,{children:[(0,r.jsx)(t.thead,{children:(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.th,{children:"Threat"}),(0,r.jsx)(t.th,{children:"Mitigation"}),(0,r.jsx)(t.th,{children:"Mitigation implementation"})]})}),(0,r.jsxs)(t.tbody,{children:[(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker intercepts the network connection of the launcher or image repository."}),(0,r.jsx)(t.td,{children:"An attacker can change the image URL and control the workload binary. However these actions are reflected in the attestation report. The image repository isn't controlled using an access list, therefore the image is assumed to be viewable by everyone. You must ensure that the workload container image doesn't contain any secrets."}),(0,r.jsxs)(t.td,{children:["Within the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/policies",children:"runtime policies"})," and ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/architecture/attestation",children:"attestation"})]})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker modifies the workload image on disk after it was downloaded and measured."}),(0,r.jsx)(t.td,{children:"This threat is mitigated by a read-only partition that's integrity-protected. The workload image is protected by dm-verity."}),(0,r.jsxs)(t.td,{children:["Within the Contrast ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/runtime",children:"runtime environment"})]})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker modifies a container's runtime environment configuration in the Kubernetes control plane."}),(0,r.jsx)(t.td,{children:"The attestation process and the runtime policies detects unsafe configurations that load non-authentic images or perform any other modification to the expected runtime environment."}),(0,r.jsxs)(t.td,{children:["Within the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/policies",children:"runtime policies"})," and ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/architecture/attestation",children:"attestation"})]})]})]})]}),"\n",(0,r.jsx)(t.h4,{id:"attacks-on-the-coordinator-attestation-service",children:"Attacks on the Coordinator attestation service"}),"\n",(0,r.jsx)(t.p,{children:"This table describes potential threats and mitigation strategies to the attestation service."}),"\n",(0,r.jsxs)(t.table,{children:[(0,r.jsx)(t.thead,{children:(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.th,{children:"Threat"}),(0,r.jsx)(t.th,{children:"Mitigation"}),(0,r.jsx)(t.th,{children:"Mitigation implementation"})]})}),(0,r.jsxs)(t.tbody,{children:[(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker intercepts the Coordinator deployment and modifies the image or hijacks the runtime environment."}),(0,r.jsx)(t.td,{children:"This threat is mitigated by having an attestation procedure and attested, encrypted TLS connections to the Coordinator. The attestation evidence for the Coordinator image is distributed with our releases, protected by supply chain security, and fully reproducible."}),(0,r.jsxs)(t.td,{children:["Within the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/architecture/attestation",children:"attestation"})]})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker intercepts the network connection between the workload and the Coordinator and reads secret keys from the wire."}),(0,r.jsx)(t.td,{children:"This threat is mitigated by having an attested, encrypted TLS connection. This connection helps protect the secrets from passive eavesdropping. The attacker can't create valid workload certificates that would be accepted in Contrast's service mesh. An attacker can't impersonate a valid workload container because the container's identity is guaranteed by the attestation protocol."}),(0,r.jsx)(t.td,{children:"Within the network between your workload and the Coordinator."})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker exploits parsing discrepancies, which leads to undetected changes in the attestation process."}),(0,r.jsx)(t.td,{children:"This risk is mitigated by having a parsing engine written in memory-safe Go that's tested against the attestation specification of the hardware vendor. The runtime policies are available as an attestation artifact for further inspection and audits to verify their effectiveness."}),(0,r.jsxs)(t.td,{children:["Within the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/overview#the-coordinator",children:"Coordinator"})]})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker uses all service resources, which brings the Coordinator down in a denial of service (DoS) attack."}),(0,r.jsx)(t.td,{children:"In the future, this reliability risk is mitigated by having a distributed Coordinator service that can be easily replicated and scaled out as needed."}),(0,r.jsxs)(t.td,{children:["Within the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/overview#the-coordinator",children:"Coordinator"})]})]})]})]}),"\n",(0,r.jsx)(t.h4,{id:"attacks-on-workloads",children:"Attacks on workloads"}),"\n",(0,r.jsx)(t.p,{children:"This table describes potential threats and mitigation strategies related to workloads."}),"\n",(0,r.jsxs)(t.table,{children:[(0,r.jsx)(t.thead,{children:(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.th,{children:"Threat"}),(0,r.jsx)(t.th,{children:"Mitigation"}),(0,r.jsx)(t.th,{children:"Mitigation implementation"})]})}),(0,r.jsxs)(t.tbody,{children:[(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker intercepts the network connection between two workload containers."}),(0,r.jsx)(t.td,{children:"This threat is mitigated by having transparently encrypted TLS connections between the containers in your deployment."}),(0,r.jsxs)(t.td,{children:["Within the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/service-mesh",children:"service mesh"})]})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker reads or modifies data written to disk via persistent volumes."}),(0,r.jsx)(t.td,{children:"Currently, persistent volumes aren't supported in Contrast. In the future, this threat is mitigated by encrypted and integrity-protected volume mounts."}),(0,r.jsxs)(t.td,{children:["Within the Contrast ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/runtime",children:"runtime environment"})]})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"An attacker publishes a new image version containing malicious code."}),(0,r.jsx)(t.td,{children:"The attestation process and the runtime policies require a data owner to accept a specific version of the workload and any update to the workload needs to be explicitly acknowledged."}),(0,r.jsxs)(t.td,{children:["Within the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/architecture/attestation",children:"attestation"})]})]})]})]}),"\n",(0,r.jsx)(t.h2,{id:"examples-of-contrasts-threat-model-in-practice",children:"Examples of Contrast's threat model in practice"}),"\n",(0,r.jsx)(t.p,{children:"The following table describes three example use cases and how they map to the defined threat model in this document:"}),"\n",(0,r.jsxs)(t.table,{children:[(0,r.jsx)(t.thead,{children:(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.th,{children:"Use Case"}),(0,r.jsx)(t.th,{children:"Example Scenario"})]})}),(0,r.jsxs)(t.tbody,{children:[(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Migrate sensitive workloads to the cloud"}),(0,r.jsxs)(t.td,{children:["TechSolve Inc., a software development firm, aimed to enhance its defense-in-depth strategy for its cloud-based development environment, especially for projects involving proprietary algorithms and client data. TechSolve acts as the image provider, workload operator, and data owner, combining all three personas in this scenario. In our ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/architecture/attestation",children:"attestation terminology"}),", they're the workload operator and relying party in one entity. Their threat model includes a malicious cloud insider and cloud co-tenant."]})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Make your SaaS more trustworthy"}),(0,r.jsxs)(t.td,{children:["SaaSProviderX, a company offering cloud-based project management tools, sought to enhance its platform's trustworthiness amidst growing concerns about data breaches and privacy. Here, the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/architecture/attestation",children:"relying party"})," is the SaaS customer as the data owner. The goal is to achieve a form of operator exclusion and only allow selective operations on the deployment. Hence, their threat model includes a malicious workload operator."]})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"Simplify regulatory compliance"}),(0,r.jsx)(t.td,{children:"HealthSecure Inc. has been managing a significant volume of sensitive patient data on-premises. With the increasing demand for advanced data analytics and the need for scalable infrastructure, the firm decides to migrate its data analytics operations to the cloud. However, the primary concern is maintaining the confidentiality and security of patient data during and after the migration, in compliance with healthcare regulations. In this compliance scenario, the regulator serves as an additional relying party. HealthSecure must implement a mechanism that ensures the isolation of patient data can be verifiably guaranteed to the regulator."})]})]})]}),"\n",(0,r.jsx)(t.p,{children:"In each scenario, Contrast ensures exclusive data access and processing capabilities are confined to the designated workloads. It achieves this by effectively isolating the workload from the infrastructure and other components of the stack. Data owners are granted the capability to audit and approve the deployment environment before submitting their data, ensuring a secure handover. Meanwhile, workload operators are equipped to manage and operate the application seamlessly, without requiring direct access to either the workload or its associated data."})]})}function l(e={}){const{wrapper:t}={...(0,a.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(h,{...e})}):h(e)}},72168:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/personas-0d51d0cc03b37c9f45b914bbea163646.svg"},94074:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/tcb-eebc94816125417eaf55b0e5e96bba37.svg"},28453:(e,t,n)=>{n.d(t,{R:()=>s,x:()=>o});var i=n(96540);const r={},a=i.createContext(r);function s(e){const t=i.useContext(a);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:s(e.components),i.createElement(a.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/1057c3b3.c2e3952a.js b/pr-preview/pr-1071/assets/js/1057c3b3.c2e3952a.js
deleted file mode 100644
index bfe8639122..0000000000
--- a/pr-preview/pr-1071/assets/js/1057c3b3.c2e3952a.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[5811],{26033:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>r,metadata:()=>s,toc:()=>d});const s=JSON.parse('{"id":"basics/confidential-containers","title":"Confidential Containers","description":"Contrast uses some building blocks from Confidential Containers (CoCo), a CNCF Sandbox project that aims to standardize confidential computing at the pod level.","source":"@site/versioned_docs/version-1.1/basics/confidential-containers.md","sourceDirName":"basics","slug":"/basics/confidential-containers","permalink":"/contrast/pr-preview/pr-1071/1.1/basics/confidential-containers","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-1.1/basics/confidential-containers.md","tags":[],"version":"1.1","frontMatter":{},"sidebar":"docs","previous":{"title":"What is Contrast?","permalink":"/contrast/pr-preview/pr-1071/1.1/"},"next":{"title":"Security benefits","permalink":"/contrast/pr-preview/pr-1071/1.1/basics/security-benefits"}}');var i=t(74848),o=t(28453);const r={},a="Confidential Containers",c={},d=[{value:"Kubernetes RuntimeClass",id:"kubernetes-runtimeclass",level:2},{value:"Kata Containers",id:"kata-containers",level:2},{value:"AKS CoCo preview",id:"aks-coco-preview",level:2}];function l(e){const n={a:"a",code:"code",h1:"h1",h2:"h2",header:"header",p:"p",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.header,{children:(0,i.jsx)(n.h1,{id:"confidential-containers",children:"Confidential Containers"})}),"\n",(0,i.jsxs)(n.p,{children:["Contrast uses some building blocks from ",(0,i.jsx)(n.a,{href:"https://confidentialcontainers.org",children:"Confidential Containers"})," (CoCo), a ",(0,i.jsx)(n.a,{href:"https://www.cncf.io/projects/confidential-containers/",children:"CNCF Sandbox project"})," that aims to standardize confidential computing at the pod level.\nThe project is under active development and many of the high-level features are still in flux.\nContrast uses the more stable core primitive provided by CoCo: its Kubernetes runtime."]}),"\n",(0,i.jsx)(n.h2,{id:"kubernetes-runtimeclass",children:"Kubernetes RuntimeClass"}),"\n",(0,i.jsxs)(n.p,{children:["Kubernetes can be extended to use more than one container runtime with ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/containers/runtime-class/",children:(0,i.jsx)(n.code,{children:"RuntimeClass"})})," objects.\nThe ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/architecture/cri/",children:"Container Runtime Interface"})," (CRI) implementation, for example containerd, dispatches pod management API calls to the appropriate ",(0,i.jsx)(n.code,{children:"RuntimeClass"}),".\n",(0,i.jsx)(n.code,{children:"RuntimeClass"})," implementations are usually based on an ",(0,i.jsx)(n.a,{href:"https://github.com/opencontainers/runtime-spec",children:"OCI runtime"}),", such as ",(0,i.jsx)(n.code,{children:"runc"}),", ",(0,i.jsx)(n.code,{children:"runsc"})," or ",(0,i.jsx)(n.code,{children:"crun"}),".\nIn CoCo's case, the runtime is Kata Containers with added confidential computing capabilities."]}),"\n",(0,i.jsx)(n.h2,{id:"kata-containers",children:"Kata Containers"}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"https://katacontainers.io/",children:"Kata Containers"})," is an OCI runtime that runs pods in VMs.\nThe pod VM spawns an agent process that accepts management commands from the Kata runtime running on the host.\nThere are two options for creating pod VMs: local to the Kubernetes node, or remote VMs created with cloud provider APIs.\nUsing local VMs requires either bare-metal servers or VMs with support for nested virtualization.\nLocal VMs communicate with the host over a virtual socket.\nFor remote VMs, host-to-agent communication is tunnelled through the cloud provider's network."]}),"\n",(0,i.jsxs)(n.p,{children:["Kata Containers was originally designed to isolate the guest from the host, but it can also run pods in confidential VMs (CVMs) to shield pods from their underlying infrastructure.\nIn confidential mode, the guest agent is configured with an ",(0,i.jsx)(n.a,{href:"https://www.openpolicyagent.org/",children:"Open Policy Agent"})," (OPA) policy to authorize API calls from the host.\nThis policy also contains checksums for the expected container images.\nIt's derived from Kubernetes resource definitions and its checksum is included in the attestation report."]}),"\n",(0,i.jsx)(n.h2,{id:"aks-coco-preview",children:"AKS CoCo preview"}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/azure/aks/",children:"Azure Kubernetes Service"})," (AKS) provides CoCo-enabled node pools as a ",(0,i.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/azure/aks/confidential-containers-overview",children:"preview offering"}),".\nThese node pools leverage Azure VM types capable of nested virtualization (CVM-in-VM) and the CoCo stack is pre-installed.\nContrast can be deployed directly into a CoCo-enabled AKS cluster."]})]})}function h(e={}){const{wrapper:n}={...(0,o.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},28453:(e,n,t)=>{t.d(n,{R:()=>r,x:()=>a});var s=t(96540);const i={},o=s.createContext(i);function r(e){const n=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),s.createElement(o.Provider,{value:n},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/1478.f7519b53.js b/pr-preview/pr-1071/assets/js/1478.f7519b53.js
deleted file mode 100644
index 68543d3778..0000000000
--- a/pr-preview/pr-1071/assets/js/1478.f7519b53.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[1478],{96474:(t,e,s)=>{s.d(e,{A:()=>u,P:()=>a});var n=s(10009),i=s(20007),u=(0,n.K2)(((t,e)=>{let s;"sandbox"===e&&(s=(0,i.Ltv)("#i"+t));return("sandbox"===e?(0,i.Ltv)(s.nodes()[0].contentDocument.body):(0,i.Ltv)("body")).select(`[id="${t}"]`)}),"getDiagramElement"),a=(0,n.K2)(((t,e,s,i)=>{t.attr("class",s);const{width:u,height:a,x:l,y:c}=r(t,e);(0,n.a$)(t,a,u,i);const h=o(l,c,u,a,e);t.attr("viewBox",h),n.Rm.debug(`viewBox configured: ${h} with padding: ${e}`)}),"setupViewPortForSVG"),r=(0,n.K2)(((t,e)=>{const s=t.node()?.getBBox()||{width:0,height:0,x:0,y:0};return{width:s.width+2*e,height:s.height+2*e,x:s.x,y:s.y}}),"calculateDimensionsWithPadding"),o=(0,n.K2)(((t,e,s,n,i)=>`${t-i} ${e-i} ${s} ${n}`),"createViewBox")},66240:(t,e,s)=>{s.d(e,{Lh:()=>ot,_$:()=>l,tM:()=>at,z2:()=>ut});var n=s(96474),i=s(87308),u=s(8159),a=s(10009),r=s(20007),o=function(){var t=(0,a.K2)((function(t,e,s,n){for(s=s||{},n=t.length;n--;s[t[n]]=e);return s}),"o"),e=[1,18],s=[1,19],n=[1,20],i=[1,41],u=[1,42],r=[1,26],o=[1,24],l=[1,25],c=[1,32],h=[1,33],p=[1,34],d=[1,45],A=[1,35],y=[1,36],g=[1,37],m=[1,38],C=[1,27],f=[1,28],E=[1,29],b=[1,30],k=[1,31],T=[1,44],D=[1,46],F=[1,43],B=[1,47],_=[1,9],S=[1,8,9],N=[1,58],L=[1,59],$=[1,60],x=[1,61],O=[1,62],v=[1,63],I=[1,64],K=[1,8,9,41],w=[1,76],R=[1,8,9,12,13,22,39,41,44,66,67,68,69,70,71,72,77,79],P=[1,8,9,12,13,17,20,22,39,41,44,48,58,66,67,68,69,70,71,72,77,79,84,99,101,102],M=[13,58,84,99,101,102],G=[13,58,71,72,84,99,101,102],U=[13,58,66,67,68,69,70,84,99,101,102],Y=[1,98],z=[1,115],Q=[1,107],W=[1,113],X=[1,108],j=[1,109],V=[1,110],q=[1,111],H=[1,112],J=[1,114],Z=[22,58,59,80,84,85,86,87,88,89],tt=[1,8,9,39,41,44],et=[1,8,9,22],st=[1,143],nt=[1,8,9,59],it=[1,8,9,22,58,59,80,84,85,86,87,88,89],ut={trace:(0,a.K2)((function(){}),"trace"),yy:{},symbols_:{error:2,start:3,mermaidDoc:4,statements:5,graphConfig:6,CLASS_DIAGRAM:7,NEWLINE:8,EOF:9,statement:10,classLabel:11,SQS:12,STR:13,SQE:14,namespaceName:15,alphaNumToken:16,DOT:17,className:18,classLiteralName:19,GENERICTYPE:20,relationStatement:21,LABEL:22,namespaceStatement:23,classStatement:24,memberStatement:25,annotationStatement:26,clickStatement:27,styleStatement:28,cssClassStatement:29,noteStatement:30,classDefStatement:31,direction:32,acc_title:33,acc_title_value:34,acc_descr:35,acc_descr_value:36,acc_descr_multiline_value:37,namespaceIdentifier:38,STRUCT_START:39,classStatements:40,STRUCT_STOP:41,NAMESPACE:42,classIdentifier:43,STYLE_SEPARATOR:44,members:45,CLASS:46,ANNOTATION_START:47,ANNOTATION_END:48,MEMBER:49,SEPARATOR:50,relation:51,NOTE_FOR:52,noteText:53,NOTE:54,CLASSDEF:55,classList:56,stylesOpt:57,ALPHA:58,COMMA:59,direction_tb:60,direction_bt:61,direction_rl:62,direction_lr:63,relationType:64,lineType:65,AGGREGATION:66,EXTENSION:67,COMPOSITION:68,DEPENDENCY:69,LOLLIPOP:70,LINE:71,DOTTED_LINE:72,CALLBACK:73,LINK:74,LINK_TARGET:75,CLICK:76,CALLBACK_NAME:77,CALLBACK_ARGS:78,HREF:79,STYLE:80,CSSCLASS:81,style:82,styleComponent:83,NUM:84,COLON:85,UNIT:86,SPACE:87,BRKT:88,PCT:89,commentToken:90,textToken:91,graphCodeTokens:92,textNoTagsToken:93,TAGSTART:94,TAGEND:95,"==":96,"--":97,DEFAULT:98,MINUS:99,keywords:100,UNICODE_TEXT:101,BQUOTE_STR:102,$accept:0,$end:1},terminals_:{2:"error",7:"CLASS_DIAGRAM",8:"NEWLINE",9:"EOF",12:"SQS",13:"STR",14:"SQE",17:"DOT",20:"GENERICTYPE",22:"LABEL",33:"acc_title",34:"acc_title_value",35:"acc_descr",36:"acc_descr_value",37:"acc_descr_multiline_value",39:"STRUCT_START",41:"STRUCT_STOP",42:"NAMESPACE",44:"STYLE_SEPARATOR",46:"CLASS",47:"ANNOTATION_START",48:"ANNOTATION_END",49:"MEMBER",50:"SEPARATOR",52:"NOTE_FOR",54:"NOTE",55:"CLASSDEF",58:"ALPHA",59:"COMMA",60:"direction_tb",61:"direction_bt",62:"direction_rl",63:"direction_lr",66:"AGGREGATION",67:"EXTENSION",68:"COMPOSITION",69:"DEPENDENCY",70:"LOLLIPOP",71:"LINE",72:"DOTTED_LINE",73:"CALLBACK",74:"LINK",75:"LINK_TARGET",76:"CLICK",77:"CALLBACK_NAME",78:"CALLBACK_ARGS",79:"HREF",80:"STYLE",81:"CSSCLASS",84:"NUM",85:"COLON",86:"UNIT",87:"SPACE",88:"BRKT",89:"PCT",92:"graphCodeTokens",94:"TAGSTART",95:"TAGEND",96:"==",97:"--",98:"DEFAULT",99:"MINUS",100:"keywords",101:"UNICODE_TEXT",102:"BQUOTE_STR"},productions_:[0,[3,1],[3,1],[4,1],[6,4],[5,1],[5,2],[5,3],[11,3],[15,1],[15,3],[15,2],[18,1],[18,3],[18,1],[18,2],[18,2],[18,2],[10,1],[10,2],[10,1],[10,1],[10,1],[10,1],[10,1],[10,1],[10,1],[10,1],[10,1],[10,1],[10,2],[10,2],[10,1],[23,4],[23,5],[38,2],[40,1],[40,2],[40,3],[24,1],[24,3],[24,4],[24,6],[43,2],[43,3],[26,4],[45,1],[45,2],[25,1],[25,2],[25,1],[25,1],[21,3],[21,4],[21,4],[21,5],[30,3],[30,2],[31,3],[56,1],[56,3],[32,1],[32,1],[32,1],[32,1],[51,3],[51,2],[51,2],[51,1],[64,1],[64,1],[64,1],[64,1],[64,1],[65,1],[65,1],[27,3],[27,4],[27,3],[27,4],[27,4],[27,5],[27,3],[27,4],[27,4],[27,5],[27,4],[27,5],[27,5],[27,6],[28,3],[29,3],[57,1],[57,3],[82,1],[82,2],[83,1],[83,1],[83,1],[83,1],[83,1],[83,1],[83,1],[83,1],[83,1],[90,1],[90,1],[91,1],[91,1],[91,1],[91,1],[91,1],[91,1],[91,1],[93,1],[93,1],[93,1],[93,1],[16,1],[16,1],[16,1],[16,1],[19,1],[53,1]],performAction:(0,a.K2)((function(t,e,s,n,i,u,a){var r=u.length-1;switch(i){case 8:this.$=u[r-1];break;case 9:case 12:case 14:this.$=u[r];break;case 10:case 13:this.$=u[r-2]+"."+u[r];break;case 11:case 15:case 95:this.$=u[r-1]+u[r];break;case 16:case 17:this.$=u[r-1]+"~"+u[r]+"~";break;case 18:n.addRelation(u[r]);break;case 19:u[r-1].title=n.cleanupLabel(u[r]),n.addRelation(u[r-1]);break;case 30:this.$=u[r].trim(),n.setAccTitle(this.$);break;case 31:case 32:this.$=u[r].trim(),n.setAccDescription(this.$);break;case 33:n.addClassesToNamespace(u[r-3],u[r-1]);break;case 34:n.addClassesToNamespace(u[r-4],u[r-1]);break;case 35:this.$=u[r],n.addNamespace(u[r]);break;case 36:case 46:case 59:case 92:this.$=[u[r]];break;case 37:this.$=[u[r-1]];break;case 38:u[r].unshift(u[r-2]),this.$=u[r];break;case 40:n.setCssClass(u[r-2],u[r]);break;case 41:n.addMembers(u[r-3],u[r-1]);break;case 42:n.setCssClass(u[r-5],u[r-3]),n.addMembers(u[r-5],u[r-1]);break;case 43:this.$=u[r],n.addClass(u[r]);break;case 44:this.$=u[r-1],n.addClass(u[r-1]),n.setClassLabel(u[r-1],u[r]);break;case 45:n.addAnnotation(u[r],u[r-2]);break;case 47:u[r].push(u[r-1]),this.$=u[r];break;case 48:case 50:case 51:break;case 49:n.addMember(u[r-1],n.cleanupLabel(u[r]));break;case 52:this.$={id1:u[r-2],id2:u[r],relation:u[r-1],relationTitle1:"none",relationTitle2:"none"};break;case 53:this.$={id1:u[r-3],id2:u[r],relation:u[r-1],relationTitle1:u[r-2],relationTitle2:"none"};break;case 54:this.$={id1:u[r-3],id2:u[r],relation:u[r-2],relationTitle1:"none",relationTitle2:u[r-1]};break;case 55:this.$={id1:u[r-4],id2:u[r],relation:u[r-2],relationTitle1:u[r-3],relationTitle2:u[r-1]};break;case 56:n.addNote(u[r],u[r-1]);break;case 57:n.addNote(u[r]);break;case 58:this.$=u[r-2],n.defineClass(u[r-1],u[r]);break;case 60:this.$=u[r-2].concat([u[r]]);break;case 61:n.setDirection("TB");break;case 62:n.setDirection("BT");break;case 63:n.setDirection("RL");break;case 64:n.setDirection("LR");break;case 65:this.$={type1:u[r-2],type2:u[r],lineType:u[r-1]};break;case 66:this.$={type1:"none",type2:u[r],lineType:u[r-1]};break;case 67:this.$={type1:u[r-1],type2:"none",lineType:u[r]};break;case 68:this.$={type1:"none",type2:"none",lineType:u[r]};break;case 69:this.$=n.relationType.AGGREGATION;break;case 70:this.$=n.relationType.EXTENSION;break;case 71:this.$=n.relationType.COMPOSITION;break;case 72:this.$=n.relationType.DEPENDENCY;break;case 73:this.$=n.relationType.LOLLIPOP;break;case 74:this.$=n.lineType.LINE;break;case 75:this.$=n.lineType.DOTTED_LINE;break;case 76:case 82:this.$=u[r-2],n.setClickEvent(u[r-1],u[r]);break;case 77:case 83:this.$=u[r-3],n.setClickEvent(u[r-2],u[r-1]),n.setTooltip(u[r-2],u[r]);break;case 78:this.$=u[r-2],n.setLink(u[r-1],u[r]);break;case 79:this.$=u[r-3],n.setLink(u[r-2],u[r-1],u[r]);break;case 80:this.$=u[r-3],n.setLink(u[r-2],u[r-1]),n.setTooltip(u[r-2],u[r]);break;case 81:this.$=u[r-4],n.setLink(u[r-3],u[r-2],u[r]),n.setTooltip(u[r-3],u[r-1]);break;case 84:this.$=u[r-3],n.setClickEvent(u[r-2],u[r-1],u[r]);break;case 85:this.$=u[r-4],n.setClickEvent(u[r-3],u[r-2],u[r-1]),n.setTooltip(u[r-3],u[r]);break;case 86:this.$=u[r-3],n.setLink(u[r-2],u[r]);break;case 87:this.$=u[r-4],n.setLink(u[r-3],u[r-1],u[r]);break;case 88:this.$=u[r-4],n.setLink(u[r-3],u[r-1]),n.setTooltip(u[r-3],u[r]);break;case 89:this.$=u[r-5],n.setLink(u[r-4],u[r-2],u[r]),n.setTooltip(u[r-4],u[r-1]);break;case 90:this.$=u[r-2],n.setCssStyle(u[r-1],u[r]);break;case 91:n.setCssClass(u[r-1],u[r]);break;case 93:u[r-2].push(u[r]),this.$=u[r-2]}}),"anonymous"),table:[{3:1,4:2,5:3,6:4,7:[1,6],10:5,16:39,18:21,19:40,21:7,23:8,24:9,25:10,26:11,27:12,28:13,29:14,30:15,31:16,32:17,33:e,35:s,37:n,38:22,42:i,43:23,46:u,47:r,49:o,50:l,52:c,54:h,55:p,58:d,60:A,61:y,62:g,63:m,73:C,74:f,76:E,80:b,81:k,84:T,99:D,101:F,102:B},{1:[3]},{1:[2,1]},{1:[2,2]},{1:[2,3]},t(_,[2,5],{8:[1,48]}),{8:[1,49]},t(S,[2,18],{22:[1,50]}),t(S,[2,20]),t(S,[2,21]),t(S,[2,22]),t(S,[2,23]),t(S,[2,24]),t(S,[2,25]),t(S,[2,26]),t(S,[2,27]),t(S,[2,28]),t(S,[2,29]),{34:[1,51]},{36:[1,52]},t(S,[2,32]),t(S,[2,48],{51:53,64:56,65:57,13:[1,54],22:[1,55],66:N,67:L,68:$,69:x,70:O,71:v,72:I}),{39:[1,65]},t(K,[2,39],{39:[1,67],44:[1,66]}),t(S,[2,50]),t(S,[2,51]),{16:68,58:d,84:T,99:D,101:F},{16:39,18:69,19:40,58:d,84:T,99:D,101:F,102:B},{16:39,18:70,19:40,58:d,84:T,99:D,101:F,102:B},{16:39,18:71,19:40,58:d,84:T,99:D,101:F,102:B},{58:[1,72]},{13:[1,73]},{16:39,18:74,19:40,58:d,84:T,99:D,101:F,102:B},{13:w,53:75},{56:77,58:[1,78]},t(S,[2,61]),t(S,[2,62]),t(S,[2,63]),t(S,[2,64]),t(R,[2,12],{16:39,19:40,18:80,17:[1,79],20:[1,81],58:d,84:T,99:D,101:F,102:B}),t(R,[2,14],{20:[1,82]}),{15:83,16:84,58:d,84:T,99:D,101:F},{16:39,18:85,19:40,58:d,84:T,99:D,101:F,102:B},t(P,[2,118]),t(P,[2,119]),t(P,[2,120]),t(P,[2,121]),t([1,8,9,12,13,20,22,39,41,44,66,67,68,69,70,71,72,77,79],[2,122]),t(_,[2,6],{10:5,21:7,23:8,24:9,25:10,26:11,27:12,28:13,29:14,30:15,31:16,32:17,18:21,38:22,43:23,16:39,19:40,5:86,33:e,35:s,37:n,42:i,46:u,47:r,49:o,50:l,52:c,54:h,55:p,58:d,60:A,61:y,62:g,63:m,73:C,74:f,76:E,80:b,81:k,84:T,99:D,101:F,102:B}),{5:87,10:5,16:39,18:21,19:40,21:7,23:8,24:9,25:10,26:11,27:12,28:13,29:14,30:15,31:16,32:17,33:e,35:s,37:n,38:22,42:i,43:23,46:u,47:r,49:o,50:l,52:c,54:h,55:p,58:d,60:A,61:y,62:g,63:m,73:C,74:f,76:E,80:b,81:k,84:T,99:D,101:F,102:B},t(S,[2,19]),t(S,[2,30]),t(S,[2,31]),{13:[1,89],16:39,18:88,19:40,58:d,84:T,99:D,101:F,102:B},{51:90,64:56,65:57,66:N,67:L,68:$,69:x,70:O,71:v,72:I},t(S,[2,49]),{65:91,71:v,72:I},t(M,[2,68],{64:92,66:N,67:L,68:$,69:x,70:O}),t(G,[2,69]),t(G,[2,70]),t(G,[2,71]),t(G,[2,72]),t(G,[2,73]),t(U,[2,74]),t(U,[2,75]),{8:[1,94],24:95,40:93,43:23,46:u},{16:96,58:d,84:T,99:D,101:F},{45:97,49:Y},{48:[1,99]},{13:[1,100]},{13:[1,101]},{77:[1,102],79:[1,103]},{22:z,57:104,58:Q,80:W,82:105,83:106,84:X,85:j,86:V,87:q,88:H,89:J},{58:[1,116]},{13:w,53:117},t(S,[2,57]),t(S,[2,123]),{22:z,57:118,58:Q,59:[1,119],80:W,82:105,83:106,84:X,85:j,86:V,87:q,88:H,89:J},t(Z,[2,59]),{16:39,18:120,19:40,58:d,84:T,99:D,101:F,102:B},t(R,[2,15]),t(R,[2,16]),t(R,[2,17]),{39:[2,35]},{15:122,16:84,17:[1,121],39:[2,9],58:d,84:T,99:D,101:F},t(tt,[2,43],{11:123,12:[1,124]}),t(_,[2,7]),{9:[1,125]},t(et,[2,52]),{16:39,18:126,19:40,58:d,84:T,99:D,101:F,102:B},{13:[1,128],16:39,18:127,19:40,58:d,84:T,99:D,101:F,102:B},t(M,[2,67],{64:129,66:N,67:L,68:$,69:x,70:O}),t(M,[2,66]),{41:[1,130]},{24:95,40:131,43:23,46:u},{8:[1,132],41:[2,36]},t(K,[2,40],{39:[1,133]}),{41:[1,134]},{41:[2,46],45:135,49:Y},{16:39,18:136,19:40,58:d,84:T,99:D,101:F,102:B},t(S,[2,76],{13:[1,137]}),t(S,[2,78],{13:[1,139],75:[1,138]}),t(S,[2,82],{13:[1,140],78:[1,141]}),{13:[1,142]},t(S,[2,90],{59:st}),t(nt,[2,92],{83:144,22:z,58:Q,80:W,84:X,85:j,86:V,87:q,88:H,89:J}),t(it,[2,94]),t(it,[2,96]),t(it,[2,97]),t(it,[2,98]),t(it,[2,99]),t(it,[2,100]),t(it,[2,101]),t(it,[2,102]),t(it,[2,103]),t(it,[2,104]),t(S,[2,91]),t(S,[2,56]),t(S,[2,58],{59:st}),{58:[1,145]},t(R,[2,13]),{15:146,16:84,58:d,84:T,99:D,101:F},{39:[2,11]},t(tt,[2,44]),{13:[1,147]},{1:[2,4]},t(et,[2,54]),t(et,[2,53]),{16:39,18:148,19:40,58:d,84:T,99:D,101:F,102:B},t(M,[2,65]),t(S,[2,33]),{41:[1,149]},{24:95,40:150,41:[2,37],43:23,46:u},{45:151,49:Y},t(K,[2,41]),{41:[2,47]},t(S,[2,45]),t(S,[2,77]),t(S,[2,79]),t(S,[2,80],{75:[1,152]}),t(S,[2,83]),t(S,[2,84],{13:[1,153]}),t(S,[2,86],{13:[1,155],75:[1,154]}),{22:z,58:Q,80:W,82:156,83:106,84:X,85:j,86:V,87:q,88:H,89:J},t(it,[2,95]),t(Z,[2,60]),{39:[2,10]},{14:[1,157]},t(et,[2,55]),t(S,[2,34]),{41:[2,38]},{41:[1,158]},t(S,[2,81]),t(S,[2,85]),t(S,[2,87]),t(S,[2,88],{75:[1,159]}),t(nt,[2,93],{83:144,22:z,58:Q,80:W,84:X,85:j,86:V,87:q,88:H,89:J}),t(tt,[2,8]),t(K,[2,42]),t(S,[2,89])],defaultActions:{2:[2,1],3:[2,2],4:[2,3],83:[2,35],122:[2,11],125:[2,4],135:[2,47],146:[2,10],150:[2,38]},parseError:(0,a.K2)((function(t,e){if(!e.recoverable){var s=new Error(t);throw s.hash=e,s}this.trace(t)}),"parseError"),parse:(0,a.K2)((function(t){var e=this,s=[0],n=[],i=[null],u=[],r=this.table,o="",l=0,c=0,h=0,p=u.slice.call(arguments,1),d=Object.create(this.lexer),A={yy:{}};for(var y in this.yy)Object.prototype.hasOwnProperty.call(this.yy,y)&&(A.yy[y]=this.yy[y]);d.setInput(t,A.yy),A.yy.lexer=d,A.yy.parser=this,void 0===d.yylloc&&(d.yylloc={});var g=d.yylloc;u.push(g);var m=d.options&&d.options.ranges;function C(){var t;return"number"!=typeof(t=n.pop()||d.lex()||1)&&(t instanceof Array&&(t=(n=t).pop()),t=e.symbols_[t]||t),t}"function"==typeof A.yy.parseError?this.parseError=A.yy.parseError:this.parseError=Object.getPrototypeOf(this).parseError,(0,a.K2)((function(t){s.length=s.length-2*t,i.length=i.length-t,u.length=u.length-t}),"popStack"),(0,a.K2)(C,"lex");for(var f,E,b,k,T,D,F,B,_,S={};;){if(b=s[s.length-1],this.defaultActions[b]?k=this.defaultActions[b]:(null==f&&(f=C()),k=r[b]&&r[b][f]),void 0===k||!k.length||!k[0]){var N="";for(D in _=[],r[b])this.terminals_[D]&&D>2&&_.push("'"+this.terminals_[D]+"'");N=d.showPosition?"Parse error on line "+(l+1)+":\n"+d.showPosition()+"\nExpecting "+_.join(", ")+", got '"+(this.terminals_[f]||f)+"'":"Parse error on line "+(l+1)+": Unexpected "+(1==f?"end of input":"'"+(this.terminals_[f]||f)+"'"),this.parseError(N,{text:d.match,token:this.terminals_[f]||f,line:d.yylineno,loc:g,expected:_})}if(k[0]instanceof Array&&k.length>1)throw new Error("Parse Error: multiple actions possible at state: "+b+", token: "+f);switch(k[0]){case 1:s.push(f),i.push(d.yytext),u.push(d.yylloc),s.push(k[1]),f=null,E?(f=E,E=null):(c=d.yyleng,o=d.yytext,l=d.yylineno,g=d.yylloc,h>0&&h--);break;case 2:if(F=this.productions_[k[1]][1],S.$=i[i.length-F],S._$={first_line:u[u.length-(F||1)].first_line,last_line:u[u.length-1].last_line,first_column:u[u.length-(F||1)].first_column,last_column:u[u.length-1].last_column},m&&(S._$.range=[u[u.length-(F||1)].range[0],u[u.length-1].range[1]]),void 0!==(T=this.performAction.apply(S,[o,c,l,A.yy,k[1],i,u].concat(p))))return T;F&&(s=s.slice(0,-1*F*2),i=i.slice(0,-1*F),u=u.slice(0,-1*F)),s.push(this.productions_[k[1]][0]),i.push(S.$),u.push(S._$),B=r[s[s.length-2]][s[s.length-1]],s.push(B);break;case 3:return!0}}return!0}),"parse")},at=function(){return{EOF:1,parseError:(0,a.K2)((function(t,e){if(!this.yy.parser)throw new Error(t);this.yy.parser.parseError(t,e)}),"parseError"),setInput:(0,a.K2)((function(t,e){return this.yy=e||this.yy||{},this._input=t,this._more=this._backtrack=this.done=!1,this.yylineno=this.yyleng=0,this.yytext=this.matched=this.match="",this.conditionStack=["INITIAL"],this.yylloc={first_line:1,first_column:0,last_line:1,last_column:0},this.options.ranges&&(this.yylloc.range=[0,0]),this.offset=0,this}),"setInput"),input:(0,a.K2)((function(){var t=this._input[0];return this.yytext+=t,this.yyleng++,this.offset++,this.match+=t,this.matched+=t,t.match(/(?:\r\n?|\n).*/g)?(this.yylineno++,this.yylloc.last_line++):this.yylloc.last_column++,this.options.ranges&&this.yylloc.range[1]++,this._input=this._input.slice(1),t}),"input"),unput:(0,a.K2)((function(t){var e=t.length,s=t.split(/(?:\r\n?|\n)/g);this._input=t+this._input,this.yytext=this.yytext.substr(0,this.yytext.length-e),this.offset-=e;var n=this.match.split(/(?:\r\n?|\n)/g);this.match=this.match.substr(0,this.match.length-1),this.matched=this.matched.substr(0,this.matched.length-1),s.length-1&&(this.yylineno-=s.length-1);var i=this.yylloc.range;return this.yylloc={first_line:this.yylloc.first_line,last_line:this.yylineno+1,first_column:this.yylloc.first_column,last_column:s?(s.length===n.length?this.yylloc.first_column:0)+n[n.length-s.length].length-s[0].length:this.yylloc.first_column-e},this.options.ranges&&(this.yylloc.range=[i[0],i[0]+this.yyleng-e]),this.yyleng=this.yytext.length,this}),"unput"),more:(0,a.K2)((function(){return this._more=!0,this}),"more"),reject:(0,a.K2)((function(){return this.options.backtrack_lexer?(this._backtrack=!0,this):this.parseError("Lexical error on line "+(this.yylineno+1)+". You can only invoke reject() in the lexer when the lexer is of the backtracking persuasion (options.backtrack_lexer = true).\n"+this.showPosition(),{text:"",token:null,line:this.yylineno})}),"reject"),less:(0,a.K2)((function(t){this.unput(this.match.slice(t))}),"less"),pastInput:(0,a.K2)((function(){var t=this.matched.substr(0,this.matched.length-this.match.length);return(t.length>20?"...":"")+t.substr(-20).replace(/\n/g,"")}),"pastInput"),upcomingInput:(0,a.K2)((function(){var t=this.match;return t.length<20&&(t+=this._input.substr(0,20-t.length)),(t.substr(0,20)+(t.length>20?"...":"")).replace(/\n/g,"")}),"upcomingInput"),showPosition:(0,a.K2)((function(){var t=this.pastInput(),e=new Array(t.length+1).join("-");return t+this.upcomingInput()+"\n"+e+"^"}),"showPosition"),test_match:(0,a.K2)((function(t,e){var s,n,i;if(this.options.backtrack_lexer&&(i={yylineno:this.yylineno,yylloc:{first_line:this.yylloc.first_line,last_line:this.last_line,first_column:this.yylloc.first_column,last_column:this.yylloc.last_column},yytext:this.yytext,match:this.match,matches:this.matches,matched:this.matched,yyleng:this.yyleng,offset:this.offset,_more:this._more,_input:this._input,yy:this.yy,conditionStack:this.conditionStack.slice(0),done:this.done},this.options.ranges&&(i.yylloc.range=this.yylloc.range.slice(0))),(n=t[0].match(/(?:\r\n?|\n).*/g))&&(this.yylineno+=n.length),this.yylloc={first_line:this.yylloc.last_line,last_line:this.yylineno+1,first_column:this.yylloc.last_column,last_column:n?n[n.length-1].length-n[n.length-1].match(/\r?\n?/)[0].length:this.yylloc.last_column+t[0].length},this.yytext+=t[0],this.match+=t[0],this.matches=t,this.yyleng=this.yytext.length,this.options.ranges&&(this.yylloc.range=[this.offset,this.offset+=this.yyleng]),this._more=!1,this._backtrack=!1,this._input=this._input.slice(t[0].length),this.matched+=t[0],s=this.performAction.call(this,this.yy,this,e,this.conditionStack[this.conditionStack.length-1]),this.done&&this._input&&(this.done=!1),s)return s;if(this._backtrack){for(var u in i)this[u]=i[u];return!1}return!1}),"test_match"),next:(0,a.K2)((function(){if(this.done)return this.EOF;var t,e,s,n;this._input||(this.done=!0),this._more||(this.yytext="",this.match="");for(var i=this._currentRules(),u=0;ue[0].length)){if(e=s,n=u,this.options.backtrack_lexer){if(!1!==(t=this.test_match(s,i[u])))return t;if(this._backtrack){e=!1;continue}return!1}if(!this.options.flex)break}return e?!1!==(t=this.test_match(e,i[n]))&&t:""===this._input?this.EOF:this.parseError("Lexical error on line "+(this.yylineno+1)+". Unrecognized text.\n"+this.showPosition(),{text:"",token:null,line:this.yylineno})}),"next"),lex:(0,a.K2)((function(){var t=this.next();return t||this.lex()}),"lex"),begin:(0,a.K2)((function(t){this.conditionStack.push(t)}),"begin"),popState:(0,a.K2)((function(){return this.conditionStack.length-1>0?this.conditionStack.pop():this.conditionStack[0]}),"popState"),_currentRules:(0,a.K2)((function(){return this.conditionStack.length&&this.conditionStack[this.conditionStack.length-1]?this.conditions[this.conditionStack[this.conditionStack.length-1]].rules:this.conditions.INITIAL.rules}),"_currentRules"),topState:(0,a.K2)((function(t){return(t=this.conditionStack.length-1-Math.abs(t||0))>=0?this.conditionStack[t]:"INITIAL"}),"topState"),pushState:(0,a.K2)((function(t){this.begin(t)}),"pushState"),stateStackSize:(0,a.K2)((function(){return this.conditionStack.length}),"stateStackSize"),options:{},performAction:(0,a.K2)((function(t,e,s,n){switch(s){case 0:return 60;case 1:return 61;case 2:return 62;case 3:return 63;case 4:case 5:case 14:case 31:case 36:case 40:case 47:break;case 6:return this.begin("acc_title"),33;case 7:return this.popState(),"acc_title_value";case 8:return this.begin("acc_descr"),35;case 9:return this.popState(),"acc_descr_value";case 10:this.begin("acc_descr_multiline");break;case 11:case 19:case 22:case 24:case 58:case 61:this.popState();break;case 12:return"acc_descr_multiline_value";case 13:case 35:return 8;case 15:case 16:return 7;case 17:case 37:case 45:return"EDGE_STATE";case 18:this.begin("callback_name");break;case 20:this.popState(),this.begin("callback_args");break;case 21:return 77;case 23:return 78;case 25:return"STR";case 26:this.begin("string");break;case 27:return 80;case 28:return 55;case 29:return this.begin("namespace"),42;case 30:case 39:return this.popState(),8;case 32:return this.begin("namespace-body"),39;case 33:case 43:return this.popState(),41;case 34:case 44:return"EOF_IN_STRUCT";case 38:return this.begin("class"),46;case 41:return this.popState(),this.popState(),41;case 42:return this.begin("class-body"),39;case 46:return"OPEN_IN_STRUCT";case 48:return"MEMBER";case 49:return 81;case 50:return 73;case 51:return 74;case 52:return 76;case 53:return 52;case 54:return 54;case 55:return 47;case 56:return 48;case 57:return 79;case 59:return"GENERICTYPE";case 60:this.begin("generic");break;case 62:return"BQUOTE_STR";case 63:this.begin("bqstring");break;case 64:case 65:case 66:case 67:return 75;case 68:case 69:return 67;case 70:case 71:return 69;case 72:return 68;case 73:return 66;case 74:return 70;case 75:return 71;case 76:return 72;case 77:return 22;case 78:return 44;case 79:return 99;case 80:return 17;case 81:return"PLUS";case 82:return 85;case 83:return 59;case 84:case 85:return 88;case 86:return 89;case 87:case 88:return"EQUALS";case 89:return 58;case 90:return 12;case 91:return 14;case 92:return"PUNCTUATION";case 93:return 84;case 94:return 101;case 95:case 96:return 87;case 97:return 9}}),"anonymous"),rules:[/^(?:.*direction\s+TB[^\n]*)/,/^(?:.*direction\s+BT[^\n]*)/,/^(?:.*direction\s+RL[^\n]*)/,/^(?:.*direction\s+LR[^\n]*)/,/^(?:%%(?!\{)*[^\n]*(\r?\n?)+)/,/^(?:%%[^\n]*(\r?\n)*)/,/^(?:accTitle\s*:\s*)/,/^(?:(?!\n||)*[^\n]*)/,/^(?:accDescr\s*:\s*)/,/^(?:(?!\n||)*[^\n]*)/,/^(?:accDescr\s*\{\s*)/,/^(?:[\}])/,/^(?:[^\}]*)/,/^(?:\s*(\r?\n)+)/,/^(?:\s+)/,/^(?:classDiagram-v2\b)/,/^(?:classDiagram\b)/,/^(?:\[\*\])/,/^(?:call[\s]+)/,/^(?:\([\s]*\))/,/^(?:\()/,/^(?:[^(]*)/,/^(?:\))/,/^(?:[^)]*)/,/^(?:["])/,/^(?:[^"]*)/,/^(?:["])/,/^(?:style\b)/,/^(?:classDef\b)/,/^(?:namespace\b)/,/^(?:\s*(\r?\n)+)/,/^(?:\s+)/,/^(?:[{])/,/^(?:[}])/,/^(?:$)/,/^(?:\s*(\r?\n)+)/,/^(?:\s+)/,/^(?:\[\*\])/,/^(?:class\b)/,/^(?:\s*(\r?\n)+)/,/^(?:\s+)/,/^(?:[}])/,/^(?:[{])/,/^(?:[}])/,/^(?:$)/,/^(?:\[\*\])/,/^(?:[{])/,/^(?:[\n])/,/^(?:[^{}\n]*)/,/^(?:cssClass\b)/,/^(?:callback\b)/,/^(?:link\b)/,/^(?:click\b)/,/^(?:note for\b)/,/^(?:note\b)/,/^(?:<<)/,/^(?:>>)/,/^(?:href\b)/,/^(?:[~])/,/^(?:[^~]*)/,/^(?:~)/,/^(?:[`])/,/^(?:[^`]+)/,/^(?:[`])/,/^(?:_self\b)/,/^(?:_blank\b)/,/^(?:_parent\b)/,/^(?:_top\b)/,/^(?:\s*<\|)/,/^(?:\s*\|>)/,/^(?:\s*>)/,/^(?:\s*<)/,/^(?:\s*\*)/,/^(?:\s*o\b)/,/^(?:\s*\(\))/,/^(?:--)/,/^(?:\.\.)/,/^(?::{1}[^:\n;]+)/,/^(?::{3})/,/^(?:-)/,/^(?:\.)/,/^(?:\+)/,/^(?::)/,/^(?:,)/,/^(?:#)/,/^(?:#)/,/^(?:%)/,/^(?:=)/,/^(?:=)/,/^(?:\w+)/,/^(?:\[)/,/^(?:\])/,/^(?:[!"#$%&'*+,-.`?\\/])/,/^(?:[0-9]+)/,/^(?:[\u00AA\u00B5\u00BA\u00C0-\u00D6\u00D8-\u00F6]|[\u00F8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377]|[\u037A-\u037D\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5]|[\u03F7-\u0481\u048A-\u0527\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA]|[\u05F0-\u05F2\u0620-\u064A\u066E\u066F\u0671-\u06D3\u06D5\u06E5\u06E6\u06EE]|[\u06EF\u06FA-\u06FC\u06FF\u0710\u0712-\u072F\u074D-\u07A5\u07B1\u07CA-\u07EA]|[\u07F4\u07F5\u07FA\u0800-\u0815\u081A\u0824\u0828\u0840-\u0858\u08A0]|[\u08A2-\u08AC\u0904-\u0939\u093D\u0950\u0958-\u0961\u0971-\u0977]|[\u0979-\u097F\u0985-\u098C\u098F\u0990\u0993-\u09A8\u09AA-\u09B0\u09B2]|[\u09B6-\u09B9\u09BD\u09CE\u09DC\u09DD\u09DF-\u09E1\u09F0\u09F1\u0A05-\u0A0A]|[\u0A0F\u0A10\u0A13-\u0A28\u0A2A-\u0A30\u0A32\u0A33\u0A35\u0A36\u0A38\u0A39]|[\u0A59-\u0A5C\u0A5E\u0A72-\u0A74\u0A85-\u0A8D\u0A8F-\u0A91\u0A93-\u0AA8]|[\u0AAA-\u0AB0\u0AB2\u0AB3\u0AB5-\u0AB9\u0ABD\u0AD0\u0AE0\u0AE1\u0B05-\u0B0C]|[\u0B0F\u0B10\u0B13-\u0B28\u0B2A-\u0B30\u0B32\u0B33\u0B35-\u0B39\u0B3D\u0B5C]|[\u0B5D\u0B5F-\u0B61\u0B71\u0B83\u0B85-\u0B8A\u0B8E-\u0B90\u0B92-\u0B95\u0B99]|[\u0B9A\u0B9C\u0B9E\u0B9F\u0BA3\u0BA4\u0BA8-\u0BAA\u0BAE-\u0BB9\u0BD0]|[\u0C05-\u0C0C\u0C0E-\u0C10\u0C12-\u0C28\u0C2A-\u0C33\u0C35-\u0C39\u0C3D]|[\u0C58\u0C59\u0C60\u0C61\u0C85-\u0C8C\u0C8E-\u0C90\u0C92-\u0CA8\u0CAA-\u0CB3]|[\u0CB5-\u0CB9\u0CBD\u0CDE\u0CE0\u0CE1\u0CF1\u0CF2\u0D05-\u0D0C\u0D0E-\u0D10]|[\u0D12-\u0D3A\u0D3D\u0D4E\u0D60\u0D61\u0D7A-\u0D7F\u0D85-\u0D96\u0D9A-\u0DB1]|[\u0DB3-\u0DBB\u0DBD\u0DC0-\u0DC6\u0E01-\u0E30\u0E32\u0E33\u0E40-\u0E46\u0E81]|[\u0E82\u0E84\u0E87\u0E88\u0E8A\u0E8D\u0E94-\u0E97\u0E99-\u0E9F\u0EA1-\u0EA3]|[\u0EA5\u0EA7\u0EAA\u0EAB\u0EAD-\u0EB0\u0EB2\u0EB3\u0EBD\u0EC0-\u0EC4\u0EC6]|[\u0EDC-\u0EDF\u0F00\u0F40-\u0F47\u0F49-\u0F6C\u0F88-\u0F8C\u1000-\u102A]|[\u103F\u1050-\u1055\u105A-\u105D\u1061\u1065\u1066\u106E-\u1070\u1075-\u1081]|[\u108E\u10A0-\u10C5\u10C7\u10CD\u10D0-\u10FA\u10FC-\u1248\u124A-\u124D]|[\u1250-\u1256\u1258\u125A-\u125D\u1260-\u1288\u128A-\u128D\u1290-\u12B0]|[\u12B2-\u12B5\u12B8-\u12BE\u12C0\u12C2-\u12C5\u12C8-\u12D6\u12D8-\u1310]|[\u1312-\u1315\u1318-\u135A\u1380-\u138F\u13A0-\u13F4\u1401-\u166C]|[\u166F-\u167F\u1681-\u169A\u16A0-\u16EA\u1700-\u170C\u170E-\u1711]|[\u1720-\u1731\u1740-\u1751\u1760-\u176C\u176E-\u1770\u1780-\u17B3\u17D7]|[\u17DC\u1820-\u1877\u1880-\u18A8\u18AA\u18B0-\u18F5\u1900-\u191C]|[\u1950-\u196D\u1970-\u1974\u1980-\u19AB\u19C1-\u19C7\u1A00-\u1A16]|[\u1A20-\u1A54\u1AA7\u1B05-\u1B33\u1B45-\u1B4B\u1B83-\u1BA0\u1BAE\u1BAF]|[\u1BBA-\u1BE5\u1C00-\u1C23\u1C4D-\u1C4F\u1C5A-\u1C7D\u1CE9-\u1CEC]|[\u1CEE-\u1CF1\u1CF5\u1CF6\u1D00-\u1DBF\u1E00-\u1F15\u1F18-\u1F1D]|[\u1F20-\u1F45\u1F48-\u1F4D\u1F50-\u1F57\u1F59\u1F5B\u1F5D\u1F5F-\u1F7D]|[\u1F80-\u1FB4\u1FB6-\u1FBC\u1FBE\u1FC2-\u1FC4\u1FC6-\u1FCC\u1FD0-\u1FD3]|[\u1FD6-\u1FDB\u1FE0-\u1FEC\u1FF2-\u1FF4\u1FF6-\u1FFC\u2071\u207F]|[\u2090-\u209C\u2102\u2107\u210A-\u2113\u2115\u2119-\u211D\u2124\u2126\u2128]|[\u212A-\u212D\u212F-\u2139\u213C-\u213F\u2145-\u2149\u214E\u2183\u2184]|[\u2C00-\u2C2E\u2C30-\u2C5E\u2C60-\u2CE4\u2CEB-\u2CEE\u2CF2\u2CF3]|[\u2D00-\u2D25\u2D27\u2D2D\u2D30-\u2D67\u2D6F\u2D80-\u2D96\u2DA0-\u2DA6]|[\u2DA8-\u2DAE\u2DB0-\u2DB6\u2DB8-\u2DBE\u2DC0-\u2DC6\u2DC8-\u2DCE]|[\u2DD0-\u2DD6\u2DD8-\u2DDE\u2E2F\u3005\u3006\u3031-\u3035\u303B\u303C]|[\u3041-\u3096\u309D-\u309F\u30A1-\u30FA\u30FC-\u30FF\u3105-\u312D]|[\u3131-\u318E\u31A0-\u31BA\u31F0-\u31FF\u3400-\u4DB5\u4E00-\u9FCC]|[\uA000-\uA48C\uA4D0-\uA4FD\uA500-\uA60C\uA610-\uA61F\uA62A\uA62B]|[\uA640-\uA66E\uA67F-\uA697\uA6A0-\uA6E5\uA717-\uA71F\uA722-\uA788]|[\uA78B-\uA78E\uA790-\uA793\uA7A0-\uA7AA\uA7F8-\uA801\uA803-\uA805]|[\uA807-\uA80A\uA80C-\uA822\uA840-\uA873\uA882-\uA8B3\uA8F2-\uA8F7\uA8FB]|[\uA90A-\uA925\uA930-\uA946\uA960-\uA97C\uA984-\uA9B2\uA9CF\uAA00-\uAA28]|[\uAA40-\uAA42\uAA44-\uAA4B\uAA60-\uAA76\uAA7A\uAA80-\uAAAF\uAAB1\uAAB5]|[\uAAB6\uAAB9-\uAABD\uAAC0\uAAC2\uAADB-\uAADD\uAAE0-\uAAEA\uAAF2-\uAAF4]|[\uAB01-\uAB06\uAB09-\uAB0E\uAB11-\uAB16\uAB20-\uAB26\uAB28-\uAB2E]|[\uABC0-\uABE2\uAC00-\uD7A3\uD7B0-\uD7C6\uD7CB-\uD7FB\uF900-\uFA6D]|[\uFA70-\uFAD9\uFB00-\uFB06\uFB13-\uFB17\uFB1D\uFB1F-\uFB28\uFB2A-\uFB36]|[\uFB38-\uFB3C\uFB3E\uFB40\uFB41\uFB43\uFB44\uFB46-\uFBB1\uFBD3-\uFD3D]|[\uFD50-\uFD8F\uFD92-\uFDC7\uFDF0-\uFDFB\uFE70-\uFE74\uFE76-\uFEFC]|[\uFF21-\uFF3A\uFF41-\uFF5A\uFF66-\uFFBE\uFFC2-\uFFC7\uFFCA-\uFFCF]|[\uFFD2-\uFFD7\uFFDA-\uFFDC])/,/^(?:\s)/,/^(?:\s)/,/^(?:$)/],conditions:{"namespace-body":{rules:[26,33,34,35,36,37,38,49,50,51,52,53,54,55,56,57,60,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,86,87,88,89,90,91,92,93,94,95,97],inclusive:!1},namespace:{rules:[26,29,30,31,32,49,50,51,52,53,54,55,56,57,60,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,86,87,88,89,90,91,92,93,94,95,97],inclusive:!1},"class-body":{rules:[26,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,60,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,86,87,88,89,90,91,92,93,94,95,97],inclusive:!1},class:{rules:[26,39,40,41,42,49,50,51,52,53,54,55,56,57,60,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,86,87,88,89,90,91,92,93,94,95,97],inclusive:!1},acc_descr_multiline:{rules:[11,12,26,49,50,51,52,53,54,55,56,57,60,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,86,87,88,89,90,91,92,93,94,95,97],inclusive:!1},acc_descr:{rules:[9,26,49,50,51,52,53,54,55,56,57,60,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,86,87,88,89,90,91,92,93,94,95,97],inclusive:!1},acc_title:{rules:[7,26,49,50,51,52,53,54,55,56,57,60,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,86,87,88,89,90,91,92,93,94,95,97],inclusive:!1},callback_args:{rules:[22,23,26,49,50,51,52,53,54,55,56,57,60,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,86,87,88,89,90,91,92,93,94,95,97],inclusive:!1},callback_name:{rules:[19,20,21,26,49,50,51,52,53,54,55,56,57,60,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,86,87,88,89,90,91,92,93,94,95,97],inclusive:!1},href:{rules:[26,49,50,51,52,53,54,55,56,57,60,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,86,87,88,89,90,91,92,93,94,95,97],inclusive:!1},struct:{rules:[26,49,50,51,52,53,54,55,56,57,60,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,86,87,88,89,90,91,92,93,94,95,97],inclusive:!1},generic:{rules:[26,49,50,51,52,53,54,55,56,57,58,59,60,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,86,87,88,89,90,91,92,93,94,95,97],inclusive:!1},bqstring:{rules:[26,49,50,51,52,53,54,55,56,57,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,86,87,88,89,90,91,92,93,94,95,97],inclusive:!1},string:{rules:[24,25,26,49,50,51,52,53,54,55,56,57,60,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,86,87,88,89,90,91,92,93,94,95,97],inclusive:!1},INITIAL:{rules:[0,1,2,3,4,5,6,8,10,13,14,15,16,17,18,26,27,28,29,38,49,50,51,52,53,54,55,56,57,60,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97],inclusive:!0}}}}();function rt(){this.yy={}}return ut.lexer=at,(0,a.K2)(rt,"Parser"),rt.prototype=ut,ut.Parser=rt,new rt}();o.parser=o;var l=o,c=["#","+","~","-",""],h=class{static{(0,a.K2)(this,"ClassMember")}constructor(t,e){this.memberType=e,this.visibility="",this.classifier="",this.text="";const s=(0,a.jZ)(t,(0,a.D7)());this.parseMember(s)}getDisplayDetails(){let t=this.visibility+(0,a.QO)(this.id);"method"===this.memberType&&(t+=`(${(0,a.QO)(this.parameters.trim())})`,this.returnType&&(t+=" : "+(0,a.QO)(this.returnType))),t=t.trim();return{displayText:t,cssStyle:this.parseClassifier()}}parseMember(t){let e="";if("method"===this.memberType){const s=/([#+~-])?(.+)\((.*)\)([\s$*])?(.*)([$*])?/.exec(t);if(s){const t=s[1]?s[1].trim():"";if(c.includes(t)&&(this.visibility=t),this.id=s[2],this.parameters=s[3]?s[3].trim():"",e=s[4]?s[4].trim():"",this.returnType=s[5]?s[5].trim():"",""===e){const t=this.returnType.substring(this.returnType.length-1);/[$*]/.exec(t)&&(e=t,this.returnType=this.returnType.substring(0,this.returnType.length-1))}}}else{const s=t.length,n=t.substring(0,1),i=t.substring(s-1);c.includes(n)&&(this.visibility=n),/[$*]/.exec(i)&&(e=i),this.id=t.substring(""===this.visibility?0:1,""===e?s:s-1)}this.classifier=e,this.id=this.id.startsWith(" ")?" "+this.id.trim():this.id.trim();const s=`${this.visibility?"\\"+this.visibility:""}${(0,a.QO)(this.id)}${"method"===this.memberType?`(${(0,a.QO)(this.parameters)})${this.returnType?" : "+(0,a.QO)(this.returnType):""}`:""}`;this.text=s.replaceAll("<","<").replaceAll(">",">"),this.text.startsWith("\\<")&&(this.text=this.text.replace("\\<","~"))}parseClassifier(){switch(this.classifier){case"*":return"font-style:italic;";case"$":return"text-decoration:underline;";default:return""}}},p="classId-",d=[],A=new Map,y=new Map,g=[],m=[],C=0,f=new Map,E=0,b=[],k=(0,a.K2)((t=>a.Y2.sanitizeText(t,(0,a.D7)())),"sanitizeText"),T=(0,a.K2)((function(t){const e=a.Y2.sanitizeText(t,(0,a.D7)());let s="",n=e;if(e.indexOf("~")>0){const t=e.split("~");n=k(t[0]),s=k(t[1])}return{className:n,type:s}}),"splitClassNameAndType"),D=(0,a.K2)((function(t,e){const s=a.Y2.sanitizeText(t,(0,a.D7)());e&&(e=k(e));const{className:n}=T(s);A.get(n).label=e,A.get(n).text=`${e}${A.get(n).type?`<${A.get(n).type}>`:""}`}),"setClassLabel"),F=(0,a.K2)((function(t){const e=a.Y2.sanitizeText(t,(0,a.D7)()),{className:s,type:n}=T(e);if(A.has(s))return;const i=a.Y2.sanitizeText(s,(0,a.D7)());A.set(i,{id:i,type:n,label:i,text:`${i}${n?`<${n}>`:""}`,shape:"classBox",cssClasses:"default",methods:[],members:[],annotations:[],styles:[],domId:p+i+"-"+C}),C++}),"addClass"),B=(0,a.K2)((function(t,e){const s={id:`interface${m.length}`,label:t,classId:e};m.push(s)}),"addInterface"),_=(0,a.K2)((function(t){const e=a.Y2.sanitizeText(t,(0,a.D7)());if(A.has(e))return A.get(e).domId;throw new Error("Class not found: "+e)}),"lookUpDomId"),S=(0,a.K2)((function(){d=[],A=new Map,g=[],m=[],(b=[]).push(j),f=new Map,E=0,V="TB",(0,a.IU)()}),"clear"),N=(0,a.K2)((function(t){return A.get(t)}),"getClass"),L=(0,a.K2)((function(){return A}),"getClasses"),$=(0,a.K2)((function(){return d}),"getRelations"),x=(0,a.K2)((function(){return g}),"getNotes"),O=(0,a.K2)((function(t){a.Rm.debug("Adding relation: "+JSON.stringify(t));const e=[X.LOLLIPOP,X.AGGREGATION,X.COMPOSITION,X.DEPENDENCY,X.EXTENSION];t.relation.type1!==X.LOLLIPOP||e.includes(t.relation.type2)?t.relation.type2!==X.LOLLIPOP||e.includes(t.relation.type1)?(F(t.id1),F(t.id2)):(F(t.id1),B(t.id2,t.id1),t.id2="interface"+(m.length-1)):(F(t.id2),B(t.id1,t.id2),t.id1="interface"+(m.length-1)),t.id1=T(t.id1).className,t.id2=T(t.id2).className,t.relationTitle1=a.Y2.sanitizeText(t.relationTitle1.trim(),(0,a.D7)()),t.relationTitle2=a.Y2.sanitizeText(t.relationTitle2.trim(),(0,a.D7)()),d.push(t)}),"addRelation"),v=(0,a.K2)((function(t,e){const s=T(t).className;A.get(s).annotations.push(e)}),"addAnnotation"),I=(0,a.K2)((function(t,e){F(t);const s=T(t).className,n=A.get(s);if("string"==typeof e){const t=e.trim();t.startsWith("<<")&&t.endsWith(">>")?n.annotations.push(k(t.substring(2,t.length-2))):t.indexOf(")")>0?n.methods.push(new h(t,"method")):t&&n.members.push(new h(t,"attribute"))}}),"addMember"),K=(0,a.K2)((function(t,e){Array.isArray(e)&&(e.reverse(),e.forEach((e=>I(t,e))))}),"addMembers"),w=(0,a.K2)((function(t,e){const s={id:`note${g.length}`,class:e,text:t};g.push(s)}),"addNote"),R=(0,a.K2)((function(t){return t.startsWith(":")&&(t=t.substring(1)),k(t.trim())}),"cleanupLabel"),P=(0,a.K2)((function(t,e){t.split(",").forEach((function(t){let s=t;/\d/.exec(t[0])&&(s=p+s);const n=A.get(s);n&&(n.cssClasses+=" "+e)}))}),"setCssClass"),M=(0,a.K2)((function(t,e){for(const s of t){let t=y.get(s);void 0===t&&(t={id:s,styles:[],textStyles:[]},y.set(s,t)),e&&e.forEach((function(e){if(/color/.exec(e)){const s=e.replace("fill","bgFill");t.textStyles.push(s)}t.styles.push(e)})),A.forEach((t=>{t.cssClasses.includes(s)&&t.styles.push(...e.flatMap((t=>t.split(","))))}))}}),"defineClass"),G=(0,a.K2)((function(t,e){t.split(",").forEach((function(t){void 0!==e&&(A.get(t).tooltip=k(e))}))}),"setTooltip"),U=(0,a.K2)((function(t,e){return e&&f.has(e)?f.get(e).classes.get(t).tooltip:A.get(t).tooltip}),"getTooltip"),Y=(0,a.K2)((function(t,e,s){const n=(0,a.D7)();t.split(",").forEach((function(t){let i=t;/\d/.exec(t[0])&&(i=p+i);const a=A.get(i);a&&(a.link=u._K.formatUrl(e,n),"sandbox"===n.securityLevel?a.linkTarget="_top":a.linkTarget="string"==typeof s?k(s):"_blank")})),P(t,"clickable")}),"setLink"),z=(0,a.K2)((function(t,e,s){t.split(",").forEach((function(t){Q(t,e,s),A.get(t).haveCallback=!0})),P(t,"clickable")}),"setClickEvent"),Q=(0,a.K2)((function(t,e,s){const n=a.Y2.sanitizeText(t,(0,a.D7)());if("loose"!==(0,a.D7)().securityLevel)return;if(void 0===e)return;const i=n;if(A.has(i)){const t=_(i);let n=[];if("string"==typeof s){n=s.split(/,(?=(?:(?:[^"]*"){2})*[^"]*$)/);for(let t=0;t")),t.classed("hover",!0)})).on("mouseout",(function(){e.transition().duration(500).style("opacity",0);(0,r.Ltv)(this).classed("hover",!1)}))}),"setupToolTips");b.push(j);var V="TB",q=(0,a.K2)((()=>V),"getDirection"),H=(0,a.K2)((t=>{V=t}),"setDirection"),J=(0,a.K2)((function(t){f.has(t)||(f.set(t,{id:t,classes:new Map,children:{},domId:p+t+"-"+E}),E++)}),"addNamespace"),Z=(0,a.K2)((function(t){return f.get(t)}),"getNamespace"),tt=(0,a.K2)((function(){return f}),"getNamespaces"),et=(0,a.K2)((function(t,e){if(f.has(t))for(const s of e){const{className:e}=T(s);A.get(e).parent=t,f.get(t).classes.set(e,A.get(e))}}),"addClassesToNamespace"),st=(0,a.K2)((function(t,e){const s=A.get(t);if(e&&s)for(const n of e)n.includes(",")?s.styles.push(...n.split(",")):s.styles.push(n)}),"setCssStyle");function nt(t){let e;switch(t){case 0:e="aggregation";break;case 1:e="extension";break;case 2:e="composition";break;case 3:e="dependency";break;case 4:e="lollipop";break;default:e="none"}return e}(0,a.K2)(nt,"getArrowMarker");var it=(0,a.K2)((()=>{const t=[],e=[],s=(0,a.D7)();for(const i of f.keys()){const e=f.get(i);if(e){const n={id:e.id,label:e.id,isGroup:!0,padding:s.class.padding??16,shape:"rect",cssStyles:["fill: none","stroke: black"],look:s.look};t.push(n)}}for(const i of A.keys()){const e=A.get(i);if(e){const n=e;n.parentId=e.parent,n.look=s.look,t.push(n)}}let n=0;for(const i of g){n++;const u={id:i.id,label:i.text,isGroup:!1,shape:"note",padding:s.class.padding??6,cssStyles:["text-align: left","white-space: nowrap",`fill: ${s.themeVariables.noteBkgColor}`,`stroke: ${s.themeVariables.noteBorderColor}`],look:s.look};t.push(u);const a=A.get(i.class)?.id??"";if(a){const t={id:`edgeNote${n}`,start:i.id,end:a,type:"normal",thickness:"normal",classes:"relation",arrowTypeStart:"none",arrowTypeEnd:"none",arrowheadStyle:"",labelStyle:[""],style:["fill: none"],pattern:"dotted",look:s.look};e.push(t)}}for(const i of m){const e={id:i.id,label:i.label,isGroup:!1,shape:"rect",cssStyles:["opacity: 0;"],look:s.look};t.push(e)}n=0;for(const i of d){n++;const t={id:(0,u.rY)(i.id1,i.id2,{prefix:"id",counter:n}),start:i.id1,end:i.id2,type:"normal",label:i.title,labelpos:"c",thickness:"normal",classes:"relation",arrowTypeStart:nt(i.relation.type1),arrowTypeEnd:nt(i.relation.type2),startLabelRight:"none"===i.relationTitle1?"":i.relationTitle1,endLabelLeft:"none"===i.relationTitle2?"":i.relationTitle2,arrowheadStyle:"",labelStyle:["display: inline-block"],style:i.style||"",pattern:1==i.relation.lineType?"dashed":"solid",look:s.look};e.push(t)}return{nodes:t,edges:e,other:{},config:s,direction:q()}}),"getData"),ut={setAccTitle:a.SV,getAccTitle:a.iN,getAccDescription:a.m7,setAccDescription:a.EI,getConfig:(0,a.K2)((()=>(0,a.D7)().class),"getConfig"),addClass:F,bindFunctions:W,clear:S,getClass:N,getClasses:L,getNotes:x,addAnnotation:v,addNote:w,getRelations:$,addRelation:O,getDirection:q,setDirection:H,addMember:I,addMembers:K,cleanupLabel:R,lineType:{LINE:0,DOTTED_LINE:1},relationType:X,setClickEvent:z,setCssClass:P,defineClass:M,setLink:Y,getTooltip:U,setTooltip:G,lookUpDomId:_,setDiagramTitle:a.ke,getDiagramTitle:a.ab,setClassLabel:D,addNamespace:J,addClassesToNamespace:et,getNamespace:Z,getNamespaces:tt,setCssStyle:st,getData:it},at=(0,a.K2)((t=>`g.classGroup text {\n fill: ${t.nodeBorder||t.classText};\n stroke: none;\n font-family: ${t.fontFamily};\n font-size: 10px;\n\n .title {\n font-weight: bolder;\n }\n\n}\n\n.nodeLabel, .edgeLabel {\n color: ${t.classText};\n}\n.edgeLabel .label rect {\n fill: ${t.mainBkg};\n}\n.label text {\n fill: ${t.classText};\n}\n\n.labelBkg {\n background: ${t.mainBkg};\n}\n.edgeLabel .label span {\n background: ${t.mainBkg};\n}\n\n.classTitle {\n font-weight: bolder;\n}\n.node rect,\n .node circle,\n .node ellipse,\n .node polygon,\n .node path {\n fill: ${t.mainBkg};\n stroke: ${t.nodeBorder};\n stroke-width: 1px;\n }\n\n\n.divider {\n stroke: ${t.nodeBorder};\n stroke-width: 1;\n}\n\ng.clickable {\n cursor: pointer;\n}\n\ng.classGroup rect {\n fill: ${t.mainBkg};\n stroke: ${t.nodeBorder};\n}\n\ng.classGroup line {\n stroke: ${t.nodeBorder};\n stroke-width: 1;\n}\n\n.classLabel .box {\n stroke: none;\n stroke-width: 0;\n fill: ${t.mainBkg};\n opacity: 0.5;\n}\n\n.classLabel .label {\n fill: ${t.nodeBorder};\n font-size: 10px;\n}\n\n.relation {\n stroke: ${t.lineColor};\n stroke-width: 1;\n fill: none;\n}\n\n.dashed-line{\n stroke-dasharray: 3;\n}\n\n.dotted-line{\n stroke-dasharray: 1 2;\n}\n\n#compositionStart, .composition {\n fill: ${t.lineColor} !important;\n stroke: ${t.lineColor} !important;\n stroke-width: 1;\n}\n\n#compositionEnd, .composition {\n fill: ${t.lineColor} !important;\n stroke: ${t.lineColor} !important;\n stroke-width: 1;\n}\n\n#dependencyStart, .dependency {\n fill: ${t.lineColor} !important;\n stroke: ${t.lineColor} !important;\n stroke-width: 1;\n}\n\n#dependencyStart, .dependency {\n fill: ${t.lineColor} !important;\n stroke: ${t.lineColor} !important;\n stroke-width: 1;\n}\n\n#extensionStart, .extension {\n fill: transparent !important;\n stroke: ${t.lineColor} !important;\n stroke-width: 1;\n}\n\n#extensionEnd, .extension {\n fill: transparent !important;\n stroke: ${t.lineColor} !important;\n stroke-width: 1;\n}\n\n#aggregationStart, .aggregation {\n fill: transparent !important;\n stroke: ${t.lineColor} !important;\n stroke-width: 1;\n}\n\n#aggregationEnd, .aggregation {\n fill: transparent !important;\n stroke: ${t.lineColor} !important;\n stroke-width: 1;\n}\n\n#lollipopStart, .lollipop {\n fill: ${t.mainBkg} !important;\n stroke: ${t.lineColor} !important;\n stroke-width: 1;\n}\n\n#lollipopEnd, .lollipop {\n fill: ${t.mainBkg} !important;\n stroke: ${t.lineColor} !important;\n stroke-width: 1;\n}\n\n.edgeTerminals {\n font-size: 11px;\n line-height: initial;\n}\n\n.classTitleText {\n text-anchor: middle;\n font-size: 18px;\n fill: ${t.textColor};\n}\n`),"getStyles"),rt=(0,a.K2)(((t,e="TB")=>{if(!t.doc)return e;let s=e;for(const n of t.doc)"dir"===n.stmt&&(s=n.value);return s}),"getDir"),ot={getClasses:(0,a.K2)((function(t,e){return e.db.getClasses()}),"getClasses"),draw:(0,a.K2)((async function(t,e,s,r){a.Rm.info("REF0:"),a.Rm.info("Drawing class diagram (v3)",e);const{securityLevel:o,state:l,layout:c}=(0,a.D7)(),h=r.db.getData(),p=(0,n.A)(e,o);h.type=r.type,h.layoutAlgorithm=(0,i.q7)(c),h.nodeSpacing=l?.nodeSpacing||50,h.rankSpacing=l?.rankSpacing||50,h.markers=["aggregation","extension","composition","dependency","lollipop"],h.diagramId=e,await(0,i.XX)(h,p);u._K.insertTitle(p,"classDiagramTitleText",l?.titleTopMargin??25,r.db.getDiagramTitle()),(0,n.P)(p,8,"classDiagram",l?.useMaxWidth??!0)}),"draw"),getDir:rt}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/14a9ce33.ad4e3471.js b/pr-preview/pr-1071/assets/js/14a9ce33.ad4e3471.js
deleted file mode 100644
index 62a9cd1bc2..0000000000
--- a/pr-preview/pr-1071/assets/js/14a9ce33.ad4e3471.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[7924],{50499:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>o,default:()=>l,frontMatter:()=>a,metadata:()=>i,toc:()=>h});const i=JSON.parse('{"id":"architecture/attestation","title":"Attestation in Contrast","description":"This document describes the attestation architecture of Contrast, adhering to the definitions of Remote ATtestation procedureS (RATS) in RFC 9334.","source":"@site/versioned_docs/version-0.8/architecture/attestation.md","sourceDirName":"architecture","slug":"/architecture/attestation","permalink":"/contrast/pr-preview/pr-1071/0.8/architecture/attestation","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.8/architecture/attestation.md","tags":[],"version":"0.8","frontMatter":{},"sidebar":"docs","previous":{"title":"Service mesh","permalink":"/contrast/pr-preview/pr-1071/0.8/components/service-mesh"},"next":{"title":"Secrets & recovery","permalink":"/contrast/pr-preview/pr-1071/0.8/architecture/secrets"}}');var r=n(74848),s=n(28453);const a={},o="Attestation in Contrast",c={},h=[{value:"Attestation architecture",id:"attestation-architecture",level:2},{value:"Components of Contrast's attestation",id:"components-of-contrasts-attestation",level:2},{value:"Attester: Application Pods",id:"attester-application-pods",level:3},{value:"Verifier: Coordinator and CLI",id:"verifier-coordinator-and-cli",level:3},{value:"Relying Party: Data owner",id:"relying-party-data-owner",level:3},{value:"Evidence generation and appraisal",id:"evidence-generation-and-appraisal",level:2},{value:"Evidence types and formats",id:"evidence-types-and-formats",level:3},{value:"Appraisal policies for evidence",id:"appraisal-policies-for-evidence",level:3},{value:"Frequently asked questions about attestation in Contrast",id:"frequently-asked-questions-about-attestation-in-contrast",level:2},{value:"What's the purpose of remote attestation in Contrast?",id:"whats-the-purpose-of-remote-attestation-in-contrast",level:3},{value:"How does Contrast ensure the security of the attestation process?",id:"how-does-contrast-ensure-the-security-of-the-attestation-process",level:3},{value:"What security benefits does attestation provide?",id:"what-security-benefits-does-attestation-provide",level:3},{value:"How can you verify the authenticity of attestation results?",id:"how-can-you-verify-the-authenticity-of-attestation-results",level:3},{value:"How are attestation results used by relying parties?",id:"how-are-attestation-results-used-by-relying-parties",level:3},{value:"Summary",id:"summary",level:2}];function d(e){const t={a:"a",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",header:"header",img:"img",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.header,{children:(0,r.jsx)(t.h1,{id:"attestation-in-contrast",children:"Attestation in Contrast"})}),"\n",(0,r.jsxs)(t.p,{children:["This document describes the attestation architecture of Contrast, adhering to the definitions of Remote ATtestation procedureS (RATS) in ",(0,r.jsx)(t.a,{href:"https://www.rfc-editor.org/rfc/rfc9334.html",children:"RFC 9334"}),".\nThe following gives a detailed description of Contrast's attestation architecture.\nAt the end of this document, we included an ",(0,r.jsx)(t.a,{href:"#frequently-asked-questions-about-attestation-in-contrast",children:"FAQ"})," that answers the most common questions regarding attestation in hindsight of the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/basics/security-benefits",children:"security benefits"}),"."]}),"\n",(0,r.jsx)(t.h2,{id:"attestation-architecture",children:"Attestation architecture"}),"\n",(0,r.jsxs)(t.p,{children:["Contrast integrates with the RATS architecture, leveraging their definition of roles and processes including ",(0,r.jsx)(t.em,{children:"Attesters"}),", ",(0,r.jsx)(t.em,{children:"Verifiers"}),", and ",(0,r.jsx)(t.em,{children:"Relying Parties"}),"."]}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Conceptual attestation architecture",src:n(55732).A+"",width:"592",height:"377"})}),"\n",(0,r.jsxs)(t.p,{children:["Figure 1: Conceptual attestation architecture. Taken from ",(0,r.jsx)(t.a,{href:"https://www.rfc-editor.org/rfc/rfc9334.html#figure-1",children:"RFC 9334"}),"."]}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Attester"}),": Assigned to entities that are responsible for creating ",(0,r.jsx)(t.em,{children:"Evidence"})," which is then sent to a ",(0,r.jsx)(t.em,{children:"Verifier"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Verifier"}),": These entities utilize the ",(0,r.jsx)(t.em,{children:"Evidence"}),", ",(0,r.jsx)(t.em,{children:"Reference Values"}),", and ",(0,r.jsx)(t.em,{children:"Endorsements"}),". They assess the trustworthiness of the ",(0,r.jsx)(t.em,{children:"Attester"})," by applying an ",(0,r.jsx)(t.em,{children:"Appraisal Policy"})," for ",(0,r.jsx)(t.em,{children:"Evidence"}),". Following this assessment, ",(0,r.jsx)(t.em,{children:"Verifiers"})," generate ",(0,r.jsx)(t.em,{children:"Attestation Results"})," for use by ",(0,r.jsx)(t.em,{children:"Relying Parties"}),". The ",(0,r.jsx)(t.em,{children:"Appraisal Policy"})," for ",(0,r.jsx)(t.em,{children:"Evidence"})," may be provided by the ",(0,r.jsx)(t.em,{children:"Verifier Owner"}),", programmed into the ",(0,r.jsx)(t.em,{children:"Verifier"}),", or acquired through other means."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Relying Party"}),": Assigned to entities that utilize ",(0,r.jsx)(t.em,{children:"Attestation Results"}),', applying their own appraisal policies to make specific decisions, such as authorization decisions. This process is referred to as the "appraisal of Attestation Results." The ',(0,r.jsx)(t.em,{children:"Appraisal Policy"})," for ",(0,r.jsx)(t.em,{children:"Attestation Results"})," might be sourced from the ",(0,r.jsx)(t.em,{children:"Relying Party Owner"}),", configured by the owner, embedded in the ",(0,r.jsx)(t.em,{children:"Relying Party"}),", or obtained through other protocols or mechanisms."]}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"components-of-contrasts-attestation",children:"Components of Contrast's attestation"}),"\n",(0,r.jsx)(t.p,{children:"The key components involved in the attestation process of Contrast are detailed below:"}),"\n",(0,r.jsx)(t.h3,{id:"attester-application-pods",children:"Attester: Application Pods"}),"\n",(0,r.jsxs)(t.p,{children:["This includes all Pods of the Contrast deployment that run inside Confidential Containers and generate cryptographic evidence reflecting their current configuration and state.\nTheir evidence is rooted in the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/basics/confidential-containers",children:"hardware measurements"})," from the CPU and their ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/components/runtime",children:"confidential VM environment"}),".\nThe details of this evidence are given below in the section on ",(0,r.jsx)(t.a,{href:"#evidence-generation-and-appraisal",children:"evidence generation and appraisal"}),"."]}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Attestation flow of a confidential pod",src:n(15601).A+"",width:"608",height:"697"})}),"\n",(0,r.jsxs)(t.p,{children:["Figure 2: Attestation flow of a confidential pod. Based on the layered attester graphic in ",(0,r.jsx)(t.a,{href:"https://www.rfc-editor.org/rfc/rfc9334.html#figure-3",children:"RFC 9334"}),"."]}),"\n",(0,r.jsxs)(t.p,{children:["Pods run in Contrast's ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/components/runtime",children:"runtime environment"})," (B), effectively within a confidential VM.\nDuring launch, the CPU (A) measures the initial memory content of the confidential VM that contains Contrast's pod-VM image and generates the corresponding attestation evidence.\nThe image is in ",(0,r.jsx)(t.a,{href:"https://github.com/microsoft/igvm",children:"IGVM format"}),", encapsulating all information required to launch a virtual machine, including the kernel, the initramfs, and kernel cmdline.\nThe kernel cmdline contains the root hash for ",(0,r.jsx)(t.a,{href:"https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/verity.html",children:"dm-verity"})," that ensures the integrity of the root filesystem.\nThe root filesystem contains all components of the container's runtime environment including the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/basics/confidential-containers#kata-containers",children:"guest agent"})," (C)."]}),"\n",(0,r.jsxs)(t.p,{children:["In the userland, the guest agent takes care of enforcing the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/components/overview#runtime-policies",children:"runtime policy"})," of the pod.\nWhile the policy is passed in during the initialization procedure via the host, the evidence for the runtime policy is part of the CPU measurements.\nDuring the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/deployment#generate-policy-annotations-and-manifest",children:"deployment"})," the policy is annotated to the Kubernetes Pod resources.\nOn AMD SEV-SNP the hash of the policy is then added to the attestation report via the ",(0,r.jsx)(t.code,{children:"HOSTDATA"})," field by the hypervisor.\nWhen provided with the policy from the Kata host, the guest agent verifies that the policy's hash matches the one in the ",(0,r.jsx)(t.code,{children:"HOSTDATA"})," field."]}),"\n",(0,r.jsx)(t.p,{children:"In summary a Pod's evidence is the attestation report of the CPU that provides evidence for runtime environment and the runtime policy."}),"\n",(0,r.jsx)(t.h3,{id:"verifier-coordinator-and-cli",children:"Verifier: Coordinator and CLI"}),"\n",(0,r.jsxs)(t.p,{children:["The ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/components/overview#the-coordinator",children:"Coordinator"})," acts as a verifier within the Contrast deployment, configured with a ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/components/overview#the-manifest",children:"Manifest"})," that defines the reference values and serves as an appraisal policy for all pods in the deployment.\nIt also pulls endorsements from hardware vendors to verify the hardware claims.\nThe Coordinator operates within the cluster as a confidential container and provides similar evidence as any other Pod when it acts as an attester.\nIn RATS terminology, the Coordinator's dual role is defined as a lead attester in a composite device which spans the entire deployment: Coordinator and the workload pods.\nIt collects evidence from other attesters and conveys it to a verifier, generating evidence about the layout of the whole composite device based on the Manifest as the appraisal policy."]}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Deployment attestation as a composite device",src:n(92084).A+"",width:"576",height:"393"})}),"\n",(0,r.jsxs)(t.p,{children:["Figure 3: Contrast deployment as a composite device. Based on the composite device in ",(0,r.jsx)(t.a,{href:"https://www.rfc-editor.org/rfc/rfc9334.html#figure-4",children:"RFC 9334"}),"."]}),"\n",(0,r.jsxs)(t.p,{children:["The ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/components/overview#the-cli-command-line-interface",children:"CLI"})," serves as the verifier for the Coordinator and the entire Contrast deployment, containing the reference values for the Coordinator and the endorsements from hardware vendors.\nThese reference values are built into the CLI during our release process and can be reproduced offline via reproducible builds."]}),"\n",(0,r.jsx)(t.h3,{id:"relying-party-data-owner",children:"Relying Party: Data owner"}),"\n",(0,r.jsxs)(t.p,{children:["A relying party in the Contrast scenario could be, for example, the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/basics/security-benefits",children:"data owner"})," that interacts with the application.\nThe relying party can use the CLI to obtain the attestation results and Contrast's ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/architecture/certificates",children:"CA certificates"})," bound to these results.\nThe CA certificates can then be used by the relying party to authenticate the application, for example through TLS connections."]}),"\n",(0,r.jsx)(t.h2,{id:"evidence-generation-and-appraisal",children:"Evidence generation and appraisal"}),"\n",(0,r.jsx)(t.h3,{id:"evidence-types-and-formats",children:"Evidence types and formats"}),"\n",(0,r.jsx)(t.p,{children:"In Contrast, attestation evidence revolves around a hardware-generated attestation report, which contains several critical pieces of information:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"The hardware attestation report"}),": This report includes details such as the chip identifier, platform information, microcode versions, and comprehensive guest measurements. The entire report is signed by the CPU's private key, ensuring the authenticity and integrity of the data provided."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"The launch measurements"}),": Included within the hardware attestation report, this is a digest generated by the CPU that represents a hash of all initial guest memory pages. This includes essential components like the kernel, initramfs, and the kernel command line. Notably, it incorporates the root filesystem's dm-verity root hash, verifying the integrity of the root filesystem."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"The runtime policy hash"}),": Also part of the hardware attestation report, this field contains the hash of the Rego policy which dictates all expected API commands and their values from the host to the Kata guest agent. It encompasses crucial settings such as dm-verity hashes for the container image layers, environment variables, and mount points."]}),"\n"]}),"\n",(0,r.jsx)(t.h3,{id:"appraisal-policies-for-evidence",children:"Appraisal policies for evidence"}),"\n",(0,r.jsx)(t.p,{children:"The appraisal of this evidence in Contrast is governed by two main components:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"The Manifest"}),": A JSON file used by the Coordinator to align with reference values. It sets the expectations for runtime policy hashes for each pod and includes what should be reported in the hardware attestation report for each component of the deployment."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"The CLI's appraisal policy"}),": This policy encompasses expected values of the Coordinator\u2019s guest measurements and its runtime policy. It's embedded into the CLI during the build process and ensures that any discrepancy between the built-in values and those reported by the hardware attestation can be identified and addressed. The integrity of this policy is safeguardable through reproducible builds, allowing verification against the source code reference."]}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"frequently-asked-questions-about-attestation-in-contrast",children:"Frequently asked questions about attestation in Contrast"}),"\n",(0,r.jsx)(t.h3,{id:"whats-the-purpose-of-remote-attestation-in-contrast",children:"What's the purpose of remote attestation in Contrast?"}),"\n",(0,r.jsx)(t.p,{children:"Remote attestation in Contrast ensures that software runs within a secure, isolated confidential computing environment.\nThis process certifies that the memory is encrypted and confirms the integrity and authenticity of the software running within the deployment.\nBy validating the runtime environment and the policies enforced on it, Contrast ensures that the system operates in a trustworthy state and hasn't been tampered with."}),"\n",(0,r.jsx)(t.h3,{id:"how-does-contrast-ensure-the-security-of-the-attestation-process",children:"How does Contrast ensure the security of the attestation process?"}),"\n",(0,r.jsx)(t.p,{children:"Contrast leverages hardware-rooted security features such as AMD SEV-SNP to generate cryptographic evidence of a pod\u2019s current state and configuration.\nThis evidence is checked against pre-defined appraisal policies to guarantee that only verified and authorized pods are part of a Contrast deployment."}),"\n",(0,r.jsx)(t.h3,{id:"what-security-benefits-does-attestation-provide",children:"What security benefits does attestation provide?"}),"\n",(0,r.jsxs)(t.p,{children:["Attestation confirms the integrity of the runtime environment and the identity of the workloads.\nIt plays a critical role in preventing unauthorized changes and detecting potential modifications at runtime.\nThe attestation provides integrity and authenticity guarantees, enabling relying parties\u2014such as workload operators or data owners\u2014to confirm the effective protection against potential threats, including malicious cloud insiders, co-tenants, or compromised workload operators.\nMore details on the specific security benefits can be found ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/basics/security-benefits",children:"here"}),"."]}),"\n",(0,r.jsx)(t.h3,{id:"how-can-you-verify-the-authenticity-of-attestation-results",children:"How can you verify the authenticity of attestation results?"}),"\n",(0,r.jsx)(t.p,{children:"Attestation results in Contrast are tied to cryptographic proofs generated and signed by the hardware itself.\nThese proofs are then verified using public keys from trusted hardware vendors, ensuring that the results aren't only accurate but also resistant to tampering.\nFor further authenticity verification, all of Contrast's code is reproducibly built, and the attestation evidence can be verified locally from the source code."}),"\n",(0,r.jsx)(t.h3,{id:"how-are-attestation-results-used-by-relying-parties",children:"How are attestation results used by relying parties?"}),"\n",(0,r.jsxs)(t.p,{children:["Relying parties use attestation results to make informed security decisions, such as allowing access to sensitive data or resources only if the attestation verifies the system's integrity.\nThereafter, the use of Contrast's ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.8/architecture/certificates",children:"CA certificates in TLS connections"})," provides a practical approach to communicate securely with the application."]}),"\n",(0,r.jsx)(t.h2,{id:"summary",children:"Summary"}),"\n",(0,r.jsx)(t.p,{children:"In summary, Contrast's attestation strategy adheres to the RATS guidelines and consists of robust verification mechanisms that ensure each component of the deployment is secure and trustworthy.\nThis comprehensive approach allows Contrast to provide a high level of security assurance to its users."})]})}function l(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},92084:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/attestation-composite-device-b91e917a07f0f2bb082989317a9b053f.svg"},15601:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/attestation-pod-af4fc34dd97b1fdc20f66ecfa4fdeb1a.svg"},55732:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/attestation-rats-architecture-1a05fc2165e5c75a171e7b7832186bc3.svg"},28453:(e,t,n)=>{n.d(t,{R:()=>a,x:()=>o});var i=n(96540);const r={},s=i.createContext(r);function a(e){const t=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),i.createElement(s.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/14eb3368.65875b1f.js b/pr-preview/pr-1071/assets/js/14eb3368.65875b1f.js
deleted file mode 100644
index da6b8575df..0000000000
--- a/pr-preview/pr-1071/assets/js/14eb3368.65875b1f.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[6969],{44168:(e,t,n)=>{n.d(t,{A:()=>g});n(96540);var s=n(34164),r=n(18630),i=n(45357),a=n(80260),l=n(14783),o=n(23230),c=n(98180),d=n(74848);function u(e){return(0,d.jsx)("svg",{viewBox:"0 0 24 24",...e,children:(0,d.jsx)("path",{d:"M10 19v-5h4v5c0 .55.45 1 1 1h3c.55 0 1-.45 1-1v-7h1.7c.46 0 .68-.57.33-.87L12.67 3.6c-.38-.34-.96-.34-1.34 0l-8.36 7.53c-.34.3-.13.87.33.87H5v7c0 .55.45 1 1 1h3c.55 0 1-.45 1-1z",fill:"currentColor"})})}const m={breadcrumbHomeIcon:"breadcrumbHomeIcon_YNFT"};function h(){const e=(0,c.Ay)("/");return(0,d.jsx)("li",{className:"breadcrumbs__item",children:(0,d.jsx)(l.A,{"aria-label":(0,o.T)({id:"theme.docs.breadcrumbs.home",message:"Home page",description:"The ARIA label for the home page in the breadcrumbs"}),className:"breadcrumbs__link",href:e,children:(0,d.jsx)(u,{className:m.breadcrumbHomeIcon})})})}const b={breadcrumbsContainer:"breadcrumbsContainer_Z_bl"};function x(e){let{children:t,href:n,isLast:s}=e;const r="breadcrumbs__link";return s?(0,d.jsx)("span",{className:r,itemProp:"name",children:t}):n?(0,d.jsx)(l.A,{className:r,href:n,itemProp:"item",children:(0,d.jsx)("span",{itemProp:"name",children:t})}):(0,d.jsx)("span",{className:r,children:t})}function p(e){let{children:t,active:n,index:r,addMicrodata:i}=e;return(0,d.jsxs)("li",{...i&&{itemScope:!0,itemProp:"itemListElement",itemType:"https://schema.org/ListItem"},className:(0,s.A)("breadcrumbs__item",{"breadcrumbs__item--active":n}),children:[t,(0,d.jsx)("meta",{itemProp:"position",content:String(r+1)})]})}function g(){const e=(0,i.OF)(),t=(0,a.Dt)();return e?(0,d.jsx)("nav",{className:(0,s.A)(r.G.docs.docBreadcrumbs,b.breadcrumbsContainer),"aria-label":(0,o.T)({id:"theme.docs.breadcrumbs.navAriaLabel",message:"Breadcrumbs",description:"The ARIA label for the breadcrumbs"}),children:(0,d.jsxs)("ul",{className:"breadcrumbs",itemScope:!0,itemType:"https://schema.org/BreadcrumbList",children:[t&&(0,d.jsx)(h,{}),e.map(((t,n)=>{const s=n===e.length-1,r="category"===t.type&&t.linkUnlisted?void 0:t.href;return(0,d.jsx)(p,{active:s,index:n,addMicrodata:!!r,children:(0,d.jsx)(x,{href:r,isLast:s,children:t.label})},n)}))]})}):null}},44074:(e,t,n)=>{n.d(t,{A:()=>_});var s=n(96540),r=n(34164),i=n(45357),a=n(14783),l=n(97639);const o=["zero","one","two","few","many","other"];function c(e){return o.filter((t=>e.includes(t)))}const d={locale:"en",pluralForms:c(["one","other"]),select:e=>1===e?"one":"other"};function u(){const{i18n:{currentLocale:e}}=(0,l.A)();return(0,s.useMemo)((()=>{try{return function(e){const t=new Intl.PluralRules(e);return{locale:e,pluralForms:c(t.resolvedOptions().pluralCategories),select:e=>t.select(e)}}(e)}catch(t){return console.error(`Failed to use Intl.PluralRules for locale "${e}".\nDocusaurus will fallback to the default (English) implementation.\nError: ${t.message}\n`),d}}),[e])}function m(){const e=u();return{selectMessage:(t,n)=>function(e,t,n){const s=e.split("|");if(1===s.length)return s[0];s.length>n.pluralForms.length&&console.error(`For locale=${n.locale}, a maximum of ${n.pluralForms.length} plural forms are expected (${n.pluralForms.join(",")}), but the message contains ${s.length}: ${e}`);const r=n.select(t),i=n.pluralForms.indexOf(r);return s[Math.min(i,s.length-1)]}(n,t,e)}}var h=n(40877),b=n(23230),x=n(85225);const p={cardContainer:"cardContainer_fWXF",cardTitle:"cardTitle_rnsV",cardDescription:"cardDescription_PWke"};var g=n(74848);function v(e){let{href:t,children:n}=e;return(0,g.jsx)(a.A,{href:t,className:(0,r.A)("card padding--lg",p.cardContainer),children:n})}function f(e){let{href:t,icon:n,title:s,description:i}=e;return(0,g.jsxs)(v,{href:t,children:[(0,g.jsxs)(x.A,{as:"h2",className:(0,r.A)("text--truncate",p.cardTitle),title:s,children:[n," ",s]}),i&&(0,g.jsx)("p",{className:(0,r.A)("text--truncate",p.cardDescription),title:i,children:i})]})}function j(e){let{item:t}=e;const n=(0,i.Nr)(t),s=function(){const{selectMessage:e}=m();return t=>e(t,(0,b.T)({message:"1 item|{count} items",id:"theme.docs.DocCard.categoryDescription.plurals",description:"The default description for a category card in the generated index about how many items this category includes"},{count:t}))}();return n?(0,g.jsx)(f,{href:n,icon:"\ud83d\uddc3\ufe0f",title:t.label,description:t.description??s(t.items.length)}):null}function A(e){let{item:t}=e;const n=(0,h.A)(t.href)?"\ud83d\udcc4\ufe0f":"\ud83d\udd17",s=(0,i.cC)(t.docId??void 0);return(0,g.jsx)(f,{href:t.href,icon:n,title:t.label,description:t.description??s?.description})}function N(e){let{item:t}=e;switch(t.type){case"link":return(0,g.jsx)(A,{item:t});case"category":return(0,g.jsx)(j,{item:t});default:throw new Error(`unknown item type ${JSON.stringify(t)}`)}}function T(e){let{className:t}=e;const n=(0,i.$S)();return(0,g.jsx)(_,{items:n.items,className:t})}function _(e){const{items:t,className:n}=e;if(!t)return(0,g.jsx)(T,{...e});const s=(0,i.d1)(t);return(0,g.jsx)("section",{className:(0,r.A)("row",n),children:s.map(((e,t)=>(0,g.jsx)("article",{className:"col col--6 margin-bottom--lg",children:(0,g.jsx)(N,{item:e})},t)))})}},97449:(e,t,n)=>{n.r(t),n.d(t,{default:()=>p});n(96540);var s=n(69817),r=n(45357),i=n(98180),a=n(44074),l=n(62400),o=n(84799),c=n(79436),d=n(44168),u=n(85225);const m={generatedIndexPage:"generatedIndexPage_vN6x",list:"list_eTzJ",title:"title_kItE"};var h=n(74848);function b(e){let{categoryGeneratedIndex:t}=e;return(0,h.jsx)(s.be,{title:t.title,description:t.description,keywords:t.keywords,image:(0,i.Ay)(t.image)})}function x(e){let{categoryGeneratedIndex:t}=e;const n=(0,r.$S)();return(0,h.jsxs)("div",{className:m.generatedIndexPage,children:[(0,h.jsx)(o.A,{}),(0,h.jsx)(d.A,{}),(0,h.jsx)(c.A,{}),(0,h.jsxs)("header",{children:[(0,h.jsx)(u.A,{as:"h1",className:m.title,children:t.title}),t.description&&(0,h.jsx)("p",{children:t.description})]}),(0,h.jsx)("article",{className:"margin-top--lg",children:(0,h.jsx)(a.A,{items:n.items,className:m.list})}),(0,h.jsx)("footer",{className:"margin-top--lg",children:(0,h.jsx)(l.A,{previous:t.navigation.previous,next:t.navigation.next})})]})}function p(e){return(0,h.jsxs)(h.Fragment,{children:[(0,h.jsx)(b,{...e}),(0,h.jsx)(x,{...e})]})}},62400:(e,t,n)=>{n.d(t,{A:()=>o});n(96540);var s=n(23230),r=n(34164),i=n(14783),a=n(74848);function l(e){const{permalink:t,title:n,subLabel:s,isNext:l}=e;return(0,a.jsxs)(i.A,{className:(0,r.A)("pagination-nav__link",l?"pagination-nav__link--next":"pagination-nav__link--prev"),to:t,children:[s&&(0,a.jsx)("div",{className:"pagination-nav__sublabel",children:s}),(0,a.jsx)("div",{className:"pagination-nav__label",children:n})]})}function o(e){const{previous:t,next:n}=e;return(0,a.jsxs)("nav",{className:"pagination-nav docusaurus-mt-lg","aria-label":(0,s.T)({id:"theme.docs.paginator.navAriaLabel",message:"Docs pages",description:"The ARIA label for the docs pagination"}),children:[t&&(0,a.jsx)(l,{...t,subLabel:(0,a.jsx)(s.A,{id:"theme.docs.paginator.previous",description:"The label used to navigate to the previous doc",children:"Previous"})}),n&&(0,a.jsx)(l,{...n,subLabel:(0,a.jsx)(s.A,{id:"theme.docs.paginator.next",description:"The label used to navigate to the next doc",children:"Next"}),isNext:!0})]})}},79436:(e,t,n)=>{n.d(t,{A:()=>o});n(96540);var s=n(34164),r=n(23230),i=n(18630),a=n(91704),l=n(74848);function o(e){let{className:t}=e;const n=(0,a.r)();return n.badge?(0,l.jsx)("span",{className:(0,s.A)(t,i.G.docs.docVersionBadge,"badge badge--secondary"),children:(0,l.jsx)(r.A,{id:"theme.docs.versionBadge.label",values:{versionLabel:n.label},children:"Version: {versionLabel}"})}):null}},84799:(e,t,n)=>{n.d(t,{A:()=>p});n(96540);var s=n(34164),r=n(97639),i=n(14783),a=n(23230),l=n(19802),o=n(18630),c=n(86457),d=n(91704),u=n(74848);const m={unreleased:function(e){let{siteTitle:t,versionMetadata:n}=e;return(0,u.jsx)(a.A,{id:"theme.docs.versions.unreleasedVersionLabel",description:"The label used to tell the user that he's browsing an unreleased doc version",values:{siteTitle:t,versionLabel:(0,u.jsx)("b",{children:n.label})},children:"This is unreleased documentation for {siteTitle} {versionLabel} version."})},unmaintained:function(e){let{siteTitle:t,versionMetadata:n}=e;return(0,u.jsx)(a.A,{id:"theme.docs.versions.unmaintainedVersionLabel",description:"The label used to tell the user that he's browsing an unmaintained doc version",values:{siteTitle:t,versionLabel:(0,u.jsx)("b",{children:n.label})},children:"This is documentation for {siteTitle} {versionLabel}, which is no longer actively maintained."})}};function h(e){const t=m[e.versionMetadata.banner];return(0,u.jsx)(t,{...e})}function b(e){let{versionLabel:t,to:n,onClick:s}=e;return(0,u.jsx)(a.A,{id:"theme.docs.versions.latestVersionSuggestionLabel",description:"The label used to tell the user to check the latest version",values:{versionLabel:t,latestVersionLink:(0,u.jsx)("b",{children:(0,u.jsx)(i.A,{to:n,onClick:s,children:(0,u.jsx)(a.A,{id:"theme.docs.versions.latestVersionLinkLabel",description:"The label used for the latest version suggestion link label",children:"latest version"})})})},children:"For up-to-date documentation, see the {latestVersionLink} ({versionLabel})."})}function x(e){let{className:t,versionMetadata:n}=e;const{siteConfig:{title:i}}=(0,r.A)(),{pluginId:a}=(0,l.vT)({failfast:!0}),{savePreferredVersionName:d}=(0,c.g1)(a),{latestDocSuggestion:m,latestVersionSuggestion:x}=(0,l.HW)(a),p=m??(g=x).docs.find((e=>e.id===g.mainDocId));var g;return(0,u.jsxs)("div",{className:(0,s.A)(t,o.G.docs.docVersionBanner,"alert alert--warning margin-bottom--md"),role:"alert",children:[(0,u.jsx)("div",{children:(0,u.jsx)(h,{siteTitle:i,versionMetadata:n})}),(0,u.jsx)("div",{className:"margin-top--md",children:(0,u.jsx)(b,{versionLabel:x.label,to:p.path,onClick:()=>d(x.name)})})]})}function p(e){let{className:t}=e;const n=(0,d.r)();return n.banner?(0,u.jsx)(x,{className:t,versionMetadata:n}):null}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/15b9bf06.8dd25a08.js b/pr-preview/pr-1071/assets/js/15b9bf06.8dd25a08.js
deleted file mode 100644
index af6ba811a2..0000000000
--- a/pr-preview/pr-1071/assets/js/15b9bf06.8dd25a08.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[5388],{12988:(t,e,n)=>{n.r(e),n.d(e,{assets:()=>a,contentTitle:()=>s,default:()=>l,frontMatter:()=>i,metadata:()=>r,toc:()=>d});const r=JSON.parse('{"id":"architecture/confidential-containers","title":"confidential-containers","description":"","source":"@site/versioned_docs/version-0.5/architecture/confidential-containers.md","sourceDirName":"architecture","slug":"/architecture/confidential-containers","permalink":"/contrast/pr-preview/pr-1071/0.5/architecture/confidential-containers","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.5/architecture/confidential-containers.md","tags":[],"version":"0.5","frontMatter":{},"sidebar":"docs","previous":{"title":"CLI","permalink":"/contrast/pr-preview/pr-1071/0.5/architecture/components/cli"},"next":{"title":"Attestation","permalink":"/contrast/pr-preview/pr-1071/0.5/category/attestation"}}');var o=n(74848),c=n(28453);const i={},s=void 0,a={},d=[];function u(t){return(0,o.jsx)(o.Fragment,{})}function l(t={}){const{wrapper:e}={...(0,c.R)(),...t.components};return e?(0,o.jsx)(e,{...t,children:(0,o.jsx)(u,{...t})}):u()}},28453:(t,e,n)=>{n.d(e,{R:()=>i,x:()=>s});var r=n(96540);const o={},c=r.createContext(o);function i(t){const e=r.useContext(c);return r.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function s(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(o):t.components||o:i(t.components),r.createElement(c.Provider,{value:e},t.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/165.786b0b5b.js b/pr-preview/pr-1071/assets/js/165.786b0b5b.js
deleted file mode 100644
index 37d705ad9b..0000000000
--- a/pr-preview/pr-1071/assets/js/165.786b0b5b.js
+++ /dev/null
@@ -1,2 +0,0 @@
-/*! For license information please see 165.786b0b5b.js.LICENSE.txt */
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[165],{90165:(e,t,n)=>{function r(e){return r="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},r(e)}function a(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}function i(e,t){for(var n=0;ne.length)&&(t=e.length);for(var n=0,r=new Array(t);n=e.length?{done:!0}:{done:!1,value:e[r++]}},e:function(e){throw e},f:a}}throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}var i,o=!0,s=!1;return{s:function(){n=n.call(e)},n:function(){var e=n.next();return o=e.done,e},e:function(e){s=!0,i=e},f:function(){try{o||null==n.return||n.return()}finally{if(s)throw i}}}}n.d(t,{A:()=>Xc});var h="undefined"==typeof window?null:window,p=h?h.navigator:null;h&&h.document;var f=r(""),g=r({}),v=r((function(){})),y="undefined"==typeof HTMLElement?"undefined":r(HTMLElement),m=function(e){return e&&e.instanceString&&x(e.instanceString)?e.instanceString():null},b=function(e){return null!=e&&r(e)==f},x=function(e){return null!=e&&r(e)===v},w=function(e){return!S(e)&&(Array.isArray?Array.isArray(e):null!=e&&e instanceof Array)},E=function(e){return null!=e&&r(e)===g&&!w(e)&&e.constructor===Object},k=function(e){return null!=e&&r(e)===r(1)&&!isNaN(e)},C=function(e){return"undefined"===y?void 0:null!=e&&e instanceof HTMLElement},S=function(e){return P(e)||D(e)},P=function(e){return"collection"===m(e)&&e._private.single},D=function(e){return"collection"===m(e)&&!e._private.single},T=function(e){return"core"===m(e)},_=function(e){return"stylesheet"===m(e)},M=function(e){return null==e||!(""!==e&&!e.match(/^\s+$/))},B=function(e){return function(e){return null!=e&&r(e)===g}(e)&&x(e.then)},N=function(e,t){t||(t=function(){if(1===arguments.length)return arguments[0];if(0===arguments.length)return"undefined";for(var e=[],t=0;tt?1:0},Y=null!=Object.assign?Object.assign.bind(Object):function(e){for(var t=arguments,n=1;n255)return;t.push(Math.floor(i))}var o=r[1]||r[2]||r[3],s=r[1]&&r[2]&&r[3];if(o&&!s)return;var l=n[4];if(void 0!==l){if((l=parseFloat(l))<0||l>1)return;t.push(l)}}return t}(e)||function(e){var t,n,r,a,i,o,s,l;function u(e,t,n){return n<0&&(n+=1),n>1&&(n-=1),n<1/6?e+6*(t-e)*n:n<.5?t:n<2/3?e+(t-e)*(2/3-n)*6:e}var c=new RegExp("^"+F+"$").exec(e);if(c){if((n=parseInt(c[1]))<0?n=(360- -1*n%360)%360:n>360&&(n%=360),n/=360,(r=parseFloat(c[2]))<0||r>100)return;if(r/=100,(a=parseFloat(c[3]))<0||a>100)return;if(a/=100,void 0!==(i=c[4])&&((i=parseFloat(i))<0||i>1))return;if(0===r)o=s=l=Math.round(255*a);else{var d=a<.5?a*(1+r):a+r-a*r,h=2*a-d;o=Math.round(255*u(h,d,n+1/3)),s=Math.round(255*u(h,d,n)),l=Math.round(255*u(h,d,n-1/3))}t=[o,s,l,i]}return t}(e)},W={transparent:[0,0,0,0],aliceblue:[240,248,255],antiquewhite:[250,235,215],aqua:[0,255,255],aquamarine:[127,255,212],azure:[240,255,255],beige:[245,245,220],bisque:[255,228,196],black:[0,0,0],blanchedalmond:[255,235,205],blue:[0,0,255],blueviolet:[138,43,226],brown:[165,42,42],burlywood:[222,184,135],cadetblue:[95,158,160],chartreuse:[127,255,0],chocolate:[210,105,30],coral:[255,127,80],cornflowerblue:[100,149,237],cornsilk:[255,248,220],crimson:[220,20,60],cyan:[0,255,255],darkblue:[0,0,139],darkcyan:[0,139,139],darkgoldenrod:[184,134,11],darkgray:[169,169,169],darkgreen:[0,100,0],darkgrey:[169,169,169],darkkhaki:[189,183,107],darkmagenta:[139,0,139],darkolivegreen:[85,107,47],darkorange:[255,140,0],darkorchid:[153,50,204],darkred:[139,0,0],darksalmon:[233,150,122],darkseagreen:[143,188,143],darkslateblue:[72,61,139],darkslategray:[47,79,79],darkslategrey:[47,79,79],darkturquoise:[0,206,209],darkviolet:[148,0,211],deeppink:[255,20,147],deepskyblue:[0,191,255],dimgray:[105,105,105],dimgrey:[105,105,105],dodgerblue:[30,144,255],firebrick:[178,34,34],floralwhite:[255,250,240],forestgreen:[34,139,34],fuchsia:[255,0,255],gainsboro:[220,220,220],ghostwhite:[248,248,255],gold:[255,215,0],goldenrod:[218,165,32],gray:[128,128,128],grey:[128,128,128],green:[0,128,0],greenyellow:[173,255,47],honeydew:[240,255,240],hotpink:[255,105,180],indianred:[205,92,92],indigo:[75,0,130],ivory:[255,255,240],khaki:[240,230,140],lavender:[230,230,250],lavenderblush:[255,240,245],lawngreen:[124,252,0],lemonchiffon:[255,250,205],lightblue:[173,216,230],lightcoral:[240,128,128],lightcyan:[224,255,255],lightgoldenrodyellow:[250,250,210],lightgray:[211,211,211],lightgreen:[144,238,144],lightgrey:[211,211,211],lightpink:[255,182,193],lightsalmon:[255,160,122],lightseagreen:[32,178,170],lightskyblue:[135,206,250],lightslategray:[119,136,153],lightslategrey:[119,136,153],lightsteelblue:[176,196,222],lightyellow:[255,255,224],lime:[0,255,0],limegreen:[50,205,50],linen:[250,240,230],magenta:[255,0,255],maroon:[128,0,0],mediumaquamarine:[102,205,170],mediumblue:[0,0,205],mediumorchid:[186,85,211],mediumpurple:[147,112,219],mediumseagreen:[60,179,113],mediumslateblue:[123,104,238],mediumspringgreen:[0,250,154],mediumturquoise:[72,209,204],mediumvioletred:[199,21,133],midnightblue:[25,25,112],mintcream:[245,255,250],mistyrose:[255,228,225],moccasin:[255,228,181],navajowhite:[255,222,173],navy:[0,0,128],oldlace:[253,245,230],olive:[128,128,0],olivedrab:[107,142,35],orange:[255,165,0],orangered:[255,69,0],orchid:[218,112,214],palegoldenrod:[238,232,170],palegreen:[152,251,152],paleturquoise:[175,238,238],palevioletred:[219,112,147],papayawhip:[255,239,213],peachpuff:[255,218,185],peru:[205,133,63],pink:[255,192,203],plum:[221,160,221],powderblue:[176,224,230],purple:[128,0,128],red:[255,0,0],rosybrown:[188,143,143],royalblue:[65,105,225],saddlebrown:[139,69,19],salmon:[250,128,114],sandybrown:[244,164,96],seagreen:[46,139,87],seashell:[255,245,238],sienna:[160,82,45],silver:[192,192,192],skyblue:[135,206,235],slateblue:[106,90,205],slategray:[112,128,144],slategrey:[112,128,144],snow:[255,250,250],springgreen:[0,255,127],steelblue:[70,130,180],tan:[210,180,140],teal:[0,128,128],thistle:[216,191,216],tomato:[255,99,71],turquoise:[64,224,208],violet:[238,130,238],wheat:[245,222,179],white:[255,255,255],whitesmoke:[245,245,245],yellow:[255,255,0],yellowgreen:[154,205,50]},H=function(e){for(var t=e.map,n=e.keys,r=n.length,a=0;a=t||n<0||d&&e-u>=i}function g(){var e=J();if(f(e))return v(e);s=setTimeout(g,function(e){var n=t-(e-l);return d?Ee(n,i-(e-u)):n}(e))}function v(e){return s=void 0,h&&r?p(e):(r=a=void 0,o)}function y(){var e=J(),n=f(e);if(r=arguments,a=this,l=e,n){if(void 0===s)return function(e){return u=e,s=setTimeout(g,t),c?p(e):o}(l);if(d)return clearTimeout(s),s=setTimeout(g,t),p(l)}return void 0===s&&(s=setTimeout(g,t)),o}return t=xe(t)||0,G(n)&&(c=!!n.leading,i=(d="maxWait"in n)?we(xe(n.maxWait)||0,t):i,h="trailing"in n?!!n.trailing:h),y.cancel=function(){void 0!==s&&clearTimeout(s),u=0,r=l=a=s=void 0},y.flush=function(){return void 0===s?o:v(J())},y},Ce=h?h.performance:null,Se=Ce&&Ce.now?function(){return Ce.now()}:function(){return Date.now()},Pe=function(){if(h){if(h.requestAnimationFrame)return function(e){h.requestAnimationFrame(e)};if(h.mozRequestAnimationFrame)return function(e){h.mozRequestAnimationFrame(e)};if(h.webkitRequestAnimationFrame)return function(e){h.webkitRequestAnimationFrame(e)};if(h.msRequestAnimationFrame)return function(e){h.msRequestAnimationFrame(e)}}return function(e){e&&setTimeout((function(){e(Se())}),1e3/60)}}(),De=function(e){return Pe(e)},Te=Se,_e=9261,Me=5381,Be=function(e){for(var t,n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:_e;!(t=e.next()).done;)n=65599*n+t.value|0;return n},Ne=function(e){return 65599*(arguments.length>1&&void 0!==arguments[1]?arguments[1]:_e)+e|0},Ie=function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:Me;return(t<<5)+t+e|0},ze=function(e){return 2097152*e[0]+e[1]},Ae=function(e,t){return[Ne(e[0],t[0]),Ie(e[1],t[1])]},Le=function(e,t){var n={value:0,done:!1},r=0,a=e.length;return Be({next:function(){return r=0&&(e[r]!==t||(e.splice(r,1),!n));r--);},nt=function(e){e.splice(0,e.length)},rt=function(e,t,n){return n&&(t=A(n,t)),e[t]},at=function(e,t,n,r){n&&(t=A(n,t)),e[t]=r},it="undefined"!=typeof Map?Map:function(){function e(){a(this,e),this._obj={}}return o(e,[{key:"set",value:function(e,t){return this._obj[e]=t,this}},{key:"delete",value:function(e){return this._obj[e]=void 0,this}},{key:"clear",value:function(){this._obj={}}},{key:"has",value:function(e){return void 0!==this._obj[e]}},{key:"get",value:function(e){return this._obj[e]}}]),e}(),ot=function(){function e(t){if(a(this,e),this._obj=Object.create(null),this.size=0,null!=t){var n;n=null!=t.instanceString&&t.instanceString()===this.instanceString()?t.toArray():t;for(var r=0;r2&&void 0!==arguments[2])||arguments[2];if(void 0!==e&&void 0!==t&&T(e)){var r=t.group;if(null==r&&(r=t.data&&null!=t.data.source&&null!=t.data.target?"edges":"nodes"),"nodes"===r||"edges"===r){this.length=1,this[0]=this;var a=this._private={cy:e,single:!0,data:t.data||{},position:t.position||{x:0,y:0},autoWidth:void 0,autoHeight:void 0,autoPadding:void 0,compoundBoundsClean:!1,listeners:[],group:r,style:{},rstyle:{},styleCxts:[],styleKeys:{},removed:!0,selected:!!t.selected,selectable:void 0===t.selectable||!!t.selectable,locked:!!t.locked,grabbed:!1,grabbable:void 0===t.grabbable||!!t.grabbable,pannable:void 0===t.pannable?"edges"===r:!!t.pannable,active:!1,classes:new st,animation:{current:[],queue:[]},rscratch:{},scratch:t.scratch||{},edges:[],children:[],parent:t.parent&&t.parent.isNode()?t.parent:null,traversalCache:{},backgrounding:!1,bbCache:null,bbCacheShift:{x:0,y:0},bodyBounds:null,overlayBounds:null,labelBounds:{all:null,source:null,target:null,main:null},arrowBounds:{source:null,target:null,"mid-source":null,"mid-target":null}};if(null==a.position.x&&(a.position.x=0),null==a.position.y&&(a.position.y=0),t.renderedPosition){var i=t.renderedPosition,o=e.pan(),s=e.zoom();a.position={x:(i.x-o.x)/s,y:(i.y-o.y)/s}}var l=[];w(t.classes)?l=t.classes:b(t.classes)&&(l=t.classes.split(/\s+/));for(var u=0,c=l.length;ut?1:0},u=function(e,t,a,i,o){var s;if(null==a&&(a=0),null==o&&(o=n),a<0)throw new Error("lo must be non-negative");for(null==i&&(i=e.length);an;0<=n?t++:t--)u.push(t);return u}.apply(this).reverse()).length;ig;0<=g?++h:--h)v.push(i(e,r));return v},f=function(e,t,r,a){var i,o,s;for(null==a&&(a=n),i=e[r];r>t&&a(i,o=e[s=r-1>>1])<0;)e[r]=o,r=s;return e[r]=i},g=function(e,t,r){var a,i,o,s,l;for(null==r&&(r=n),i=e.length,l=t,o=e[t],a=2*t+1;a0;){var k=y.pop(),C=g(k),S=k.id();if(d[S]=C,C!==1/0)for(var P=k.neighborhood().intersect(p),D=0;D0)for(n.unshift(t);c[a];){var i=c[a];n.unshift(i.edge),n.unshift(i.node),a=(r=i.node).id()}return o.spawn(n)}}}},gt={kruskal:function(e){e=e||function(e){return 1};for(var t=this.byGroup(),n=t.nodes,r=t.edges,a=n.length,i=new Array(a),o=n,s=function(e){for(var t=0;t0;){if(l=g.pop(),u=l.id(),v.delete(u),w++,u===d){for(var E=[],k=a,C=d,S=m[C];E.unshift(k),null!=S&&E.unshift(S),null!=(k=y[C]);)S=m[C=k.id()];return{found:!0,distance:h[u],path:this.spawn(E),steps:w}}f[u]=!0;for(var P=l._private.edges,D=0;DD&&(p[P]=D,y[P]=S,m[P]=w),!a){var T=S*u+C;!a&&p[T]>D&&(p[T]=D,y[T]=C,m[T]=w)}}}for(var _=0;_1&&void 0!==arguments[1]?arguments[1]:i,r=[],a=m(e);;){if(null==a)return t.spawn();var o=y(a),l=o.edge,u=o.pred;if(r.unshift(a[0]),a.same(n)&&r.length>0)break;null!=l&&r.unshift(l),a=u}return s.spawn(r)},hasNegativeWeightCycle:f,negativeWeightCycles:g}}},Et=Math.sqrt(2),kt=function(e,t,n){0===n.length&&Ke("Karger-Stein must be run on a connected (sub)graph");for(var r=n[e],a=r[1],i=r[2],o=t[a],s=t[i],l=n,u=l.length-1;u>=0;u--){var c=l[u],d=c[1],h=c[2];(t[d]===o&&t[h]===s||t[d]===s&&t[h]===o)&&l.splice(u,1)}for(var p=0;pr;){var a=Math.floor(Math.random()*t.length);t=kt(a,e,t),n--}return t},St={kargerStein:function(){var e=this,t=this.byGroup(),n=t.nodes,r=t.edges;r.unmergeBy((function(e){return e.isLoop()}));var a=n.length,i=r.length,o=Math.ceil(Math.pow(Math.log(a)/Math.LN2,2)),s=Math.floor(a/Et);if(!(a<2)){for(var l=[],u=0;u0?1:e<0?-1:0},Nt=function(e,t){return Math.sqrt(It(e,t))},It=function(e,t){var n=t.x-e.x,r=t.y-e.y;return n*n+r*r},zt=function(e){for(var t=e.length,n=0,r=0;r=e.x1&&e.y2>=e.y1)return{x1:e.x1,y1:e.y1,x2:e.x2,y2:e.y2,w:e.x2-e.x1,h:e.y2-e.y1};if(null!=e.w&&null!=e.h&&e.w>=0&&e.h>=0)return{x1:e.x1,y1:e.y1,x2:e.x1+e.w,y2:e.y1+e.h,w:e.w,h:e.h}}},Vt=function(e,t){e.x1=Math.min(e.x1,t.x1),e.x2=Math.max(e.x2,t.x2),e.w=e.x2-e.x1,e.y1=Math.min(e.y1,t.y1),e.y2=Math.max(e.y2,t.y2),e.h=e.y2-e.y1},Ft=function(e,t,n){e.x1=Math.min(e.x1,t),e.x2=Math.max(e.x2,t),e.w=e.x2-e.x1,e.y1=Math.min(e.y1,n),e.y2=Math.max(e.y2,n),e.h=e.y2-e.y1},jt=function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:0;return e.x1-=t,e.x2+=t,e.y1-=t,e.y2+=t,e.w=e.x2-e.x1,e.h=e.y2-e.y1,e},qt=function(e){var t,n,r,a,i=arguments.length>1&&void 0!==arguments[1]?arguments[1]:[0];if(1===i.length)t=n=r=a=i[0];else if(2===i.length)t=r=i[0],a=n=i[1];else if(4===i.length){var o=l(i,4);t=o[0],n=o[1],r=o[2],a=o[3]}return e.x1-=a,e.x2+=n,e.y1-=t,e.y2+=r,e.w=e.x2-e.x1,e.h=e.y2-e.y1,e},Yt=function(e,t){e.x1=t.x1,e.y1=t.y1,e.x2=t.x2,e.y2=t.y2,e.w=e.x2-e.x1,e.h=e.y2-e.y1},Xt=function(e,t){return!(e.x1>t.x2)&&(!(t.x1>e.x2)&&(!(e.x2t.y2)&&!(t.y1>e.y2)))))))},Wt=function(e,t,n){return e.x1<=t&&t<=e.x2&&e.y1<=n&&n<=e.y2},Ht=function(e,t){return Wt(e,t.x1,t.y1)&&Wt(e,t.x2,t.y2)},Kt=function(e,t,n,r,a,i,o){var s,l,u=arguments.length>7&&void 0!==arguments[7]?arguments[7]:"auto",c="auto"===u?hn(a,i):u,d=a/2,h=i/2,p=(c=Math.min(c,d,h))!==d,f=c!==h;if(p){var g=r-h-o;if((s=on(e,t,n,r,n-d+c-o,g,n+d-c+o,g,!1)).length>0)return s}if(f){var v=n+d+o;if((s=on(e,t,n,r,v,r-h+c-o,v,r+h-c+o,!1)).length>0)return s}if(p){var y=r+h+o;if((s=on(e,t,n,r,n-d+c-o,y,n+d-c+o,y,!1)).length>0)return s}if(f){var m=n-d-o;if((s=on(e,t,n,r,m,r-h+c-o,m,r+h-c+o,!1)).length>0)return s}var b=n-d+c,x=r-h+c;if((l=rn(e,t,n,r,b,x,c+o)).length>0&&l[0]<=b&&l[1]<=x)return[l[0],l[1]];var w=n+d-c,E=r-h+c;if((l=rn(e,t,n,r,w,E,c+o)).length>0&&l[0]>=w&&l[1]<=E)return[l[0],l[1]];var k=n+d-c,C=r+h-c;if((l=rn(e,t,n,r,k,C,c+o)).length>0&&l[0]>=k&&l[1]>=C)return[l[0],l[1]];var S=n-d+c,P=r+h-c;return(l=rn(e,t,n,r,S,P,c+o)).length>0&&l[0]<=S&&l[1]>=P?[l[0],l[1]]:[]},Gt=function(e,t,n,r,a,i,o){var s=o,l=Math.min(n,a),u=Math.max(n,a),c=Math.min(r,i),d=Math.max(r,i);return l-s<=e&&e<=u+s&&c-s<=t&&t<=d+s},Ut=function(e,t,n,r,a,i,o,s,l){var u=Math.min(n,o,a)-l,c=Math.max(n,o,a)+l,d=Math.min(r,s,i)-l,h=Math.max(r,s,i)+l;return!(ec||th)},Zt=function(e,t,n,r,a,i,o,s){var l=[];!function(e,t,n,r,a){var i,o,s,l,u,c,d,h;0===e&&(e=1e-5),s=-27*(r/=e)+(t/=e)*(9*(n/=e)-t*t*2),i=(o=(3*n-t*t)/9)*o*o+(s/=54)*s,a[1]=0,d=t/3,i>0?(u=(u=s+Math.sqrt(i))<0?-Math.pow(-u,1/3):Math.pow(u,1/3),c=(c=s-Math.sqrt(i))<0?-Math.pow(-c,1/3):Math.pow(c,1/3),a[0]=-d+u+c,d+=(u+c)/2,a[4]=a[2]=-d,d=Math.sqrt(3)*(-c+u)/2,a[3]=d,a[5]=-d):(a[5]=a[3]=0,0===i?(h=s<0?-Math.pow(-s,1/3):Math.pow(s,1/3),a[0]=2*h-d,a[4]=a[2]=-(h+d)):(l=(o=-o)*o*o,l=Math.acos(s/Math.sqrt(l)),h=2*Math.sqrt(o),a[0]=-d+h*Math.cos(l/3),a[2]=-d+h*Math.cos((l+2*Math.PI)/3),a[4]=-d+h*Math.cos((l+4*Math.PI)/3)))}(1*n*n-4*n*a+2*n*o+4*a*a-4*a*o+o*o+r*r-4*r*i+2*r*s+4*i*i-4*i*s+s*s,9*n*a-3*n*n-3*n*o-6*a*a+3*a*o+9*r*i-3*r*r-3*r*s-6*i*i+3*i*s,3*n*n-6*n*a+n*o-n*e+2*a*a+2*a*e-o*e+3*r*r-6*r*i+r*s-r*t+2*i*i+2*i*t-s*t,1*n*a-n*n+n*e-a*e+r*i-r*r+r*t-i*t,l);for(var u=[],c=0;c<6;c+=2)Math.abs(l[c+1])<1e-7&&l[c]>=0&&l[c]<=1&&u.push(l[c]);u.push(1),u.push(0);for(var d,h,p,f=-1,g=0;g=0?pl?(e-a)*(e-a)+(t-i)*(t-i):u-d},Qt=function(e,t,n){for(var r,a,i,o,s=0,l=0;l=e&&e>=i||r<=e&&e<=i))continue;(e-r)/(i-r)*(o-a)+a>t&&s++}return s%2!=0},Jt=function(e,t,n,r,a,i,o,s,l){var u,c=new Array(n.length);null!=s[0]?(u=Math.atan(s[1]/s[0]),s[0]<0?u+=Math.PI/2:u=-u-Math.PI/2):u=s;for(var d,h=Math.cos(-u),p=Math.sin(-u),f=0;f0){var g=tn(c,-l);d=en(g)}else d=c;return Qt(e,t,d)},en=function(e){for(var t,n,r,a,i,o,s,l,u=new Array(e.length/2),c=0;c=0&&f<=1&&v.push(f),g>=0&&g<=1&&v.push(g),0===v.length)return[];var y=v[0]*s[0]+e,m=v[0]*s[1]+t;return v.length>1?v[0]==v[1]?[y,m]:[y,m,v[1]*s[0]+e,v[1]*s[1]+t]:[y,m]},an=function(e,t,n){return t<=e&&e<=n||n<=e&&e<=t?e:e<=t&&t<=n||n<=t&&t<=e?t:n},on=function(e,t,n,r,a,i,o,s,l){var u=e-a,c=n-e,d=o-a,h=t-i,p=r-t,f=s-i,g=d*h-f*u,v=c*h-p*u,y=f*c-d*p;if(0!==y){var m=g/y,b=v/y,x=-.001;return x<=m&&m<=1.001&&x<=b&&b<=1.001||l?[e+m*c,t+m*p]:[]}return 0===g||0===v?an(e,n,o)===o?[o,s]:an(e,n,a)===a?[a,i]:an(a,o,n)===n?[n,r]:[]:[]},sn=function(e,t,n,r,a,i,o,s){var l,u,c,d,h,p,f=[],g=new Array(n.length),v=!0;if(null==i&&(v=!1),v){for(var y=0;y0){var m=tn(g,-s);u=en(m)}else u=g}else u=n;for(var b=0;bu&&(u=t)},d=function(e){return l[e]},h=0;h0?b.edgesTo(m)[0]:m.edgesTo(b)[0];var w=r(x);m=m.id(),h[m]>h[v]+w&&(h[m]=h[v]+w,p.nodes.indexOf(m)<0?p.push(m):p.updateItem(m),u[m]=0,l[m]=[]),h[m]==h[v]+w&&(u[m]=u[m]+u[v],l[m].push(v))}else for(var E=0;E0;){for(var P=n.pop(),D=0;D0&&o.push(n[s]);0!==o.length&&a.push(r.collection(o))}return a}(c,l,t,r);return b=function(e){for(var t=0;t5&&void 0!==arguments[5]?arguments[5]:In,o=r,s=0;s=2?Vn(e,t,n,0,Ln,On):Vn(e,t,n,0,An)},squaredEuclidean:function(e,t,n){return Vn(e,t,n,0,Ln)},manhattan:function(e,t,n){return Vn(e,t,n,0,An)},max:function(e,t,n){return Vn(e,t,n,-1/0,Rn)}};function jn(e,t,n,r,a,i){var o;return o=x(e)?e:Fn[e]||Fn.euclidean,0===t&&x(e)?o(a,i):o(t,n,r,a,i)}Fn["squared-euclidean"]=Fn.squaredEuclidean,Fn.squaredeuclidean=Fn.squaredEuclidean;var qn=et({k:2,m:2,sensitivityThreshold:1e-4,distance:"euclidean",maxIterations:10,attributes:[],testMode:!1,testCentroids:null}),Yn=function(e){return qn(e)},Xn=function(e,t,n,r,a){var i="kMedoids"!==a?function(e){return n[e]}:function(e){return r[e](n)},o=n,s=t;return jn(e,r.length,i,(function(e){return r[e](t)}),o,s)},Wn=function(e,t,n){for(var r=n.length,a=new Array(r),i=new Array(r),o=new Array(t),s=null,l=0;ln)return!1}return!0},Zn=function(e,t,n){for(var r=0;ra&&(a=t[l][u],i=u);o[i].push(e[l])}for(var c=0;c=a.threshold||"dendrogram"===a.mode&&1===e.length)return!1;var p,f=t[o],g=t[r[o]];p="dendrogram"===a.mode?{left:f,right:g,key:f.key}:{value:f.value.concat(g.value),key:f.key},e[f.index]=p,e.splice(g.index,1),t[f.key]=p;for(var v=0;vn[g.key][y.key]&&(i=n[g.key][y.key])):"max"===a.linkage?(i=n[f.key][y.key],n[f.key][y.key]1&&void 0!==arguments[1]?arguments[1]:0,n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:e.length,r=!(arguments.length>4&&void 0!==arguments[4])||arguments[4],a=!(arguments.length>5&&void 0!==arguments[5])||arguments[5];arguments.length>3&&void 0!==arguments[3]&&!arguments[3]?(n0&&e.splice(0,t)):e=e.slice(t,n);for(var i=0,o=e.length-1;o>=0;o--){var s=e[o];a?isFinite(s)||(e[o]=-1/0,i++):e.splice(o,1)}r&&e.sort((function(e,t){return e-t}));var l=e.length,u=Math.floor(l/2);return l%2!=0?e[u+1+i]:(e[u-1+i]+e[u+i])/2}(e):"mean"===t?function(e){for(var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:0,n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:e.length,r=0,a=0,i=t;i1&&void 0!==arguments[1]?arguments[1]:0,n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:e.length,r=1/0,a=t;a1&&void 0!==arguments[1]?arguments[1]:0,n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:e.length,r=-1/0,a=t;ao&&(i=l,o=t[a*e+l])}i>0&&r.push(i)}for(var u=0;u=D?(T=D,D=M,_=B):M>T&&(T=M);for(var N=0;N0?1:0;C[E%u.minIterations*t+R]=V,O+=V}if(O>0&&(E>=u.minIterations-1||E==u.maxIterations-1)){for(var F=0,j=0;j0&&r.push(a);return r}(t,i,o),X=function(e,t,n){for(var r=fr(e,t,n),a=0;al&&(s=u,l=c)}n[a]=i[s]}return fr(e,t,n)}(t,r,Y),W={},H=0;H1||o>1)&&(u=!0),c[t]=[],e.outgoers().forEach((function(e){e.isEdge()&&c[t].push(e.id())}))}else d[t]=[void 0,e.target().id()]})):l.forEach((function(e){var t=e.id();e.isNode()?(e.degree(!0)%2&&(n?r?u=!0:r=t:n=t),c[t]=[],e.connectedEdges().forEach((function(e){return c[t].push(e.id())}))):d[t]=[e.source().id(),e.target().id()]}));var h={found:!1,trail:void 0};if(u)return h;if(r&&n)if(s){if(a&&r!=a)return h;a=r}else{if(a&&r!=a&&n!=a)return h;a||(a=r)}else a||(a=l[0].id());var p=function(e){for(var t,n,r,a=e,i=[e];c[a].length;)t=c[a].shift(),n=d[t][0],a!=(r=d[t][1])?(c[r]=c[r].filter((function(e){return e!=t})),a=r):s||a==n||(c[n]=c[n].filter((function(e){return e!=t})),a=n),i.unshift(t),i.unshift(a);return i},f=[],g=[];for(g=p(a);1!=g.length;)0==c[g[0]].length?(f.unshift(l.getElementById(g.shift())),f.unshift(l.getElementById(g.shift()))):g=p(g.shift()).concat(g);for(var v in f.unshift(l.getElementById(g.shift())),c)if(c[v].length)return h;return h.found=!0,h.trail=this.spawn(f,!0),h}},br=function(){var e=this,t={},n=0,r=0,a=[],i=[],o={},s=function s(l,u,c){l===c&&(r+=1),t[u]={id:n,low:n++,cutVertex:!1};var d,h,p,f,g=e.getElementById(u).connectedEdges().intersection(e);0===g.size()?a.push(e.spawn(e.getElementById(u))):g.forEach((function(n){d=n.source().id(),h=n.target().id(),(p=d===u?h:d)!==c&&(f=n.id(),o[f]||(o[f]=!0,i.push({x:u,y:p,edge:n})),p in t?t[u].low=Math.min(t[u].low,t[p].id):(s(l,p,u),t[u].low=Math.min(t[u].low,t[p].low),t[u].id<=t[p].low&&(t[u].cutVertex=!0,function(n,r){for(var o=i.length-1,s=[],l=e.spawn();i[o].x!=n||i[o].y!=r;)s.push(i.pop().edge),o--;s.push(i.pop().edge),s.forEach((function(n){var r=n.connectedNodes().intersection(e);l.merge(n),r.forEach((function(n){var r=n.id(),a=n.connectedEdges().intersection(e);l.merge(n),t[r].cutVertex?l.merge(a.filter((function(e){return e.isLoop()}))):l.merge(a)}))})),a.push(l)}(u,p))))}))};e.forEach((function(e){if(e.isNode()){var n=e.id();n in t||(r=0,s(n,n),t[n].cutVertex=r>1)}}));var l=Object.keys(t).filter((function(e){return t[e].cutVertex})).map((function(t){return e.getElementById(t)}));return{cut:e.spawn(l),components:a}},xr=function(){var e=this,t={},n=0,r=[],a=[],i=e.spawn(e),o=function o(s){if(a.push(s),t[s]={index:n,low:n++,explored:!1},e.getElementById(s).connectedEdges().intersection(e).forEach((function(e){var n=e.target().id();n!==s&&(n in t||o(n),t[n].explored||(t[s].low=Math.min(t[s].low,t[n].low)))})),t[s].index===t[s].low){for(var l=e.spawn();;){var u=a.pop();if(l.merge(e.getElementById(u)),t[u].low=t[s].index,t[u].explored=!0,u===s)break}var c=l.edgesWith(l),d=l.merge(c);r.push(d),i=i.difference(d)}};return e.forEach((function(e){if(e.isNode()){var n=e.id();n in t||o(n)}})),{cut:i,components:r}},wr={};[ct,ft,gt,yt,bt,wt,St,vn,mn,xn,En,Nn,nr,cr,vr,mr,{hopcroftTarjanBiconnected:br,htbc:br,htb:br,hopcroftTarjanBiconnectedComponents:br},{tarjanStronglyConnected:xr,tsc:xr,tscc:xr,tarjanStronglyConnectedComponents:xr}].forEach((function(e){Y(wr,e)}));var Er=function e(t){if(!(this instanceof e))return new e(t);this.id="Thenable/1.0.7",this.state=0,this.fulfillValue=void 0,this.rejectReason=void 0,this.onFulfilled=[],this.onRejected=[],this.proxy={then:this.then.bind(this)},"function"==typeof t&&t.call(this,this.fulfill.bind(this),this.reject.bind(this))};Er.prototype={fulfill:function(e){return kr(this,1,"fulfillValue",e)},reject:function(e){return kr(this,2,"rejectReason",e)},then:function(e,t){var n=this,r=new Er;return n.onFulfilled.push(Pr(e,r,"fulfill")),n.onRejected.push(Pr(t,r,"reject")),Cr(n),r.proxy}};var kr=function(e,t,n,r){return 0===e.state&&(e.state=t,e[n]=r,Cr(e)),e},Cr=function(e){1===e.state?Sr(e,"onFulfilled",e.fulfillValue):2===e.state&&Sr(e,"onRejected",e.rejectReason)},Sr=function(e,t,n){if(0!==e[t].length){var r=e[t];e[t]=[];var a=function(){for(var e=0;e0:void 0}},clearQueue:function(){return function(){var e=this,t=void 0!==e.length?e:[e];if(!(this._private.cy||this).styleEnabled())return this;for(var n=0;n-1};var ga=function(e,t){var n=this.__data__,r=ca(n,e);return r<0?(++this.size,n.push([e,t])):n[r][1]=t,this};function va(e){var t=-1,n=null==e?0:e.length;for(this.clear();++t-1&&e%1==0&&e0&&this.spawn(r).updateStyle().emit("class"),t},addClass:function(e){return this.toggleClass(e,!0)},hasClass:function(e){var t=this[0];return null!=t&&t._private.classes.has(e)},toggleClass:function(e,t){w(e)||(e=e.match(/\S+/g)||[]);for(var n=this,r=void 0===t,a=[],i=0,o=n.length;i0&&this.spawn(a).updateStyle().emit("class"),n},removeClass:function(e){return this.toggleClass(e,!1)},flashClass:function(e,t){var n=this;if(null==t)t=250;else if(0===t)return n;return n.addClass(e),setTimeout((function(){n.removeClass(e)}),t),n}};ai.className=ai.classNames=ai.classes;var ii={metaChar:"[\\!\\\"\\#\\$\\%\\&\\'\\(\\)\\*\\+\\,\\.\\/\\:\\;\\<\\=\\>\\?\\@\\[\\]\\^\\`\\{\\|\\}\\~]",comparatorOp:"=|\\!=|>|>=|<|<=|\\$=|\\^=|\\*=",boolOp:"\\?|\\!|\\^",string:"\"(?:\\\\\"|[^\"])*\"|'(?:\\\\'|[^'])*'",number:O,meta:"degree|indegree|outdegree",separator:"\\s*,\\s*",descendant:"\\s+",child:"\\s+>\\s+",subject:"\\$",group:"node|edge|\\*",directedEdge:"\\s+->\\s+",undirectedEdge:"\\s+<->\\s+"};ii.variable="(?:[\\w-.]|(?:\\\\"+ii.metaChar+"))+",ii.className="(?:[\\w-]|(?:\\\\"+ii.metaChar+"))+",ii.value=ii.string+"|"+ii.number,ii.id=ii.variable,function(){var e,t,n;for(e=ii.comparatorOp.split("|"),n=0;n=0||"="!==t&&(ii.comparatorOp+="|\\!"+t)}();var oi=0,si=1,li=2,ui=3,ci=4,di=5,hi=6,pi=7,fi=8,gi=9,vi=10,yi=11,mi=12,bi=13,xi=14,wi=15,Ei=16,ki=17,Ci=18,Si=19,Pi=20,Di=[{selector:":selected",matches:function(e){return e.selected()}},{selector:":unselected",matches:function(e){return!e.selected()}},{selector:":selectable",matches:function(e){return e.selectable()}},{selector:":unselectable",matches:function(e){return!e.selectable()}},{selector:":locked",matches:function(e){return e.locked()}},{selector:":unlocked",matches:function(e){return!e.locked()}},{selector:":visible",matches:function(e){return e.visible()}},{selector:":hidden",matches:function(e){return!e.visible()}},{selector:":transparent",matches:function(e){return e.transparent()}},{selector:":grabbed",matches:function(e){return e.grabbed()}},{selector:":free",matches:function(e){return!e.grabbed()}},{selector:":removed",matches:function(e){return e.removed()}},{selector:":inside",matches:function(e){return!e.removed()}},{selector:":grabbable",matches:function(e){return e.grabbable()}},{selector:":ungrabbable",matches:function(e){return!e.grabbable()}},{selector:":animated",matches:function(e){return e.animated()}},{selector:":unanimated",matches:function(e){return!e.animated()}},{selector:":parent",matches:function(e){return e.isParent()}},{selector:":childless",matches:function(e){return e.isChildless()}},{selector:":child",matches:function(e){return e.isChild()}},{selector:":orphan",matches:function(e){return e.isOrphan()}},{selector:":nonorphan",matches:function(e){return e.isChild()}},{selector:":compound",matches:function(e){return e.isNode()?e.isParent():e.source().isParent()||e.target().isParent()}},{selector:":loop",matches:function(e){return e.isLoop()}},{selector:":simple",matches:function(e){return e.isSimple()}},{selector:":active",matches:function(e){return e.active()}},{selector:":inactive",matches:function(e){return!e.active()}},{selector:":backgrounding",matches:function(e){return e.backgrounding()}},{selector:":nonbackgrounding",matches:function(e){return!e.backgrounding()}}].sort((function(e,t){return function(e,t){return-1*q(e,t)}(e.selector,t.selector)})),Ti=function(){for(var e,t={},n=0;n0&&u.edgeCount>0)return Ue("The selector `"+e+"` is invalid because it uses both a compound selector and an edge selector"),!1;if(u.edgeCount>1)return Ue("The selector `"+e+"` is invalid because it uses multiple edge selectors"),!1;1===u.edgeCount&&Ue("The selector `"+e+"` is deprecated. Edge selectors do not take effect on changes to source and target nodes after an edge is added, for performance reasons. Use a class or data selector on edges instead, updating the class or data of an edge when your app detects a change in source or target nodes.")}return!0},toString:function(){if(null!=this.toStringCache)return this.toStringCache;for(var e=function(e){return null==e?"":e},t=function(t){return b(t)?'"'+t+'"':e(t)},n=function(e){return" "+e+" "},r=function(r,i){var o=r.type,s=r.value;switch(o){case oi:var l=e(s);return l.substring(0,l.length-1);case ui:var u=r.field,c=r.operator;return"["+u+n(e(c))+t(s)+"]";case di:var d=r.operator,h=r.field;return"["+e(d)+h+"]";case ci:return"["+r.field+"]";case hi:var p=r.operator;return"[["+r.field+n(e(p))+t(s)+"]]";case pi:return s;case fi:return"#"+s;case gi:return"."+s;case ki:case wi:return a(r.parent,i)+n(">")+a(r.child,i);case Ci:case Ei:return a(r.ancestor,i)+" "+a(r.descendant,i);case Si:var f=a(r.left,i),g=a(r.subject,i),v=a(r.right,i);return f+(f.length>0?" ":"")+g+v;case Pi:return""}},a=function(e,t){return e.checks.reduce((function(n,a,i){return n+(t===e&&0===i?"$":"")+r(a,t)}),"")},i="",o=0;o1&&o=0&&(t=t.replace("!",""),c=!0),t.indexOf("@")>=0&&(t=t.replace("@",""),u=!0),(o||l||u)&&(a=o||s?""+e:"",i=""+n),u&&(e=a=a.toLowerCase(),n=i=i.toLowerCase()),t){case"*=":r=a.indexOf(i)>=0;break;case"$=":r=a.indexOf(i,a.length-i.length)>=0;break;case"^=":r=0===a.indexOf(i);break;case"=":r=e===n;break;case">":d=!0,r=e>n;break;case">=":d=!0,r=e>=n;break;case"<":d=!0,r=e0;){var u=a.shift();t(u),i.add(u.id()),o&&r(a,i,u)}return e}function Gi(e,t,n){if(n.isParent())for(var r=n._private.children,a=0;a1&&void 0!==arguments[1])||arguments[1],Gi)},Hi.forEachUp=function(e){return Ki(this,e,!(arguments.length>1&&void 0!==arguments[1])||arguments[1],Ui)},Hi.forEachUpAndDown=function(e){return Ki(this,e,!(arguments.length>1&&void 0!==arguments[1])||arguments[1],Zi)},Hi.ancestors=Hi.parents,(Yi=Xi={data:ni.data({field:"data",bindingEvent:"data",allowBinding:!0,allowSetting:!0,settingEvent:"data",settingTriggersEvent:!0,triggerFnName:"trigger",allowGetting:!0,immutableKeys:{id:!0,source:!0,target:!0,parent:!0},updateStyle:!0}),removeData:ni.removeData({field:"data",event:"data",triggerFnName:"trigger",triggerEvent:!0,immutableKeys:{id:!0,source:!0,target:!0,parent:!0},updateStyle:!0}),scratch:ni.data({field:"scratch",bindingEvent:"scratch",allowBinding:!0,allowSetting:!0,settingEvent:"scratch",settingTriggersEvent:!0,triggerFnName:"trigger",allowGetting:!0,updateStyle:!0}),removeScratch:ni.removeData({field:"scratch",event:"scratch",triggerFnName:"trigger",triggerEvent:!0,updateStyle:!0}),rscratch:ni.data({field:"rscratch",allowBinding:!1,allowSetting:!0,settingTriggersEvent:!1,allowGetting:!0}),removeRscratch:ni.removeData({field:"rscratch",triggerEvent:!1}),id:function(){var e=this[0];if(e)return e._private.data.id}}).attr=Yi.data,Yi.removeAttr=Yi.removeData;var $i,Qi,Ji=Xi,eo={};function to(e){return function(t){var n=this;if(void 0===t&&(t=!0),0!==n.length&&n.isNode()&&!n.removed()){for(var r=0,a=n[0],i=a._private.edges,o=0;ot})),minIndegree:no("indegree",(function(e,t){return et})),minOutdegree:no("outdegree",(function(e,t){return et}))}),Y(eo,{totalDegree:function(e){for(var t=0,n=this.nodes(),r=0;r0,c=u;u&&(l=l[0]);var d=c?l.position():{x:0,y:0};return a={x:s.x-d.x,y:s.y-d.y},void 0===e?a:a[e]}for(var h=0;h0,v=g;g&&(f=f[0]);var y=v?f.position():{x:0,y:0};void 0!==t?p.position(e,t+y[e]):void 0!==a&&p.position({x:a.x+y.x,y:a.y+y.y})}}else if(!i)return;return this}},$i.modelPosition=$i.point=$i.position,$i.modelPositions=$i.points=$i.positions,$i.renderedPoint=$i.renderedPosition,$i.relativePoint=$i.relativePosition;var io,oo,so=Qi;io=oo={},oo.renderedBoundingBox=function(e){var t=this.boundingBox(e),n=this.cy(),r=n.zoom(),a=n.pan(),i=t.x1*r+a.x,o=t.x2*r+a.x,s=t.y1*r+a.y,l=t.y2*r+a.y;return{x1:i,x2:o,y1:s,y2:l,w:o-i,h:l-s}},oo.dirtyCompoundBoundsCache=function(){var e=arguments.length>0&&void 0!==arguments[0]&&arguments[0],t=this.cy();return t.styleEnabled()&&t.hasCompoundNodes()?(this.forEachUp((function(t){if(t.isParent()){var n=t._private;n.compoundBoundsClean=!1,n.bbCache=null,e||t.emitAndNotify("bounds")}})),this):this},oo.updateCompoundBounds=function(){var e=arguments.length>0&&void 0!==arguments[0]&&arguments[0],t=this.cy();if(!t.styleEnabled()||!t.hasCompoundNodes())return this;if(!e&&t.batching())return this;function n(e){if(e.isParent()){var t=e._private,n=e.children(),r="include"===e.pstyle("compound-sizing-wrt-labels").value,a={width:{val:e.pstyle("min-width").pfValue,left:e.pstyle("min-width-bias-left"),right:e.pstyle("min-width-bias-right")},height:{val:e.pstyle("min-height").pfValue,top:e.pstyle("min-height-bias-top"),bottom:e.pstyle("min-height-bias-bottom")}},i=n.boundingBox({includeLabels:r,includeOverlays:!1,useCache:!1}),o=t.position;0!==i.w&&0!==i.h||((i={w:e.pstyle("width").pfValue,h:e.pstyle("height").pfValue}).x1=o.x-i.w/2,i.x2=o.x+i.w/2,i.y1=o.y-i.h/2,i.y2=o.y+i.h/2);var s=a.width.left.value;"px"===a.width.left.units&&a.width.val>0&&(s=100*s/a.width.val);var l=a.width.right.value;"px"===a.width.right.units&&a.width.val>0&&(l=100*l/a.width.val);var u=a.height.top.value;"px"===a.height.top.units&&a.height.val>0&&(u=100*u/a.height.val);var c=a.height.bottom.value;"px"===a.height.bottom.units&&a.height.val>0&&(c=100*c/a.height.val);var d=y(a.width.val-i.w,s,l),h=d.biasDiff,p=d.biasComplementDiff,f=y(a.height.val-i.h,u,c),g=f.biasDiff,v=f.biasComplementDiff;t.autoPadding=function(e,t,n,r){if("%"!==n.units)return"px"===n.units?n.pfValue:0;switch(r){case"width":return e>0?n.pfValue*e:0;case"height":return t>0?n.pfValue*t:0;case"average":return e>0&&t>0?n.pfValue*(e+t)/2:0;case"min":return e>0&&t>0?e>t?n.pfValue*t:n.pfValue*e:0;case"max":return e>0&&t>0?e>t?n.pfValue*e:n.pfValue*t:0;default:return 0}}(i.w,i.h,e.pstyle("padding"),e.pstyle("padding-relative-to").value),t.autoWidth=Math.max(i.w,a.width.val),o.x=(-h+i.x1+i.x2+p)/2,t.autoHeight=Math.max(i.h,a.height.val),o.y=(-g+i.y1+i.y2+v)/2}function y(e,t,n){var r=0,a=0,i=t+n;return e>0&&i>0&&(r=t/i*e,a=n/i*e),{biasDiff:r,biasComplementDiff:a}}}for(var r=0;re.x2?r:e.x2,e.y1=ne.y2?a:e.y2,e.w=e.x2-e.x1,e.h=e.y2-e.y1)},co=function(e,t){return null==t?e:uo(e,t.x1,t.y1,t.x2,t.y2)},ho=function(e,t,n){return rt(e,t,n)},po=function(e,t,n){if(!t.cy().headless()){var r,a,i=t._private,o=i.rstyle,s=o.arrowWidth/2;if("none"!==t.pstyle(n+"-arrow-shape").value){"source"===n?(r=o.srcX,a=o.srcY):"target"===n?(r=o.tgtX,a=o.tgtY):(r=o.midX,a=o.midY);var l=i.arrowBounds=i.arrowBounds||{},u=l[n]=l[n]||{};u.x1=r-s,u.y1=a-s,u.x2=r+s,u.y2=a+s,u.w=u.x2-u.x1,u.h=u.y2-u.y1,jt(u,1),uo(e,u.x1,u.y1,u.x2,u.y2)}}},fo=function(e,t,n){if(!t.cy().headless()){var r;r=n?n+"-":"";var a=t._private,i=a.rstyle;if(t.pstyle(r+"label").strValue){var o,s,l,u,c=t.pstyle("text-halign"),d=t.pstyle("text-valign"),h=ho(i,"labelWidth",n),p=ho(i,"labelHeight",n),f=ho(i,"labelX",n),g=ho(i,"labelY",n),v=t.pstyle(r+"text-margin-x").pfValue,y=t.pstyle(r+"text-margin-y").pfValue,m=t.isEdge(),b=t.pstyle(r+"text-rotation"),x=t.pstyle("text-outline-width").pfValue,w=t.pstyle("text-border-width").pfValue/2,E=t.pstyle("text-background-padding").pfValue,k=p,C=h,S=C/2,P=k/2;if(m)o=f-S,s=f+S,l=g-P,u=g+P;else{switch(c.value){case"left":o=f-C,s=f;break;case"center":o=f-S,s=f+S;break;case"right":o=f,s=f+C}switch(d.value){case"top":l=g-k,u=g;break;case"center":l=g-P,u=g+P;break;case"bottom":l=g,u=g+k}}var D=v-Math.max(x,w)-E-2,T=v+Math.max(x,w)+E+2,_=y-Math.max(x,w)-E-2,M=y+Math.max(x,w)+E+2;o+=D,s+=T,l+=_,u+=M;var B=n||"main",N=a.labelBounds,I=N[B]=N[B]||{};I.x1=o,I.y1=l,I.x2=s,I.y2=u,I.w=s-o,I.h=u-l,I.leftPad=D,I.rightPad=T,I.topPad=_,I.botPad=M;var z=m&&"autorotate"===b.strValue,A=null!=b.pfValue&&0!==b.pfValue;if(z||A){var L=z?ho(a.rstyle,"labelAngle",n):b.pfValue,O=Math.cos(L),R=Math.sin(L),V=(o+s)/2,F=(l+u)/2;if(!m){switch(c.value){case"left":V=s;break;case"right":V=o}switch(d.value){case"top":F=u;break;case"bottom":F=l}}var j=function(e,t){return{x:(e-=V)*O-(t-=F)*R+V,y:e*R+t*O+F}},q=j(o,l),Y=j(o,u),X=j(s,l),W=j(s,u);o=Math.min(q.x,Y.x,X.x,W.x),s=Math.max(q.x,Y.x,X.x,W.x),l=Math.min(q.y,Y.y,X.y,W.y),u=Math.max(q.y,Y.y,X.y,W.y)}var H=B+"Rot",K=N[H]=N[H]||{};K.x1=o,K.y1=l,K.x2=s,K.y2=u,K.w=s-o,K.h=u-l,uo(e,o,l,s,u),uo(a.labelBounds.all,o,l,s,u)}return e}},go=function(e,t){var n,r,a,i,o,s,l,u=e._private.cy,c=u.styleEnabled(),d=u.headless(),h=Rt(),p=e._private,f=e.isNode(),g=e.isEdge(),v=p.rstyle,y=f&&c?e.pstyle("bounds-expansion").pfValue:[0],m=function(e){return"none"!==e.pstyle("display").value},b=!c||m(e)&&(!g||m(e.source())&&m(e.target()));if(b){var x=0;c&&t.includeOverlays&&0!==e.pstyle("overlay-opacity").value&&(x=e.pstyle("overlay-padding").value);var w=0;c&&t.includeUnderlays&&0!==e.pstyle("underlay-opacity").value&&(w=e.pstyle("underlay-padding").value);var E=Math.max(x,w),k=0;if(c&&(k=e.pstyle("width").pfValue/2),f&&t.includeNodes){var C=e.position();o=C.x,s=C.y;var S=e.outerWidth()/2,P=e.outerHeight()/2;uo(h,n=o-S,a=s-P,r=o+S,i=s+P),c&&t.includeOutlines&&function(e,t){if(!t.cy().headless()){var n,r,a,i=t.pstyle("outline-opacity").value,o=t.pstyle("outline-width").value;if(i>0&&o>0){var s=t.pstyle("outline-offset").value,l=t.pstyle("shape").value,u=o+s,c=(e.w+2*u)/e.w,d=(e.h+2*u)/e.h,h=0;["diamond","pentagon","round-triangle"].includes(l)?(c=(e.w+2.4*u)/e.w,h=-u/3.6):["concave-hexagon","rhomboid","right-rhomboid"].includes(l)?c=(e.w+2.4*u)/e.w:"star"===l?(c=(e.w+2.8*u)/e.w,d=(e.h+2.6*u)/e.h,h=-u/3.8):"triangle"===l?(c=(e.w+2.8*u)/e.w,d=(e.h+2.4*u)/e.h,h=-u/1.4):"vee"===l&&(c=(e.w+4.4*u)/e.w,d=(e.h+3.8*u)/e.h,h=.5*-u);var p=e.h*d-e.h,f=e.w*c-e.w;if(qt(e,[Math.ceil(p/2),Math.ceil(f/2)]),0!==h){var g=(r=0,a=h,{x1:(n=e).x1+r,x2:n.x2+r,y1:n.y1+a,y2:n.y2+a,w:n.w,h:n.h});Vt(e,g)}}}}(h,e)}else if(g&&t.includeEdges)if(c&&!d){var D=e.pstyle("curve-style").strValue;if(n=Math.min(v.srcX,v.midX,v.tgtX),r=Math.max(v.srcX,v.midX,v.tgtX),a=Math.min(v.srcY,v.midY,v.tgtY),i=Math.max(v.srcY,v.midY,v.tgtY),uo(h,n-=k,a-=k,r+=k,i+=k),"haystack"===D){var T=v.haystackPts;if(T&&2===T.length){if(n=T[0].x,a=T[0].y,n>(r=T[1].x)){var _=n;n=r,r=_}if(a>(i=T[1].y)){var M=a;a=i,i=M}uo(h,n-k,a-k,r+k,i+k)}}else if("bezier"===D||"unbundled-bezier"===D||D.endsWith("segments")||D.endsWith("taxi")){var B;switch(D){case"bezier":case"unbundled-bezier":B=v.bezierPts;break;case"segments":case"taxi":case"round-segments":case"round-taxi":B=v.linePts}if(null!=B)for(var N=0;N(r=A.x)){var L=n;n=r,r=L}if((a=z.y)>(i=A.y)){var O=a;a=i,i=O}uo(h,n-=k,a-=k,r+=k,i+=k)}if(c&&t.includeEdges&&g&&(po(h,e,"mid-source"),po(h,e,"mid-target"),po(h,e,"source"),po(h,e,"target")),c)if("yes"===e.pstyle("ghost").value){var R=e.pstyle("ghost-offset-x").pfValue,V=e.pstyle("ghost-offset-y").pfValue;uo(h,h.x1+R,h.y1+V,h.x2+R,h.y2+V)}var F=p.bodyBounds=p.bodyBounds||{};Yt(F,h),qt(F,y),jt(F,1),c&&(n=h.x1,r=h.x2,a=h.y1,i=h.y2,uo(h,n-E,a-E,r+E,i+E));var j=p.overlayBounds=p.overlayBounds||{};Yt(j,h),qt(j,y),jt(j,1);var q=p.labelBounds=p.labelBounds||{};null!=q.all?((l=q.all).x1=1/0,l.y1=1/0,l.x2=-1/0,l.y2=-1/0,l.w=0,l.h=0):q.all=Rt(),c&&t.includeLabels&&(t.includeMainLabels&&fo(h,e,null),g&&(t.includeSourceLabels&&fo(h,e,"source"),t.includeTargetLabels&&fo(h,e,"target")))}return h.x1=lo(h.x1),h.y1=lo(h.y1),h.x2=lo(h.x2),h.y2=lo(h.y2),h.w=lo(h.x2-h.x1),h.h=lo(h.y2-h.y1),h.w>0&&h.h>0&&b&&(qt(h,y),jt(h,1)),h},vo=function(e){var t=0,n=function(e){return(e?1:0)<0&&void 0!==arguments[0]?arguments[0]:Lo,t=arguments.length>1?arguments[1]:void 0,n=0;n=0;s--)o(s);return this},Ro.removeAllListeners=function(){return this.removeListener("*")},Ro.emit=Ro.trigger=function(e,t,n){var r=this.listeners,a=r.length;return this.emitting++,w(t)||(t=[t]),jo(this,(function(e,i){null!=n&&(r=[{event:i.event,type:i.type,namespace:i.namespace,callback:n}],a=r.length);for(var o=function(n){var a=r[n];if(a.type===i.type&&(!a.namespace||a.namespace===i.namespace||".*"===a.namespace)&&e.eventMatches(e.context,a,i)){var o=[i];null!=t&&function(e,t){for(var n=0;n1&&!r){var a=this.length-1,i=this[a],o=i._private.data.id;this[a]=void 0,this[e]=i,n.set(o,{ele:i,index:e})}return this.length--,this},unmergeOne:function(e){e=e[0];var t=this._private,n=e._private.data.id,r=t.map.get(n);if(!r)return this;var a=r.index;return this.unmergeAt(a),this},unmerge:function(e){var t=this._private.cy;if(!e)return this;if(e&&b(e)){var n=e;e=t.mutableElements().filter(n)}for(var r=0;r=0;t--){e(this[t])&&this.unmergeAt(t)}return this},map:function(e,t){for(var n=[],r=this,a=0;ar&&(r=s,n=o)}return{value:r,ele:n}},min:function(e,t){for(var n,r=1/0,a=this,i=0;i=0&&a1&&void 0!==arguments[1])||arguments[1],n=this[0],r=n.cy();if(r.styleEnabled()&&n){this.cleanStyle();var a=n._private.style[e];return null!=a?a:t?r.style().getDefaultProperty(e):null}},numericStyle:function(e){var t=this[0];if(t.cy().styleEnabled()&&t){var n=t.pstyle(e);return void 0!==n.pfValue?n.pfValue:n.value}},numericStyleUnits:function(e){var t=this[0];if(t.cy().styleEnabled())return t?t.pstyle(e).units:void 0},renderedStyle:function(e){var t=this.cy();if(!t.styleEnabled())return this;var n=this[0];return n?t.style().getRenderedStyle(n,e):void 0},style:function(e,t){var n=this.cy();if(!n.styleEnabled())return this;var r=!1,a=n.style();if(E(e)){var i=e;a.applyBypass(this,i,r),this.emitAndNotify("style")}else if(b(e)){if(void 0===t){var o=this[0];return o?a.getStylePropertyValue(o,e):void 0}a.applyBypass(this,e,t,r),this.emitAndNotify("style")}else if(void 0===e){var s=this[0];return s?a.getRawStyle(s):void 0}return this},removeStyle:function(e){var t=this.cy();if(!t.styleEnabled())return this;var n=!1,r=t.style(),a=this;if(void 0===e)for(var i=0;i0&&t.push(c[0]),t.push(s[0])}return this.spawn(t,!0).filter(e)}),"neighborhood"),closedNeighborhood:function(e){return this.neighborhood().add(this).filter(e)},openNeighborhood:function(e){return this.neighborhood(e)}}),hs.neighbourhood=hs.neighborhood,hs.closedNeighbourhood=hs.closedNeighborhood,hs.openNeighbourhood=hs.openNeighborhood,Y(hs,{source:Wi((function(e){var t,n=this[0];return n&&(t=n._private.source||n.cy().collection()),t&&e?t.filter(e):t}),"source"),target:Wi((function(e){var t,n=this[0];return n&&(t=n._private.target||n.cy().collection()),t&&e?t.filter(e):t}),"target"),sources:vs({attr:"source"}),targets:vs({attr:"target"})}),Y(hs,{edgesWith:Wi(ys(),"edgesWith"),edgesTo:Wi(ys({thisIsSrc:!0}),"edgesTo")}),Y(hs,{connectedEdges:Wi((function(e){for(var t=[],n=0;n0);return i},component:function(){var e=this[0];return e.cy().mutableElements().components(e)[0]}}),hs.componentsOf=hs.components;var bs=function(e,t){var n=arguments.length>2&&void 0!==arguments[2]&&arguments[2],r=arguments.length>3&&void 0!==arguments[3]&&arguments[3];if(void 0!==e){var a=new it,i=!1;if(t){if(t.length>0&&E(t[0])&&!P(t[0])){i=!0;for(var o=[],s=new st,l=0,u=t.length;l0&&void 0!==arguments[0])||arguments[0],r=!(arguments.length>1&&void 0!==arguments[1])||arguments[1],a=this,i=a.cy(),o=i._private,s=[],l=[],u=0,c=a.length;u0){for(var O=e.length===a.length?a:new bs(i,e),R=0;R0&&void 0!==arguments[0])||arguments[0],t=!(arguments.length>1&&void 0!==arguments[1])||arguments[1],n=this,r=[],a={},i=n._private.cy;function o(e){var n=a[e.id()];t&&e.removed()||n||(a[e.id()]=!0,e.isNode()?(r.push(e),function(e){for(var t=e._private.edges,n=0;n0&&(e?k.emitAndNotify("remove"):t&&k.emit("remove"));for(var C=0;C=.001?function(t,r){for(var a=0;a<4;++a){var i=h(r,e,n);if(0===i)return r;r-=(d(r,e,n)-t)/i}return r}(t,o):0===l?o:function(t,r,a){var i,o,s=0;do{(i=d(o=r+(a-r)/2,e,n)-t)>0?a=o:r=o}while(Math.abs(i)>1e-7&&++s<10);return o}(t,r,r+a)}var f=!1;function g(){f=!0,e===t&&n===r||function(){for(var t=0;t<11;++t)s[t]=d(t*a,e,n)}()}var v=function(a){return f||g(),e===t&&n===r?a:0===a?0:1===a?1:d(p(a),t,r)};v.getControlPoints=function(){return[{x:e,y:t},{x:n,y:r}]};var y="generateBezier("+[e,t,n,r]+")";return v.toString=function(){return y},v}var ks=function(){function e(e){return-e.tension*e.x-e.friction*e.v}function t(t,n,r){var a={x:t.x+r.dx*n,v:t.v+r.dv*n,tension:t.tension,friction:t.friction};return{dx:a.v,dv:e(a)}}function n(n,r){var a={dx:n.v,dv:e(n)},i=t(n,.5*r,a),o=t(n,.5*r,i),s=t(n,r,o),l=1/6*(a.dx+2*(i.dx+o.dx)+s.dx),u=1/6*(a.dv+2*(i.dv+o.dv)+s.dv);return n.x=n.x+l*r,n.v=n.v+u*r,n}return function e(t,r,a){var i,o,s,l={x:-1,v:0,tension:null,friction:null},u=[0],c=0,d=1e-4;for(t=parseFloat(t)||500,r=parseFloat(r)||20,a=a||null,l.tension=t,l.friction=r,o=(i=null!==a)?(c=e(t,r))/a*.016:.016;s=n(s||l,o),u.push(1+s.x),c+=16,Math.abs(s.x)>d&&Math.abs(s.v)>d;);return i?function(e){return u[e*(u.length-1)|0]}:c}}(),Cs=function(e,t,n,r){var a=Es(e,t,n,r);return function(e,t,n){return e+(t-e)*a(n)}},Ss={linear:function(e,t,n){return e+(t-e)*n},ease:Cs(.25,.1,.25,1),"ease-in":Cs(.42,0,1,1),"ease-out":Cs(0,0,.58,1),"ease-in-out":Cs(.42,0,.58,1),"ease-in-sine":Cs(.47,0,.745,.715),"ease-out-sine":Cs(.39,.575,.565,1),"ease-in-out-sine":Cs(.445,.05,.55,.95),"ease-in-quad":Cs(.55,.085,.68,.53),"ease-out-quad":Cs(.25,.46,.45,.94),"ease-in-out-quad":Cs(.455,.03,.515,.955),"ease-in-cubic":Cs(.55,.055,.675,.19),"ease-out-cubic":Cs(.215,.61,.355,1),"ease-in-out-cubic":Cs(.645,.045,.355,1),"ease-in-quart":Cs(.895,.03,.685,.22),"ease-out-quart":Cs(.165,.84,.44,1),"ease-in-out-quart":Cs(.77,0,.175,1),"ease-in-quint":Cs(.755,.05,.855,.06),"ease-out-quint":Cs(.23,1,.32,1),"ease-in-out-quint":Cs(.86,0,.07,1),"ease-in-expo":Cs(.95,.05,.795,.035),"ease-out-expo":Cs(.19,1,.22,1),"ease-in-out-expo":Cs(1,0,0,1),"ease-in-circ":Cs(.6,.04,.98,.335),"ease-out-circ":Cs(.075,.82,.165,1),"ease-in-out-circ":Cs(.785,.135,.15,.86),spring:function(e,t,n){if(0===n)return Ss.linear;var r=ks(e,t,n);return function(e,t,n){return e+(t-e)*r(n)}},"cubic-bezier":Cs};function Ps(e,t,n,r,a){if(1===r)return n;if(t===n)return n;var i=a(t,n,r);return null==e||((e.roundValue||e.color)&&(i=Math.round(i)),void 0!==e.min&&(i=Math.max(i,e.min)),void 0!==e.max&&(i=Math.min(i,e.max))),i}function Ds(e,t){return null!=e.pfValue||null!=e.value?null==e.pfValue||null!=t&&"%"===t.type.units?e.value:e.pfValue:e}function Ts(e,t,n,r,a){var i=null!=a?a.type:null;n<0?n=0:n>1&&(n=1);var o=Ds(e,a),s=Ds(t,a);if(k(o)&&k(s))return Ps(i,o,s,n,r);if(w(o)&&w(s)){for(var l=[],u=0;u0?("spring"===d&&h.push(o.duration),o.easingImpl=Ss[d].apply(null,h)):o.easingImpl=Ss[d]}var p,f=o.easingImpl;if(p=0===o.duration?1:(n-l)/o.duration,o.applying&&(p=o.progress),p<0?p=0:p>1&&(p=1),null==o.delay){var g=o.startPosition,v=o.position;if(v&&a&&!e.locked()){var y={};Ms(g.x,v.x)&&(y.x=Ts(g.x,v.x,p,f)),Ms(g.y,v.y)&&(y.y=Ts(g.y,v.y,p,f)),e.position(y)}var m=o.startPan,x=o.pan,w=i.pan,E=null!=x&&r;E&&(Ms(m.x,x.x)&&(w.x=Ts(m.x,x.x,p,f)),Ms(m.y,x.y)&&(w.y=Ts(m.y,x.y,p,f)),e.emit("pan"));var k=o.startZoom,C=o.zoom,S=null!=C&&r;S&&(Ms(k,C)&&(i.zoom=Ot(i.minZoom,Ts(k,C,p,f),i.maxZoom)),e.emit("zoom")),(E||S)&&e.emit("viewport");var P=o.style;if(P&&P.length>0&&a){for(var D=0;D=0;t--){(0,e[t])()}e.splice(0,e.length)},c=i.length-1;c>=0;c--){var d=i[c],h=d._private;h.stopped?(i.splice(c,1),h.hooked=!1,h.playing=!1,h.started=!1,u(h.frames)):(h.playing||h.applying)&&(h.playing&&h.applying&&(h.applying=!1),h.started||Bs(0,d,e),_s(t,d,e,n),h.applying&&(h.applying=!1),u(h.frames),null!=h.step&&h.step(e),d.completed()&&(i.splice(c,1),h.hooked=!1,h.playing=!1,h.started=!1,u(h.completes)),s=!0)}return n||0!==i.length||0!==o.length||r.push(t),s}for(var i=!1,o=0;o0?t.notify("draw",n):t.notify("draw")),n.unmerge(r),t.emit("step")}var Is={animate:ni.animate(),animation:ni.animation(),animated:ni.animated(),clearQueue:ni.clearQueue(),delay:ni.delay(),delayAnimation:ni.delayAnimation(),stop:ni.stop(),addToAnimationPool:function(e){this.styleEnabled()&&this._private.aniEles.merge(e)},stopAnimationLoop:function(){this._private.animationsRunning=!1},startAnimationLoop:function(){var e=this;if(e._private.animationsRunning=!0,e.styleEnabled()){var t=e.renderer();t&&t.beforeRender?t.beforeRender((function(t,n){Ns(n,e)}),t.beforeRenderPriorities.animations):function t(){e._private.animationsRunning&&De((function(n){Ns(n,e),t()}))}()}}},zs={qualifierCompare:function(e,t){return null==e||null==t?null==e&&null==t:e.sameText(t)},eventMatches:function(e,t,n){var r=t.qualifier;return null==r||e!==n.target&&P(n.target)&&r.matches(n.target)},addEventFields:function(e,t){t.cy=e,t.target=e},callbackContext:function(e,t,n){return null!=t.qualifier?n.target:e}},As=function(e){return b(e)?new Fi(e):e},Ls={createEmitter:function(){var e=this._private;return e.emitter||(e.emitter=new Oo(zs,this)),this},emitter:function(){return this._private.emitter},on:function(e,t,n){return this.emitter().on(e,As(t),n),this},removeListener:function(e,t,n){return this.emitter().removeListener(e,As(t),n),this},removeAllListeners:function(){return this.emitter().removeAllListeners(),this},one:function(e,t,n){return this.emitter().one(e,As(t),n),this},once:function(e,t,n){return this.emitter().one(e,As(t),n),this},emit:function(e,t){return this.emitter().emit(e,t),this},emitAndNotify:function(e,t){return this.emit(e),this.notify(e,t),this}};ni.eventAliasesOn(Ls);var Os={png:function(e){return e=e||{},this._private.renderer.png(e)},jpg:function(e){var t=this._private.renderer;return(e=e||{}).bg=e.bg||"#fff",t.jpg(e)}};Os.jpeg=Os.jpg;var Rs={layout:function(e){var t=this;if(null!=e)if(null!=e.name){var n=e.name,r=t.extension("layout",n);if(null!=r){var a;a=b(e.eles)?t.$(e.eles):null!=e.eles?e.eles:t.$();var i=new r(Y({},e,{cy:t,eles:a}));return i}Ke("No such layout `"+n+"` found. Did you forget to import it and `cytoscape.use()` it?")}else Ke("A `name` must be specified to make a layout");else Ke("Layout options must be specified to make a layout")}};Rs.createLayout=Rs.makeLayout=Rs.layout;var Vs={notify:function(e,t){var n=this._private;if(this.batching()){n.batchNotifications=n.batchNotifications||{};var r=n.batchNotifications[e]=n.batchNotifications[e]||this.collection();null!=t&&r.merge(t)}else if(n.notificationsEnabled){var a=this.renderer();!this.destroyed()&&a&&a.notify(e,t)}},notifications:function(e){var t=this._private;return void 0===e?t.notificationsEnabled:(t.notificationsEnabled=!!e,this)},noNotifications:function(e){this.notifications(!1),e(),this.notifications(!0)},batching:function(){return this._private.batchCount>0},startBatch:function(){var e=this._private;return null==e.batchCount&&(e.batchCount=0),0===e.batchCount&&(e.batchStyleEles=this.collection(),e.batchNotifications={}),e.batchCount++,this},endBatch:function(){var e=this._private;if(0===e.batchCount)return this;if(e.batchCount--,0===e.batchCount){e.batchStyleEles.updateStyle();var t=this.renderer();Object.keys(e.batchNotifications).forEach((function(n){var r=e.batchNotifications[n];r.empty()?t.notify(n):t.notify(n,r)}))}return this},batch:function(e){return this.startBatch(),e(),this.endBatch(),this},batchData:function(e){var t=this;return this.batch((function(){for(var n=Object.keys(e),r=0;r0;)t.removeChild(t.childNodes[0]);e._private.renderer=null,e.mutableElements().forEach((function(e){var t=e._private;t.rscratch={},t.rstyle={},t.animation.current=[],t.animation.queue=[]}))},onRender:function(e){return this.on("render",e)},offRender:function(e){return this.off("render",e)}};js.invalidateDimensions=js.resize;var qs={collection:function(e,t){return b(e)?this.$(e):S(e)?e.collection():w(e)?(t||(t={}),new bs(this,e,t.unique,t.removed)):new bs(this)},nodes:function(e){var t=this.$((function(e){return e.isNode()}));return e?t.filter(e):t},edges:function(e){var t=this.$((function(e){return e.isEdge()}));return e?t.filter(e):t},$:function(e){var t=this._private.elements;return e?t.filter(e):t.spawnSelf()},mutableElements:function(){return this._private.elements}};qs.elements=qs.filter=qs.$;var Ys={},Xs="t";Ys.apply=function(e){for(var t=this,n=t._private.cy.collection(),r=0;r0;if(h||d&&p){var f=void 0;h&&p||h?f=u.properties:p&&(f=u.mappedProperties);for(var g=0;g1&&(v=1),s.color){var w=a.valueMin[0],E=a.valueMax[0],C=a.valueMin[1],S=a.valueMax[1],P=a.valueMin[2],D=a.valueMax[2],T=null==a.valueMin[3]?1:a.valueMin[3],_=null==a.valueMax[3]?1:a.valueMax[3],M=[Math.round(w+(E-w)*v),Math.round(C+(S-C)*v),Math.round(P+(D-P)*v),Math.round(T+(_-T)*v)];n={bypass:a.bypass,name:a.name,value:M,strValue:"rgb("+M[0]+", "+M[1]+", "+M[2]+")"}}else{if(!s.number)return!1;var B=a.valueMin+(a.valueMax-a.valueMin)*v;n=this.parse(a.name,B,a.bypass,h)}if(!n)return g(),!1;n.mapping=a,a=n;break;case o.data:for(var N=a.field.split("."),I=d.data,z=0;z0&&i>0){for(var s={},l=!1,u=0;u0?e.delayAnimation(o).play().promise().then(t):t()})).then((function(){return e.animation({style:s,duration:i,easing:e.pstyle("transition-timing-function").value,queue:!1}).play().promise()})).then((function(){n.removeBypasses(e,a),e.emitAndNotify("style"),r.transitioning=!1}))}else r.transitioning&&(this.removeBypasses(e,a),e.emitAndNotify("style"),r.transitioning=!1)},Ys.checkTrigger=function(e,t,n,r,a,i){var o=this.properties[t],s=a(o);null!=s&&s(n,r)&&i(o)},Ys.checkZOrderTrigger=function(e,t,n,r){var a=this;this.checkTrigger(e,t,n,r,(function(e){return e.triggersZOrder}),(function(){a._private.cy.notify("zorder",e)}))},Ys.checkBoundsTrigger=function(e,t,n,r){this.checkTrigger(e,t,n,r,(function(e){return e.triggersBounds}),(function(a){e.dirtyCompoundBoundsCache(),e.dirtyBoundingBoxCache(),!a.triggersBoundsOfParallelBeziers||"curve-style"!==t||"bezier"!==n&&"bezier"!==r||e.parallelEdges().forEach((function(e){e.dirtyBoundingBoxCache()})),!a.triggersBoundsOfConnectedEdges||"display"!==t||"none"!==n&&"none"!==r||e.connectedEdges().forEach((function(e){e.dirtyBoundingBoxCache()}))}))},Ys.checkTriggers=function(e,t,n,r){e.dirtyStyleCache(),this.checkZOrderTrigger(e,t,n,r),this.checkBoundsTrigger(e,t,n,r)};var Ws={applyBypass:function(e,t,n,r){var a=[];if("*"===t||"**"===t){if(void 0!==n)for(var i=0;it.length?i.substr(t.length):""}function s(){n=n.length>r.length?n.substr(r.length):""}for(i=i.replace(/[/][*](\s|.)+?[*][/]/g,"");;){if(i.match(/^\s*$/))break;var l=i.match(/^\s*((?:.|\s)+?)\s*\{((?:.|\s)+?)\}/);if(!l){Ue("Halting stylesheet parsing: String stylesheet contains more to parse but no selector and block found in: "+i);break}t=l[0];var u=l[1];if("core"!==u)if(new Fi(u).invalid){Ue("Skipping parsing of block: Invalid selector found in string stylesheet: "+u),o();continue}var c=l[2],d=!1;n=c;for(var h=[];;){if(n.match(/^\s*$/))break;var p=n.match(/^\s*(.+?)\s*:\s*(.+?)(?:\s*;|\s*$)/);if(!p){Ue("Skipping parsing of block: Invalid formatting of style property and value definitions found in:"+c),d=!0;break}r=p[0];var f=p[1],g=p[2];if(this.properties[f])a.parse(f,g)?(h.push({name:f,val:g}),s()):(Ue("Skipping property: Invalid property definition in: "+r),s());else Ue("Skipping property: Invalid property name in: "+r),s()}if(d){o();break}a.selector(u);for(var v=0;v=7&&"d"===t[0]&&(u=new RegExp(s.data.regex).exec(t))){if(n)return!1;var h=s.data;return{name:e,value:u,strValue:""+t,mapped:h,field:u[1],bypass:n}}if(t.length>=10&&"m"===t[0]&&(c=new RegExp(s.mapData.regex).exec(t))){if(n)return!1;if(d.multiple)return!1;var p=s.mapData;if(!d.color&&!d.number)return!1;var f=this.parse(e,c[4]);if(!f||f.mapped)return!1;var g=this.parse(e,c[5]);if(!g||g.mapped)return!1;if(f.pfValue===g.pfValue||f.strValue===g.strValue)return Ue("`"+e+": "+t+"` is not a valid mapper because the output range is zero; converting to `"+e+": "+f.strValue+"`"),this.parse(e,f.strValue);if(d.color){var v=f.value,y=g.value;if(!(v[0]!==y[0]||v[1]!==y[1]||v[2]!==y[2]||v[3]!==y[3]&&(null!=v[3]&&1!==v[3]||null!=y[3]&&1!==y[3])))return!1}return{name:e,value:c,strValue:""+t,mapped:p,field:c[1],fieldMin:parseFloat(c[2]),fieldMax:parseFloat(c[3]),valueMin:f.value,valueMax:g.value,bypass:n}}}if(d.multiple&&"multiple"!==r){var m;if(m=l?t.split(/\s+/):w(t)?t:[t],d.evenMultiple&&m.length%2!=0)return null;for(var E=[],C=[],S=[],P="",D=!1,T=0;T0?" ":"")+_.strValue}return d.validate&&!d.validate(E,C)?null:d.singleEnum&&D?1===E.length&&b(E[0])?{name:e,value:E[0],strValue:E[0],bypass:n}:null:{name:e,value:E,pfValue:S,strValue:P,bypass:n,units:C}}var M,B,N=function(){for(var r=0;rd.max||d.strictMax&&t===d.max))return null;var V={name:e,value:t,strValue:""+t+(z||""),units:z,bypass:n};return d.unitless||"px"!==z&&"em"!==z?V.pfValue=t:V.pfValue="px"!==z&&z?this.getEmSizeInPixels()*t:t,"ms"!==z&&"s"!==z||(V.pfValue="ms"===z?t:1e3*t),"deg"!==z&&"rad"!==z||(V.pfValue="rad"===z?t:(M=t,Math.PI*M/180)),"%"===z&&(V.pfValue=t/100),V}if(d.propList){var F=[],j=""+t;if("none"===j);else{for(var q=j.split(/\s*,\s*|\s+/),Y=0;Y0&&l>0&&!isNaN(n.w)&&!isNaN(n.h)&&n.w>0&&n.h>0)return{zoom:o=(o=(o=Math.min((s-2*t)/n.w,(l-2*t)/n.h))>this._private.maxZoom?this._private.maxZoom:o)=n.minZoom&&(n.maxZoom=t),this},minZoom:function(e){return void 0===e?this._private.minZoom:this.zoomRange({min:e})},maxZoom:function(e){return void 0===e?this._private.maxZoom:this.zoomRange({max:e})},getZoomedViewport:function(e){var t,n,r=this._private,a=r.pan,i=r.zoom,o=!1;if(r.zoomingEnabled||(o=!0),k(e)?n=e:E(e)&&(n=e.level,null!=e.position?t=Pt(e.position,i,a):null!=e.renderedPosition&&(t=e.renderedPosition),null==t||r.panningEnabled||(o=!0)),n=(n=n>r.maxZoom?r.maxZoom:n)t.maxZoom||!t.zoomingEnabled?i=!0:(t.zoom=s,a.push("zoom"))}if(r&&(!i||!e.cancelOnFailedZoom)&&t.panningEnabled){var l=e.pan;k(l.x)&&(t.pan.x=l.x,o=!1),k(l.y)&&(t.pan.y=l.y,o=!1),o||a.push("pan")}return a.length>0&&(a.push("viewport"),this.emit(a.join(" ")),this.notify("viewport")),this},center:function(e){var t=this.getCenterPan(e);return t&&(this._private.pan=t,this.emit("pan viewport"),this.notify("viewport")),this},getCenterPan:function(e,t){if(this._private.panningEnabled){if(b(e)){var n=e;e=this.mutableElements().filter(n)}else S(e)||(e=this.mutableElements());if(0!==e.length){var r=e.boundingBox(),a=this.width(),i=this.height();return{x:(a-(t=void 0===t?this._private.zoom:t)*(r.x1+r.x2))/2,y:(i-t*(r.y1+r.y2))/2}}}},reset:function(){return this._private.panningEnabled&&this._private.zoomingEnabled?(this.viewport({pan:{x:0,y:0},zoom:1}),this):this},invalidateSize:function(){this._private.sizeCache=null},size:function(){var e,t,n=this._private,r=n.container,a=this;return n.sizeCache=n.sizeCache||(r?(e=a.window().getComputedStyle(r),t=function(t){return parseFloat(e.getPropertyValue(t))},{width:r.clientWidth-t("padding-left")-t("padding-right"),height:r.clientHeight-t("padding-top")-t("padding-bottom")}):{width:1,height:1})},width:function(){return this.size().width},height:function(){return this.size().height},extent:function(){var e=this._private.pan,t=this._private.zoom,n=this.renderedExtent(),r={x1:(n.x1-e.x)/t,x2:(n.x2-e.x)/t,y1:(n.y1-e.y)/t,y2:(n.y2-e.y)/t};return r.w=r.x2-r.x1,r.h=r.y2-r.y1,r},renderedExtent:function(){var e=this.width(),t=this.height();return{x1:0,y1:0,x2:e,y2:t,w:e,h:t}},multiClickDebounceTime:function(e){return e?(this._private.multiClickDebounceTime=e,this):this._private.multiClickDebounceTime}};tl.centre=tl.center,tl.autolockNodes=tl.autolock,tl.autoungrabifyNodes=tl.autoungrabify;var nl={data:ni.data({field:"data",bindingEvent:"data",allowBinding:!0,allowSetting:!0,settingEvent:"data",settingTriggersEvent:!0,triggerFnName:"trigger",allowGetting:!0,updateStyle:!0}),removeData:ni.removeData({field:"data",event:"data",triggerFnName:"trigger",triggerEvent:!0,updateStyle:!0}),scratch:ni.data({field:"scratch",bindingEvent:"scratch",allowBinding:!0,allowSetting:!0,settingEvent:"scratch",settingTriggersEvent:!0,triggerFnName:"trigger",allowGetting:!0,updateStyle:!0}),removeScratch:ni.removeData({field:"scratch",event:"scratch",triggerFnName:"trigger",triggerEvent:!0,updateStyle:!0})};nl.attr=nl.data,nl.removeAttr=nl.removeData;var rl=function(e){var t=this,n=(e=Y({},e)).container;n&&!C(n)&&C(n[0])&&(n=n[0]);var r=n?n._cyreg:null;(r=r||{})&&r.cy&&(r.cy.destroy(),r={});var a=r.readies=r.readies||[];n&&(n._cyreg=r),r.cy=t;var i=void 0!==h&&void 0!==n&&!e.headless,o=e;o.layout=Y({name:i?"grid":"null"},o.layout),o.renderer=Y({name:i?"canvas":"null"},o.renderer);var s=function(e,t,n){return void 0!==t?t:void 0!==n?n:e},l=this._private={container:n,ready:!1,options:o,elements:new bs(this),listeners:[],aniEles:new bs(this),data:o.data||{},scratch:{},layout:null,renderer:null,destroyed:!1,notificationsEnabled:!0,minZoom:1e-50,maxZoom:1e50,zoomingEnabled:s(!0,o.zoomingEnabled),userZoomingEnabled:s(!0,o.userZoomingEnabled),panningEnabled:s(!0,o.panningEnabled),userPanningEnabled:s(!0,o.userPanningEnabled),boxSelectionEnabled:s(!0,o.boxSelectionEnabled),autolock:s(!1,o.autolock,o.autolockNodes),autoungrabify:s(!1,o.autoungrabify,o.autoungrabifyNodes),autounselectify:s(!1,o.autounselectify),styleEnabled:void 0===o.styleEnabled?i:o.styleEnabled,zoom:k(o.zoom)?o.zoom:1,pan:{x:E(o.pan)&&k(o.pan.x)?o.pan.x:0,y:E(o.pan)&&k(o.pan.y)?o.pan.y:0},animation:{current:[],queue:[]},hasCompoundNodes:!1,multiClickDebounceTime:s(250,o.multiClickDebounceTime)};this.createEmitter(),this.selectionType(o.selectionType),this.zoomRange({min:o.minZoom,max:o.maxZoom});l.styleEnabled&&t.setStyle([]);var u=Y({},o,o.renderer);t.initRenderer(u);!function(e,t){if(e.some(B))return Tr.all(e).then(t);t(e)}([o.style,o.elements],(function(e){var n=e[0],i=e[1];l.styleEnabled&&t.style().append(n),function(e,n,r){t.notifications(!1);var a=t.mutableElements();a.length>0&&a.remove(),null!=e&&(E(e)||w(e))&&t.add(e),t.one("layoutready",(function(e){t.notifications(!0),t.emit(e),t.one("load",n),t.emitAndNotify("load")})).one("layoutstop",(function(){t.one("done",r),t.emit("done")}));var i=Y({},t._private.options.layout);i.eles=t.elements(),t.layout(i).run()}(i,(function(){t.startAnimationLoop(),l.ready=!0,x(o.ready)&&t.on("ready",o.ready);for(var e=0;e0,u=Rt(n.boundingBox?n.boundingBox:{x1:0,y1:0,w:r.width(),h:r.height()});if(S(n.roots))e=n.roots;else if(w(n.roots)){for(var c=[],d=0;d0;){var N=_.shift(),I=T(N,M);if(I)N.outgoers().filter((function(e){return e.isNode()&&a.has(e)})).forEach(B);else if(null===I){Ue("Detected double maximal shift for node `"+N.id()+"`. Bailing maximal adjustment due to cycle. Use `options.maximal: true` only on DAGs.");break}}}D();var z=0;if(n.avoidOverlap)for(var A=0;A0&&y[0].length<=3?l/2:0),d=2*Math.PI/y[r].length*a;return 0===r&&1===y[0].length&&(c=1),{x:G+c*Math.cos(d),y:U+c*Math.sin(d)}}return{x:G+(a+1-(i+1)/2)*o,y:(r+1)*s}})),this};var cl={fit:!0,padding:30,boundingBox:void 0,avoidOverlap:!0,nodeDimensionsIncludeLabels:!1,spacingFactor:void 0,radius:void 0,startAngle:1.5*Math.PI,sweep:void 0,clockwise:!0,sort:void 0,animate:!1,animationDuration:500,animationEasing:void 0,animateFilter:function(e,t){return!0},ready:void 0,stop:void 0,transform:function(e,t){return t}};function dl(e){this.options=Y({},cl,e)}dl.prototype.run=function(){var e=this.options,t=e,n=e.cy,r=t.eles,a=void 0!==t.counterclockwise?!t.counterclockwise:t.clockwise,i=r.nodes().not(":parent");t.sort&&(i=i.sort(t.sort));for(var o,s=Rt(t.boundingBox?t.boundingBox:{x1:0,y1:0,w:n.width(),h:n.height()}),l=s.x1+s.w/2,u=s.y1+s.h/2,c=(void 0===t.sweep?2*Math.PI-2*Math.PI/i.length:t.sweep)/Math.max(1,i.length-1),d=0,h=0;h1&&t.avoidOverlap){d*=1.75;var v=Math.cos(c)-Math.cos(0),y=Math.sin(c)-Math.sin(0),m=Math.sqrt(d*d/(v*v+y*y));o=Math.max(m,o)}return r.nodes().layoutPositions(this,t,(function(e,n){var r=t.startAngle+n*c*(a?1:-1),i=o*Math.cos(r),s=o*Math.sin(r);return{x:l+i,y:u+s}})),this};var hl,pl={fit:!0,padding:30,startAngle:1.5*Math.PI,sweep:void 0,clockwise:!0,equidistant:!1,minNodeSpacing:10,boundingBox:void 0,avoidOverlap:!0,nodeDimensionsIncludeLabels:!1,height:void 0,width:void 0,spacingFactor:void 0,concentric:function(e){return e.degree()},levelWidth:function(e){return e.maxDegree()/4},animate:!1,animationDuration:500,animationEasing:void 0,animateFilter:function(e,t){return!0},ready:void 0,stop:void 0,transform:function(e,t){return t}};function fl(e){this.options=Y({},pl,e)}fl.prototype.run=function(){for(var e=this.options,t=e,n=void 0!==t.counterclockwise?!t.counterclockwise:t.clockwise,r=e.cy,a=t.eles,i=a.nodes().not(":parent"),o=Rt(t.boundingBox?t.boundingBox:{x1:0,y1:0,w:r.width(),h:r.height()}),s=o.x1+o.w/2,l=o.y1+o.h/2,u=[],c=0,d=0;d0)Math.abs(m[0].value-x.value)>=v&&(m=[],y.push(m));m.push(x)}var w=c+t.minNodeSpacing;if(!t.avoidOverlap){var E=y.length>0&&y[0].length>1,k=(Math.min(o.w,o.h)/2-w)/(y.length+E?1:0);w=Math.min(w,k)}for(var C=0,S=0;S1&&t.avoidOverlap){var _=Math.cos(T)-Math.cos(0),M=Math.sin(T)-Math.sin(0),B=Math.sqrt(w*w/(_*_+M*M));C=Math.max(B,C)}P.r=C,C+=w}if(t.equidistant){for(var N=0,I=0,z=0;z=e.numIter)&&(kl(r,e),r.temperature=r.temperature*e.coolingFactor,!(r.temperature=e.animationThreshold&&i(),De(t)):(Al(r,e),s())}()}else{for(;u;)u=o(l),l++;Al(r,e),s()}return this},vl.prototype.stop=function(){return this.stopped=!0,this.thread&&this.thread.stop(),this.emit("layoutstop"),this},vl.prototype.destroy=function(){return this.thread&&this.thread.stop(),this};var yl=function(e,t,n){for(var r=n.eles.edges(),a=n.eles.nodes(),i=Rt(n.boundingBox?n.boundingBox:{x1:0,y1:0,w:e.width(),h:e.height()}),o={isCompound:e.hasCompoundNodes(),layoutNodes:[],idToIndex:{},nodeSize:a.size(),graphSet:[],indexToGraph:[],layoutEdges:[],edgeSize:r.size(),temperature:n.initialTemp,clientWidth:i.w,clientHeight:i.h,boundingBox:i},s=n.eles.components(),l={},u=0;u0){o.graphSet.push(E);for(u=0;ur.count?0:r.graph},bl=function e(t,n,r,a){var i=a.graphSet[r];if(-10)var s=(u=r.nodeOverlap*o)*a/(g=Math.sqrt(a*a+i*i)),l=u*i/g;else{var u,c=Tl(e,a,i),d=Tl(t,-1*a,-1*i),h=d.x-c.x,p=d.y-c.y,f=h*h+p*p,g=Math.sqrt(f);s=(u=(e.nodeRepulsion+t.nodeRepulsion)/f)*h/g,l=u*p/g}e.isLocked||(e.offsetX-=s,e.offsetY-=l),t.isLocked||(t.offsetX+=s,t.offsetY+=l)}},Dl=function(e,t,n,r){if(n>0)var a=e.maxX-t.minX;else a=t.maxX-e.minX;if(r>0)var i=e.maxY-t.minY;else i=t.maxY-e.minY;return a>=0&&i>=0?Math.sqrt(a*a+i*i):0},Tl=function(e,t,n){var r=e.positionX,a=e.positionY,i=e.height||1,o=e.width||1,s=n/t,l=i/o,u={};return 0===t&&0n?(u.x=r,u.y=a+i/2,u):0t&&-1*l<=s&&s<=l?(u.x=r-o/2,u.y=a-o*n/2/t,u):0=l)?(u.x=r+i*t/2/n,u.y=a+i/2,u):0>n&&(s<=-1*l||s>=l)?(u.x=r-i*t/2/n,u.y=a-i/2,u):u},_l=function(e,t){for(var n=0;n1){var f=t.gravity*d/p,g=t.gravity*h/p;c.offsetX+=f,c.offsetY+=g}}}}},Bl=function(e,t){var n=[],r=0,a=-1;for(n.push.apply(n,e.graphSet[0]),a+=e.graphSet[0].length;r<=a;){var i=n[r++],o=e.idToIndex[i],s=e.layoutNodes[o],l=s.children;if(0n)var a={x:n*e/r,y:n*t/r};else a={x:e,y:t};return a},zl=function e(t,n){var r=t.parentId;if(null!=r){var a=n.layoutNodes[n.idToIndex[r]],i=!1;return(null==a.maxX||t.maxX+a.padRight>a.maxX)&&(a.maxX=t.maxX+a.padRight,i=!0),(null==a.minX||t.minX-a.padLefta.maxY)&&(a.maxY=t.maxY+a.padBottom,i=!0),(null==a.minY||t.minY-a.padTopf&&(d+=p+t.componentSpacing,c=0,h=0,p=0)}}},Ll={fit:!0,padding:30,boundingBox:void 0,avoidOverlap:!0,avoidOverlapPadding:10,nodeDimensionsIncludeLabels:!1,spacingFactor:void 0,condense:!1,rows:void 0,cols:void 0,position:function(e){},sort:void 0,animate:!1,animationDuration:500,animationEasing:void 0,animateFilter:function(e,t){return!0},ready:void 0,stop:void 0,transform:function(e,t){return t}};function Ol(e){this.options=Y({},Ll,e)}Ol.prototype.run=function(){var e=this.options,t=e,n=e.cy,r=t.eles,a=r.nodes().not(":parent");t.sort&&(a=a.sort(t.sort));var i=Rt(t.boundingBox?t.boundingBox:{x1:0,y1:0,w:n.width(),h:n.height()});if(0===i.h||0===i.w)r.nodes().layoutPositions(this,t,(function(e){return{x:i.x1,y:i.y1}}));else{var o=a.size(),s=Math.sqrt(o*i.h/i.w),l=Math.round(s),u=Math.round(i.w/i.h*s),c=function(e){if(null==e)return Math.min(l,u);Math.min(l,u)==l?l=e:u=e},d=function(e){if(null==e)return Math.max(l,u);Math.max(l,u)==l?l=e:u=e},h=t.rows,p=null!=t.cols?t.cols:t.columns;if(null!=h&&null!=p)l=h,u=p;else if(null!=h&&null==p)l=h,u=Math.ceil(o/l);else if(null==h&&null!=p)u=p,l=Math.ceil(o/u);else if(u*l>o){var f=c(),g=d();(f-1)*g>=o?c(f-1):(g-1)*f>=o&&d(g-1)}else for(;u*l=o?d(y+1):c(v+1)}var m=i.w/u,b=i.h/l;if(t.condense&&(m=0,b=0),t.avoidOverlap)for(var x=0;x=u&&(B=0,M++)},I={},z=0;z(r=$t(e,t,x[w],x[w+1],x[w+2],x[w+3])))return v(n,r),!0}else if("bezier"===i.edgeType||"multibezier"===i.edgeType||"self"===i.edgeType||"compound"===i.edgeType)for(x=i.allpts,w=0;w+5(r=Zt(e,t,x[w],x[w+1],x[w+2],x[w+3],x[w+4],x[w+5])))return v(n,r),!0;m=m||a.source,b=b||a.target;var E=o.getArrowWidth(l,c),k=[{name:"source",x:i.arrowStartX,y:i.arrowStartY,angle:i.srcArrowAngle},{name:"target",x:i.arrowEndX,y:i.arrowEndY,angle:i.tgtArrowAngle},{name:"mid-source",x:i.midX,y:i.midY,angle:i.midsrcArrowAngle},{name:"mid-target",x:i.midX,y:i.midY,angle:i.midtgtArrowAngle}];for(w=0;w0&&(y(m),y(b))}function b(e,t,n){return rt(e,t,n)}function x(n,r){var a,i=n._private,o=f;a=r?r+"-":"",n.boundingBox();var s=i.labelBounds[r||"main"],l=n.pstyle(a+"label").value;if("yes"===n.pstyle("text-events").strValue&&l){var u=b(i.rscratch,"labelX",r),c=b(i.rscratch,"labelY",r),d=b(i.rscratch,"labelAngle",r),h=n.pstyle(a+"text-margin-x").pfValue,p=n.pstyle(a+"text-margin-y").pfValue,g=s.x1-o-h,y=s.x2+o-h,m=s.y1-o-p,x=s.y2+o-p;if(d){var w=Math.cos(d),E=Math.sin(d),k=function(e,t){return{x:(e-=u)*w-(t-=c)*E+u,y:e*E+t*w+c}},C=k(g,m),S=k(g,x),P=k(y,m),D=k(y,x),T=[C.x+h,C.y+p,P.x+h,P.y+p,D.x+h,D.y+p,S.x+h,S.y+p];if(Qt(e,t,T))return v(n),!0}else if(Wt(s,e,t))return v(n),!0}}n&&(l=l.interactive);for(var w=l.length-1;w>=0;w--){var E=l[w];E.isNode()?y(E)||x(E):m(E)||x(E)||x(E,"source")||x(E,"target")}return u},getAllInBox:function(e,t,n,r){for(var a,i,o=this.getCachedZSortedEles().interactive,s=[],l=Math.min(e,n),u=Math.max(e,n),c=Math.min(t,r),d=Math.max(t,r),h=Rt({x1:e=l,y1:t=c,x2:n=u,y2:r=d}),p=0;p0?-(Math.PI-i.ang):Math.PI+i.ang),vu(t,n,gu),Jl=fu.nx*gu.ny-fu.ny*gu.nx,eu=fu.nx*gu.nx-fu.ny*-gu.ny,ru=Math.asin(Math.max(-1,Math.min(1,Jl))),Math.abs(ru)<1e-6)return $l=t.x,Ql=t.y,void(iu=su=0);tu=1,nu=!1,eu<0?ru<0?ru=Math.PI+ru:(ru=Math.PI-ru,tu=-1,nu=!0):ru>0&&(tu=-1,nu=!0),su=void 0!==t.radius?t.radius:r,au=ru/2,lu=Math.min(fu.len/2,gu.len/2),a?(ou=Math.abs(Math.cos(au)*su/Math.sin(au)))>lu?(ou=lu,iu=Math.abs(ou*Math.sin(au)/Math.cos(au))):iu=su:(ou=Math.min(lu,su),iu=Math.abs(ou*Math.sin(au)/Math.cos(au))),du=t.x+gu.nx*ou,hu=t.y+gu.ny*ou,$l=du-gu.ny*iu*tu,Ql=hu+gu.nx*iu*tu,uu=t.x+fu.nx*ou,cu=t.y+fu.ny*ou,pu=t};function mu(e,t){0===t.radius?e.lineTo(t.cx,t.cy):e.arc(t.cx,t.cy,t.radius,t.startAngle,t.endAngle,t.counterClockwise)}function bu(e,t,n,r){var a=!(arguments.length>4&&void 0!==arguments[4])||arguments[4];return 0===r||0===t.radius?{cx:t.x,cy:t.y,radius:0,startX:t.x,startY:t.y,stopX:t.x,stopY:t.y,startAngle:void 0,endAngle:void 0,counterClockwise:void 0}:(yu(e,t,n,r,a),{cx:$l,cy:Ql,radius:iu,startX:uu,startY:cu,stopX:du,stopY:hu,startAngle:fu.ang+Math.PI/2*tu,endAngle:gu.ang-Math.PI/2*tu,counterClockwise:nu})}var xu={};function wu(e){var t=[];if(null!=e){for(var n=0;n0?Math.max(e-t,0):Math.min(e+t,0)},D=P(C,E),T=P(S,k),_=!1;"auto"===v?g=Math.abs(D)>Math.abs(T)?a:r:v===l||v===s?(g=r,_=!0):v!==i&&v!==o||(g=a,_=!0);var M,B=g===r,N=B?T:D,I=B?S:C,z=Bt(I),A=!1;(_&&(m||x)||!(v===s&&I<0||v===l&&I>0||v===i&&I>0||v===o&&I<0)||(N=(z*=-1)*Math.abs(N),A=!0),m)?M=(b<0?1+b:b)*N:M=(b<0?N:0)+b*z;var L=function(e){return Math.abs(e)=Math.abs(N)},O=L(M),R=L(Math.abs(N)-Math.abs(M));if((O||R)&&!A)if(B){var V=Math.abs(I)<=d/2,F=Math.abs(C)<=h/2;if(V){var j=(u.x1+u.x2)/2,q=u.y1,Y=u.y2;n.segpts=[j,q,j,Y]}else if(F){var X=(u.y1+u.y2)/2,W=u.x1,H=u.x2;n.segpts=[W,X,H,X]}else n.segpts=[u.x1,u.y2]}else{var K=Math.abs(I)<=c/2,G=Math.abs(S)<=p/2;if(K){var U=(u.y1+u.y2)/2,Z=u.x1,$=u.x2;n.segpts=[Z,U,$,U]}else if(G){var Q=(u.x1+u.x2)/2,J=u.y1,ee=u.y2;n.segpts=[Q,J,Q,ee]}else n.segpts=[u.x2,u.y1]}else if(B){var te=u.y1+M+(f?d/2*z:0),ne=u.x1,re=u.x2;n.segpts=[ne,te,re,te]}else{var ae=u.x1+M+(f?c/2*z:0),ie=u.y1,oe=u.y2;n.segpts=[ae,ie,ae,oe]}if(n.isRound){var se=e.pstyle("taxi-radius").value,le="arc-radius"===e.pstyle("radius-type").value[0];n.radii=new Array(n.segpts.length/2).fill(se),n.isArcRadius=new Array(n.segpts.length/2).fill(le)}},xu.tryToCorrectInvalidPoints=function(e,t){var n=e._private.rscratch;if("bezier"===n.edgeType){var r=t.srcPos,a=t.tgtPos,i=t.srcW,o=t.srcH,s=t.tgtW,l=t.tgtH,u=t.srcShape,c=t.tgtShape,d=t.srcCornerRadius,h=t.tgtCornerRadius,p=t.srcRs,f=t.tgtRs,g=!k(n.startX)||!k(n.startY),v=!k(n.arrowStartX)||!k(n.arrowStartY),y=!k(n.endX)||!k(n.endY),m=!k(n.arrowEndX)||!k(n.arrowEndY),b=3*(this.getArrowWidth(e.pstyle("width").pfValue,e.pstyle("arrow-scale").value)*this.arrowShapeWidth),x=Nt({x:n.ctrlpts[0],y:n.ctrlpts[1]},{x:n.startX,y:n.startY}),w=xh.poolIndex()){var p=d;d=h,h=p}var f=s.srcPos=d.position(),g=s.tgtPos=h.position(),v=s.srcW=d.outerWidth(),y=s.srcH=d.outerHeight(),m=s.tgtW=h.outerWidth(),b=s.tgtH=h.outerHeight(),x=s.srcShape=n.nodeShapes[t.getNodeShape(d)],w=s.tgtShape=n.nodeShapes[t.getNodeShape(h)],E=s.srcCornerRadius="auto"===d.pstyle("corner-radius").value?"auto":d.pstyle("corner-radius").pfValue,C=s.tgtCornerRadius="auto"===h.pstyle("corner-radius").value?"auto":h.pstyle("corner-radius").pfValue,S=s.tgtRs=h._private.rscratch,P=s.srcRs=d._private.rscratch;s.dirCounts={north:0,west:0,south:0,east:0,northwest:0,southwest:0,northeast:0,southeast:0};for(var D=0;D0){var H=u,K=It(H,Tt(t)),G=It(H,Tt(W)),U=K;if(G2)It(H,{x:W[2],y:W[3]})0){var le=c,ue=It(le,Tt(t)),ce=It(le,Tt(se)),de=ue;if(ce2)It(le,{x:se[2],y:se[3]})=u||m){c={cp:g,segment:y};break}}if(c)break}var b=c.cp,x=c.segment,w=(u-h)/x.length,E=x.t1-x.t0,k=s?x.t0+E*w:x.t1-E*w;k=Ot(0,k,1),t=Lt(b.p0,b.p1,b.p2,k),a=function(e,t,n,r){var a=Ot(0,r-.001,1),i=Ot(0,r+.001,1),o=Lt(e,t,n,a),s=Lt(e,t,n,i);return Du(o,s)}(b.p0,b.p1,b.p2,k);break;case"straight":case"segments":case"haystack":for(var C,S,P,D,T=0,_=r.allpts.length,M=0;M+3<_&&(s?(P={x:r.allpts[M],y:r.allpts[M+1]},D={x:r.allpts[M+2],y:r.allpts[M+3]}):(P={x:r.allpts[_-2-M],y:r.allpts[_-1-M]},D={x:r.allpts[_-4-M],y:r.allpts[_-3-M]}),S=T,!((T+=C=Nt(P,D))>=u));M+=2);var B=(u-S)/C;B=Ot(0,B,1),t=function(e,t,n,r){var a=t.x-e.x,i=t.y-e.y,o=Nt(e,t),s=a/o,l=i/o;return n=null==n?0:n,r=null!=r?r:n*o,{x:e.x+s*r,y:e.y+l*r}}(P,D,B),a=Du(P,D)}o("labelX",n,t.x),o("labelY",n,t.y),o("labelAutoAngle",n,a)}};u("source"),u("target"),this.applyLabelDimensions(e)}},Su.applyLabelDimensions=function(e){this.applyPrefixedLabelDimensions(e),e.isEdge()&&(this.applyPrefixedLabelDimensions(e,"source"),this.applyPrefixedLabelDimensions(e,"target"))},Su.applyPrefixedLabelDimensions=function(e,t){var n=e._private,r=this.getLabelText(e,t),a=this.calculateLabelDimensions(e,r),i=e.pstyle("line-height").pfValue,o=e.pstyle("text-wrap").strValue,s=rt(n.rscratch,"labelWrapCachedLines",t)||[],l="wrap"!==o?1:Math.max(s.length,1),u=a.height/l,c=u*i,d=a.width,h=a.height+(l-1)*(i-1)*u;at(n.rstyle,"labelWidth",t,d),at(n.rscratch,"labelWidth",t,d),at(n.rstyle,"labelHeight",t,h),at(n.rscratch,"labelHeight",t,h),at(n.rscratch,"labelLineHeight",t,c)},Su.getLabelText=function(e,t){var n=e._private,r=t?t+"-":"",a=e.pstyle(r+"label").strValue,i=e.pstyle("text-transform").value,o=function(e,r){return r?(at(n.rscratch,e,t,r),r):rt(n.rscratch,e,t)};if(!a)return"";"none"==i||("uppercase"==i?a=a.toUpperCase():"lowercase"==i&&(a=a.toLowerCase()));var s=e.pstyle("text-wrap").value;if("wrap"===s){var l=o("labelKey");if(null!=l&&o("labelWrapKey")===l)return o("labelWrapCachedText");for(var u=a.split("\n"),c=e.pstyle("text-max-width").pfValue,h="anywhere"===e.pstyle("text-overflow-wrap").value,p=[],f=/[\s\u200b]+|$/g,g=0;gc){var b,x="",w=0,E=d(v.matchAll(f));try{for(E.s();!(b=E.n()).done;){var k=b.value,C=k[0],S=v.substring(w,k.index);w=k.index+C.length;var P=0===x.length?S:x+S+C;this.calculateLabelDimensions(e,P).width<=c?x+=S+C:(x&&p.push(x),x=S+C)}}catch(B){E.e(B)}finally{E.f()}x.match(/^[\s\u200b]+$/)||p.push(x)}else p.push(v)}o("labelWrapCachedLines",p),a=o("labelWrapCachedText",p.join("\n")),o("labelWrapKey",l)}else if("ellipsis"===s){var D=e.pstyle("text-max-width").pfValue,T="",_=!1;if(this.calculateLabelDimensions(e,a).widthD)break;T+=a[M],M===a.length-1&&(_=!0)}return _||(T+="\u2026"),T}return a},Su.getLabelJustification=function(e){var t=e.pstyle("text-justification").strValue,n=e.pstyle("text-halign").strValue;if("auto"!==t)return t;if(!e.isNode())return"center";switch(n){case"left":return"right";case"right":return"left";default:return"center"}},Su.calculateLabelDimensions=function(e,t){var n=this,r=n.cy.window().document,a=Le(t,e._private.labelDimsKey),i=n.labelDimCache||(n.labelDimCache=[]),o=i[a];if(null!=o)return o;var s=e.pstyle("font-style").strValue,l=e.pstyle("font-size").pfValue,u=e.pstyle("font-family").strValue,c=e.pstyle("font-weight").strValue,d=this.labelCalcCanvas,h=this.labelCalcCanvasContext;if(!d){d=this.labelCalcCanvas=r.createElement("canvas"),h=this.labelCalcCanvasContext=d.getContext("2d");var p=d.style;p.position="absolute",p.left="-9999px",p.top="-9999px",p.zIndex="-1",p.visibility="hidden",p.pointerEvents="none"}h.font="".concat(s," ").concat(c," ").concat(l,"px ").concat(u);for(var f=0,g=0,v=t.split("\n"),y=0;y1&&void 0!==arguments[1])||arguments[1];if(t.merge(e),n)for(var r=0;r=e.desktopTapThreshold2}var D=a(t);v&&(e.hoverData.tapholdCancelled=!0);n=!0,r(g,["mousemove","vmousemove","tapdrag"],t,{x:c[0],y:c[1]});var T=function(){e.data.bgActivePosistion=void 0,e.hoverData.selecting||o.emit({originalEvent:t,type:"boxstart",position:{x:c[0],y:c[1]}}),f[4]=1,e.hoverData.selecting=!0,e.redrawHint("select",!0),e.redraw()};if(3===e.hoverData.which){if(v){var _={originalEvent:t,type:"cxtdrag",position:{x:c[0],y:c[1]}};b?b.emit(_):o.emit(_),e.hoverData.cxtDragged=!0,e.hoverData.cxtOver&&g===e.hoverData.cxtOver||(e.hoverData.cxtOver&&e.hoverData.cxtOver.emit({originalEvent:t,type:"cxtdragout",position:{x:c[0],y:c[1]}}),e.hoverData.cxtOver=g,g&&g.emit({originalEvent:t,type:"cxtdragover",position:{x:c[0],y:c[1]}}))}}else if(e.hoverData.dragging){if(n=!0,o.panningEnabled()&&o.userPanningEnabled()){var M;if(e.hoverData.justStartedPan){var B=e.hoverData.mdownPos;M={x:(c[0]-B[0])*s,y:(c[1]-B[1])*s},e.hoverData.justStartedPan=!1}else M={x:x[0]*s,y:x[1]*s};o.panBy(M),o.emit("dragpan"),e.hoverData.dragged=!0}c=e.projectIntoViewport(t.clientX,t.clientY)}else if(1!=f[4]||null!=b&&!b.pannable()){if(b&&b.pannable()&&b.active()&&b.unactivate(),b&&b.grabbed()||g==y||(y&&r(y,["mouseout","tapdragout"],t,{x:c[0],y:c[1]}),g&&r(g,["mouseover","tapdragover"],t,{x:c[0],y:c[1]}),e.hoverData.last=g),b)if(v){if(o.boxSelectionEnabled()&&D)b&&b.grabbed()&&(d(w),b.emit("freeon"),w.emit("free"),e.dragData.didDrag&&(b.emit("dragfreeon"),w.emit("dragfree"))),T();else if(b&&b.grabbed()&&e.nodeIsDraggable(b)){var N=!e.dragData.didDrag;N&&e.redrawHint("eles",!0),e.dragData.didDrag=!0,e.hoverData.draggingEles||u(w,{inDragLayer:!0});var I={x:0,y:0};if(k(x[0])&&k(x[1])&&(I.x+=x[0],I.y+=x[1],N)){var z=e.hoverData.dragDelta;z&&k(z[0])&&k(z[1])&&(I.x+=z[0],I.y+=z[1])}e.hoverData.draggingEles=!0,w.silentShift(I).emit("position drag"),e.redrawHint("drag",!0),e.redraw()}}else!function(){var t=e.hoverData.dragDelta=e.hoverData.dragDelta||[];0===t.length?(t.push(x[0]),t.push(x[1])):(t[0]+=x[0],t[1]+=x[1])}();n=!0}else if(v){if(e.hoverData.dragging||!o.boxSelectionEnabled()||!D&&o.panningEnabled()&&o.userPanningEnabled()){if(!e.hoverData.selecting&&o.panningEnabled()&&o.userPanningEnabled()){i(b,e.hoverData.downs)&&(e.hoverData.dragging=!0,e.hoverData.justStartedPan=!0,f[4]=0,e.data.bgActivePosistion=Tt(h),e.redrawHint("select",!0),e.redraw())}}else T();b&&b.pannable()&&b.active()&&b.unactivate()}return f[2]=c[0],f[3]=c[1],n?(t.stopPropagation&&t.stopPropagation(),t.preventDefault&&t.preventDefault(),!1):void 0}}),!1),e.registerBinding(t,"mouseup",(function(t){if((1!==e.hoverData.which||1===t.which||!e.hoverData.capture)&&e.hoverData.capture){e.hoverData.capture=!1;var i=e.cy,o=e.projectIntoViewport(t.clientX,t.clientY),s=e.selection,l=e.findNearestElement(o[0],o[1],!0,!1),u=e.dragData.possibleDragElements,c=e.hoverData.down,h=a(t);if(e.data.bgActivePosistion&&(e.redrawHint("select",!0),e.redraw()),e.hoverData.tapholdCancelled=!0,e.data.bgActivePosistion=void 0,c&&c.unactivate(),3===e.hoverData.which){var p={originalEvent:t,type:"cxttapend",position:{x:o[0],y:o[1]}};if(c?c.emit(p):i.emit(p),!e.hoverData.cxtDragged){var f={originalEvent:t,type:"cxttap",position:{x:o[0],y:o[1]}};c?c.emit(f):i.emit(f)}e.hoverData.cxtDragged=!1,e.hoverData.which=null}else if(1===e.hoverData.which){if(r(l,["mouseup","tapend","vmouseup"],t,{x:o[0],y:o[1]}),e.dragData.didDrag||e.hoverData.dragged||e.hoverData.selecting||e.hoverData.isOverThresholdDrag||(r(c,["click","tap","vclick"],t,{x:o[0],y:o[1]}),x=!1,t.timeStamp-w<=i.multiClickDebounceTime()?(b&&clearTimeout(b),x=!0,w=null,r(c,["dblclick","dbltap","vdblclick"],t,{x:o[0],y:o[1]})):(b=setTimeout((function(){x||r(c,["oneclick","onetap","voneclick"],t,{x:o[0],y:o[1]})}),i.multiClickDebounceTime()),w=t.timeStamp)),null!=c||e.dragData.didDrag||e.hoverData.selecting||e.hoverData.dragged||a(t)||(i.$(n).unselect(["tapunselect"]),u.length>0&&e.redrawHint("eles",!0),e.dragData.possibleDragElements=u=i.collection()),l!=c||e.dragData.didDrag||e.hoverData.selecting||null!=l&&l._private.selectable&&(e.hoverData.dragging||("additive"===i.selectionType()||h?l.selected()?l.unselect(["tapunselect"]):l.select(["tapselect"]):h||(i.$(n).unmerge(l).unselect(["tapunselect"]),l.select(["tapselect"]))),e.redrawHint("eles",!0)),e.hoverData.selecting){var g=i.collection(e.getAllInBox(s[0],s[1],s[2],s[3]));e.redrawHint("select",!0),g.length>0&&e.redrawHint("eles",!0),i.emit({type:"boxend",originalEvent:t,position:{x:o[0],y:o[1]}});var v=function(e){return e.selectable()&&!e.selected()};"additive"===i.selectionType()||h||i.$(n).unmerge(g).unselect(),g.emit("box").stdFilter(v).select().emit("boxselect"),e.redraw()}if(e.hoverData.dragging&&(e.hoverData.dragging=!1,e.redrawHint("select",!0),e.redrawHint("eles",!0),e.redraw()),!s[4]){e.redrawHint("drag",!0),e.redrawHint("eles",!0);var y=c&&c.grabbed();d(u),y&&(c.emit("freeon"),u.emit("free"),e.dragData.didDrag&&(c.emit("dragfreeon"),u.emit("dragfree")))}}s[4]=0,e.hoverData.down=null,e.hoverData.cxtStarted=!1,e.hoverData.draggingEles=!1,e.hoverData.selecting=!1,e.hoverData.isOverThresholdDrag=!1,e.dragData.didDrag=!1,e.hoverData.dragged=!1,e.hoverData.dragDelta=[],e.hoverData.mdownPos=null,e.hoverData.mdownGPos=null,e.hoverData.which=null}}),!1);var C,S,P,D,T,_,M,B,N,I,z,A,L,O=function(t){if(!e.scrollingPage){var n=e.cy,r=n.zoom(),a=n.pan(),i=e.projectIntoViewport(t.clientX,t.clientY),o=[i[0]*r+a.x,i[1]*r+a.y];if(e.hoverData.draggingEles||e.hoverData.dragging||e.hoverData.cxtStarted||0!==e.selection[4])t.preventDefault();else if(n.panningEnabled()&&n.userPanningEnabled()&&n.zoomingEnabled()&&n.userZoomingEnabled()){var s;t.preventDefault(),e.data.wheelZooming=!0,clearTimeout(e.data.wheelTimeout),e.data.wheelTimeout=setTimeout((function(){e.data.wheelZooming=!1,e.redrawHint("eles",!0),e.redraw()}),150),s=null!=t.deltaY?t.deltaY/-250:null!=t.wheelDeltaY?t.wheelDeltaY/1e3:t.wheelDelta/1e3,s*=e.wheelSensitivity,1===t.deltaMode&&(s*=33);var l=n.zoom()*Math.pow(10,s);"gesturechange"===t.type&&(l=e.gestureStartZoom*t.scale),n.zoom({level:l,renderedPosition:{x:o[0],y:o[1]}}),n.emit("gesturechange"===t.type?"pinchzoom":"scrollzoom")}}};e.registerBinding(e.container,"wheel",O,!0),e.registerBinding(t,"scroll",(function(t){e.scrollingPage=!0,clearTimeout(e.scrollingPageTimeout),e.scrollingPageTimeout=setTimeout((function(){e.scrollingPage=!1}),250)}),!0),e.registerBinding(e.container,"gesturestart",(function(t){e.gestureStartZoom=e.cy.zoom(),e.hasTouchStarted||t.preventDefault()}),!0),e.registerBinding(e.container,"gesturechange",(function(t){e.hasTouchStarted||O(t)}),!0),e.registerBinding(e.container,"mouseout",(function(t){var n=e.projectIntoViewport(t.clientX,t.clientY);e.cy.emit({originalEvent:t,type:"mouseout",position:{x:n[0],y:n[1]}})}),!1),e.registerBinding(e.container,"mouseover",(function(t){var n=e.projectIntoViewport(t.clientX,t.clientY);e.cy.emit({originalEvent:t,type:"mouseover",position:{x:n[0],y:n[1]}})}),!1);var R,V,F,j,q,Y,X,W=function(e,t,n,r){return Math.sqrt((n-e)*(n-e)+(r-t)*(r-t))},H=function(e,t,n,r){return(n-e)*(n-e)+(r-t)*(r-t)};if(e.registerBinding(e.container,"touchstart",R=function(t){if(e.hasTouchStarted=!0,m(t)){p(),e.touchData.capture=!0,e.data.bgActivePosistion=void 0;var n=e.cy,a=e.touchData.now,i=e.touchData.earlier;if(t.touches[0]){var o=e.projectIntoViewport(t.touches[0].clientX,t.touches[0].clientY);a[0]=o[0],a[1]=o[1]}if(t.touches[1]){o=e.projectIntoViewport(t.touches[1].clientX,t.touches[1].clientY);a[2]=o[0],a[3]=o[1]}if(t.touches[2]){o=e.projectIntoViewport(t.touches[2].clientX,t.touches[2].clientY);a[4]=o[0],a[5]=o[1]}if(t.touches[1]){e.touchData.singleTouchMoved=!0,d(e.dragData.touchDragEles);var l=e.findContainerClientCoords();N=l[0],I=l[1],z=l[2],A=l[3],C=t.touches[0].clientX-N,S=t.touches[0].clientY-I,P=t.touches[1].clientX-N,D=t.touches[1].clientY-I,L=0<=C&&C<=z&&0<=P&&P<=z&&0<=S&&S<=A&&0<=D&&D<=A;var h=n.pan(),f=n.zoom();T=W(C,S,P,D),_=H(C,S,P,D),B=[((M=[(C+P)/2,(S+D)/2])[0]-h.x)/f,(M[1]-h.y)/f];if(_<4e4&&!t.touches[2]){var g=e.findNearestElement(a[0],a[1],!0,!0),v=e.findNearestElement(a[2],a[3],!0,!0);return g&&g.isNode()?(g.activate().emit({originalEvent:t,type:"cxttapstart",position:{x:a[0],y:a[1]}}),e.touchData.start=g):v&&v.isNode()?(v.activate().emit({originalEvent:t,type:"cxttapstart",position:{x:a[0],y:a[1]}}),e.touchData.start=v):n.emit({originalEvent:t,type:"cxttapstart",position:{x:a[0],y:a[1]}}),e.touchData.start&&(e.touchData.start._private.grabbed=!1),e.touchData.cxt=!0,e.touchData.cxtDragged=!1,e.data.bgActivePosistion=void 0,void e.redraw()}}if(t.touches[2])n.boxSelectionEnabled()&&t.preventDefault();else if(t.touches[1]);else if(t.touches[0]){var y=e.findNearestElements(a[0],a[1],!0,!0),b=y[0];if(null!=b&&(b.activate(),e.touchData.start=b,e.touchData.starts=y,e.nodeIsGrabbable(b))){var x=e.dragData.touchDragEles=n.collection(),w=null;e.redrawHint("eles",!0),e.redrawHint("drag",!0),b.selected()?(w=n.$((function(t){return t.selected()&&e.nodeIsGrabbable(t)})),u(w,{addToList:x})):c(b,{addToList:x}),s(b);var E=function(e){return{originalEvent:t,type:e,position:{x:a[0],y:a[1]}}};b.emit(E("grabon")),w?w.forEach((function(e){e.emit(E("grab"))})):b.emit(E("grab"))}r(b,["touchstart","tapstart","vmousedown"],t,{x:a[0],y:a[1]}),null==b&&(e.data.bgActivePosistion={x:o[0],y:o[1]},e.redrawHint("select",!0),e.redraw()),e.touchData.singleTouchMoved=!1,e.touchData.singleTouchStartTime=+new Date,clearTimeout(e.touchData.tapholdTimeout),e.touchData.tapholdTimeout=setTimeout((function(){!1!==e.touchData.singleTouchMoved||e.pinching||e.touchData.selecting||r(e.touchData.start,["taphold"],t,{x:a[0],y:a[1]})}),e.tapholdDuration)}if(t.touches.length>=1){for(var k=e.touchData.startPosition=[null,null,null,null,null,null],O=0;O=e.touchTapThreshold2}if(n&&e.touchData.cxt){t.preventDefault();var w=t.touches[0].clientX-N,E=t.touches[0].clientY-I,M=t.touches[1].clientX-N,z=t.touches[1].clientY-I,A=H(w,E,M,z);if(A/_>=2.25||A>=22500){e.touchData.cxt=!1,e.data.bgActivePosistion=void 0,e.redrawHint("select",!0);var O={originalEvent:t,type:"cxttapend",position:{x:s[0],y:s[1]}};e.touchData.start?(e.touchData.start.unactivate().emit(O),e.touchData.start=null):o.emit(O)}}if(n&&e.touchData.cxt){O={originalEvent:t,type:"cxtdrag",position:{x:s[0],y:s[1]}};e.data.bgActivePosistion=void 0,e.redrawHint("select",!0),e.touchData.start?e.touchData.start.emit(O):o.emit(O),e.touchData.start&&(e.touchData.start._private.grabbed=!1),e.touchData.cxtDragged=!0;var R=e.findNearestElement(s[0],s[1],!0,!0);e.touchData.cxtOver&&R===e.touchData.cxtOver||(e.touchData.cxtOver&&e.touchData.cxtOver.emit({originalEvent:t,type:"cxtdragout",position:{x:s[0],y:s[1]}}),e.touchData.cxtOver=R,R&&R.emit({originalEvent:t,type:"cxtdragover",position:{x:s[0],y:s[1]}}))}else if(n&&t.touches[2]&&o.boxSelectionEnabled())t.preventDefault(),e.data.bgActivePosistion=void 0,this.lastThreeTouch=+new Date,e.touchData.selecting||o.emit({originalEvent:t,type:"boxstart",position:{x:s[0],y:s[1]}}),e.touchData.selecting=!0,e.touchData.didSelect=!0,a[4]=1,a&&0!==a.length&&void 0!==a[0]?(a[2]=(s[0]+s[2]+s[4])/3,a[3]=(s[1]+s[3]+s[5])/3):(a[0]=(s[0]+s[2]+s[4])/3,a[1]=(s[1]+s[3]+s[5])/3,a[2]=(s[0]+s[2]+s[4])/3+1,a[3]=(s[1]+s[3]+s[5])/3+1),e.redrawHint("select",!0),e.redraw();else if(n&&t.touches[1]&&!e.touchData.didSelect&&o.zoomingEnabled()&&o.panningEnabled()&&o.userZoomingEnabled()&&o.userPanningEnabled()){if(t.preventDefault(),e.data.bgActivePosistion=void 0,e.redrawHint("select",!0),ee=e.dragData.touchDragEles){e.redrawHint("drag",!0);for(var V=0;V0&&!e.hoverData.draggingEles&&!e.swipePanning&&null!=e.data.bgActivePosistion&&(e.data.bgActivePosistion=void 0,e.redrawHint("select",!0),e.redraw())}},!1),e.registerBinding(t,"touchcancel",F=function(t){var n=e.touchData.start;e.touchData.capture=!1,n&&n.unactivate()}),e.registerBinding(t,"touchend",j=function(t){var a=e.touchData.start;if(e.touchData.capture){0===t.touches.length&&(e.touchData.capture=!1),t.preventDefault();var i=e.selection;e.swipePanning=!1,e.hoverData.draggingEles=!1;var o,s=e.cy,l=s.zoom(),u=e.touchData.now,c=e.touchData.earlier;if(t.touches[0]){var h=e.projectIntoViewport(t.touches[0].clientX,t.touches[0].clientY);u[0]=h[0],u[1]=h[1]}if(t.touches[1]){h=e.projectIntoViewport(t.touches[1].clientX,t.touches[1].clientY);u[2]=h[0],u[3]=h[1]}if(t.touches[2]){h=e.projectIntoViewport(t.touches[2].clientX,t.touches[2].clientY);u[4]=h[0],u[5]=h[1]}if(a&&a.unactivate(),e.touchData.cxt){if(o={originalEvent:t,type:"cxttapend",position:{x:u[0],y:u[1]}},a?a.emit(o):s.emit(o),!e.touchData.cxtDragged){var p={originalEvent:t,type:"cxttap",position:{x:u[0],y:u[1]}};a?a.emit(p):s.emit(p)}return e.touchData.start&&(e.touchData.start._private.grabbed=!1),e.touchData.cxt=!1,e.touchData.start=null,void e.redraw()}if(!t.touches[2]&&s.boxSelectionEnabled()&&e.touchData.selecting){e.touchData.selecting=!1;var f=s.collection(e.getAllInBox(i[0],i[1],i[2],i[3]));i[0]=void 0,i[1]=void 0,i[2]=void 0,i[3]=void 0,i[4]=0,e.redrawHint("select",!0),s.emit({type:"boxend",originalEvent:t,position:{x:u[0],y:u[1]}});f.emit("box").stdFilter((function(e){return e.selectable()&&!e.selected()})).select().emit("boxselect"),f.nonempty()&&e.redrawHint("eles",!0),e.redraw()}if(null!=a&&a.unactivate(),t.touches[2])e.data.bgActivePosistion=void 0,e.redrawHint("select",!0);else if(t.touches[1]);else if(t.touches[0]);else if(!t.touches[0]){e.data.bgActivePosistion=void 0,e.redrawHint("select",!0);var g=e.dragData.touchDragEles;if(null!=a){var v=a._private.grabbed;d(g),e.redrawHint("drag",!0),e.redrawHint("eles",!0),v&&(a.emit("freeon"),g.emit("free"),e.dragData.didDrag&&(a.emit("dragfreeon"),g.emit("dragfree"))),r(a,["touchend","tapend","vmouseup","tapdragout"],t,{x:u[0],y:u[1]}),a.unactivate(),e.touchData.start=null}else{var y=e.findNearestElement(u[0],u[1],!0,!0);r(y,["touchend","tapend","vmouseup","tapdragout"],t,{x:u[0],y:u[1]})}var m=e.touchData.startPosition[0]-u[0],b=m*m,x=e.touchData.startPosition[1]-u[1],w=(b+x*x)*l*l;e.touchData.singleTouchMoved||(a||s.$(":selected").unselect(["tapunselect"]),r(a,["tap","vclick"],t,{x:u[0],y:u[1]}),q=!1,t.timeStamp-X<=s.multiClickDebounceTime()?(Y&&clearTimeout(Y),q=!0,X=null,r(a,["dbltap","vdblclick"],t,{x:u[0],y:u[1]})):(Y=setTimeout((function(){q||r(a,["onetap","voneclick"],t,{x:u[0],y:u[1]})}),s.multiClickDebounceTime()),X=t.timeStamp)),null!=a&&!e.dragData.didDrag&&a._private.selectable&&w2){for(var p=[c[0],c[1]],f=Math.pow(p[0]-e,2)+Math.pow(p[1]-t,2),g=1;g0)return g[0]}return null},p=Object.keys(d),f=0;f0?u:Kt(a,i,e,t,n,r,o,s)},checkPoint:function(e,t,n,r,a,i,o,s){var l=2*(s="auto"===s?hn(r,a):s);if(Jt(e,t,this.points,i,o,r,a-l,[0,-1],n))return!0;if(Jt(e,t,this.points,i,o,r-l,a,[0,-1],n))return!0;var u=r/2+2*n,c=a/2+2*n;return!!Qt(e,t,[i-u,o-c,i-u,o,i+u,o,i+u,o-c])||(!!nn(e,t,l,l,i+r/2-s,o+a/2-s,n)||!!nn(e,t,l,l,i-r/2+s,o+a/2-s,n))}}},Au.registerNodeShapes=function(){var e=this.nodeShapes={},t=this;this.generateEllipse(),this.generatePolygon("triangle",un(3,0)),this.generateRoundPolygon("round-triangle",un(3,0)),this.generatePolygon("rectangle",un(4,0)),e.square=e.rectangle,this.generateRoundRectangle(),this.generateCutRectangle(),this.generateBarrel(),this.generateBottomRoundrectangle();var n=[0,1,1,0,0,-1,-1,0];this.generatePolygon("diamond",n),this.generateRoundPolygon("round-diamond",n),this.generatePolygon("pentagon",un(5,0)),this.generateRoundPolygon("round-pentagon",un(5,0)),this.generatePolygon("hexagon",un(6,0)),this.generateRoundPolygon("round-hexagon",un(6,0)),this.generatePolygon("heptagon",un(7,0)),this.generateRoundPolygon("round-heptagon",un(7,0)),this.generatePolygon("octagon",un(8,0)),this.generateRoundPolygon("round-octagon",un(8,0));var r=new Array(20),a=dn(5,0),i=dn(5,Math.PI/5),o=.5*(3-Math.sqrt(5));o*=1.57;for(var s=0;s=e.deqFastCost*g)break}else if(a){if(p>=e.deqCost*l||p>=e.deqAvgCost*s)break}else if(f>=e.deqNoDrawCost*Fu)break;var v=e.deq(t,d,c);if(!(v.length>0))break;for(var y=0;y0&&(e.onDeqd(t,u),!a&&e.shouldRedraw(t,u,d,c)&&r())}),a(t))}}},qu=function(){function e(t){var n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:Xe;a(this,e),this.idsByKey=new it,this.keyForId=new it,this.cachesByLvl=new it,this.lvls=[],this.getKey=t,this.doesEleInvalidateKey=n}return o(e,[{key:"getIdsFor",value:function(e){null==e&&Ke("Can not get id list for null key");var t=this.idsByKey,n=this.idsByKey.get(e);return n||(n=new st,t.set(e,n)),n}},{key:"addIdForKey",value:function(e,t){null!=e&&this.getIdsFor(e).add(t)}},{key:"deleteIdForKey",value:function(e,t){null!=e&&this.getIdsFor(e).delete(t)}},{key:"getNumberOfIdsForKey",value:function(e){return null==e?0:this.getIdsFor(e).size}},{key:"updateKeyMappingFor",value:function(e){var t=e.id(),n=this.keyForId.get(t),r=this.getKey(e);this.deleteIdForKey(n,t),this.addIdForKey(r,t),this.keyForId.set(t,r)}},{key:"deleteKeyMappingFor",value:function(e){var t=e.id(),n=this.keyForId.get(t);this.deleteIdForKey(n,t),this.keyForId.delete(t)}},{key:"keyHasChangedFor",value:function(e){var t=e.id();return this.keyForId.get(t)!==this.getKey(e)}},{key:"isInvalid",value:function(e){return this.keyHasChangedFor(e)||this.doesEleInvalidateKey(e)}},{key:"getCachesAt",value:function(e){var t=this.cachesByLvl,n=this.lvls,r=t.get(e);return r||(r=new it,t.set(e,r),n.push(e)),r}},{key:"getCache",value:function(e,t){return this.getCachesAt(t).get(e)}},{key:"get",value:function(e,t){var n=this.getKey(e),r=this.getCache(n,t);return null!=r&&this.updateKeyMappingFor(e),r}},{key:"getForCachedKey",value:function(e,t){var n=this.keyForId.get(e.id());return this.getCache(n,t)}},{key:"hasCache",value:function(e,t){return this.getCachesAt(t).has(e)}},{key:"has",value:function(e,t){var n=this.getKey(e);return this.hasCache(n,t)}},{key:"setCache",value:function(e,t,n){n.key=e,this.getCachesAt(t).set(e,n)}},{key:"set",value:function(e,t,n){var r=this.getKey(e);this.setCache(r,t,n),this.updateKeyMappingFor(e)}},{key:"deleteCache",value:function(e,t){this.getCachesAt(t).delete(e)}},{key:"delete",value:function(e,t){var n=this.getKey(e);this.deleteCache(n,t)}},{key:"invalidateKey",value:function(e){var t=this;this.lvls.forEach((function(n){return t.deleteCache(e,n)}))}},{key:"invalidate",value:function(e){var t=e.id(),n=this.keyForId.get(t);this.deleteKeyMappingFor(e);var r=this.doesEleInvalidateKey(e);return r&&this.invalidateKey(n),r||0===this.getNumberOfIdsForKey(n)}}]),e}(),Yu={dequeue:"dequeue",downscale:"downscale",highQuality:"highQuality"},Xu=et({getKey:null,doesEleInvalidateKey:Xe,drawElement:null,getBoundingBox:null,getRotationPoint:null,getRotationOffset:null,isVisible:Ye,allowEdgeTxrCaching:!0,allowParentTxrCaching:!0}),Wu=function(e,t){var n=this;n.renderer=e,n.onDequeues=[];var r=Xu(t);Y(n,r),n.lookup=new qu(r.getKey,r.doesEleInvalidateKey),n.setupDequeueing()},Hu=Wu.prototype;Hu.reasons=Yu,Hu.getTextureQueue=function(e){var t=this;return t.eleImgCaches=t.eleImgCaches||{},t.eleImgCaches[e]=t.eleImgCaches[e]||[]},Hu.getRetiredTextureQueue=function(e){var t=this.eleImgCaches.retired=this.eleImgCaches.retired||{};return t[e]=t[e]||[]},Hu.getElementQueue=function(){return this.eleCacheQueue=this.eleCacheQueue||new ht((function(e,t){return t.reqs-e.reqs}))},Hu.getElementKeyToQueue=function(){return this.eleKeyToCacheQueue=this.eleKeyToCacheQueue||{}},Hu.getElement=function(e,t,n,r,a){var i=this,o=this.renderer,s=o.cy.zoom(),l=this.lookup;if(!t||0===t.w||0===t.h||isNaN(t.w)||isNaN(t.h)||!e.visible()||e.removed())return null;if(!i.allowEdgeTxrCaching&&e.isEdge()||!i.allowParentTxrCaching&&e.isParent())return null;if(null==r&&(r=Math.ceil(Mt(s*n))),r<-4)r=-4;else if(s>=7.99||r>3)return null;var u=Math.pow(2,r),c=t.h*u,d=t.w*u,h=o.eleTextBiggerThanMin(e,u);if(!this.isVisible(e,h))return null;var p,f=l.get(e,r);if(f&&f.invalidated&&(f.invalidated=!1,f.texture.invalidatedWidth-=f.width),f)return f;if(p=c<=25?25:c<=50?50:50*Math.ceil(c/50),c>1024||d>1024)return null;var g=i.getTextureQueue(p),v=g[g.length-2],y=function(){return i.recycleTexture(p,d)||i.addTexture(p,d)};v||(v=g[g.length-1]),v||(v=y()),v.width-v.usedWidthr;D--)S=i.getElement(e,t,n,D,Yu.downscale);P()}else{var T;if(!x&&!w&&!E)for(var _=r-1;_>=-4;_--){var M=l.get(e,_);if(M){T=M;break}}if(b(T))return i.queueElement(e,r),T;v.context.translate(v.usedWidth,0),v.context.scale(u,u),this.drawElement(v.context,e,t,h,!1),v.context.scale(1/u,1/u),v.context.translate(-v.usedWidth,0)}return f={x:v.usedWidth,texture:v,level:r,scale:u,width:d,height:c,scaledLabelShown:h},v.usedWidth+=Math.ceil(d+8),v.eleCaches.push(f),l.set(e,r,f),i.checkTextureFullness(v),f},Hu.invalidateElements=function(e){for(var t=0;t=.2*e.width&&this.retireTexture(e)},Hu.checkTextureFullness=function(e){var t=this.getTextureQueue(e.height);e.usedWidth/e.width>.8&&e.fullnessChecks>=10?tt(t,e):e.fullnessChecks++},Hu.retireTexture=function(e){var t=e.height,n=this.getTextureQueue(t),r=this.lookup;tt(n,e),e.retired=!0;for(var a=e.eleCaches,i=0;i=t)return i.retired=!1,i.usedWidth=0,i.invalidatedWidth=0,i.fullnessChecks=0,nt(i.eleCaches),i.context.setTransform(1,0,0,1,0,0),i.context.clearRect(0,0,i.width,i.height),tt(r,i),n.push(i),i}},Hu.queueElement=function(e,t){var n=this.getElementQueue(),r=this.getElementKeyToQueue(),a=this.getKey(e),i=r[a];if(i)i.level=Math.max(i.level,t),i.eles.merge(e),i.reqs++,n.updateItem(i);else{var o={eles:e.spawn().merge(e),level:t,reqs:1,key:a};n.push(o),r[a]=o}},Hu.dequeue=function(e){for(var t=this,n=t.getElementQueue(),r=t.getElementKeyToQueue(),a=[],i=t.lookup,o=0;o<1&&n.size()>0;o++){var s=n.pop(),l=s.key,u=s.eles[0],c=i.hasCache(u,s.level);if(r[l]=null,!c){a.push(s);var d=t.getBoundingBox(u);t.getElement(u,d,e,s.level,Yu.dequeue)}}return a},Hu.removeFromQueue=function(e){var t=this.getElementQueue(),n=this.getElementKeyToQueue(),r=this.getKey(e),a=n[r];null!=a&&(1===a.eles.length?(a.reqs=qe,t.updateItem(a),t.pop(),n[r]=null):a.eles.unmerge(e))},Hu.onDequeue=function(e){this.onDequeues.push(e)},Hu.offDequeue=function(e){tt(this.onDequeues,e)},Hu.setupDequeueing=ju({deqRedrawThreshold:100,deqCost:.15,deqAvgCost:.1,deqNoDrawCost:.9,deqFastCost:.9,deq:function(e,t,n){return e.dequeue(t,n)},onDeqd:function(e,t){for(var n=0;n=3.99||n>2)return null;r.validateLayersElesOrdering(n,e);var o,s,l=r.layersByLevel,u=Math.pow(2,n),c=l[n]=l[n]||[];if(r.levelIsComplete(n,e))return c;!function(){var t=function(t){if(r.validateLayersElesOrdering(t,e),r.levelIsComplete(t,e))return s=l[t],!0},a=function(e){if(!s)for(var r=n+e;-4<=r&&r<=2&&!t(r);r+=e);};a(1),a(-1);for(var i=c.length-1;i>=0;i--){var o=c[i];o.invalid&&tt(c,o)}}();var d=function(t){var a=(t=t||{}).after;!function(){if(!o){o=Rt();for(var t=0;t32767||s>32767)return null;if(i*s>16e6)return null;var l=r.makeLayer(o,n);if(null!=a){var d=c.indexOf(a)+1;c.splice(d,0,l)}else(void 0===t.insert||t.insert)&&c.unshift(l);return l};if(r.skipping&&!i)return null;for(var h=null,p=e.length/1,f=!i,g=0;g=p||!Ht(h.bb,v.boundingBox()))&&!(h=d({insert:!0,after:h})))return null;s||f?r.queueLayer(h,v):r.drawEleInLayer(h,v,n,t),h.eles.push(v),m[n]=h}}return s||(f?null:c)},Gu.getEleLevelForLayerLevel=function(e,t){return e},Gu.drawEleInLayer=function(e,t,n,r){var a=this.renderer,i=e.context,o=t.boundingBox();0!==o.w&&0!==o.h&&t.visible()&&(n=this.getEleLevelForLayerLevel(n,r),a.setImgSmoothing(i,!1),a.drawCachedElement(i,t,null,null,n,true),a.setImgSmoothing(i,!0))},Gu.levelIsComplete=function(e,t){var n=this.layersByLevel[e];if(!n||0===n.length)return!1;for(var r=0,a=0;a0)return!1;if(i.invalid)return!1;r+=i.eles.length}return r===t.length},Gu.validateLayersElesOrdering=function(e,t){var n=this.layersByLevel[e];if(n)for(var r=0;r0){e=!0;break}}return e},Gu.invalidateElements=function(e){var t=this;0!==e.length&&(t.lastInvalidationTime=Te(),0!==e.length&&t.haveLayers()&&t.updateElementsInLayers(e,(function(e,n,r){t.invalidateLayer(e)})))},Gu.invalidateLayer=function(e){if(this.lastInvalidationTime=Te(),!e.invalid){var t=e.level,n=e.eles,r=this.layersByLevel[t];tt(r,e),e.elesQueue=[],e.invalid=!0,e.replacement&&(e.replacement.invalid=!0);for(var a=0;a3&&void 0!==arguments[3])||arguments[3],a=!(arguments.length>4&&void 0!==arguments[4])||arguments[4],i=!(arguments.length>5&&void 0!==arguments[5])||arguments[5],o=this,s=t._private.rscratch;if((!i||t.visible())&&!s.badLine&&null!=s.allpts&&!isNaN(s.allpts[0])){var l;n&&(l=n,e.translate(-l.x1,-l.y1));var u=i?t.pstyle("opacity").value:1,c=i?t.pstyle("line-opacity").value:1,d=t.pstyle("curve-style").value,h=t.pstyle("line-style").value,p=t.pstyle("width").pfValue,f=t.pstyle("line-cap").value,g=t.pstyle("line-outline-width").value,v=t.pstyle("line-outline-color").value,y=u*c,m=u*c,b=function(){var n=arguments.length>0&&void 0!==arguments[0]?arguments[0]:y;"straight-triangle"===d?(o.eleStrokeStyle(e,t,n),o.drawEdgeTrianglePath(t,e,s.allpts)):(e.lineWidth=p,e.lineCap=f,o.eleStrokeStyle(e,t,n),o.drawEdgePath(t,e,s.allpts,h),e.lineCap="butt")},x=function(){var n=arguments.length>0&&void 0!==arguments[0]?arguments[0]:m;o.drawArrowheads(e,t,n)};if(e.lineJoin="round","yes"===t.pstyle("ghost").value){var w=t.pstyle("ghost-offset-x").pfValue,E=t.pstyle("ghost-offset-y").pfValue,k=t.pstyle("ghost-opacity").value,C=y*k;e.translate(w,E),b(C),x(C),e.translate(-w,-E)}else!function(){var n=arguments.length>0&&void 0!==arguments[0]?arguments[0]:y;e.lineWidth=p+g,e.lineCap=f,g>0?(o.colorStrokeStyle(e,v[0],v[1],v[2],n),"straight-triangle"===d?o.drawEdgeTrianglePath(t,e,s.allpts):(o.drawEdgePath(t,e,s.allpts,h),e.lineCap="butt")):e.lineCap="butt"}();a&&o.drawEdgeUnderlay(e,t),b(),x(),a&&o.drawEdgeOverlay(e,t),o.drawElementText(e,t,null,r),n&&e.translate(l.x1,l.y1)}}},hc=function(e){if(!["overlay","underlay"].includes(e))throw new Error("Invalid state");return function(t,n){if(n.visible()){var r=n.pstyle("".concat(e,"-opacity")).value;if(0!==r){var a=this,i=a.usePaths(),o=n._private.rscratch,s=2*n.pstyle("".concat(e,"-padding")).pfValue,l=n.pstyle("".concat(e,"-color")).value;t.lineWidth=s,"self"!==o.edgeType||i?t.lineCap="round":t.lineCap="butt",a.colorStrokeStyle(t,l[0],l[1],l[2],r),a.drawEdgePath(n,t,o.allpts,"solid")}}}};dc.drawEdgeOverlay=hc("overlay"),dc.drawEdgeUnderlay=hc("underlay"),dc.drawEdgePath=function(e,t,n,r){var a,i=e._private.rscratch,o=t,s=!1,l=this.usePaths(),u=e.pstyle("line-dash-pattern").pfValue,c=e.pstyle("line-dash-offset").pfValue;if(l){var h=n.join("$");i.pathCacheKey&&i.pathCacheKey===h?(a=t=i.pathCache,s=!0):(a=t=new Path2D,i.pathCacheKey=h,i.pathCache=a)}if(o.setLineDash)switch(r){case"dotted":o.setLineDash([1,1]);break;case"dashed":o.setLineDash(u),o.lineDashOffset=c;break;case"solid":o.setLineDash([])}if(!s&&!i.badLine)switch(t.beginPath&&t.beginPath(),t.moveTo(n[0],n[1]),i.edgeType){case"bezier":case"self":case"compound":case"multibezier":for(var p=2;p+35&&void 0!==arguments[5]?arguments[5]:5,o=arguments.length>6?arguments[6]:void 0;e.beginPath(),e.moveTo(t+i,n),e.lineTo(t+r-i,n),e.quadraticCurveTo(t+r,n,t+r,n+i),e.lineTo(t+r,n+a-i),e.quadraticCurveTo(t+r,n+a,t+r-i,n+a),e.lineTo(t+i,n+a),e.quadraticCurveTo(t,n+a,t,n+a-i),e.lineTo(t,n+i),e.quadraticCurveTo(t,n,t+i,n),e.closePath(),o?e.stroke():e.fill()}fc.eleTextBiggerThanMin=function(e,t){if(!t){var n=e.cy().zoom(),r=this.getPixelRatio(),a=Math.ceil(Mt(n*r));t=Math.pow(2,a)}return!(e.pstyle("font-size").pfValue*t5&&void 0!==arguments[5])||arguments[5],o=this;if(null==r){if(i&&!o.eleTextBiggerThanMin(t))return}else if(!1===r)return;if(t.isNode()){var s=t.pstyle("label");if(!s||!s.value)return;var l=o.getLabelJustification(t);e.textAlign=l,e.textBaseline="bottom"}else{var u=t.element()._private.rscratch.badLine,c=t.pstyle("label"),d=t.pstyle("source-label"),h=t.pstyle("target-label");if(u||(!c||!c.value)&&(!d||!d.value)&&(!h||!h.value))return;e.textAlign="center",e.textBaseline="bottom"}var p,f=!n;n&&(p=n,e.translate(-p.x1,-p.y1)),null==a?(o.drawText(e,t,null,f,i),t.isEdge()&&(o.drawText(e,t,"source",f,i),o.drawText(e,t,"target",f,i))):o.drawText(e,t,a,f,i),n&&e.translate(p.x1,p.y1)},fc.getFontCache=function(e){var t;this.fontCaches=this.fontCaches||[];for(var n=0;n2&&void 0!==arguments[2])||arguments[2],r=t.pstyle("font-style").strValue,a=t.pstyle("font-size").pfValue+"px",i=t.pstyle("font-family").strValue,o=t.pstyle("font-weight").strValue,s=n?t.effectiveOpacity()*t.pstyle("text-opacity").value:1,l=t.pstyle("text-outline-opacity").value*s,u=t.pstyle("color").value,c=t.pstyle("text-outline-color").value;e.font=r+" "+o+" "+a+" "+i,e.lineJoin="round",this.colorFillStyle(e,u[0],u[1],u[2],s),this.colorStrokeStyle(e,c[0],c[1],c[2],l)},fc.getTextAngle=function(e,t){var n=e._private.rscratch,r=t?t+"-":"",a=e.pstyle(r+"text-rotation"),i=rt(n,"labelAngle",t);return"autorotate"===a.strValue?e.isEdge()?i:0:"none"===a.strValue?0:a.pfValue},fc.drawText=function(e,t,n){var r=!(arguments.length>3&&void 0!==arguments[3])||arguments[3],a=!(arguments.length>4&&void 0!==arguments[4])||arguments[4],i=t._private.rscratch,o=a?t.effectiveOpacity():1;if(!a||0!==o&&0!==t.pstyle("text-opacity").value){"main"===n&&(n=null);var s,l,u=rt(i,"labelX",n),c=rt(i,"labelY",n),d=this.getLabelText(t,n);if(null!=d&&""!==d&&!isNaN(u)&&!isNaN(c)){this.setupTextStyle(e,t,a);var h,p=n?n+"-":"",f=rt(i,"labelWidth",n),g=rt(i,"labelHeight",n),v=t.pstyle(p+"text-margin-x").pfValue,y=t.pstyle(p+"text-margin-y").pfValue,m=t.isEdge(),b=t.pstyle("text-halign").value,x=t.pstyle("text-valign").value;switch(m&&(b="center",x="center"),u+=v,c+=y,0!==(h=r?this.getTextAngle(t,n):0)&&(s=u,l=c,e.translate(s,l),e.rotate(h),u=0,c=0),x){case"top":break;case"center":c+=g/2;break;case"bottom":c+=g}var w=t.pstyle("text-background-opacity").value,E=t.pstyle("text-border-opacity").value,k=t.pstyle("text-border-width").pfValue,C=t.pstyle("text-background-padding").pfValue,S=0===t.pstyle("text-background-shape").strValue.indexOf("round");if(w>0||k>0&&E>0){var P=u-C;switch(b){case"left":P-=f;break;case"center":P-=f/2}var D=c-g-C,T=f+2*C,_=g+2*C;if(w>0){var M=e.fillStyle,B=t.pstyle("text-background-color").value;e.fillStyle="rgba("+B[0]+","+B[1]+","+B[2]+","+w*o+")",S?gc(e,P,D,T,_,2):e.fillRect(P,D,T,_),e.fillStyle=M}if(k>0&&E>0){var N=e.strokeStyle,I=e.lineWidth,z=t.pstyle("text-border-color").value,A=t.pstyle("text-border-style").value;if(e.strokeStyle="rgba("+z[0]+","+z[1]+","+z[2]+","+E*o+")",e.lineWidth=k,e.setLineDash)switch(A){case"dotted":e.setLineDash([1,1]);break;case"dashed":e.setLineDash([4,2]);break;case"double":e.lineWidth=k/4,e.setLineDash([]);break;case"solid":e.setLineDash([])}if(S?gc(e,P,D,T,_,2,"stroke"):e.strokeRect(P,D,T,_),"double"===A){var L=k/2;S?gc(e,P+L,D+L,T-2*L,_-2*L,2,"stroke"):e.strokeRect(P+L,D+L,T-2*L,_-2*L)}e.setLineDash&&e.setLineDash([]),e.lineWidth=I,e.strokeStyle=N}}var O=2*t.pstyle("text-outline-width").pfValue;if(O>0&&(e.lineWidth=O),"wrap"===t.pstyle("text-wrap").value){var R=rt(i,"labelWrapCachedLines",n),V=rt(i,"labelLineHeight",n),F=f/2,j=this.getLabelJustification(t);switch("auto"===j||("left"===b?"left"===j?u+=-f:"center"===j&&(u+=-F):"center"===b?"left"===j?u+=-F:"right"===j&&(u+=F):"right"===b&&("center"===j?u+=F:"right"===j&&(u+=f))),x){case"top":case"center":case"bottom":c-=(R.length-1)*V}for(var q=0;q0&&e.strokeText(R[q],u,c),e.fillText(R[q],u,c),c+=V}else O>0&&e.strokeText(d,u,c),e.fillText(d,u,c);0!==h&&(e.rotate(-h),e.translate(-s,-l))}}};var vc={drawNode:function(e,t,n){var r,a,i=!(arguments.length>3&&void 0!==arguments[3])||arguments[3],o=!(arguments.length>4&&void 0!==arguments[4])||arguments[4],s=!(arguments.length>5&&void 0!==arguments[5])||arguments[5],l=this,u=t._private,c=u.rscratch,d=t.position();if(k(d.x)&&k(d.y)&&(!s||t.visible())){var h,p,f=s?t.effectiveOpacity():1,g=l.usePaths(),v=!1,y=t.padding();r=t.width()+2*y,a=t.height()+2*y,n&&(p=n,e.translate(-p.x1,-p.y1));for(var m=t.pstyle("background-image").value,b=new Array(m.length),x=new Array(m.length),w=0,E=0;E0&&void 0!==arguments[0]?arguments[0]:T;l.eleFillStyle(e,t,n)},X=function(){var t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:L;l.colorStrokeStyle(e,_[0],_[1],_[2],t)},W=function(){var t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:F;l.colorStrokeStyle(e,R[0],R[1],R[2],t)},H=function(e,t,n,r){var a,i=l.nodePathCache=l.nodePathCache||[],o=Oe("polygon"===n?n+","+r.join(","):n,""+t,""+e,""+q),s=i[o],u=!1;return null!=s?(a=s,u=!0,c.pathCache=a):(a=new Path2D,i[o]=c.pathCache=a),{path:a,cacheHit:u}},K=t.pstyle("shape").strValue,G=t.pstyle("shape-polygon-points").pfValue;if(g){e.translate(d.x,d.y);var U=H(r,a,K,G);h=U.path,v=U.cacheHit}var Z=function(){if(!v){var n=d;g&&(n={x:0,y:0}),l.nodeShapes[l.getNodeShape(t)].draw(h||e,n.x,n.y,r,a,q,c)}g?e.fill(h):e.fill()},$=function(){for(var n=arguments.length>0&&void 0!==arguments[0]?arguments[0]:f,r=!(arguments.length>1&&void 0!==arguments[1])||arguments[1],a=u.backgrounding,i=0,o=0;o0&&void 0!==arguments[0]&&arguments[0],i=arguments.length>1&&void 0!==arguments[1]?arguments[1]:f;l.hasPie(t)&&(l.drawPie(e,t,i),n&&(g||l.nodeShapes[l.getNodeShape(t)].draw(e,d.x,d.y,r,a,q,c)))},J=function(){var t=(P>0?P:-P)*(arguments.length>0&&void 0!==arguments[0]?arguments[0]:f),n=P>0?0:255;0!==P&&(l.colorFillStyle(e,n,n,n,t),g?e.fill(h):e.fill())},ee=function(){if(D>0){if(e.lineWidth=D,e.lineCap=N,e.lineJoin=B,e.setLineDash)switch(M){case"dotted":e.setLineDash([1,1]);break;case"dashed":e.setLineDash(z),e.lineDashOffset=A;break;case"solid":case"double":e.setLineDash([])}if("center"!==I){if(e.save(),e.lineWidth*=2,"inside"===I)g?e.clip(h):e.clip();else{var t=new Path2D;t.rect(-r/2-D,-a/2-D,r+2*D,a+2*D),t.addPath(h),e.clip(t,"evenodd")}g?e.stroke(h):e.stroke(),e.restore()}else g?e.stroke(h):e.stroke();if("double"===M){e.lineWidth=D/3;var n=e.globalCompositeOperation;e.globalCompositeOperation="destination-out",g?e.stroke(h):e.stroke(),e.globalCompositeOperation=n}e.setLineDash&&e.setLineDash([])}},te=function(){if(O>0){if(e.lineWidth=O,e.lineCap="butt",e.setLineDash)switch(V){case"dotted":e.setLineDash([1,1]);break;case"dashed":e.setLineDash([4,2]);break;case"solid":case"double":e.setLineDash([])}var n=d;g&&(n={x:0,y:0});var i=l.getNodeShape(t),o=D;"inside"===I&&(o=0),"outside"===I&&(o*=2);var s,u=(r+o+(O+j))/r,c=(a+o+(O+j))/a,h=r*u,p=a*c,f=l.nodeShapes[i].points;if(g)s=H(h,p,i,f).path;if("ellipse"===i)l.drawEllipsePath(s||e,n.x,n.y,h,p);else if(["round-diamond","round-heptagon","round-hexagon","round-octagon","round-pentagon","round-polygon","round-triangle","round-tag"].includes(i)){var v=0,y=0,m=0;"round-diamond"===i?v=1.4*(o+j+O):"round-heptagon"===i?(v=1.075*(o+j+O),m=-(o/2+j+O)/35):"round-hexagon"===i?v=1.12*(o+j+O):"round-pentagon"===i?(v=1.13*(o+j+O),m=-(o/2+j+O)/15):"round-tag"===i?(v=1.12*(o+j+O),y=.07*(o/2+O+j)):"round-triangle"===i&&(v=(o+j+O)*(Math.PI/2),m=-(o+j/2+O)/Math.PI),0!==v&&(h=r*(u=(r+v)/r),["round-hexagon","round-tag"].includes(i)||(p=a*(c=(a+v)/a)));for(var b=h/2,x=p/2,w=(q="auto"===q?pn(h,p):q)+(o+O+j)/2,E=new Array(f.length/2),k=new Array(f.length/2),C=0;C0){if(r=r||n.position(),null==a||null==i){var d=n.padding();a=n.width()+2*d,i=n.height()+2*d}this.colorFillStyle(t,l[0],l[1],l[2],s),this.nodeShapes[u].draw(t,r.x,r.y,a+2*o,i+2*o,c),t.fill()}}}};vc.drawNodeOverlay=yc("overlay"),vc.drawNodeUnderlay=yc("underlay"),vc.hasPie=function(e){return(e=e[0])._private.hasPie},vc.drawPie=function(e,t,n,r){t=t[0],r=r||t.position();var a=t.cy().style(),i=t.pstyle("pie-size"),o=r.x,s=r.y,l=t.width(),u=t.height(),c=Math.min(l,u)/2,d=0;this.usePaths()&&(o=0,s=0),"%"===i.units?c*=i.pfValue:void 0!==i.pfValue&&(c=i.pfValue/2);for(var h=1;h<=a.pieBackgroundN;h++){var p=t.pstyle("pie-"+h+"-background-size").value,f=t.pstyle("pie-"+h+"-background-color").value,g=t.pstyle("pie-"+h+"-background-opacity").value*n,v=p/100;v+d>1&&(v=1-d);var y=1.5*Math.PI+2*Math.PI*d,m=y+2*Math.PI*v;0===p||d>=1||d+v>1||(e.beginPath(),e.moveTo(o,s),e.arc(o,s,c,y,m),e.closePath(),this.colorFillStyle(e,f[0],f[1],f[2],g),e.fill(),d+=v)}};var mc={};mc.getPixelRatio=function(){var e=this.data.contexts[0];if(null!=this.forcedPixelRatio)return this.forcedPixelRatio;var t=this.cy.window(),n=e.backingStorePixelRatio||e.webkitBackingStorePixelRatio||e.mozBackingStorePixelRatio||e.msBackingStorePixelRatio||e.oBackingStorePixelRatio||e.backingStorePixelRatio||1;return(t.devicePixelRatio||1)/n},mc.paintCache=function(e){for(var t,n=this.paintCaches=this.paintCaches||[],r=!0,a=0;ao.minMbLowQualFrames&&(o.motionBlurPxRatio=o.mbPxRBlurry)),o.clearingMotionBlur&&(o.motionBlurPxRatio=1),o.textureDrawLastFrame&&!d&&(c[o.NODE]=!0,c[o.SELECT_BOX]=!0);var m=l.style(),b=l.zoom(),x=void 0!==a?a:b,w=l.pan(),E={x:w.x,y:w.y},k={zoom:b,pan:{x:w.x,y:w.y}},C=o.prevViewport;void 0===C||k.zoom!==C.zoom||k.pan.x!==C.pan.x||k.pan.y!==C.pan.y||g&&!f||(o.motionBlurPxRatio=1),i&&(E=i),x*=s,E.x*=s,E.y*=s;var S=o.getCachedZSortedEles();function P(e,t,n,r,a){var i=e.globalCompositeOperation;e.globalCompositeOperation="destination-out",o.colorFillStyle(e,255,255,255,o.motionBlurTransparency),e.fillRect(t,n,r,a),e.globalCompositeOperation=i}function D(e,r){var s,l,c,d;o.clearingMotionBlur||e!==u.bufferContexts[o.MOTIONBLUR_BUFFER_NODE]&&e!==u.bufferContexts[o.MOTIONBLUR_BUFFER_DRAG]?(s=E,l=x,c=o.canvasWidth,d=o.canvasHeight):(s={x:w.x*p,y:w.y*p},l=b*p,c=o.canvasWidth*p,d=o.canvasHeight*p),e.setTransform(1,0,0,1,0,0),"motionBlur"===r?P(e,0,0,c,d):t||void 0!==r&&!r||e.clearRect(0,0,c,d),n||(e.translate(s.x,s.y),e.scale(l,l)),i&&e.translate(i.x,i.y),a&&e.scale(a,a)}if(d||(o.textureDrawLastFrame=!1),d){if(o.textureDrawLastFrame=!0,!o.textureCache){o.textureCache={},o.textureCache.bb=l.mutableElements().boundingBox(),o.textureCache.texture=o.data.bufferCanvases[o.TEXTURE_BUFFER];var T=o.data.bufferContexts[o.TEXTURE_BUFFER];T.setTransform(1,0,0,1,0,0),T.clearRect(0,0,o.canvasWidth*o.textureMult,o.canvasHeight*o.textureMult),o.render({forcedContext:T,drawOnlyNodeLayer:!0,forcedPxRatio:s*o.textureMult}),(k=o.textureCache.viewport={zoom:l.zoom(),pan:l.pan(),width:o.canvasWidth,height:o.canvasHeight}).mpan={x:(0-k.pan.x)/k.zoom,y:(0-k.pan.y)/k.zoom}}c[o.DRAG]=!1,c[o.NODE]=!1;var _=u.contexts[o.NODE],M=o.textureCache.texture;k=o.textureCache.viewport;_.setTransform(1,0,0,1,0,0),h?P(_,0,0,k.width,k.height):_.clearRect(0,0,k.width,k.height);var B=m.core("outside-texture-bg-color").value,N=m.core("outside-texture-bg-opacity").value;o.colorFillStyle(_,B[0],B[1],B[2],N),_.fillRect(0,0,k.width,k.height);b=l.zoom();D(_,!1),_.clearRect(k.mpan.x,k.mpan.y,k.width/k.zoom/s,k.height/k.zoom/s),_.drawImage(M,k.mpan.x,k.mpan.y,k.width/k.zoom/s,k.height/k.zoom/s)}else o.textureOnViewport&&!t&&(o.textureCache=null);var I=l.extent(),z=o.pinching||o.hoverData.dragging||o.swipePanning||o.data.wheelZooming||o.hoverData.draggingEles||o.cy.animated(),A=o.hideEdgesOnViewport&&z,L=[];if(L[o.NODE]=!c[o.NODE]&&h&&!o.clearedForMotionBlur[o.NODE]||o.clearingMotionBlur,L[o.NODE]&&(o.clearedForMotionBlur[o.NODE]=!0),L[o.DRAG]=!c[o.DRAG]&&h&&!o.clearedForMotionBlur[o.DRAG]||o.clearingMotionBlur,L[o.DRAG]&&(o.clearedForMotionBlur[o.DRAG]=!0),c[o.NODE]||n||r||L[o.NODE]){var O=h&&!L[o.NODE]&&1!==p;D(_=t||(O?o.data.bufferContexts[o.MOTIONBLUR_BUFFER_NODE]:u.contexts[o.NODE]),h&&!O?"motionBlur":void 0),A?o.drawCachedNodes(_,S.nondrag,s,I):o.drawLayeredElements(_,S.nondrag,s,I),o.debug&&o.drawDebugPoints(_,S.nondrag),n||h||(c[o.NODE]=!1)}if(!r&&(c[o.DRAG]||n||L[o.DRAG])){O=h&&!L[o.DRAG]&&1!==p;D(_=t||(O?o.data.bufferContexts[o.MOTIONBLUR_BUFFER_DRAG]:u.contexts[o.DRAG]),h&&!O?"motionBlur":void 0),A?o.drawCachedNodes(_,S.drag,s,I):o.drawCachedElements(_,S.drag,s,I),o.debug&&o.drawDebugPoints(_,S.drag),n||h||(c[o.DRAG]=!1)}if(o.showFps||!r&&c[o.SELECT_BOX]&&!n){if(D(_=t||u.contexts[o.SELECT_BOX]),1==o.selection[4]&&(o.hoverData.selecting||o.touchData.selecting)){b=o.cy.zoom();var R=m.core("selection-box-border-width").value/b;_.lineWidth=R,_.fillStyle="rgba("+m.core("selection-box-color").value[0]+","+m.core("selection-box-color").value[1]+","+m.core("selection-box-color").value[2]+","+m.core("selection-box-opacity").value+")",_.fillRect(o.selection[0],o.selection[1],o.selection[2]-o.selection[0],o.selection[3]-o.selection[1]),R>0&&(_.strokeStyle="rgba("+m.core("selection-box-border-color").value[0]+","+m.core("selection-box-border-color").value[1]+","+m.core("selection-box-border-color").value[2]+","+m.core("selection-box-opacity").value+")",_.strokeRect(o.selection[0],o.selection[1],o.selection[2]-o.selection[0],o.selection[3]-o.selection[1]))}if(u.bgActivePosistion&&!o.hoverData.selecting){b=o.cy.zoom();var V=u.bgActivePosistion;_.fillStyle="rgba("+m.core("active-bg-color").value[0]+","+m.core("active-bg-color").value[1]+","+m.core("active-bg-color").value[2]+","+m.core("active-bg-opacity").value+")",_.beginPath(),_.arc(V.x,V.y,m.core("active-bg-size").pfValue/b,0,2*Math.PI),_.fill()}var F=o.lastRedrawTime;if(o.showFps&&F){F=Math.round(F);var j=Math.round(1e3/F);_.setTransform(1,0,0,1,0,0),_.fillStyle="rgba(255, 0, 0, 0.75)",_.strokeStyle="rgba(255, 0, 0, 0.75)",_.lineWidth=1,_.fillText("1 frame = "+F+" ms = "+j+" fps",0,20);_.strokeRect(0,30,250,20),_.fillRect(0,30,250*Math.min(j/60,1),20)}n||(c[o.SELECT_BOX]=!1)}if(h&&1!==p){var q=u.contexts[o.NODE],Y=o.data.bufferCanvases[o.MOTIONBLUR_BUFFER_NODE],X=u.contexts[o.DRAG],W=o.data.bufferCanvases[o.MOTIONBLUR_BUFFER_DRAG],H=function(e,t,n){e.setTransform(1,0,0,1,0,0),n||!y?e.clearRect(0,0,o.canvasWidth,o.canvasHeight):P(e,0,0,o.canvasWidth,o.canvasHeight);var r=p;e.drawImage(t,0,0,o.canvasWidth*r,o.canvasHeight*r,0,0,o.canvasWidth,o.canvasHeight)};(c[o.NODE]||L[o.NODE])&&(H(q,Y,L[o.NODE]),c[o.NODE]=!1),(c[o.DRAG]||L[o.DRAG])&&(H(X,W,L[o.DRAG]),c[o.DRAG]=!1)}o.prevViewport=k,o.clearingMotionBlur&&(o.clearingMotionBlur=!1,o.motionBlurCleared=!0,o.motionBlur=!0),h&&(o.motionBlurTimeout=setTimeout((function(){o.motionBlurTimeout=null,o.clearedForMotionBlur[o.NODE]=!1,o.clearedForMotionBlur[o.DRAG]=!1,o.motionBlur=!1,o.clearingMotionBlur=!d,o.mbFrames=0,c[o.NODE]=!0,c[o.DRAG]=!0,o.redraw()}),100)),t||l.emit("render")};for(var bc={drawPolygonPath:function(e,t,n,r,a,i){var o=r/2,s=a/2;e.beginPath&&e.beginPath(),e.moveTo(t+o*i[0],n+s*i[1]);for(var l=1;l0&&i>0){h.clearRect(0,0,a,i),h.globalCompositeOperation="source-over";var p=this.getCachedZSortedEles();if(e.full)h.translate(-n.x1*l,-n.y1*l),h.scale(l,l),this.drawElements(h,p),h.scale(1/l,1/l),h.translate(n.x1*l,n.y1*l);else{var f=t.pan(),g={x:f.x*l,y:f.y*l};l*=t.zoom(),h.translate(g.x,g.y),h.scale(l,l),this.drawElements(h,p),h.scale(1/l,1/l),h.translate(-g.x,-g.y)}e.bg&&(h.globalCompositeOperation="destination-over",h.fillStyle=e.bg,h.rect(0,0,a,i),h.fill())}return d},Pc.png=function(e){return Tc(e,this.bufferCanvasImage(e),"image/png")},Pc.jpg=function(e){return Tc(e,this.bufferCanvasImage(e),"image/jpeg")};var _c={nodeShapeImpl:function(e,t,n,r,a,i,o,s){switch(e){case"ellipse":return this.drawEllipsePath(t,n,r,a,i);case"polygon":return this.drawPolygonPath(t,n,r,a,i,o);case"round-polygon":return this.drawRoundPolygonPath(t,n,r,a,i,o,s);case"roundrectangle":case"round-rectangle":return this.drawRoundRectanglePath(t,n,r,a,i,s);case"cutrectangle":case"cut-rectangle":return this.drawCutRectanglePath(t,n,r,a,i,o,s);case"bottomroundrectangle":case"bottom-round-rectangle":return this.drawBottomRoundRectanglePath(t,n,r,a,i,s);case"barrel":return this.drawBarrelPath(t,n,r,a,i)}}},Mc=Nc,Bc=Nc.prototype;function Nc(e){var t=this,n=t.cy.window().document;t.data={canvases:new Array(Bc.CANVAS_LAYERS),contexts:new Array(Bc.CANVAS_LAYERS),canvasNeedsRedraw:new Array(Bc.CANVAS_LAYERS),bufferCanvases:new Array(Bc.BUFFER_COUNT),bufferContexts:new Array(Bc.CANVAS_LAYERS)};var r="-webkit-tap-highlight-color",a="rgba(0,0,0,0)";t.data.canvasContainer=n.createElement("div");var i=t.data.canvasContainer.style;t.data.canvasContainer.style[r]=a,i.position="relative",i.zIndex="0",i.overflow="hidden";var o=e.cy.container();o.appendChild(t.data.canvasContainer),o.style[r]=a;var s={"-webkit-user-select":"none","-moz-user-select":"-moz-none","user-select":"none","-webkit-tap-highlight-color":"rgba(0,0,0,0)","outline-style":"none"};p&&p.userAgent.match(/msie|trident|edge/i)&&(s["-ms-touch-action"]="none",s["touch-action"]="none");for(var l=0;l{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>i,toc:()=>l});const i=JSON.parse('{"id":"components/policies","title":"Policies","description":"Kata runtime policies are an integral part of the Confidential Containers preview on AKS.","source":"@site/versioned_docs/version-1.2/components/policies.md","sourceDirName":"components","slug":"/components/policies","permalink":"/contrast/pr-preview/pr-1071/components/policies","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-1.2/components/policies.md","tags":[],"version":"1.2","frontMatter":{},"sidebar":"docs","previous":{"title":"Runtime","permalink":"/contrast/pr-preview/pr-1071/components/runtime"},"next":{"title":"Service mesh","permalink":"/contrast/pr-preview/pr-1071/components/service-mesh"}}');var s=n(74848),r=n(28453);const o={},a="Policies",c={},l=[{value:"Structure",id:"structure",level:2},{value:"Generation",id:"generation",level:2},{value:"Evaluation",id:"evaluation",level:2},{value:"Guarantees",id:"guarantees",level:2},{value:"Trust",id:"trust",level:2},{value:"Platform Differences",id:"platform-differences",level:2}];function d(e){const t={a:"a",code:"code",em:"em",h1:"h1",h2:"h2",header:"header",li:"li",ol:"ol",p:"p",ul:"ul",...(0,r.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.header,{children:(0,s.jsx)(t.h1,{id:"policies",children:"Policies"})}),"\n",(0,s.jsx)(t.p,{children:"Kata runtime policies are an integral part of the Confidential Containers preview on AKS.\nThey prescribe how a Kubernetes pod must be configured to launch successfully in a confidential VM.\nIn Contrast, policies act as a workload identifier: only pods with a policy registered in the manifest receive workload certificates and may participate in the confidential deployment.\nVerification of the Contrast Coordinator and its manifest transitively guarantees that all workloads meet the owner's expectations."}),"\n",(0,s.jsx)(t.h2,{id:"structure",children:"Structure"}),"\n",(0,s.jsxs)(t.p,{children:["The Kata agent running in the confidential micro-VM exposes an RPC service ",(0,s.jsx)(t.a,{href:"https://github.com/kata-containers/kata-containers/blob/e5e0983/src/libs/protocols/protos/agent.proto#L21-L76",children:(0,s.jsx)(t.code,{children:"AgentService"})})," to the Kata runtime.\nThis service handles potentially untrustworthy requests from outside the TCB, which need to be checked against a policy."]}),"\n",(0,s.jsxs)(t.p,{children:["Kata runtime policies are written in the policy language ",(0,s.jsx)(t.a,{href:"https://www.openpolicyagent.org/docs/latest/policy-language/",children:"Rego"}),".\nThey specify what ",(0,s.jsx)(t.code,{children:"AgentService"})," methods can be called, and the permissible parameters for each call."]}),"\n",(0,s.jsxs)(t.p,{children:["Policies consist of two parts: a list of rules and a data section.\nWhile the list of rules is static, the data section is populated with information from the ",(0,s.jsx)(t.code,{children:"PodSpec"})," and other sources."]}),"\n",(0,s.jsx)(t.h2,{id:"generation",children:"Generation"}),"\n",(0,s.jsxs)(t.p,{children:["Runtime policies are programmatically generated from Kubernetes manifests by the Contrast CLI.\nThe ",(0,s.jsx)(t.code,{children:"generate"})," subcommand inspects pod definitions and derives rules for validating the pod at the Kata agent.\nThere are two important integrity checks: container image checksums and OCI runtime parameters."]}),"\n",(0,s.jsxs)(t.p,{children:["For each of the container images used in a pod, the CLI downloads all image layers and produces a cryptographic ",(0,s.jsx)(t.a,{href:"https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/verity.html",children:"dm-verity"})," checksum.\nThese checksums are the basis for the policy's ",(0,s.jsx)(t.em,{children:"storage data"}),"."]}),"\n",(0,s.jsxs)(t.p,{children:["The CLI combines information from the ",(0,s.jsx)(t.code,{children:"PodSpec"}),", ",(0,s.jsx)(t.code,{children:"ConfigMaps"}),", and ",(0,s.jsx)(t.code,{children:"Secrets"})," in the provided Kubernetes manifests to derive a permissible set of command-line arguments and environment variables.\nThese constitute the policy's ",(0,s.jsx)(t.em,{children:"OCI data"}),"."]}),"\n",(0,s.jsx)(t.h2,{id:"evaluation",children:"Evaluation"}),"\n",(0,s.jsxs)(t.p,{children:["The generated policy document is annotated to the pod definitions in Base64 encoding.\nThis annotation is propagated to the Kata runtime, which calculates the SHA256 checksum for the policy and uses that as SNP ",(0,s.jsx)(t.code,{children:"HOSTDATA"})," or TDX ",(0,s.jsx)(t.code,{children:"MRCONFIGID"})," for the confidential micro-VM."]}),"\n",(0,s.jsxs)(t.p,{children:["After the VM launched, the runtime calls the agent's ",(0,s.jsx)(t.code,{children:"SetPolicy"})," method with the full policy document.\nIf the policy doesn't match the checksum in ",(0,s.jsx)(t.code,{children:"HOSTDATA"})," or ",(0,s.jsx)(t.code,{children:"MRCONFIGID"}),", the agent rejects the policy.\nOtherwise, it applies the policy to all future ",(0,s.jsx)(t.code,{children:"AgentService"})," requests."]}),"\n",(0,s.jsx)(t.h2,{id:"guarantees",children:"Guarantees"}),"\n",(0,s.jsx)(t.p,{children:"The policy evaluation provides the following guarantees for pods launched with the correct generated policy:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"Command and its arguments are set as specified in the resources."}),"\n",(0,s.jsx)(t.li,{children:"There are no unexpected additional environment variables."}),"\n",(0,s.jsx)(t.li,{children:"The container image layers correspond to the layers observed at policy generation time.\nThus, only the expected workload image can be instantiated."}),"\n",(0,s.jsx)(t.li,{children:"Executing additional processes in a container is prohibited."}),"\n",(0,s.jsx)(t.li,{children:"Sending data to a container's standard input is prohibited."}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:"The current implementation of policy checking has some blind spots:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"Containers can be started in any order, or be omitted entirely."}),"\n",(0,s.jsx)(t.li,{children:"Environment variables may be missing."}),"\n",(0,s.jsxs)(t.li,{children:["Volumes other than the container root volume don't have integrity checks (particularly relevant for mounted ",(0,s.jsx)(t.code,{children:"ConfigMaps"})," and ",(0,s.jsx)(t.code,{children:"Secrets"}),")."]}),"\n"]}),"\n",(0,s.jsx)(t.h2,{id:"trust",children:"Trust"}),"\n",(0,s.jsx)(t.p,{children:"Contrast verifies its confidential containers following these steps:"}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsx)(t.li,{children:"The Contrast CLI generates a policy and attaches it to the pod definition."}),"\n",(0,s.jsx)(t.li,{children:"Kubernetes schedules the pod on a node with the confidential computing runtime."}),"\n",(0,s.jsx)(t.li,{children:"Containerd invokes the Kata runtime to create the pod sandbox."}),"\n",(0,s.jsxs)(t.li,{children:["The Kata runtime starts a CVM with the policy's digest as ",(0,s.jsx)(t.code,{children:"HOSTDATA"}),"/",(0,s.jsx)(t.code,{children:"MRCONFIGID"}),"."]}),"\n",(0,s.jsxs)(t.li,{children:["The Kata runtime sets the policy using the ",(0,s.jsx)(t.code,{children:"SetPolicy"})," method."]}),"\n",(0,s.jsxs)(t.li,{children:["The Kata agent verifies that the incoming policy's digest matches ",(0,s.jsx)(t.code,{children:"HOSTDATA"}),"/",(0,s.jsx)(t.code,{children:"MRCONFIGID"}),"."]}),"\n",(0,s.jsx)(t.li,{children:"The CLI sets a manifest in the Contrast Coordinator, including a list of permitted policies."}),"\n",(0,s.jsx)(t.li,{children:"The Contrast Initializer sends an attestation report to the Contrast Coordinator, asking for a mesh certificate."}),"\n",(0,s.jsxs)(t.li,{children:["The Contrast Coordinator verifies that the started pod has a permitted policy hash in its ",(0,s.jsx)(t.code,{children:"HOSTDATA"}),"/",(0,s.jsx)(t.code,{children:"MRCONFIGID"})," field."]}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:"After the last step, we know that the policy hasn't been tampered with and, thus, that the workload matches expectations and may receive mesh certificates."}),"\n",(0,s.jsx)(t.h2,{id:"platform-differences",children:"Platform Differences"}),"\n",(0,s.jsx)(t.p,{children:"Contrast uses different rules and data sections for different platforms.\nThis results in different policy hashes for different platforms."}),"\n",(0,s.jsxs)(t.p,{children:["The ",(0,s.jsx)(t.code,{children:"generate"})," command automatically derives the correct set of rules and data sections from the ",(0,s.jsx)(t.code,{children:"reference-values"})," flag."]}),"\n",(0,s.jsxs)(t.p,{children:["The ",(0,s.jsx)(t.code,{children:"verify"}),", ",(0,s.jsx)(t.code,{children:"set"}),", and ",(0,s.jsx)(t.code,{children:"recover"})," commands need to know the coordinator's expected policy hash to verify its identity.\nBy default these commands assume that the coordinator is using the policy for the ",(0,s.jsx)(t.code,{children:"AKS-CLH-SNP"})," platform.\nIf the coordinator is running on a different platform, the correct policy hash can be looked up in the ",(0,s.jsx)(t.code,{children:"coordinator-policy.hash"})," file bundled with the ",(0,s.jsx)(t.a,{href:"https://github.com/edgelesssys/contrast/releases",children:"Contrast release"}),".\nThe coordinator policy hash can be overwritten using the ",(0,s.jsx)(t.code,{children:"--coordinator-policy-hash"})," flag."]})]})}function h(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>o,x:()=>a});var i=n(96540);const s={},r=i.createContext(s);function o(e){const t=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),i.createElement(r.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/173fd1a8.3f03ca9c.js b/pr-preview/pr-1071/assets/js/173fd1a8.3f03ca9c.js
deleted file mode 100644
index 1f499d8135..0000000000
--- a/pr-preview/pr-1071/assets/js/173fd1a8.3f03ca9c.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[1514],{71144:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>u,frontMatter:()=>o,metadata:()=>s,toc:()=>l});const s=JSON.parse('{"id":"basics/features","title":"Product features","description":"Contrast simplifies the deployment and management of Confidential Containers, offering optimal data security for your workloads while integrating seamlessly with your existing Kubernetes environment.","source":"@site/versioned_docs/version-0.7/basics/features.md","sourceDirName":"basics","slug":"/basics/features","permalink":"/contrast/pr-preview/pr-1071/0.7/basics/features","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.7/basics/features.md","tags":[],"version":"0.7","frontMatter":{},"sidebar":"docs","previous":{"title":"Security benefits","permalink":"/contrast/pr-preview/pr-1071/0.7/basics/security-benefits"},"next":{"title":"Getting started","permalink":"/contrast/pr-preview/pr-1071/0.7/getting-started/"}}');var r=n(74848),i=n(28453);const o={},a="Product features",c={},l=[];function d(e){const t={a:"a",h1:"h1",header:"header",li:"li",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.header,{children:(0,r.jsx)(t.h1,{id:"product-features",children:"Product features"})}),"\n",(0,r.jsx)(t.p,{children:"Contrast simplifies the deployment and management of Confidential Containers, offering optimal data security for your workloads while integrating seamlessly with your existing Kubernetes environment."}),"\n",(0,r.jsxs)(t.p,{children:["From a security perspective, Contrast employs the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.7/basics/confidential-containers",children:"Confidential Containers"})," concept and provides ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.7/basics/security-benefits",children:"security benefits"})," that go beyond individual containers, shielding your entire deployment from the underlying infrastructure."]}),"\n",(0,r.jsx)(t.p,{children:"From an operational perspective, Contrast provides the following key features:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Managed Kubernetes compatibility"}),": Initially compatible with Azure Kubernetes Service (AKS), Contrast is designed to support additional platforms such as AWS EKS and Google Cloud GKE as they begin to accommodate confidential containers."]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Lightweight installation"}),": Contrast can be integrated as a ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.7/deployment",children:"day-2 operation"})," within existing clusters, adding minimal ",(0,r.jsx)(t.a,{href:"../architecture",children:"components"})," to your setup. This facilitates straightforward deployments using your existing YAML configurations, Helm charts, or Kustomization, enabling native Kubernetes orchestration of your applications."]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Remote attestation"}),": Contrast generates a concise attestation statement that verifies the identity, authenticity, and integrity of your deployment both internally and to external parties. This architecture ensures that updates or scaling of the application don't compromise the attestation\u2019s validity."]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Service mesh"}),": Contrast securely manages a Public Key Infrastructure (PKI) for your deployments, issues workload-specific certificates, and establishes transparent mutual TLS (mTLS) connections across pods. This is done by harnessing the ",(0,r.jsx)(t.a,{href:"https://www.envoyproxy.io/",children:"envoy proxy"})," to ensure secure communications within your Kubernetes cluster."]}),"\n"]}),"\n"]})]})}function u(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>o,x:()=>a});var s=n(96540);const r={},i=s.createContext(r);function o(e){const t=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),s.createElement(i.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/17896441.642e26c0.js b/pr-preview/pr-1071/assets/js/17896441.642e26c0.js
deleted file mode 100644
index efaa52a851..0000000000
--- a/pr-preview/pr-1071/assets/js/17896441.642e26c0.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[8401],{51807:(s,c,t)=>{t.d(c,{A:()=>o});var a=t(13404),e=t(49489),n=t(7227);const o={...a.A,Tabs:e.A,TabItem:n.A}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/1825.260fa3c3.js b/pr-preview/pr-1071/assets/js/1825.260fa3c3.js
deleted file mode 100644
index 050f1434c0..0000000000
--- a/pr-preview/pr-1071/assets/js/1825.260fa3c3.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[1825],{63933:(e,t,a)=>{function i(e,t){e.accDescr&&t.setAccDescription?.(e.accDescr),e.accTitle&&t.setAccTitle?.(e.accTitle),e.title&&t.setDiagramTitle?.(e.title)}a.d(t,{S:()=>i}),(0,a(10009).K2)(i,"populateCommonDb")},61825:(e,t,a)=>{a.d(t,{diagram:()=>b});var i=a(63933),n=a(8159),r=a(77286),l=a(10009),s=a(78731),o=a(20007),c=l.UI.pie,p={sections:new Map,showData:!1,config:c},d=p.sections,g=p.showData,u=structuredClone(c),h=(0,l.K2)((()=>structuredClone(u)),"getConfig"),m=(0,l.K2)((()=>{d=new Map,g=p.showData,(0,l.IU)()}),"clear"),f=(0,l.K2)((({label:e,value:t})=>{d.has(e)||(d.set(e,t),l.Rm.debug(`added new section: ${e}, with value: ${t}`))}),"addSection"),S=(0,l.K2)((()=>d),"getSections"),x=(0,l.K2)((e=>{g=e}),"setShowData"),w=(0,l.K2)((()=>g),"getShowData"),D={getConfig:h,clear:m,setDiagramTitle:l.ke,getDiagramTitle:l.ab,setAccTitle:l.SV,getAccTitle:l.iN,setAccDescription:l.EI,getAccDescription:l.m7,addSection:f,getSections:S,setShowData:x,getShowData:w},T=(0,l.K2)(((e,t)=>{(0,i.S)(e,t),t.setShowData(e.showData),e.sections.map(t.addSection)}),"populateDb"),$={parse:(0,l.K2)((async e=>{const t=await(0,s.qg)("pie",e);l.Rm.debug(t),T(t,D)}),"parse")},y=(0,l.K2)((e=>`\n .pieCircle{\n stroke: ${e.pieStrokeColor};\n stroke-width : ${e.pieStrokeWidth};\n opacity : ${e.pieOpacity};\n }\n .pieOuterCircle{\n stroke: ${e.pieOuterStrokeColor};\n stroke-width: ${e.pieOuterStrokeWidth};\n fill: none;\n }\n .pieTitleText {\n text-anchor: middle;\n font-size: ${e.pieTitleTextSize};\n fill: ${e.pieTitleTextColor};\n font-family: ${e.fontFamily};\n }\n .slice {\n font-family: ${e.fontFamily};\n fill: ${e.pieSectionTextColor};\n font-size:${e.pieSectionTextSize};\n // fill: white;\n }\n .legend text {\n fill: ${e.pieLegendTextColor};\n font-family: ${e.fontFamily};\n font-size: ${e.pieLegendTextSize};\n }\n`),"getStyles"),C=(0,l.K2)((e=>{const t=[...e.entries()].map((e=>({label:e[0],value:e[1]}))).sort(((e,t)=>t.value-e.value));return(0,o.rLf)().value((e=>e.value))(t)}),"createPieArcs"),b={parser:$,db:D,renderer:{draw:(0,l.K2)(((e,t,a,i)=>{l.Rm.debug("rendering pie chart\n"+e);const s=i.db,c=(0,l.D7)(),p=(0,n.$t)(s.getConfig(),c.pie),d=18,g=450,u=g,h=(0,r.D)(t),m=h.append("g");m.attr("transform","translate(225,225)");const{themeVariables:f}=c;let[S]=(0,n.I5)(f.pieOuterStrokeWidth);S??=2;const x=p.textPosition,w=Math.min(u,g)/2-40,D=(0,o.JLW)().innerRadius(0).outerRadius(w),T=(0,o.JLW)().innerRadius(w*x).outerRadius(w*x);m.append("circle").attr("cx",0).attr("cy",0).attr("r",w+S/2).attr("class","pieOuterCircle");const $=s.getSections(),y=C($),b=[f.pie1,f.pie2,f.pie3,f.pie4,f.pie5,f.pie6,f.pie7,f.pie8,f.pie9,f.pie10,f.pie11,f.pie12],k=(0,o.UMr)(b);m.selectAll("mySlices").data(y).enter().append("path").attr("d",D).attr("fill",(e=>k(e.data.label))).attr("class","pieCircle");let K=0;$.forEach((e=>{K+=e})),m.selectAll("mySlices").data(y).enter().append("text").text((e=>(e.data.value/K*100).toFixed(0)+"%")).attr("transform",(e=>"translate("+T.centroid(e)+")")).style("text-anchor","middle").attr("class","slice"),m.append("text").text(s.getDiagramTitle()).attr("x",0).attr("y",-200).attr("class","pieTitleText");const v=m.selectAll(".legend").data(k.domain()).enter().append("g").attr("class","legend").attr("transform",((e,t)=>"translate(216,"+(22*t-22*k.domain().length/2)+")"));v.append("rect").attr("width",d).attr("height",d).style("fill",k).style("stroke",k),v.data(y).append("text").attr("x",22).attr("y",14).text((e=>{const{label:t,value:a}=e.data;return s.getShowData()?`${t} [${a}]`:t}));const A=512+Math.max(...v.selectAll("text").nodes().map((e=>e?.getBoundingClientRect().width??0)));h.attr("viewBox",`0 0 ${A} 450`),(0,l.a$)(h,g,A,p.useMaxWidth)}),"draw")},styles:y}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/197c7105.a9227bd1.js b/pr-preview/pr-1071/assets/js/197c7105.a9227bd1.js
deleted file mode 100644
index 93b69e2282..0000000000
--- a/pr-preview/pr-1071/assets/js/197c7105.a9227bd1.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[7742],{82557:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>i,metadata:()=>s,toc:()=>c});const s=JSON.parse('{"id":"deployment","title":"Workload deployment","description":"The following instructions will guide you through the process of making an existing Kubernetes deployment","source":"@site/versioned_docs/version-1.2/deployment.md","sourceDirName":".","slug":"/deployment","permalink":"/contrast/pr-preview/pr-1071/deployment","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-1.2/deployment.md","tags":[],"version":"1.2","frontMatter":{},"sidebar":"docs","previous":{"title":"Encrypted volume mount","permalink":"/contrast/pr-preview/pr-1071/examples/mysql"},"next":{"title":"Troubleshooting","permalink":"/contrast/pr-preview/pr-1071/troubleshooting"}}');var r=t(74848),a=t(28453);const i={},o="Workload deployment",l={},c=[{value:"Deploy the Contrast runtime",id:"deploy-the-contrast-runtime",level:2},{value:"Deploy the Contrast Coordinator",id:"deploy-the-contrast-coordinator",level:2},{value:"Prepare your Kubernetes resources",id:"prepare-your-kubernetes-resources",level:2},{value:"Security review",id:"security-review",level:3},{value:"RuntimeClass",id:"runtimeclass",level:3},{value:"Handling TLS",id:"handling-tls",level:3},{value:"Generate policy annotations and manifest",id:"generate-policy-annotations-and-manifest",level:2},{value:"Apply the resources",id:"apply-the-resources",level:2},{value:"Connect to the Contrast Coordinator",id:"connect-to-the-contrast-coordinator",level:2},{value:"Set the manifest",id:"set-the-manifest",level:2},{value:"Verify the Coordinator",id:"verify-the-coordinator",level:2},{value:"Communicate with workloads",id:"communicate-with-workloads",level:2},{value:"Recover the Coordinator",id:"recover-the-coordinator",level:2}];function d(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",p:"p",pre:"pre",ul:"ul",...(0,a.R)(),...e.components},{TabItem:t,Tabs:s}=n;return t||u("TabItem",!0),s||u("Tabs",!0),(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.header,{children:(0,r.jsx)(n.h1,{id:"workload-deployment",children:"Workload deployment"})}),"\n",(0,r.jsx)(n.p,{children:"The following instructions will guide you through the process of making an existing Kubernetes deployment\nconfidential and deploying it together with Contrast."}),"\n",(0,r.jsxs)(s,{queryString:"platform",children:[(0,r.jsx)(t,{value:"aks-clh-snp",label:"AKS",default:!0,children:(0,r.jsxs)(n.p,{children:["A running CoCo-enabled cluster is required for these steps, see the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/getting-started/cluster-setup",children:"setup guide"})," on how to set up a cluster on AKS."]})}),(0,r.jsx)(t,{value:"k3s-qemu-snp",label:"Bare metal (SEV-SNP)",children:(0,r.jsxs)(n.p,{children:["A running CoCo-enabled cluster is required for these steps, see the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/getting-started/bare-metal",children:"setup guide"})," on how to set up a bare-metal cluster."]})}),(0,r.jsx)(t,{value:"k3s-qemu-tdx",label:"Bare metal (TDX)",children:(0,r.jsxs)(n.p,{children:["A running CoCo-enabled cluster is required for these steps, see the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/getting-started/bare-metal",children:"setup guide"})," on how to set up a bare-metal cluster."]})})]}),"\n",(0,r.jsx)(n.h2,{id:"deploy-the-contrast-runtime",children:"Deploy the Contrast runtime"}),"\n",(0,r.jsxs)(n.p,{children:["Contrast depends on a ",(0,r.jsxs)(n.a,{href:"/contrast/pr-preview/pr-1071/components/runtime",children:["custom Kubernetes ",(0,r.jsx)(n.code,{children:"RuntimeClass"})," (",(0,r.jsx)(n.code,{children:"contrast-cc"}),")"]}),",\nwhich needs to be installed in the cluster prior to the Coordinator or any confidential workloads.\nThis consists of a ",(0,r.jsx)(n.code,{children:"RuntimeClass"})," resource and a ",(0,r.jsx)(n.code,{children:"DaemonSet"})," that performs installation on worker nodes.\nThis step is only required once for each version of the runtime.\nIt can be shared between Contrast deployments."]}),"\n",(0,r.jsxs)(s,{queryString:"platform",children:[(0,r.jsx)(t,{value:"aks-clh-snp",label:"AKS",default:!0,children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/runtime-aks-clh-snp.yml\n"})})}),(0,r.jsx)(t,{value:"k3s-qemu-snp",label:"Bare metal (SEV-SNP)",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/runtime-k3s-qemu-snp.yml\n"})})}),(0,r.jsx)(t,{value:"k3s-qemu-tdx",label:"Bare metal (TDX)",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/runtime-k3s-qemu-tdx.yml\n"})})})]}),"\n",(0,r.jsx)(n.h2,{id:"deploy-the-contrast-coordinator",children:"Deploy the Contrast Coordinator"}),"\n",(0,r.jsx)(n.p,{children:"Install the latest Contrast Coordinator release, comprising a single replica deployment and a\nLoadBalancer service, into your cluster."}),"\n",(0,r.jsxs)(s,{queryString:"platform",children:[(0,r.jsx)(t,{value:"aks-clh-snp",label:"AKS",default:!0,children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/coordinator-aks-clh-snp.yml\n"})})}),(0,r.jsx)(t,{value:"k3s-qemu-snp",label:"Bare metal (SEV-SNP)",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/coordinator-k3s-qemu-snp.yml\n"})})}),(0,r.jsx)(t,{value:"k3s-qemu-tdx",label:"Bare metal (TDX)",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/coordinator-k3s-qemu-tdx.yml\n"})})})]}),"\n",(0,r.jsx)(n.h2,{id:"prepare-your-kubernetes-resources",children:"Prepare your Kubernetes resources"}),"\n",(0,r.jsx)(n.p,{children:"Your Kubernetes resources need some modifications to run as Confidential Containers.\nThis section guides you through the process and outlines the necessary changes."}),"\n",(0,r.jsx)(n.h3,{id:"security-review",children:"Security review"}),"\n",(0,r.jsxs)(n.p,{children:["Contrast ensures integrity and confidentiality of the applications, but interactions with untrusted systems require the developers' attention.\nReview the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/architecture/security-considerations",children:"security considerations"})," and the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/architecture/certificates",children:"certificates"})," section for writing secure Contrast application."]}),"\n",(0,r.jsx)(n.h3,{id:"runtimeclass",children:"RuntimeClass"}),"\n",(0,r.jsx)(n.p,{children:"Contrast will add annotations to your Kubernetes YAML files. If you want to keep the original files\nunchanged, you can copy the files into a separate local directory.\nYou can also generate files from a Helm chart or from a Kustomization."}),"\n",(0,r.jsxs)(s,{groupId:"yaml-source",children:[(0,r.jsx)(t,{value:"kustomize",label:"kustomize",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"mkdir resources\nkustomize build $MY_RESOURCE_DIR > resources/all.yml\n"})})}),(0,r.jsx)(t,{value:"helm",label:"helm",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"mkdir resources\nhelm template $RELEASE_NAME $CHART_NAME > resources/all.yml\n"})})}),(0,r.jsx)(t,{value:"copy",label:"copy",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"cp -R $MY_RESOURCE_DIR resources/\n"})})})]}),"\n",(0,r.jsxs)(n.p,{children:["To specify that a workload (pod, deployment, etc.) should be deployed as confidential containers,\nadd ",(0,r.jsx)(n.code,{children:"runtimeClassName: contrast-cc"})," to the pod spec (pod definition or template).\nThis is a placeholder name that will be replaced by a versioned ",(0,r.jsx)(n.code,{children:"runtimeClassName"})," when generating policies."]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-yaml",children:"spec: # v1.PodSpec\n runtimeClassName: contrast-cc\n"})}),"\n",(0,r.jsx)(n.h3,{id:"handling-tls",children:"Handling TLS"}),"\n",(0,r.jsxs)(n.p,{children:["In the initialization process, the ",(0,r.jsx)(n.code,{children:"contrast-secrets"})," shared volume is populated with X.509 certificates for your workload.\nThese certificates are used by the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/components/service-mesh",children:"Contrast Service Mesh"}),", but can also be used by your application directly.\nThe following tab group explains the setup for both scenarios."]}),"\n",(0,r.jsxs)(s,{groupId:"tls",children:[(0,r.jsxs)(t,{value:"mesh",label:"Drop-in service mesh",children:[(0,r.jsx)(n.p,{children:"Contrast can be configured to handle TLS in a sidecar container.\nThis is useful for workloads that are hard to configure with custom certificates, like Java applications."}),(0,r.jsx)(n.p,{children:"Configuration of the sidecar depends heavily on the application.\nThe following example is for an application with these properties:"}),(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"The container has a main application at TCP port 8001, which should be TLS-wrapped and doesn't require client authentication."}),"\n",(0,r.jsx)(n.li,{children:"The container has a metrics endpoint at TCP port 8080, which should be accessible in plain text."}),"\n",(0,r.jsx)(n.li,{children:"All other endpoints require client authentication."}),"\n",(0,r.jsxs)(n.li,{children:["The app connects to a Kubernetes service ",(0,r.jsx)(n.code,{children:"backend.default:4001"}),", which requires client authentication."]}),"\n"]}),(0,r.jsx)(n.p,{children:"Add the following annotations to your workload:"}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-yaml",children:'metadata: # apps/v1.Deployment, apps/v1.DaemonSet, ...\n annotations:\n contrast.edgeless.systems/servicemesh-ingress: "main#8001#false##metrics#8080#true"\n contrast.edgeless.systems/servicemesh-egress: "backend#127.0.0.2:4001#backend.default:4001"\n'})}),(0,r.jsxs)(n.p,{children:["During the ",(0,r.jsx)(n.code,{children:"generate"})," step, this configuration will be translated into a Service Mesh sidecar container which handles TLS connections automatically.\nThe only change required to the app itself is to let it connect to ",(0,r.jsx)(n.code,{children:"127.0.0.2:4001"})," to reach the backend service.\nYou can find more detailed documentation in the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/components/service-mesh",children:"Service Mesh chapter"}),"."]})]}),(0,r.jsxs)(t,{value:"go",label:"Go integration",children:[(0,r.jsxs)(n.p,{children:["The mesh certificate contained in ",(0,r.jsx)(n.code,{children:"certChain.pem"})," authenticates this workload, while the mesh CA certificate ",(0,r.jsx)(n.code,{children:"mesh-ca.pem"})," authenticates its peers.\nYour app should turn on client authentication to ensure peers are running as confidential containers, too.\nSee the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/architecture/certificates",children:"Certificate Authority"})," section for detailed information about these certificates."]}),(0,r.jsx)(n.p,{children:"The following example shows how to configure a Golang app, with error handling omitted for clarity."}),(0,r.jsxs)(s,{groupId:"golang-tls-setup",children:[(0,r.jsx)(t,{value:"client",label:"Client",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-go",children:'caCerts := x509.NewCertPool()\ncaCert, _ := os.ReadFile("/contrast/tls-config/mesh-ca.pem")\ncaCerts.AppendCertsFromPEM(caCert)\ncert, _ := tls.LoadX509KeyPair("/contrast/tls-config/certChain.pem", "/contrast/tls-config/key.pem")\ncfg := &tls.Config{\n Certificates: []tls.Certificate{cert},\n RootCAs: caCerts,\n}\n'})})}),(0,r.jsx)(t,{value:"server",label:"Server",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-go",children:'caCerts := x509.NewCertPool()\ncaCert, _ := os.ReadFile("/contrast/tls-config/mesh-ca.pem")\ncaCerts.AppendCertsFromPEM(caCert)\ncert, _ := tls.LoadX509KeyPair("/contrast/tls-config/certChain.pem", "/contrast/tls-config/key.pem")\ncfg := &tls.Config{\n Certificates: []tls.Certificate{cert},\n ClientAuth: tls.RequireAndVerifyClientCert,\n ClientCAs: caCerts,\n}\n'})})})]})]})]}),"\n",(0,r.jsx)(n.h2,{id:"generate-policy-annotations-and-manifest",children:"Generate policy annotations and manifest"}),"\n",(0,r.jsxs)(n.p,{children:["Run the ",(0,r.jsx)(n.code,{children:"generate"})," command to add the necessary components to your deployment files.\nThis will add the Contrast Initializer to every workload with the specified ",(0,r.jsx)(n.code,{children:"contrast-cc"})," runtime class\nand the Contrast Service Mesh to all workloads that have a specified configuration.\nAfter that, it will generate the execution policies and add them as annotations to your deployment files.\nA ",(0,r.jsx)(n.code,{children:"manifest.json"})," with the reference values of your deployment will be created."]}),"\n",(0,r.jsxs)(s,{queryString:"platform",children:[(0,r.jsx)(t,{value:"aks-clh-snp",label:"AKS",default:!0,children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"contrast generate --reference-values aks-clh-snp resources/\n"})})}),(0,r.jsxs)(t,{value:"k3s-qemu-snp",label:"Bare metal (SEV-SNP)",children:[(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"contrast generate --reference-values k3s-qemu-snp resources/\n"})}),(0,r.jsx)(n.admonition,{title:"Missing TCB values",type:"note",children:(0,r.jsxs)(n.p,{children:["On bare-metal SEV-SNP, ",(0,r.jsx)(n.code,{children:"contrast generate"})," is unable to fill in the ",(0,r.jsx)(n.code,{children:"MinimumTCB"})," values as they can vary between platforms.\nThey will have to be filled in manually.\nIf you don't know the correct values use ",(0,r.jsx)(n.code,{children:'{"BootloaderVersion":255,"TEEVersion":255,"SNPVersion":255,"MicrocodeVersion":255}'})," and observe the real values in the error messages in the following steps. This should only be done in a secure environment. Note that the values will differ between CPU models."]})})]}),(0,r.jsxs)(t,{value:"k3s-qemu-tdx",label:"Bare metal (TDX)",children:[(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"contrast generate --reference-values k3s-qemu-tdx resources/\n"})}),(0,r.jsx)(n.admonition,{title:"Missing TCB values",type:"note",children:(0,r.jsxs)(n.p,{children:["On bare-metal TDX, ",(0,r.jsx)(n.code,{children:"contrast generate"})," is unable to fill in the ",(0,r.jsx)(n.code,{children:"MinimumTeeTcbSvn"})," and ",(0,r.jsx)(n.code,{children:"MrSeam"})," TCB values as they can vary between platforms.\nThey will have to be filled in manually.\nIf you don't know the correct values use ",(0,r.jsx)(n.code,{children:"ffffffffffffffffffffffffffffffff"})," and ",(0,r.jsx)(n.code,{children:"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"})," respectively and observe the real values in the error messages in the following steps. This should only be done in a secure environment."]})})]})]}),"\n",(0,r.jsx)(n.admonition,{type:"warning",children:(0,r.jsxs)(n.p,{children:["Please be aware that runtime policies currently have some blind spots. For example, they can't guarantee the starting order of containers. See the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/features-limitations#runtime-policies",children:"current limitations"})," for more details."]})}),"\n",(0,r.jsx)(n.p,{children:"If you don't want the Contrast Initializer to automatically be added to your\nworkloads, there are two ways you can skip the Initializer injection step,\ndepending on how you want to customize your deployment."}),"\n",(0,r.jsxs)(s,{groupId:"injection",children:[(0,r.jsxs)(t,{value:"flag",label:"Command-line flag",children:[(0,r.jsxs)(n.p,{children:["You can disable the Initializer injection completely by specifying the\n",(0,r.jsx)(n.code,{children:"--skip-initializer"})," flag in the ",(0,r.jsx)(n.code,{children:"generate"})," command."]}),(0,r.jsxs)(s,{queryString:"platform",children:[(0,r.jsx)(t,{value:"aks-clh-snp",label:"AKS",default:!0,children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"contrast generate --reference-values aks-clh-snp --skip-initializer resources/\n"})})}),(0,r.jsx)(t,{value:"k3s-qemu-snp",label:"Bare metal (SEV-SNP)",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"contrast generate --reference-values k3s-qemu-snp --skip-initializer resources/\n"})})}),(0,r.jsx)(t,{value:"k3s-qemu-tdx",label:"Bare metal (TDX)",children:(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"contrast generate --reference-values k3s-qemu-tdx --skip-initializer resources/\n"})})})]})]}),(0,r.jsxs)(t,{value:"annotation",label:"Per-workload annotation",children:[(0,r.jsxs)(n.p,{children:["If you want to disable the Initializer injection for a specific workload with\nthe ",(0,r.jsx)(n.code,{children:"contrast-cc"})," runtime class, you can do so by adding an annotation to the workload."]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-yaml",children:'metadata: # apps/v1.Deployment, apps/v1.DaemonSet, ...\n annotations:\n contrast.edgeless.systems/skip-initializer: "true"\n'})})]})]}),"\n",(0,r.jsxs)(n.p,{children:["When disabling the automatic Initializer injection, you can manually add the\nInitializer as a sidecar container to your workload before generating the\npolicies. Configure the workload to use the certificates written to the\n",(0,r.jsx)(n.code,{children:"contrast-secrets"})," ",(0,r.jsx)(n.code,{children:"volumeMount"}),"."]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-yaml",children:'# v1.PodSpec\nspec:\n initContainers:\n - env:\n - name: COORDINATOR_HOST\n value: coordinator\n image: "ghcr.io/edgelesssys/contrast/initializer:v1.2.0@sha256:942c019b751762540c45d827c1667e5e9f228ccf72c8cc44f11fc428610d196e"\n name: contrast-initializer\n volumeMounts:\n - mountPath: /contrast\n name: contrast-secrets\n volumes:\n - emptyDir: {}\n name: contrast-secrets\n'})}),"\n",(0,r.jsx)(n.h2,{id:"apply-the-resources",children:"Apply the resources"}),"\n",(0,r.jsx)(n.p,{children:"Apply the resources to the cluster. Your workloads will block in the initialization phase until a\nmanifest is set at the Coordinator."}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"kubectl apply -f resources/\n"})}),"\n",(0,r.jsx)(n.h2,{id:"connect-to-the-contrast-coordinator",children:"Connect to the Contrast Coordinator"}),"\n",(0,r.jsx)(n.p,{children:"For the next steps, we will need to connect to the Coordinator. The released Coordinator resource\nincludes a LoadBalancer definition we can use."}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}')\n"})}),"\n",(0,r.jsxs)(n.admonition,{title:"Port-forwarding of Confidential Containers",type:"info",children:[(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.code,{children:"kubectl port-forward"})," uses a Container Runtime Interface (CRI) method that isn't supported by the Kata shim.\nIf you can't use a public load balancer, you can deploy a ",(0,r.jsx)(n.a,{href:"https://github.com/edgelesssys/contrast/blob/ddc371b/deployments/emojivoto/portforwarder.yml",children:"port-forwarder"}),".\nThe port-forwarder relays traffic from a CoCo pod and can be accessed via ",(0,r.jsx)(n.code,{children:"kubectl port-forward"}),"."]}),(0,r.jsxs)(n.p,{children:["Upstream tracking issue: ",(0,r.jsx)(n.a,{href:"https://github.com/kata-containers/kata-containers/issues/1693",children:"https://github.com/kata-containers/kata-containers/issues/1693"}),"."]})]}),"\n",(0,r.jsx)(n.h2,{id:"set-the-manifest",children:"Set the manifest"}),"\n",(0,r.jsx)(n.p,{children:"Attest the Coordinator and set the manifest:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:'contrast set -c "${coordinator}:1313" resources/\n'})}),"\n",(0,r.jsx)(n.p,{children:"This will use the reference values from the manifest file to attest the Coordinator.\nAfter this step, the Coordinator will start issuing TLS certificates to the workloads. The init container\nwill fetch a certificate for the workload and the workload is started."}),"\n",(0,r.jsx)(n.admonition,{type:"warning",children:(0,r.jsxs)(n.p,{children:["On bare metal, the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/components/policies#platform-differences",children:"coordinator policy hash"})," must be overwritten using ",(0,r.jsx)(n.code,{children:"--coordinator-policy-hash"}),"."]})}),"\n",(0,r.jsx)(n.h2,{id:"verify-the-coordinator",children:"Verify the Coordinator"}),"\n",(0,r.jsxs)(n.p,{children:["An end user (data owner) can verify the Contrast deployment using the ",(0,r.jsx)(n.code,{children:"verify"})," command."]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:'contrast verify -c "${coordinator}:1313"\n'})}),"\n",(0,r.jsxs)(n.p,{children:["The CLI will attest the Coordinator using the reference values from the given manifest file. It will then write the\nservice mesh root certificate and the history of manifests into the ",(0,r.jsx)(n.code,{children:"verify/"})," directory. In addition, the policies\nreferenced in the active manifest are also written to the directory. The verification will fail if the active\nmanifest at the Coordinator doesn't match the manifest passed to the CLI."]}),"\n",(0,r.jsx)(n.admonition,{type:"warning",children:(0,r.jsxs)(n.p,{children:["On bare metal, the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/components/policies#platform-differences",children:"coordinator policy hash"})," must be overwritten using ",(0,r.jsx)(n.code,{children:"--coordinator-policy-hash"}),"."]})}),"\n",(0,r.jsx)(n.h2,{id:"communicate-with-workloads",children:"Communicate with workloads"}),"\n",(0,r.jsxs)(n.p,{children:["You can securely connect to the workloads using the Coordinator's ",(0,r.jsx)(n.code,{children:"mesh-ca.pem"})," as a trusted CA certificate.\nFirst, expose the service on a public IP address via a LoadBalancer service:"]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"kubectl patch svc ${MY_SERVICE} -p '{\"spec\": {\"type\": \"LoadBalancer\"}}'\nkubectl wait --timeout=30s --for=jsonpath='{.status.loadBalancer.ingress}' service/${MY_SERVICE}\nlbip=$(kubectl get svc ${MY_SERVICE} -o=jsonpath='{.status.loadBalancer.ingress[0].ip}')\necho $lbip\n"})}),"\n",(0,r.jsxs)(n.admonition,{title:"Subject alternative names and LoadBalancer IP",type:"info",children:[(0,r.jsx)(n.p,{children:"By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed\nvia load balancer IP in this demo. Tools like curl check the certificate for IP entries in the SAN field.\nValidation fails since the certificate contains no IP entries as a subject alternative name (SAN).\nFor example, attempting to connect with curl and the mesh CA certificate will throw the following error:"}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"$ curl --cacert ./verify/mesh-ca.pem \"https://${frontendIP}:443\"\ncurl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34'\n"})})]}),"\n",(0,r.jsxs)(n.p,{children:["Using ",(0,r.jsx)(n.code,{children:"openssl"}),", the certificate of the service can be validated with the ",(0,r.jsx)(n.code,{children:"mesh-ca.pem"}),":"]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"openssl s_client -CAfile verify/mesh-ca.pem -verify_return_error -connect ${frontendIP}:443 < /dev/null\n"})}),"\n",(0,r.jsx)(n.h2,{id:"recover-the-coordinator",children:"Recover the Coordinator"}),"\n",(0,r.jsx)(n.p,{children:"If the Contrast Coordinator restarts, it enters recovery mode and waits for an operator to provide key material.\nFor demonstration purposes, you can simulate this scenario by deleting the Coordinator pod."}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:"kubectl delete pod -l app.kubernetes.io/name=coordinator\n"})}),"\n",(0,r.jsxs)(n.p,{children:["Kubernetes schedules a new pod, but that pod doesn't have access to the key material the previous pod held in memory and can't issue certificates for workloads yet.\nYou can confirm this by running ",(0,r.jsx)(n.code,{children:"verify"})," again, or you can restart a workload pod, which should stay in the initialization phase.\nHowever, the secret seed in your working directory is sufficient to recover the coordinator."]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-sh",children:'contrast recover -c "${coordinator}:1313"\n'})}),"\n",(0,r.jsx)(n.p,{children:"Now that the Coordinator is recovered, all workloads should pass initialization and enter the running state.\nYou can now verify the Coordinator again, which should return the same manifest you set before."}),"\n",(0,r.jsx)(n.admonition,{type:"warning",children:(0,r.jsx)(n.p,{children:"The recovery process invalidates the mesh CA certificate:\nexisting workloads won't be able to communicate with workloads newly spawned.\nAll workloads should be restarted after the recovery succeeded."})}),"\n",(0,r.jsx)(n.admonition,{type:"warning",children:(0,r.jsxs)(n.p,{children:["On bare metal, the ",(0,r.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/components/policies#platform-differences",children:"coordinator policy hash"})," must be overwritten using ",(0,r.jsx)(n.code,{children:"--coordinator-policy-hash"}),"."]})})]})}function h(e={}){const{wrapper:n}={...(0,a.R)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}function u(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},28453:(e,n,t)=>{t.d(n,{R:()=>i,x:()=>o});var s=t(96540);const r={},a=s.createContext(r);function i(e){const n=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function o(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:i(e.components),s.createElement(a.Provider,{value:n},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/1ab97833.c3577891.js b/pr-preview/pr-1071/assets/js/1ab97833.c3577891.js
deleted file mode 100644
index 9619bf5e34..0000000000
--- a/pr-preview/pr-1071/assets/js/1ab97833.c3577891.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[985],{29083:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>s,metadata:()=>i,toc:()=>l});const i=JSON.parse('{"id":"components/overview","title":"Components","description":"Contrast is composed of several key components that work together to manage and scale confidential containers effectively within Kubernetes environments.","source":"@site/versioned_docs/version-1.0/components/overview.md","sourceDirName":"components","slug":"/components/overview","permalink":"/contrast/pr-preview/pr-1071/1.0/components/overview","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-1.0/components/overview.md","tags":[],"version":"1.0","frontMatter":{},"sidebar":"docs","previous":{"title":"Troubleshooting","permalink":"/contrast/pr-preview/pr-1071/1.0/troubleshooting"},"next":{"title":"Runtime","permalink":"/contrast/pr-preview/pr-1071/1.0/components/runtime"}}');var o=n(74848),r=n(28453);const s={},a="Components",c={},l=[{value:"The CLI (Command Line Interface)",id:"the-cli-command-line-interface",level:2},{value:"The Coordinator",id:"the-coordinator",level:2},{value:"The Manifest",id:"the-manifest",level:2},{value:"Runtime policies",id:"runtime-policies",level:2},{value:"The Initializer",id:"the-initializer",level:2},{value:"The Contrast runtime",id:"the-contrast-runtime",level:2}];function d(e){const t={a:"a",code:"code",em:"em",h1:"h1",h2:"h2",header:"header",img:"img",li:"li",p:"p",ul:"ul",...(0,r.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.header,{children:(0,o.jsx)(t.h1,{id:"components",children:"Components"})}),"\n",(0,o.jsx)(t.p,{children:"Contrast is composed of several key components that work together to manage and scale confidential containers effectively within Kubernetes environments.\nThis page provides an overview of the core components essential for deploying and managing Contrast."}),"\n",(0,o.jsx)(t.p,{children:(0,o.jsx)(t.img,{alt:"components overview",src:n(45426).A+"",width:"3387",height:"1866"})}),"\n",(0,o.jsx)(t.h2,{id:"the-cli-command-line-interface",children:"The CLI (Command Line Interface)"}),"\n",(0,o.jsx)(t.p,{children:"The CLI serves as the primary management tool for Contrast deployments. It's designed to streamline the configuration and operation of Contrast in several ways:"}),"\n",(0,o.jsxs)(t.ul,{children:["\n",(0,o.jsx)(t.li,{children:"Installation and setup: The CLI facilitates the installation of the necessary runtime classes required for Contrast to function within a Kubernetes cluster."}),"\n",(0,o.jsx)(t.li,{children:"Policy generation: It allows users to generate runtime policies, adapt the deployment files, and generate the Contrast manifest."}),"\n",(0,o.jsx)(t.li,{children:"Configuration management: Through the CLI, users can configure the Contrast Coordinator with the generated manifest."}),"\n",(0,o.jsx)(t.li,{children:"Verification and attestation: The CLI provides tools to verify the integrity and authenticity of the Coordinator and the entire deployment via remote attestation."}),"\n"]}),"\n",(0,o.jsx)(t.h2,{id:"the-coordinator",children:"The Coordinator"}),"\n",(0,o.jsxs)(t.p,{children:["The Contrast Coordinator is the central remote attestation service of a Contrast deployment.\nIt runs inside a confidential container inside your cluster.\nThe Coordinator can be verified via remote attestation, and a Contrast deployment is self-contained.\nThe Coordinator is configured with a ",(0,o.jsx)(t.em,{children:"manifest"}),", a configuration file containing the reference attestation values of your deployment.\nIt ensures that your deployment's topology adheres to your specified manifest by verifying the identity and integrity of all confidential pods inside the deployment.\nThe Coordinator is also a certificate authority and issues certificates for your workload pods during the attestation procedure.\nYour workload pods can establish secure, encrypted communication channels between themselves based on these certificates using the Coordinator as the root CA.\nAs your app needs to scale, the Coordinator transparently verifies new instances and then provides them with their certificates to join the deployment."]}),"\n",(0,o.jsx)(t.p,{children:"To verify your deployment, the Coordinator's remote attestation statement combined with the manifest offers a concise single remote attestation statement for your entire deployment.\nA third party can use this to verify the integrity of your distributed app, making it easy to assure stakeholders of your app's identity and integrity."}),"\n",(0,o.jsx)(t.h2,{id:"the-manifest",children:"The Manifest"}),"\n",(0,o.jsx)(t.p,{children:"The manifest is the configuration file for the Coordinator, defining your confidential deployment.\nIt's automatically generated from your deployment by the Contrast CLI.\nIt currently consists of the following parts:"}),"\n",(0,o.jsxs)(t.ul,{children:["\n",(0,o.jsxs)(t.li,{children:[(0,o.jsx)(t.em,{children:"Policies"}),": The identities of your Pods, represented by the hashes of their respective runtime policies."]}),"\n",(0,o.jsxs)(t.li,{children:[(0,o.jsx)(t.em,{children:"Reference Values"}),": The remote attestation reference values for the Kata confidential micro-VM that's the runtime environment of your Pods."]}),"\n",(0,o.jsxs)(t.li,{children:[(0,o.jsx)(t.em,{children:"WorkloadOwnerKeyDigest"}),": The workload owner's public key digest. Used for authenticating subsequent manifest updates."]}),"\n"]}),"\n",(0,o.jsx)(t.h2,{id:"runtime-policies",children:"Runtime policies"}),"\n",(0,o.jsx)(t.p,{children:"Runtime Policies are a mechanism to enable the use of the untrusted Kubernetes API for orchestration while ensuring the confidentiality and integrity of your confidential containers.\nThey allow us to enforce the integrity of your containers' runtime environment as defined in your deployment files.\nThe runtime policy mechanism is based on the Open Policy Agent (OPA) and translates the Kubernetes deployment YAML into the Rego policy language of OPA.\nThe Kata Agent inside the confidential micro-VM then enforces the policy by only acting on permitted requests.\nThe Contrast CLI provides the tooling for automatically translating Kubernetes deployment YAML into the Rego policy language of OPA."}),"\n",(0,o.jsx)(t.h2,{id:"the-initializer",children:"The Initializer"}),"\n",(0,o.jsxs)(t.p,{children:["Contrast provides an Initializer that handles the remote attestation on the workload side transparently and\nfetches the workload certificate. The Initializer runs as an init container before your workload is started.\nIt provides the workload container and the ",(0,o.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.0/components/service-mesh",children:"service mesh sidecar"})," with the workload certificates."]}),"\n",(0,o.jsx)(t.h2,{id:"the-contrast-runtime",children:"The Contrast runtime"}),"\n",(0,o.jsxs)(t.p,{children:["Contrast depends on a Kubernetes ",(0,o.jsx)(t.a,{href:"https://kubernetes.io/docs/concepts/containers/runtime-class/",children:"runtime class"}),", which is installed\nby the ",(0,o.jsx)(t.code,{children:"node-installer"})," DaemonSet.\nThis runtime consists of a containerd runtime plugin, a virtual machine manager (cloud-hypervisor), and a podvm image (IGVM and rootFS).\nThe installer takes care of provisioning every node in the cluster so it provides this runtime class."]})]})}function h(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},45426:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/components-ea3fb9800d5718d6ab96607ee817c104.svg"},28453:(e,t,n)=>{n.d(t,{R:()=>s,x:()=>a});var i=n(96540);const o={},r=i.createContext(o);function s(e){const t=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:s(e.components),i.createElement(r.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/1c9b88ee.c2b9b81d.js b/pr-preview/pr-1071/assets/js/1c9b88ee.c2b9b81d.js
deleted file mode 100644
index 54609048c5..0000000000
--- a/pr-preview/pr-1071/assets/js/1c9b88ee.c2b9b81d.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[1560],{62538:(t,e,n)=>{n.r(e),n.d(e,{assets:()=>l,contentTitle:()=>i,default:()=>p,frontMatter:()=>o,metadata:()=>s,toc:()=>c});const s=JSON.parse('{"id":"getting-started/install","title":"Installation","description":"Download the Contrast CLI from the latest release:","source":"@site/versioned_docs/version-0.6/getting-started/install.md","sourceDirName":"getting-started","slug":"/getting-started/install","permalink":"/contrast/pr-preview/pr-1071/0.6/getting-started/install","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.6/getting-started/install.md","tags":[],"version":"0.6","frontMatter":{},"sidebar":"docs","previous":{"title":"Getting started","permalink":"/contrast/pr-preview/pr-1071/0.6/getting-started/"},"next":{"title":"Cluster setup","permalink":"/contrast/pr-preview/pr-1071/0.6/getting-started/cluster-setup"}}');var r=n(74848),a=n(28453);const o={},i="Installation",l={},c=[];function d(t){const e={code:"code",h1:"h1",header:"header",p:"p",pre:"pre",...(0,a.R)(),...t.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(e.header,{children:(0,r.jsx)(e.h1,{id:"installation",children:"Installation"})}),"\n",(0,r.jsx)(e.p,{children:"Download the Contrast CLI from the latest release:"}),"\n",(0,r.jsx)(e.pre,{children:(0,r.jsx)(e.code,{className:"language-bash",children:"curl --proto '=https' --tlsv1.2 -fLo contrast https://github.com/edgelesssys/contrast/releases/latest/download/contrast\n"})}),"\n",(0,r.jsx)(e.p,{children:"After that, install the Contrast CLI in your PATH, e.g.:"}),"\n",(0,r.jsx)(e.pre,{children:(0,r.jsx)(e.code,{className:"language-bash",children:"sudo install contrast /usr/local/bin/contrast\n"})})]})}function p(t={}){const{wrapper:e}={...(0,a.R)(),...t.components};return e?(0,r.jsx)(e,{...t,children:(0,r.jsx)(d,{...t})}):d(t)}},28453:(t,e,n)=>{n.d(e,{R:()=>o,x:()=>i});var s=n(96540);const r={},a=s.createContext(r);function o(t){const e=s.useContext(a);return s.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function i(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(r):t.components||r:o(t.components),s.createElement(a.Provider,{value:e},t.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/1de90583.1ca7e4e9.js b/pr-preview/pr-1071/assets/js/1de90583.1ca7e4e9.js
deleted file mode 100644
index 3e29056bbe..0000000000
--- a/pr-preview/pr-1071/assets/js/1de90583.1ca7e4e9.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[6200],{64920:e=>{e.exports=JSON.parse('{"version":{"pluginId":"default","version":"0.8","label":"0.8","banner":"unmaintained","badge":true,"noIndex":false,"className":"docs-version-0.8","isLast":false,"docsSidebars":{"docs":[{"type":"link","label":"What is Contrast?","href":"/contrast/pr-preview/pr-1071/0.8/","docId":"intro","unlisted":false},{"type":"category","label":"Basics","collapsed":false,"items":[{"type":"link","label":"Confidential Containers","href":"/contrast/pr-preview/pr-1071/0.8/basics/confidential-containers","docId":"basics/confidential-containers","unlisted":false},{"type":"link","label":"Security benefits","href":"/contrast/pr-preview/pr-1071/0.8/basics/security-benefits","docId":"basics/security-benefits","unlisted":false},{"type":"link","label":"Features","href":"/contrast/pr-preview/pr-1071/0.8/basics/features","docId":"basics/features","unlisted":false}],"collapsible":true},{"type":"category","label":"Getting started","collapsed":false,"items":[{"type":"link","label":"Install","href":"/contrast/pr-preview/pr-1071/0.8/getting-started/install","docId":"getting-started/install","unlisted":false},{"type":"link","label":"Cluster setup","href":"/contrast/pr-preview/pr-1071/0.8/getting-started/cluster-setup","docId":"getting-started/cluster-setup","unlisted":false}],"collapsible":true},{"type":"category","label":"Examples","items":[{"type":"link","label":"Confidential emoji voting","href":"/contrast/pr-preview/pr-1071/0.8/examples/emojivoto","docId":"examples/emojivoto","unlisted":false}],"collapsed":true,"collapsible":true},{"type":"link","label":"Workload deployment","href":"/contrast/pr-preview/pr-1071/0.8/deployment","docId":"deployment","unlisted":false},{"type":"link","label":"Troubleshooting","href":"/contrast/pr-preview/pr-1071/0.8/troubleshooting","docId":"troubleshooting","unlisted":false},{"type":"category","label":"Components","items":[{"type":"link","label":"Overview","href":"/contrast/pr-preview/pr-1071/0.8/components/overview","docId":"components/overview","unlisted":false},{"type":"link","label":"Runtime","href":"/contrast/pr-preview/pr-1071/0.8/components/runtime","docId":"components/runtime","unlisted":false},{"type":"link","label":"Policies","href":"/contrast/pr-preview/pr-1071/0.8/components/policies","docId":"components/policies","unlisted":false},{"type":"link","label":"Service mesh","href":"/contrast/pr-preview/pr-1071/0.8/components/service-mesh","docId":"components/service-mesh","unlisted":false}],"collapsed":true,"collapsible":true},{"type":"category","label":"Architecture","items":[{"type":"link","label":"Attestation","href":"/contrast/pr-preview/pr-1071/0.8/architecture/attestation","docId":"architecture/attestation","unlisted":false},{"type":"link","label":"Secrets & recovery","href":"/contrast/pr-preview/pr-1071/0.8/architecture/secrets","docId":"architecture/secrets","unlisted":false},{"type":"link","label":"Certificate authority","href":"/contrast/pr-preview/pr-1071/0.8/architecture/certificates","docId":"architecture/certificates","unlisted":false},{"type":"link","label":"Observability","href":"/contrast/pr-preview/pr-1071/0.8/architecture/observability","docId":"architecture/observability","unlisted":false}],"collapsed":true,"collapsible":true},{"type":"link","label":"Planned features and limitations","href":"/contrast/pr-preview/pr-1071/0.8/features-limitations","docId":"features-limitations","unlisted":false},{"type":"category","label":"About","items":[{"type":"link","label":"Telemetry","href":"/contrast/pr-preview/pr-1071/0.8/about/telemetry","docId":"about/telemetry","unlisted":false}],"collapsed":true,"collapsible":true}]},"docs":{"about/telemetry":{"id":"about/telemetry","title":"CLI telemetry","description":"The Contrast CLI sends telemetry data to Edgeless Systems when you use CLI commands.","sidebar":"docs"},"architecture/attestation":{"id":"architecture/attestation","title":"Attestation in Contrast","description":"This document describes the attestation architecture of Contrast, adhering to the definitions of Remote ATtestation procedureS (RATS) in RFC 9334.","sidebar":"docs"},"architecture/certificates":{"id":"architecture/certificates","title":"Certificate authority","description":"The Coordinator acts as a certificate authority (CA) for the workloads","sidebar":"docs"},"architecture/observability":{"id":"architecture/observability","title":"Observability","description":"The Contrast Coordinator can expose metrics in the","sidebar":"docs"},"architecture/secrets":{"id":"architecture/secrets","title":"Secrets & recovery","description":"When the Coordinator is configured with the initial manifest, it generates a random secret seed.","sidebar":"docs"},"basics/confidential-containers":{"id":"basics/confidential-containers","title":"Confidential Containers","description":"Contrast uses some building blocks from Confidential Containers (CoCo), a CNCF Sandbox project that aims to standardize confidential computing at the pod level.","sidebar":"docs"},"basics/features":{"id":"basics/features","title":"Product features","description":"Contrast simplifies the deployment and management of Confidential Containers, offering optimal data security for your workloads while integrating seamlessly with your existing Kubernetes environment.","sidebar":"docs"},"basics/security-benefits":{"id":"basics/security-benefits","title":"Contrast security overview","description":"This document outlines the security measures of Contrast and its capability to counter various threats.","sidebar":"docs"},"components/overview":{"id":"components/overview","title":"Components","description":"Contrast is composed of several key components that work together to manage and scale confidential containers effectively within Kubernetes environments.","sidebar":"docs"},"components/policies":{"id":"components/policies","title":"Policies","description":"Kata runtime policies are an integral part of the Confidential Containers preview on AKS.","sidebar":"docs"},"components/runtime":{"id":"components/runtime","title":"Contrast Runtime","description":"The Contrast runtime is responsible for starting pods as confidential virtual machines.","sidebar":"docs"},"components/service-mesh":{"id":"components/service-mesh","title":"Service mesh","description":"The Contrast service mesh secures the communication of the workload by automatically","sidebar":"docs"},"deployment":{"id":"deployment","title":"Workload deployment","description":"The following instructions will guide you through the process of making an existing Kubernetes deployment","sidebar":"docs"},"examples/emojivoto":{"id":"examples/emojivoto","title":"Confidential emoji voting","description":"screenshot of the emojivoto UI","sidebar":"docs"},"features-limitations":{"id":"features-limitations","title":"Planned features and limitations","description":"This section lists planned features and current limitations of Contrast.","sidebar":"docs"},"getting-started/cluster-setup":{"id":"getting-started/cluster-setup","title":"Create a cluster","description":"Prerequisites","sidebar":"docs"},"getting-started/install":{"id":"getting-started/install","title":"Installation","description":"Download the Contrast CLI from the latest release:","sidebar":"docs"},"intro":{"id":"intro","title":"Contrast","description":"Welcome to the documentation of Contrast! Contrast runs confidential container deployments on Kubernetes at scale.","sidebar":"docs"},"troubleshooting":{"id":"troubleshooting","title":"Troubleshooting","description":"This section contains information on how to debug your Contrast deployment.","sidebar":"docs"}}}}')}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/1e7c9753.62495ac8.js b/pr-preview/pr-1071/assets/js/1e7c9753.62495ac8.js
deleted file mode 100644
index 96147c2d48..0000000000
--- a/pr-preview/pr-1071/assets/js/1e7c9753.62495ac8.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[3391],{99028:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>u,frontMatter:()=>o,metadata:()=>s,toc:()=>l});const s=JSON.parse('{"id":"basics/features","title":"Product features","description":"Contrast simplifies the deployment and management of Confidential Containers, offering optimal data security for your workloads while integrating seamlessly with your existing Kubernetes environment.","source":"@site/versioned_docs/version-1.1/basics/features.md","sourceDirName":"basics","slug":"/basics/features","permalink":"/contrast/pr-preview/pr-1071/1.1/basics/features","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-1.1/basics/features.md","tags":[],"version":"1.1","frontMatter":{},"sidebar":"docs","previous":{"title":"Security benefits","permalink":"/contrast/pr-preview/pr-1071/1.1/basics/security-benefits"},"next":{"title":"Install","permalink":"/contrast/pr-preview/pr-1071/1.1/getting-started/install"}}');var r=n(74848),i=n(28453);const o={},a="Product features",c={},l=[];function d(e){const t={a:"a",h1:"h1",header:"header",li:"li",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.header,{children:(0,r.jsx)(t.h1,{id:"product-features",children:"Product features"})}),"\n",(0,r.jsx)(t.p,{children:"Contrast simplifies the deployment and management of Confidential Containers, offering optimal data security for your workloads while integrating seamlessly with your existing Kubernetes environment."}),"\n",(0,r.jsxs)(t.p,{children:["From a security perspective, Contrast employs the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/basics/confidential-containers",children:"Confidential Containers"})," concept and provides ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/basics/security-benefits",children:"security benefits"})," that go beyond individual containers, shielding your entire deployment from the underlying infrastructure."]}),"\n",(0,r.jsx)(t.p,{children:"From an operational perspective, Contrast provides the following key features:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Managed Kubernetes compatibility"}),": Initially compatible with Azure Kubernetes Service (AKS), Contrast is designed to support additional platforms such as AWS EKS and Google Cloud GKE as they begin to accommodate confidential containers."]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Lightweight installation"}),": Contrast can be integrated as a ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/deployment",children:"day-2 operation"})," within existing clusters, adding minimal ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/overview",children:"components"})," to your setup. This facilitates straightforward deployments using your existing YAML configurations, Helm charts, or Kustomization, enabling native Kubernetes orchestration of your applications."]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Remote attestation"}),": Contrast generates a concise attestation statement that verifies the identity, authenticity, and integrity of your deployment both internally and to external parties. This architecture ensures that updates or scaling of the application don't compromise the attestation\u2019s validity."]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Service mesh"}),": Contrast securely manages a Public Key Infrastructure (PKI) for your deployments, issues workload-specific certificates, and establishes transparent mutual TLS (mTLS) connections across pods. This is done by harnessing the ",(0,r.jsx)(t.a,{href:"https://www.envoyproxy.io/",children:"envoy proxy"})," to ensure secure communications within your Kubernetes cluster."]}),"\n"]}),"\n"]})]})}function u(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>o,x:()=>a});var s=n(96540);const r={},i=s.createContext(r);function o(e){const t=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),s.createElement(i.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/1fefe6de.55a1a00a.js b/pr-preview/pr-1071/assets/js/1fefe6de.55a1a00a.js
deleted file mode 100644
index d74ca90c46..0000000000
--- a/pr-preview/pr-1071/assets/js/1fefe6de.55a1a00a.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[6463],{71758:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>c,contentTitle:()=>r,default:()=>h,frontMatter:()=>a,metadata:()=>o,toc:()=>l});const o=JSON.parse('{"id":"troubleshooting","title":"Troubleshooting","description":"This section contains information on how to debug your Contrast deployment.","source":"@site/versioned_docs/version-1.2/troubleshooting.md","sourceDirName":".","slug":"/troubleshooting","permalink":"/contrast/pr-preview/pr-1071/troubleshooting","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-1.2/troubleshooting.md","tags":[],"version":"1.2","frontMatter":{},"sidebar":"docs","previous":{"title":"Workload deployment","permalink":"/contrast/pr-preview/pr-1071/deployment"},"next":{"title":"Overview","permalink":"/contrast/pr-preview/pr-1071/components/overview"}}');var i=t(74848),s=t(28453);const a={},r="Troubleshooting",c={},l=[{value:"Logging",id:"logging",level:2},{value:"CLI",id:"cli",level:3},{value:"Coordinator and Initializer",id:"coordinator-and-initializer",level:3},{value:"Pod fails to start",id:"pod-fails-to-start",level:2},{value:"Regenerating the policies",id:"regenerating-the-policies",level:3},{value:"Pin container images",id:"pin-container-images",level:3},{value:"Validate Contrast components match",id:"validate-contrast-components-match",level:3}];function d(e){const n={admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",p:"p",pre:"pre",ul:"ul",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.header,{children:(0,i.jsx)(n.h1,{id:"troubleshooting",children:"Troubleshooting"})}),"\n",(0,i.jsx)(n.p,{children:"This section contains information on how to debug your Contrast deployment."}),"\n",(0,i.jsx)(n.h2,{id:"logging",children:"Logging"}),"\n",(0,i.jsx)(n.p,{children:"Collecting logs can be a good first step to identify problems in your\ndeployment. Both the CLI and the Contrast Coordinator as well as the Initializer\ncan be configured to emit additional logs."}),"\n",(0,i.jsx)(n.h3,{id:"cli",children:"CLI"}),"\n",(0,i.jsxs)(n.p,{children:["The CLI logs can be configured with the ",(0,i.jsx)(n.code,{children:"--log-level"})," command-line flag, which\ncan be set to either ",(0,i.jsx)(n.code,{children:"debug"}),", ",(0,i.jsx)(n.code,{children:"info"}),", ",(0,i.jsx)(n.code,{children:"warn"})," or ",(0,i.jsx)(n.code,{children:"error"}),". The default is ",(0,i.jsx)(n.code,{children:"info"}),".\nSetting this to ",(0,i.jsx)(n.code,{children:"debug"})," can get more fine-grained information as to where the\nproblem lies."]}),"\n",(0,i.jsx)(n.h3,{id:"coordinator-and-initializer",children:"Coordinator and Initializer"}),"\n",(0,i.jsxs)(n.p,{children:["The logs from the Coordinator and the Initializer can be configured via the\nenvironment variables ",(0,i.jsx)(n.code,{children:"CONTRAST_LOG_LEVEL"}),", ",(0,i.jsx)(n.code,{children:"CONTRAST_LOG_FORMAT"})," and\n",(0,i.jsx)(n.code,{children:"CONTRAST_LOG_SUBSYSTEMS"}),"."]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"CONTRAST_LOG_LEVEL"})," can be set to one of either ",(0,i.jsx)(n.code,{children:"debug"}),", ",(0,i.jsx)(n.code,{children:"info"}),", ",(0,i.jsx)(n.code,{children:"warn"}),", or\n",(0,i.jsx)(n.code,{children:"error"}),", similar to the CLI (defaults to ",(0,i.jsx)(n.code,{children:"info"}),")."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"CONTRAST_LOG_FORMAT"})," can be set to ",(0,i.jsx)(n.code,{children:"text"})," or ",(0,i.jsx)(n.code,{children:"json"}),", determining the output\nformat (defaults to ",(0,i.jsx)(n.code,{children:"text"}),")."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"CONTRAST_LOG_SUBSYSTEMS"})," is a comma-separated list of subsystems that should\nbe enabled for logging, which are disabled by default. Subsystems include:\n",(0,i.jsx)(n.code,{children:"kds-getter"}),", ",(0,i.jsx)(n.code,{children:"issuer"})," and ",(0,i.jsx)(n.code,{children:"validator"}),".\nTo enable all subsystems, use ",(0,i.jsx)(n.code,{children:"*"})," as the value for this environment variable.\nWarnings and error messages from subsystems get printed regardless of whether\nthe subsystem is listed in the ",(0,i.jsx)(n.code,{children:"CONTRAST_LOG_SUBSYSTEMS"})," environment variable."]}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:"To configure debug logging with all subsystems for your Coordinator, add the\nfollowing variables to your container definition."}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:'spec: # v1.PodSpec\n containers:\n image: "ghcr.io/edgelesssys/contrast/coordinator:v1.2.0@sha256:458e408cd8f390b258b84a1236464febf63bda08f0be91a585c5a14500564cc8"\n name: coordinator\n env:\n - name: CONTRAST_LOG_LEVEL\n value: debug\n - name: CONTRAST_LOG_SUBSYSTEMS\n value: "*"\n # ...\n'})}),"\n",(0,i.jsx)(n.admonition,{type:"info",children:(0,i.jsxs)(n.p,{children:["While the Contrast Coordinator has a policy that allows certain configurations,\nthe Initializer and service mesh don't. When changing environment variables of other\nparts than the Coordinator, ensure to rerun ",(0,i.jsx)(n.code,{children:"contrast generate"})," to update the policy."]})}),"\n",(0,i.jsxs)(n.p,{children:["To access the logs generated by the Coordinator, you can use ",(0,i.jsx)(n.code,{children:"kubectl"})," with the\nfollowing command:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-sh",children:"kubectl logs \n"})}),"\n",(0,i.jsx)(n.h2,{id:"pod-fails-to-start",children:"Pod fails to start"}),"\n",(0,i.jsxs)(n.p,{children:["If the Coordinator or a workload pod fails to even start, it can be helpful to\nlook at the events of the pod during the startup process using the ",(0,i.jsx)(n.code,{children:"describe"}),"\ncommand."]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-sh",children:"kubectl -n events --for pod/\n"})}),"\n",(0,i.jsx)(n.p,{children:"Example output:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:'LAST SEEN TYPE REASON OBJECT MESSAGE\n32m Warning Failed Pod/coordinator-0 kubelet Error: failed to create containerd task: failed to create shim task: "CreateContainerRequest is blocked by policy: ...\n'})}),"\n",(0,i.jsx)(n.p,{children:"A common error, as in this example, is that the container creation was blocked by the\npolicy. Potential reasons are a modification of the deployment YAML without updating\nthe policies afterward, or a version mismatch between Contrast components."}),"\n",(0,i.jsx)(n.h3,{id:"regenerating-the-policies",children:"Regenerating the policies"}),"\n",(0,i.jsx)(n.p,{children:"To ensure there isn't a mismatch between Kubernetes resource YAML and the annotated\npolicies, rerun"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-sh",children:"contrast generate\n"})}),"\n",(0,i.jsx)(n.p,{children:"on your deployment. If any of the policy annotations change, re-deploy with the updated policies."}),"\n",(0,i.jsx)(n.h3,{id:"pin-container-images",children:"Pin container images"}),"\n",(0,i.jsx)(n.p,{children:"When generating the policies, Contrast will download the images specified in your deployment\nYAML and include their cryptographic identity. If the image tag is moved to another\ncontainer image after the policy has been generated, the image downloaded at deploy time\nwill differ from the one at generation time, and the policy enforcement won't allow the\ncontainer to be started in the pod VM."}),"\n",(0,i.jsxs)(n.p,{children:["To ensure the correct image is always used, pin the container image to a fixed ",(0,i.jsx)(n.code,{children:"sha256"}),":"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"image: ubuntu:22.04@sha256:19478ce7fc2ffbce89df29fea5725a8d12e57de52eb9ea570890dc5852aac1ac\n"})}),"\n",(0,i.jsxs)(n.p,{children:["This way, the same image will still be pulled when the container tag (",(0,i.jsx)(n.code,{children:"22.04"}),") is moved\nto another image."]}),"\n",(0,i.jsx)(n.h3,{id:"validate-contrast-components-match",children:"Validate Contrast components match"}),"\n",(0,i.jsx)(n.p,{children:"A version mismatch between Contrast components can cause policy validation or attestation\nto fail. Each Contrast runtime is identifiable based on its (shortened) measurement value\nused to name the runtime class version."}),"\n",(0,i.jsx)(n.p,{children:"First, analyze which runtime class is currently installed in your cluster by running"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-sh",children:"kubectl get runtimeclasses\n"})}),"\n",(0,i.jsx)(n.p,{children:"This should give you output similar to the following one."}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-sh",children:"NAME HANDLER AGE\ncontrast-cc-aks-clh-snp-7173acb5 contrast-cc-aks-clh-snp-7173acb5 23h\nkata-cc-isolation kata-cc 45d\n"})}),"\n",(0,i.jsx)(n.p,{children:"The output shows that there are four Contrast runtime classes installed (as well as the runtime class provided\nby the AKS CoCo preview, which isn't used by Contrast)."}),"\n",(0,i.jsx)(n.p,{children:"Next, check if the pod that won't start has the correct runtime class configured, and the\nCoordinator uses the exact same runtime:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-sh",children:"kubectl -n get -o=jsonpath='{.spec.runtimeClassName}' pod/\nkubectl -n get -o=jsonpath='{.spec.runtimeClassName}' pod/\n"})}),"\n",(0,i.jsx)(n.p,{children:"The output should list the runtime class the pod is using:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-sh",children:"contrast-cc-aks-clh-snp-7173acb5\n"})}),"\n",(0,i.jsxs)(n.p,{children:["Version information about the currently used CLI can be obtained via the ",(0,i.jsx)(n.code,{children:"version"})," flag:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-sh",children:"contrast --version\n"})}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-sh",children:"contrast version v0.X.0\n\n runtime handler: contrast-cc-aks-clh-snp-7173acb5\n launch digest: beee79ca916b9e5dc59602788cbfb097721cde34943e1583a3918f21011a71c47f371f68e883f5e474a6d4053d931a35\n genpolicy version: 3.2.0.azl1.genpolicy0\n image versions: ghcr.io/edgelesssys/contrast/coordinator@sha256:...\n ghcr.io/edgelesssys/contrast/initializer@sha256:...\n"})})]})}function h(e={}){const{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},28453:(e,n,t)=>{t.d(n,{R:()=>a,x:()=>r});var o=t(96540);const i={},s=o.createContext(i);function a(e){const n=o.useContext(s);return o.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),o.createElement(s.Provider,{value:n},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/200ecf61.42b16ee7.js b/pr-preview/pr-1071/assets/js/200ecf61.42b16ee7.js
deleted file mode 100644
index 5c7a3e5fc8..0000000000
--- a/pr-preview/pr-1071/assets/js/200ecf61.42b16ee7.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[8904],{79880:e=>{e.exports=JSON.parse('{"categoryGeneratedIndex":{"title":"Network Encryption","slug":"/category/network-encryption","permalink":"/contrast/pr-preview/pr-1071/0.5/category/network-encryption","sidebar":"docs","navigation":{"previous":{"title":"PKI","permalink":"/contrast/pr-preview/pr-1071/0.5/architecture/certificates-and-identities/pki"},"next":{"title":"Sidecar","permalink":"/contrast/pr-preview/pr-1071/0.5/architecture/network-encryption/sidecar"}}}}')}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/20382dd7.24536267.js b/pr-preview/pr-1071/assets/js/20382dd7.24536267.js
deleted file mode 100644
index e04c2fa522..0000000000
--- a/pr-preview/pr-1071/assets/js/20382dd7.24536267.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[3357],{33961:(t,e,n)=>{n.r(e),n.d(e,{assets:()=>a,contentTitle:()=>c,default:()=>d,frontMatter:()=>o,metadata:()=>r,toc:()=>u});const r=JSON.parse('{"id":"architecture/attestation/runtime-policies","title":"runtime-policies","description":"","source":"@site/versioned_docs/version-0.5/architecture/attestation/runtime-policies.md","sourceDirName":"architecture/attestation","slug":"/architecture/attestation/runtime-policies","permalink":"/contrast/pr-preview/pr-1071/0.5/architecture/attestation/runtime-policies","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.5/architecture/attestation/runtime-policies.md","tags":[],"version":"0.5","frontMatter":{},"sidebar":"docs","previous":{"title":"Pod VM","permalink":"/contrast/pr-preview/pr-1071/0.5/architecture/attestation/pod-vm"},"next":{"title":"Manifest","permalink":"/contrast/pr-preview/pr-1071/0.5/architecture/attestation/manifest"}}');var i=n(74848),s=n(28453);const o={},c=void 0,a={},u=[];function p(t){return(0,i.jsx)(i.Fragment,{})}function d(t={}){const{wrapper:e}={...(0,s.R)(),...t.components};return e?(0,i.jsx)(e,{...t,children:(0,i.jsx)(p,{...t})}):p()}},28453:(t,e,n)=>{n.d(e,{R:()=>o,x:()=>c});var r=n(96540);const i={},s=r.createContext(i);function o(t){const e=r.useContext(s);return r.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function c(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(i):t.components||i:o(t.components),r.createElement(s.Provider,{value:e},t.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/207bb774.937e3159.js b/pr-preview/pr-1071/assets/js/207bb774.937e3159.js
deleted file mode 100644
index 1a09c99f9c..0000000000
--- a/pr-preview/pr-1071/assets/js/207bb774.937e3159.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[430],{50880:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>m,frontMatter:()=>i,metadata:()=>r,toc:()=>u});const r=JSON.parse('{"id":"about/index","title":"About","description":"","source":"@site/versioned_docs/version-0.6/about/index.md","sourceDirName":"about","slug":"/about/","permalink":"/contrast/pr-preview/pr-1071/0.6/about/","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.6/about/index.md","tags":[],"version":"0.6","frontMatter":{},"sidebar":"docs","previous":{"title":"Known limitations","permalink":"/contrast/pr-preview/pr-1071/0.6/known-limitations"},"next":{"title":"Telemetry","permalink":"/contrast/pr-preview/pr-1071/0.6/about/telemetry"}}');var o=n(74848),s=n(28453),c=n(44074);const i={},a="About",l={},u=[];function d(e){const t={h1:"h1",header:"header",...(0,s.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.header,{children:(0,o.jsx)(t.h1,{id:"about",children:"About"})}),"\n","\n",(0,o.jsx)(c.A,{})]})}function m(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},44074:(e,t,n)=>{n.d(t,{A:()=>k});var r=n(96540),o=n(34164),s=n(45357),c=n(14783),i=n(97639);const a=["zero","one","two","few","many","other"];function l(e){return a.filter((t=>e.includes(t)))}const u={locale:"en",pluralForms:l(["one","other"]),select:e=>1===e?"one":"other"};function d(){const{i18n:{currentLocale:e}}=(0,i.A)();return(0,r.useMemo)((()=>{try{return function(e){const t=new Intl.PluralRules(e);return{locale:e,pluralForms:l(t.resolvedOptions().pluralCategories),select:e=>t.select(e)}}(e)}catch(t){return console.error(`Failed to use Intl.PluralRules for locale "${e}".\nDocusaurus will fallback to the default (English) implementation.\nError: ${t.message}\n`),u}}),[e])}function m(){const e=d();return{selectMessage:(t,n)=>function(e,t,n){const r=e.split("|");if(1===r.length)return r[0];r.length>n.pluralForms.length&&console.error(`For locale=${n.locale}, a maximum of ${n.pluralForms.length} plural forms are expected (${n.pluralForms.join(",")}), but the message contains ${r.length}: ${e}`);const o=n.select(t),s=n.pluralForms.indexOf(o);return r[Math.min(s,r.length-1)]}(n,t,e)}}var p=n(40877),h=n(23230),f=n(85225);const x={cardContainer:"cardContainer_fWXF",cardTitle:"cardTitle_rnsV",cardDescription:"cardDescription_PWke"};var g=n(74848);function b(e){let{href:t,children:n}=e;return(0,g.jsx)(c.A,{href:t,className:(0,o.A)("card padding--lg",x.cardContainer),children:n})}function j(e){let{href:t,icon:n,title:r,description:s}=e;return(0,g.jsxs)(b,{href:t,children:[(0,g.jsxs)(f.A,{as:"h2",className:(0,o.A)("text--truncate",x.cardTitle),title:r,children:[n," ",r]}),s&&(0,g.jsx)("p",{className:(0,o.A)("text--truncate",x.cardDescription),title:s,children:s})]})}function v(e){let{item:t}=e;const n=(0,s.Nr)(t),r=function(){const{selectMessage:e}=m();return t=>e(t,(0,h.T)({message:"1 item|{count} items",id:"theme.docs.DocCard.categoryDescription.plurals",description:"The default description for a category card in the generated index about how many items this category includes"},{count:t}))}();return n?(0,g.jsx)(j,{href:n,icon:"\ud83d\uddc3\ufe0f",title:t.label,description:t.description??r(t.items.length)}):null}function w(e){let{item:t}=e;const n=(0,p.A)(t.href)?"\ud83d\udcc4\ufe0f":"\ud83d\udd17",r=(0,s.cC)(t.docId??void 0);return(0,g.jsx)(j,{href:t.href,icon:n,title:t.label,description:t.description??r?.description})}function y(e){let{item:t}=e;switch(t.type){case"link":return(0,g.jsx)(w,{item:t});case"category":return(0,g.jsx)(v,{item:t});default:throw new Error(`unknown item type ${JSON.stringify(t)}`)}}function A(e){let{className:t}=e;const n=(0,s.$S)();return(0,g.jsx)(k,{items:n.items,className:t})}function k(e){const{items:t,className:n}=e;if(!t)return(0,g.jsx)(A,{...e});const r=(0,s.d1)(t);return(0,g.jsx)("section",{className:(0,o.A)("row",n),children:r.map(((e,t)=>(0,g.jsx)("article",{className:"col col--6 margin-bottom--lg",children:(0,g.jsx)(y,{item:e})},t)))})}},28453:(e,t,n)=>{n.d(t,{R:()=>c,x:()=>i});var r=n(96540);const o={},s=r.createContext(o);function c(e){const t=r.useContext(s);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:c(e.components),r.createElement(s.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/20e0cfa9.efdde374.js b/pr-preview/pr-1071/assets/js/20e0cfa9.efdde374.js
deleted file mode 100644
index b013ab8cea..0000000000
--- a/pr-preview/pr-1071/assets/js/20e0cfa9.efdde374.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[8403],{69107:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>r,metadata:()=>s,toc:()=>d});const s=JSON.parse('{"id":"basics/confidential-containers","title":"Confidential Containers","description":"Contrast uses some building blocks from Confidential Containers (CoCo), a CNCF Sandbox project that aims to standardize confidential computing at the pod level.","source":"@site/versioned_docs/version-0.7/basics/confidential-containers.md","sourceDirName":"basics","slug":"/basics/confidential-containers","permalink":"/contrast/pr-preview/pr-1071/0.7/basics/confidential-containers","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.7/basics/confidential-containers.md","tags":[],"version":"0.7","frontMatter":{},"sidebar":"docs","previous":{"title":"Contrast","permalink":"/contrast/pr-preview/pr-1071/0.7/"},"next":{"title":"Security benefits","permalink":"/contrast/pr-preview/pr-1071/0.7/basics/security-benefits"}}');var i=t(74848),o=t(28453);const r={},a="Confidential Containers",c={},d=[{value:"Kubernetes RuntimeClass",id:"kubernetes-runtimeclass",level:2},{value:"Kata Containers",id:"kata-containers",level:2},{value:"AKS CoCo preview",id:"aks-coco-preview",level:2}];function l(e){const n={a:"a",code:"code",h1:"h1",h2:"h2",header:"header",p:"p",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.header,{children:(0,i.jsx)(n.h1,{id:"confidential-containers",children:"Confidential Containers"})}),"\n",(0,i.jsxs)(n.p,{children:["Contrast uses some building blocks from ",(0,i.jsx)(n.a,{href:"https://confidentialcontainers.org",children:"Confidential Containers"})," (CoCo), a ",(0,i.jsx)(n.a,{href:"https://www.cncf.io/projects/confidential-containers/",children:"CNCF Sandbox project"})," that aims to standardize confidential computing at the pod level.\nThe project is under active development and many of the high-level features are still in flux.\nContrast uses the more stable core primitive provided by CoCo: its Kubernetes runtime."]}),"\n",(0,i.jsx)(n.h2,{id:"kubernetes-runtimeclass",children:"Kubernetes RuntimeClass"}),"\n",(0,i.jsxs)(n.p,{children:["Kubernetes can be extended to use more than one container runtime with ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/containers/runtime-class/",children:(0,i.jsx)(n.code,{children:"RuntimeClass"})})," objects.\nThe ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/architecture/cri/",children:"Container Runtime Interface"})," (CRI) implementation, for example containerd, dispatches pod management API calls to the appropriate ",(0,i.jsx)(n.code,{children:"RuntimeClass"}),".\n",(0,i.jsx)(n.code,{children:"RuntimeClass"})," implementations are usually based on an ",(0,i.jsx)(n.a,{href:"https://github.com/opencontainers/runtime-spec",children:"OCI runtime"}),", such as ",(0,i.jsx)(n.code,{children:"runc"}),", ",(0,i.jsx)(n.code,{children:"runsc"})," or ",(0,i.jsx)(n.code,{children:"crun"}),".\nIn CoCo's case, the runtime is Kata Containers with added confidential computing capabilities."]}),"\n",(0,i.jsx)(n.h2,{id:"kata-containers",children:"Kata Containers"}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"https://katacontainers.io/",children:"Kata Containers"})," is an OCI runtime that runs pods in VMs.\nThe pod VM spawns an agent process that accepts management commands from the Kata runtime running on the host.\nThere are two options for creating pod VMs: local to the Kubernetes node, or remote VMs created with cloud provider APIs.\nUsing local VMs requires either bare-metal servers or VMs with support for nested virtualization.\nLocal VMs communicate with the host over a virtual socket.\nFor remote VMs, host-to-agent communication is tunnelled through the cloud provider's network."]}),"\n",(0,i.jsxs)(n.p,{children:["Kata Containers was originally designed to isolate the guest from the host, but it can also run pods in confidential VMs (CVMs) to shield pods from their underlying infrastructure.\nIn confidential mode, the guest agent is configured with an ",(0,i.jsx)(n.a,{href:"https://www.openpolicyagent.org/",children:"Open Policy Agent"})," (OPA) policy to authorize API calls from the host.\nThis policy also contains checksums for the expected container images.\nIt's derived from Kubernetes resource definitions and its checksum is included in the attestation report."]}),"\n",(0,i.jsx)(n.h2,{id:"aks-coco-preview",children:"AKS CoCo preview"}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/azure/aks/",children:"Azure Kubernetes Service"})," (AKS) provides CoCo-enabled node pools as a ",(0,i.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/azure/aks/confidential-containers-overview",children:"preview offering"}),".\nThese node pools leverage Azure VM types capable of nested virtualization (CVM-in-VM) and the CoCo stack is pre-installed.\nContrast can be deployed directly into a CoCo-enabled AKS cluster."]})]})}function h(e={}){const{wrapper:n}={...(0,o.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},28453:(e,n,t)=>{t.d(n,{R:()=>r,x:()=>a});var s=t(96540);const i={},o=s.createContext(i);function r(e){const n=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),s.createElement(o.Provider,{value:n},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/2130.a7c31b12.js b/pr-preview/pr-1071/assets/js/2130.a7c31b12.js
deleted file mode 100644
index edb87e73cd..0000000000
--- a/pr-preview/pr-1071/assets/js/2130.a7c31b12.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[2130],{22130:(e,t,r)=>{r.d(t,{default:()=>Ja});class a{constructor(e,t,r){this.lexer=void 0,this.start=void 0,this.end=void 0,this.lexer=e,this.start=t,this.end=r}static range(e,t){return t?e&&e.loc&&t.loc&&e.loc.lexer===t.loc.lexer?new a(e.loc.lexer,e.loc.start,t.loc.end):null:e&&e.loc}}class n{constructor(e,t){this.text=void 0,this.loc=void 0,this.noexpand=void 0,this.treatAsRelax=void 0,this.text=e,this.loc=t}range(e,t){return new n(t,a.range(this,e))}}class i{constructor(e,t){this.name=void 0,this.position=void 0,this.length=void 0,this.rawMessage=void 0;var r,a,n="KaTeX parse error: "+e,o=t&&t.loc;if(o&&o.start<=o.end){var s=o.lexer.input;r=o.start,a=o.end,r===s.length?n+=" at end of input: ":n+=" at position "+(r+1)+": ";var l=s.slice(r,a).replace(/[^]/g,"$&\u0332");n+=(r>15?"\u2026"+s.slice(r-15,r):s.slice(0,r))+l+(a+15":">","<":"<",'"':""","'":"'"},l=/[&><"']/g;var h=function e(t){return"ordgroup"===t.type||"color"===t.type?1===t.body.length?e(t.body[0]):t:"font"===t.type?e(t.body):t},m={contains:function(e,t){return-1!==e.indexOf(t)},deflt:function(e,t){return void 0===e?t:e},escape:function(e){return String(e).replace(l,(e=>s[e]))},hyphenate:function(e){return e.replace(o,"-$1").toLowerCase()},getBaseElem:h,isCharacterBox:function(e){var t=h(e);return"mathord"===t.type||"textord"===t.type||"atom"===t.type},protocolFromUrl:function(e){var t=/^[\x00-\x20]*([^\\/#?]*?)(:|�*58|�*3a|&colon)/i.exec(e);return t?":"!==t[2]?null:/^[a-zA-Z][a-zA-Z0-9+\-.]*$/.test(t[1])?t[1].toLowerCase():null:"_relative"}},c={displayMode:{type:"boolean",description:"Render math in display mode, which puts the math in display style (so \\int and \\sum are large, for example), and centers the math on the page on its own line.",cli:"-d, --display-mode"},output:{type:{enum:["htmlAndMathml","html","mathml"]},description:"Determines the markup language of the output.",cli:"-F, --format "},leqno:{type:"boolean",description:"Render display math in leqno style (left-justified tags)."},fleqn:{type:"boolean",description:"Render display math flush left."},throwOnError:{type:"boolean",default:!0,cli:"-t, --no-throw-on-error",cliDescription:"Render errors (in the color given by --error-color) instead of throwing a ParseError exception when encountering an error."},errorColor:{type:"string",default:"#cc0000",cli:"-c, --error-color ",cliDescription:"A color string given in the format 'rgb' or 'rrggbb' (no #). This option determines the color of errors rendered by the -t option.",cliProcessor:e=>"#"+e},macros:{type:"object",cli:"-m, --macro ",cliDescription:"Define custom macro of the form '\\foo:expansion' (use multiple -m arguments for multiple macros).",cliDefault:[],cliProcessor:(e,t)=>(t.push(e),t)},minRuleThickness:{type:"number",description:"Specifies a minimum thickness, in ems, for fraction lines, `\\sqrt` top lines, `{array}` vertical lines, `\\hline`, `\\hdashline`, `\\underline`, `\\overline`, and the borders of `\\fbox`, `\\boxed`, and `\\fcolorbox`.",processor:e=>Math.max(0,e),cli:"--min-rule-thickness ",cliProcessor:parseFloat},colorIsTextColor:{type:"boolean",description:"Makes \\color behave like LaTeX's 2-argument \\textcolor, instead of LaTeX's one-argument \\color mode change.",cli:"-b, --color-is-text-color"},strict:{type:[{enum:["warn","ignore","error"]},"boolean","function"],description:"Turn on strict / LaTeX faithfulness mode, which throws an error if the input uses features that are not supported by LaTeX.",cli:"-S, --strict",cliDefault:!1},trust:{type:["boolean","function"],description:"Trust the input, enabling all HTML features such as \\url.",cli:"-T, --trust"},maxSize:{type:"number",default:1/0,description:"If non-zero, all user-specified sizes, e.g. in \\rule{500em}{500em}, will be capped to maxSize ems. Otherwise, elements and spaces can be arbitrarily large",processor:e=>Math.max(0,e),cli:"-s, --max-size ",cliProcessor:parseInt},maxExpand:{type:"number",default:1e3,description:"Limit the number of macro expansions to the specified number, to prevent e.g. infinite macro loops. If set to Infinity, the macro expander will try to fully expand as in LaTeX.",processor:e=>Math.max(0,e),cli:"-e, --max-expand ",cliProcessor:e=>"Infinity"===e?1/0:parseInt(e)},globalGroup:{type:"boolean",cli:!1}};function p(e){if(e.default)return e.default;var t=e.type,r=Array.isArray(t)?t[0]:t;if("string"!=typeof r)return r.enum[0];switch(r){case"boolean":return!1;case"string":return"";case"number":return 0;case"object":return{}}}class u{constructor(e){for(var t in this.displayMode=void 0,this.output=void 0,this.leqno=void 0,this.fleqn=void 0,this.throwOnError=void 0,this.errorColor=void 0,this.macros=void 0,this.minRuleThickness=void 0,this.colorIsTextColor=void 0,this.strict=void 0,this.trust=void 0,this.maxSize=void 0,this.maxExpand=void 0,this.globalGroup=void 0,e=e||{},c)if(c.hasOwnProperty(t)){var r=c[t];this[t]=void 0!==e[t]?r.processor?r.processor(e[t]):e[t]:p(r)}}reportNonstrict(e,t,r){var a=this.strict;if("function"==typeof a&&(a=a(e,t,r)),a&&"ignore"!==a){if(!0===a||"error"===a)throw new i("LaTeX-incompatible input and strict mode is set to 'error': "+t+" ["+e+"]",r);"warn"===a?"undefined"!=typeof console&&console.warn("LaTeX-incompatible input and strict mode is set to 'warn': "+t+" ["+e+"]"):"undefined"!=typeof console&&console.warn("LaTeX-incompatible input and strict mode is set to unrecognized '"+a+"': "+t+" ["+e+"]")}}useStrictBehavior(e,t,r){var a=this.strict;if("function"==typeof a)try{a=a(e,t,r)}catch(n){a="error"}return!(!a||"ignore"===a)&&(!0===a||"error"===a||("warn"===a?("undefined"!=typeof console&&console.warn("LaTeX-incompatible input and strict mode is set to 'warn': "+t+" ["+e+"]"),!1):("undefined"!=typeof console&&console.warn("LaTeX-incompatible input and strict mode is set to unrecognized '"+a+"': "+t+" ["+e+"]"),!1)))}isTrusted(e){if(e.url&&!e.protocol){var t=m.protocolFromUrl(e.url);if(null==t)return!1;e.protocol=t}var r="function"==typeof this.trust?this.trust(e):this.trust;return Boolean(r)}}class d{constructor(e,t,r){this.id=void 0,this.size=void 0,this.cramped=void 0,this.id=e,this.size=t,this.cramped=r}sup(){return g[f[this.id]]}sub(){return g[v[this.id]]}fracNum(){return g[b[this.id]]}fracDen(){return g[y[this.id]]}cramp(){return g[x[this.id]]}text(){return g[w[this.id]]}isTight(){return this.size>=2}}var g=[new d(0,0,!1),new d(1,0,!0),new d(2,1,!1),new d(3,1,!0),new d(4,2,!1),new d(5,2,!0),new d(6,3,!1),new d(7,3,!0)],f=[4,5,4,5,6,7,6,7],v=[5,5,5,5,7,7,7,7],b=[2,3,4,5,6,7,6,7],y=[3,3,5,5,7,7,7,7],x=[1,1,3,3,5,5,7,7],w=[0,1,2,3,2,3,2,3],k={DISPLAY:g[0],TEXT:g[2],SCRIPT:g[4],SCRIPTSCRIPT:g[6]},S=[{name:"latin",blocks:[[256,591],[768,879]]},{name:"cyrillic",blocks:[[1024,1279]]},{name:"armenian",blocks:[[1328,1423]]},{name:"brahmic",blocks:[[2304,4255]]},{name:"georgian",blocks:[[4256,4351]]},{name:"cjk",blocks:[[12288,12543],[19968,40879],[65280,65376]]},{name:"hangul",blocks:[[44032,55215]]}];var M=[];function z(e){for(var t=0;t=M[t]&&e<=M[t+1])return!0;return!1}S.forEach((e=>e.blocks.forEach((e=>M.push(...e)))));var A=80,T={doubleleftarrow:"M262 157\nl10-10c34-36 62.7-77 86-123 3.3-8 5-13.3 5-16 0-5.3-6.7-8-20-8-7.3\n 0-12.2.5-14.5 1.5-2.3 1-4.8 4.5-7.5 10.5-49.3 97.3-121.7 169.3-217 216-28\n 14-57.3 25-88 33-6.7 2-11 3.8-13 5.5-2 1.7-3 4.2-3 7.5s1 5.8 3 7.5\nc2 1.7 6.3 3.5 13 5.5 68 17.3 128.2 47.8 180.5 91.5 52.3 43.7 93.8 96.2 124.5\n 157.5 9.3 8 15.3 12.3 18 13h6c12-.7 18-4 18-10 0-2-1.7-7-5-15-23.3-46-52-87\n-86-123l-10-10h399738v-40H218c328 0 0 0 0 0l-10-8c-26.7-20-65.7-43-117-69 2.7\n-2 6-3.7 10-5 36.7-16 72.3-37.3 107-64l10-8h399782v-40z\nm8 0v40h399730v-40zm0 194v40h399730v-40z",doublerightarrow:"M399738 392l\n-10 10c-34 36-62.7 77-86 123-3.3 8-5 13.3-5 16 0 5.3 6.7 8 20 8 7.3 0 12.2-.5\n 14.5-1.5 2.3-1 4.8-4.5 7.5-10.5 49.3-97.3 121.7-169.3 217-216 28-14 57.3-25 88\n-33 6.7-2 11-3.8 13-5.5 2-1.7 3-4.2 3-7.5s-1-5.8-3-7.5c-2-1.7-6.3-3.5-13-5.5-68\n-17.3-128.2-47.8-180.5-91.5-52.3-43.7-93.8-96.2-124.5-157.5-9.3-8-15.3-12.3-18\n-13h-6c-12 .7-18 4-18 10 0 2 1.7 7 5 15 23.3 46 52 87 86 123l10 10H0v40h399782\nc-328 0 0 0 0 0l10 8c26.7 20 65.7 43 117 69-2.7 2-6 3.7-10 5-36.7 16-72.3 37.3\n-107 64l-10 8H0v40zM0 157v40h399730v-40zm0 194v40h399730v-40z",leftarrow:"M400000 241H110l3-3c68.7-52.7 113.7-120\n 135-202 4-14.7 6-23 6-25 0-7.3-7-11-21-11-8 0-13.2.8-15.5 2.5-2.3 1.7-4.2 5.8\n-5.5 12.5-1.3 4.7-2.7 10.3-4 17-12 48.7-34.8 92-68.5 130S65.3 228.3 18 247\nc-10 4-16 7.7-18 11 0 8.7 6 14.3 18 17 47.3 18.7 87.8 47 121.5 85S196 441.3 208\n 490c.7 2 1.3 5 2 9s1.2 6.7 1.5 8c.3 1.3 1 3.3 2 6s2.2 4.5 3.5 5.5c1.3 1 3.3\n 1.8 6 2.5s6 1 10 1c14 0 21-3.7 21-11 0-2-2-10.3-6-25-20-79.3-65-146.7-135-202\n l-3-3h399890zM100 241v40h399900v-40z",leftbrace:"M6 548l-6-6v-35l6-11c56-104 135.3-181.3 238-232 57.3-28.7 117\n-45 179-50h399577v120H403c-43.3 7-81 15-113 26-100.7 33-179.7 91-237 174-2.7\n 5-6 9-10 13-.7 1-7.3 1-20 1H6z",leftbraceunder:"M0 6l6-6h17c12.688 0 19.313.3 20 1 4 4 7.313 8.3 10 13\n 35.313 51.3 80.813 93.8 136.5 127.5 55.688 33.7 117.188 55.8 184.5 66.5.688\n 0 2 .3 4 1 18.688 2.7 76 4.3 172 5h399450v120H429l-6-1c-124.688-8-235-61.7\n-331-161C60.687 138.7 32.312 99.3 7 54L0 41V6z",leftgroup:"M400000 80\nH435C64 80 168.3 229.4 21 260c-5.9 1.2-18 0-18 0-2 0-3-1-3-3v-38C76 61 257 0\n 435 0h399565z",leftgroupunder:"M400000 262\nH435C64 262 168.3 112.6 21 82c-5.9-1.2-18 0-18 0-2 0-3 1-3 3v38c76 158 257 219\n 435 219h399565z",leftharpoon:"M0 267c.7 5.3 3 10 7 14h399993v-40H93c3.3\n-3.3 10.2-9.5 20.5-18.5s17.8-15.8 22.5-20.5c50.7-52 88-110.3 112-175 4-11.3 5\n-18.3 3-21-1.3-4-7.3-6-18-6-8 0-13 .7-15 2s-4.7 6.7-8 16c-42 98.7-107.3 174.7\n-196 228-6.7 4.7-10.7 8-12 10-1.3 2-2 5.7-2 11zm100-26v40h399900v-40z",leftharpoonplus:"M0 267c.7 5.3 3 10 7 14h399993v-40H93c3.3-3.3 10.2-9.5\n 20.5-18.5s17.8-15.8 22.5-20.5c50.7-52 88-110.3 112-175 4-11.3 5-18.3 3-21-1.3\n-4-7.3-6-18-6-8 0-13 .7-15 2s-4.7 6.7-8 16c-42 98.7-107.3 174.7-196 228-6.7 4.7\n-10.7 8-12 10-1.3 2-2 5.7-2 11zm100-26v40h399900v-40zM0 435v40h400000v-40z\nm0 0v40h400000v-40z",leftharpoondown:"M7 241c-4 4-6.333 8.667-7 14 0 5.333.667 9 2 11s5.333\n 5.333 12 10c90.667 54 156 130 196 228 3.333 10.667 6.333 16.333 9 17 2 .667 5\n 1 9 1h5c10.667 0 16.667-2 18-6 2-2.667 1-9.667-3-21-32-87.333-82.667-157.667\n-152-211l-3-3h399907v-40zM93 281 H400000 v-40L7 241z",leftharpoondownplus:"M7 435c-4 4-6.3 8.7-7 14 0 5.3.7 9 2 11s5.3 5.3 12\n 10c90.7 54 156 130 196 228 3.3 10.7 6.3 16.3 9 17 2 .7 5 1 9 1h5c10.7 0 16.7\n-2 18-6 2-2.7 1-9.7-3-21-32-87.3-82.7-157.7-152-211l-3-3h399907v-40H7zm93 0\nv40h399900v-40zM0 241v40h399900v-40zm0 0v40h399900v-40z",lefthook:"M400000 281 H103s-33-11.2-61-33.5S0 197.3 0 164s14.2-61.2 42.5\n-83.5C70.8 58.2 104 47 142 47 c16.7 0 25 6.7 25 20 0 12-8.7 18.7-26 20-40 3.3\n-68.7 15.7-86 37-10 12-15 25.3-15 40 0 22.7 9.8 40.7 29.5 54 19.7 13.3 43.5 21\n 71.5 23h399859zM103 281v-40h399897v40z",leftlinesegment:"M40 281 V428 H0 V94 H40 V241 H400000 v40z\nM40 281 V428 H0 V94 H40 V241 H400000 v40z",leftmapsto:"M40 281 V448H0V74H40V241H400000v40z\nM40 281 V448H0V74H40V241H400000v40z",leftToFrom:"M0 147h400000v40H0zm0 214c68 40 115.7 95.7 143 167h22c15.3 0 23\n-.3 23-1 0-1.3-5.3-13.7-16-37-18-35.3-41.3-69-70-101l-7-8h399905v-40H95l7-8\nc28.7-32 52-65.7 70-101 10.7-23.3 16-35.7 16-37 0-.7-7.7-1-23-1h-22C115.7 265.3\n 68 321 0 361zm0-174v-40h399900v40zm100 154v40h399900v-40z",longequal:"M0 50 h400000 v40H0z m0 194h40000v40H0z\nM0 50 h400000 v40H0z m0 194h40000v40H0z",midbrace:"M200428 334\nc-100.7-8.3-195.3-44-280-108-55.3-42-101.7-93-139-153l-9-14c-2.7 4-5.7 8.7-9 14\n-53.3 86.7-123.7 153-211 199-66.7 36-137.3 56.3-212 62H0V214h199568c178.3-11.7\n 311.7-78.3 403-201 6-8 9.7-12 11-12 .7-.7 6.7-1 18-1s17.3.3 18 1c1.3 0 5 4 11\n 12 44.7 59.3 101.3 106.3 170 141s145.3 54.3 229 60h199572v120z",midbraceunder:"M199572 214\nc100.7 8.3 195.3 44 280 108 55.3 42 101.7 93 139 153l9 14c2.7-4 5.7-8.7 9-14\n 53.3-86.7 123.7-153 211-199 66.7-36 137.3-56.3 212-62h199568v120H200432c-178.3\n 11.7-311.7 78.3-403 201-6 8-9.7 12-11 12-.7.7-6.7 1-18 1s-17.3-.3-18-1c-1.3 0\n-5-4-11-12-44.7-59.3-101.3-106.3-170-141s-145.3-54.3-229-60H0V214z",oiintSize1:"M512.6 71.6c272.6 0 320.3 106.8 320.3 178.2 0 70.8-47.7 177.6\n-320.3 177.6S193.1 320.6 193.1 249.8c0-71.4 46.9-178.2 319.5-178.2z\nm368.1 178.2c0-86.4-60.9-215.4-368.1-215.4-306.4 0-367.3 129-367.3 215.4 0 85.8\n60.9 214.8 367.3 214.8 307.2 0 368.1-129 368.1-214.8z",oiintSize2:"M757.8 100.1c384.7 0 451.1 137.6 451.1 230 0 91.3-66.4 228.8\n-451.1 228.8-386.3 0-452.7-137.5-452.7-228.8 0-92.4 66.4-230 452.7-230z\nm502.4 230c0-111.2-82.4-277.2-502.4-277.2s-504 166-504 277.2\nc0 110 84 276 504 276s502.4-166 502.4-276z",oiiintSize1:"M681.4 71.6c408.9 0 480.5 106.8 480.5 178.2 0 70.8-71.6 177.6\n-480.5 177.6S202.1 320.6 202.1 249.8c0-71.4 70.5-178.2 479.3-178.2z\nm525.8 178.2c0-86.4-86.8-215.4-525.7-215.4-437.9 0-524.7 129-524.7 215.4 0\n85.8 86.8 214.8 524.7 214.8 438.9 0 525.7-129 525.7-214.8z",oiiintSize2:"M1021.2 53c603.6 0 707.8 165.8 707.8 277.2 0 110-104.2 275.8\n-707.8 275.8-606 0-710.2-165.8-710.2-275.8C311 218.8 415.2 53 1021.2 53z\nm770.4 277.1c0-131.2-126.4-327.6-770.5-327.6S248.4 198.9 248.4 330.1\nc0 130 128.8 326.4 772.7 326.4s770.5-196.4 770.5-326.4z",rightarrow:"M0 241v40h399891c-47.3 35.3-84 78-110 128\n-16.7 32-27.7 63.7-33 95 0 1.3-.2 2.7-.5 4-.3 1.3-.5 2.3-.5 3 0 7.3 6.7 11 20\n 11 8 0 13.2-.8 15.5-2.5 2.3-1.7 4.2-5.5 5.5-11.5 2-13.3 5.7-27 11-41 14.7-44.7\n 39-84.5 73-119.5s73.7-60.2 119-75.5c6-2 9-5.7 9-11s-3-9-9-11c-45.3-15.3-85\n-40.5-119-75.5s-58.3-74.8-73-119.5c-4.7-14-8.3-27.3-11-40-1.3-6.7-3.2-10.8-5.5\n-12.5-2.3-1.7-7.5-2.5-15.5-2.5-14 0-21 3.7-21 11 0 2 2 10.3 6 25 20.7 83.3 67\n 151.7 139 205zm0 0v40h399900v-40z",rightbrace:"M400000 542l\n-6 6h-17c-12.7 0-19.3-.3-20-1-4-4-7.3-8.3-10-13-35.3-51.3-80.8-93.8-136.5-127.5\ns-117.2-55.8-184.5-66.5c-.7 0-2-.3-4-1-18.7-2.7-76-4.3-172-5H0V214h399571l6 1\nc124.7 8 235 61.7 331 161 31.3 33.3 59.7 72.7 85 118l7 13v35z",rightbraceunder:"M399994 0l6 6v35l-6 11c-56 104-135.3 181.3-238 232-57.3\n 28.7-117 45-179 50H-300V214h399897c43.3-7 81-15 113-26 100.7-33 179.7-91 237\n-174 2.7-5 6-9 10-13 .7-1 7.3-1 20-1h17z",rightgroup:"M0 80h399565c371 0 266.7 149.4 414 180 5.9 1.2 18 0 18 0 2 0\n 3-1 3-3v-38c-76-158-257-219-435-219H0z",rightgroupunder:"M0 262h399565c371 0 266.7-149.4 414-180 5.9-1.2 18 0 18\n 0 2 0 3 1 3 3v38c-76 158-257 219-435 219H0z",rightharpoon:"M0 241v40h399993c4.7-4.7 7-9.3 7-14 0-9.3\n-3.7-15.3-11-18-92.7-56.7-159-133.7-199-231-3.3-9.3-6-14.7-8-16-2-1.3-7-2-15-2\n-10.7 0-16.7 2-18 6-2 2.7-1 9.7 3 21 15.3 42 36.7 81.8 64 119.5 27.3 37.7 58\n 69.2 92 94.5zm0 0v40h399900v-40z",rightharpoonplus:"M0 241v40h399993c4.7-4.7 7-9.3 7-14 0-9.3-3.7-15.3-11\n-18-92.7-56.7-159-133.7-199-231-3.3-9.3-6-14.7-8-16-2-1.3-7-2-15-2-10.7 0-16.7\n 2-18 6-2 2.7-1 9.7 3 21 15.3 42 36.7 81.8 64 119.5 27.3 37.7 58 69.2 92 94.5z\nm0 0v40h399900v-40z m100 194v40h399900v-40zm0 0v40h399900v-40z",rightharpoondown:"M399747 511c0 7.3 6.7 11 20 11 8 0 13-.8 15-2.5s4.7-6.8\n 8-15.5c40-94 99.3-166.3 178-217 13.3-8 20.3-12.3 21-13 5.3-3.3 8.5-5.8 9.5\n-7.5 1-1.7 1.5-5.2 1.5-10.5s-2.3-10.3-7-15H0v40h399908c-34 25.3-64.7 57-92 95\n-27.3 38-48.7 77.7-64 119-3.3 8.7-5 14-5 16zM0 241v40h399900v-40z",rightharpoondownplus:"M399747 705c0 7.3 6.7 11 20 11 8 0 13-.8\n 15-2.5s4.7-6.8 8-15.5c40-94 99.3-166.3 178-217 13.3-8 20.3-12.3 21-13 5.3-3.3\n 8.5-5.8 9.5-7.5 1-1.7 1.5-5.2 1.5-10.5s-2.3-10.3-7-15H0v40h399908c-34 25.3\n-64.7 57-92 95-27.3 38-48.7 77.7-64 119-3.3 8.7-5 14-5 16zM0 435v40h399900v-40z\nm0-194v40h400000v-40zm0 0v40h400000v-40z",righthook:"M399859 241c-764 0 0 0 0 0 40-3.3 68.7-15.7 86-37 10-12 15-25.3\n 15-40 0-22.7-9.8-40.7-29.5-54-19.7-13.3-43.5-21-71.5-23-17.3-1.3-26-8-26-20 0\n-13.3 8.7-20 26-20 38 0 71 11.2 99 33.5 0 0 7 5.6 21 16.7 14 11.2 21 33.5 21\n 66.8s-14 61.2-42 83.5c-28 22.3-61 33.5-99 33.5L0 241z M0 281v-40h399859v40z",rightlinesegment:"M399960 241 V94 h40 V428 h-40 V281 H0 v-40z\nM399960 241 V94 h40 V428 h-40 V281 H0 v-40z",rightToFrom:"M400000 167c-70.7-42-118-97.7-142-167h-23c-15.3 0-23 .3-23\n 1 0 1.3 5.3 13.7 16 37 18 35.3 41.3 69 70 101l7 8H0v40h399905l-7 8c-28.7 32\n-52 65.7-70 101-10.7 23.3-16 35.7-16 37 0 .7 7.7 1 23 1h23c24-69.3 71.3-125 142\n-167z M100 147v40h399900v-40zM0 341v40h399900v-40z",twoheadleftarrow:"M0 167c68 40\n 115.7 95.7 143 167h22c15.3 0 23-.3 23-1 0-1.3-5.3-13.7-16-37-18-35.3-41.3-69\n-70-101l-7-8h125l9 7c50.7 39.3 85 86 103 140h46c0-4.7-6.3-18.7-19-42-18-35.3\n-40-67.3-66-96l-9-9h399716v-40H284l9-9c26-28.7 48-60.7 66-96 12.7-23.333 19\n-37.333 19-42h-46c-18 54-52.3 100.7-103 140l-9 7H95l7-8c28.7-32 52-65.7 70-101\n 10.7-23.333 16-35.7 16-37 0-.7-7.7-1-23-1h-22C115.7 71.3 68 127 0 167z",twoheadrightarrow:"M400000 167\nc-68-40-115.7-95.7-143-167h-22c-15.3 0-23 .3-23 1 0 1.3 5.3 13.7 16 37 18 35.3\n 41.3 69 70 101l7 8h-125l-9-7c-50.7-39.3-85-86-103-140h-46c0 4.7 6.3 18.7 19 42\n 18 35.3 40 67.3 66 96l9 9H0v40h399716l-9 9c-26 28.7-48 60.7-66 96-12.7 23.333\n-19 37.333-19 42h46c18-54 52.3-100.7 103-140l9-7h125l-7 8c-28.7 32-52 65.7-70\n 101-10.7 23.333-16 35.7-16 37 0 .7 7.7 1 23 1h22c27.3-71.3 75-127 143-167z",tilde1:"M200 55.538c-77 0-168 73.953-177 73.953-3 0-7\n-2.175-9-5.437L2 97c-1-2-2-4-2-6 0-4 2-7 5-9l20-12C116 12 171 0 207 0c86 0\n 114 68 191 68 78 0 168-68 177-68 4 0 7 2 9 5l12 19c1 2.175 2 4.35 2 6.525 0\n 4.35-2 7.613-5 9.788l-19 13.05c-92 63.077-116.937 75.308-183 76.128\n-68.267.847-113-73.952-191-73.952z",tilde2:"M344 55.266c-142 0-300.638 81.316-311.5 86.418\n-8.01 3.762-22.5 10.91-23.5 5.562L1 120c-1-2-1-3-1-4 0-5 3-9 8-10l18.4-9C160.9\n 31.9 283 0 358 0c148 0 188 122 331 122s314-97 326-97c4 0 8 2 10 7l7 21.114\nc1 2.14 1 3.21 1 4.28 0 5.347-3 9.626-7 10.696l-22.3 12.622C852.6 158.372 751\n 181.476 676 181.476c-149 0-189-126.21-332-126.21z",tilde3:"M786 59C457 59 32 175.242 13 175.242c-6 0-10-3.457\n-11-10.37L.15 138c-1-7 3-12 10-13l19.2-6.4C378.4 40.7 634.3 0 804.3 0c337 0\n 411.8 157 746.8 157 328 0 754-112 773-112 5 0 10 3 11 9l1 14.075c1 8.066-.697\n 16.595-6.697 17.492l-21.052 7.31c-367.9 98.146-609.15 122.696-778.15 122.696\n -338 0-409-156.573-744-156.573z",tilde4:"M786 58C457 58 32 177.487 13 177.487c-6 0-10-3.345\n-11-10.035L.15 143c-1-7 3-12 10-13l22-6.7C381.2 35 637.15 0 807.15 0c337 0 409\n 177 744 177 328 0 754-127 773-127 5 0 10 3 11 9l1 14.794c1 7.805-3 13.38-9\n 14.495l-20.7 5.574c-366.85 99.79-607.3 139.372-776.3 139.372-338 0-409\n -175.236-744-175.236z",vec:"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",widehat1:"M529 0h5l519 115c5 1 9 5 9 10 0 1-1 2-1 3l-4 22\nc-1 5-5 9-11 9h-2L532 67 19 159h-2c-5 0-9-4-11-9l-5-22c-1-6 2-12 8-13z",widehat2:"M1181 0h2l1171 176c6 0 10 5 10 11l-2 23c-1 6-5 10\n-11 10h-1L1182 67 15 220h-1c-6 0-10-4-11-10l-2-23c-1-6 4-11 10-11z",widehat3:"M1181 0h2l1171 236c6 0 10 5 10 11l-2 23c-1 6-5 10\n-11 10h-1L1182 67 15 280h-1c-6 0-10-4-11-10l-2-23c-1-6 4-11 10-11z",widehat4:"M1181 0h2l1171 296c6 0 10 5 10 11l-2 23c-1 6-5 10\n-11 10h-1L1182 67 15 340h-1c-6 0-10-4-11-10l-2-23c-1-6 4-11 10-11z",widecheck1:"M529,159h5l519,-115c5,-1,9,-5,9,-10c0,-1,-1,-2,-1,-3l-4,-22c-1,\n-5,-5,-9,-11,-9h-2l-512,92l-513,-92h-2c-5,0,-9,4,-11,9l-5,22c-1,6,2,12,8,13z",widecheck2:"M1181,220h2l1171,-176c6,0,10,-5,10,-11l-2,-23c-1,-6,-5,-10,\n-11,-10h-1l-1168,153l-1167,-153h-1c-6,0,-10,4,-11,10l-2,23c-1,6,4,11,10,11z",widecheck3:"M1181,280h2l1171,-236c6,0,10,-5,10,-11l-2,-23c-1,-6,-5,-10,\n-11,-10h-1l-1168,213l-1167,-213h-1c-6,0,-10,4,-11,10l-2,23c-1,6,4,11,10,11z",widecheck4:"M1181,340h2l1171,-296c6,0,10,-5,10,-11l-2,-23c-1,-6,-5,-10,\n-11,-10h-1l-1168,273l-1167,-273h-1c-6,0,-10,4,-11,10l-2,23c-1,6,4,11,10,11z",baraboveleftarrow:"M400000 620h-399890l3 -3c68.7 -52.7 113.7 -120 135 -202\nc4 -14.7 6 -23 6 -25c0 -7.3 -7 -11 -21 -11c-8 0 -13.2 0.8 -15.5 2.5\nc-2.3 1.7 -4.2 5.8 -5.5 12.5c-1.3 4.7 -2.7 10.3 -4 17c-12 48.7 -34.8 92 -68.5 130\ns-74.2 66.3 -121.5 85c-10 4 -16 7.7 -18 11c0 8.7 6 14.3 18 17c47.3 18.7 87.8 47\n121.5 85s56.5 81.3 68.5 130c0.7 2 1.3 5 2 9s1.2 6.7 1.5 8c0.3 1.3 1 3.3 2 6\ns2.2 4.5 3.5 5.5c1.3 1 3.3 1.8 6 2.5s6 1 10 1c14 0 21 -3.7 21 -11\nc0 -2 -2 -10.3 -6 -25c-20 -79.3 -65 -146.7 -135 -202l-3 -3h399890z\nM100 620v40h399900v-40z M0 241v40h399900v-40zM0 241v40h399900v-40z",rightarrowabovebar:"M0 241v40h399891c-47.3 35.3-84 78-110 128-16.7 32\n-27.7 63.7-33 95 0 1.3-.2 2.7-.5 4-.3 1.3-.5 2.3-.5 3 0 7.3 6.7 11 20 11 8 0\n13.2-.8 15.5-2.5 2.3-1.7 4.2-5.5 5.5-11.5 2-13.3 5.7-27 11-41 14.7-44.7 39\n-84.5 73-119.5s73.7-60.2 119-75.5c6-2 9-5.7 9-11s-3-9-9-11c-45.3-15.3-85-40.5\n-119-75.5s-58.3-74.8-73-119.5c-4.7-14-8.3-27.3-11-40-1.3-6.7-3.2-10.8-5.5\n-12.5-2.3-1.7-7.5-2.5-15.5-2.5-14 0-21 3.7-21 11 0 2 2 10.3 6 25 20.7 83.3 67\n151.7 139 205zm96 379h399894v40H0zm0 0h399904v40H0z",baraboveshortleftharpoon:"M507,435c-4,4,-6.3,8.7,-7,14c0,5.3,0.7,9,2,11\nc1.3,2,5.3,5.3,12,10c90.7,54,156,130,196,228c3.3,10.7,6.3,16.3,9,17\nc2,0.7,5,1,9,1c0,0,5,0,5,0c10.7,0,16.7,-2,18,-6c2,-2.7,1,-9.7,-3,-21\nc-32,-87.3,-82.7,-157.7,-152,-211c0,0,-3,-3,-3,-3l399351,0l0,-40\nc-398570,0,-399437,0,-399437,0z M593 435 v40 H399500 v-40z\nM0 281 v-40 H399908 v40z M0 281 v-40 H399908 v40z",rightharpoonaboveshortbar:"M0,241 l0,40c399126,0,399993,0,399993,0\nc4.7,-4.7,7,-9.3,7,-14c0,-9.3,-3.7,-15.3,-11,-18c-92.7,-56.7,-159,-133.7,-199,\n-231c-3.3,-9.3,-6,-14.7,-8,-16c-2,-1.3,-7,-2,-15,-2c-10.7,0,-16.7,2,-18,6\nc-2,2.7,-1,9.7,3,21c15.3,42,36.7,81.8,64,119.5c27.3,37.7,58,69.2,92,94.5z\nM0 241 v40 H399908 v-40z M0 475 v-40 H399500 v40z M0 475 v-40 H399500 v40z",shortbaraboveleftharpoon:"M7,435c-4,4,-6.3,8.7,-7,14c0,5.3,0.7,9,2,11\nc1.3,2,5.3,5.3,12,10c90.7,54,156,130,196,228c3.3,10.7,6.3,16.3,9,17c2,0.7,5,1,9,\n1c0,0,5,0,5,0c10.7,0,16.7,-2,18,-6c2,-2.7,1,-9.7,-3,-21c-32,-87.3,-82.7,-157.7,\n-152,-211c0,0,-3,-3,-3,-3l399907,0l0,-40c-399126,0,-399993,0,-399993,0z\nM93 435 v40 H400000 v-40z M500 241 v40 H400000 v-40z M500 241 v40 H400000 v-40z",shortrightharpoonabovebar:"M53,241l0,40c398570,0,399437,0,399437,0\nc4.7,-4.7,7,-9.3,7,-14c0,-9.3,-3.7,-15.3,-11,-18c-92.7,-56.7,-159,-133.7,-199,\n-231c-3.3,-9.3,-6,-14.7,-8,-16c-2,-1.3,-7,-2,-15,-2c-10.7,0,-16.7,2,-18,6\nc-2,2.7,-1,9.7,3,21c15.3,42,36.7,81.8,64,119.5c27.3,37.7,58,69.2,92,94.5z\nM500 241 v40 H399408 v-40z M500 435 v40 H400000 v-40z"};class B{constructor(e){this.children=void 0,this.classes=void 0,this.height=void 0,this.depth=void 0,this.maxFontSize=void 0,this.style=void 0,this.children=e,this.classes=[],this.height=0,this.depth=0,this.maxFontSize=0,this.style={}}hasClass(e){return m.contains(this.classes,e)}toNode(){for(var e=document.createDocumentFragment(),t=0;te.toText())).join("")}}var C={"AMS-Regular":{32:[0,0,0,0,.25],65:[0,.68889,0,0,.72222],66:[0,.68889,0,0,.66667],67:[0,.68889,0,0,.72222],68:[0,.68889,0,0,.72222],69:[0,.68889,0,0,.66667],70:[0,.68889,0,0,.61111],71:[0,.68889,0,0,.77778],72:[0,.68889,0,0,.77778],73:[0,.68889,0,0,.38889],74:[.16667,.68889,0,0,.5],75:[0,.68889,0,0,.77778],76:[0,.68889,0,0,.66667],77:[0,.68889,0,0,.94445],78:[0,.68889,0,0,.72222],79:[.16667,.68889,0,0,.77778],80:[0,.68889,0,0,.61111],81:[.16667,.68889,0,0,.77778],82:[0,.68889,0,0,.72222],83:[0,.68889,0,0,.55556],84:[0,.68889,0,0,.66667],85:[0,.68889,0,0,.72222],86:[0,.68889,0,0,.72222],87:[0,.68889,0,0,1],88:[0,.68889,0,0,.72222],89:[0,.68889,0,0,.72222],90:[0,.68889,0,0,.66667],107:[0,.68889,0,0,.55556],160:[0,0,0,0,.25],165:[0,.675,.025,0,.75],174:[.15559,.69224,0,0,.94666],240:[0,.68889,0,0,.55556],295:[0,.68889,0,0,.54028],710:[0,.825,0,0,2.33334],732:[0,.9,0,0,2.33334],770:[0,.825,0,0,2.33334],771:[0,.9,0,0,2.33334],989:[.08167,.58167,0,0,.77778],1008:[0,.43056,.04028,0,.66667],8245:[0,.54986,0,0,.275],8463:[0,.68889,0,0,.54028],8487:[0,.68889,0,0,.72222],8498:[0,.68889,0,0,.55556],8502:[0,.68889,0,0,.66667],8503:[0,.68889,0,0,.44445],8504:[0,.68889,0,0,.66667],8513:[0,.68889,0,0,.63889],8592:[-.03598,.46402,0,0,.5],8594:[-.03598,.46402,0,0,.5],8602:[-.13313,.36687,0,0,1],8603:[-.13313,.36687,0,0,1],8606:[.01354,.52239,0,0,1],8608:[.01354,.52239,0,0,1],8610:[.01354,.52239,0,0,1.11111],8611:[.01354,.52239,0,0,1.11111],8619:[0,.54986,0,0,1],8620:[0,.54986,0,0,1],8621:[-.13313,.37788,0,0,1.38889],8622:[-.13313,.36687,0,0,1],8624:[0,.69224,0,0,.5],8625:[0,.69224,0,0,.5],8630:[0,.43056,0,0,1],8631:[0,.43056,0,0,1],8634:[.08198,.58198,0,0,.77778],8635:[.08198,.58198,0,0,.77778],8638:[.19444,.69224,0,0,.41667],8639:[.19444,.69224,0,0,.41667],8642:[.19444,.69224,0,0,.41667],8643:[.19444,.69224,0,0,.41667],8644:[.1808,.675,0,0,1],8646:[.1808,.675,0,0,1],8647:[.1808,.675,0,0,1],8648:[.19444,.69224,0,0,.83334],8649:[.1808,.675,0,0,1],8650:[.19444,.69224,0,0,.83334],8651:[.01354,.52239,0,0,1],8652:[.01354,.52239,0,0,1],8653:[-.13313,.36687,0,0,1],8654:[-.13313,.36687,0,0,1],8655:[-.13313,.36687,0,0,1],8666:[.13667,.63667,0,0,1],8667:[.13667,.63667,0,0,1],8669:[-.13313,.37788,0,0,1],8672:[-.064,.437,0,0,1.334],8674:[-.064,.437,0,0,1.334],8705:[0,.825,0,0,.5],8708:[0,.68889,0,0,.55556],8709:[.08167,.58167,0,0,.77778],8717:[0,.43056,0,0,.42917],8722:[-.03598,.46402,0,0,.5],8724:[.08198,.69224,0,0,.77778],8726:[.08167,.58167,0,0,.77778],8733:[0,.69224,0,0,.77778],8736:[0,.69224,0,0,.72222],8737:[0,.69224,0,0,.72222],8738:[.03517,.52239,0,0,.72222],8739:[.08167,.58167,0,0,.22222],8740:[.25142,.74111,0,0,.27778],8741:[.08167,.58167,0,0,.38889],8742:[.25142,.74111,0,0,.5],8756:[0,.69224,0,0,.66667],8757:[0,.69224,0,0,.66667],8764:[-.13313,.36687,0,0,.77778],8765:[-.13313,.37788,0,0,.77778],8769:[-.13313,.36687,0,0,.77778],8770:[-.03625,.46375,0,0,.77778],8774:[.30274,.79383,0,0,.77778],8776:[-.01688,.48312,0,0,.77778],8778:[.08167,.58167,0,0,.77778],8782:[.06062,.54986,0,0,.77778],8783:[.06062,.54986,0,0,.77778],8785:[.08198,.58198,0,0,.77778],8786:[.08198,.58198,0,0,.77778],8787:[.08198,.58198,0,0,.77778],8790:[0,.69224,0,0,.77778],8791:[.22958,.72958,0,0,.77778],8796:[.08198,.91667,0,0,.77778],8806:[.25583,.75583,0,0,.77778],8807:[.25583,.75583,0,0,.77778],8808:[.25142,.75726,0,0,.77778],8809:[.25142,.75726,0,0,.77778],8812:[.25583,.75583,0,0,.5],8814:[.20576,.70576,0,0,.77778],8815:[.20576,.70576,0,0,.77778],8816:[.30274,.79383,0,0,.77778],8817:[.30274,.79383,0,0,.77778],8818:[.22958,.72958,0,0,.77778],8819:[.22958,.72958,0,0,.77778],8822:[.1808,.675,0,0,.77778],8823:[.1808,.675,0,0,.77778],8828:[.13667,.63667,0,0,.77778],8829:[.13667,.63667,0,0,.77778],8830:[.22958,.72958,0,0,.77778],8831:[.22958,.72958,0,0,.77778],8832:[.20576,.70576,0,0,.77778],8833:[.20576,.70576,0,0,.77778],8840:[.30274,.79383,0,0,.77778],8841:[.30274,.79383,0,0,.77778],8842:[.13597,.63597,0,0,.77778],8843:[.13597,.63597,0,0,.77778],8847:[.03517,.54986,0,0,.77778],8848:[.03517,.54986,0,0,.77778],8858:[.08198,.58198,0,0,.77778],8859:[.08198,.58198,0,0,.77778],8861:[.08198,.58198,0,0,.77778],8862:[0,.675,0,0,.77778],8863:[0,.675,0,0,.77778],8864:[0,.675,0,0,.77778],8865:[0,.675,0,0,.77778],8872:[0,.69224,0,0,.61111],8873:[0,.69224,0,0,.72222],8874:[0,.69224,0,0,.88889],8876:[0,.68889,0,0,.61111],8877:[0,.68889,0,0,.61111],8878:[0,.68889,0,0,.72222],8879:[0,.68889,0,0,.72222],8882:[.03517,.54986,0,0,.77778],8883:[.03517,.54986,0,0,.77778],8884:[.13667,.63667,0,0,.77778],8885:[.13667,.63667,0,0,.77778],8888:[0,.54986,0,0,1.11111],8890:[.19444,.43056,0,0,.55556],8891:[.19444,.69224,0,0,.61111],8892:[.19444,.69224,0,0,.61111],8901:[0,.54986,0,0,.27778],8903:[.08167,.58167,0,0,.77778],8905:[.08167,.58167,0,0,.77778],8906:[.08167,.58167,0,0,.77778],8907:[0,.69224,0,0,.77778],8908:[0,.69224,0,0,.77778],8909:[-.03598,.46402,0,0,.77778],8910:[0,.54986,0,0,.76042],8911:[0,.54986,0,0,.76042],8912:[.03517,.54986,0,0,.77778],8913:[.03517,.54986,0,0,.77778],8914:[0,.54986,0,0,.66667],8915:[0,.54986,0,0,.66667],8916:[0,.69224,0,0,.66667],8918:[.0391,.5391,0,0,.77778],8919:[.0391,.5391,0,0,.77778],8920:[.03517,.54986,0,0,1.33334],8921:[.03517,.54986,0,0,1.33334],8922:[.38569,.88569,0,0,.77778],8923:[.38569,.88569,0,0,.77778],8926:[.13667,.63667,0,0,.77778],8927:[.13667,.63667,0,0,.77778],8928:[.30274,.79383,0,0,.77778],8929:[.30274,.79383,0,0,.77778],8934:[.23222,.74111,0,0,.77778],8935:[.23222,.74111,0,0,.77778],8936:[.23222,.74111,0,0,.77778],8937:[.23222,.74111,0,0,.77778],8938:[.20576,.70576,0,0,.77778],8939:[.20576,.70576,0,0,.77778],8940:[.30274,.79383,0,0,.77778],8941:[.30274,.79383,0,0,.77778],8994:[.19444,.69224,0,0,.77778],8995:[.19444,.69224,0,0,.77778],9416:[.15559,.69224,0,0,.90222],9484:[0,.69224,0,0,.5],9488:[0,.69224,0,0,.5],9492:[0,.37788,0,0,.5],9496:[0,.37788,0,0,.5],9585:[.19444,.68889,0,0,.88889],9586:[.19444,.74111,0,0,.88889],9632:[0,.675,0,0,.77778],9633:[0,.675,0,0,.77778],9650:[0,.54986,0,0,.72222],9651:[0,.54986,0,0,.72222],9654:[.03517,.54986,0,0,.77778],9660:[0,.54986,0,0,.72222],9661:[0,.54986,0,0,.72222],9664:[.03517,.54986,0,0,.77778],9674:[.11111,.69224,0,0,.66667],9733:[.19444,.69224,0,0,.94445],10003:[0,.69224,0,0,.83334],10016:[0,.69224,0,0,.83334],10731:[.11111,.69224,0,0,.66667],10846:[.19444,.75583,0,0,.61111],10877:[.13667,.63667,0,0,.77778],10878:[.13667,.63667,0,0,.77778],10885:[.25583,.75583,0,0,.77778],10886:[.25583,.75583,0,0,.77778],10887:[.13597,.63597,0,0,.77778],10888:[.13597,.63597,0,0,.77778],10889:[.26167,.75726,0,0,.77778],10890:[.26167,.75726,0,0,.77778],10891:[.48256,.98256,0,0,.77778],10892:[.48256,.98256,0,0,.77778],10901:[.13667,.63667,0,0,.77778],10902:[.13667,.63667,0,0,.77778],10933:[.25142,.75726,0,0,.77778],10934:[.25142,.75726,0,0,.77778],10935:[.26167,.75726,0,0,.77778],10936:[.26167,.75726,0,0,.77778],10937:[.26167,.75726,0,0,.77778],10938:[.26167,.75726,0,0,.77778],10949:[.25583,.75583,0,0,.77778],10950:[.25583,.75583,0,0,.77778],10955:[.28481,.79383,0,0,.77778],10956:[.28481,.79383,0,0,.77778],57350:[.08167,.58167,0,0,.22222],57351:[.08167,.58167,0,0,.38889],57352:[.08167,.58167,0,0,.77778],57353:[0,.43056,.04028,0,.66667],57356:[.25142,.75726,0,0,.77778],57357:[.25142,.75726,0,0,.77778],57358:[.41951,.91951,0,0,.77778],57359:[.30274,.79383,0,0,.77778],57360:[.30274,.79383,0,0,.77778],57361:[.41951,.91951,0,0,.77778],57366:[.25142,.75726,0,0,.77778],57367:[.25142,.75726,0,0,.77778],57368:[.25142,.75726,0,0,.77778],57369:[.25142,.75726,0,0,.77778],57370:[.13597,.63597,0,0,.77778],57371:[.13597,.63597,0,0,.77778]},"Caligraphic-Regular":{32:[0,0,0,0,.25],65:[0,.68333,0,.19445,.79847],66:[0,.68333,.03041,.13889,.65681],67:[0,.68333,.05834,.13889,.52653],68:[0,.68333,.02778,.08334,.77139],69:[0,.68333,.08944,.11111,.52778],70:[0,.68333,.09931,.11111,.71875],71:[.09722,.68333,.0593,.11111,.59487],72:[0,.68333,.00965,.11111,.84452],73:[0,.68333,.07382,0,.54452],74:[.09722,.68333,.18472,.16667,.67778],75:[0,.68333,.01445,.05556,.76195],76:[0,.68333,0,.13889,.68972],77:[0,.68333,0,.13889,1.2009],78:[0,.68333,.14736,.08334,.82049],79:[0,.68333,.02778,.11111,.79611],80:[0,.68333,.08222,.08334,.69556],81:[.09722,.68333,0,.11111,.81667],82:[0,.68333,0,.08334,.8475],83:[0,.68333,.075,.13889,.60556],84:[0,.68333,.25417,0,.54464],85:[0,.68333,.09931,.08334,.62583],86:[0,.68333,.08222,0,.61278],87:[0,.68333,.08222,.08334,.98778],88:[0,.68333,.14643,.13889,.7133],89:[.09722,.68333,.08222,.08334,.66834],90:[0,.68333,.07944,.13889,.72473],160:[0,0,0,0,.25]},"Fraktur-Regular":{32:[0,0,0,0,.25],33:[0,.69141,0,0,.29574],34:[0,.69141,0,0,.21471],38:[0,.69141,0,0,.73786],39:[0,.69141,0,0,.21201],40:[.24982,.74947,0,0,.38865],41:[.24982,.74947,0,0,.38865],42:[0,.62119,0,0,.27764],43:[.08319,.58283,0,0,.75623],44:[0,.10803,0,0,.27764],45:[.08319,.58283,0,0,.75623],46:[0,.10803,0,0,.27764],47:[.24982,.74947,0,0,.50181],48:[0,.47534,0,0,.50181],49:[0,.47534,0,0,.50181],50:[0,.47534,0,0,.50181],51:[.18906,.47534,0,0,.50181],52:[.18906,.47534,0,0,.50181],53:[.18906,.47534,0,0,.50181],54:[0,.69141,0,0,.50181],55:[.18906,.47534,0,0,.50181],56:[0,.69141,0,0,.50181],57:[.18906,.47534,0,0,.50181],58:[0,.47534,0,0,.21606],59:[.12604,.47534,0,0,.21606],61:[-.13099,.36866,0,0,.75623],63:[0,.69141,0,0,.36245],65:[0,.69141,0,0,.7176],66:[0,.69141,0,0,.88397],67:[0,.69141,0,0,.61254],68:[0,.69141,0,0,.83158],69:[0,.69141,0,0,.66278],70:[.12604,.69141,0,0,.61119],71:[0,.69141,0,0,.78539],72:[.06302,.69141,0,0,.7203],73:[0,.69141,0,0,.55448],74:[.12604,.69141,0,0,.55231],75:[0,.69141,0,0,.66845],76:[0,.69141,0,0,.66602],77:[0,.69141,0,0,1.04953],78:[0,.69141,0,0,.83212],79:[0,.69141,0,0,.82699],80:[.18906,.69141,0,0,.82753],81:[.03781,.69141,0,0,.82699],82:[0,.69141,0,0,.82807],83:[0,.69141,0,0,.82861],84:[0,.69141,0,0,.66899],85:[0,.69141,0,0,.64576],86:[0,.69141,0,0,.83131],87:[0,.69141,0,0,1.04602],88:[0,.69141,0,0,.71922],89:[.18906,.69141,0,0,.83293],90:[.12604,.69141,0,0,.60201],91:[.24982,.74947,0,0,.27764],93:[.24982,.74947,0,0,.27764],94:[0,.69141,0,0,.49965],97:[0,.47534,0,0,.50046],98:[0,.69141,0,0,.51315],99:[0,.47534,0,0,.38946],100:[0,.62119,0,0,.49857],101:[0,.47534,0,0,.40053],102:[.18906,.69141,0,0,.32626],103:[.18906,.47534,0,0,.5037],104:[.18906,.69141,0,0,.52126],105:[0,.69141,0,0,.27899],106:[0,.69141,0,0,.28088],107:[0,.69141,0,0,.38946],108:[0,.69141,0,0,.27953],109:[0,.47534,0,0,.76676],110:[0,.47534,0,0,.52666],111:[0,.47534,0,0,.48885],112:[.18906,.52396,0,0,.50046],113:[.18906,.47534,0,0,.48912],114:[0,.47534,0,0,.38919],115:[0,.47534,0,0,.44266],116:[0,.62119,0,0,.33301],117:[0,.47534,0,0,.5172],118:[0,.52396,0,0,.5118],119:[0,.52396,0,0,.77351],120:[.18906,.47534,0,0,.38865],121:[.18906,.47534,0,0,.49884],122:[.18906,.47534,0,0,.39054],160:[0,0,0,0,.25],8216:[0,.69141,0,0,.21471],8217:[0,.69141,0,0,.21471],58112:[0,.62119,0,0,.49749],58113:[0,.62119,0,0,.4983],58114:[.18906,.69141,0,0,.33328],58115:[.18906,.69141,0,0,.32923],58116:[.18906,.47534,0,0,.50343],58117:[0,.69141,0,0,.33301],58118:[0,.62119,0,0,.33409],58119:[0,.47534,0,0,.50073]},"Main-Bold":{32:[0,0,0,0,.25],33:[0,.69444,0,0,.35],34:[0,.69444,0,0,.60278],35:[.19444,.69444,0,0,.95833],36:[.05556,.75,0,0,.575],37:[.05556,.75,0,0,.95833],38:[0,.69444,0,0,.89444],39:[0,.69444,0,0,.31944],40:[.25,.75,0,0,.44722],41:[.25,.75,0,0,.44722],42:[0,.75,0,0,.575],43:[.13333,.63333,0,0,.89444],44:[.19444,.15556,0,0,.31944],45:[0,.44444,0,0,.38333],46:[0,.15556,0,0,.31944],47:[.25,.75,0,0,.575],48:[0,.64444,0,0,.575],49:[0,.64444,0,0,.575],50:[0,.64444,0,0,.575],51:[0,.64444,0,0,.575],52:[0,.64444,0,0,.575],53:[0,.64444,0,0,.575],54:[0,.64444,0,0,.575],55:[0,.64444,0,0,.575],56:[0,.64444,0,0,.575],57:[0,.64444,0,0,.575],58:[0,.44444,0,0,.31944],59:[.19444,.44444,0,0,.31944],60:[.08556,.58556,0,0,.89444],61:[-.10889,.39111,0,0,.89444],62:[.08556,.58556,0,0,.89444],63:[0,.69444,0,0,.54305],64:[0,.69444,0,0,.89444],65:[0,.68611,0,0,.86944],66:[0,.68611,0,0,.81805],67:[0,.68611,0,0,.83055],68:[0,.68611,0,0,.88194],69:[0,.68611,0,0,.75555],70:[0,.68611,0,0,.72361],71:[0,.68611,0,0,.90416],72:[0,.68611,0,0,.9],73:[0,.68611,0,0,.43611],74:[0,.68611,0,0,.59444],75:[0,.68611,0,0,.90138],76:[0,.68611,0,0,.69166],77:[0,.68611,0,0,1.09166],78:[0,.68611,0,0,.9],79:[0,.68611,0,0,.86388],80:[0,.68611,0,0,.78611],81:[.19444,.68611,0,0,.86388],82:[0,.68611,0,0,.8625],83:[0,.68611,0,0,.63889],84:[0,.68611,0,0,.8],85:[0,.68611,0,0,.88472],86:[0,.68611,.01597,0,.86944],87:[0,.68611,.01597,0,1.18888],88:[0,.68611,0,0,.86944],89:[0,.68611,.02875,0,.86944],90:[0,.68611,0,0,.70277],91:[.25,.75,0,0,.31944],92:[.25,.75,0,0,.575],93:[.25,.75,0,0,.31944],94:[0,.69444,0,0,.575],95:[.31,.13444,.03194,0,.575],97:[0,.44444,0,0,.55902],98:[0,.69444,0,0,.63889],99:[0,.44444,0,0,.51111],100:[0,.69444,0,0,.63889],101:[0,.44444,0,0,.52708],102:[0,.69444,.10903,0,.35139],103:[.19444,.44444,.01597,0,.575],104:[0,.69444,0,0,.63889],105:[0,.69444,0,0,.31944],106:[.19444,.69444,0,0,.35139],107:[0,.69444,0,0,.60694],108:[0,.69444,0,0,.31944],109:[0,.44444,0,0,.95833],110:[0,.44444,0,0,.63889],111:[0,.44444,0,0,.575],112:[.19444,.44444,0,0,.63889],113:[.19444,.44444,0,0,.60694],114:[0,.44444,0,0,.47361],115:[0,.44444,0,0,.45361],116:[0,.63492,0,0,.44722],117:[0,.44444,0,0,.63889],118:[0,.44444,.01597,0,.60694],119:[0,.44444,.01597,0,.83055],120:[0,.44444,0,0,.60694],121:[.19444,.44444,.01597,0,.60694],122:[0,.44444,0,0,.51111],123:[.25,.75,0,0,.575],124:[.25,.75,0,0,.31944],125:[.25,.75,0,0,.575],126:[.35,.34444,0,0,.575],160:[0,0,0,0,.25],163:[0,.69444,0,0,.86853],168:[0,.69444,0,0,.575],172:[0,.44444,0,0,.76666],176:[0,.69444,0,0,.86944],177:[.13333,.63333,0,0,.89444],184:[.17014,0,0,0,.51111],198:[0,.68611,0,0,1.04166],215:[.13333,.63333,0,0,.89444],216:[.04861,.73472,0,0,.89444],223:[0,.69444,0,0,.59722],230:[0,.44444,0,0,.83055],247:[.13333,.63333,0,0,.89444],248:[.09722,.54167,0,0,.575],305:[0,.44444,0,0,.31944],338:[0,.68611,0,0,1.16944],339:[0,.44444,0,0,.89444],567:[.19444,.44444,0,0,.35139],710:[0,.69444,0,0,.575],711:[0,.63194,0,0,.575],713:[0,.59611,0,0,.575],714:[0,.69444,0,0,.575],715:[0,.69444,0,0,.575],728:[0,.69444,0,0,.575],729:[0,.69444,0,0,.31944],730:[0,.69444,0,0,.86944],732:[0,.69444,0,0,.575],733:[0,.69444,0,0,.575],915:[0,.68611,0,0,.69166],916:[0,.68611,0,0,.95833],920:[0,.68611,0,0,.89444],923:[0,.68611,0,0,.80555],926:[0,.68611,0,0,.76666],928:[0,.68611,0,0,.9],931:[0,.68611,0,0,.83055],933:[0,.68611,0,0,.89444],934:[0,.68611,0,0,.83055],936:[0,.68611,0,0,.89444],937:[0,.68611,0,0,.83055],8211:[0,.44444,.03194,0,.575],8212:[0,.44444,.03194,0,1.14999],8216:[0,.69444,0,0,.31944],8217:[0,.69444,0,0,.31944],8220:[0,.69444,0,0,.60278],8221:[0,.69444,0,0,.60278],8224:[.19444,.69444,0,0,.51111],8225:[.19444,.69444,0,0,.51111],8242:[0,.55556,0,0,.34444],8407:[0,.72444,.15486,0,.575],8463:[0,.69444,0,0,.66759],8465:[0,.69444,0,0,.83055],8467:[0,.69444,0,0,.47361],8472:[.19444,.44444,0,0,.74027],8476:[0,.69444,0,0,.83055],8501:[0,.69444,0,0,.70277],8592:[-.10889,.39111,0,0,1.14999],8593:[.19444,.69444,0,0,.575],8594:[-.10889,.39111,0,0,1.14999],8595:[.19444,.69444,0,0,.575],8596:[-.10889,.39111,0,0,1.14999],8597:[.25,.75,0,0,.575],8598:[.19444,.69444,0,0,1.14999],8599:[.19444,.69444,0,0,1.14999],8600:[.19444,.69444,0,0,1.14999],8601:[.19444,.69444,0,0,1.14999],8636:[-.10889,.39111,0,0,1.14999],8637:[-.10889,.39111,0,0,1.14999],8640:[-.10889,.39111,0,0,1.14999],8641:[-.10889,.39111,0,0,1.14999],8656:[-.10889,.39111,0,0,1.14999],8657:[.19444,.69444,0,0,.70277],8658:[-.10889,.39111,0,0,1.14999],8659:[.19444,.69444,0,0,.70277],8660:[-.10889,.39111,0,0,1.14999],8661:[.25,.75,0,0,.70277],8704:[0,.69444,0,0,.63889],8706:[0,.69444,.06389,0,.62847],8707:[0,.69444,0,0,.63889],8709:[.05556,.75,0,0,.575],8711:[0,.68611,0,0,.95833],8712:[.08556,.58556,0,0,.76666],8715:[.08556,.58556,0,0,.76666],8722:[.13333,.63333,0,0,.89444],8723:[.13333,.63333,0,0,.89444],8725:[.25,.75,0,0,.575],8726:[.25,.75,0,0,.575],8727:[-.02778,.47222,0,0,.575],8728:[-.02639,.47361,0,0,.575],8729:[-.02639,.47361,0,0,.575],8730:[.18,.82,0,0,.95833],8733:[0,.44444,0,0,.89444],8734:[0,.44444,0,0,1.14999],8736:[0,.69224,0,0,.72222],8739:[.25,.75,0,0,.31944],8741:[.25,.75,0,0,.575],8743:[0,.55556,0,0,.76666],8744:[0,.55556,0,0,.76666],8745:[0,.55556,0,0,.76666],8746:[0,.55556,0,0,.76666],8747:[.19444,.69444,.12778,0,.56875],8764:[-.10889,.39111,0,0,.89444],8768:[.19444,.69444,0,0,.31944],8771:[.00222,.50222,0,0,.89444],8773:[.027,.638,0,0,.894],8776:[.02444,.52444,0,0,.89444],8781:[.00222,.50222,0,0,.89444],8801:[.00222,.50222,0,0,.89444],8804:[.19667,.69667,0,0,.89444],8805:[.19667,.69667,0,0,.89444],8810:[.08556,.58556,0,0,1.14999],8811:[.08556,.58556,0,0,1.14999],8826:[.08556,.58556,0,0,.89444],8827:[.08556,.58556,0,0,.89444],8834:[.08556,.58556,0,0,.89444],8835:[.08556,.58556,0,0,.89444],8838:[.19667,.69667,0,0,.89444],8839:[.19667,.69667,0,0,.89444],8846:[0,.55556,0,0,.76666],8849:[.19667,.69667,0,0,.89444],8850:[.19667,.69667,0,0,.89444],8851:[0,.55556,0,0,.76666],8852:[0,.55556,0,0,.76666],8853:[.13333,.63333,0,0,.89444],8854:[.13333,.63333,0,0,.89444],8855:[.13333,.63333,0,0,.89444],8856:[.13333,.63333,0,0,.89444],8857:[.13333,.63333,0,0,.89444],8866:[0,.69444,0,0,.70277],8867:[0,.69444,0,0,.70277],8868:[0,.69444,0,0,.89444],8869:[0,.69444,0,0,.89444],8900:[-.02639,.47361,0,0,.575],8901:[-.02639,.47361,0,0,.31944],8902:[-.02778,.47222,0,0,.575],8968:[.25,.75,0,0,.51111],8969:[.25,.75,0,0,.51111],8970:[.25,.75,0,0,.51111],8971:[.25,.75,0,0,.51111],8994:[-.13889,.36111,0,0,1.14999],8995:[-.13889,.36111,0,0,1.14999],9651:[.19444,.69444,0,0,1.02222],9657:[-.02778,.47222,0,0,.575],9661:[.19444,.69444,0,0,1.02222],9667:[-.02778,.47222,0,0,.575],9711:[.19444,.69444,0,0,1.14999],9824:[.12963,.69444,0,0,.89444],9825:[.12963,.69444,0,0,.89444],9826:[.12963,.69444,0,0,.89444],9827:[.12963,.69444,0,0,.89444],9837:[0,.75,0,0,.44722],9838:[.19444,.69444,0,0,.44722],9839:[.19444,.69444,0,0,.44722],10216:[.25,.75,0,0,.44722],10217:[.25,.75,0,0,.44722],10815:[0,.68611,0,0,.9],10927:[.19667,.69667,0,0,.89444],10928:[.19667,.69667,0,0,.89444],57376:[.19444,.69444,0,0,0]},"Main-BoldItalic":{32:[0,0,0,0,.25],33:[0,.69444,.11417,0,.38611],34:[0,.69444,.07939,0,.62055],35:[.19444,.69444,.06833,0,.94444],37:[.05556,.75,.12861,0,.94444],38:[0,.69444,.08528,0,.88555],39:[0,.69444,.12945,0,.35555],40:[.25,.75,.15806,0,.47333],41:[.25,.75,.03306,0,.47333],42:[0,.75,.14333,0,.59111],43:[.10333,.60333,.03306,0,.88555],44:[.19444,.14722,0,0,.35555],45:[0,.44444,.02611,0,.41444],46:[0,.14722,0,0,.35555],47:[.25,.75,.15806,0,.59111],48:[0,.64444,.13167,0,.59111],49:[0,.64444,.13167,0,.59111],50:[0,.64444,.13167,0,.59111],51:[0,.64444,.13167,0,.59111],52:[.19444,.64444,.13167,0,.59111],53:[0,.64444,.13167,0,.59111],54:[0,.64444,.13167,0,.59111],55:[.19444,.64444,.13167,0,.59111],56:[0,.64444,.13167,0,.59111],57:[0,.64444,.13167,0,.59111],58:[0,.44444,.06695,0,.35555],59:[.19444,.44444,.06695,0,.35555],61:[-.10889,.39111,.06833,0,.88555],63:[0,.69444,.11472,0,.59111],64:[0,.69444,.09208,0,.88555],65:[0,.68611,0,0,.86555],66:[0,.68611,.0992,0,.81666],67:[0,.68611,.14208,0,.82666],68:[0,.68611,.09062,0,.87555],69:[0,.68611,.11431,0,.75666],70:[0,.68611,.12903,0,.72722],71:[0,.68611,.07347,0,.89527],72:[0,.68611,.17208,0,.8961],73:[0,.68611,.15681,0,.47166],74:[0,.68611,.145,0,.61055],75:[0,.68611,.14208,0,.89499],76:[0,.68611,0,0,.69777],77:[0,.68611,.17208,0,1.07277],78:[0,.68611,.17208,0,.8961],79:[0,.68611,.09062,0,.85499],80:[0,.68611,.0992,0,.78721],81:[.19444,.68611,.09062,0,.85499],82:[0,.68611,.02559,0,.85944],83:[0,.68611,.11264,0,.64999],84:[0,.68611,.12903,0,.7961],85:[0,.68611,.17208,0,.88083],86:[0,.68611,.18625,0,.86555],87:[0,.68611,.18625,0,1.15999],88:[0,.68611,.15681,0,.86555],89:[0,.68611,.19803,0,.86555],90:[0,.68611,.14208,0,.70888],91:[.25,.75,.1875,0,.35611],93:[.25,.75,.09972,0,.35611],94:[0,.69444,.06709,0,.59111],95:[.31,.13444,.09811,0,.59111],97:[0,.44444,.09426,0,.59111],98:[0,.69444,.07861,0,.53222],99:[0,.44444,.05222,0,.53222],100:[0,.69444,.10861,0,.59111],101:[0,.44444,.085,0,.53222],102:[.19444,.69444,.21778,0,.4],103:[.19444,.44444,.105,0,.53222],104:[0,.69444,.09426,0,.59111],105:[0,.69326,.11387,0,.35555],106:[.19444,.69326,.1672,0,.35555],107:[0,.69444,.11111,0,.53222],108:[0,.69444,.10861,0,.29666],109:[0,.44444,.09426,0,.94444],110:[0,.44444,.09426,0,.64999],111:[0,.44444,.07861,0,.59111],112:[.19444,.44444,.07861,0,.59111],113:[.19444,.44444,.105,0,.53222],114:[0,.44444,.11111,0,.50167],115:[0,.44444,.08167,0,.48694],116:[0,.63492,.09639,0,.385],117:[0,.44444,.09426,0,.62055],118:[0,.44444,.11111,0,.53222],119:[0,.44444,.11111,0,.76777],120:[0,.44444,.12583,0,.56055],121:[.19444,.44444,.105,0,.56166],122:[0,.44444,.13889,0,.49055],126:[.35,.34444,.11472,0,.59111],160:[0,0,0,0,.25],168:[0,.69444,.11473,0,.59111],176:[0,.69444,0,0,.94888],184:[.17014,0,0,0,.53222],198:[0,.68611,.11431,0,1.02277],216:[.04861,.73472,.09062,0,.88555],223:[.19444,.69444,.09736,0,.665],230:[0,.44444,.085,0,.82666],248:[.09722,.54167,.09458,0,.59111],305:[0,.44444,.09426,0,.35555],338:[0,.68611,.11431,0,1.14054],339:[0,.44444,.085,0,.82666],567:[.19444,.44444,.04611,0,.385],710:[0,.69444,.06709,0,.59111],711:[0,.63194,.08271,0,.59111],713:[0,.59444,.10444,0,.59111],714:[0,.69444,.08528,0,.59111],715:[0,.69444,0,0,.59111],728:[0,.69444,.10333,0,.59111],729:[0,.69444,.12945,0,.35555],730:[0,.69444,0,0,.94888],732:[0,.69444,.11472,0,.59111],733:[0,.69444,.11472,0,.59111],915:[0,.68611,.12903,0,.69777],916:[0,.68611,0,0,.94444],920:[0,.68611,.09062,0,.88555],923:[0,.68611,0,0,.80666],926:[0,.68611,.15092,0,.76777],928:[0,.68611,.17208,0,.8961],931:[0,.68611,.11431,0,.82666],933:[0,.68611,.10778,0,.88555],934:[0,.68611,.05632,0,.82666],936:[0,.68611,.10778,0,.88555],937:[0,.68611,.0992,0,.82666],8211:[0,.44444,.09811,0,.59111],8212:[0,.44444,.09811,0,1.18221],8216:[0,.69444,.12945,0,.35555],8217:[0,.69444,.12945,0,.35555],8220:[0,.69444,.16772,0,.62055],8221:[0,.69444,.07939,0,.62055]},"Main-Italic":{32:[0,0,0,0,.25],33:[0,.69444,.12417,0,.30667],34:[0,.69444,.06961,0,.51444],35:[.19444,.69444,.06616,0,.81777],37:[.05556,.75,.13639,0,.81777],38:[0,.69444,.09694,0,.76666],39:[0,.69444,.12417,0,.30667],40:[.25,.75,.16194,0,.40889],41:[.25,.75,.03694,0,.40889],42:[0,.75,.14917,0,.51111],43:[.05667,.56167,.03694,0,.76666],44:[.19444,.10556,0,0,.30667],45:[0,.43056,.02826,0,.35778],46:[0,.10556,0,0,.30667],47:[.25,.75,.16194,0,.51111],48:[0,.64444,.13556,0,.51111],49:[0,.64444,.13556,0,.51111],50:[0,.64444,.13556,0,.51111],51:[0,.64444,.13556,0,.51111],52:[.19444,.64444,.13556,0,.51111],53:[0,.64444,.13556,0,.51111],54:[0,.64444,.13556,0,.51111],55:[.19444,.64444,.13556,0,.51111],56:[0,.64444,.13556,0,.51111],57:[0,.64444,.13556,0,.51111],58:[0,.43056,.0582,0,.30667],59:[.19444,.43056,.0582,0,.30667],61:[-.13313,.36687,.06616,0,.76666],63:[0,.69444,.1225,0,.51111],64:[0,.69444,.09597,0,.76666],65:[0,.68333,0,0,.74333],66:[0,.68333,.10257,0,.70389],67:[0,.68333,.14528,0,.71555],68:[0,.68333,.09403,0,.755],69:[0,.68333,.12028,0,.67833],70:[0,.68333,.13305,0,.65277],71:[0,.68333,.08722,0,.77361],72:[0,.68333,.16389,0,.74333],73:[0,.68333,.15806,0,.38555],74:[0,.68333,.14028,0,.525],75:[0,.68333,.14528,0,.76888],76:[0,.68333,0,0,.62722],77:[0,.68333,.16389,0,.89666],78:[0,.68333,.16389,0,.74333],79:[0,.68333,.09403,0,.76666],80:[0,.68333,.10257,0,.67833],81:[.19444,.68333,.09403,0,.76666],82:[0,.68333,.03868,0,.72944],83:[0,.68333,.11972,0,.56222],84:[0,.68333,.13305,0,.71555],85:[0,.68333,.16389,0,.74333],86:[0,.68333,.18361,0,.74333],87:[0,.68333,.18361,0,.99888],88:[0,.68333,.15806,0,.74333],89:[0,.68333,.19383,0,.74333],90:[0,.68333,.14528,0,.61333],91:[.25,.75,.1875,0,.30667],93:[.25,.75,.10528,0,.30667],94:[0,.69444,.06646,0,.51111],95:[.31,.12056,.09208,0,.51111],97:[0,.43056,.07671,0,.51111],98:[0,.69444,.06312,0,.46],99:[0,.43056,.05653,0,.46],100:[0,.69444,.10333,0,.51111],101:[0,.43056,.07514,0,.46],102:[.19444,.69444,.21194,0,.30667],103:[.19444,.43056,.08847,0,.46],104:[0,.69444,.07671,0,.51111],105:[0,.65536,.1019,0,.30667],106:[.19444,.65536,.14467,0,.30667],107:[0,.69444,.10764,0,.46],108:[0,.69444,.10333,0,.25555],109:[0,.43056,.07671,0,.81777],110:[0,.43056,.07671,0,.56222],111:[0,.43056,.06312,0,.51111],112:[.19444,.43056,.06312,0,.51111],113:[.19444,.43056,.08847,0,.46],114:[0,.43056,.10764,0,.42166],115:[0,.43056,.08208,0,.40889],116:[0,.61508,.09486,0,.33222],117:[0,.43056,.07671,0,.53666],118:[0,.43056,.10764,0,.46],119:[0,.43056,.10764,0,.66444],120:[0,.43056,.12042,0,.46389],121:[.19444,.43056,.08847,0,.48555],122:[0,.43056,.12292,0,.40889],126:[.35,.31786,.11585,0,.51111],160:[0,0,0,0,.25],168:[0,.66786,.10474,0,.51111],176:[0,.69444,0,0,.83129],184:[.17014,0,0,0,.46],198:[0,.68333,.12028,0,.88277],216:[.04861,.73194,.09403,0,.76666],223:[.19444,.69444,.10514,0,.53666],230:[0,.43056,.07514,0,.71555],248:[.09722,.52778,.09194,0,.51111],338:[0,.68333,.12028,0,.98499],339:[0,.43056,.07514,0,.71555],710:[0,.69444,.06646,0,.51111],711:[0,.62847,.08295,0,.51111],713:[0,.56167,.10333,0,.51111],714:[0,.69444,.09694,0,.51111],715:[0,.69444,0,0,.51111],728:[0,.69444,.10806,0,.51111],729:[0,.66786,.11752,0,.30667],730:[0,.69444,0,0,.83129],732:[0,.66786,.11585,0,.51111],733:[0,.69444,.1225,0,.51111],915:[0,.68333,.13305,0,.62722],916:[0,.68333,0,0,.81777],920:[0,.68333,.09403,0,.76666],923:[0,.68333,0,0,.69222],926:[0,.68333,.15294,0,.66444],928:[0,.68333,.16389,0,.74333],931:[0,.68333,.12028,0,.71555],933:[0,.68333,.11111,0,.76666],934:[0,.68333,.05986,0,.71555],936:[0,.68333,.11111,0,.76666],937:[0,.68333,.10257,0,.71555],8211:[0,.43056,.09208,0,.51111],8212:[0,.43056,.09208,0,1.02222],8216:[0,.69444,.12417,0,.30667],8217:[0,.69444,.12417,0,.30667],8220:[0,.69444,.1685,0,.51444],8221:[0,.69444,.06961,0,.51444],8463:[0,.68889,0,0,.54028]},"Main-Regular":{32:[0,0,0,0,.25],33:[0,.69444,0,0,.27778],34:[0,.69444,0,0,.5],35:[.19444,.69444,0,0,.83334],36:[.05556,.75,0,0,.5],37:[.05556,.75,0,0,.83334],38:[0,.69444,0,0,.77778],39:[0,.69444,0,0,.27778],40:[.25,.75,0,0,.38889],41:[.25,.75,0,0,.38889],42:[0,.75,0,0,.5],43:[.08333,.58333,0,0,.77778],44:[.19444,.10556,0,0,.27778],45:[0,.43056,0,0,.33333],46:[0,.10556,0,0,.27778],47:[.25,.75,0,0,.5],48:[0,.64444,0,0,.5],49:[0,.64444,0,0,.5],50:[0,.64444,0,0,.5],51:[0,.64444,0,0,.5],52:[0,.64444,0,0,.5],53:[0,.64444,0,0,.5],54:[0,.64444,0,0,.5],55:[0,.64444,0,0,.5],56:[0,.64444,0,0,.5],57:[0,.64444,0,0,.5],58:[0,.43056,0,0,.27778],59:[.19444,.43056,0,0,.27778],60:[.0391,.5391,0,0,.77778],61:[-.13313,.36687,0,0,.77778],62:[.0391,.5391,0,0,.77778],63:[0,.69444,0,0,.47222],64:[0,.69444,0,0,.77778],65:[0,.68333,0,0,.75],66:[0,.68333,0,0,.70834],67:[0,.68333,0,0,.72222],68:[0,.68333,0,0,.76389],69:[0,.68333,0,0,.68056],70:[0,.68333,0,0,.65278],71:[0,.68333,0,0,.78472],72:[0,.68333,0,0,.75],73:[0,.68333,0,0,.36111],74:[0,.68333,0,0,.51389],75:[0,.68333,0,0,.77778],76:[0,.68333,0,0,.625],77:[0,.68333,0,0,.91667],78:[0,.68333,0,0,.75],79:[0,.68333,0,0,.77778],80:[0,.68333,0,0,.68056],81:[.19444,.68333,0,0,.77778],82:[0,.68333,0,0,.73611],83:[0,.68333,0,0,.55556],84:[0,.68333,0,0,.72222],85:[0,.68333,0,0,.75],86:[0,.68333,.01389,0,.75],87:[0,.68333,.01389,0,1.02778],88:[0,.68333,0,0,.75],89:[0,.68333,.025,0,.75],90:[0,.68333,0,0,.61111],91:[.25,.75,0,0,.27778],92:[.25,.75,0,0,.5],93:[.25,.75,0,0,.27778],94:[0,.69444,0,0,.5],95:[.31,.12056,.02778,0,.5],97:[0,.43056,0,0,.5],98:[0,.69444,0,0,.55556],99:[0,.43056,0,0,.44445],100:[0,.69444,0,0,.55556],101:[0,.43056,0,0,.44445],102:[0,.69444,.07778,0,.30556],103:[.19444,.43056,.01389,0,.5],104:[0,.69444,0,0,.55556],105:[0,.66786,0,0,.27778],106:[.19444,.66786,0,0,.30556],107:[0,.69444,0,0,.52778],108:[0,.69444,0,0,.27778],109:[0,.43056,0,0,.83334],110:[0,.43056,0,0,.55556],111:[0,.43056,0,0,.5],112:[.19444,.43056,0,0,.55556],113:[.19444,.43056,0,0,.52778],114:[0,.43056,0,0,.39167],115:[0,.43056,0,0,.39445],116:[0,.61508,0,0,.38889],117:[0,.43056,0,0,.55556],118:[0,.43056,.01389,0,.52778],119:[0,.43056,.01389,0,.72222],120:[0,.43056,0,0,.52778],121:[.19444,.43056,.01389,0,.52778],122:[0,.43056,0,0,.44445],123:[.25,.75,0,0,.5],124:[.25,.75,0,0,.27778],125:[.25,.75,0,0,.5],126:[.35,.31786,0,0,.5],160:[0,0,0,0,.25],163:[0,.69444,0,0,.76909],167:[.19444,.69444,0,0,.44445],168:[0,.66786,0,0,.5],172:[0,.43056,0,0,.66667],176:[0,.69444,0,0,.75],177:[.08333,.58333,0,0,.77778],182:[.19444,.69444,0,0,.61111],184:[.17014,0,0,0,.44445],198:[0,.68333,0,0,.90278],215:[.08333,.58333,0,0,.77778],216:[.04861,.73194,0,0,.77778],223:[0,.69444,0,0,.5],230:[0,.43056,0,0,.72222],247:[.08333,.58333,0,0,.77778],248:[.09722,.52778,0,0,.5],305:[0,.43056,0,0,.27778],338:[0,.68333,0,0,1.01389],339:[0,.43056,0,0,.77778],567:[.19444,.43056,0,0,.30556],710:[0,.69444,0,0,.5],711:[0,.62847,0,0,.5],713:[0,.56778,0,0,.5],714:[0,.69444,0,0,.5],715:[0,.69444,0,0,.5],728:[0,.69444,0,0,.5],729:[0,.66786,0,0,.27778],730:[0,.69444,0,0,.75],732:[0,.66786,0,0,.5],733:[0,.69444,0,0,.5],915:[0,.68333,0,0,.625],916:[0,.68333,0,0,.83334],920:[0,.68333,0,0,.77778],923:[0,.68333,0,0,.69445],926:[0,.68333,0,0,.66667],928:[0,.68333,0,0,.75],931:[0,.68333,0,0,.72222],933:[0,.68333,0,0,.77778],934:[0,.68333,0,0,.72222],936:[0,.68333,0,0,.77778],937:[0,.68333,0,0,.72222],8211:[0,.43056,.02778,0,.5],8212:[0,.43056,.02778,0,1],8216:[0,.69444,0,0,.27778],8217:[0,.69444,0,0,.27778],8220:[0,.69444,0,0,.5],8221:[0,.69444,0,0,.5],8224:[.19444,.69444,0,0,.44445],8225:[.19444,.69444,0,0,.44445],8230:[0,.123,0,0,1.172],8242:[0,.55556,0,0,.275],8407:[0,.71444,.15382,0,.5],8463:[0,.68889,0,0,.54028],8465:[0,.69444,0,0,.72222],8467:[0,.69444,0,.11111,.41667],8472:[.19444,.43056,0,.11111,.63646],8476:[0,.69444,0,0,.72222],8501:[0,.69444,0,0,.61111],8592:[-.13313,.36687,0,0,1],8593:[.19444,.69444,0,0,.5],8594:[-.13313,.36687,0,0,1],8595:[.19444,.69444,0,0,.5],8596:[-.13313,.36687,0,0,1],8597:[.25,.75,0,0,.5],8598:[.19444,.69444,0,0,1],8599:[.19444,.69444,0,0,1],8600:[.19444,.69444,0,0,1],8601:[.19444,.69444,0,0,1],8614:[.011,.511,0,0,1],8617:[.011,.511,0,0,1.126],8618:[.011,.511,0,0,1.126],8636:[-.13313,.36687,0,0,1],8637:[-.13313,.36687,0,0,1],8640:[-.13313,.36687,0,0,1],8641:[-.13313,.36687,0,0,1],8652:[.011,.671,0,0,1],8656:[-.13313,.36687,0,0,1],8657:[.19444,.69444,0,0,.61111],8658:[-.13313,.36687,0,0,1],8659:[.19444,.69444,0,0,.61111],8660:[-.13313,.36687,0,0,1],8661:[.25,.75,0,0,.61111],8704:[0,.69444,0,0,.55556],8706:[0,.69444,.05556,.08334,.5309],8707:[0,.69444,0,0,.55556],8709:[.05556,.75,0,0,.5],8711:[0,.68333,0,0,.83334],8712:[.0391,.5391,0,0,.66667],8715:[.0391,.5391,0,0,.66667],8722:[.08333,.58333,0,0,.77778],8723:[.08333,.58333,0,0,.77778],8725:[.25,.75,0,0,.5],8726:[.25,.75,0,0,.5],8727:[-.03472,.46528,0,0,.5],8728:[-.05555,.44445,0,0,.5],8729:[-.05555,.44445,0,0,.5],8730:[.2,.8,0,0,.83334],8733:[0,.43056,0,0,.77778],8734:[0,.43056,0,0,1],8736:[0,.69224,0,0,.72222],8739:[.25,.75,0,0,.27778],8741:[.25,.75,0,0,.5],8743:[0,.55556,0,0,.66667],8744:[0,.55556,0,0,.66667],8745:[0,.55556,0,0,.66667],8746:[0,.55556,0,0,.66667],8747:[.19444,.69444,.11111,0,.41667],8764:[-.13313,.36687,0,0,.77778],8768:[.19444,.69444,0,0,.27778],8771:[-.03625,.46375,0,0,.77778],8773:[-.022,.589,0,0,.778],8776:[-.01688,.48312,0,0,.77778],8781:[-.03625,.46375,0,0,.77778],8784:[-.133,.673,0,0,.778],8801:[-.03625,.46375,0,0,.77778],8804:[.13597,.63597,0,0,.77778],8805:[.13597,.63597,0,0,.77778],8810:[.0391,.5391,0,0,1],8811:[.0391,.5391,0,0,1],8826:[.0391,.5391,0,0,.77778],8827:[.0391,.5391,0,0,.77778],8834:[.0391,.5391,0,0,.77778],8835:[.0391,.5391,0,0,.77778],8838:[.13597,.63597,0,0,.77778],8839:[.13597,.63597,0,0,.77778],8846:[0,.55556,0,0,.66667],8849:[.13597,.63597,0,0,.77778],8850:[.13597,.63597,0,0,.77778],8851:[0,.55556,0,0,.66667],8852:[0,.55556,0,0,.66667],8853:[.08333,.58333,0,0,.77778],8854:[.08333,.58333,0,0,.77778],8855:[.08333,.58333,0,0,.77778],8856:[.08333,.58333,0,0,.77778],8857:[.08333,.58333,0,0,.77778],8866:[0,.69444,0,0,.61111],8867:[0,.69444,0,0,.61111],8868:[0,.69444,0,0,.77778],8869:[0,.69444,0,0,.77778],8872:[.249,.75,0,0,.867],8900:[-.05555,.44445,0,0,.5],8901:[-.05555,.44445,0,0,.27778],8902:[-.03472,.46528,0,0,.5],8904:[.005,.505,0,0,.9],8942:[.03,.903,0,0,.278],8943:[-.19,.313,0,0,1.172],8945:[-.1,.823,0,0,1.282],8968:[.25,.75,0,0,.44445],8969:[.25,.75,0,0,.44445],8970:[.25,.75,0,0,.44445],8971:[.25,.75,0,0,.44445],8994:[-.14236,.35764,0,0,1],8995:[-.14236,.35764,0,0,1],9136:[.244,.744,0,0,.412],9137:[.244,.745,0,0,.412],9651:[.19444,.69444,0,0,.88889],9657:[-.03472,.46528,0,0,.5],9661:[.19444,.69444,0,0,.88889],9667:[-.03472,.46528,0,0,.5],9711:[.19444,.69444,0,0,1],9824:[.12963,.69444,0,0,.77778],9825:[.12963,.69444,0,0,.77778],9826:[.12963,.69444,0,0,.77778],9827:[.12963,.69444,0,0,.77778],9837:[0,.75,0,0,.38889],9838:[.19444,.69444,0,0,.38889],9839:[.19444,.69444,0,0,.38889],10216:[.25,.75,0,0,.38889],10217:[.25,.75,0,0,.38889],10222:[.244,.744,0,0,.412],10223:[.244,.745,0,0,.412],10229:[.011,.511,0,0,1.609],10230:[.011,.511,0,0,1.638],10231:[.011,.511,0,0,1.859],10232:[.024,.525,0,0,1.609],10233:[.024,.525,0,0,1.638],10234:[.024,.525,0,0,1.858],10236:[.011,.511,0,0,1.638],10815:[0,.68333,0,0,.75],10927:[.13597,.63597,0,0,.77778],10928:[.13597,.63597,0,0,.77778],57376:[.19444,.69444,0,0,0]},"Math-BoldItalic":{32:[0,0,0,0,.25],48:[0,.44444,0,0,.575],49:[0,.44444,0,0,.575],50:[0,.44444,0,0,.575],51:[.19444,.44444,0,0,.575],52:[.19444,.44444,0,0,.575],53:[.19444,.44444,0,0,.575],54:[0,.64444,0,0,.575],55:[.19444,.44444,0,0,.575],56:[0,.64444,0,0,.575],57:[.19444,.44444,0,0,.575],65:[0,.68611,0,0,.86944],66:[0,.68611,.04835,0,.8664],67:[0,.68611,.06979,0,.81694],68:[0,.68611,.03194,0,.93812],69:[0,.68611,.05451,0,.81007],70:[0,.68611,.15972,0,.68889],71:[0,.68611,0,0,.88673],72:[0,.68611,.08229,0,.98229],73:[0,.68611,.07778,0,.51111],74:[0,.68611,.10069,0,.63125],75:[0,.68611,.06979,0,.97118],76:[0,.68611,0,0,.75555],77:[0,.68611,.11424,0,1.14201],78:[0,.68611,.11424,0,.95034],79:[0,.68611,.03194,0,.83666],80:[0,.68611,.15972,0,.72309],81:[.19444,.68611,0,0,.86861],82:[0,.68611,.00421,0,.87235],83:[0,.68611,.05382,0,.69271],84:[0,.68611,.15972,0,.63663],85:[0,.68611,.11424,0,.80027],86:[0,.68611,.25555,0,.67778],87:[0,.68611,.15972,0,1.09305],88:[0,.68611,.07778,0,.94722],89:[0,.68611,.25555,0,.67458],90:[0,.68611,.06979,0,.77257],97:[0,.44444,0,0,.63287],98:[0,.69444,0,0,.52083],99:[0,.44444,0,0,.51342],100:[0,.69444,0,0,.60972],101:[0,.44444,0,0,.55361],102:[.19444,.69444,.11042,0,.56806],103:[.19444,.44444,.03704,0,.5449],104:[0,.69444,0,0,.66759],105:[0,.69326,0,0,.4048],106:[.19444,.69326,.0622,0,.47083],107:[0,.69444,.01852,0,.6037],108:[0,.69444,.0088,0,.34815],109:[0,.44444,0,0,1.0324],110:[0,.44444,0,0,.71296],111:[0,.44444,0,0,.58472],112:[.19444,.44444,0,0,.60092],113:[.19444,.44444,.03704,0,.54213],114:[0,.44444,.03194,0,.5287],115:[0,.44444,0,0,.53125],116:[0,.63492,0,0,.41528],117:[0,.44444,0,0,.68102],118:[0,.44444,.03704,0,.56666],119:[0,.44444,.02778,0,.83148],120:[0,.44444,0,0,.65903],121:[.19444,.44444,.03704,0,.59028],122:[0,.44444,.04213,0,.55509],160:[0,0,0,0,.25],915:[0,.68611,.15972,0,.65694],916:[0,.68611,0,0,.95833],920:[0,.68611,.03194,0,.86722],923:[0,.68611,0,0,.80555],926:[0,.68611,.07458,0,.84125],928:[0,.68611,.08229,0,.98229],931:[0,.68611,.05451,0,.88507],933:[0,.68611,.15972,0,.67083],934:[0,.68611,0,0,.76666],936:[0,.68611,.11653,0,.71402],937:[0,.68611,.04835,0,.8789],945:[0,.44444,0,0,.76064],946:[.19444,.69444,.03403,0,.65972],947:[.19444,.44444,.06389,0,.59003],948:[0,.69444,.03819,0,.52222],949:[0,.44444,0,0,.52882],950:[.19444,.69444,.06215,0,.50833],951:[.19444,.44444,.03704,0,.6],952:[0,.69444,.03194,0,.5618],953:[0,.44444,0,0,.41204],954:[0,.44444,0,0,.66759],955:[0,.69444,0,0,.67083],956:[.19444,.44444,0,0,.70787],957:[0,.44444,.06898,0,.57685],958:[.19444,.69444,.03021,0,.50833],959:[0,.44444,0,0,.58472],960:[0,.44444,.03704,0,.68241],961:[.19444,.44444,0,0,.6118],962:[.09722,.44444,.07917,0,.42361],963:[0,.44444,.03704,0,.68588],964:[0,.44444,.13472,0,.52083],965:[0,.44444,.03704,0,.63055],966:[.19444,.44444,0,0,.74722],967:[.19444,.44444,0,0,.71805],968:[.19444,.69444,.03704,0,.75833],969:[0,.44444,.03704,0,.71782],977:[0,.69444,0,0,.69155],981:[.19444,.69444,0,0,.7125],982:[0,.44444,.03194,0,.975],1009:[.19444,.44444,0,0,.6118],1013:[0,.44444,0,0,.48333],57649:[0,.44444,0,0,.39352],57911:[.19444,.44444,0,0,.43889]},"Math-Italic":{32:[0,0,0,0,.25],48:[0,.43056,0,0,.5],49:[0,.43056,0,0,.5],50:[0,.43056,0,0,.5],51:[.19444,.43056,0,0,.5],52:[.19444,.43056,0,0,.5],53:[.19444,.43056,0,0,.5],54:[0,.64444,0,0,.5],55:[.19444,.43056,0,0,.5],56:[0,.64444,0,0,.5],57:[.19444,.43056,0,0,.5],65:[0,.68333,0,.13889,.75],66:[0,.68333,.05017,.08334,.75851],67:[0,.68333,.07153,.08334,.71472],68:[0,.68333,.02778,.05556,.82792],69:[0,.68333,.05764,.08334,.7382],70:[0,.68333,.13889,.08334,.64306],71:[0,.68333,0,.08334,.78625],72:[0,.68333,.08125,.05556,.83125],73:[0,.68333,.07847,.11111,.43958],74:[0,.68333,.09618,.16667,.55451],75:[0,.68333,.07153,.05556,.84931],76:[0,.68333,0,.02778,.68056],77:[0,.68333,.10903,.08334,.97014],78:[0,.68333,.10903,.08334,.80347],79:[0,.68333,.02778,.08334,.76278],80:[0,.68333,.13889,.08334,.64201],81:[.19444,.68333,0,.08334,.79056],82:[0,.68333,.00773,.08334,.75929],83:[0,.68333,.05764,.08334,.6132],84:[0,.68333,.13889,.08334,.58438],85:[0,.68333,.10903,.02778,.68278],86:[0,.68333,.22222,0,.58333],87:[0,.68333,.13889,0,.94445],88:[0,.68333,.07847,.08334,.82847],89:[0,.68333,.22222,0,.58056],90:[0,.68333,.07153,.08334,.68264],97:[0,.43056,0,0,.52859],98:[0,.69444,0,0,.42917],99:[0,.43056,0,.05556,.43276],100:[0,.69444,0,.16667,.52049],101:[0,.43056,0,.05556,.46563],102:[.19444,.69444,.10764,.16667,.48959],103:[.19444,.43056,.03588,.02778,.47697],104:[0,.69444,0,0,.57616],105:[0,.65952,0,0,.34451],106:[.19444,.65952,.05724,0,.41181],107:[0,.69444,.03148,0,.5206],108:[0,.69444,.01968,.08334,.29838],109:[0,.43056,0,0,.87801],110:[0,.43056,0,0,.60023],111:[0,.43056,0,.05556,.48472],112:[.19444,.43056,0,.08334,.50313],113:[.19444,.43056,.03588,.08334,.44641],114:[0,.43056,.02778,.05556,.45116],115:[0,.43056,0,.05556,.46875],116:[0,.61508,0,.08334,.36111],117:[0,.43056,0,.02778,.57246],118:[0,.43056,.03588,.02778,.48472],119:[0,.43056,.02691,.08334,.71592],120:[0,.43056,0,.02778,.57153],121:[.19444,.43056,.03588,.05556,.49028],122:[0,.43056,.04398,.05556,.46505],160:[0,0,0,0,.25],915:[0,.68333,.13889,.08334,.61528],916:[0,.68333,0,.16667,.83334],920:[0,.68333,.02778,.08334,.76278],923:[0,.68333,0,.16667,.69445],926:[0,.68333,.07569,.08334,.74236],928:[0,.68333,.08125,.05556,.83125],931:[0,.68333,.05764,.08334,.77986],933:[0,.68333,.13889,.05556,.58333],934:[0,.68333,0,.08334,.66667],936:[0,.68333,.11,.05556,.61222],937:[0,.68333,.05017,.08334,.7724],945:[0,.43056,.0037,.02778,.6397],946:[.19444,.69444,.05278,.08334,.56563],947:[.19444,.43056,.05556,0,.51773],948:[0,.69444,.03785,.05556,.44444],949:[0,.43056,0,.08334,.46632],950:[.19444,.69444,.07378,.08334,.4375],951:[.19444,.43056,.03588,.05556,.49653],952:[0,.69444,.02778,.08334,.46944],953:[0,.43056,0,.05556,.35394],954:[0,.43056,0,0,.57616],955:[0,.69444,0,0,.58334],956:[.19444,.43056,0,.02778,.60255],957:[0,.43056,.06366,.02778,.49398],958:[.19444,.69444,.04601,.11111,.4375],959:[0,.43056,0,.05556,.48472],960:[0,.43056,.03588,0,.57003],961:[.19444,.43056,0,.08334,.51702],962:[.09722,.43056,.07986,.08334,.36285],963:[0,.43056,.03588,0,.57141],964:[0,.43056,.1132,.02778,.43715],965:[0,.43056,.03588,.02778,.54028],966:[.19444,.43056,0,.08334,.65417],967:[.19444,.43056,0,.05556,.62569],968:[.19444,.69444,.03588,.11111,.65139],969:[0,.43056,.03588,0,.62245],977:[0,.69444,0,.08334,.59144],981:[.19444,.69444,0,.08334,.59583],982:[0,.43056,.02778,0,.82813],1009:[.19444,.43056,0,.08334,.51702],1013:[0,.43056,0,.05556,.4059],57649:[0,.43056,0,.02778,.32246],57911:[.19444,.43056,0,.08334,.38403]},"SansSerif-Bold":{32:[0,0,0,0,.25],33:[0,.69444,0,0,.36667],34:[0,.69444,0,0,.55834],35:[.19444,.69444,0,0,.91667],36:[.05556,.75,0,0,.55],37:[.05556,.75,0,0,1.02912],38:[0,.69444,0,0,.83056],39:[0,.69444,0,0,.30556],40:[.25,.75,0,0,.42778],41:[.25,.75,0,0,.42778],42:[0,.75,0,0,.55],43:[.11667,.61667,0,0,.85556],44:[.10556,.13056,0,0,.30556],45:[0,.45833,0,0,.36667],46:[0,.13056,0,0,.30556],47:[.25,.75,0,0,.55],48:[0,.69444,0,0,.55],49:[0,.69444,0,0,.55],50:[0,.69444,0,0,.55],51:[0,.69444,0,0,.55],52:[0,.69444,0,0,.55],53:[0,.69444,0,0,.55],54:[0,.69444,0,0,.55],55:[0,.69444,0,0,.55],56:[0,.69444,0,0,.55],57:[0,.69444,0,0,.55],58:[0,.45833,0,0,.30556],59:[.10556,.45833,0,0,.30556],61:[-.09375,.40625,0,0,.85556],63:[0,.69444,0,0,.51945],64:[0,.69444,0,0,.73334],65:[0,.69444,0,0,.73334],66:[0,.69444,0,0,.73334],67:[0,.69444,0,0,.70278],68:[0,.69444,0,0,.79445],69:[0,.69444,0,0,.64167],70:[0,.69444,0,0,.61111],71:[0,.69444,0,0,.73334],72:[0,.69444,0,0,.79445],73:[0,.69444,0,0,.33056],74:[0,.69444,0,0,.51945],75:[0,.69444,0,0,.76389],76:[0,.69444,0,0,.58056],77:[0,.69444,0,0,.97778],78:[0,.69444,0,0,.79445],79:[0,.69444,0,0,.79445],80:[0,.69444,0,0,.70278],81:[.10556,.69444,0,0,.79445],82:[0,.69444,0,0,.70278],83:[0,.69444,0,0,.61111],84:[0,.69444,0,0,.73334],85:[0,.69444,0,0,.76389],86:[0,.69444,.01528,0,.73334],87:[0,.69444,.01528,0,1.03889],88:[0,.69444,0,0,.73334],89:[0,.69444,.0275,0,.73334],90:[0,.69444,0,0,.67223],91:[.25,.75,0,0,.34306],93:[.25,.75,0,0,.34306],94:[0,.69444,0,0,.55],95:[.35,.10833,.03056,0,.55],97:[0,.45833,0,0,.525],98:[0,.69444,0,0,.56111],99:[0,.45833,0,0,.48889],100:[0,.69444,0,0,.56111],101:[0,.45833,0,0,.51111],102:[0,.69444,.07639,0,.33611],103:[.19444,.45833,.01528,0,.55],104:[0,.69444,0,0,.56111],105:[0,.69444,0,0,.25556],106:[.19444,.69444,0,0,.28611],107:[0,.69444,0,0,.53056],108:[0,.69444,0,0,.25556],109:[0,.45833,0,0,.86667],110:[0,.45833,0,0,.56111],111:[0,.45833,0,0,.55],112:[.19444,.45833,0,0,.56111],113:[.19444,.45833,0,0,.56111],114:[0,.45833,.01528,0,.37222],115:[0,.45833,0,0,.42167],116:[0,.58929,0,0,.40417],117:[0,.45833,0,0,.56111],118:[0,.45833,.01528,0,.5],119:[0,.45833,.01528,0,.74445],120:[0,.45833,0,0,.5],121:[.19444,.45833,.01528,0,.5],122:[0,.45833,0,0,.47639],126:[.35,.34444,0,0,.55],160:[0,0,0,0,.25],168:[0,.69444,0,0,.55],176:[0,.69444,0,0,.73334],180:[0,.69444,0,0,.55],184:[.17014,0,0,0,.48889],305:[0,.45833,0,0,.25556],567:[.19444,.45833,0,0,.28611],710:[0,.69444,0,0,.55],711:[0,.63542,0,0,.55],713:[0,.63778,0,0,.55],728:[0,.69444,0,0,.55],729:[0,.69444,0,0,.30556],730:[0,.69444,0,0,.73334],732:[0,.69444,0,0,.55],733:[0,.69444,0,0,.55],915:[0,.69444,0,0,.58056],916:[0,.69444,0,0,.91667],920:[0,.69444,0,0,.85556],923:[0,.69444,0,0,.67223],926:[0,.69444,0,0,.73334],928:[0,.69444,0,0,.79445],931:[0,.69444,0,0,.79445],933:[0,.69444,0,0,.85556],934:[0,.69444,0,0,.79445],936:[0,.69444,0,0,.85556],937:[0,.69444,0,0,.79445],8211:[0,.45833,.03056,0,.55],8212:[0,.45833,.03056,0,1.10001],8216:[0,.69444,0,0,.30556],8217:[0,.69444,0,0,.30556],8220:[0,.69444,0,0,.55834],8221:[0,.69444,0,0,.55834]},"SansSerif-Italic":{32:[0,0,0,0,.25],33:[0,.69444,.05733,0,.31945],34:[0,.69444,.00316,0,.5],35:[.19444,.69444,.05087,0,.83334],36:[.05556,.75,.11156,0,.5],37:[.05556,.75,.03126,0,.83334],38:[0,.69444,.03058,0,.75834],39:[0,.69444,.07816,0,.27778],40:[.25,.75,.13164,0,.38889],41:[.25,.75,.02536,0,.38889],42:[0,.75,.11775,0,.5],43:[.08333,.58333,.02536,0,.77778],44:[.125,.08333,0,0,.27778],45:[0,.44444,.01946,0,.33333],46:[0,.08333,0,0,.27778],47:[.25,.75,.13164,0,.5],48:[0,.65556,.11156,0,.5],49:[0,.65556,.11156,0,.5],50:[0,.65556,.11156,0,.5],51:[0,.65556,.11156,0,.5],52:[0,.65556,.11156,0,.5],53:[0,.65556,.11156,0,.5],54:[0,.65556,.11156,0,.5],55:[0,.65556,.11156,0,.5],56:[0,.65556,.11156,0,.5],57:[0,.65556,.11156,0,.5],58:[0,.44444,.02502,0,.27778],59:[.125,.44444,.02502,0,.27778],61:[-.13,.37,.05087,0,.77778],63:[0,.69444,.11809,0,.47222],64:[0,.69444,.07555,0,.66667],65:[0,.69444,0,0,.66667],66:[0,.69444,.08293,0,.66667],67:[0,.69444,.11983,0,.63889],68:[0,.69444,.07555,0,.72223],69:[0,.69444,.11983,0,.59722],70:[0,.69444,.13372,0,.56945],71:[0,.69444,.11983,0,.66667],72:[0,.69444,.08094,0,.70834],73:[0,.69444,.13372,0,.27778],74:[0,.69444,.08094,0,.47222],75:[0,.69444,.11983,0,.69445],76:[0,.69444,0,0,.54167],77:[0,.69444,.08094,0,.875],78:[0,.69444,.08094,0,.70834],79:[0,.69444,.07555,0,.73611],80:[0,.69444,.08293,0,.63889],81:[.125,.69444,.07555,0,.73611],82:[0,.69444,.08293,0,.64584],83:[0,.69444,.09205,0,.55556],84:[0,.69444,.13372,0,.68056],85:[0,.69444,.08094,0,.6875],86:[0,.69444,.1615,0,.66667],87:[0,.69444,.1615,0,.94445],88:[0,.69444,.13372,0,.66667],89:[0,.69444,.17261,0,.66667],90:[0,.69444,.11983,0,.61111],91:[.25,.75,.15942,0,.28889],93:[.25,.75,.08719,0,.28889],94:[0,.69444,.0799,0,.5],95:[.35,.09444,.08616,0,.5],97:[0,.44444,.00981,0,.48056],98:[0,.69444,.03057,0,.51667],99:[0,.44444,.08336,0,.44445],100:[0,.69444,.09483,0,.51667],101:[0,.44444,.06778,0,.44445],102:[0,.69444,.21705,0,.30556],103:[.19444,.44444,.10836,0,.5],104:[0,.69444,.01778,0,.51667],105:[0,.67937,.09718,0,.23889],106:[.19444,.67937,.09162,0,.26667],107:[0,.69444,.08336,0,.48889],108:[0,.69444,.09483,0,.23889],109:[0,.44444,.01778,0,.79445],110:[0,.44444,.01778,0,.51667],111:[0,.44444,.06613,0,.5],112:[.19444,.44444,.0389,0,.51667],113:[.19444,.44444,.04169,0,.51667],114:[0,.44444,.10836,0,.34167],115:[0,.44444,.0778,0,.38333],116:[0,.57143,.07225,0,.36111],117:[0,.44444,.04169,0,.51667],118:[0,.44444,.10836,0,.46111],119:[0,.44444,.10836,0,.68334],120:[0,.44444,.09169,0,.46111],121:[.19444,.44444,.10836,0,.46111],122:[0,.44444,.08752,0,.43472],126:[.35,.32659,.08826,0,.5],160:[0,0,0,0,.25],168:[0,.67937,.06385,0,.5],176:[0,.69444,0,0,.73752],184:[.17014,0,0,0,.44445],305:[0,.44444,.04169,0,.23889],567:[.19444,.44444,.04169,0,.26667],710:[0,.69444,.0799,0,.5],711:[0,.63194,.08432,0,.5],713:[0,.60889,.08776,0,.5],714:[0,.69444,.09205,0,.5],715:[0,.69444,0,0,.5],728:[0,.69444,.09483,0,.5],729:[0,.67937,.07774,0,.27778],730:[0,.69444,0,0,.73752],732:[0,.67659,.08826,0,.5],733:[0,.69444,.09205,0,.5],915:[0,.69444,.13372,0,.54167],916:[0,.69444,0,0,.83334],920:[0,.69444,.07555,0,.77778],923:[0,.69444,0,0,.61111],926:[0,.69444,.12816,0,.66667],928:[0,.69444,.08094,0,.70834],931:[0,.69444,.11983,0,.72222],933:[0,.69444,.09031,0,.77778],934:[0,.69444,.04603,0,.72222],936:[0,.69444,.09031,0,.77778],937:[0,.69444,.08293,0,.72222],8211:[0,.44444,.08616,0,.5],8212:[0,.44444,.08616,0,1],8216:[0,.69444,.07816,0,.27778],8217:[0,.69444,.07816,0,.27778],8220:[0,.69444,.14205,0,.5],8221:[0,.69444,.00316,0,.5]},"SansSerif-Regular":{32:[0,0,0,0,.25],33:[0,.69444,0,0,.31945],34:[0,.69444,0,0,.5],35:[.19444,.69444,0,0,.83334],36:[.05556,.75,0,0,.5],37:[.05556,.75,0,0,.83334],38:[0,.69444,0,0,.75834],39:[0,.69444,0,0,.27778],40:[.25,.75,0,0,.38889],41:[.25,.75,0,0,.38889],42:[0,.75,0,0,.5],43:[.08333,.58333,0,0,.77778],44:[.125,.08333,0,0,.27778],45:[0,.44444,0,0,.33333],46:[0,.08333,0,0,.27778],47:[.25,.75,0,0,.5],48:[0,.65556,0,0,.5],49:[0,.65556,0,0,.5],50:[0,.65556,0,0,.5],51:[0,.65556,0,0,.5],52:[0,.65556,0,0,.5],53:[0,.65556,0,0,.5],54:[0,.65556,0,0,.5],55:[0,.65556,0,0,.5],56:[0,.65556,0,0,.5],57:[0,.65556,0,0,.5],58:[0,.44444,0,0,.27778],59:[.125,.44444,0,0,.27778],61:[-.13,.37,0,0,.77778],63:[0,.69444,0,0,.47222],64:[0,.69444,0,0,.66667],65:[0,.69444,0,0,.66667],66:[0,.69444,0,0,.66667],67:[0,.69444,0,0,.63889],68:[0,.69444,0,0,.72223],69:[0,.69444,0,0,.59722],70:[0,.69444,0,0,.56945],71:[0,.69444,0,0,.66667],72:[0,.69444,0,0,.70834],73:[0,.69444,0,0,.27778],74:[0,.69444,0,0,.47222],75:[0,.69444,0,0,.69445],76:[0,.69444,0,0,.54167],77:[0,.69444,0,0,.875],78:[0,.69444,0,0,.70834],79:[0,.69444,0,0,.73611],80:[0,.69444,0,0,.63889],81:[.125,.69444,0,0,.73611],82:[0,.69444,0,0,.64584],83:[0,.69444,0,0,.55556],84:[0,.69444,0,0,.68056],85:[0,.69444,0,0,.6875],86:[0,.69444,.01389,0,.66667],87:[0,.69444,.01389,0,.94445],88:[0,.69444,0,0,.66667],89:[0,.69444,.025,0,.66667],90:[0,.69444,0,0,.61111],91:[.25,.75,0,0,.28889],93:[.25,.75,0,0,.28889],94:[0,.69444,0,0,.5],95:[.35,.09444,.02778,0,.5],97:[0,.44444,0,0,.48056],98:[0,.69444,0,0,.51667],99:[0,.44444,0,0,.44445],100:[0,.69444,0,0,.51667],101:[0,.44444,0,0,.44445],102:[0,.69444,.06944,0,.30556],103:[.19444,.44444,.01389,0,.5],104:[0,.69444,0,0,.51667],105:[0,.67937,0,0,.23889],106:[.19444,.67937,0,0,.26667],107:[0,.69444,0,0,.48889],108:[0,.69444,0,0,.23889],109:[0,.44444,0,0,.79445],110:[0,.44444,0,0,.51667],111:[0,.44444,0,0,.5],112:[.19444,.44444,0,0,.51667],113:[.19444,.44444,0,0,.51667],114:[0,.44444,.01389,0,.34167],115:[0,.44444,0,0,.38333],116:[0,.57143,0,0,.36111],117:[0,.44444,0,0,.51667],118:[0,.44444,.01389,0,.46111],119:[0,.44444,.01389,0,.68334],120:[0,.44444,0,0,.46111],121:[.19444,.44444,.01389,0,.46111],122:[0,.44444,0,0,.43472],126:[.35,.32659,0,0,.5],160:[0,0,0,0,.25],168:[0,.67937,0,0,.5],176:[0,.69444,0,0,.66667],184:[.17014,0,0,0,.44445],305:[0,.44444,0,0,.23889],567:[.19444,.44444,0,0,.26667],710:[0,.69444,0,0,.5],711:[0,.63194,0,0,.5],713:[0,.60889,0,0,.5],714:[0,.69444,0,0,.5],715:[0,.69444,0,0,.5],728:[0,.69444,0,0,.5],729:[0,.67937,0,0,.27778],730:[0,.69444,0,0,.66667],732:[0,.67659,0,0,.5],733:[0,.69444,0,0,.5],915:[0,.69444,0,0,.54167],916:[0,.69444,0,0,.83334],920:[0,.69444,0,0,.77778],923:[0,.69444,0,0,.61111],926:[0,.69444,0,0,.66667],928:[0,.69444,0,0,.70834],931:[0,.69444,0,0,.72222],933:[0,.69444,0,0,.77778],934:[0,.69444,0,0,.72222],936:[0,.69444,0,0,.77778],937:[0,.69444,0,0,.72222],8211:[0,.44444,.02778,0,.5],8212:[0,.44444,.02778,0,1],8216:[0,.69444,0,0,.27778],8217:[0,.69444,0,0,.27778],8220:[0,.69444,0,0,.5],8221:[0,.69444,0,0,.5]},"Script-Regular":{32:[0,0,0,0,.25],65:[0,.7,.22925,0,.80253],66:[0,.7,.04087,0,.90757],67:[0,.7,.1689,0,.66619],68:[0,.7,.09371,0,.77443],69:[0,.7,.18583,0,.56162],70:[0,.7,.13634,0,.89544],71:[0,.7,.17322,0,.60961],72:[0,.7,.29694,0,.96919],73:[0,.7,.19189,0,.80907],74:[.27778,.7,.19189,0,1.05159],75:[0,.7,.31259,0,.91364],76:[0,.7,.19189,0,.87373],77:[0,.7,.15981,0,1.08031],78:[0,.7,.3525,0,.9015],79:[0,.7,.08078,0,.73787],80:[0,.7,.08078,0,1.01262],81:[0,.7,.03305,0,.88282],82:[0,.7,.06259,0,.85],83:[0,.7,.19189,0,.86767],84:[0,.7,.29087,0,.74697],85:[0,.7,.25815,0,.79996],86:[0,.7,.27523,0,.62204],87:[0,.7,.27523,0,.80532],88:[0,.7,.26006,0,.94445],89:[0,.7,.2939,0,.70961],90:[0,.7,.24037,0,.8212],160:[0,0,0,0,.25]},"Size1-Regular":{32:[0,0,0,0,.25],40:[.35001,.85,0,0,.45834],41:[.35001,.85,0,0,.45834],47:[.35001,.85,0,0,.57778],91:[.35001,.85,0,0,.41667],92:[.35001,.85,0,0,.57778],93:[.35001,.85,0,0,.41667],123:[.35001,.85,0,0,.58334],125:[.35001,.85,0,0,.58334],160:[0,0,0,0,.25],710:[0,.72222,0,0,.55556],732:[0,.72222,0,0,.55556],770:[0,.72222,0,0,.55556],771:[0,.72222,0,0,.55556],8214:[-99e-5,.601,0,0,.77778],8593:[1e-5,.6,0,0,.66667],8595:[1e-5,.6,0,0,.66667],8657:[1e-5,.6,0,0,.77778],8659:[1e-5,.6,0,0,.77778],8719:[.25001,.75,0,0,.94445],8720:[.25001,.75,0,0,.94445],8721:[.25001,.75,0,0,1.05556],8730:[.35001,.85,0,0,1],8739:[-.00599,.606,0,0,.33333],8741:[-.00599,.606,0,0,.55556],8747:[.30612,.805,.19445,0,.47222],8748:[.306,.805,.19445,0,.47222],8749:[.306,.805,.19445,0,.47222],8750:[.30612,.805,.19445,0,.47222],8896:[.25001,.75,0,0,.83334],8897:[.25001,.75,0,0,.83334],8898:[.25001,.75,0,0,.83334],8899:[.25001,.75,0,0,.83334],8968:[.35001,.85,0,0,.47222],8969:[.35001,.85,0,0,.47222],8970:[.35001,.85,0,0,.47222],8971:[.35001,.85,0,0,.47222],9168:[-99e-5,.601,0,0,.66667],10216:[.35001,.85,0,0,.47222],10217:[.35001,.85,0,0,.47222],10752:[.25001,.75,0,0,1.11111],10753:[.25001,.75,0,0,1.11111],10754:[.25001,.75,0,0,1.11111],10756:[.25001,.75,0,0,.83334],10758:[.25001,.75,0,0,.83334]},"Size2-Regular":{32:[0,0,0,0,.25],40:[.65002,1.15,0,0,.59722],41:[.65002,1.15,0,0,.59722],47:[.65002,1.15,0,0,.81111],91:[.65002,1.15,0,0,.47222],92:[.65002,1.15,0,0,.81111],93:[.65002,1.15,0,0,.47222],123:[.65002,1.15,0,0,.66667],125:[.65002,1.15,0,0,.66667],160:[0,0,0,0,.25],710:[0,.75,0,0,1],732:[0,.75,0,0,1],770:[0,.75,0,0,1],771:[0,.75,0,0,1],8719:[.55001,1.05,0,0,1.27778],8720:[.55001,1.05,0,0,1.27778],8721:[.55001,1.05,0,0,1.44445],8730:[.65002,1.15,0,0,1],8747:[.86225,1.36,.44445,0,.55556],8748:[.862,1.36,.44445,0,.55556],8749:[.862,1.36,.44445,0,.55556],8750:[.86225,1.36,.44445,0,.55556],8896:[.55001,1.05,0,0,1.11111],8897:[.55001,1.05,0,0,1.11111],8898:[.55001,1.05,0,0,1.11111],8899:[.55001,1.05,0,0,1.11111],8968:[.65002,1.15,0,0,.52778],8969:[.65002,1.15,0,0,.52778],8970:[.65002,1.15,0,0,.52778],8971:[.65002,1.15,0,0,.52778],10216:[.65002,1.15,0,0,.61111],10217:[.65002,1.15,0,0,.61111],10752:[.55001,1.05,0,0,1.51112],10753:[.55001,1.05,0,0,1.51112],10754:[.55001,1.05,0,0,1.51112],10756:[.55001,1.05,0,0,1.11111],10758:[.55001,1.05,0,0,1.11111]},"Size3-Regular":{32:[0,0,0,0,.25],40:[.95003,1.45,0,0,.73611],41:[.95003,1.45,0,0,.73611],47:[.95003,1.45,0,0,1.04445],91:[.95003,1.45,0,0,.52778],92:[.95003,1.45,0,0,1.04445],93:[.95003,1.45,0,0,.52778],123:[.95003,1.45,0,0,.75],125:[.95003,1.45,0,0,.75],160:[0,0,0,0,.25],710:[0,.75,0,0,1.44445],732:[0,.75,0,0,1.44445],770:[0,.75,0,0,1.44445],771:[0,.75,0,0,1.44445],8730:[.95003,1.45,0,0,1],8968:[.95003,1.45,0,0,.58334],8969:[.95003,1.45,0,0,.58334],8970:[.95003,1.45,0,0,.58334],8971:[.95003,1.45,0,0,.58334],10216:[.95003,1.45,0,0,.75],10217:[.95003,1.45,0,0,.75]},"Size4-Regular":{32:[0,0,0,0,.25],40:[1.25003,1.75,0,0,.79167],41:[1.25003,1.75,0,0,.79167],47:[1.25003,1.75,0,0,1.27778],91:[1.25003,1.75,0,0,.58334],92:[1.25003,1.75,0,0,1.27778],93:[1.25003,1.75,0,0,.58334],123:[1.25003,1.75,0,0,.80556],125:[1.25003,1.75,0,0,.80556],160:[0,0,0,0,.25],710:[0,.825,0,0,1.8889],732:[0,.825,0,0,1.8889],770:[0,.825,0,0,1.8889],771:[0,.825,0,0,1.8889],8730:[1.25003,1.75,0,0,1],8968:[1.25003,1.75,0,0,.63889],8969:[1.25003,1.75,0,0,.63889],8970:[1.25003,1.75,0,0,.63889],8971:[1.25003,1.75,0,0,.63889],9115:[.64502,1.155,0,0,.875],9116:[1e-5,.6,0,0,.875],9117:[.64502,1.155,0,0,.875],9118:[.64502,1.155,0,0,.875],9119:[1e-5,.6,0,0,.875],9120:[.64502,1.155,0,0,.875],9121:[.64502,1.155,0,0,.66667],9122:[-99e-5,.601,0,0,.66667],9123:[.64502,1.155,0,0,.66667],9124:[.64502,1.155,0,0,.66667],9125:[-99e-5,.601,0,0,.66667],9126:[.64502,1.155,0,0,.66667],9127:[1e-5,.9,0,0,.88889],9128:[.65002,1.15,0,0,.88889],9129:[.90001,0,0,0,.88889],9130:[0,.3,0,0,.88889],9131:[1e-5,.9,0,0,.88889],9132:[.65002,1.15,0,0,.88889],9133:[.90001,0,0,0,.88889],9143:[.88502,.915,0,0,1.05556],10216:[1.25003,1.75,0,0,.80556],10217:[1.25003,1.75,0,0,.80556],57344:[-.00499,.605,0,0,1.05556],57345:[-.00499,.605,0,0,1.05556],57680:[0,.12,0,0,.45],57681:[0,.12,0,0,.45],57682:[0,.12,0,0,.45],57683:[0,.12,0,0,.45]},"Typewriter-Regular":{32:[0,0,0,0,.525],33:[0,.61111,0,0,.525],34:[0,.61111,0,0,.525],35:[0,.61111,0,0,.525],36:[.08333,.69444,0,0,.525],37:[.08333,.69444,0,0,.525],38:[0,.61111,0,0,.525],39:[0,.61111,0,0,.525],40:[.08333,.69444,0,0,.525],41:[.08333,.69444,0,0,.525],42:[0,.52083,0,0,.525],43:[-.08056,.53055,0,0,.525],44:[.13889,.125,0,0,.525],45:[-.08056,.53055,0,0,.525],46:[0,.125,0,0,.525],47:[.08333,.69444,0,0,.525],48:[0,.61111,0,0,.525],49:[0,.61111,0,0,.525],50:[0,.61111,0,0,.525],51:[0,.61111,0,0,.525],52:[0,.61111,0,0,.525],53:[0,.61111,0,0,.525],54:[0,.61111,0,0,.525],55:[0,.61111,0,0,.525],56:[0,.61111,0,0,.525],57:[0,.61111,0,0,.525],58:[0,.43056,0,0,.525],59:[.13889,.43056,0,0,.525],60:[-.05556,.55556,0,0,.525],61:[-.19549,.41562,0,0,.525],62:[-.05556,.55556,0,0,.525],63:[0,.61111,0,0,.525],64:[0,.61111,0,0,.525],65:[0,.61111,0,0,.525],66:[0,.61111,0,0,.525],67:[0,.61111,0,0,.525],68:[0,.61111,0,0,.525],69:[0,.61111,0,0,.525],70:[0,.61111,0,0,.525],71:[0,.61111,0,0,.525],72:[0,.61111,0,0,.525],73:[0,.61111,0,0,.525],74:[0,.61111,0,0,.525],75:[0,.61111,0,0,.525],76:[0,.61111,0,0,.525],77:[0,.61111,0,0,.525],78:[0,.61111,0,0,.525],79:[0,.61111,0,0,.525],80:[0,.61111,0,0,.525],81:[.13889,.61111,0,0,.525],82:[0,.61111,0,0,.525],83:[0,.61111,0,0,.525],84:[0,.61111,0,0,.525],85:[0,.61111,0,0,.525],86:[0,.61111,0,0,.525],87:[0,.61111,0,0,.525],88:[0,.61111,0,0,.525],89:[0,.61111,0,0,.525],90:[0,.61111,0,0,.525],91:[.08333,.69444,0,0,.525],92:[.08333,.69444,0,0,.525],93:[.08333,.69444,0,0,.525],94:[0,.61111,0,0,.525],95:[.09514,0,0,0,.525],96:[0,.61111,0,0,.525],97:[0,.43056,0,0,.525],98:[0,.61111,0,0,.525],99:[0,.43056,0,0,.525],100:[0,.61111,0,0,.525],101:[0,.43056,0,0,.525],102:[0,.61111,0,0,.525],103:[.22222,.43056,0,0,.525],104:[0,.61111,0,0,.525],105:[0,.61111,0,0,.525],106:[.22222,.61111,0,0,.525],107:[0,.61111,0,0,.525],108:[0,.61111,0,0,.525],109:[0,.43056,0,0,.525],110:[0,.43056,0,0,.525],111:[0,.43056,0,0,.525],112:[.22222,.43056,0,0,.525],113:[.22222,.43056,0,0,.525],114:[0,.43056,0,0,.525],115:[0,.43056,0,0,.525],116:[0,.55358,0,0,.525],117:[0,.43056,0,0,.525],118:[0,.43056,0,0,.525],119:[0,.43056,0,0,.525],120:[0,.43056,0,0,.525],121:[.22222,.43056,0,0,.525],122:[0,.43056,0,0,.525],123:[.08333,.69444,0,0,.525],124:[.08333,.69444,0,0,.525],125:[.08333,.69444,0,0,.525],126:[0,.61111,0,0,.525],127:[0,.61111,0,0,.525],160:[0,0,0,0,.525],176:[0,.61111,0,0,.525],184:[.19445,0,0,0,.525],305:[0,.43056,0,0,.525],567:[.22222,.43056,0,0,.525],711:[0,.56597,0,0,.525],713:[0,.56555,0,0,.525],714:[0,.61111,0,0,.525],715:[0,.61111,0,0,.525],728:[0,.61111,0,0,.525],730:[0,.61111,0,0,.525],770:[0,.61111,0,0,.525],771:[0,.61111,0,0,.525],776:[0,.61111,0,0,.525],915:[0,.61111,0,0,.525],916:[0,.61111,0,0,.525],920:[0,.61111,0,0,.525],923:[0,.61111,0,0,.525],926:[0,.61111,0,0,.525],928:[0,.61111,0,0,.525],931:[0,.61111,0,0,.525],933:[0,.61111,0,0,.525],934:[0,.61111,0,0,.525],936:[0,.61111,0,0,.525],937:[0,.61111,0,0,.525],8216:[0,.61111,0,0,.525],8217:[0,.61111,0,0,.525],8242:[0,.61111,0,0,.525],9251:[.11111,.21944,0,0,.525]}},N={slant:[.25,.25,.25],space:[0,0,0],stretch:[0,0,0],shrink:[0,0,0],xHeight:[.431,.431,.431],quad:[1,1.171,1.472],extraSpace:[0,0,0],num1:[.677,.732,.925],num2:[.394,.384,.387],num3:[.444,.471,.504],denom1:[.686,.752,1.025],denom2:[.345,.344,.532],sup1:[.413,.503,.504],sup2:[.363,.431,.404],sup3:[.289,.286,.294],sub1:[.15,.143,.2],sub2:[.247,.286,.4],supDrop:[.386,.353,.494],subDrop:[.05,.071,.1],delim1:[2.39,1.7,1.98],delim2:[1.01,1.157,1.42],axisHeight:[.25,.25,.25],defaultRuleThickness:[.04,.049,.049],bigOpSpacing1:[.111,.111,.111],bigOpSpacing2:[.166,.166,.166],bigOpSpacing3:[.2,.2,.2],bigOpSpacing4:[.6,.611,.611],bigOpSpacing5:[.1,.143,.143],sqrtRuleThickness:[.04,.04,.04],ptPerEm:[10,10,10],doubleRuleSep:[.2,.2,.2],arrayRuleWidth:[.04,.04,.04],fboxsep:[.3,.3,.3],fboxrule:[.04,.04,.04]},q={"\xc5":"A","\xd0":"D","\xde":"o","\xe5":"a","\xf0":"d","\xfe":"o","\u0410":"A","\u0411":"B","\u0412":"B","\u0413":"F","\u0414":"A","\u0415":"E","\u0416":"K","\u0417":"3","\u0418":"N","\u0419":"N","\u041a":"K","\u041b":"N","\u041c":"M","\u041d":"H","\u041e":"O","\u041f":"N","\u0420":"P","\u0421":"C","\u0422":"T","\u0423":"y","\u0424":"O","\u0425":"X","\u0426":"U","\u0427":"h","\u0428":"W","\u0429":"W","\u042a":"B","\u042b":"X","\u042c":"B","\u042d":"3","\u042e":"X","\u042f":"R","\u0430":"a","\u0431":"b","\u0432":"a","\u0433":"r","\u0434":"y","\u0435":"e","\u0436":"m","\u0437":"e","\u0438":"n","\u0439":"n","\u043a":"n","\u043b":"n","\u043c":"m","\u043d":"n","\u043e":"o","\u043f":"n","\u0440":"p","\u0441":"c","\u0442":"o","\u0443":"y","\u0444":"b","\u0445":"x","\u0446":"n","\u0447":"n","\u0448":"w","\u0449":"w","\u044a":"a","\u044b":"m","\u044c":"a","\u044d":"e","\u044e":"m","\u044f":"r"};function I(e,t,r){if(!C[t])throw new Error("Font metrics not found for font: "+t+".");var a=e.charCodeAt(0),n=C[t][a];if(!n&&e[0]in q&&(a=q[e[0]].charCodeAt(0),n=C[t][a]),n||"text"!==r||z(a)&&(n=C[t][77]),n)return{depth:n[0],height:n[1],italic:n[2],skew:n[3],width:n[4]}}var R={};var H=[[1,1,1],[2,1,1],[3,1,1],[4,2,1],[5,2,1],[6,3,1],[7,4,2],[8,6,3],[9,7,6],[10,8,7],[11,10,9]],O=[.5,.6,.7,.8,.9,1,1.2,1.44,1.728,2.074,2.488],E=function(e,t){return t.size<2?e:H[e-1][t.size-1]};class L{constructor(e){this.style=void 0,this.color=void 0,this.size=void 0,this.textSize=void 0,this.phantom=void 0,this.font=void 0,this.fontFamily=void 0,this.fontWeight=void 0,this.fontShape=void 0,this.sizeMultiplier=void 0,this.maxSize=void 0,this.minRuleThickness=void 0,this._fontMetrics=void 0,this.style=e.style,this.color=e.color,this.size=e.size||L.BASESIZE,this.textSize=e.textSize||this.size,this.phantom=!!e.phantom,this.font=e.font||"",this.fontFamily=e.fontFamily||"",this.fontWeight=e.fontWeight||"",this.fontShape=e.fontShape||"",this.sizeMultiplier=O[this.size-1],this.maxSize=e.maxSize,this.minRuleThickness=e.minRuleThickness,this._fontMetrics=void 0}extend(e){var t={style:this.style,size:this.size,textSize:this.textSize,color:this.color,phantom:this.phantom,font:this.font,fontFamily:this.fontFamily,fontWeight:this.fontWeight,fontShape:this.fontShape,maxSize:this.maxSize,minRuleThickness:this.minRuleThickness};for(var r in e)e.hasOwnProperty(r)&&(t[r]=e[r]);return new L(t)}havingStyle(e){return this.style===e?this:this.extend({style:e,size:E(this.textSize,e)})}havingCrampedStyle(){return this.havingStyle(this.style.cramp())}havingSize(e){return this.size===e&&this.textSize===e?this:this.extend({style:this.style.text(),size:e,textSize:e,sizeMultiplier:O[e-1]})}havingBaseStyle(e){e=e||this.style.text();var t=E(L.BASESIZE,e);return this.size===t&&this.textSize===L.BASESIZE&&this.style===e?this:this.extend({style:e,size:t})}havingBaseSizing(){var e;switch(this.style.id){case 4:case 5:e=3;break;case 6:case 7:e=1;break;default:e=6}return this.extend({style:this.style.text(),size:e})}withColor(e){return this.extend({color:e})}withPhantom(){return this.extend({phantom:!0})}withFont(e){return this.extend({font:e})}withTextFontFamily(e){return this.extend({fontFamily:e,font:""})}withTextFontWeight(e){return this.extend({fontWeight:e,font:""})}withTextFontShape(e){return this.extend({fontShape:e,font:""})}sizingClasses(e){return e.size!==this.size?["sizing","reset-size"+e.size,"size"+this.size]:[]}baseSizingClasses(){return this.size!==L.BASESIZE?["sizing","reset-size"+this.size,"size"+L.BASESIZE]:[]}fontMetrics(){return this._fontMetrics||(this._fontMetrics=function(e){var t;if(!R[t=e>=5?0:e>=3?1:2]){var r=R[t]={cssEmPerMu:N.quad[t]/18};for(var a in N)N.hasOwnProperty(a)&&(r[a]=N[a][t])}return R[t]}(this.size)),this._fontMetrics}getColor(){return this.phantom?"transparent":this.color}}L.BASESIZE=6;var D={pt:1,mm:7227/2540,cm:7227/254,in:72.27,bp:1.00375,pc:12,dd:1238/1157,cc:14856/1157,nd:685/642,nc:1370/107,sp:1/65536,px:1.00375},V={ex:!0,em:!0,mu:!0},P=function(e){return"string"!=typeof e&&(e=e.unit),e in D||e in V||"ex"===e},F=function(e,t){var r;if(e.unit in D)r=D[e.unit]/t.fontMetrics().ptPerEm/t.sizeMultiplier;else if("mu"===e.unit)r=t.fontMetrics().cssEmPerMu;else{var a;if(a=t.style.isTight()?t.havingStyle(t.style.text()):t,"ex"===e.unit)r=a.fontMetrics().xHeight;else{if("em"!==e.unit)throw new i("Invalid unit: '"+e.unit+"'");r=a.fontMetrics().quad}a!==t&&(r*=a.sizeMultiplier/t.sizeMultiplier)}return Math.min(e.number*r,t.maxSize)},G=function(e){return+e.toFixed(4)+"em"},U=function(e){return e.filter((e=>e)).join(" ")},Y=function(e,t,r){if(this.classes=e||[],this.attributes={},this.height=0,this.depth=0,this.maxFontSize=0,this.style=r||{},t){t.style.isTight()&&this.classes.push("mtight");var a=t.getColor();a&&(this.style.color=a)}},X=function(e){var t=document.createElement(e);for(var r in t.className=U(this.classes),this.style)this.style.hasOwnProperty(r)&&(t.style[r]=this.style[r]);for(var a in this.attributes)this.attributes.hasOwnProperty(a)&&t.setAttribute(a,this.attributes[a]);for(var n=0;n"};class _{constructor(e,t,r,a){this.children=void 0,this.attributes=void 0,this.classes=void 0,this.height=void 0,this.depth=void 0,this.width=void 0,this.maxFontSize=void 0,this.style=void 0,Y.call(this,e,r,a),this.children=t||[]}setAttribute(e,t){this.attributes[e]=t}hasClass(e){return m.contains(this.classes,e)}toNode(){return X.call(this,"span")}toMarkup(){return W.call(this,"span")}}class j{constructor(e,t,r,a){this.children=void 0,this.attributes=void 0,this.classes=void 0,this.height=void 0,this.depth=void 0,this.maxFontSize=void 0,this.style=void 0,Y.call(this,t,a),this.children=r||[],this.setAttribute("href",e)}setAttribute(e,t){this.attributes[e]=t}hasClass(e){return m.contains(this.classes,e)}toNode(){return X.call(this,"a")}toMarkup(){return W.call(this,"a")}}class ${constructor(e,t,r){this.src=void 0,this.alt=void 0,this.classes=void 0,this.height=void 0,this.depth=void 0,this.maxFontSize=void 0,this.style=void 0,this.alt=t,this.src=e,this.classes=["mord"],this.style=r}hasClass(e){return m.contains(this.classes,e)}toNode(){var e=document.createElement("img");for(var t in e.src=this.src,e.alt=this.alt,e.className="mord",this.style)this.style.hasOwnProperty(t)&&(e.style[t]=this.style[t]);return e}toMarkup(){var e='=n[0]&&e<=n[1])return r.name}return null}(this.text.charCodeAt(0));l&&this.classes.push(l+"_fallback"),/[\xee\xef\xed\xec]/.test(this.text)&&(this.text=Z[this.text])}hasClass(e){return m.contains(this.classes,e)}toNode(){var e=document.createTextNode(this.text),t=null;for(var r in this.italic>0&&((t=document.createElement("span")).style.marginRight=G(this.italic)),this.classes.length>0&&((t=t||document.createElement("span")).className=U(this.classes)),this.style)this.style.hasOwnProperty(r)&&((t=t||document.createElement("span")).style[r]=this.style[r]);return t?(t.appendChild(e),t):e}toMarkup(){var e=!1,t="0&&(r+="margin-right:"+this.italic+"em;"),this.style)this.style.hasOwnProperty(a)&&(r+=m.hyphenate(a)+":"+this.style[a]+";");r&&(e=!0,t+=' style="'+m.escape(r)+'"');var n=m.escape(this.text);return e?(t+=">",t+=n,t+=""):n}}class J{constructor(e,t){this.children=void 0,this.attributes=void 0,this.children=e||[],this.attributes=t||{}}toNode(){var e=document.createElementNS("http://www.w3.org/2000/svg","svg");for(var t in this.attributes)Object.prototype.hasOwnProperty.call(this.attributes,t)&&e.setAttribute(t,this.attributes[t]);for(var r=0;r':''}}class ee{constructor(e){this.attributes=void 0,this.attributes=e||{}}toNode(){var e=document.createElementNS("http://www.w3.org/2000/svg","line");for(var t in this.attributes)Object.prototype.hasOwnProperty.call(this.attributes,t)&&e.setAttribute(t,this.attributes[t]);return e}toMarkup(){var e="","\\gt",!0),ie(oe,le,be,"\u2208","\\in",!0),ie(oe,le,be,"\ue020","\\@not"),ie(oe,le,be,"\u2282","\\subset",!0),ie(oe,le,be,"\u2283","\\supset",!0),ie(oe,le,be,"\u2286","\\subseteq",!0),ie(oe,le,be,"\u2287","\\supseteq",!0),ie(oe,he,be,"\u2288","\\nsubseteq",!0),ie(oe,he,be,"\u2289","\\nsupseteq",!0),ie(oe,le,be,"\u22a8","\\models"),ie(oe,le,be,"\u2190","\\leftarrow",!0),ie(oe,le,be,"\u2264","\\le"),ie(oe,le,be,"\u2264","\\leq",!0),ie(oe,le,be,"<","\\lt",!0),ie(oe,le,be,"\u2192","\\rightarrow",!0),ie(oe,le,be,"\u2192","\\to"),ie(oe,he,be,"\u2271","\\ngeq",!0),ie(oe,he,be,"\u2270","\\nleq",!0),ie(oe,le,ye,"\xa0","\\ "),ie(oe,le,ye,"\xa0","\\space"),ie(oe,le,ye,"\xa0","\\nobreakspace"),ie(se,le,ye,"\xa0","\\ "),ie(se,le,ye,"\xa0"," "),ie(se,le,ye,"\xa0","\\space"),ie(se,le,ye,"\xa0","\\nobreakspace"),ie(oe,le,ye,null,"\\nobreak"),ie(oe,le,ye,null,"\\allowbreak"),ie(oe,le,ve,",",","),ie(oe,le,ve,";",";"),ie(oe,he,ce,"\u22bc","\\barwedge",!0),ie(oe,he,ce,"\u22bb","\\veebar",!0),ie(oe,le,ce,"\u2299","\\odot",!0),ie(oe,le,ce,"\u2295","\\oplus",!0),ie(oe,le,ce,"\u2297","\\otimes",!0),ie(oe,le,xe,"\u2202","\\partial",!0),ie(oe,le,ce,"\u2298","\\oslash",!0),ie(oe,he,ce,"\u229a","\\circledcirc",!0),ie(oe,he,ce,"\u22a1","\\boxdot",!0),ie(oe,le,ce,"\u25b3","\\bigtriangleup"),ie(oe,le,ce,"\u25bd","\\bigtriangledown"),ie(oe,le,ce,"\u2020","\\dagger"),ie(oe,le,ce,"\u22c4","\\diamond"),ie(oe,le,ce,"\u22c6","\\star"),ie(oe,le,ce,"\u25c3","\\triangleleft"),ie(oe,le,ce,"\u25b9","\\triangleright"),ie(oe,le,fe,"{","\\{"),ie(se,le,xe,"{","\\{"),ie(se,le,xe,"{","\\textbraceleft"),ie(oe,le,pe,"}","\\}"),ie(se,le,xe,"}","\\}"),ie(se,le,xe,"}","\\textbraceright"),ie(oe,le,fe,"{","\\lbrace"),ie(oe,le,pe,"}","\\rbrace"),ie(oe,le,fe,"[","\\lbrack",!0),ie(se,le,xe,"[","\\lbrack",!0),ie(oe,le,pe,"]","\\rbrack",!0),ie(se,le,xe,"]","\\rbrack",!0),ie(oe,le,fe,"(","\\lparen",!0),ie(oe,le,pe,")","\\rparen",!0),ie(se,le,xe,"<","\\textless",!0),ie(se,le,xe,">","\\textgreater",!0),ie(oe,le,fe,"\u230a","\\lfloor",!0),ie(oe,le,pe,"\u230b","\\rfloor",!0),ie(oe,le,fe,"\u2308","\\lceil",!0),ie(oe,le,pe,"\u2309","\\rceil",!0),ie(oe,le,xe,"\\","\\backslash"),ie(oe,le,xe,"\u2223","|"),ie(oe,le,xe,"\u2223","\\vert"),ie(se,le,xe,"|","\\textbar",!0),ie(oe,le,xe,"\u2225","\\|"),ie(oe,le,xe,"\u2225","\\Vert"),ie(se,le,xe,"\u2225","\\textbardbl"),ie(se,le,xe,"~","\\textasciitilde"),ie(se,le,xe,"\\","\\textbackslash"),ie(se,le,xe,"^","\\textasciicircum"),ie(oe,le,be,"\u2191","\\uparrow",!0),ie(oe,le,be,"\u21d1","\\Uparrow",!0),ie(oe,le,be,"\u2193","\\downarrow",!0),ie(oe,le,be,"\u21d3","\\Downarrow",!0),ie(oe,le,be,"\u2195","\\updownarrow",!0),ie(oe,le,be,"\u21d5","\\Updownarrow",!0),ie(oe,le,ge,"\u2210","\\coprod"),ie(oe,le,ge,"\u22c1","\\bigvee"),ie(oe,le,ge,"\u22c0","\\bigwedge"),ie(oe,le,ge,"\u2a04","\\biguplus"),ie(oe,le,ge,"\u22c2","\\bigcap"),ie(oe,le,ge,"\u22c3","\\bigcup"),ie(oe,le,ge,"\u222b","\\int"),ie(oe,le,ge,"\u222b","\\intop"),ie(oe,le,ge,"\u222c","\\iint"),ie(oe,le,ge,"\u222d","\\iiint"),ie(oe,le,ge,"\u220f","\\prod"),ie(oe,le,ge,"\u2211","\\sum"),ie(oe,le,ge,"\u2a02","\\bigotimes"),ie(oe,le,ge,"\u2a01","\\bigoplus"),ie(oe,le,ge,"\u2a00","\\bigodot"),ie(oe,le,ge,"\u222e","\\oint"),ie(oe,le,ge,"\u222f","\\oiint"),ie(oe,le,ge,"\u2230","\\oiiint"),ie(oe,le,ge,"\u2a06","\\bigsqcup"),ie(oe,le,ge,"\u222b","\\smallint"),ie(se,le,ue,"\u2026","\\textellipsis"),ie(oe,le,ue,"\u2026","\\mathellipsis"),ie(se,le,ue,"\u2026","\\ldots",!0),ie(oe,le,ue,"\u2026","\\ldots",!0),ie(oe,le,ue,"\u22ef","\\@cdots",!0),ie(oe,le,ue,"\u22f1","\\ddots",!0),ie(oe,le,xe,"\u22ee","\\varvdots"),ie(oe,le,me,"\u02ca","\\acute"),ie(oe,le,me,"\u02cb","\\grave"),ie(oe,le,me,"\xa8","\\ddot"),ie(oe,le,me,"~","\\tilde"),ie(oe,le,me,"\u02c9","\\bar"),ie(oe,le,me,"\u02d8","\\breve"),ie(oe,le,me,"\u02c7","\\check"),ie(oe,le,me,"^","\\hat"),ie(oe,le,me,"\u20d7","\\vec"),ie(oe,le,me,"\u02d9","\\dot"),ie(oe,le,me,"\u02da","\\mathring"),ie(oe,le,de,"\ue131","\\@imath"),ie(oe,le,de,"\ue237","\\@jmath"),ie(oe,le,xe,"\u0131","\u0131"),ie(oe,le,xe,"\u0237","\u0237"),ie(se,le,xe,"\u0131","\\i",!0),ie(se,le,xe,"\u0237","\\j",!0),ie(se,le,xe,"\xdf","\\ss",!0),ie(se,le,xe,"\xe6","\\ae",!0),ie(se,le,xe,"\u0153","\\oe",!0),ie(se,le,xe,"\xf8","\\o",!0),ie(se,le,xe,"\xc6","\\AE",!0),ie(se,le,xe,"\u0152","\\OE",!0),ie(se,le,xe,"\xd8","\\O",!0),ie(se,le,me,"\u02ca","\\'"),ie(se,le,me,"\u02cb","\\`"),ie(se,le,me,"\u02c6","\\^"),ie(se,le,me,"\u02dc","\\~"),ie(se,le,me,"\u02c9","\\="),ie(se,le,me,"\u02d8","\\u"),ie(se,le,me,"\u02d9","\\."),ie(se,le,me,"\xb8","\\c"),ie(se,le,me,"\u02da","\\r"),ie(se,le,me,"\u02c7","\\v"),ie(se,le,me,"\xa8",'\\"'),ie(se,le,me,"\u02dd","\\H"),ie(se,le,me,"\u25ef","\\textcircled");var we={"--":!0,"---":!0,"``":!0,"''":!0};ie(se,le,xe,"\u2013","--",!0),ie(se,le,xe,"\u2013","\\textendash"),ie(se,le,xe,"\u2014","---",!0),ie(se,le,xe,"\u2014","\\textemdash"),ie(se,le,xe,"\u2018","`",!0),ie(se,le,xe,"\u2018","\\textquoteleft"),ie(se,le,xe,"\u2019","'",!0),ie(se,le,xe,"\u2019","\\textquoteright"),ie(se,le,xe,"\u201c","``",!0),ie(se,le,xe,"\u201c","\\textquotedblleft"),ie(se,le,xe,"\u201d","''",!0),ie(se,le,xe,"\u201d","\\textquotedblright"),ie(oe,le,xe,"\xb0","\\degree",!0),ie(se,le,xe,"\xb0","\\degree"),ie(se,le,xe,"\xb0","\\textdegree",!0),ie(oe,le,xe,"\xa3","\\pounds"),ie(oe,le,xe,"\xa3","\\mathsterling",!0),ie(se,le,xe,"\xa3","\\pounds"),ie(se,le,xe,"\xa3","\\textsterling",!0),ie(oe,he,xe,"\u2720","\\maltese"),ie(se,he,xe,"\u2720","\\maltese");for(var ke='0123456789/@."',Se=0;Se<14;Se++){var Me=ke.charAt(Se);ie(oe,le,xe,Me,Me)}for(var ze='0123456789!@*()-=+";:?/.,',Ae=0;Ae<25;Ae++){var Te=ze.charAt(Ae);ie(se,le,xe,Te,Te)}for(var Be="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",Ce=0;Ce<52;Ce++){var Ne=Be.charAt(Ce);ie(oe,le,de,Ne,Ne),ie(se,le,xe,Ne,Ne)}ie(oe,he,xe,"C","\u2102"),ie(se,he,xe,"C","\u2102"),ie(oe,he,xe,"H","\u210d"),ie(se,he,xe,"H","\u210d"),ie(oe,he,xe,"N","\u2115"),ie(se,he,xe,"N","\u2115"),ie(oe,he,xe,"P","\u2119"),ie(se,he,xe,"P","\u2119"),ie(oe,he,xe,"Q","\u211a"),ie(se,he,xe,"Q","\u211a"),ie(oe,he,xe,"R","\u211d"),ie(se,he,xe,"R","\u211d"),ie(oe,he,xe,"Z","\u2124"),ie(se,he,xe,"Z","\u2124"),ie(oe,le,de,"h","\u210e"),ie(se,le,de,"h","\u210e");for(var qe="",Ie=0;Ie<52;Ie++){var Re=Be.charAt(Ie);ie(oe,le,de,Re,qe=String.fromCharCode(55349,56320+Ie)),ie(se,le,xe,Re,qe),ie(oe,le,de,Re,qe=String.fromCharCode(55349,56372+Ie)),ie(se,le,xe,Re,qe),ie(oe,le,de,Re,qe=String.fromCharCode(55349,56424+Ie)),ie(se,le,xe,Re,qe),ie(oe,le,de,Re,qe=String.fromCharCode(55349,56580+Ie)),ie(se,le,xe,Re,qe),ie(oe,le,de,Re,qe=String.fromCharCode(55349,56684+Ie)),ie(se,le,xe,Re,qe),ie(oe,le,de,Re,qe=String.fromCharCode(55349,56736+Ie)),ie(se,le,xe,Re,qe),ie(oe,le,de,Re,qe=String.fromCharCode(55349,56788+Ie)),ie(se,le,xe,Re,qe),ie(oe,le,de,Re,qe=String.fromCharCode(55349,56840+Ie)),ie(se,le,xe,Re,qe),ie(oe,le,de,Re,qe=String.fromCharCode(55349,56944+Ie)),ie(se,le,xe,Re,qe),Ie<26&&(ie(oe,le,de,Re,qe=String.fromCharCode(55349,56632+Ie)),ie(se,le,xe,Re,qe),ie(oe,le,de,Re,qe=String.fromCharCode(55349,56476+Ie)),ie(se,le,xe,Re,qe))}ie(oe,le,de,"k",qe=String.fromCharCode(55349,56668)),ie(se,le,xe,"k",qe);for(var He=0;He<10;He++){var Oe=He.toString();ie(oe,le,de,Oe,qe=String.fromCharCode(55349,57294+He)),ie(se,le,xe,Oe,qe),ie(oe,le,de,Oe,qe=String.fromCharCode(55349,57314+He)),ie(se,le,xe,Oe,qe),ie(oe,le,de,Oe,qe=String.fromCharCode(55349,57324+He)),ie(se,le,xe,Oe,qe),ie(oe,le,de,Oe,qe=String.fromCharCode(55349,57334+He)),ie(se,le,xe,Oe,qe)}for(var Ee="\xd0\xde\xfe",Le=0;Le<3;Le++){var De=Ee.charAt(Le);ie(oe,le,de,De,De),ie(se,le,xe,De,De)}var Ve=[["mathbf","textbf","Main-Bold"],["mathbf","textbf","Main-Bold"],["mathnormal","textit","Math-Italic"],["mathnormal","textit","Math-Italic"],["boldsymbol","boldsymbol","Main-BoldItalic"],["boldsymbol","boldsymbol","Main-BoldItalic"],["mathscr","textscr","Script-Regular"],["","",""],["","",""],["","",""],["mathfrak","textfrak","Fraktur-Regular"],["mathfrak","textfrak","Fraktur-Regular"],["mathbb","textbb","AMS-Regular"],["mathbb","textbb","AMS-Regular"],["mathboldfrak","textboldfrak","Fraktur-Regular"],["mathboldfrak","textboldfrak","Fraktur-Regular"],["mathsf","textsf","SansSerif-Regular"],["mathsf","textsf","SansSerif-Regular"],["mathboldsf","textboldsf","SansSerif-Bold"],["mathboldsf","textboldsf","SansSerif-Bold"],["mathitsf","textitsf","SansSerif-Italic"],["mathitsf","textitsf","SansSerif-Italic"],["","",""],["","",""],["mathtt","texttt","Typewriter-Regular"],["mathtt","texttt","Typewriter-Regular"]],Pe=[["mathbf","textbf","Main-Bold"],["","",""],["mathsf","textsf","SansSerif-Regular"],["mathboldsf","textboldsf","SansSerif-Bold"],["mathtt","texttt","Typewriter-Regular"]],Fe=function(e,t,r){return ne[r][e]&&ne[r][e].replace&&(e=ne[r][e].replace),{value:e,metrics:I(e,t,r)}},Ge=function(e,t,r,a,n){var i,o=Fe(e,t,r),s=o.metrics;if(e=o.value,s){var l=s.italic;("text"===r||a&&"mathit"===a.font)&&(l=0),i=new K(e,s.height,s.depth,l,s.skew,s.width,n)}else"undefined"!=typeof console&&console.warn("No character metrics for '"+e+"' in style '"+t+"' and mode '"+r+"'"),i=new K(e,0,0,0,0,0,n);if(a){i.maxFontSize=a.sizeMultiplier,a.style.isTight()&&i.classes.push("mtight");var h=a.getColor();h&&(i.style.color=h)}return i},Ue=(e,t)=>{if(U(e.classes)!==U(t.classes)||e.skew!==t.skew||e.maxFontSize!==t.maxFontSize)return!1;if(1===e.classes.length){var r=e.classes[0];if("mbin"===r||"mord"===r)return!1}for(var a in e.style)if(e.style.hasOwnProperty(a)&&e.style[a]!==t.style[a])return!1;for(var n in t.style)if(t.style.hasOwnProperty(n)&&e.style[n]!==t.style[n])return!1;return!0},Ye=function(e){for(var t=0,r=0,a=0,n=0;nt&&(t=i.height),i.depth>r&&(r=i.depth),i.maxFontSize>a&&(a=i.maxFontSize)}e.height=t,e.depth=r,e.maxFontSize=a},Xe=function(e,t,r,a){var n=new _(e,t,r,a);return Ye(n),n},We=(e,t,r,a)=>new _(e,t,r,a),_e=function(e){var t=new B(e);return Ye(t),t},je=function(e,t,r){var a="";switch(e){case"amsrm":a="AMS";break;case"textrm":a="Main";break;case"textsf":a="SansSerif";break;case"texttt":a="Typewriter";break;default:a=e}return a+"-"+("textbf"===t&&"textit"===r?"BoldItalic":"textbf"===t?"Bold":"textit"===t?"Italic":"Regular")},$e={mathbf:{variant:"bold",fontName:"Main-Bold"},mathrm:{variant:"normal",fontName:"Main-Regular"},textit:{variant:"italic",fontName:"Main-Italic"},mathit:{variant:"italic",fontName:"Main-Italic"},mathnormal:{variant:"italic",fontName:"Math-Italic"},mathbb:{variant:"double-struck",fontName:"AMS-Regular"},mathcal:{variant:"script",fontName:"Caligraphic-Regular"},mathfrak:{variant:"fraktur",fontName:"Fraktur-Regular"},mathscr:{variant:"script",fontName:"Script-Regular"},mathsf:{variant:"sans-serif",fontName:"SansSerif-Regular"},mathtt:{variant:"monospace",fontName:"Typewriter-Regular"}},Ze={vec:["vec",.471,.714],oiintSize1:["oiintSize1",.957,.499],oiintSize2:["oiintSize2",1.472,.659],oiiintSize1:["oiiintSize1",1.304,.499],oiiintSize2:["oiiintSize2",1.98,.659]},Ke={fontMap:$e,makeSymbol:Ge,mathsym:function(e,t,r,a){return void 0===a&&(a=[]),"boldsymbol"===r.font&&Fe(e,"Main-Bold",t).metrics?Ge(e,"Main-Bold",t,r,a.concat(["mathbf"])):"\\"===e||"main"===ne[t][e].font?Ge(e,"Main-Regular",t,r,a):Ge(e,"AMS-Regular",t,r,a.concat(["amsrm"]))},makeSpan:Xe,makeSvgSpan:We,makeLineSpan:function(e,t,r){var a=Xe([e],[],t);return a.height=Math.max(r||t.fontMetrics().defaultRuleThickness,t.minRuleThickness),a.style.borderBottomWidth=G(a.height),a.maxFontSize=1,a},makeAnchor:function(e,t,r,a){var n=new j(e,t,r,a);return Ye(n),n},makeFragment:_e,wrapFragment:function(e,t){return e instanceof B?Xe([],[e],t):e},makeVList:function(e,t){for(var{children:r,depth:a}=function(e){if("individualShift"===e.positionType){for(var t=e.children,r=[t[0]],a=-t[0].shift-t[0].elem.depth,n=a,i=1;i0)return Ge(n,h,a,t,o.concat(m));if(l){var c,p;if("boldsymbol"===l){var u=function(e,t,r,a,n){return"textord"!==n&&Fe(e,"Math-BoldItalic",t).metrics?{fontName:"Math-BoldItalic",fontClass:"boldsymbol"}:{fontName:"Main-Bold",fontClass:"mathbf"}}(n,a,0,0,r);c=u.fontName,p=[u.fontClass]}else s?(c=$e[l].fontName,p=[l]):(c=je(l,t.fontWeight,t.fontShape),p=[l,t.fontWeight,t.fontShape]);if(Fe(n,c,a).metrics)return Ge(n,c,a,t,o.concat(p));if(we.hasOwnProperty(n)&&"Typewriter"===c.slice(0,10)){for(var d=[],g=0;g{var r=Xe(["mspace"],[],t),a=F(e,t);return r.style.marginRight=G(a),r},staticSvg:function(e,t){var[r,a,n]=Ze[e],i=new Q(r),o=new J([i],{width:G(a),height:G(n),style:"width:"+G(a),viewBox:"0 0 "+1e3*a+" "+1e3*n,preserveAspectRatio:"xMinYMin"}),s=We(["overlay"],[o],t);return s.height=n,s.style.height=G(n),s.style.width=G(a),s},svgData:Ze,tryCombineChars:e=>{for(var t=0;t{var r=t.classes[0],a=e.classes[0];"mbin"===r&&m.contains(pt,a)?t.classes[0]="mord":"mbin"===a&&m.contains(ct,r)&&(e.classes[0]="mord")}),{node:c},p,u),ft(n,((e,t)=>{var r=yt(t),a=yt(e),n=r&&a?e.hasClass("mtight")?rt[r][a]:tt[r][a]:null;if(n)return Ke.makeGlue(n,l)}),{node:c},p,u),n},ft=function e(t,r,a,n,i){n&&t.push(n);for(var o=0;or=>{t.splice(e+1,0,r),o++})(o)}}n&&t.pop()},vt=function(e){return e instanceof B||e instanceof j||e instanceof _&&e.hasClass("enclosing")?e:null},bt=function e(t,r){var a=vt(t);if(a){var n=a.children;if(n.length){if("right"===r)return e(n[n.length-1],"right");if("left"===r)return e(n[0],"left")}}return t},yt=function(e,t){return e?(t&&(e=bt(e,t)),dt[e.classes[0]]||null):null},xt=function(e,t){var r=["nulldelimiter"].concat(e.baseSizingClasses());return mt(t.concat(r))},wt=function(e,t,r){if(!e)return mt();if(nt[e.type]){var a=nt[e.type](e,t);if(r&&t.size!==r.size){a=mt(t.sizingClasses(r),[a],t);var n=t.sizeMultiplier/r.sizeMultiplier;a.height*=n,a.depth*=n}return a}throw new i("Got group of unknown type: '"+e.type+"'")};function kt(e,t){var r=mt(["base"],e,t),a=mt(["strut"]);return a.style.height=G(r.height+r.depth),r.depth&&(a.style.verticalAlign=G(-r.depth)),r.children.unshift(a),r}function St(e,t){var r=null;1===e.length&&"tag"===e[0].type&&(r=e[0].tag,e=e[0].body);var a,n=gt(e,t,"root");2===n.length&&n[1].hasClass("tag")&&(a=n.pop());for(var i,o=[],s=[],l=0;l0&&(o.push(kt(s,t)),s=[]),o.push(n[l]));s.length>0&&o.push(kt(s,t)),r?((i=kt(gt(r,t,!0))).classes=["tag"],o.push(i)):a&&o.push(a);var m=mt(["katex-html"],o);if(m.setAttribute("aria-hidden","true"),i){var c=i.children[0];c.style.height=G(m.height+m.depth),m.depth&&(c.style.verticalAlign=G(-m.depth))}return m}function Mt(e){return new B(e)}class zt{constructor(e,t,r){this.type=void 0,this.attributes=void 0,this.children=void 0,this.classes=void 0,this.type=e,this.attributes={},this.children=t||[],this.classes=r||[]}setAttribute(e,t){this.attributes[e]=t}getAttribute(e){return this.attributes[e]}toNode(){var e=document.createElementNS("http://www.w3.org/1998/Math/MathML",this.type);for(var t in this.attributes)Object.prototype.hasOwnProperty.call(this.attributes,t)&&e.setAttribute(t,this.attributes[t]);this.classes.length>0&&(e.className=U(this.classes));for(var r=0;r0&&(e+=' class ="'+m.escape(U(this.classes))+'"'),e+=">";for(var r=0;r"}toText(){return this.children.map((e=>e.toText())).join("")}}class At{constructor(e){this.text=void 0,this.text=e}toNode(){return document.createTextNode(this.text)}toMarkup(){return m.escape(this.toText())}toText(){return this.text}}var Tt={MathNode:zt,TextNode:At,SpaceNode:class{constructor(e){this.width=void 0,this.character=void 0,this.width=e,this.character=e>=.05555&&e<=.05556?"\u200a":e>=.1666&&e<=.1667?"\u2009":e>=.2222&&e<=.2223?"\u2005":e>=.2777&&e<=.2778?"\u2005\u200a":e>=-.05556&&e<=-.05555?"\u200a\u2063":e>=-.1667&&e<=-.1666?"\u2009\u2063":e>=-.2223&&e<=-.2222?"\u205f\u2063":e>=-.2778&&e<=-.2777?"\u2005\u2063":null}toNode(){if(this.character)return document.createTextNode(this.character);var e=document.createElementNS("http://www.w3.org/1998/Math/MathML","mspace");return e.setAttribute("width",G(this.width)),e}toMarkup(){return this.character?""+this.character+"":''}toText(){return this.character?this.character:" "}},newDocumentFragment:Mt},Bt=function(e,t,r){return!ne[t][e]||!ne[t][e].replace||55349===e.charCodeAt(0)||we.hasOwnProperty(e)&&r&&(r.fontFamily&&"tt"===r.fontFamily.slice(4,6)||r.font&&"tt"===r.font.slice(4,6))||(e=ne[t][e].replace),new Tt.TextNode(e)},Ct=function(e){return 1===e.length?e[0]:new Tt.MathNode("mrow",e)},Nt=function(e,t){if("texttt"===t.fontFamily)return"monospace";if("textsf"===t.fontFamily)return"textit"===t.fontShape&&"textbf"===t.fontWeight?"sans-serif-bold-italic":"textit"===t.fontShape?"sans-serif-italic":"textbf"===t.fontWeight?"bold-sans-serif":"sans-serif";if("textit"===t.fontShape&&"textbf"===t.fontWeight)return"bold-italic";if("textit"===t.fontShape)return"italic";if("textbf"===t.fontWeight)return"bold";var r=t.font;if(!r||"mathnormal"===r)return null;var a=e.mode;if("mathit"===r)return"italic";if("boldsymbol"===r)return"textord"===e.type?"bold":"bold-italic";if("mathbf"===r)return"bold";if("mathbb"===r)return"double-struck";if("mathfrak"===r)return"fraktur";if("mathscr"===r||"mathcal"===r)return"script";if("mathsf"===r)return"sans-serif";if("mathtt"===r)return"monospace";var n=e.text;return m.contains(["\\imath","\\jmath"],n)?null:(ne[a][n]&&ne[a][n].replace&&(n=ne[a][n].replace),I(n,Ke.fontMap[r].fontName,a)?Ke.fontMap[r].variant:null)},qt=function(e,t,r){if(1===e.length){var a=Rt(e[0],t);return r&&a instanceof zt&&"mo"===a.type&&(a.setAttribute("lspace","0em"),a.setAttribute("rspace","0em")),[a]}for(var n,i=[],o=0;o0&&(m.text=m.text.slice(0,1)+"\u0338"+m.text.slice(1),i.pop())}}}i.push(s),n=s}return i},It=function(e,t,r){return Ct(qt(e,t,r))},Rt=function(e,t){if(!e)return new Tt.MathNode("mrow");if(it[e.type])return it[e.type](e,t);throw new i("Got group of unknown type: '"+e.type+"'")};function Ht(e,t,r,a,n){var i,o=qt(e,r);i=1===o.length&&o[0]instanceof zt&&m.contains(["mrow","mtable"],o[0].type)?o[0]:new Tt.MathNode("mrow",o);var s=new Tt.MathNode("annotation",[new Tt.TextNode(t)]);s.setAttribute("encoding","application/x-tex");var l=new Tt.MathNode("semantics",[i,s]),h=new Tt.MathNode("math",[l]);h.setAttribute("xmlns","http://www.w3.org/1998/Math/MathML"),a&&h.setAttribute("display","block");var c=n?"katex":"katex-mathml";return Ke.makeSpan([c],[h])}var Ot=function(e){return new L({style:e.displayMode?k.DISPLAY:k.TEXT,maxSize:e.maxSize,minRuleThickness:e.minRuleThickness})},Et=function(e,t){if(t.displayMode){var r=["katex-display"];t.leqno&&r.push("leqno"),t.fleqn&&r.push("fleqn"),e=Ke.makeSpan(r,[e])}return e},Lt={widehat:"^",widecheck:"\u02c7",widetilde:"~",utilde:"~",overleftarrow:"\u2190",underleftarrow:"\u2190",xleftarrow:"\u2190",overrightarrow:"\u2192",underrightarrow:"\u2192",xrightarrow:"\u2192",underbrace:"\u23df",overbrace:"\u23de",overgroup:"\u23e0",undergroup:"\u23e1",overleftrightarrow:"\u2194",underleftrightarrow:"\u2194",xleftrightarrow:"\u2194",Overrightarrow:"\u21d2",xRightarrow:"\u21d2",overleftharpoon:"\u21bc",xleftharpoonup:"\u21bc",overrightharpoon:"\u21c0",xrightharpoonup:"\u21c0",xLeftarrow:"\u21d0",xLeftrightarrow:"\u21d4",xhookleftarrow:"\u21a9",xhookrightarrow:"\u21aa",xmapsto:"\u21a6",xrightharpoondown:"\u21c1",xleftharpoondown:"\u21bd",xrightleftharpoons:"\u21cc",xleftrightharpoons:"\u21cb",xtwoheadleftarrow:"\u219e",xtwoheadrightarrow:"\u21a0",xlongequal:"=",xtofrom:"\u21c4",xrightleftarrows:"\u21c4",xrightequilibrium:"\u21cc",xleftequilibrium:"\u21cb","\\cdrightarrow":"\u2192","\\cdleftarrow":"\u2190","\\cdlongequal":"="},Dt={overrightarrow:[["rightarrow"],.888,522,"xMaxYMin"],overleftarrow:[["leftarrow"],.888,522,"xMinYMin"],underrightarrow:[["rightarrow"],.888,522,"xMaxYMin"],underleftarrow:[["leftarrow"],.888,522,"xMinYMin"],xrightarrow:[["rightarrow"],1.469,522,"xMaxYMin"],"\\cdrightarrow":[["rightarrow"],3,522,"xMaxYMin"],xleftarrow:[["leftarrow"],1.469,522,"xMinYMin"],"\\cdleftarrow":[["leftarrow"],3,522,"xMinYMin"],Overrightarrow:[["doublerightarrow"],.888,560,"xMaxYMin"],xRightarrow:[["doublerightarrow"],1.526,560,"xMaxYMin"],xLeftarrow:[["doubleleftarrow"],1.526,560,"xMinYMin"],overleftharpoon:[["leftharpoon"],.888,522,"xMinYMin"],xleftharpoonup:[["leftharpoon"],.888,522,"xMinYMin"],xleftharpoondown:[["leftharpoondown"],.888,522,"xMinYMin"],overrightharpoon:[["rightharpoon"],.888,522,"xMaxYMin"],xrightharpoonup:[["rightharpoon"],.888,522,"xMaxYMin"],xrightharpoondown:[["rightharpoondown"],.888,522,"xMaxYMin"],xlongequal:[["longequal"],.888,334,"xMinYMin"],"\\cdlongequal":[["longequal"],3,334,"xMinYMin"],xtwoheadleftarrow:[["twoheadleftarrow"],.888,334,"xMinYMin"],xtwoheadrightarrow:[["twoheadrightarrow"],.888,334,"xMaxYMin"],overleftrightarrow:[["leftarrow","rightarrow"],.888,522],overbrace:[["leftbrace","midbrace","rightbrace"],1.6,548],underbrace:[["leftbraceunder","midbraceunder","rightbraceunder"],1.6,548],underleftrightarrow:[["leftarrow","rightarrow"],.888,522],xleftrightarrow:[["leftarrow","rightarrow"],1.75,522],xLeftrightarrow:[["doubleleftarrow","doublerightarrow"],1.75,560],xrightleftharpoons:[["leftharpoondownplus","rightharpoonplus"],1.75,716],xleftrightharpoons:[["leftharpoonplus","rightharpoondownplus"],1.75,716],xhookleftarrow:[["leftarrow","righthook"],1.08,522],xhookrightarrow:[["lefthook","rightarrow"],1.08,522],overlinesegment:[["leftlinesegment","rightlinesegment"],.888,522],underlinesegment:[["leftlinesegment","rightlinesegment"],.888,522],overgroup:[["leftgroup","rightgroup"],.888,342],undergroup:[["leftgroupunder","rightgroupunder"],.888,342],xmapsto:[["leftmapsto","rightarrow"],1.5,522],xtofrom:[["leftToFrom","rightToFrom"],1.75,528],xrightleftarrows:[["baraboveleftarrow","rightarrowabovebar"],1.75,901],xrightequilibrium:[["baraboveshortleftharpoon","rightharpoonaboveshortbar"],1.75,716],xleftequilibrium:[["shortbaraboveleftharpoon","shortrightharpoonabovebar"],1.75,716]},Vt=function(e,t,r,a,n){var i,o=e.height+e.depth+r+a;if(/fbox|color|angl/.test(t)){if(i=Ke.makeSpan(["stretchy",t],[],n),"fbox"===t){var s=n.color&&n.getColor();s&&(i.style.borderColor=s)}}else{var l=[];/^[bx]cancel$/.test(t)&&l.push(new ee({x1:"0",y1:"0",x2:"100%",y2:"100%","stroke-width":"0.046em"})),/^x?cancel$/.test(t)&&l.push(new ee({x1:"0",y1:"100%",x2:"100%",y2:"0","stroke-width":"0.046em"}));var h=new J(l,{width:"100%",height:G(o)});i=Ke.makeSvgSpan([],[h],n)}return i.height=o,i.style.height=G(o),i},Pt=function(e){var t=new Tt.MathNode("mo",[new Tt.TextNode(Lt[e.replace(/^\\/,"")])]);return t.setAttribute("stretchy","true"),t},Ft=function(e,t){var{span:r,minWidth:a,height:n}=function(){var r=4e5,a=e.label.slice(1);if(m.contains(["widehat","widecheck","widetilde","utilde"],a)){var n,i,o,s="ordgroup"===(d=e.base).type?d.body.length:1;if(s>5)"widehat"===a||"widecheck"===a?(n=420,r=2364,o=.42,i=a+"4"):(n=312,r=2340,o=.34,i="tilde4");else{var l=[1,1,2,2,3,3][s];"widehat"===a||"widecheck"===a?(r=[0,1062,2364,2364,2364][l],n=[0,239,300,360,420][l],o=[0,.24,.3,.3,.36,.42][l],i=a+l):(r=[0,600,1033,2339,2340][l],n=[0,260,286,306,312][l],o=[0,.26,.286,.3,.306,.34][l],i="tilde"+l)}var h=new Q(i),c=new J([h],{width:"100%",height:G(o),viewBox:"0 0 "+r+" "+n,preserveAspectRatio:"none"});return{span:Ke.makeSvgSpan([],[c],t),minWidth:0,height:o}}var p,u,d,g=[],f=Dt[a],[v,b,y]=f,x=y/1e3,w=v.length;if(1===w)p=["hide-tail"],u=[f[3]];else if(2===w)p=["halfarrow-left","halfarrow-right"],u=["xMinYMin","xMaxYMin"];else{if(3!==w)throw new Error("Correct katexImagesData or update code here to support\n "+w+" children.");p=["brace-left","brace-center","brace-right"],u=["xMinYMin","xMidYMin","xMaxYMin"]}for(var k=0;k0&&(r.style.minWidth=G(a)),r};function Gt(e,t){if(!e||e.type!==t)throw new Error("Expected node of type "+t+", but got "+(e?"node of type "+e.type:String(e)));return e}function Ut(e){var t=Yt(e);if(!t)throw new Error("Expected node of symbol group type, but got "+(e?"node of type "+e.type:String(e)));return t}function Yt(e){return e&&("atom"===e.type||ae.hasOwnProperty(e.type))?e:null}var Xt=(e,t)=>{var r,a,n;e&&"supsub"===e.type?(r=(a=Gt(e.base,"accent")).base,e.base=r,n=function(e){if(e instanceof _)return e;throw new Error("Expected span but got "+String(e)+".")}(wt(e,t)),e.base=a):r=(a=Gt(e,"accent")).base;var i=wt(r,t.havingCrampedStyle()),o=0;if(a.isShifty&&m.isCharacterBox(r)){var s=m.getBaseElem(r);o=te(wt(s,t.havingCrampedStyle())).skew}var l,h="\\c"===a.label,c=h?i.height+i.depth:Math.min(i.height,t.fontMetrics().xHeight);if(a.isStretchy)l=Ft(a,t),l=Ke.makeVList({positionType:"firstBaseline",children:[{type:"elem",elem:i},{type:"elem",elem:l,wrapperClasses:["svg-align"],wrapperStyle:o>0?{width:"calc(100% - "+G(2*o)+")",marginLeft:G(2*o)}:void 0}]},t);else{var p,u;"\\vec"===a.label?(p=Ke.staticSvg("vec",t),u=Ke.svgData.vec[1]):((p=te(p=Ke.makeOrd({mode:a.mode,text:a.label},t,"textord"))).italic=0,u=p.width,h&&(c+=p.depth)),l=Ke.makeSpan(["accent-body"],[p]);var d="\\textcircled"===a.label;d&&(l.classes.push("accent-full"),c=i.height);var g=o;d||(g-=u/2),l.style.left=G(g),"\\textcircled"===a.label&&(l.style.top=".2em"),l=Ke.makeVList({positionType:"firstBaseline",children:[{type:"elem",elem:i},{type:"kern",size:-c},{type:"elem",elem:l}]},t)}var f=Ke.makeSpan(["mord","accent"],[l],t);return n?(n.children[0]=f,n.height=Math.max(f.height,n.height),n.classes[0]="mord",n):f},Wt=(e,t)=>{var r=e.isStretchy?Pt(e.label):new Tt.MathNode("mo",[Bt(e.label,e.mode)]),a=new Tt.MathNode("mover",[Rt(e.base,t),r]);return a.setAttribute("accent","true"),a},_t=new RegExp(["\\acute","\\grave","\\ddot","\\tilde","\\bar","\\breve","\\check","\\hat","\\vec","\\dot","\\mathring"].map((e=>"\\"+e)).join("|"));ot({type:"accent",names:["\\acute","\\grave","\\ddot","\\tilde","\\bar","\\breve","\\check","\\hat","\\vec","\\dot","\\mathring","\\widecheck","\\widehat","\\widetilde","\\overrightarrow","\\overleftarrow","\\Overrightarrow","\\overleftrightarrow","\\overgroup","\\overlinesegment","\\overleftharpoon","\\overrightharpoon"],props:{numArgs:1},handler:(e,t)=>{var r=lt(t[0]),a=!_t.test(e.funcName),n=!a||"\\widehat"===e.funcName||"\\widetilde"===e.funcName||"\\widecheck"===e.funcName;return{type:"accent",mode:e.parser.mode,label:e.funcName,isStretchy:a,isShifty:n,base:r}},htmlBuilder:Xt,mathmlBuilder:Wt}),ot({type:"accent",names:["\\'","\\`","\\^","\\~","\\=","\\u","\\.",'\\"',"\\c","\\r","\\H","\\v","\\textcircled"],props:{numArgs:1,allowedInText:!0,allowedInMath:!0,argTypes:["primitive"]},handler:(e,t)=>{var r=t[0],a=e.parser.mode;return"math"===a&&(e.parser.settings.reportNonstrict("mathVsTextAccents","LaTeX's accent "+e.funcName+" works only in text mode"),a="text"),{type:"accent",mode:a,label:e.funcName,isStretchy:!1,isShifty:!0,base:r}},htmlBuilder:Xt,mathmlBuilder:Wt}),ot({type:"accentUnder",names:["\\underleftarrow","\\underrightarrow","\\underleftrightarrow","\\undergroup","\\underlinesegment","\\utilde"],props:{numArgs:1},handler:(e,t)=>{var{parser:r,funcName:a}=e,n=t[0];return{type:"accentUnder",mode:r.mode,label:a,base:n}},htmlBuilder:(e,t)=>{var r=wt(e.base,t),a=Ft(e,t),n="\\utilde"===e.label?.12:0,i=Ke.makeVList({positionType:"top",positionData:r.height,children:[{type:"elem",elem:a,wrapperClasses:["svg-align"]},{type:"kern",size:n},{type:"elem",elem:r}]},t);return Ke.makeSpan(["mord","accentunder"],[i],t)},mathmlBuilder:(e,t)=>{var r=Pt(e.label),a=new Tt.MathNode("munder",[Rt(e.base,t),r]);return a.setAttribute("accentunder","true"),a}});var jt=e=>{var t=new Tt.MathNode("mpadded",e?[e]:[]);return t.setAttribute("width","+0.6em"),t.setAttribute("lspace","0.3em"),t};ot({type:"xArrow",names:["\\xleftarrow","\\xrightarrow","\\xLeftarrow","\\xRightarrow","\\xleftrightarrow","\\xLeftrightarrow","\\xhookleftarrow","\\xhookrightarrow","\\xmapsto","\\xrightharpoondown","\\xrightharpoonup","\\xleftharpoondown","\\xleftharpoonup","\\xrightleftharpoons","\\xleftrightharpoons","\\xlongequal","\\xtwoheadrightarrow","\\xtwoheadleftarrow","\\xtofrom","\\xrightleftarrows","\\xrightequilibrium","\\xleftequilibrium","\\\\cdrightarrow","\\\\cdleftarrow","\\\\cdlongequal"],props:{numArgs:1,numOptionalArgs:1},handler(e,t,r){var{parser:a,funcName:n}=e;return{type:"xArrow",mode:a.mode,label:n,body:t[0],below:r[0]}},htmlBuilder(e,t){var r,a=t.style,n=t.havingStyle(a.sup()),i=Ke.wrapFragment(wt(e.body,n,t),t),o="\\x"===e.label.slice(0,2)?"x":"cd";i.classes.push(o+"-arrow-pad"),e.below&&(n=t.havingStyle(a.sub()),(r=Ke.wrapFragment(wt(e.below,n,t),t)).classes.push(o+"-arrow-pad"));var s,l=Ft(e,t),h=-t.fontMetrics().axisHeight+.5*l.height,m=-t.fontMetrics().axisHeight-.5*l.height-.111;if((i.depth>.25||"\\xleftequilibrium"===e.label)&&(m-=i.depth),r){var c=-t.fontMetrics().axisHeight+r.height+.5*l.height+.111;s=Ke.makeVList({positionType:"individualShift",children:[{type:"elem",elem:i,shift:m},{type:"elem",elem:l,shift:h},{type:"elem",elem:r,shift:c}]},t)}else s=Ke.makeVList({positionType:"individualShift",children:[{type:"elem",elem:i,shift:m},{type:"elem",elem:l,shift:h}]},t);return s.children[0].children[0].children[1].classes.push("svg-align"),Ke.makeSpan(["mrel","x-arrow"],[s],t)},mathmlBuilder(e,t){var r,a=Pt(e.label);if(a.setAttribute("minsize","x"===e.label.charAt(0)?"1.75em":"3.0em"),e.body){var n=jt(Rt(e.body,t));if(e.below){var i=jt(Rt(e.below,t));r=new Tt.MathNode("munderover",[a,i,n])}else r=new Tt.MathNode("mover",[a,n])}else if(e.below){var o=jt(Rt(e.below,t));r=new Tt.MathNode("munder",[a,o])}else r=jt(),r=new Tt.MathNode("mover",[a,r]);return r}});var $t=Ke.makeSpan;function Zt(e,t){var r=gt(e.body,t,!0);return $t([e.mclass],r,t)}function Kt(e,t){var r,a=qt(e.body,t);return"minner"===e.mclass?r=new Tt.MathNode("mpadded",a):"mord"===e.mclass?e.isCharacterBox?(r=a[0]).type="mi":r=new Tt.MathNode("mi",a):(e.isCharacterBox?(r=a[0]).type="mo":r=new Tt.MathNode("mo",a),"mbin"===e.mclass?(r.attributes.lspace="0.22em",r.attributes.rspace="0.22em"):"mpunct"===e.mclass?(r.attributes.lspace="0em",r.attributes.rspace="0.17em"):"mopen"===e.mclass||"mclose"===e.mclass?(r.attributes.lspace="0em",r.attributes.rspace="0em"):"minner"===e.mclass&&(r.attributes.lspace="0.0556em",r.attributes.width="+0.1111em")),r}ot({type:"mclass",names:["\\mathord","\\mathbin","\\mathrel","\\mathopen","\\mathclose","\\mathpunct","\\mathinner"],props:{numArgs:1,primitive:!0},handler(e,t){var{parser:r,funcName:a}=e,n=t[0];return{type:"mclass",mode:r.mode,mclass:"m"+a.slice(5),body:ht(n),isCharacterBox:m.isCharacterBox(n)}},htmlBuilder:Zt,mathmlBuilder:Kt});var Jt=e=>{var t="ordgroup"===e.type&&e.body.length?e.body[0]:e;return"atom"!==t.type||"bin"!==t.family&&"rel"!==t.family?"mord":"m"+t.family};ot({type:"mclass",names:["\\@binrel"],props:{numArgs:2},handler(e,t){var{parser:r}=e;return{type:"mclass",mode:r.mode,mclass:Jt(t[0]),body:ht(t[1]),isCharacterBox:m.isCharacterBox(t[1])}}}),ot({type:"mclass",names:["\\stackrel","\\overset","\\underset"],props:{numArgs:2},handler(e,t){var r,{parser:a,funcName:n}=e,i=t[1],o=t[0];r="\\stackrel"!==n?Jt(i):"mrel";var s={type:"op",mode:i.mode,limits:!0,alwaysHandleSupSub:!0,parentIsSupSub:!1,symbol:!1,suppressBaseShift:"\\stackrel"!==n,body:ht(i)},l={type:"supsub",mode:o.mode,base:s,sup:"\\underset"===n?null:o,sub:"\\underset"===n?o:null};return{type:"mclass",mode:a.mode,mclass:r,body:[l],isCharacterBox:m.isCharacterBox(l)}},htmlBuilder:Zt,mathmlBuilder:Kt}),ot({type:"pmb",names:["\\pmb"],props:{numArgs:1,allowedInText:!0},handler(e,t){var{parser:r}=e;return{type:"pmb",mode:r.mode,mclass:Jt(t[0]),body:ht(t[0])}},htmlBuilder(e,t){var r=gt(e.body,t,!0),a=Ke.makeSpan([e.mclass],r,t);return a.style.textShadow="0.02em 0.01em 0.04px",a},mathmlBuilder(e,t){var r=qt(e.body,t),a=new Tt.MathNode("mstyle",r);return a.setAttribute("style","text-shadow: 0.02em 0.01em 0.04px"),a}});var Qt={">":"\\\\cdrightarrow","<":"\\\\cdleftarrow","=":"\\\\cdlongequal",A:"\\uparrow",V:"\\downarrow","|":"\\Vert",".":"no arrow"},er=e=>"textord"===e.type&&"@"===e.text;function tr(e,t,r){var a=Qt[e];switch(a){case"\\\\cdrightarrow":case"\\\\cdleftarrow":return r.callFunction(a,[t[0]],[t[1]]);case"\\uparrow":case"\\downarrow":var n={type:"atom",text:a,mode:"math",family:"rel"},i={type:"ordgroup",mode:"math",body:[r.callFunction("\\\\cdleft",[t[0]],[]),r.callFunction("\\Big",[n],[]),r.callFunction("\\\\cdright",[t[1]],[])]};return r.callFunction("\\\\cdparent",[i],[]);case"\\\\cdlongequal":return r.callFunction("\\\\cdlongequal",[],[]);case"\\Vert":return r.callFunction("\\Big",[{type:"textord",text:"\\Vert",mode:"math"}],[]);default:return{type:"textord",text:" ",mode:"math"}}}ot({type:"cdlabel",names:["\\\\cdleft","\\\\cdright"],props:{numArgs:1},handler(e,t){var{parser:r,funcName:a}=e;return{type:"cdlabel",mode:r.mode,side:a.slice(4),label:t[0]}},htmlBuilder(e,t){var r=t.havingStyle(t.style.sup()),a=Ke.wrapFragment(wt(e.label,r,t),t);return a.classes.push("cd-label-"+e.side),a.style.bottom=G(.8-a.depth),a.height=0,a.depth=0,a},mathmlBuilder(e,t){var r=new Tt.MathNode("mrow",[Rt(e.label,t)]);return(r=new Tt.MathNode("mpadded",[r])).setAttribute("width","0"),"left"===e.side&&r.setAttribute("lspace","-1width"),r.setAttribute("voffset","0.7em"),(r=new Tt.MathNode("mstyle",[r])).setAttribute("displaystyle","false"),r.setAttribute("scriptlevel","1"),r}}),ot({type:"cdlabelparent",names:["\\\\cdparent"],props:{numArgs:1},handler(e,t){var{parser:r}=e;return{type:"cdlabelparent",mode:r.mode,fragment:t[0]}},htmlBuilder(e,t){var r=Ke.wrapFragment(wt(e.fragment,t),t);return r.classes.push("cd-vert-arrow"),r},mathmlBuilder:(e,t)=>new Tt.MathNode("mrow",[Rt(e.fragment,t)])}),ot({type:"textord",names:["\\@char"],props:{numArgs:1,allowedInText:!0},handler(e,t){for(var{parser:r}=e,a=Gt(t[0],"ordgroup").body,n="",o=0;o=1114111)throw new i("\\@char with invalid code point "+n);return l<=65535?s=String.fromCharCode(l):(l-=65536,s=String.fromCharCode(55296+(l>>10),56320+(1023&l))),{type:"textord",mode:r.mode,text:s}}});var rr=(e,t)=>{var r=gt(e.body,t.withColor(e.color),!1);return Ke.makeFragment(r)},ar=(e,t)=>{var r=qt(e.body,t.withColor(e.color)),a=new Tt.MathNode("mstyle",r);return a.setAttribute("mathcolor",e.color),a};ot({type:"color",names:["\\textcolor"],props:{numArgs:2,allowedInText:!0,argTypes:["color","original"]},handler(e,t){var{parser:r}=e,a=Gt(t[0],"color-token").color,n=t[1];return{type:"color",mode:r.mode,color:a,body:ht(n)}},htmlBuilder:rr,mathmlBuilder:ar}),ot({type:"color",names:["\\color"],props:{numArgs:1,allowedInText:!0,argTypes:["color"]},handler(e,t){var{parser:r,breakOnTokenText:a}=e,n=Gt(t[0],"color-token").color;r.gullet.macros.set("\\current@color",n);var i=r.parseExpression(!0,a);return{type:"color",mode:r.mode,color:n,body:i}},htmlBuilder:rr,mathmlBuilder:ar}),ot({type:"cr",names:["\\\\"],props:{numArgs:0,numOptionalArgs:0,allowedInText:!0},handler(e,t,r){var{parser:a}=e,n="["===a.gullet.future().text?a.parseSizeGroup(!0):null,i=!a.settings.displayMode||!a.settings.useStrictBehavior("newLineInDisplayMode","In LaTeX, \\\\ or \\newline does nothing in display mode");return{type:"cr",mode:a.mode,newLine:i,size:n&&Gt(n,"size").value}},htmlBuilder(e,t){var r=Ke.makeSpan(["mspace"],[],t);return e.newLine&&(r.classes.push("newline"),e.size&&(r.style.marginTop=G(F(e.size,t)))),r},mathmlBuilder(e,t){var r=new Tt.MathNode("mspace");return e.newLine&&(r.setAttribute("linebreak","newline"),e.size&&r.setAttribute("height",G(F(e.size,t)))),r}});var nr={"\\global":"\\global","\\long":"\\\\globallong","\\\\globallong":"\\\\globallong","\\def":"\\gdef","\\gdef":"\\gdef","\\edef":"\\xdef","\\xdef":"\\xdef","\\let":"\\\\globallet","\\futurelet":"\\\\globalfuture"},ir=e=>{var t=e.text;if(/^(?:[\\{}$&#^_]|EOF)$/.test(t))throw new i("Expected a control sequence",e);return t},or=(e,t,r,a)=>{var n=e.gullet.macros.get(r.text);null==n&&(r.noexpand=!0,n={tokens:[r],numArgs:0,unexpandable:!e.gullet.isExpandable(r.text)}),e.gullet.macros.set(t,n,a)};ot({type:"internal",names:["\\global","\\long","\\\\globallong"],props:{numArgs:0,allowedInText:!0},handler(e){var{parser:t,funcName:r}=e;t.consumeSpaces();var a=t.fetch();if(nr[a.text])return"\\global"!==r&&"\\\\globallong"!==r||(a.text=nr[a.text]),Gt(t.parseFunction(),"internal");throw new i("Invalid token after macro prefix",a)}}),ot({type:"internal",names:["\\def","\\gdef","\\edef","\\xdef"],props:{numArgs:0,allowedInText:!0,primitive:!0},handler(e){var{parser:t,funcName:r}=e,a=t.gullet.popToken(),n=a.text;if(/^(?:[\\{}$&#^_]|EOF)$/.test(n))throw new i("Expected a control sequence",a);for(var o,s=0,l=[[]];"{"!==t.gullet.future().text;)if("#"===(a=t.gullet.popToken()).text){if("{"===t.gullet.future().text){o=t.gullet.future(),l[s].push("{");break}if(a=t.gullet.popToken(),!/^[1-9]$/.test(a.text))throw new i('Invalid argument number "'+a.text+'"');if(parseInt(a.text)!==s+1)throw new i('Argument number "'+a.text+'" out of order');s++,l.push([])}else{if("EOF"===a.text)throw new i("Expected a macro definition");l[s].push(a.text)}var{tokens:h}=t.gullet.consumeArg();return o&&h.unshift(o),"\\edef"!==r&&"\\xdef"!==r||(h=t.gullet.expandTokens(h)).reverse(),t.gullet.macros.set(n,{tokens:h,numArgs:s,delimiters:l},r===nr[r]),{type:"internal",mode:t.mode}}}),ot({type:"internal",names:["\\let","\\\\globallet"],props:{numArgs:0,allowedInText:!0,primitive:!0},handler(e){var{parser:t,funcName:r}=e,a=ir(t.gullet.popToken());t.gullet.consumeSpaces();var n=(e=>{var t=e.gullet.popToken();return"="===t.text&&" "===(t=e.gullet.popToken()).text&&(t=e.gullet.popToken()),t})(t);return or(t,a,n,"\\\\globallet"===r),{type:"internal",mode:t.mode}}}),ot({type:"internal",names:["\\futurelet","\\\\globalfuture"],props:{numArgs:0,allowedInText:!0,primitive:!0},handler(e){var{parser:t,funcName:r}=e,a=ir(t.gullet.popToken()),n=t.gullet.popToken(),i=t.gullet.popToken();return or(t,a,i,"\\\\globalfuture"===r),t.gullet.pushToken(i),t.gullet.pushToken(n),{type:"internal",mode:t.mode}}});var sr=function(e,t,r){var a=I(ne.math[e]&&ne.math[e].replace||e,t,r);if(!a)throw new Error("Unsupported symbol "+e+" and font size "+t+".");return a},lr=function(e,t,r,a){var n=r.havingBaseStyle(t),i=Ke.makeSpan(a.concat(n.sizingClasses(r)),[e],r),o=n.sizeMultiplier/r.sizeMultiplier;return i.height*=o,i.depth*=o,i.maxFontSize=n.sizeMultiplier,i},hr=function(e,t,r){var a=t.havingBaseStyle(r),n=(1-t.sizeMultiplier/a.sizeMultiplier)*t.fontMetrics().axisHeight;e.classes.push("delimcenter"),e.style.top=G(n),e.height-=n,e.depth+=n},mr=function(e,t,r,a,n,i){var o=function(e,t,r,a){return Ke.makeSymbol(e,"Size"+t+"-Regular",r,a)}(e,t,n,a),s=lr(Ke.makeSpan(["delimsizing","size"+t],[o],a),k.TEXT,a,i);return r&&hr(s,a,k.TEXT),s},cr=function(e,t,r){var a;return a="Size1-Regular"===t?"delim-size1":"delim-size4",{type:"elem",elem:Ke.makeSpan(["delimsizinginner",a],[Ke.makeSpan([],[Ke.makeSymbol(e,t,r)])])}},pr=function(e,t,r){var a=C["Size4-Regular"][e.charCodeAt(0)]?C["Size4-Regular"][e.charCodeAt(0)][4]:C["Size1-Regular"][e.charCodeAt(0)][4],n=new Q("inner",function(e,t){switch(e){case"\u239c":return"M291 0 H417 V"+t+" H291z M291 0 H417 V"+t+" H291z";case"\u2223":return"M145 0 H188 V"+t+" H145z M145 0 H188 V"+t+" H145z";case"\u2225":return"M145 0 H188 V"+t+" H145z M145 0 H188 V"+t+" H145zM367 0 H410 V"+t+" H367z M367 0 H410 V"+t+" H367z";case"\u239f":return"M457 0 H583 V"+t+" H457z M457 0 H583 V"+t+" H457z";case"\u23a2":return"M319 0 H403 V"+t+" H319z M319 0 H403 V"+t+" H319z";case"\u23a5":return"M263 0 H347 V"+t+" H263z M263 0 H347 V"+t+" H263z";case"\u23aa":return"M384 0 H504 V"+t+" H384z M384 0 H504 V"+t+" H384z";case"\u23d0":return"M312 0 H355 V"+t+" H312z M312 0 H355 V"+t+" H312z";case"\u2016":return"M257 0 H300 V"+t+" H257z M257 0 H300 V"+t+" H257zM478 0 H521 V"+t+" H478z M478 0 H521 V"+t+" H478z";default:return""}}(e,Math.round(1e3*t))),i=new J([n],{width:G(a),height:G(t),style:"width:"+G(a),viewBox:"0 0 "+1e3*a+" "+Math.round(1e3*t),preserveAspectRatio:"xMinYMin"}),o=Ke.makeSvgSpan([],[i],r);return o.height=t,o.style.height=G(t),o.style.width=G(a),{type:"elem",elem:o}},ur={type:"kern",size:-.008},dr=["|","\\lvert","\\rvert","\\vert"],gr=["\\|","\\lVert","\\rVert","\\Vert"],fr=function(e,t,r,a,n,i){var o,s,l,h,c="",p=0;o=l=h=e,s=null;var u="Size1-Regular";"\\uparrow"===e?l=h="\u23d0":"\\Uparrow"===e?l=h="\u2016":"\\downarrow"===e?o=l="\u23d0":"\\Downarrow"===e?o=l="\u2016":"\\updownarrow"===e?(o="\\uparrow",l="\u23d0",h="\\downarrow"):"\\Updownarrow"===e?(o="\\Uparrow",l="\u2016",h="\\Downarrow"):m.contains(dr,e)?(l="\u2223",c="vert",p=333):m.contains(gr,e)?(l="\u2225",c="doublevert",p=556):"["===e||"\\lbrack"===e?(o="\u23a1",l="\u23a2",h="\u23a3",u="Size4-Regular",c="lbrack",p=667):"]"===e||"\\rbrack"===e?(o="\u23a4",l="\u23a5",h="\u23a6",u="Size4-Regular",c="rbrack",p=667):"\\lfloor"===e||"\u230a"===e?(l=o="\u23a2",h="\u23a3",u="Size4-Regular",c="lfloor",p=667):"\\lceil"===e||"\u2308"===e?(o="\u23a1",l=h="\u23a2",u="Size4-Regular",c="lceil",p=667):"\\rfloor"===e||"\u230b"===e?(l=o="\u23a5",h="\u23a6",u="Size4-Regular",c="rfloor",p=667):"\\rceil"===e||"\u2309"===e?(o="\u23a4",l=h="\u23a5",u="Size4-Regular",c="rceil",p=667):"("===e||"\\lparen"===e?(o="\u239b",l="\u239c",h="\u239d",u="Size4-Regular",c="lparen",p=875):")"===e||"\\rparen"===e?(o="\u239e",l="\u239f",h="\u23a0",u="Size4-Regular",c="rparen",p=875):"\\{"===e||"\\lbrace"===e?(o="\u23a7",s="\u23a8",h="\u23a9",l="\u23aa",u="Size4-Regular"):"\\}"===e||"\\rbrace"===e?(o="\u23ab",s="\u23ac",h="\u23ad",l="\u23aa",u="Size4-Regular"):"\\lgroup"===e||"\u27ee"===e?(o="\u23a7",h="\u23a9",l="\u23aa",u="Size4-Regular"):"\\rgroup"===e||"\u27ef"===e?(o="\u23ab",h="\u23ad",l="\u23aa",u="Size4-Regular"):"\\lmoustache"===e||"\u23b0"===e?(o="\u23a7",h="\u23ad",l="\u23aa",u="Size4-Regular"):"\\rmoustache"!==e&&"\u23b1"!==e||(o="\u23ab",h="\u23a9",l="\u23aa",u="Size4-Regular");var d=sr(o,u,n),g=d.height+d.depth,f=sr(l,u,n),v=f.height+f.depth,b=sr(h,u,n),y=b.height+b.depth,x=0,w=1;if(null!==s){var S=sr(s,u,n);x=S.height+S.depth,w=2}var M=g+y+x,z=M+Math.max(0,Math.ceil((t-M)/(w*v)))*w*v,A=a.fontMetrics().axisHeight;r&&(A*=a.sizeMultiplier);var T=z/2-A,B=[];if(c.length>0){var C=z-g-y,N=Math.round(1e3*z),q=function(e,t){switch(e){case"lbrack":return"M403 1759 V84 H666 V0 H319 V1759 v"+t+" v1759 h347 v-84\nH403z M403 1759 V0 H319 V1759 v"+t+" v1759 h84z";case"rbrack":return"M347 1759 V0 H0 V84 H263 V1759 v"+t+" v1759 H0 v84 H347z\nM347 1759 V0 H263 V1759 v"+t+" v1759 h84z";case"vert":return"M145 15 v585 v"+t+" v585 c2.667,10,9.667,15,21,15\nc10,0,16.667,-5,20,-15 v-585 v"+-t+" v-585 c-2.667,-10,-9.667,-15,-21,-15\nc-10,0,-16.667,5,-20,15z M188 15 H145 v585 v"+t+" v585 h43z";case"doublevert":return"M145 15 v585 v"+t+" v585 c2.667,10,9.667,15,21,15\nc10,0,16.667,-5,20,-15 v-585 v"+-t+" v-585 c-2.667,-10,-9.667,-15,-21,-15\nc-10,0,-16.667,5,-20,15z M188 15 H145 v585 v"+t+" v585 h43z\nM367 15 v585 v"+t+" v585 c2.667,10,9.667,15,21,15\nc10,0,16.667,-5,20,-15 v-585 v"+-t+" v-585 c-2.667,-10,-9.667,-15,-21,-15\nc-10,0,-16.667,5,-20,15z M410 15 H367 v585 v"+t+" v585 h43z";case"lfloor":return"M319 602 V0 H403 V602 v"+t+" v1715 h263 v84 H319z\nMM319 602 V0 H403 V602 v"+t+" v1715 H319z";case"rfloor":return"M319 602 V0 H403 V602 v"+t+" v1799 H0 v-84 H319z\nMM319 602 V0 H403 V602 v"+t+" v1715 H319z";case"lceil":return"M403 1759 V84 H666 V0 H319 V1759 v"+t+" v602 h84z\nM403 1759 V0 H319 V1759 v"+t+" v602 h84z";case"rceil":return"M347 1759 V0 H0 V84 H263 V1759 v"+t+" v602 h84z\nM347 1759 V0 h-84 V1759 v"+t+" v602 h84z";case"lparen":return"M863,9c0,-2,-2,-5,-6,-9c0,0,-17,0,-17,0c-12.7,0,-19.3,0.3,-20,1\nc-5.3,5.3,-10.3,11,-15,17c-242.7,294.7,-395.3,682,-458,1162c-21.3,163.3,-33.3,349,\n-36,557 l0,"+(t+84)+"c0.2,6,0,26,0,60c2,159.3,10,310.7,24,454c53.3,528,210,\n949.7,470,1265c4.7,6,9.7,11.7,15,17c0.7,0.7,7,1,19,1c0,0,18,0,18,0c4,-4,6,-7,6,-9\nc0,-2.7,-3.3,-8.7,-10,-18c-135.3,-192.7,-235.5,-414.3,-300.5,-665c-65,-250.7,-102.5,\n-544.7,-112.5,-882c-2,-104,-3,-167,-3,-189\nl0,-"+(t+92)+"c0,-162.7,5.7,-314,17,-454c20.7,-272,63.7,-513,129,-723c65.3,\n-210,155.3,-396.3,270,-559c6.7,-9.3,10,-15.3,10,-18z";case"rparen":return"M76,0c-16.7,0,-25,3,-25,9c0,2,2,6.3,6,13c21.3,28.7,42.3,60.3,\n63,95c96.7,156.7,172.8,332.5,228.5,527.5c55.7,195,92.8,416.5,111.5,664.5\nc11.3,139.3,17,290.7,17,454c0,28,1.7,43,3.3,45l0,"+(t+9)+"\nc-3,4,-3.3,16.7,-3.3,38c0,162,-5.7,313.7,-17,455c-18.7,248,-55.8,469.3,-111.5,664\nc-55.7,194.7,-131.8,370.3,-228.5,527c-20.7,34.7,-41.7,66.3,-63,95c-2,3.3,-4,7,-6,11\nc0,7.3,5.7,11,17,11c0,0,11,0,11,0c9.3,0,14.3,-0.3,15,-1c5.3,-5.3,10.3,-11,15,-17\nc242.7,-294.7,395.3,-681.7,458,-1161c21.3,-164.7,33.3,-350.7,36,-558\nl0,-"+(t+144)+"c-2,-159.3,-10,-310.7,-24,-454c-53.3,-528,-210,-949.7,\n-470,-1265c-4.7,-6,-9.7,-11.7,-15,-17c-0.7,-0.7,-6.7,-1,-18,-1z";default:throw new Error("Unknown stretchy delimiter.")}}(c,Math.round(1e3*C)),I=new Q(c,q),R=(p/1e3).toFixed(3)+"em",H=(N/1e3).toFixed(3)+"em",O=new J([I],{width:R,height:H,viewBox:"0 0 "+p+" "+N}),E=Ke.makeSvgSpan([],[O],a);E.height=N/1e3,E.style.width=R,E.style.height=H,B.push({type:"elem",elem:E})}else{if(B.push(cr(h,u,n)),B.push(ur),null===s){var L=z-g-y+.016;B.push(pr(l,L,a))}else{var D=(z-g-y-x)/2+.016;B.push(pr(l,D,a)),B.push(ur),B.push(cr(s,u,n)),B.push(ur),B.push(pr(l,D,a))}B.push(ur),B.push(cr(o,u,n))}var V=a.havingBaseStyle(k.TEXT),P=Ke.makeVList({positionType:"bottom",positionData:T,children:B},V);return lr(Ke.makeSpan(["delimsizing","mult"],[P],V),k.TEXT,a,i)},vr=.08,br=function(e,t,r,a,n){var i=function(e,t,r){t*=1e3;var a="";switch(e){case"sqrtMain":a=function(e,t){return"M95,"+(622+e+t)+"\nc-2.7,0,-7.17,-2.7,-13.5,-8c-5.8,-5.3,-9.5,-10,-9.5,-14\nc0,-2,0.3,-3.3,1,-4c1.3,-2.7,23.83,-20.7,67.5,-54\nc44.2,-33.3,65.8,-50.3,66.5,-51c1.3,-1.3,3,-2,5,-2c4.7,0,8.7,3.3,12,10\ns173,378,173,378c0.7,0,35.3,-71,104,-213c68.7,-142,137.5,-285,206.5,-429\nc69,-144,104.5,-217.7,106.5,-221\nl"+e/2.075+" -"+e+"\nc5.3,-9.3,12,-14,20,-14\nH400000v"+(40+e)+"H845.2724\ns-225.272,467,-225.272,467s-235,486,-235,486c-2.7,4.7,-9,7,-19,7\nc-6,0,-10,-1,-12,-3s-194,-422,-194,-422s-65,47,-65,47z\nM"+(834+e)+" "+t+"h400000v"+(40+e)+"h-400000z"}(t,A);break;case"sqrtSize1":a=function(e,t){return"M263,"+(601+e+t)+"c0.7,0,18,39.7,52,119\nc34,79.3,68.167,158.7,102.5,238c34.3,79.3,51.8,119.3,52.5,120\nc340,-704.7,510.7,-1060.3,512,-1067\nl"+e/2.084+" -"+e+"\nc4.7,-7.3,11,-11,19,-11\nH40000v"+(40+e)+"H1012.3\ns-271.3,567,-271.3,567c-38.7,80.7,-84,175,-136,283c-52,108,-89.167,185.3,-111.5,232\nc-22.3,46.7,-33.8,70.3,-34.5,71c-4.7,4.7,-12.3,7,-23,7s-12,-1,-12,-1\ns-109,-253,-109,-253c-72.7,-168,-109.3,-252,-110,-252c-10.7,8,-22,16.7,-34,26\nc-22,17.3,-33.3,26,-34,26s-26,-26,-26,-26s76,-59,76,-59s76,-60,76,-60z\nM"+(1001+e)+" "+t+"h400000v"+(40+e)+"h-400000z"}(t,A);break;case"sqrtSize2":a=function(e,t){return"M983 "+(10+e+t)+"\nl"+e/3.13+" -"+e+"\nc4,-6.7,10,-10,18,-10 H400000v"+(40+e)+"\nH1013.1s-83.4,268,-264.1,840c-180.7,572,-277,876.3,-289,913c-4.7,4.7,-12.7,7,-24,7\ns-12,0,-12,0c-1.3,-3.3,-3.7,-11.7,-7,-25c-35.3,-125.3,-106.7,-373.3,-214,-744\nc-10,12,-21,25,-33,39s-32,39,-32,39c-6,-5.3,-15,-14,-27,-26s25,-30,25,-30\nc26.7,-32.7,52,-63,76,-91s52,-60,52,-60s208,722,208,722\nc56,-175.3,126.3,-397.3,211,-666c84.7,-268.7,153.8,-488.2,207.5,-658.5\nc53.7,-170.3,84.5,-266.8,92.5,-289.5z\nM"+(1001+e)+" "+t+"h400000v"+(40+e)+"h-400000z"}(t,A);break;case"sqrtSize3":a=function(e,t){return"M424,"+(2398+e+t)+"\nc-1.3,-0.7,-38.5,-172,-111.5,-514c-73,-342,-109.8,-513.3,-110.5,-514\nc0,-2,-10.7,14.3,-32,49c-4.7,7.3,-9.8,15.7,-15.5,25c-5.7,9.3,-9.8,16,-12.5,20\ns-5,7,-5,7c-4,-3.3,-8.3,-7.7,-13,-13s-13,-13,-13,-13s76,-122,76,-122s77,-121,77,-121\ns209,968,209,968c0,-2,84.7,-361.7,254,-1079c169.3,-717.3,254.7,-1077.7,256,-1081\nl"+e/4.223+" -"+e+"c4,-6.7,10,-10,18,-10 H400000\nv"+(40+e)+"H1014.6\ns-87.3,378.7,-272.6,1166c-185.3,787.3,-279.3,1182.3,-282,1185\nc-2,6,-10,9,-24,9\nc-8,0,-12,-0.7,-12,-2z M"+(1001+e)+" "+t+"\nh400000v"+(40+e)+"h-400000z"}(t,A);break;case"sqrtSize4":a=function(e,t){return"M473,"+(2713+e+t)+"\nc339.3,-1799.3,509.3,-2700,510,-2702 l"+e/5.298+" -"+e+"\nc3.3,-7.3,9.3,-11,18,-11 H400000v"+(40+e)+"H1017.7\ns-90.5,478,-276.2,1466c-185.7,988,-279.5,1483,-281.5,1485c-2,6,-10,9,-24,9\nc-8,0,-12,-0.7,-12,-2c0,-1.3,-5.3,-32,-16,-92c-50.7,-293.3,-119.7,-693.3,-207,-1200\nc0,-1.3,-5.3,8.7,-16,30c-10.7,21.3,-21.3,42.7,-32,64s-16,33,-16,33s-26,-26,-26,-26\ns76,-153,76,-153s77,-151,77,-151c0.7,0.7,35.7,202,105,604c67.3,400.7,102,602.7,104,\n606zM"+(1001+e)+" "+t+"h400000v"+(40+e)+"H1017.7z"}(t,A);break;case"sqrtTall":a=function(e,t,r){return"M702 "+(e+t)+"H400000"+(40+e)+"\nH742v"+(r-54-t-e)+"l-4 4-4 4c-.667.7 -2 1.5-4 2.5s-4.167 1.833-6.5 2.5-5.5 1-9.5 1\nh-12l-28-84c-16.667-52-96.667 -294.333-240-727l-212 -643 -85 170\nc-4-3.333-8.333-7.667-13 -13l-13-13l77-155 77-156c66 199.333 139 419.667\n219 661 l218 661zM702 "+t+"H400000v"+(40+e)+"H742z"}(t,A,r)}return a}(e,a,r),o=new Q(e,i),s=new J([o],{width:"400em",height:G(t),viewBox:"0 0 400000 "+r,preserveAspectRatio:"xMinYMin slice"});return Ke.makeSvgSpan(["hide-tail"],[s],n)},yr=["(","\\lparen",")","\\rparen","[","\\lbrack","]","\\rbrack","\\{","\\lbrace","\\}","\\rbrace","\\lfloor","\\rfloor","\u230a","\u230b","\\lceil","\\rceil","\u2308","\u2309","\\surd"],xr=["\\uparrow","\\downarrow","\\updownarrow","\\Uparrow","\\Downarrow","\\Updownarrow","|","\\|","\\vert","\\Vert","\\lvert","\\rvert","\\lVert","\\rVert","\\lgroup","\\rgroup","\u27ee","\u27ef","\\lmoustache","\\rmoustache","\u23b0","\u23b1"],wr=["<",">","\\langle","\\rangle","/","\\backslash","\\lt","\\gt"],kr=[0,1.2,1.8,2.4,3],Sr=[{type:"small",style:k.SCRIPTSCRIPT},{type:"small",style:k.SCRIPT},{type:"small",style:k.TEXT},{type:"large",size:1},{type:"large",size:2},{type:"large",size:3},{type:"large",size:4}],Mr=[{type:"small",style:k.SCRIPTSCRIPT},{type:"small",style:k.SCRIPT},{type:"small",style:k.TEXT},{type:"stack"}],zr=[{type:"small",style:k.SCRIPTSCRIPT},{type:"small",style:k.SCRIPT},{type:"small",style:k.TEXT},{type:"large",size:1},{type:"large",size:2},{type:"large",size:3},{type:"large",size:4},{type:"stack"}],Ar=function(e){if("small"===e.type)return"Main-Regular";if("large"===e.type)return"Size"+e.size+"-Regular";if("stack"===e.type)return"Size4-Regular";throw new Error("Add support for delim type '"+e.type+"' here.")},Tr=function(e,t,r,a){for(var n=Math.min(2,3-a.style.size);nt)return r[n]}return r[r.length-1]},Br=function(e,t,r,a,n,i){var o;"<"===e||"\\lt"===e||"\u27e8"===e?e="\\langle":">"!==e&&"\\gt"!==e&&"\u27e9"!==e||(e="\\rangle"),o=m.contains(wr,e)?Sr:m.contains(yr,e)?zr:Mr;var s=Tr(e,t,o,a);return"small"===s.type?function(e,t,r,a,n,i){var o=Ke.makeSymbol(e,"Main-Regular",n,a),s=lr(o,t,a,i);return r&&hr(s,a,t),s}(e,s.style,r,a,n,i):"large"===s.type?mr(e,s.size,r,a,n,i):fr(e,t,r,a,n,i)},Cr={sqrtImage:function(e,t){var r,a,n=t.havingBaseSizing(),i=Tr("\\surd",e*n.sizeMultiplier,zr,n),o=n.sizeMultiplier,s=Math.max(0,t.minRuleThickness-t.fontMetrics().sqrtRuleThickness),l=0,h=0,m=0;return"small"===i.type?(e<1?o=1:e<1.4&&(o=.7),h=(1+s)/o,(r=br("sqrtMain",l=(1+s+vr)/o,m=1e3+1e3*s+80,s,t)).style.minWidth="0.853em",a=.833/o):"large"===i.type?(m=1080*kr[i.size],h=(kr[i.size]+s)/o,l=(kr[i.size]+s+vr)/o,(r=br("sqrtSize"+i.size,l,m,s,t)).style.minWidth="1.02em",a=1/o):(l=e+s+vr,h=e+s,m=Math.floor(1e3*e+s)+80,(r=br("sqrtTall",l,m,s,t)).style.minWidth="0.742em",a=1.056),r.height=h,r.style.height=G(l),{span:r,advanceWidth:a,ruleWidth:(t.fontMetrics().sqrtRuleThickness+s)*o}},sizedDelim:function(e,t,r,a,n){if("<"===e||"\\lt"===e||"\u27e8"===e?e="\\langle":">"!==e&&"\\gt"!==e&&"\u27e9"!==e||(e="\\rangle"),m.contains(yr,e)||m.contains(wr,e))return mr(e,t,!1,r,a,n);if(m.contains(xr,e))return fr(e,kr[t],!1,r,a,n);throw new i("Illegal delimiter: '"+e+"'")},sizeToMaxHeight:kr,customSizedDelim:Br,leftRightDelim:function(e,t,r,a,n,i){var o=a.fontMetrics().axisHeight*a.sizeMultiplier,s=5/a.fontMetrics().ptPerEm,l=Math.max(t-o,r+o),h=Math.max(l/500*901,2*l-s);return Br(e,h,!0,a,n,i)}},Nr={"\\bigl":{mclass:"mopen",size:1},"\\Bigl":{mclass:"mopen",size:2},"\\biggl":{mclass:"mopen",size:3},"\\Biggl":{mclass:"mopen",size:4},"\\bigr":{mclass:"mclose",size:1},"\\Bigr":{mclass:"mclose",size:2},"\\biggr":{mclass:"mclose",size:3},"\\Biggr":{mclass:"mclose",size:4},"\\bigm":{mclass:"mrel",size:1},"\\Bigm":{mclass:"mrel",size:2},"\\biggm":{mclass:"mrel",size:3},"\\Biggm":{mclass:"mrel",size:4},"\\big":{mclass:"mord",size:1},"\\Big":{mclass:"mord",size:2},"\\bigg":{mclass:"mord",size:3},"\\Bigg":{mclass:"mord",size:4}},qr=["(","\\lparen",")","\\rparen","[","\\lbrack","]","\\rbrack","\\{","\\lbrace","\\}","\\rbrace","\\lfloor","\\rfloor","\u230a","\u230b","\\lceil","\\rceil","\u2308","\u2309","<",">","\\langle","\u27e8","\\rangle","\u27e9","\\lt","\\gt","\\lvert","\\rvert","\\lVert","\\rVert","\\lgroup","\\rgroup","\u27ee","\u27ef","\\lmoustache","\\rmoustache","\u23b0","\u23b1","/","\\backslash","|","\\vert","\\|","\\Vert","\\uparrow","\\Uparrow","\\downarrow","\\Downarrow","\\updownarrow","\\Updownarrow","."];function Ir(e,t){var r=Yt(e);if(r&&m.contains(qr,r.text))return r;throw new i(r?"Invalid delimiter '"+r.text+"' after '"+t.funcName+"'":"Invalid delimiter type '"+e.type+"'",e)}function Rr(e){if(!e.body)throw new Error("Bug: The leftright ParseNode wasn't fully parsed.")}ot({type:"delimsizing",names:["\\bigl","\\Bigl","\\biggl","\\Biggl","\\bigr","\\Bigr","\\biggr","\\Biggr","\\bigm","\\Bigm","\\biggm","\\Biggm","\\big","\\Big","\\bigg","\\Bigg"],props:{numArgs:1,argTypes:["primitive"]},handler:(e,t)=>{var r=Ir(t[0],e);return{type:"delimsizing",mode:e.parser.mode,size:Nr[e.funcName].size,mclass:Nr[e.funcName].mclass,delim:r.text}},htmlBuilder:(e,t)=>"."===e.delim?Ke.makeSpan([e.mclass]):Cr.sizedDelim(e.delim,e.size,t,e.mode,[e.mclass]),mathmlBuilder:e=>{var t=[];"."!==e.delim&&t.push(Bt(e.delim,e.mode));var r=new Tt.MathNode("mo",t);"mopen"===e.mclass||"mclose"===e.mclass?r.setAttribute("fence","true"):r.setAttribute("fence","false"),r.setAttribute("stretchy","true");var a=G(Cr.sizeToMaxHeight[e.size]);return r.setAttribute("minsize",a),r.setAttribute("maxsize",a),r}}),ot({type:"leftright-right",names:["\\right"],props:{numArgs:1,primitive:!0},handler:(e,t)=>{var r=e.parser.gullet.macros.get("\\current@color");if(r&&"string"!=typeof r)throw new i("\\current@color set to non-string in \\right");return{type:"leftright-right",mode:e.parser.mode,delim:Ir(t[0],e).text,color:r}}}),ot({type:"leftright",names:["\\left"],props:{numArgs:1,primitive:!0},handler:(e,t)=>{var r=Ir(t[0],e),a=e.parser;++a.leftrightDepth;var n=a.parseExpression(!1);--a.leftrightDepth,a.expect("\\right",!1);var i=Gt(a.parseFunction(),"leftright-right");return{type:"leftright",mode:a.mode,body:n,left:r.text,right:i.delim,rightColor:i.color}},htmlBuilder:(e,t)=>{Rr(e);for(var r,a,n=gt(e.body,t,!0,["mopen","mclose"]),i=0,o=0,s=!1,l=0;l{Rr(e);var r=qt(e.body,t);if("."!==e.left){var a=new Tt.MathNode("mo",[Bt(e.left,e.mode)]);a.setAttribute("fence","true"),r.unshift(a)}if("."!==e.right){var n=new Tt.MathNode("mo",[Bt(e.right,e.mode)]);n.setAttribute("fence","true"),e.rightColor&&n.setAttribute("mathcolor",e.rightColor),r.push(n)}return Ct(r)}}),ot({type:"middle",names:["\\middle"],props:{numArgs:1,primitive:!0},handler:(e,t)=>{var r=Ir(t[0],e);if(!e.parser.leftrightDepth)throw new i("\\middle without preceding \\left",r);return{type:"middle",mode:e.parser.mode,delim:r.text}},htmlBuilder:(e,t)=>{var r;if("."===e.delim)r=xt(t,[]);else{r=Cr.sizedDelim(e.delim,1,t,e.mode,[]);var a={delim:e.delim,options:t};r.isMiddle=a}return r},mathmlBuilder:(e,t)=>{var r="\\vert"===e.delim||"|"===e.delim?Bt("|","text"):Bt(e.delim,e.mode),a=new Tt.MathNode("mo",[r]);return a.setAttribute("fence","true"),a.setAttribute("lspace","0.05em"),a.setAttribute("rspace","0.05em"),a}});var Hr=(e,t)=>{var r,a,n,i=Ke.wrapFragment(wt(e.body,t),t),o=e.label.slice(1),s=t.sizeMultiplier,l=0,h=m.isCharacterBox(e.body);if("sout"===o)(r=Ke.makeSpan(["stretchy","sout"])).height=t.fontMetrics().defaultRuleThickness/s,l=-.5*t.fontMetrics().xHeight;else if("phase"===o){var c=F({number:.6,unit:"pt"},t),p=F({number:.35,unit:"ex"},t);s/=t.havingBaseSizing().sizeMultiplier;var u=i.height+i.depth+c+p;i.style.paddingLeft=G(u/2+c);var d=Math.floor(1e3*u*s),g="M400000 "+(a=d)+" H0 L"+a/2+" 0 l65 45 L145 "+(a-80)+" H400000z",f=new J([new Q("phase",g)],{width:"400em",height:G(d/1e3),viewBox:"0 0 400000 "+d,preserveAspectRatio:"xMinYMin slice"});(r=Ke.makeSvgSpan(["hide-tail"],[f],t)).style.height=G(u),l=i.depth+c+p}else{/cancel/.test(o)?h||i.classes.push("cancel-pad"):"angl"===o?i.classes.push("anglpad"):i.classes.push("boxpad");var v=0,b=0,y=0;/box/.test(o)?(y=Math.max(t.fontMetrics().fboxrule,t.minRuleThickness),b=v=t.fontMetrics().fboxsep+("colorbox"===o?0:y)):"angl"===o?(v=4*(y=Math.max(t.fontMetrics().defaultRuleThickness,t.minRuleThickness)),b=Math.max(0,.25-i.depth)):b=v=h?.2:0,r=Vt(i,o,v,b,t),/fbox|boxed|fcolorbox/.test(o)?(r.style.borderStyle="solid",r.style.borderWidth=G(y)):"angl"===o&&.049!==y&&(r.style.borderTopWidth=G(y),r.style.borderRightWidth=G(y)),l=i.depth+b,e.backgroundColor&&(r.style.backgroundColor=e.backgroundColor,e.borderColor&&(r.style.borderColor=e.borderColor))}if(e.backgroundColor)n=Ke.makeVList({positionType:"individualShift",children:[{type:"elem",elem:r,shift:l},{type:"elem",elem:i,shift:0}]},t);else{var x=/cancel|phase/.test(o)?["svg-align"]:[];n=Ke.makeVList({positionType:"individualShift",children:[{type:"elem",elem:i,shift:0},{type:"elem",elem:r,shift:l,wrapperClasses:x}]},t)}return/cancel/.test(o)&&(n.height=i.height,n.depth=i.depth),/cancel/.test(o)&&!h?Ke.makeSpan(["mord","cancel-lap"],[n],t):Ke.makeSpan(["mord"],[n],t)},Or=(e,t)=>{var r=0,a=new Tt.MathNode(e.label.indexOf("colorbox")>-1?"mpadded":"menclose",[Rt(e.body,t)]);switch(e.label){case"\\cancel":a.setAttribute("notation","updiagonalstrike");break;case"\\bcancel":a.setAttribute("notation","downdiagonalstrike");break;case"\\phase":a.setAttribute("notation","phasorangle");break;case"\\sout":a.setAttribute("notation","horizontalstrike");break;case"\\fbox":a.setAttribute("notation","box");break;case"\\angl":a.setAttribute("notation","actuarial");break;case"\\fcolorbox":case"\\colorbox":if(r=t.fontMetrics().fboxsep*t.fontMetrics().ptPerEm,a.setAttribute("width","+"+2*r+"pt"),a.setAttribute("height","+"+2*r+"pt"),a.setAttribute("lspace",r+"pt"),a.setAttribute("voffset",r+"pt"),"\\fcolorbox"===e.label){var n=Math.max(t.fontMetrics().fboxrule,t.minRuleThickness);a.setAttribute("style","border: "+n+"em solid "+String(e.borderColor))}break;case"\\xcancel":a.setAttribute("notation","updiagonalstrike downdiagonalstrike")}return e.backgroundColor&&a.setAttribute("mathbackground",e.backgroundColor),a};ot({type:"enclose",names:["\\colorbox"],props:{numArgs:2,allowedInText:!0,argTypes:["color","text"]},handler(e,t,r){var{parser:a,funcName:n}=e,i=Gt(t[0],"color-token").color,o=t[1];return{type:"enclose",mode:a.mode,label:n,backgroundColor:i,body:o}},htmlBuilder:Hr,mathmlBuilder:Or}),ot({type:"enclose",names:["\\fcolorbox"],props:{numArgs:3,allowedInText:!0,argTypes:["color","color","text"]},handler(e,t,r){var{parser:a,funcName:n}=e,i=Gt(t[0],"color-token").color,o=Gt(t[1],"color-token").color,s=t[2];return{type:"enclose",mode:a.mode,label:n,backgroundColor:o,borderColor:i,body:s}},htmlBuilder:Hr,mathmlBuilder:Or}),ot({type:"enclose",names:["\\fbox"],props:{numArgs:1,argTypes:["hbox"],allowedInText:!0},handler(e,t){var{parser:r}=e;return{type:"enclose",mode:r.mode,label:"\\fbox",body:t[0]}}}),ot({type:"enclose",names:["\\cancel","\\bcancel","\\xcancel","\\sout","\\phase"],props:{numArgs:1},handler(e,t){var{parser:r,funcName:a}=e,n=t[0];return{type:"enclose",mode:r.mode,label:a,body:n}},htmlBuilder:Hr,mathmlBuilder:Or}),ot({type:"enclose",names:["\\angl"],props:{numArgs:1,argTypes:["hbox"],allowedInText:!1},handler(e,t){var{parser:r}=e;return{type:"enclose",mode:r.mode,label:"\\angl",body:t[0]}}});var Er={};function Lr(e){for(var{type:t,names:r,props:a,handler:n,htmlBuilder:i,mathmlBuilder:o}=e,s={type:t,numArgs:a.numArgs||0,allowedInText:!1,numOptionalArgs:0,handler:n},l=0;l{if(!e.parser.settings.displayMode)throw new i("{"+e.envName+"} can be used only in display mode.")};function Gr(e){if(-1===e.indexOf("ed"))return-1===e.indexOf("*")}function Ur(e,t,r){var{hskipBeforeAndAfter:a,addJot:o,cols:s,arraystretch:l,colSeparationType:h,autoTag:m,singleRow:c,emptySingleRow:p,maxNumCols:u,leqno:d}=t;if(e.gullet.beginGroup(),c||e.gullet.macros.set("\\cr","\\\\\\relax"),!l){var g=e.gullet.expandMacroAsText("\\arraystretch");if(null==g)l=1;else if(!(l=parseFloat(g))||l<0)throw new i("Invalid \\arraystretch: "+g)}e.gullet.beginGroup();var f=[],v=[f],b=[],y=[],x=null!=m?[]:void 0;function w(){m&&e.gullet.macros.set("\\@eqnsw","1",!0)}function k(){x&&(e.gullet.macros.get("\\df@tag")?(x.push(e.subparse([new n("\\df@tag")])),e.gullet.macros.set("\\df@tag",void 0,!0)):x.push(Boolean(m)&&"1"===e.gullet.macros.get("\\@eqnsw")))}for(w(),y.push(Pr(e));;){var S=e.parseExpression(!1,c?"\\end":"\\\\");e.gullet.endGroup(),e.gullet.beginGroup(),S={type:"ordgroup",mode:e.mode,body:S},r&&(S={type:"styling",mode:e.mode,style:r,body:[S]}),f.push(S);var M=e.fetch().text;if("&"===M){if(u&&f.length===u){if(c||h)throw new i("Too many tab characters: &",e.nextToken);e.settings.reportNonstrict("textEnv","Too few columns specified in the {array} column argument.")}e.consume()}else{if("\\end"===M){k(),1===f.length&&"styling"===S.type&&0===S.body[0].body.length&&(v.length>1||!p)&&v.pop(),y.length0&&(y+=.25),h.push({pos:y,isDashed:e[t]})}for(x(o[0]),r=0;r0&&(M<(B+=b)&&(M=B),B=0),e.addJot&&(M+=g),z.height=S,z.depth=M,y+=S,z.pos=y,y+=M+B,l[r]=z,x(o[r+1])}var C,N,q=y/2+t.fontMetrics().axisHeight,I=e.cols||[],R=[],H=[];if(e.tags&&e.tags.some((e=>e)))for(r=0;r=s)){var W=void 0;(a>0||e.hskipBeforeAndAfter)&&0!==(W=m.deflt(V.pregap,u))&&((C=Ke.makeSpan(["arraycolsep"],[])).style.width=G(W),R.push(C));var _=[];for(r=0;r0){for(var K=Ke.makeLineSpan("hline",t,c),J=Ke.makeLineSpan("hdashline",t,c),Q=[{type:"elem",elem:l,shift:0}];h.length>0;){var ee=h.pop(),te=ee.pos-q;ee.isDashed?Q.push({type:"elem",elem:J,shift:te}):Q.push({type:"elem",elem:K,shift:te})}l=Ke.makeVList({positionType:"individualShift",children:Q},t)}if(0===H.length)return Ke.makeSpan(["mord"],[l],t);var re=Ke.makeVList({positionType:"individualShift",children:H},t);return re=Ke.makeSpan(["tag"],[re],t),Ke.makeFragment([l,re])},Wr={c:"center ",l:"left ",r:"right "},_r=function(e,t){for(var r=[],a=new Tt.MathNode("mtd",[],["mtr-glue"]),n=new Tt.MathNode("mtd",[],["mml-eqn-num"]),i=0;i0){var u=e.cols,d="",g=!1,f=0,v=u.length;"separator"===u[0].type&&(c+="top ",f=1),"separator"===u[u.length-1].type&&(c+="bottom ",v-=1);for(var b=f;b0?"left ":"",c+=S[S.length-1].length>0?"right ":"";for(var M=1;M-1?"alignat":"align",o="split"===e.envName,s=Ur(e.parser,{cols:a,addJot:!0,autoTag:o?void 0:Gr(e.envName),emptySingleRow:!0,colSeparationType:n,maxNumCols:o?2:void 0,leqno:e.parser.settings.leqno},"display"),l=0,h={type:"ordgroup",mode:e.mode,body:[]};if(t[0]&&"ordgroup"===t[0].type){for(var m="",c=0;c0&&p&&(g=1),a[u]={type:"align",align:d,pregap:g,postgap:0}}return s.colSeparationType=p?"align":"alignat",s};Lr({type:"array",names:["array","darray"],props:{numArgs:1},handler(e,t){var r=(Yt(t[0])?[t[0]]:Gt(t[0],"ordgroup").body).map((function(e){var t=Ut(e).text;if(-1!=="lcr".indexOf(t))return{type:"align",align:t};if("|"===t)return{type:"separator",separator:"|"};if(":"===t)return{type:"separator",separator:":"};throw new i("Unknown column alignment: "+t,e)})),a={cols:r,hskipBeforeAndAfter:!0,maxNumCols:r.length};return Ur(e.parser,a,Yr(e.envName))},htmlBuilder:Xr,mathmlBuilder:_r}),Lr({type:"array",names:["matrix","pmatrix","bmatrix","Bmatrix","vmatrix","Vmatrix","matrix*","pmatrix*","bmatrix*","Bmatrix*","vmatrix*","Vmatrix*"],props:{numArgs:0},handler(e){var t={matrix:null,pmatrix:["(",")"],bmatrix:["[","]"],Bmatrix:["\\{","\\}"],vmatrix:["|","|"],Vmatrix:["\\Vert","\\Vert"]}[e.envName.replace("*","")],r="c",a={hskipBeforeAndAfter:!1,cols:[{type:"align",align:r}]};if("*"===e.envName.charAt(e.envName.length-1)){var n=e.parser;if(n.consumeSpaces(),"["===n.fetch().text){if(n.consume(),n.consumeSpaces(),r=n.fetch().text,-1==="lcr".indexOf(r))throw new i("Expected l or c or r",n.nextToken);n.consume(),n.consumeSpaces(),n.expect("]"),n.consume(),a.cols=[{type:"align",align:r}]}}var o=Ur(e.parser,a,Yr(e.envName)),s=Math.max(0,...o.body.map((e=>e.length)));return o.cols=new Array(s).fill({type:"align",align:r}),t?{type:"leftright",mode:e.mode,body:[o],left:t[0],right:t[1],rightColor:void 0}:o},htmlBuilder:Xr,mathmlBuilder:_r}),Lr({type:"array",names:["smallmatrix"],props:{numArgs:0},handler(e){var t=Ur(e.parser,{arraystretch:.5},"script");return t.colSeparationType="small",t},htmlBuilder:Xr,mathmlBuilder:_r}),Lr({type:"array",names:["subarray"],props:{numArgs:1},handler(e,t){var r=(Yt(t[0])?[t[0]]:Gt(t[0],"ordgroup").body).map((function(e){var t=Ut(e).text;if(-1!=="lc".indexOf(t))return{type:"align",align:t};throw new i("Unknown column alignment: "+t,e)}));if(r.length>1)throw new i("{subarray} can contain only one column");var a={cols:r,hskipBeforeAndAfter:!1,arraystretch:.5};if((a=Ur(e.parser,a,"script")).body.length>0&&a.body[0].length>1)throw new i("{subarray} can contain only one column");return a},htmlBuilder:Xr,mathmlBuilder:_r}),Lr({type:"array",names:["cases","dcases","rcases","drcases"],props:{numArgs:0},handler(e){var t=Ur(e.parser,{arraystretch:1.2,cols:[{type:"align",align:"l",pregap:0,postgap:1},{type:"align",align:"l",pregap:0,postgap:0}]},Yr(e.envName));return{type:"leftright",mode:e.mode,body:[t],left:e.envName.indexOf("r")>-1?".":"\\{",right:e.envName.indexOf("r")>-1?"\\}":".",rightColor:void 0}},htmlBuilder:Xr,mathmlBuilder:_r}),Lr({type:"array",names:["align","align*","aligned","split"],props:{numArgs:0},handler:jr,htmlBuilder:Xr,mathmlBuilder:_r}),Lr({type:"array",names:["gathered","gather","gather*"],props:{numArgs:0},handler(e){m.contains(["gather","gather*"],e.envName)&&Fr(e);var t={cols:[{type:"align",align:"c"}],addJot:!0,colSeparationType:"gather",autoTag:Gr(e.envName),emptySingleRow:!0,leqno:e.parser.settings.leqno};return Ur(e.parser,t,"display")},htmlBuilder:Xr,mathmlBuilder:_r}),Lr({type:"array",names:["alignat","alignat*","alignedat"],props:{numArgs:1},handler:jr,htmlBuilder:Xr,mathmlBuilder:_r}),Lr({type:"array",names:["equation","equation*"],props:{numArgs:0},handler(e){Fr(e);var t={autoTag:Gr(e.envName),emptySingleRow:!0,singleRow:!0,maxNumCols:1,leqno:e.parser.settings.leqno};return Ur(e.parser,t,"display")},htmlBuilder:Xr,mathmlBuilder:_r}),Lr({type:"array",names:["CD"],props:{numArgs:0},handler:e=>(Fr(e),function(e){var t=[];for(e.gullet.beginGroup(),e.gullet.macros.set("\\cr","\\\\\\relax"),e.gullet.beginGroup();;){t.push(e.parseExpression(!1,"\\\\")),e.gullet.endGroup(),e.gullet.beginGroup();var r=e.fetch().text;if("&"!==r&&"\\\\"!==r){if("\\end"===r){0===t[t.length-1].length&&t.pop();break}throw new i("Expected \\\\ or \\cr or \\end",e.nextToken)}e.consume()}for(var a,n,o=[],s=[o],l=0;l-1);else{if(!("<>AV".indexOf(p)>-1))throw new i('Expected one of "<>AV=|." after @',h[c]);for(var d=0;d<2;d++){for(var g=!0,f=c+1;f{var r=e.font,a=t.withFont(r);return wt(e.body,a)},Kr=(e,t)=>{var r=e.font,a=t.withFont(r);return Rt(e.body,a)},Jr={"\\Bbb":"\\mathbb","\\bold":"\\mathbf","\\frak":"\\mathfrak","\\bm":"\\boldsymbol"};ot({type:"font",names:["\\mathrm","\\mathit","\\mathbf","\\mathnormal","\\mathbb","\\mathcal","\\mathfrak","\\mathscr","\\mathsf","\\mathtt","\\Bbb","\\bold","\\frak"],props:{numArgs:1,allowedInArgument:!0},handler:(e,t)=>{var{parser:r,funcName:a}=e,n=lt(t[0]),i=a;return i in Jr&&(i=Jr[i]),{type:"font",mode:r.mode,font:i.slice(1),body:n}},htmlBuilder:Zr,mathmlBuilder:Kr}),ot({type:"mclass",names:["\\boldsymbol","\\bm"],props:{numArgs:1},handler:(e,t)=>{var{parser:r}=e,a=t[0],n=m.isCharacterBox(a);return{type:"mclass",mode:r.mode,mclass:Jt(a),body:[{type:"font",mode:r.mode,font:"boldsymbol",body:a}],isCharacterBox:n}}}),ot({type:"font",names:["\\rm","\\sf","\\tt","\\bf","\\it","\\cal"],props:{numArgs:0,allowedInText:!0},handler:(e,t)=>{var{parser:r,funcName:a,breakOnTokenText:n}=e,{mode:i}=r,o=r.parseExpression(!0,n);return{type:"font",mode:i,font:"math"+a.slice(1),body:{type:"ordgroup",mode:r.mode,body:o}}},htmlBuilder:Zr,mathmlBuilder:Kr});var Qr=(e,t)=>{var r=t;return"display"===e?r=r.id>=k.SCRIPT.id?r.text():k.DISPLAY:"text"===e&&r.size===k.DISPLAY.size?r=k.TEXT:"script"===e?r=k.SCRIPT:"scriptscript"===e&&(r=k.SCRIPTSCRIPT),r},ea=(e,t)=>{var r,a=Qr(e.size,t.style),n=a.fracNum(),i=a.fracDen();r=t.havingStyle(n);var o=wt(e.numer,r,t);if(e.continued){var s=8.5/t.fontMetrics().ptPerEm,l=3.5/t.fontMetrics().ptPerEm;o.height=o.height0?3*c:7*c,d=t.fontMetrics().denom1):(m>0?(p=t.fontMetrics().num2,u=c):(p=t.fontMetrics().num3,u=3*c),d=t.fontMetrics().denom2),h){var x=t.fontMetrics().axisHeight;p-o.depth-(x+.5*m){var r=new Tt.MathNode("mfrac",[Rt(e.numer,t),Rt(e.denom,t)]);if(e.hasBarLine){if(e.barSize){var a=F(e.barSize,t);r.setAttribute("linethickness",G(a))}}else r.setAttribute("linethickness","0px");var n=Qr(e.size,t.style);if(n.size!==t.style.size){r=new Tt.MathNode("mstyle",[r]);var i=n.size===k.DISPLAY.size?"true":"false";r.setAttribute("displaystyle",i),r.setAttribute("scriptlevel","0")}if(null!=e.leftDelim||null!=e.rightDelim){var o=[];if(null!=e.leftDelim){var s=new Tt.MathNode("mo",[new Tt.TextNode(e.leftDelim.replace("\\",""))]);s.setAttribute("fence","true"),o.push(s)}if(o.push(r),null!=e.rightDelim){var l=new Tt.MathNode("mo",[new Tt.TextNode(e.rightDelim.replace("\\",""))]);l.setAttribute("fence","true"),o.push(l)}return Ct(o)}return r};ot({type:"genfrac",names:["\\dfrac","\\frac","\\tfrac","\\dbinom","\\binom","\\tbinom","\\\\atopfrac","\\\\bracefrac","\\\\brackfrac"],props:{numArgs:2,allowedInArgument:!0},handler:(e,t)=>{var r,{parser:a,funcName:n}=e,i=t[0],o=t[1],s=null,l=null,h="auto";switch(n){case"\\dfrac":case"\\frac":case"\\tfrac":r=!0;break;case"\\\\atopfrac":r=!1;break;case"\\dbinom":case"\\binom":case"\\tbinom":r=!1,s="(",l=")";break;case"\\\\bracefrac":r=!1,s="\\{",l="\\}";break;case"\\\\brackfrac":r=!1,s="[",l="]";break;default:throw new Error("Unrecognized genfrac command")}switch(n){case"\\dfrac":case"\\dbinom":h="display";break;case"\\tfrac":case"\\tbinom":h="text"}return{type:"genfrac",mode:a.mode,continued:!1,numer:i,denom:o,hasBarLine:r,leftDelim:s,rightDelim:l,size:h,barSize:null}},htmlBuilder:ea,mathmlBuilder:ta}),ot({type:"genfrac",names:["\\cfrac"],props:{numArgs:2},handler:(e,t)=>{var{parser:r,funcName:a}=e,n=t[0],i=t[1];return{type:"genfrac",mode:r.mode,continued:!0,numer:n,denom:i,hasBarLine:!0,leftDelim:null,rightDelim:null,size:"display",barSize:null}}}),ot({type:"infix",names:["\\over","\\choose","\\atop","\\brace","\\brack"],props:{numArgs:0,infix:!0},handler(e){var t,{parser:r,funcName:a,token:n}=e;switch(a){case"\\over":t="\\frac";break;case"\\choose":t="\\binom";break;case"\\atop":t="\\\\atopfrac";break;case"\\brace":t="\\\\bracefrac";break;case"\\brack":t="\\\\brackfrac";break;default:throw new Error("Unrecognized infix genfrac command")}return{type:"infix",mode:r.mode,replaceWith:t,token:n}}});var ra=["display","text","script","scriptscript"],aa=function(e){var t=null;return e.length>0&&(t="."===(t=e)?null:t),t};ot({type:"genfrac",names:["\\genfrac"],props:{numArgs:6,allowedInArgument:!0,argTypes:["math","math","size","text","math","math"]},handler(e,t){var r,{parser:a}=e,n=t[4],i=t[5],o=lt(t[0]),s="atom"===o.type&&"open"===o.family?aa(o.text):null,l=lt(t[1]),h="atom"===l.type&&"close"===l.family?aa(l.text):null,m=Gt(t[2],"size"),c=null;r=!!m.isBlank||(c=m.value).number>0;var p="auto",u=t[3];if("ordgroup"===u.type){if(u.body.length>0){var d=Gt(u.body[0],"textord");p=ra[Number(d.text)]}}else u=Gt(u,"textord"),p=ra[Number(u.text)];return{type:"genfrac",mode:a.mode,numer:n,denom:i,continued:!1,hasBarLine:r,barSize:c,leftDelim:s,rightDelim:h,size:p}},htmlBuilder:ea,mathmlBuilder:ta}),ot({type:"infix",names:["\\above"],props:{numArgs:1,argTypes:["size"],infix:!0},handler(e,t){var{parser:r,funcName:a,token:n}=e;return{type:"infix",mode:r.mode,replaceWith:"\\\\abovefrac",size:Gt(t[0],"size").value,token:n}}}),ot({type:"genfrac",names:["\\\\abovefrac"],props:{numArgs:3,argTypes:["math","size","math"]},handler:(e,t)=>{var{parser:r,funcName:a}=e,n=t[0],i=function(e){if(!e)throw new Error("Expected non-null, but got "+String(e));return e}(Gt(t[1],"infix").size),o=t[2],s=i.number>0;return{type:"genfrac",mode:r.mode,numer:n,denom:o,continued:!1,hasBarLine:s,barSize:i,leftDelim:null,rightDelim:null,size:"auto"}},htmlBuilder:ea,mathmlBuilder:ta});var na=(e,t)=>{var r,a,n=t.style;"supsub"===e.type?(r=e.sup?wt(e.sup,t.havingStyle(n.sup()),t):wt(e.sub,t.havingStyle(n.sub()),t),a=Gt(e.base,"horizBrace")):a=Gt(e,"horizBrace");var i,o=wt(a.base,t.havingBaseStyle(k.DISPLAY)),s=Ft(a,t);if(a.isOver?(i=Ke.makeVList({positionType:"firstBaseline",children:[{type:"elem",elem:o},{type:"kern",size:.1},{type:"elem",elem:s}]},t)).children[0].children[0].children[1].classes.push("svg-align"):(i=Ke.makeVList({positionType:"bottom",positionData:o.depth+.1+s.height,children:[{type:"elem",elem:s},{type:"kern",size:.1},{type:"elem",elem:o}]},t)).children[0].children[0].children[0].classes.push("svg-align"),r){var l=Ke.makeSpan(["mord",a.isOver?"mover":"munder"],[i],t);i=a.isOver?Ke.makeVList({positionType:"firstBaseline",children:[{type:"elem",elem:l},{type:"kern",size:.2},{type:"elem",elem:r}]},t):Ke.makeVList({positionType:"bottom",positionData:l.depth+.2+r.height+r.depth,children:[{type:"elem",elem:r},{type:"kern",size:.2},{type:"elem",elem:l}]},t)}return Ke.makeSpan(["mord",a.isOver?"mover":"munder"],[i],t)};ot({type:"horizBrace",names:["\\overbrace","\\underbrace"],props:{numArgs:1},handler(e,t){var{parser:r,funcName:a}=e;return{type:"horizBrace",mode:r.mode,label:a,isOver:/^\\over/.test(a),base:t[0]}},htmlBuilder:na,mathmlBuilder:(e,t)=>{var r=Pt(e.label);return new Tt.MathNode(e.isOver?"mover":"munder",[Rt(e.base,t),r])}}),ot({type:"href",names:["\\href"],props:{numArgs:2,argTypes:["url","original"],allowedInText:!0},handler:(e,t)=>{var{parser:r}=e,a=t[1],n=Gt(t[0],"url").url;return r.settings.isTrusted({command:"\\href",url:n})?{type:"href",mode:r.mode,href:n,body:ht(a)}:r.formatUnsupportedCmd("\\href")},htmlBuilder:(e,t)=>{var r=gt(e.body,t,!1);return Ke.makeAnchor(e.href,[],r,t)},mathmlBuilder:(e,t)=>{var r=It(e.body,t);return r instanceof zt||(r=new zt("mrow",[r])),r.setAttribute("href",e.href),r}}),ot({type:"href",names:["\\url"],props:{numArgs:1,argTypes:["url"],allowedInText:!0},handler:(e,t)=>{var{parser:r}=e,a=Gt(t[0],"url").url;if(!r.settings.isTrusted({command:"\\url",url:a}))return r.formatUnsupportedCmd("\\url");for(var n=[],i=0;inew Tt.MathNode("mrow",qt(e.body,t))}),ot({type:"html",names:["\\htmlClass","\\htmlId","\\htmlStyle","\\htmlData"],props:{numArgs:2,argTypes:["raw","original"],allowedInText:!0},handler:(e,t)=>{var r,{parser:a,funcName:n,token:o}=e,s=Gt(t[0],"raw").string,l=t[1];a.settings.strict&&a.settings.reportNonstrict("htmlExtension","HTML extension is disabled on strict mode");var h={};switch(n){case"\\htmlClass":h.class=s,r={command:"\\htmlClass",class:s};break;case"\\htmlId":h.id=s,r={command:"\\htmlId",id:s};break;case"\\htmlStyle":h.style=s,r={command:"\\htmlStyle",style:s};break;case"\\htmlData":for(var m=s.split(","),c=0;c{var r=gt(e.body,t,!1),a=["enclosing"];e.attributes.class&&a.push(...e.attributes.class.trim().split(/\s+/));var n=Ke.makeSpan(a,r,t);for(var i in e.attributes)"class"!==i&&e.attributes.hasOwnProperty(i)&&n.setAttribute(i,e.attributes[i]);return n},mathmlBuilder:(e,t)=>It(e.body,t)}),ot({type:"htmlmathml",names:["\\html@mathml"],props:{numArgs:2,allowedInText:!0},handler:(e,t)=>{var{parser:r}=e;return{type:"htmlmathml",mode:r.mode,html:ht(t[0]),mathml:ht(t[1])}},htmlBuilder:(e,t)=>{var r=gt(e.html,t,!1);return Ke.makeFragment(r)},mathmlBuilder:(e,t)=>It(e.mathml,t)});var ia=function(e){if(/^[-+]? *(\d+(\.\d*)?|\.\d+)$/.test(e))return{number:+e,unit:"bp"};var t=/([-+]?) *(\d+(?:\.\d*)?|\.\d+) *([a-z]{2})/.exec(e);if(!t)throw new i("Invalid size: '"+e+"' in \\includegraphics");var r={number:+(t[1]+t[2]),unit:t[3]};if(!P(r))throw new i("Invalid unit: '"+r.unit+"' in \\includegraphics.");return r};ot({type:"includegraphics",names:["\\includegraphics"],props:{numArgs:1,numOptionalArgs:1,argTypes:["raw","url"],allowedInText:!1},handler:(e,t,r)=>{var{parser:a}=e,n={number:0,unit:"em"},o={number:.9,unit:"em"},s={number:0,unit:"em"},l="";if(r[0])for(var h=Gt(r[0],"raw").string.split(","),m=0;m{var r=F(e.height,t),a=0;e.totalheight.number>0&&(a=F(e.totalheight,t)-r);var n=0;e.width.number>0&&(n=F(e.width,t));var i={height:G(r+a)};n>0&&(i.width=G(n)),a>0&&(i.verticalAlign=G(-a));var o=new $(e.src,e.alt,i);return o.height=r,o.depth=a,o},mathmlBuilder:(e,t)=>{var r=new Tt.MathNode("mglyph",[]);r.setAttribute("alt",e.alt);var a=F(e.height,t),n=0;if(e.totalheight.number>0&&(n=F(e.totalheight,t)-a,r.setAttribute("valign",G(-n))),r.setAttribute("height",G(a+n)),e.width.number>0){var i=F(e.width,t);r.setAttribute("width",G(i))}return r.setAttribute("src",e.src),r}}),ot({type:"kern",names:["\\kern","\\mkern","\\hskip","\\mskip"],props:{numArgs:1,argTypes:["size"],primitive:!0,allowedInText:!0},handler(e,t){var{parser:r,funcName:a}=e,n=Gt(t[0],"size");if(r.settings.strict){var i="m"===a[1],o="mu"===n.value.unit;i?(o||r.settings.reportNonstrict("mathVsTextUnits","LaTeX's "+a+" supports only mu units, not "+n.value.unit+" units"),"math"!==r.mode&&r.settings.reportNonstrict("mathVsTextUnits","LaTeX's "+a+" works only in math mode")):o&&r.settings.reportNonstrict("mathVsTextUnits","LaTeX's "+a+" doesn't support mu units")}return{type:"kern",mode:r.mode,dimension:n.value}},htmlBuilder:(e,t)=>Ke.makeGlue(e.dimension,t),mathmlBuilder(e,t){var r=F(e.dimension,t);return new Tt.SpaceNode(r)}}),ot({type:"lap",names:["\\mathllap","\\mathrlap","\\mathclap"],props:{numArgs:1,allowedInText:!0},handler:(e,t)=>{var{parser:r,funcName:a}=e,n=t[0];return{type:"lap",mode:r.mode,alignment:a.slice(5),body:n}},htmlBuilder:(e,t)=>{var r;"clap"===e.alignment?(r=Ke.makeSpan([],[wt(e.body,t)]),r=Ke.makeSpan(["inner"],[r],t)):r=Ke.makeSpan(["inner"],[wt(e.body,t)]);var a=Ke.makeSpan(["fix"],[]),n=Ke.makeSpan([e.alignment],[r,a],t),i=Ke.makeSpan(["strut"]);return i.style.height=G(n.height+n.depth),n.depth&&(i.style.verticalAlign=G(-n.depth)),n.children.unshift(i),n=Ke.makeSpan(["thinbox"],[n],t),Ke.makeSpan(["mord","vbox"],[n],t)},mathmlBuilder:(e,t)=>{var r=new Tt.MathNode("mpadded",[Rt(e.body,t)]);if("rlap"!==e.alignment){var a="llap"===e.alignment?"-1":"-0.5";r.setAttribute("lspace",a+"width")}return r.setAttribute("width","0px"),r}}),ot({type:"styling",names:["\\(","$"],props:{numArgs:0,allowedInText:!0,allowedInMath:!1},handler(e,t){var{funcName:r,parser:a}=e,n=a.mode;a.switchMode("math");var i="\\("===r?"\\)":"$",o=a.parseExpression(!1,i);return a.expect(i),a.switchMode(n),{type:"styling",mode:a.mode,style:"text",body:o}}}),ot({type:"text",names:["\\)","\\]"],props:{numArgs:0,allowedInText:!0,allowedInMath:!1},handler(e,t){throw new i("Mismatched "+e.funcName)}});var oa=(e,t)=>{switch(t.style.size){case k.DISPLAY.size:return e.display;case k.TEXT.size:return e.text;case k.SCRIPT.size:return e.script;case k.SCRIPTSCRIPT.size:return e.scriptscript;default:return e.text}};ot({type:"mathchoice",names:["\\mathchoice"],props:{numArgs:4,primitive:!0},handler:(e,t)=>{var{parser:r}=e;return{type:"mathchoice",mode:r.mode,display:ht(t[0]),text:ht(t[1]),script:ht(t[2]),scriptscript:ht(t[3])}},htmlBuilder:(e,t)=>{var r=oa(e,t),a=gt(r,t,!1);return Ke.makeFragment(a)},mathmlBuilder:(e,t)=>{var r=oa(e,t);return It(r,t)}});var sa=(e,t,r,a,n,i,o)=>{e=Ke.makeSpan([],[e]);var s,l,h,c=r&&m.isCharacterBox(r);if(t){var p=wt(t,a.havingStyle(n.sup()),a);l={elem:p,kern:Math.max(a.fontMetrics().bigOpSpacing1,a.fontMetrics().bigOpSpacing3-p.depth)}}if(r){var u=wt(r,a.havingStyle(n.sub()),a);s={elem:u,kern:Math.max(a.fontMetrics().bigOpSpacing2,a.fontMetrics().bigOpSpacing4-u.height)}}if(l&&s){var d=a.fontMetrics().bigOpSpacing5+s.elem.height+s.elem.depth+s.kern+e.depth+o;h=Ke.makeVList({positionType:"bottom",positionData:d,children:[{type:"kern",size:a.fontMetrics().bigOpSpacing5},{type:"elem",elem:s.elem,marginLeft:G(-i)},{type:"kern",size:s.kern},{type:"elem",elem:e},{type:"kern",size:l.kern},{type:"elem",elem:l.elem,marginLeft:G(i)},{type:"kern",size:a.fontMetrics().bigOpSpacing5}]},a)}else if(s){var g=e.height-o;h=Ke.makeVList({positionType:"top",positionData:g,children:[{type:"kern",size:a.fontMetrics().bigOpSpacing5},{type:"elem",elem:s.elem,marginLeft:G(-i)},{type:"kern",size:s.kern},{type:"elem",elem:e}]},a)}else{if(!l)return e;var f=e.depth+o;h=Ke.makeVList({positionType:"bottom",positionData:f,children:[{type:"elem",elem:e},{type:"kern",size:l.kern},{type:"elem",elem:l.elem,marginLeft:G(i)},{type:"kern",size:a.fontMetrics().bigOpSpacing5}]},a)}var v=[h];if(s&&0!==i&&!c){var b=Ke.makeSpan(["mspace"],[],a);b.style.marginRight=G(i),v.unshift(b)}return Ke.makeSpan(["mop","op-limits"],v,a)},la=["\\smallint"],ha=(e,t)=>{var r,a,n,i=!1;"supsub"===e.type?(r=e.sup,a=e.sub,n=Gt(e.base,"op"),i=!0):n=Gt(e,"op");var o,s=t.style,l=!1;if(s.size===k.DISPLAY.size&&n.symbol&&!m.contains(la,n.name)&&(l=!0),n.symbol){var h=l?"Size2-Regular":"Size1-Regular",c="";if("\\oiint"!==n.name&&"\\oiiint"!==n.name||(c=n.name.slice(1),n.name="oiint"===c?"\\iint":"\\iiint"),o=Ke.makeSymbol(n.name,h,"math",t,["mop","op-symbol",l?"large-op":"small-op"]),c.length>0){var p=o.italic,u=Ke.staticSvg(c+"Size"+(l?"2":"1"),t);o=Ke.makeVList({positionType:"individualShift",children:[{type:"elem",elem:o,shift:0},{type:"elem",elem:u,shift:l?.08:0}]},t),n.name="\\"+c,o.classes.unshift("mop"),o.italic=p}}else if(n.body){var d=gt(n.body,t,!0);1===d.length&&d[0]instanceof K?(o=d[0]).classes[0]="mop":o=Ke.makeSpan(["mop"],d,t)}else{for(var g=[],f=1;f{var r;if(e.symbol)r=new zt("mo",[Bt(e.name,e.mode)]),m.contains(la,e.name)&&r.setAttribute("largeop","false");else if(e.body)r=new zt("mo",qt(e.body,t));else{r=new zt("mi",[new At(e.name.slice(1))]);var a=new zt("mo",[Bt("\u2061","text")]);r=e.parentIsSupSub?new zt("mrow",[r,a]):Mt([r,a])}return r},ca={"\u220f":"\\prod","\u2210":"\\coprod","\u2211":"\\sum","\u22c0":"\\bigwedge","\u22c1":"\\bigvee","\u22c2":"\\bigcap","\u22c3":"\\bigcup","\u2a00":"\\bigodot","\u2a01":"\\bigoplus","\u2a02":"\\bigotimes","\u2a04":"\\biguplus","\u2a06":"\\bigsqcup"};ot({type:"op",names:["\\coprod","\\bigvee","\\bigwedge","\\biguplus","\\bigcap","\\bigcup","\\intop","\\prod","\\sum","\\bigotimes","\\bigoplus","\\bigodot","\\bigsqcup","\\smallint","\u220f","\u2210","\u2211","\u22c0","\u22c1","\u22c2","\u22c3","\u2a00","\u2a01","\u2a02","\u2a04","\u2a06"],props:{numArgs:0},handler:(e,t)=>{var{parser:r,funcName:a}=e,n=a;return 1===n.length&&(n=ca[n]),{type:"op",mode:r.mode,limits:!0,parentIsSupSub:!1,symbol:!0,name:n}},htmlBuilder:ha,mathmlBuilder:ma}),ot({type:"op",names:["\\mathop"],props:{numArgs:1,primitive:!0},handler:(e,t)=>{var{parser:r}=e,a=t[0];return{type:"op",mode:r.mode,limits:!1,parentIsSupSub:!1,symbol:!1,body:ht(a)}},htmlBuilder:ha,mathmlBuilder:ma});var pa={"\u222b":"\\int","\u222c":"\\iint","\u222d":"\\iiint","\u222e":"\\oint","\u222f":"\\oiint","\u2230":"\\oiiint"};ot({type:"op",names:["\\arcsin","\\arccos","\\arctan","\\arctg","\\arcctg","\\arg","\\ch","\\cos","\\cosec","\\cosh","\\cot","\\cotg","\\coth","\\csc","\\ctg","\\cth","\\deg","\\dim","\\exp","\\hom","\\ker","\\lg","\\ln","\\log","\\sec","\\sin","\\sinh","\\sh","\\tan","\\tanh","\\tg","\\th"],props:{numArgs:0},handler(e){var{parser:t,funcName:r}=e;return{type:"op",mode:t.mode,limits:!1,parentIsSupSub:!1,symbol:!1,name:r}},htmlBuilder:ha,mathmlBuilder:ma}),ot({type:"op",names:["\\det","\\gcd","\\inf","\\lim","\\max","\\min","\\Pr","\\sup"],props:{numArgs:0},handler(e){var{parser:t,funcName:r}=e;return{type:"op",mode:t.mode,limits:!0,parentIsSupSub:!1,symbol:!1,name:r}},htmlBuilder:ha,mathmlBuilder:ma}),ot({type:"op",names:["\\int","\\iint","\\iiint","\\oint","\\oiint","\\oiiint","\u222b","\u222c","\u222d","\u222e","\u222f","\u2230"],props:{numArgs:0},handler(e){var{parser:t,funcName:r}=e,a=r;return 1===a.length&&(a=pa[a]),{type:"op",mode:t.mode,limits:!1,parentIsSupSub:!1,symbol:!0,name:a}},htmlBuilder:ha,mathmlBuilder:ma});var ua=(e,t)=>{var r,a,n,i,o=!1;if("supsub"===e.type?(r=e.sup,a=e.sub,n=Gt(e.base,"operatorname"),o=!0):n=Gt(e,"operatorname"),n.body.length>0){for(var s=n.body.map((e=>{var t=e.text;return"string"==typeof t?{type:"textord",mode:e.mode,text:t}:e})),l=gt(s,t.withFont("mathrm"),!0),h=0;h{var{parser:r,funcName:a}=e,n=t[0];return{type:"operatorname",mode:r.mode,body:ht(n),alwaysHandleSupSub:"\\operatornamewithlimits"===a,limits:!1,parentIsSupSub:!1}},htmlBuilder:ua,mathmlBuilder:(e,t)=>{for(var r=qt(e.body,t.withFont("mathrm")),a=!0,n=0;ne.toText())).join("");r=[new Tt.TextNode(s)]}var l=new Tt.MathNode("mi",r);l.setAttribute("mathvariant","normal");var h=new Tt.MathNode("mo",[Bt("\u2061","text")]);return e.parentIsSupSub?new Tt.MathNode("mrow",[l,h]):Tt.newDocumentFragment([l,h])}}),Vr("\\operatorname","\\@ifstar\\operatornamewithlimits\\operatorname@"),st({type:"ordgroup",htmlBuilder:(e,t)=>e.semisimple?Ke.makeFragment(gt(e.body,t,!1)):Ke.makeSpan(["mord"],gt(e.body,t,!0),t),mathmlBuilder:(e,t)=>It(e.body,t,!0)}),ot({type:"overline",names:["\\overline"],props:{numArgs:1},handler(e,t){var{parser:r}=e,a=t[0];return{type:"overline",mode:r.mode,body:a}},htmlBuilder(e,t){var r=wt(e.body,t.havingCrampedStyle()),a=Ke.makeLineSpan("overline-line",t),n=t.fontMetrics().defaultRuleThickness,i=Ke.makeVList({positionType:"firstBaseline",children:[{type:"elem",elem:r},{type:"kern",size:3*n},{type:"elem",elem:a},{type:"kern",size:n}]},t);return Ke.makeSpan(["mord","overline"],[i],t)},mathmlBuilder(e,t){var r=new Tt.MathNode("mo",[new Tt.TextNode("\u203e")]);r.setAttribute("stretchy","true");var a=new Tt.MathNode("mover",[Rt(e.body,t),r]);return a.setAttribute("accent","true"),a}}),ot({type:"phantom",names:["\\phantom"],props:{numArgs:1,allowedInText:!0},handler:(e,t)=>{var{parser:r}=e,a=t[0];return{type:"phantom",mode:r.mode,body:ht(a)}},htmlBuilder:(e,t)=>{var r=gt(e.body,t.withPhantom(),!1);return Ke.makeFragment(r)},mathmlBuilder:(e,t)=>{var r=qt(e.body,t);return new Tt.MathNode("mphantom",r)}}),ot({type:"hphantom",names:["\\hphantom"],props:{numArgs:1,allowedInText:!0},handler:(e,t)=>{var{parser:r}=e,a=t[0];return{type:"hphantom",mode:r.mode,body:a}},htmlBuilder:(e,t)=>{var r=Ke.makeSpan([],[wt(e.body,t.withPhantom())]);if(r.height=0,r.depth=0,r.children)for(var a=0;a{var r=qt(ht(e.body),t),a=new Tt.MathNode("mphantom",r),n=new Tt.MathNode("mpadded",[a]);return n.setAttribute("height","0px"),n.setAttribute("depth","0px"),n}}),ot({type:"vphantom",names:["\\vphantom"],props:{numArgs:1,allowedInText:!0},handler:(e,t)=>{var{parser:r}=e,a=t[0];return{type:"vphantom",mode:r.mode,body:a}},htmlBuilder:(e,t)=>{var r=Ke.makeSpan(["inner"],[wt(e.body,t.withPhantom())]),a=Ke.makeSpan(["fix"],[]);return Ke.makeSpan(["mord","rlap"],[r,a],t)},mathmlBuilder:(e,t)=>{var r=qt(ht(e.body),t),a=new Tt.MathNode("mphantom",r),n=new Tt.MathNode("mpadded",[a]);return n.setAttribute("width","0px"),n}}),ot({type:"raisebox",names:["\\raisebox"],props:{numArgs:2,argTypes:["size","hbox"],allowedInText:!0},handler(e,t){var{parser:r}=e,a=Gt(t[0],"size").value,n=t[1];return{type:"raisebox",mode:r.mode,dy:a,body:n}},htmlBuilder(e,t){var r=wt(e.body,t),a=F(e.dy,t);return Ke.makeVList({positionType:"shift",positionData:-a,children:[{type:"elem",elem:r}]},t)},mathmlBuilder(e,t){var r=new Tt.MathNode("mpadded",[Rt(e.body,t)]),a=e.dy.number+e.dy.unit;return r.setAttribute("voffset",a),r}}),ot({type:"internal",names:["\\relax"],props:{numArgs:0,allowedInText:!0},handler(e){var{parser:t}=e;return{type:"internal",mode:t.mode}}}),ot({type:"rule",names:["\\rule"],props:{numArgs:2,numOptionalArgs:1,argTypes:["size","size","size"]},handler(e,t,r){var{parser:a}=e,n=r[0],i=Gt(t[0],"size"),o=Gt(t[1],"size");return{type:"rule",mode:a.mode,shift:n&&Gt(n,"size").value,width:i.value,height:o.value}},htmlBuilder(e,t){var r=Ke.makeSpan(["mord","rule"],[],t),a=F(e.width,t),n=F(e.height,t),i=e.shift?F(e.shift,t):0;return r.style.borderRightWidth=G(a),r.style.borderTopWidth=G(n),r.style.bottom=G(i),r.width=a,r.height=n+i,r.depth=-i,r.maxFontSize=1.125*n*t.sizeMultiplier,r},mathmlBuilder(e,t){var r=F(e.width,t),a=F(e.height,t),n=e.shift?F(e.shift,t):0,i=t.color&&t.getColor()||"black",o=new Tt.MathNode("mspace");o.setAttribute("mathbackground",i),o.setAttribute("width",G(r)),o.setAttribute("height",G(a));var s=new Tt.MathNode("mpadded",[o]);return n>=0?s.setAttribute("height",G(n)):(s.setAttribute("height",G(n)),s.setAttribute("depth",G(-n))),s.setAttribute("voffset",G(n)),s}});var ga=["\\tiny","\\sixptsize","\\scriptsize","\\footnotesize","\\small","\\normalsize","\\large","\\Large","\\LARGE","\\huge","\\Huge"];ot({type:"sizing",names:ga,props:{numArgs:0,allowedInText:!0},handler:(e,t)=>{var{breakOnTokenText:r,funcName:a,parser:n}=e,i=n.parseExpression(!1,r);return{type:"sizing",mode:n.mode,size:ga.indexOf(a)+1,body:i}},htmlBuilder:(e,t)=>{var r=t.havingSize(e.size);return da(e.body,r,t)},mathmlBuilder:(e,t)=>{var r=t.havingSize(e.size),a=qt(e.body,r),n=new Tt.MathNode("mstyle",a);return n.setAttribute("mathsize",G(r.sizeMultiplier)),n}}),ot({type:"smash",names:["\\smash"],props:{numArgs:1,numOptionalArgs:1,allowedInText:!0},handler:(e,t,r)=>{var{parser:a}=e,n=!1,i=!1,o=r[0]&&Gt(r[0],"ordgroup");if(o)for(var s="",l=0;l{var r=Ke.makeSpan([],[wt(e.body,t)]);if(!e.smashHeight&&!e.smashDepth)return r;if(e.smashHeight&&(r.height=0,r.children))for(var a=0;a{var r=new Tt.MathNode("mpadded",[Rt(e.body,t)]);return e.smashHeight&&r.setAttribute("height","0px"),e.smashDepth&&r.setAttribute("depth","0px"),r}}),ot({type:"sqrt",names:["\\sqrt"],props:{numArgs:1,numOptionalArgs:1},handler(e,t,r){var{parser:a}=e,n=r[0],i=t[0];return{type:"sqrt",mode:a.mode,body:i,index:n}},htmlBuilder(e,t){var r=wt(e.body,t.havingCrampedStyle());0===r.height&&(r.height=t.fontMetrics().xHeight),r=Ke.wrapFragment(r,t);var a=t.fontMetrics().defaultRuleThickness,n=a;t.style.idr.height+r.depth+i&&(i=(i+m-r.height-r.depth)/2);var c=s.height-r.height-i-l;r.style.paddingLeft=G(h);var p=Ke.makeVList({positionType:"firstBaseline",children:[{type:"elem",elem:r,wrapperClasses:["svg-align"]},{type:"kern",size:-(r.height+c)},{type:"elem",elem:s},{type:"kern",size:l}]},t);if(e.index){var u=t.havingStyle(k.SCRIPTSCRIPT),d=wt(e.index,u,t),g=.6*(p.height-p.depth),f=Ke.makeVList({positionType:"shift",positionData:-g,children:[{type:"elem",elem:d}]},t),v=Ke.makeSpan(["root"],[f]);return Ke.makeSpan(["mord","sqrt"],[v,p],t)}return Ke.makeSpan(["mord","sqrt"],[p],t)},mathmlBuilder(e,t){var{body:r,index:a}=e;return a?new Tt.MathNode("mroot",[Rt(r,t),Rt(a,t)]):new Tt.MathNode("msqrt",[Rt(r,t)])}});var fa={display:k.DISPLAY,text:k.TEXT,script:k.SCRIPT,scriptscript:k.SCRIPTSCRIPT};ot({type:"styling",names:["\\displaystyle","\\textstyle","\\scriptstyle","\\scriptscriptstyle"],props:{numArgs:0,allowedInText:!0,primitive:!0},handler(e,t){var{breakOnTokenText:r,funcName:a,parser:n}=e,i=n.parseExpression(!0,r),o=a.slice(1,a.length-5);return{type:"styling",mode:n.mode,style:o,body:i}},htmlBuilder(e,t){var r=fa[e.style],a=t.havingStyle(r).withFont("");return da(e.body,a,t)},mathmlBuilder(e,t){var r=fa[e.style],a=t.havingStyle(r),n=qt(e.body,a),i=new Tt.MathNode("mstyle",n),o={display:["0","true"],text:["0","false"],script:["1","false"],scriptscript:["2","false"]}[e.style];return i.setAttribute("scriptlevel",o[0]),i.setAttribute("displaystyle",o[1]),i}});st({type:"supsub",htmlBuilder(e,t){var r=function(e,t){var r=e.base;return r?"op"===r.type?r.limits&&(t.style.size===k.DISPLAY.size||r.alwaysHandleSupSub)?ha:null:"operatorname"===r.type?r.alwaysHandleSupSub&&(t.style.size===k.DISPLAY.size||r.limits)?ua:null:"accent"===r.type?m.isCharacterBox(r.base)?Xt:null:"horizBrace"===r.type&&!e.sub===r.isOver?na:null:null}(e,t);if(r)return r(e,t);var a,n,i,{base:o,sup:s,sub:l}=e,h=wt(o,t),c=t.fontMetrics(),p=0,u=0,d=o&&m.isCharacterBox(o);if(s){var g=t.havingStyle(t.style.sup());a=wt(s,g,t),d||(p=h.height-g.fontMetrics().supDrop*g.sizeMultiplier/t.sizeMultiplier)}if(l){var f=t.havingStyle(t.style.sub());n=wt(l,f,t),d||(u=h.depth+f.fontMetrics().subDrop*f.sizeMultiplier/t.sizeMultiplier)}i=t.style===k.DISPLAY?c.sup1:t.style.cramped?c.sup3:c.sup2;var v,b=t.sizeMultiplier,y=G(.5/c.ptPerEm/b),x=null;if(n){var w=e.base&&"op"===e.base.type&&e.base.name&&("\\oiint"===e.base.name||"\\oiiint"===e.base.name);(h instanceof K||w)&&(x=G(-h.italic))}if(a&&n){p=Math.max(p,i,a.depth+.25*c.xHeight),u=Math.max(u,c.sub2);var S=4*c.defaultRuleThickness;if(p-a.depth-(n.height-u)0&&(p+=M,u-=M)}var z=[{type:"elem",elem:n,shift:u,marginRight:y,marginLeft:x},{type:"elem",elem:a,shift:-p,marginRight:y}];v=Ke.makeVList({positionType:"individualShift",children:z},t)}else if(n){u=Math.max(u,c.sub1,n.height-.8*c.xHeight);var A=[{type:"elem",elem:n,marginLeft:x,marginRight:y}];v=Ke.makeVList({positionType:"shift",positionData:u,children:A},t)}else{if(!a)throw new Error("supsub must have either sup or sub.");p=Math.max(p,i,a.depth+.25*c.xHeight),v=Ke.makeVList({positionType:"shift",positionData:-p,children:[{type:"elem",elem:a,marginRight:y}]},t)}var T=yt(h,"right")||"mord";return Ke.makeSpan([T],[h,Ke.makeSpan(["msupsub"],[v])],t)},mathmlBuilder(e,t){var r,a=!1;e.base&&"horizBrace"===e.base.type&&!!e.sup===e.base.isOver&&(a=!0,r=e.base.isOver),!e.base||"op"!==e.base.type&&"operatorname"!==e.base.type||(e.base.parentIsSupSub=!0);var n,i=[Rt(e.base,t)];if(e.sub&&i.push(Rt(e.sub,t)),e.sup&&i.push(Rt(e.sup,t)),a)n=r?"mover":"munder";else if(e.sub)if(e.sup){var o=e.base;n=o&&"op"===o.type&&o.limits&&t.style===k.DISPLAY||o&&"operatorname"===o.type&&o.alwaysHandleSupSub&&(t.style===k.DISPLAY||o.limits)?"munderover":"msubsup"}else{var s=e.base;n=s&&"op"===s.type&&s.limits&&(t.style===k.DISPLAY||s.alwaysHandleSupSub)||s&&"operatorname"===s.type&&s.alwaysHandleSupSub&&(s.limits||t.style===k.DISPLAY)?"munder":"msub"}else{var l=e.base;n=l&&"op"===l.type&&l.limits&&(t.style===k.DISPLAY||l.alwaysHandleSupSub)||l&&"operatorname"===l.type&&l.alwaysHandleSupSub&&(l.limits||t.style===k.DISPLAY)?"mover":"msup"}return new Tt.MathNode(n,i)}}),st({type:"atom",htmlBuilder:(e,t)=>Ke.mathsym(e.text,e.mode,t,["m"+e.family]),mathmlBuilder(e,t){var r=new Tt.MathNode("mo",[Bt(e.text,e.mode)]);if("bin"===e.family){var a=Nt(e,t);"bold-italic"===a&&r.setAttribute("mathvariant",a)}else"punct"===e.family?r.setAttribute("separator","true"):"open"!==e.family&&"close"!==e.family||r.setAttribute("stretchy","false");return r}});var va={mi:"italic",mn:"normal",mtext:"normal"};st({type:"mathord",htmlBuilder:(e,t)=>Ke.makeOrd(e,t,"mathord"),mathmlBuilder(e,t){var r=new Tt.MathNode("mi",[Bt(e.text,e.mode,t)]),a=Nt(e,t)||"italic";return a!==va[r.type]&&r.setAttribute("mathvariant",a),r}}),st({type:"textord",htmlBuilder:(e,t)=>Ke.makeOrd(e,t,"textord"),mathmlBuilder(e,t){var r,a=Bt(e.text,e.mode,t),n=Nt(e,t)||"normal";return r="text"===e.mode?new Tt.MathNode("mtext",[a]):/[0-9]/.test(e.text)?new Tt.MathNode("mn",[a]):"\\prime"===e.text?new Tt.MathNode("mo",[a]):new Tt.MathNode("mi",[a]),n!==va[r.type]&&r.setAttribute("mathvariant",n),r}});var ba={"\\nobreak":"nobreak","\\allowbreak":"allowbreak"},ya={" ":{},"\\ ":{},"~":{className:"nobreak"},"\\space":{},"\\nobreakspace":{className:"nobreak"}};st({type:"spacing",htmlBuilder(e,t){if(ya.hasOwnProperty(e.text)){var r=ya[e.text].className||"";if("text"===e.mode){var a=Ke.makeOrd(e,t,"textord");return a.classes.push(r),a}return Ke.makeSpan(["mspace",r],[Ke.mathsym(e.text,e.mode,t)],t)}if(ba.hasOwnProperty(e.text))return Ke.makeSpan(["mspace",ba[e.text]],[],t);throw new i('Unknown type of space "'+e.text+'"')},mathmlBuilder(e,t){if(!ya.hasOwnProperty(e.text)){if(ba.hasOwnProperty(e.text))return new Tt.MathNode("mspace");throw new i('Unknown type of space "'+e.text+'"')}return new Tt.MathNode("mtext",[new Tt.TextNode("\xa0")])}});var xa=()=>{var e=new Tt.MathNode("mtd",[]);return e.setAttribute("width","50%"),e};st({type:"tag",mathmlBuilder(e,t){var r=new Tt.MathNode("mtable",[new Tt.MathNode("mtr",[xa(),new Tt.MathNode("mtd",[It(e.body,t)]),xa(),new Tt.MathNode("mtd",[It(e.tag,t)])])]);return r.setAttribute("width","100%"),r}});var wa={"\\text":void 0,"\\textrm":"textrm","\\textsf":"textsf","\\texttt":"texttt","\\textnormal":"textrm"},ka={"\\textbf":"textbf","\\textmd":"textmd"},Sa={"\\textit":"textit","\\textup":"textup"},Ma=(e,t)=>{var r=e.font;return r?wa[r]?t.withTextFontFamily(wa[r]):ka[r]?t.withTextFontWeight(ka[r]):"\\emph"===r?"textit"===t.fontShape?t.withTextFontShape("textup"):t.withTextFontShape("textit"):t.withTextFontShape(Sa[r]):t};ot({type:"text",names:["\\text","\\textrm","\\textsf","\\texttt","\\textnormal","\\textbf","\\textmd","\\textit","\\textup","\\emph"],props:{numArgs:1,argTypes:["text"],allowedInArgument:!0,allowedInText:!0},handler(e,t){var{parser:r,funcName:a}=e,n=t[0];return{type:"text",mode:r.mode,body:ht(n),font:a}},htmlBuilder(e,t){var r=Ma(e,t),a=gt(e.body,r,!0);return Ke.makeSpan(["mord","text"],a,r)},mathmlBuilder(e,t){var r=Ma(e,t);return It(e.body,r)}}),ot({type:"underline",names:["\\underline"],props:{numArgs:1,allowedInText:!0},handler(e,t){var{parser:r}=e;return{type:"underline",mode:r.mode,body:t[0]}},htmlBuilder(e,t){var r=wt(e.body,t),a=Ke.makeLineSpan("underline-line",t),n=t.fontMetrics().defaultRuleThickness,i=Ke.makeVList({positionType:"top",positionData:r.height,children:[{type:"kern",size:n},{type:"elem",elem:a},{type:"kern",size:3*n},{type:"elem",elem:r}]},t);return Ke.makeSpan(["mord","underline"],[i],t)},mathmlBuilder(e,t){var r=new Tt.MathNode("mo",[new Tt.TextNode("\u203e")]);r.setAttribute("stretchy","true");var a=new Tt.MathNode("munder",[Rt(e.body,t),r]);return a.setAttribute("accentunder","true"),a}}),ot({type:"vcenter",names:["\\vcenter"],props:{numArgs:1,argTypes:["original"],allowedInText:!1},handler(e,t){var{parser:r}=e;return{type:"vcenter",mode:r.mode,body:t[0]}},htmlBuilder(e,t){var r=wt(e.body,t),a=t.fontMetrics().axisHeight,n=.5*(r.height-a-(r.depth+a));return Ke.makeVList({positionType:"shift",positionData:n,children:[{type:"elem",elem:r}]},t)},mathmlBuilder:(e,t)=>new Tt.MathNode("mpadded",[Rt(e.body,t)],["vcenter"])}),ot({type:"verb",names:["\\verb"],props:{numArgs:0,allowedInText:!0},handler(e,t,r){throw new i("\\verb ended by end of line instead of matching delimiter")},htmlBuilder(e,t){for(var r=za(e),a=[],n=t.havingStyle(t.style.text()),i=0;ie.body.replace(/ /g,e.star?"\u2423":"\xa0"),Aa=at,Ta="[ \r\n\t]",Ba="(\\\\[a-zA-Z@]+)"+Ta+"*",Ca="[\u0300-\u036f]",Na=new RegExp(Ca+"+$"),qa="("+Ta+"+)|\\\\(\n|[ \r\t]+\n?)[ \r\t]*|([!-\\[\\]-\u2027\u202a-\ud7ff\uf900-\uffff]"+Ca+"*|[\ud800-\udbff][\udc00-\udfff]"+Ca+"*|\\\\verb\\*([^]).*?\\4|\\\\verb([^*a-zA-Z]).*?\\5|"+Ba+"|\\\\[^\ud800-\udfff])";class Ia{constructor(e,t){this.input=void 0,this.settings=void 0,this.tokenRegex=void 0,this.catcodes=void 0,this.input=e,this.settings=t,this.tokenRegex=new RegExp(qa,"g"),this.catcodes={"%":14,"~":13}}setCatcode(e,t){this.catcodes[e]=t}lex(){var e=this.input,t=this.tokenRegex.lastIndex;if(t===e.length)return new n("EOF",new a(this,t,t));var r=this.tokenRegex.exec(e);if(null===r||r.index!==t)throw new i("Unexpected character: '"+e[t]+"'",new n(e[t],new a(this,t,t+1)));var o=r[6]||r[3]||(r[2]?"\\ ":" ");if(14===this.catcodes[o]){var s=e.indexOf("\n",this.tokenRegex.lastIndex);return-1===s?(this.tokenRegex.lastIndex=e.length,this.settings.reportNonstrict("commentAtEnd","% comment has no terminating newline; LaTeX would fail because of commenting the end of math mode (e.g. $)")):this.tokenRegex.lastIndex=s+1,this.lex()}return new n(o,new a(this,t,this.tokenRegex.lastIndex))}}class Ra{constructor(e,t){void 0===e&&(e={}),void 0===t&&(t={}),this.current=void 0,this.builtins=void 0,this.undefStack=void 0,this.current=t,this.builtins=e,this.undefStack=[]}beginGroup(){this.undefStack.push({})}endGroup(){if(0===this.undefStack.length)throw new i("Unbalanced namespace destruction: attempt to pop global namespace; please report this as a bug");var e=this.undefStack.pop();for(var t in e)e.hasOwnProperty(t)&&(null==e[t]?delete this.current[t]:this.current[t]=e[t])}endGroups(){for(;this.undefStack.length>0;)this.endGroup()}has(e){return this.current.hasOwnProperty(e)||this.builtins.hasOwnProperty(e)}get(e){return this.current.hasOwnProperty(e)?this.current[e]:this.builtins[e]}set(e,t,r){if(void 0===r&&(r=!1),r){for(var a=0;a0&&(this.undefStack[this.undefStack.length-1][e]=t)}else{var n=this.undefStack[this.undefStack.length-1];n&&!n.hasOwnProperty(e)&&(n[e]=this.current[e])}null==t?delete this.current[e]:this.current[e]=t}}var Ha=Dr;Vr("\\noexpand",(function(e){var t=e.popToken();return e.isExpandable(t.text)&&(t.noexpand=!0,t.treatAsRelax=!0),{tokens:[t],numArgs:0}})),Vr("\\expandafter",(function(e){var t=e.popToken();return e.expandOnce(!0),{tokens:[t],numArgs:0}})),Vr("\\@firstoftwo",(function(e){return{tokens:e.consumeArgs(2)[0],numArgs:0}})),Vr("\\@secondoftwo",(function(e){return{tokens:e.consumeArgs(2)[1],numArgs:0}})),Vr("\\@ifnextchar",(function(e){var t=e.consumeArgs(3);e.consumeSpaces();var r=e.future();return 1===t[0].length&&t[0][0].text===r.text?{tokens:t[1],numArgs:0}:{tokens:t[2],numArgs:0}})),Vr("\\@ifstar","\\@ifnextchar *{\\@firstoftwo{#1}}"),Vr("\\TextOrMath",(function(e){var t=e.consumeArgs(2);return"text"===e.mode?{tokens:t[0],numArgs:0}:{tokens:t[1],numArgs:0}}));var Oa={0:0,1:1,2:2,3:3,4:4,5:5,6:6,7:7,8:8,9:9,a:10,A:10,b:11,B:11,c:12,C:12,d:13,D:13,e:14,E:14,f:15,F:15};Vr("\\char",(function(e){var t,r=e.popToken(),a="";if("'"===r.text)t=8,r=e.popToken();else if('"'===r.text)t=16,r=e.popToken();else if("`"===r.text)if("\\"===(r=e.popToken()).text[0])a=r.text.charCodeAt(1);else{if("EOF"===r.text)throw new i("\\char` missing argument");a=r.text.charCodeAt(0)}else t=10;if(t){if(null==(a=Oa[r.text])||a>=t)throw new i("Invalid base-"+t+" digit "+r.text);for(var n;null!=(n=Oa[e.future().text])&&n{var a=e.consumeArg().tokens;if(1!==a.length)throw new i("\\newcommand's first argument must be a macro name");var n=a[0].text,o=e.isDefined(n);if(o&&!t)throw new i("\\newcommand{"+n+"} attempting to redefine "+n+"; use \\renewcommand");if(!o&&!r)throw new i("\\renewcommand{"+n+"} when command "+n+" does not yet exist; use \\newcommand");var s=0;if(1===(a=e.consumeArg().tokens).length&&"["===a[0].text){for(var l="",h=e.expandNextToken();"]"!==h.text&&"EOF"!==h.text;)l+=h.text,h=e.expandNextToken();if(!l.match(/^\s*[0-9]+\s*$/))throw new i("Invalid number of arguments: "+l);s=parseInt(l),a=e.consumeArg().tokens}return e.macros.set(n,{tokens:a,numArgs:s}),""};Vr("\\newcommand",(e=>Ea(e,!1,!0))),Vr("\\renewcommand",(e=>Ea(e,!0,!1))),Vr("\\providecommand",(e=>Ea(e,!0,!0))),Vr("\\message",(e=>{var t=e.consumeArgs(1)[0];return console.log(t.reverse().map((e=>e.text)).join("")),""})),Vr("\\errmessage",(e=>{var t=e.consumeArgs(1)[0];return console.error(t.reverse().map((e=>e.text)).join("")),""})),Vr("\\show",(e=>{var t=e.popToken(),r=t.text;return console.log(t,e.macros.get(r),Aa[r],ne.math[r],ne.text[r]),""})),Vr("\\bgroup","{"),Vr("\\egroup","}"),Vr("~","\\nobreakspace"),Vr("\\lq","`"),Vr("\\rq","'"),Vr("\\aa","\\r a"),Vr("\\AA","\\r A"),Vr("\\textcopyright","\\html@mathml{\\textcircled{c}}{\\char`\xa9}"),Vr("\\copyright","\\TextOrMath{\\textcopyright}{\\text{\\textcopyright}}"),Vr("\\textregistered","\\html@mathml{\\textcircled{\\scriptsize R}}{\\char`\xae}"),Vr("\u212c","\\mathscr{B}"),Vr("\u2130","\\mathscr{E}"),Vr("\u2131","\\mathscr{F}"),Vr("\u210b","\\mathscr{H}"),Vr("\u2110","\\mathscr{I}"),Vr("\u2112","\\mathscr{L}"),Vr("\u2133","\\mathscr{M}"),Vr("\u211b","\\mathscr{R}"),Vr("\u212d","\\mathfrak{C}"),Vr("\u210c","\\mathfrak{H}"),Vr("\u2128","\\mathfrak{Z}"),Vr("\\Bbbk","\\Bbb{k}"),Vr("\xb7","\\cdotp"),Vr("\\llap","\\mathllap{\\textrm{#1}}"),Vr("\\rlap","\\mathrlap{\\textrm{#1}}"),Vr("\\clap","\\mathclap{\\textrm{#1}}"),Vr("\\mathstrut","\\vphantom{(}"),Vr("\\underbar","\\underline{\\text{#1}}"),Vr("\\not",'\\html@mathml{\\mathrel{\\mathrlap\\@not}}{\\char"338}'),Vr("\\neq","\\html@mathml{\\mathrel{\\not=}}{\\mathrel{\\char`\u2260}}"),Vr("\\ne","\\neq"),Vr("\u2260","\\neq"),Vr("\\notin","\\html@mathml{\\mathrel{{\\in}\\mathllap{/\\mskip1mu}}}{\\mathrel{\\char`\u2209}}"),Vr("\u2209","\\notin"),Vr("\u2258","\\html@mathml{\\mathrel{=\\kern{-1em}\\raisebox{0.4em}{$\\scriptsize\\frown$}}}{\\mathrel{\\char`\u2258}}"),Vr("\u2259","\\html@mathml{\\stackrel{\\tiny\\wedge}{=}}{\\mathrel{\\char`\u2258}}"),Vr("\u225a","\\html@mathml{\\stackrel{\\tiny\\vee}{=}}{\\mathrel{\\char`\u225a}}"),Vr("\u225b","\\html@mathml{\\stackrel{\\scriptsize\\star}{=}}{\\mathrel{\\char`\u225b}}"),Vr("\u225d","\\html@mathml{\\stackrel{\\tiny\\mathrm{def}}{=}}{\\mathrel{\\char`\u225d}}"),Vr("\u225e","\\html@mathml{\\stackrel{\\tiny\\mathrm{m}}{=}}{\\mathrel{\\char`\u225e}}"),Vr("\u225f","\\html@mathml{\\stackrel{\\tiny?}{=}}{\\mathrel{\\char`\u225f}}"),Vr("\u27c2","\\perp"),Vr("\u203c","\\mathclose{!\\mkern-0.8mu!}"),Vr("\u220c","\\notni"),Vr("\u231c","\\ulcorner"),Vr("\u231d","\\urcorner"),Vr("\u231e","\\llcorner"),Vr("\u231f","\\lrcorner"),Vr("\xa9","\\copyright"),Vr("\xae","\\textregistered"),Vr("\ufe0f","\\textregistered"),Vr("\\ulcorner",'\\html@mathml{\\@ulcorner}{\\mathop{\\char"231c}}'),Vr("\\urcorner",'\\html@mathml{\\@urcorner}{\\mathop{\\char"231d}}'),Vr("\\llcorner",'\\html@mathml{\\@llcorner}{\\mathop{\\char"231e}}'),Vr("\\lrcorner",'\\html@mathml{\\@lrcorner}{\\mathop{\\char"231f}}'),Vr("\\vdots","\\mathord{\\varvdots\\rule{0pt}{15pt}}"),Vr("\u22ee","\\vdots"),Vr("\\varGamma","\\mathit{\\Gamma}"),Vr("\\varDelta","\\mathit{\\Delta}"),Vr("\\varTheta","\\mathit{\\Theta}"),Vr("\\varLambda","\\mathit{\\Lambda}"),Vr("\\varXi","\\mathit{\\Xi}"),Vr("\\varPi","\\mathit{\\Pi}"),Vr("\\varSigma","\\mathit{\\Sigma}"),Vr("\\varUpsilon","\\mathit{\\Upsilon}"),Vr("\\varPhi","\\mathit{\\Phi}"),Vr("\\varPsi","\\mathit{\\Psi}"),Vr("\\varOmega","\\mathit{\\Omega}"),Vr("\\substack","\\begin{subarray}{c}#1\\end{subarray}"),Vr("\\colon","\\nobreak\\mskip2mu\\mathpunct{}\\mathchoice{\\mkern-3mu}{\\mkern-3mu}{}{}{:}\\mskip6mu\\relax"),Vr("\\boxed","\\fbox{$\\displaystyle{#1}$}"),Vr("\\iff","\\DOTSB\\;\\Longleftrightarrow\\;"),Vr("\\implies","\\DOTSB\\;\\Longrightarrow\\;"),Vr("\\impliedby","\\DOTSB\\;\\Longleftarrow\\;");var La={",":"\\dotsc","\\not":"\\dotsb","+":"\\dotsb","=":"\\dotsb","<":"\\dotsb",">":"\\dotsb","-":"\\dotsb","*":"\\dotsb",":":"\\dotsb","\\DOTSB":"\\dotsb","\\coprod":"\\dotsb","\\bigvee":"\\dotsb","\\bigwedge":"\\dotsb","\\biguplus":"\\dotsb","\\bigcap":"\\dotsb","\\bigcup":"\\dotsb","\\prod":"\\dotsb","\\sum":"\\dotsb","\\bigotimes":"\\dotsb","\\bigoplus":"\\dotsb","\\bigodot":"\\dotsb","\\bigsqcup":"\\dotsb","\\And":"\\dotsb","\\longrightarrow":"\\dotsb","\\Longrightarrow":"\\dotsb","\\longleftarrow":"\\dotsb","\\Longleftarrow":"\\dotsb","\\longleftrightarrow":"\\dotsb","\\Longleftrightarrow":"\\dotsb","\\mapsto":"\\dotsb","\\longmapsto":"\\dotsb","\\hookrightarrow":"\\dotsb","\\doteq":"\\dotsb","\\mathbin":"\\dotsb","\\mathrel":"\\dotsb","\\relbar":"\\dotsb","\\Relbar":"\\dotsb","\\xrightarrow":"\\dotsb","\\xleftarrow":"\\dotsb","\\DOTSI":"\\dotsi","\\int":"\\dotsi","\\oint":"\\dotsi","\\iint":"\\dotsi","\\iiint":"\\dotsi","\\iiiint":"\\dotsi","\\idotsint":"\\dotsi","\\DOTSX":"\\dotsx"};Vr("\\dots",(function(e){var t="\\dotso",r=e.expandAfterFuture().text;return r in La?t=La[r]:("\\not"===r.slice(0,4)||r in ne.math&&m.contains(["bin","rel"],ne.math[r].group))&&(t="\\dotsb"),t}));var Da={")":!0,"]":!0,"\\rbrack":!0,"\\}":!0,"\\rbrace":!0,"\\rangle":!0,"\\rceil":!0,"\\rfloor":!0,"\\rgroup":!0,"\\rmoustache":!0,"\\right":!0,"\\bigr":!0,"\\biggr":!0,"\\Bigr":!0,"\\Biggr":!0,$:!0,";":!0,".":!0,",":!0};Vr("\\dotso",(function(e){return e.future().text in Da?"\\ldots\\,":"\\ldots"})),Vr("\\dotsc",(function(e){var t=e.future().text;return t in Da&&","!==t?"\\ldots\\,":"\\ldots"})),Vr("\\cdots",(function(e){return e.future().text in Da?"\\@cdots\\,":"\\@cdots"})),Vr("\\dotsb","\\cdots"),Vr("\\dotsm","\\cdots"),Vr("\\dotsi","\\!\\cdots"),Vr("\\dotsx","\\ldots\\,"),Vr("\\DOTSI","\\relax"),Vr("\\DOTSB","\\relax"),Vr("\\DOTSX","\\relax"),Vr("\\tmspace","\\TextOrMath{\\kern#1#3}{\\mskip#1#2}\\relax"),Vr("\\,","\\tmspace+{3mu}{.1667em}"),Vr("\\thinspace","\\,"),Vr("\\>","\\mskip{4mu}"),Vr("\\:","\\tmspace+{4mu}{.2222em}"),Vr("\\medspace","\\:"),Vr("\\;","\\tmspace+{5mu}{.2777em}"),Vr("\\thickspace","\\;"),Vr("\\!","\\tmspace-{3mu}{.1667em}"),Vr("\\negthinspace","\\!"),Vr("\\negmedspace","\\tmspace-{4mu}{.2222em}"),Vr("\\negthickspace","\\tmspace-{5mu}{.277em}"),Vr("\\enspace","\\kern.5em "),Vr("\\enskip","\\hskip.5em\\relax"),Vr("\\quad","\\hskip1em\\relax"),Vr("\\qquad","\\hskip2em\\relax"),Vr("\\tag","\\@ifstar\\tag@literal\\tag@paren"),Vr("\\tag@paren","\\tag@literal{({#1})}"),Vr("\\tag@literal",(e=>{if(e.macros.get("\\df@tag"))throw new i("Multiple \\tag");return"\\gdef\\df@tag{\\text{#1}}"})),Vr("\\bmod","\\mathchoice{\\mskip1mu}{\\mskip1mu}{\\mskip5mu}{\\mskip5mu}\\mathbin{\\rm mod}\\mathchoice{\\mskip1mu}{\\mskip1mu}{\\mskip5mu}{\\mskip5mu}"),Vr("\\pod","\\allowbreak\\mathchoice{\\mkern18mu}{\\mkern8mu}{\\mkern8mu}{\\mkern8mu}(#1)"),Vr("\\pmod","\\pod{{\\rm mod}\\mkern6mu#1}"),Vr("\\mod","\\allowbreak\\mathchoice{\\mkern18mu}{\\mkern12mu}{\\mkern12mu}{\\mkern12mu}{\\rm mod}\\,\\,#1"),Vr("\\newline","\\\\\\relax"),Vr("\\TeX","\\textrm{\\html@mathml{T\\kern-.1667em\\raisebox{-.5ex}{E}\\kern-.125emX}{TeX}}");var Va=G(C["Main-Regular"]["T".charCodeAt(0)][1]-.7*C["Main-Regular"]["A".charCodeAt(0)][1]);Vr("\\LaTeX","\\textrm{\\html@mathml{L\\kern-.36em\\raisebox{"+Va+"}{\\scriptstyle A}\\kern-.15em\\TeX}{LaTeX}}"),Vr("\\KaTeX","\\textrm{\\html@mathml{K\\kern-.17em\\raisebox{"+Va+"}{\\scriptstyle A}\\kern-.15em\\TeX}{KaTeX}}"),Vr("\\hspace","\\@ifstar\\@hspacer\\@hspace"),Vr("\\@hspace","\\hskip #1\\relax"),Vr("\\@hspacer","\\rule{0pt}{0pt}\\hskip #1\\relax"),Vr("\\ordinarycolon",":"),Vr("\\vcentcolon","\\mathrel{\\mathop\\ordinarycolon}"),Vr("\\dblcolon",'\\html@mathml{\\mathrel{\\vcentcolon\\mathrel{\\mkern-.9mu}\\vcentcolon}}{\\mathop{\\char"2237}}'),Vr("\\coloneqq",'\\html@mathml{\\mathrel{\\vcentcolon\\mathrel{\\mkern-1.2mu}=}}{\\mathop{\\char"2254}}'),Vr("\\Coloneqq",'\\html@mathml{\\mathrel{\\dblcolon\\mathrel{\\mkern-1.2mu}=}}{\\mathop{\\char"2237\\char"3d}}'),Vr("\\coloneq",'\\html@mathml{\\mathrel{\\vcentcolon\\mathrel{\\mkern-1.2mu}\\mathrel{-}}}{\\mathop{\\char"3a\\char"2212}}'),Vr("\\Coloneq",'\\html@mathml{\\mathrel{\\dblcolon\\mathrel{\\mkern-1.2mu}\\mathrel{-}}}{\\mathop{\\char"2237\\char"2212}}'),Vr("\\eqqcolon",'\\html@mathml{\\mathrel{=\\mathrel{\\mkern-1.2mu}\\vcentcolon}}{\\mathop{\\char"2255}}'),Vr("\\Eqqcolon",'\\html@mathml{\\mathrel{=\\mathrel{\\mkern-1.2mu}\\dblcolon}}{\\mathop{\\char"3d\\char"2237}}'),Vr("\\eqcolon",'\\html@mathml{\\mathrel{\\mathrel{-}\\mathrel{\\mkern-1.2mu}\\vcentcolon}}{\\mathop{\\char"2239}}'),Vr("\\Eqcolon",'\\html@mathml{\\mathrel{\\mathrel{-}\\mathrel{\\mkern-1.2mu}\\dblcolon}}{\\mathop{\\char"2212\\char"2237}}'),Vr("\\colonapprox",'\\html@mathml{\\mathrel{\\vcentcolon\\mathrel{\\mkern-1.2mu}\\approx}}{\\mathop{\\char"3a\\char"2248}}'),Vr("\\Colonapprox",'\\html@mathml{\\mathrel{\\dblcolon\\mathrel{\\mkern-1.2mu}\\approx}}{\\mathop{\\char"2237\\char"2248}}'),Vr("\\colonsim",'\\html@mathml{\\mathrel{\\vcentcolon\\mathrel{\\mkern-1.2mu}\\sim}}{\\mathop{\\char"3a\\char"223c}}'),Vr("\\Colonsim",'\\html@mathml{\\mathrel{\\dblcolon\\mathrel{\\mkern-1.2mu}\\sim}}{\\mathop{\\char"2237\\char"223c}}'),Vr("\u2237","\\dblcolon"),Vr("\u2239","\\eqcolon"),Vr("\u2254","\\coloneqq"),Vr("\u2255","\\eqqcolon"),Vr("\u2a74","\\Coloneqq"),Vr("\\ratio","\\vcentcolon"),Vr("\\coloncolon","\\dblcolon"),Vr("\\colonequals","\\coloneqq"),Vr("\\coloncolonequals","\\Coloneqq"),Vr("\\equalscolon","\\eqqcolon"),Vr("\\equalscoloncolon","\\Eqqcolon"),Vr("\\colonminus","\\coloneq"),Vr("\\coloncolonminus","\\Coloneq"),Vr("\\minuscolon","\\eqcolon"),Vr("\\minuscoloncolon","\\Eqcolon"),Vr("\\coloncolonapprox","\\Colonapprox"),Vr("\\coloncolonsim","\\Colonsim"),Vr("\\simcolon","\\mathrel{\\sim\\mathrel{\\mkern-1.2mu}\\vcentcolon}"),Vr("\\simcoloncolon","\\mathrel{\\sim\\mathrel{\\mkern-1.2mu}\\dblcolon}"),Vr("\\approxcolon","\\mathrel{\\approx\\mathrel{\\mkern-1.2mu}\\vcentcolon}"),Vr("\\approxcoloncolon","\\mathrel{\\approx\\mathrel{\\mkern-1.2mu}\\dblcolon}"),Vr("\\notni","\\html@mathml{\\not\\ni}{\\mathrel{\\char`\u220c}}"),Vr("\\limsup","\\DOTSB\\operatorname*{lim\\,sup}"),Vr("\\liminf","\\DOTSB\\operatorname*{lim\\,inf}"),Vr("\\injlim","\\DOTSB\\operatorname*{inj\\,lim}"),Vr("\\projlim","\\DOTSB\\operatorname*{proj\\,lim}"),Vr("\\varlimsup","\\DOTSB\\operatorname*{\\overline{lim}}"),Vr("\\varliminf","\\DOTSB\\operatorname*{\\underline{lim}}"),Vr("\\varinjlim","\\DOTSB\\operatorname*{\\underrightarrow{lim}}"),Vr("\\varprojlim","\\DOTSB\\operatorname*{\\underleftarrow{lim}}"),Vr("\\gvertneqq","\\html@mathml{\\@gvertneqq}{\u2269}"),Vr("\\lvertneqq","\\html@mathml{\\@lvertneqq}{\u2268}"),Vr("\\ngeqq","\\html@mathml{\\@ngeqq}{\u2271}"),Vr("\\ngeqslant","\\html@mathml{\\@ngeqslant}{\u2271}"),Vr("\\nleqq","\\html@mathml{\\@nleqq}{\u2270}"),Vr("\\nleqslant","\\html@mathml{\\@nleqslant}{\u2270}"),Vr("\\nshortmid","\\html@mathml{\\@nshortmid}{\u2224}"),Vr("\\nshortparallel","\\html@mathml{\\@nshortparallel}{\u2226}"),Vr("\\nsubseteqq","\\html@mathml{\\@nsubseteqq}{\u2288}"),Vr("\\nsupseteqq","\\html@mathml{\\@nsupseteqq}{\u2289}"),Vr("\\varsubsetneq","\\html@mathml{\\@varsubsetneq}{\u228a}"),Vr("\\varsubsetneqq","\\html@mathml{\\@varsubsetneqq}{\u2acb}"),Vr("\\varsupsetneq","\\html@mathml{\\@varsupsetneq}{\u228b}"),Vr("\\varsupsetneqq","\\html@mathml{\\@varsupsetneqq}{\u2acc}"),Vr("\\imath","\\html@mathml{\\@imath}{\u0131}"),Vr("\\jmath","\\html@mathml{\\@jmath}{\u0237}"),Vr("\\llbracket","\\html@mathml{\\mathopen{[\\mkern-3.2mu[}}{\\mathopen{\\char`\u27e6}}"),Vr("\\rrbracket","\\html@mathml{\\mathclose{]\\mkern-3.2mu]}}{\\mathclose{\\char`\u27e7}}"),Vr("\u27e6","\\llbracket"),Vr("\u27e7","\\rrbracket"),Vr("\\lBrace","\\html@mathml{\\mathopen{\\{\\mkern-3.2mu[}}{\\mathopen{\\char`\u2983}}"),Vr("\\rBrace","\\html@mathml{\\mathclose{]\\mkern-3.2mu\\}}}{\\mathclose{\\char`\u2984}}"),Vr("\u2983","\\lBrace"),Vr("\u2984","\\rBrace"),Vr("\\minuso","\\mathbin{\\html@mathml{{\\mathrlap{\\mathchoice{\\kern{0.145em}}{\\kern{0.145em}}{\\kern{0.1015em}}{\\kern{0.0725em}}\\circ}{-}}}{\\char`\u29b5}}"),Vr("\u29b5","\\minuso"),Vr("\\darr","\\downarrow"),Vr("\\dArr","\\Downarrow"),Vr("\\Darr","\\Downarrow"),Vr("\\lang","\\langle"),Vr("\\rang","\\rangle"),Vr("\\uarr","\\uparrow"),Vr("\\uArr","\\Uparrow"),Vr("\\Uarr","\\Uparrow"),Vr("\\N","\\mathbb{N}"),Vr("\\R","\\mathbb{R}"),Vr("\\Z","\\mathbb{Z}"),Vr("\\alef","\\aleph"),Vr("\\alefsym","\\aleph"),Vr("\\Alpha","\\mathrm{A}"),Vr("\\Beta","\\mathrm{B}"),Vr("\\bull","\\bullet"),Vr("\\Chi","\\mathrm{X}"),Vr("\\clubs","\\clubsuit"),Vr("\\cnums","\\mathbb{C}"),Vr("\\Complex","\\mathbb{C}"),Vr("\\Dagger","\\ddagger"),Vr("\\diamonds","\\diamondsuit"),Vr("\\empty","\\emptyset"),Vr("\\Epsilon","\\mathrm{E}"),Vr("\\Eta","\\mathrm{H}"),Vr("\\exist","\\exists"),Vr("\\harr","\\leftrightarrow"),Vr("\\hArr","\\Leftrightarrow"),Vr("\\Harr","\\Leftrightarrow"),Vr("\\hearts","\\heartsuit"),Vr("\\image","\\Im"),Vr("\\infin","\\infty"),Vr("\\Iota","\\mathrm{I}"),Vr("\\isin","\\in"),Vr("\\Kappa","\\mathrm{K}"),Vr("\\larr","\\leftarrow"),Vr("\\lArr","\\Leftarrow"),Vr("\\Larr","\\Leftarrow"),Vr("\\lrarr","\\leftrightarrow"),Vr("\\lrArr","\\Leftrightarrow"),Vr("\\Lrarr","\\Leftrightarrow"),Vr("\\Mu","\\mathrm{M}"),Vr("\\natnums","\\mathbb{N}"),Vr("\\Nu","\\mathrm{N}"),Vr("\\Omicron","\\mathrm{O}"),Vr("\\plusmn","\\pm"),Vr("\\rarr","\\rightarrow"),Vr("\\rArr","\\Rightarrow"),Vr("\\Rarr","\\Rightarrow"),Vr("\\real","\\Re"),Vr("\\reals","\\mathbb{R}"),Vr("\\Reals","\\mathbb{R}"),Vr("\\Rho","\\mathrm{P}"),Vr("\\sdot","\\cdot"),Vr("\\sect","\\S"),Vr("\\spades","\\spadesuit"),Vr("\\sub","\\subset"),Vr("\\sube","\\subseteq"),Vr("\\supe","\\supseteq"),Vr("\\Tau","\\mathrm{T}"),Vr("\\thetasym","\\vartheta"),Vr("\\weierp","\\wp"),Vr("\\Zeta","\\mathrm{Z}"),Vr("\\argmin","\\DOTSB\\operatorname*{arg\\,min}"),Vr("\\argmax","\\DOTSB\\operatorname*{arg\\,max}"),Vr("\\plim","\\DOTSB\\mathop{\\operatorname{plim}}\\limits"),Vr("\\bra","\\mathinner{\\langle{#1}|}"),Vr("\\ket","\\mathinner{|{#1}\\rangle}"),Vr("\\braket","\\mathinner{\\langle{#1}\\rangle}"),Vr("\\Bra","\\left\\langle#1\\right|"),Vr("\\Ket","\\left|#1\\right\\rangle");var Pa=e=>t=>{var r=t.consumeArg().tokens,a=t.consumeArg().tokens,n=t.consumeArg().tokens,i=t.consumeArg().tokens,o=t.macros.get("|"),s=t.macros.get("\\|");t.macros.beginGroup();var l=t=>r=>{e&&(r.macros.set("|",o),n.length&&r.macros.set("\\|",s));var i=t;!t&&n.length&&("|"===r.future().text&&(r.popToken(),i=!0));return{tokens:i?n:a,numArgs:0}};t.macros.set("|",l(!1)),n.length&&t.macros.set("\\|",l(!0));var h=t.consumeArg().tokens,m=t.expandTokens([...i,...h,...r]);return t.macros.endGroup(),{tokens:m.reverse(),numArgs:0}};Vr("\\bra@ket",Pa(!1)),Vr("\\bra@set",Pa(!0)),Vr("\\Braket","\\bra@ket{\\left\\langle}{\\,\\middle\\vert\\,}{\\,\\middle\\vert\\,}{\\right\\rangle}"),Vr("\\Set","\\bra@set{\\left\\{\\:}{\\;\\middle\\vert\\;}{\\;\\middle\\Vert\\;}{\\:\\right\\}}"),Vr("\\set","\\bra@set{\\{\\,}{\\mid}{}{\\,\\}}"),Vr("\\angln","{\\angl n}"),Vr("\\blue","\\textcolor{##6495ed}{#1}"),Vr("\\orange","\\textcolor{##ffa500}{#1}"),Vr("\\pink","\\textcolor{##ff00af}{#1}"),Vr("\\red","\\textcolor{##df0030}{#1}"),Vr("\\green","\\textcolor{##28ae7b}{#1}"),Vr("\\gray","\\textcolor{gray}{#1}"),Vr("\\purple","\\textcolor{##9d38bd}{#1}"),Vr("\\blueA","\\textcolor{##ccfaff}{#1}"),Vr("\\blueB","\\textcolor{##80f6ff}{#1}"),Vr("\\blueC","\\textcolor{##63d9ea}{#1}"),Vr("\\blueD","\\textcolor{##11accd}{#1}"),Vr("\\blueE","\\textcolor{##0c7f99}{#1}"),Vr("\\tealA","\\textcolor{##94fff5}{#1}"),Vr("\\tealB","\\textcolor{##26edd5}{#1}"),Vr("\\tealC","\\textcolor{##01d1c1}{#1}"),Vr("\\tealD","\\textcolor{##01a995}{#1}"),Vr("\\tealE","\\textcolor{##208170}{#1}"),Vr("\\greenA","\\textcolor{##b6ffb0}{#1}"),Vr("\\greenB","\\textcolor{##8af281}{#1}"),Vr("\\greenC","\\textcolor{##74cf70}{#1}"),Vr("\\greenD","\\textcolor{##1fab54}{#1}"),Vr("\\greenE","\\textcolor{##0d923f}{#1}"),Vr("\\goldA","\\textcolor{##ffd0a9}{#1}"),Vr("\\goldB","\\textcolor{##ffbb71}{#1}"),Vr("\\goldC","\\textcolor{##ff9c39}{#1}"),Vr("\\goldD","\\textcolor{##e07d10}{#1}"),Vr("\\goldE","\\textcolor{##a75a05}{#1}"),Vr("\\redA","\\textcolor{##fca9a9}{#1}"),Vr("\\redB","\\textcolor{##ff8482}{#1}"),Vr("\\redC","\\textcolor{##f9685d}{#1}"),Vr("\\redD","\\textcolor{##e84d39}{#1}"),Vr("\\redE","\\textcolor{##bc2612}{#1}"),Vr("\\maroonA","\\textcolor{##ffbde0}{#1}"),Vr("\\maroonB","\\textcolor{##ff92c6}{#1}"),Vr("\\maroonC","\\textcolor{##ed5fa6}{#1}"),Vr("\\maroonD","\\textcolor{##ca337c}{#1}"),Vr("\\maroonE","\\textcolor{##9e034e}{#1}"),Vr("\\purpleA","\\textcolor{##ddd7ff}{#1}"),Vr("\\purpleB","\\textcolor{##c6b9fc}{#1}"),Vr("\\purpleC","\\textcolor{##aa87ff}{#1}"),Vr("\\purpleD","\\textcolor{##7854ab}{#1}"),Vr("\\purpleE","\\textcolor{##543b78}{#1}"),Vr("\\mintA","\\textcolor{##f5f9e8}{#1}"),Vr("\\mintB","\\textcolor{##edf2df}{#1}"),Vr("\\mintC","\\textcolor{##e0e5cc}{#1}"),Vr("\\grayA","\\textcolor{##f6f7f7}{#1}"),Vr("\\grayB","\\textcolor{##f0f1f2}{#1}"),Vr("\\grayC","\\textcolor{##e3e5e6}{#1}"),Vr("\\grayD","\\textcolor{##d6d8da}{#1}"),Vr("\\grayE","\\textcolor{##babec2}{#1}"),Vr("\\grayF","\\textcolor{##888d93}{#1}"),Vr("\\grayG","\\textcolor{##626569}{#1}"),Vr("\\grayH","\\textcolor{##3b3e40}{#1}"),Vr("\\grayI","\\textcolor{##21242c}{#1}"),Vr("\\kaBlue","\\textcolor{##314453}{#1}"),Vr("\\kaGreen","\\textcolor{##71B307}{#1}");var Fa={"^":!0,_:!0,"\\limits":!0,"\\nolimits":!0};class Ga{constructor(e,t,r){this.settings=void 0,this.expansionCount=void 0,this.lexer=void 0,this.macros=void 0,this.stack=void 0,this.mode=void 0,this.settings=t,this.expansionCount=0,this.feed(e),this.macros=new Ra(Ha,t.macros),this.mode=r,this.stack=[]}feed(e){this.lexer=new Ia(e,this.settings)}switchMode(e){this.mode=e}beginGroup(){this.macros.beginGroup()}endGroup(){this.macros.endGroup()}endGroups(){this.macros.endGroups()}future(){return 0===this.stack.length&&this.pushToken(this.lexer.lex()),this.stack[this.stack.length-1]}popToken(){return this.future(),this.stack.pop()}pushToken(e){this.stack.push(e)}pushTokens(e){this.stack.push(...e)}scanArgument(e){var t,r,a;if(e){if(this.consumeSpaces(),"["!==this.future().text)return null;t=this.popToken(),({tokens:a,end:r}=this.consumeArg(["]"]))}else({tokens:a,start:t,end:r}=this.consumeArg());return this.pushToken(new n("EOF",r.loc)),this.pushTokens(a),t.range(r,"")}consumeSpaces(){for(;;){if(" "!==this.future().text)break;this.stack.pop()}}consumeArg(e){var t=[],r=e&&e.length>0;r||this.consumeSpaces();var a,n=this.future(),o=0,s=0;do{if(a=this.popToken(),t.push(a),"{"===a.text)++o;else if("}"===a.text){if(-1===--o)throw new i("Extra }",a)}else if("EOF"===a.text)throw new i("Unexpected end of input in a macro argument, expected '"+(e&&r?e[s]:"}")+"'",a);if(e&&r)if((0===o||1===o&&"{"===e[s])&&a.text===e[s]){if(++s===e.length){t.splice(-s,s);break}}else s=0}while(0!==o||r);return"{"===n.text&&"}"===t[t.length-1].text&&(t.pop(),t.shift()),t.reverse(),{tokens:t,start:n,end:a}}consumeArgs(e,t){if(t){if(t.length!==e+1)throw new i("The length of delimiters doesn't match the number of args!");for(var r=t[0],a=0;athis.settings.maxExpand)throw new i("Too many expansions: infinite loop or need to increase maxExpand setting")}expandOnce(e){var t=this.popToken(),r=t.text,a=t.noexpand?null:this._getExpansion(r);if(null==a||e&&a.unexpandable){if(e&&null==a&&"\\"===r[0]&&!this.isDefined(r))throw new i("Undefined control sequence: "+r);return this.pushToken(t),!1}this.countExpansion(1);var n=a.tokens,o=this.consumeArgs(a.numArgs,a.delimiters);if(a.numArgs)for(var s=(n=n.slice()).length-1;s>=0;--s){var l=n[s];if("#"===l.text){if(0===s)throw new i("Incomplete placeholder at end of macro body",l);if("#"===(l=n[--s]).text)n.splice(s+1,1);else{if(!/^[1-9]$/.test(l.text))throw new i("Not a valid argument number",l);n.splice(s,2,...o[+l.text-1])}}}return this.pushTokens(n),n.length}expandAfterFuture(){return this.expandOnce(),this.future()}expandNextToken(){for(;;)if(!1===this.expandOnce()){var e=this.stack.pop();return e.treatAsRelax&&(e.text="\\relax"),e}throw new Error}expandMacro(e){return this.macros.has(e)?this.expandTokens([new n(e)]):void 0}expandTokens(e){var t=[],r=this.stack.length;for(this.pushTokens(e);this.stack.length>r;)if(!1===this.expandOnce(!0)){var a=this.stack.pop();a.treatAsRelax&&(a.noexpand=!1,a.treatAsRelax=!1),t.push(a)}return this.countExpansion(t.length),t}expandMacroAsText(e){var t=this.expandMacro(e);return t?t.map((e=>e.text)).join(""):t}_getExpansion(e){var t=this.macros.get(e);if(null==t)return t;if(1===e.length){var r=this.lexer.catcodes[e];if(null!=r&&13!==r)return}var a="function"==typeof t?t(this):t;if("string"==typeof a){var n=0;if(-1!==a.indexOf("#"))for(var i=a.replace(/##/g,"");-1!==i.indexOf("#"+(n+1));)++n;for(var o=new Ia(a,this.settings),s=[],l=o.lex();"EOF"!==l.text;)s.push(l),l=o.lex();return s.reverse(),{tokens:s,numArgs:n}}return a}isDefined(e){return this.macros.has(e)||Aa.hasOwnProperty(e)||ne.math.hasOwnProperty(e)||ne.text.hasOwnProperty(e)||Fa.hasOwnProperty(e)}isExpandable(e){var t=this.macros.get(e);return null!=t?"string"==typeof t||"function"==typeof t||!t.unexpandable:Aa.hasOwnProperty(e)&&!Aa[e].primitive}}var Ua=/^[\u208a\u208b\u208c\u208d\u208e\u2080\u2081\u2082\u2083\u2084\u2085\u2086\u2087\u2088\u2089\u2090\u2091\u2095\u1d62\u2c7c\u2096\u2097\u2098\u2099\u2092\u209a\u1d63\u209b\u209c\u1d64\u1d65\u2093\u1d66\u1d67\u1d68\u1d69\u1d6a]/,Ya=Object.freeze({"\u208a":"+","\u208b":"-","\u208c":"=","\u208d":"(","\u208e":")","\u2080":"0","\u2081":"1","\u2082":"2","\u2083":"3","\u2084":"4","\u2085":"5","\u2086":"6","\u2087":"7","\u2088":"8","\u2089":"9","\u2090":"a","\u2091":"e","\u2095":"h","\u1d62":"i","\u2c7c":"j","\u2096":"k","\u2097":"l","\u2098":"m","\u2099":"n","\u2092":"o","\u209a":"p","\u1d63":"r","\u209b":"s","\u209c":"t","\u1d64":"u","\u1d65":"v","\u2093":"x","\u1d66":"\u03b2","\u1d67":"\u03b3","\u1d68":"\u03c1","\u1d69":"\u03d5","\u1d6a":"\u03c7","\u207a":"+","\u207b":"-","\u207c":"=","\u207d":"(","\u207e":")","\u2070":"0","\xb9":"1","\xb2":"2","\xb3":"3","\u2074":"4","\u2075":"5","\u2076":"6","\u2077":"7","\u2078":"8","\u2079":"9","\u1d2c":"A","\u1d2e":"B","\u1d30":"D","\u1d31":"E","\u1d33":"G","\u1d34":"H","\u1d35":"I","\u1d36":"J","\u1d37":"K","\u1d38":"L","\u1d39":"M","\u1d3a":"N","\u1d3c":"O","\u1d3e":"P","\u1d3f":"R","\u1d40":"T","\u1d41":"U","\u2c7d":"V","\u1d42":"W","\u1d43":"a","\u1d47":"b","\u1d9c":"c","\u1d48":"d","\u1d49":"e","\u1da0":"f","\u1d4d":"g","\u02b0":"h","\u2071":"i","\u02b2":"j","\u1d4f":"k","\u02e1":"l","\u1d50":"m","\u207f":"n","\u1d52":"o","\u1d56":"p","\u02b3":"r","\u02e2":"s","\u1d57":"t","\u1d58":"u","\u1d5b":"v","\u02b7":"w","\u02e3":"x","\u02b8":"y","\u1dbb":"z","\u1d5d":"\u03b2","\u1d5e":"\u03b3","\u1d5f":"\u03b4","\u1d60":"\u03d5","\u1d61":"\u03c7","\u1dbf":"\u03b8"}),Xa={"\u0301":{text:"\\'",math:"\\acute"},"\u0300":{text:"\\`",math:"\\grave"},"\u0308":{text:'\\"',math:"\\ddot"},"\u0303":{text:"\\~",math:"\\tilde"},"\u0304":{text:"\\=",math:"\\bar"},"\u0306":{text:"\\u",math:"\\breve"},"\u030c":{text:"\\v",math:"\\check"},"\u0302":{text:"\\^",math:"\\hat"},"\u0307":{text:"\\.",math:"\\dot"},"\u030a":{text:"\\r",math:"\\mathring"},"\u030b":{text:"\\H"},"\u0327":{text:"\\c"}},Wa={"\xe1":"a\u0301","\xe0":"a\u0300","\xe4":"a\u0308","\u01df":"a\u0308\u0304","\xe3":"a\u0303","\u0101":"a\u0304","\u0103":"a\u0306","\u1eaf":"a\u0306\u0301","\u1eb1":"a\u0306\u0300","\u1eb5":"a\u0306\u0303","\u01ce":"a\u030c","\xe2":"a\u0302","\u1ea5":"a\u0302\u0301","\u1ea7":"a\u0302\u0300","\u1eab":"a\u0302\u0303","\u0227":"a\u0307","\u01e1":"a\u0307\u0304","\xe5":"a\u030a","\u01fb":"a\u030a\u0301","\u1e03":"b\u0307","\u0107":"c\u0301","\u1e09":"c\u0327\u0301","\u010d":"c\u030c","\u0109":"c\u0302","\u010b":"c\u0307","\xe7":"c\u0327","\u010f":"d\u030c","\u1e0b":"d\u0307","\u1e11":"d\u0327","\xe9":"e\u0301","\xe8":"e\u0300","\xeb":"e\u0308","\u1ebd":"e\u0303","\u0113":"e\u0304","\u1e17":"e\u0304\u0301","\u1e15":"e\u0304\u0300","\u0115":"e\u0306","\u1e1d":"e\u0327\u0306","\u011b":"e\u030c","\xea":"e\u0302","\u1ebf":"e\u0302\u0301","\u1ec1":"e\u0302\u0300","\u1ec5":"e\u0302\u0303","\u0117":"e\u0307","\u0229":"e\u0327","\u1e1f":"f\u0307","\u01f5":"g\u0301","\u1e21":"g\u0304","\u011f":"g\u0306","\u01e7":"g\u030c","\u011d":"g\u0302","\u0121":"g\u0307","\u0123":"g\u0327","\u1e27":"h\u0308","\u021f":"h\u030c","\u0125":"h\u0302","\u1e23":"h\u0307","\u1e29":"h\u0327","\xed":"i\u0301","\xec":"i\u0300","\xef":"i\u0308","\u1e2f":"i\u0308\u0301","\u0129":"i\u0303","\u012b":"i\u0304","\u012d":"i\u0306","\u01d0":"i\u030c","\xee":"i\u0302","\u01f0":"j\u030c","\u0135":"j\u0302","\u1e31":"k\u0301","\u01e9":"k\u030c","\u0137":"k\u0327","\u013a":"l\u0301","\u013e":"l\u030c","\u013c":"l\u0327","\u1e3f":"m\u0301","\u1e41":"m\u0307","\u0144":"n\u0301","\u01f9":"n\u0300","\xf1":"n\u0303","\u0148":"n\u030c","\u1e45":"n\u0307","\u0146":"n\u0327","\xf3":"o\u0301","\xf2":"o\u0300","\xf6":"o\u0308","\u022b":"o\u0308\u0304","\xf5":"o\u0303","\u1e4d":"o\u0303\u0301","\u1e4f":"o\u0303\u0308","\u022d":"o\u0303\u0304","\u014d":"o\u0304","\u1e53":"o\u0304\u0301","\u1e51":"o\u0304\u0300","\u014f":"o\u0306","\u01d2":"o\u030c","\xf4":"o\u0302","\u1ed1":"o\u0302\u0301","\u1ed3":"o\u0302\u0300","\u1ed7":"o\u0302\u0303","\u022f":"o\u0307","\u0231":"o\u0307\u0304","\u0151":"o\u030b","\u1e55":"p\u0301","\u1e57":"p\u0307","\u0155":"r\u0301","\u0159":"r\u030c","\u1e59":"r\u0307","\u0157":"r\u0327","\u015b":"s\u0301","\u1e65":"s\u0301\u0307","\u0161":"s\u030c","\u1e67":"s\u030c\u0307","\u015d":"s\u0302","\u1e61":"s\u0307","\u015f":"s\u0327","\u1e97":"t\u0308","\u0165":"t\u030c","\u1e6b":"t\u0307","\u0163":"t\u0327","\xfa":"u\u0301","\xf9":"u\u0300","\xfc":"u\u0308","\u01d8":"u\u0308\u0301","\u01dc":"u\u0308\u0300","\u01d6":"u\u0308\u0304","\u01da":"u\u0308\u030c","\u0169":"u\u0303","\u1e79":"u\u0303\u0301","\u016b":"u\u0304","\u1e7b":"u\u0304\u0308","\u016d":"u\u0306","\u01d4":"u\u030c","\xfb":"u\u0302","\u016f":"u\u030a","\u0171":"u\u030b","\u1e7d":"v\u0303","\u1e83":"w\u0301","\u1e81":"w\u0300","\u1e85":"w\u0308","\u0175":"w\u0302","\u1e87":"w\u0307","\u1e98":"w\u030a","\u1e8d":"x\u0308","\u1e8b":"x\u0307","\xfd":"y\u0301","\u1ef3":"y\u0300","\xff":"y\u0308","\u1ef9":"y\u0303","\u0233":"y\u0304","\u0177":"y\u0302","\u1e8f":"y\u0307","\u1e99":"y\u030a","\u017a":"z\u0301","\u017e":"z\u030c","\u1e91":"z\u0302","\u017c":"z\u0307","\xc1":"A\u0301","\xc0":"A\u0300","\xc4":"A\u0308","\u01de":"A\u0308\u0304","\xc3":"A\u0303","\u0100":"A\u0304","\u0102":"A\u0306","\u1eae":"A\u0306\u0301","\u1eb0":"A\u0306\u0300","\u1eb4":"A\u0306\u0303","\u01cd":"A\u030c","\xc2":"A\u0302","\u1ea4":"A\u0302\u0301","\u1ea6":"A\u0302\u0300","\u1eaa":"A\u0302\u0303","\u0226":"A\u0307","\u01e0":"A\u0307\u0304","\xc5":"A\u030a","\u01fa":"A\u030a\u0301","\u1e02":"B\u0307","\u0106":"C\u0301","\u1e08":"C\u0327\u0301","\u010c":"C\u030c","\u0108":"C\u0302","\u010a":"C\u0307","\xc7":"C\u0327","\u010e":"D\u030c","\u1e0a":"D\u0307","\u1e10":"D\u0327","\xc9":"E\u0301","\xc8":"E\u0300","\xcb":"E\u0308","\u1ebc":"E\u0303","\u0112":"E\u0304","\u1e16":"E\u0304\u0301","\u1e14":"E\u0304\u0300","\u0114":"E\u0306","\u1e1c":"E\u0327\u0306","\u011a":"E\u030c","\xca":"E\u0302","\u1ebe":"E\u0302\u0301","\u1ec0":"E\u0302\u0300","\u1ec4":"E\u0302\u0303","\u0116":"E\u0307","\u0228":"E\u0327","\u1e1e":"F\u0307","\u01f4":"G\u0301","\u1e20":"G\u0304","\u011e":"G\u0306","\u01e6":"G\u030c","\u011c":"G\u0302","\u0120":"G\u0307","\u0122":"G\u0327","\u1e26":"H\u0308","\u021e":"H\u030c","\u0124":"H\u0302","\u1e22":"H\u0307","\u1e28":"H\u0327","\xcd":"I\u0301","\xcc":"I\u0300","\xcf":"I\u0308","\u1e2e":"I\u0308\u0301","\u0128":"I\u0303","\u012a":"I\u0304","\u012c":"I\u0306","\u01cf":"I\u030c","\xce":"I\u0302","\u0130":"I\u0307","\u0134":"J\u0302","\u1e30":"K\u0301","\u01e8":"K\u030c","\u0136":"K\u0327","\u0139":"L\u0301","\u013d":"L\u030c","\u013b":"L\u0327","\u1e3e":"M\u0301","\u1e40":"M\u0307","\u0143":"N\u0301","\u01f8":"N\u0300","\xd1":"N\u0303","\u0147":"N\u030c","\u1e44":"N\u0307","\u0145":"N\u0327","\xd3":"O\u0301","\xd2":"O\u0300","\xd6":"O\u0308","\u022a":"O\u0308\u0304","\xd5":"O\u0303","\u1e4c":"O\u0303\u0301","\u1e4e":"O\u0303\u0308","\u022c":"O\u0303\u0304","\u014c":"O\u0304","\u1e52":"O\u0304\u0301","\u1e50":"O\u0304\u0300","\u014e":"O\u0306","\u01d1":"O\u030c","\xd4":"O\u0302","\u1ed0":"O\u0302\u0301","\u1ed2":"O\u0302\u0300","\u1ed6":"O\u0302\u0303","\u022e":"O\u0307","\u0230":"O\u0307\u0304","\u0150":"O\u030b","\u1e54":"P\u0301","\u1e56":"P\u0307","\u0154":"R\u0301","\u0158":"R\u030c","\u1e58":"R\u0307","\u0156":"R\u0327","\u015a":"S\u0301","\u1e64":"S\u0301\u0307","\u0160":"S\u030c","\u1e66":"S\u030c\u0307","\u015c":"S\u0302","\u1e60":"S\u0307","\u015e":"S\u0327","\u0164":"T\u030c","\u1e6a":"T\u0307","\u0162":"T\u0327","\xda":"U\u0301","\xd9":"U\u0300","\xdc":"U\u0308","\u01d7":"U\u0308\u0301","\u01db":"U\u0308\u0300","\u01d5":"U\u0308\u0304","\u01d9":"U\u0308\u030c","\u0168":"U\u0303","\u1e78":"U\u0303\u0301","\u016a":"U\u0304","\u1e7a":"U\u0304\u0308","\u016c":"U\u0306","\u01d3":"U\u030c","\xdb":"U\u0302","\u016e":"U\u030a","\u0170":"U\u030b","\u1e7c":"V\u0303","\u1e82":"W\u0301","\u1e80":"W\u0300","\u1e84":"W\u0308","\u0174":"W\u0302","\u1e86":"W\u0307","\u1e8c":"X\u0308","\u1e8a":"X\u0307","\xdd":"Y\u0301","\u1ef2":"Y\u0300","\u0178":"Y\u0308","\u1ef8":"Y\u0303","\u0232":"Y\u0304","\u0176":"Y\u0302","\u1e8e":"Y\u0307","\u0179":"Z\u0301","\u017d":"Z\u030c","\u1e90":"Z\u0302","\u017b":"Z\u0307","\u03ac":"\u03b1\u0301","\u1f70":"\u03b1\u0300","\u1fb1":"\u03b1\u0304","\u1fb0":"\u03b1\u0306","\u03ad":"\u03b5\u0301","\u1f72":"\u03b5\u0300","\u03ae":"\u03b7\u0301","\u1f74":"\u03b7\u0300","\u03af":"\u03b9\u0301","\u1f76":"\u03b9\u0300","\u03ca":"\u03b9\u0308","\u0390":"\u03b9\u0308\u0301","\u1fd2":"\u03b9\u0308\u0300","\u1fd1":"\u03b9\u0304","\u1fd0":"\u03b9\u0306","\u03cc":"\u03bf\u0301","\u1f78":"\u03bf\u0300","\u03cd":"\u03c5\u0301","\u1f7a":"\u03c5\u0300","\u03cb":"\u03c5\u0308","\u03b0":"\u03c5\u0308\u0301","\u1fe2":"\u03c5\u0308\u0300","\u1fe1":"\u03c5\u0304","\u1fe0":"\u03c5\u0306","\u03ce":"\u03c9\u0301","\u1f7c":"\u03c9\u0300","\u038e":"\u03a5\u0301","\u1fea":"\u03a5\u0300","\u03ab":"\u03a5\u0308","\u1fe9":"\u03a5\u0304","\u1fe8":"\u03a5\u0306","\u038f":"\u03a9\u0301","\u1ffa":"\u03a9\u0300"};class _a{constructor(e,t){this.mode=void 0,this.gullet=void 0,this.settings=void 0,this.leftrightDepth=void 0,this.nextToken=void 0,this.mode="math",this.gullet=new Ga(e,t,this.mode),this.settings=t,this.leftrightDepth=0}expect(e,t){if(void 0===t&&(t=!0),this.fetch().text!==e)throw new i("Expected '"+e+"', got '"+this.fetch().text+"'",this.fetch());t&&this.consume()}consume(){this.nextToken=null}fetch(){return null==this.nextToken&&(this.nextToken=this.gullet.expandNextToken()),this.nextToken}switchMode(e){this.mode=e,this.gullet.switchMode(e)}parse(){this.settings.globalGroup||this.gullet.beginGroup(),this.settings.colorIsTextColor&&this.gullet.macros.set("\\color","\\textcolor");try{var e=this.parseExpression(!1);return this.expect("EOF"),this.settings.globalGroup||this.gullet.endGroup(),e}finally{this.gullet.endGroups()}}subparse(e){var t=this.nextToken;this.consume(),this.gullet.pushToken(new n("}")),this.gullet.pushTokens(e);var r=this.parseExpression(!1);return this.expect("}"),this.nextToken=t,r}parseExpression(e,t){for(var r=[];;){"math"===this.mode&&this.consumeSpaces();var a=this.fetch();if(-1!==_a.endOfExpression.indexOf(a.text))break;if(t&&a.text===t)break;if(e&&Aa[a.text]&&Aa[a.text].infix)break;var n=this.parseAtom(t);if(!n)break;"internal"!==n.type&&r.push(n)}return"text"===this.mode&&this.formLigatures(r),this.handleInfixNodes(r)}handleInfixNodes(e){for(var t,r=-1,a=0;a=0&&this.settings.reportNonstrict("unicodeTextInMathMode",'Latin-1/Unicode text character "'+t[0]+'" used in math mode',e);var l,h=ne[this.mode][t].group,m=a.range(e);if(re.hasOwnProperty(h)){var c=h;l={type:"atom",mode:this.mode,family:c,loc:m,text:t}}else l={type:h,mode:this.mode,loc:m,text:t};o=l}else{if(!(t.charCodeAt(0)>=128))return null;this.settings.strict&&(z(t.charCodeAt(0))?"math"===this.mode&&this.settings.reportNonstrict("unicodeTextInMathMode",'Unicode text character "'+t[0]+'" used in math mode',e):this.settings.reportNonstrict("unknownSymbol",'Unrecognized Unicode character "'+t[0]+'" ('+t.charCodeAt(0)+")",e)),o={type:"textord",mode:"text",loc:a.range(e),text:t}}if(this.consume(),s)for(var p=0;p{e.exports=JSON.parse('{"version":{"pluginId":"default","version":"current","label":"Next","banner":"unreleased","badge":true,"noIndex":false,"className":"docs-version-current","isLast":false,"docsSidebars":{"docs":[{"type":"link","label":"What is Contrast?","href":"/contrast/pr-preview/pr-1071/next/","docId":"intro","unlisted":false},{"type":"category","label":"Basics","collapsed":false,"items":[{"type":"link","label":"Confidential Containers","href":"/contrast/pr-preview/pr-1071/next/basics/confidential-containers","docId":"basics/confidential-containers","unlisted":false},{"type":"link","label":"Security benefits","href":"/contrast/pr-preview/pr-1071/next/basics/security-benefits","docId":"basics/security-benefits","unlisted":false},{"type":"link","label":"Features","href":"/contrast/pr-preview/pr-1071/next/basics/features","docId":"basics/features","unlisted":false}],"collapsible":true},{"type":"category","label":"Getting started","collapsed":false,"items":[{"type":"link","label":"Install","href":"/contrast/pr-preview/pr-1071/next/getting-started/install","docId":"getting-started/install","unlisted":false},{"type":"link","label":"Cluster setup","href":"/contrast/pr-preview/pr-1071/next/getting-started/cluster-setup","docId":"getting-started/cluster-setup","unlisted":false},{"type":"link","label":"Bare metal setup","href":"/contrast/pr-preview/pr-1071/next/getting-started/bare-metal","docId":"getting-started/bare-metal","unlisted":false}],"collapsible":true},{"type":"category","label":"Examples","items":[{"type":"link","label":"Confidential emoji voting","href":"/contrast/pr-preview/pr-1071/next/examples/emojivoto","docId":"examples/emojivoto","unlisted":false},{"type":"link","label":"Encrypted volume mount","href":"/contrast/pr-preview/pr-1071/next/examples/mysql","docId":"examples/mysql","unlisted":false}],"collapsed":true,"collapsible":true},{"type":"link","label":"Workload deployment","href":"/contrast/pr-preview/pr-1071/next/deployment","docId":"deployment","unlisted":false},{"type":"link","label":"Troubleshooting","href":"/contrast/pr-preview/pr-1071/next/troubleshooting","docId":"troubleshooting","unlisted":false},{"type":"category","label":"Components","items":[{"type":"link","label":"Overview","href":"/contrast/pr-preview/pr-1071/next/components/overview","docId":"components/overview","unlisted":false},{"type":"link","label":"Runtime","href":"/contrast/pr-preview/pr-1071/next/components/runtime","docId":"components/runtime","unlisted":false},{"type":"link","label":"Policies","href":"/contrast/pr-preview/pr-1071/next/components/policies","docId":"components/policies","unlisted":false},{"type":"link","label":"Service mesh","href":"/contrast/pr-preview/pr-1071/next/components/service-mesh","docId":"components/service-mesh","unlisted":false}],"collapsed":true,"collapsible":true},{"type":"category","label":"Architecture","items":[{"type":"link","label":"Attestation","href":"/contrast/pr-preview/pr-1071/next/architecture/attestation","docId":"architecture/attestation","unlisted":false},{"type":"link","label":"Secrets & recovery","href":"/contrast/pr-preview/pr-1071/next/architecture/secrets","docId":"architecture/secrets","unlisted":false},{"type":"link","label":"Certificate authority","href":"/contrast/pr-preview/pr-1071/next/architecture/certificates","docId":"architecture/certificates","unlisted":false},{"type":"link","label":"Security considerations","href":"/contrast/pr-preview/pr-1071/next/architecture/security-considerations","docId":"architecture/security-considerations","unlisted":false},{"type":"link","label":"Observability","href":"/contrast/pr-preview/pr-1071/next/architecture/observability","docId":"architecture/observability","unlisted":false}],"collapsed":true,"collapsible":true},{"type":"link","label":"Planned features and limitations","href":"/contrast/pr-preview/pr-1071/next/features-limitations","docId":"features-limitations","unlisted":false},{"type":"category","label":"About","items":[{"type":"link","label":"Telemetry","href":"/contrast/pr-preview/pr-1071/next/about/telemetry","docId":"about/telemetry","unlisted":false}],"collapsed":true,"collapsible":true}]},"docs":{"about/telemetry":{"id":"about/telemetry","title":"CLI telemetry","description":"The Contrast CLI sends telemetry data to Edgeless Systems when you use CLI commands.","sidebar":"docs"},"architecture/attestation":{"id":"architecture/attestation","title":"Attestation in Contrast","description":"This document describes the attestation architecture of Contrast, adhering to the definitions of Remote ATtestation procedureS (RATS) in RFC 9334.","sidebar":"docs"},"architecture/certificates":{"id":"architecture/certificates","title":"Certificate authority","description":"The Coordinator acts as a certificate authority (CA) for the workloads","sidebar":"docs"},"architecture/observability":{"id":"architecture/observability","title":"Observability","description":"The Contrast Coordinator can expose metrics in the","sidebar":"docs"},"architecture/secrets":{"id":"architecture/secrets","title":"Secrets & recovery","description":"When the Coordinator is configured with the initial manifest, it generates a random secret seed.","sidebar":"docs"},"architecture/security-considerations":{"id":"architecture/security-considerations","title":"Security Considerations","description":"Contrast ensures application integrity and provides secure means of communication and bootstrapping (see security benefits).","sidebar":"docs"},"basics/confidential-containers":{"id":"basics/confidential-containers","title":"Confidential Containers","description":"Contrast uses some building blocks from Confidential Containers (CoCo), a CNCF Sandbox project that aims to standardize confidential computing at the pod level.","sidebar":"docs"},"basics/features":{"id":"basics/features","title":"Product features","description":"Contrast simplifies the deployment and management of Confidential Containers, offering optimal data security for your workloads while integrating seamlessly with your existing Kubernetes environment.","sidebar":"docs"},"basics/security-benefits":{"id":"basics/security-benefits","title":"Contrast security overview","description":"This document outlines the security measures of Contrast and its capability to counter various threats.","sidebar":"docs"},"components/overview":{"id":"components/overview","title":"Components","description":"Contrast is composed of several key components that work together to manage and scale confidential containers effectively within Kubernetes environments.","sidebar":"docs"},"components/policies":{"id":"components/policies","title":"Policies","description":"Kata runtime policies are an integral part of the Confidential Containers preview on AKS.","sidebar":"docs"},"components/runtime":{"id":"components/runtime","title":"Contrast Runtime","description":"The Contrast runtime is responsible for starting pods as confidential virtual machines.","sidebar":"docs"},"components/service-mesh":{"id":"components/service-mesh","title":"Service mesh","description":"The Contrast service mesh secures the communication of the workload by automatically","sidebar":"docs"},"deployment":{"id":"deployment","title":"Workload deployment","description":"The following instructions will guide you through the process of making an existing Kubernetes deployment","sidebar":"docs"},"examples/emojivoto":{"id":"examples/emojivoto","title":"Confidential emoji voting","description":"screenshot of the emojivoto UI","sidebar":"docs"},"examples/mysql":{"id":"examples/mysql","title":"Encrypted volume mount","description":"This tutorial guides you through deploying a simple application with an","sidebar":"docs"},"features-limitations":{"id":"features-limitations","title":"Planned features and limitations","description":"This section lists planned features and current limitations of Contrast.","sidebar":"docs"},"getting-started/bare-metal":{"id":"getting-started/bare-metal","title":"Prepare a bare-metal instance","description":"Hardware and firmware setup","sidebar":"docs"},"getting-started/cluster-setup":{"id":"getting-started/cluster-setup","title":"Create a cluster","description":"Prerequisites","sidebar":"docs"},"getting-started/install":{"id":"getting-started/install","title":"Installation","description":"Download the Contrast CLI from the latest release:","sidebar":"docs"},"intro":{"id":"intro","title":"Contrast","description":"Welcome to the documentation of Contrast! Contrast runs confidential container deployments on Kubernetes at scale.","sidebar":"docs"},"troubleshooting":{"id":"troubleshooting","title":"Troubleshooting","description":"This section contains information on how to debug your Contrast deployment.","sidebar":"docs"}}}}')}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/21d7c4d4.70b063a4.js b/pr-preview/pr-1071/assets/js/21d7c4d4.70b063a4.js
deleted file mode 100644
index 0a99ecc8d8..0000000000
--- a/pr-preview/pr-1071/assets/js/21d7c4d4.70b063a4.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[5390],{50728:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>d,contentTitle:()=>r,default:()=>h,frontMatter:()=>a,metadata:()=>o,toc:()=>l});const o=JSON.parse('{"id":"examples/emojivoto","title":"Confidential emoji voting","description":"screenshot of the emojivoto UI","source":"@site/versioned_docs/version-0.6/examples/emojivoto.md","sourceDirName":"examples","slug":"/examples/emojivoto","permalink":"/contrast/pr-preview/pr-1071/0.6/examples/emojivoto","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.6/examples/emojivoto.md","tags":[],"version":"0.6","frontMatter":{},"sidebar":"docs","previous":{"title":"Examples","permalink":"/contrast/pr-preview/pr-1071/0.6/examples/"},"next":{"title":"Workload deployment","permalink":"/contrast/pr-preview/pr-1071/0.6/deployment"}}');var i=n(74848),s=n(28453);const a={},r="Confidential emoji voting",d={},l=[{value:"Motivation",id:"motivation",level:3},{value:"Prerequisites",id:"prerequisites",level:2},{value:"Steps to deploy emojivoto with Contrast",id:"steps-to-deploy-emojivoto-with-contrast",level:2},{value:"Downloading the deployment",id:"downloading-the-deployment",level:3},{value:"Deploy the Contrast runtime",id:"deploy-the-contrast-runtime",level:3},{value:"Deploy the Contrast Coordinator",id:"deploy-the-contrast-coordinator",level:3},{value:"Generate policy annotations and manifest",id:"generate-policy-annotations-and-manifest",level:3},{value:"Set the manifest",id:"set-the-manifest",level:3},{value:"Deploy emojivoto",id:"deploy-emojivoto",level:3},{value:"Voter's perspective: Verifying the ballot",id:"voters-perspective-verifying-the-ballot",level:2},{value:"Attest the Coordinator",id:"attest-the-coordinator",level:3},{value:"Manifest history and artifact audit",id:"manifest-history-and-artifact-audit",level:3},{value:"Confidential connection to the attested workload",id:"confidential-connection-to-the-attested-workload",level:3},{value:"Certificate SAN and manifest update (optional)",id:"certificate-san-and-manifest-update-optional",level:2},{value:"Configure the service SAN in the manifest",id:"configure-the-service-san-in-the-manifest",level:3},{value:"Update the manifest",id:"update-the-manifest",level:3},{value:"Rolling out the update",id:"rolling-out-the-update",level:3}];function c(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",img:"img",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.header,{children:(0,i.jsx)(t.h1,{id:"confidential-emoji-voting",children:"Confidential emoji voting"})}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"screenshot of the emojivoto UI",src:n(69314).A+"",width:"1503",height:"732"})}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsxs)(t.strong,{children:["This tutorial guides you through deploying ",(0,i.jsx)(t.a,{href:"https://github.com/BuoyantIO/emojivoto",children:"emojivoto"})," as a\nconfidential Contrast deployment and validating the deployment from a voters perspective."]})}),"\n",(0,i.jsxs)(t.p,{children:["Emojivoto is an example app allowing users to vote for different emojis and view votes\non a leader board. It has a microservice architecture consisting of a\nweb frontend (",(0,i.jsx)(t.code,{children:"web"}),"), a gRPC backend for listing available emojis (",(0,i.jsx)(t.code,{children:"emoji"}),"), and a backend for\nthe voting and leader board logic (",(0,i.jsx)(t.code,{children:"voting"}),"). The ",(0,i.jsx)(t.code,{children:"vote-bot"})," simulates user traffic by submitting\nvotes to the frontend."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{src:"https://raw.githubusercontent.com/BuoyantIO/emojivoto/e490d5789086e75933a474b22f9723fbfa0b29ba/assets/emojivoto-topology.png",alt:"emojivoto components topology"})}),"\n",(0,i.jsx)(t.h3,{id:"motivation",children:"Motivation"}),"\n",(0,i.jsx)(t.p,{children:"Using a voting service, users' votes are considered highly sensitive data, as we require\na secret ballot. Also, users are likely interested in the fairness of the ballot. For\nboth requirements, we can use Confidential Computing and, specifically, workload attestation\nto prove to those interested in voting that the app is running in a protected environment\nwhere their votes are processed without leaking to the platform provider or workload owner."}),"\n",(0,i.jsx)(t.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Installed Contrast CLI."}),"\nSee the ",(0,i.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/getting-started/install",children:"installation instructions"})," on how to get it."]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Running cluster with Confidential Containers support."}),"\nPlease follow the ",(0,i.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/getting-started/cluster-setup",children:"cluster setup instructions"}),"\nto create a cluster."]}),"\n"]}),"\n",(0,i.jsx)(t.h2,{id:"steps-to-deploy-emojivoto-with-contrast",children:"Steps to deploy emojivoto with Contrast"}),"\n",(0,i.jsx)(t.h3,{id:"downloading-the-deployment",children:"Downloading the deployment"}),"\n",(0,i.jsx)(t.p,{children:"The emojivoto deployment files are part of a zip file in the Contrast release. You can download the\nlatest deployment by running:"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-sh",children:"curl -fLO https://github.com/edgelesssys/contrast/releases/latest/download/emojivoto-demo.zip\n"})}),"\n",(0,i.jsxs)(t.p,{children:["After that, unzip the ",(0,i.jsx)(t.code,{children:"emojivoto-demo.zip"})," file to extract the ",(0,i.jsx)(t.code,{children:"deployment/"})," directory."]}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-sh",children:"unzip emojivoto-demo.zip\n"})}),"\n",(0,i.jsx)(t.h3,{id:"deploy-the-contrast-runtime",children:"Deploy the Contrast runtime"}),"\n",(0,i.jsxs)(t.p,{children:["Contrast depends on a ",(0,i.jsxs)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/runtime",children:["custom Kubernetes ",(0,i.jsx)(t.code,{children:"RuntimeClass"})," (",(0,i.jsx)(t.code,{children:"contrast-cc"}),")"]}),",\nwhich needs to be installed in the cluster prior to the Coordinator or any confidential workloads.\nThis consists of a ",(0,i.jsx)(t.code,{children:"RuntimeClass"})," resource and a ",(0,i.jsx)(t.code,{children:"DaemonSet"})," that performs installation on worker nodes.\nThis step is only required once for each version of the runtime.\nIt can be shared between Contrast deployments."]}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-sh",children:"kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime.yml\n"})}),"\n",(0,i.jsx)(t.h3,{id:"deploy-the-contrast-coordinator",children:"Deploy the Contrast Coordinator"}),"\n",(0,i.jsx)(t.p,{children:"Deploy the Contrast Coordinator, comprising a single replica deployment and a\nLoadBalancer service, into your cluster:"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-sh",children:"kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator.yml\n"})}),"\n",(0,i.jsx)(t.h3,{id:"generate-policy-annotations-and-manifest",children:"Generate policy annotations and manifest"}),"\n",(0,i.jsxs)(t.p,{children:["Run the ",(0,i.jsx)(t.code,{children:"generate"})," command to generate the execution policies and add them as\nannotations to your deployment files. A ",(0,i.jsx)(t.code,{children:"manifest.json"})," file with the reference values\nof your deployment will be created:"]}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-sh",children:"contrast generate deployment/\n"})}),"\n",(0,i.jsxs)(t.admonition,{title:"Runtime class and Initializer",type:"note",children:[(0,i.jsxs)(t.p,{children:["The deployment YAML shipped for this demo is already configured to be used with Contrast.\nA ",(0,i.jsx)(t.a,{href:"https://docs.edgeless.systems/contrast/components/runtime",children:"runtime class"})," ",(0,i.jsx)(t.code,{children:"contrast-cc-"}),"\nwas added to the pods to signal they should be run as Confidential Containers. In addition, the Contrast\n",(0,i.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/#the-initializer",children:"Initializer"})," was added as an init container to these workloads to\nfacilitate the attestation and certificate pulling before the actual workload is started."]}),(0,i.jsxs)(t.p,{children:["Further, the deployment YAML is also configured with the Contrast ",(0,i.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/0.6/components/service-mesh",children:"service mesh"}),".\nThe configured service mesh proxy provides transparent protection for the communication between\nthe different components of emojivoto."]})]}),"\n",(0,i.jsx)(t.h3,{id:"set-the-manifest",children:"Set the manifest"}),"\n",(0,i.jsx)(t.p,{children:"Configure the coordinator with a manifest. It might take up to a few minutes\nfor the load balancer to be created and the Coordinator being available."}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-sh",children:'coordinator=$(kubectl get svc coordinator -o=jsonpath=\'{.status.loadBalancer.ingress[0].ip}\')\necho "The user API of your Contrast Coordinator is available at $coordinator:1313"\ncontrast set -c "${coordinator}:1313" deployment/\n'})}),"\n",(0,i.jsx)(t.p,{children:"The CLI will use the embedded reference values to attest the Coordinator deployment\nduring the TLS handshake. If the connection succeeds, we're ensured that the Coordinator\ndeployment hasn't been tampered with."}),"\n",(0,i.jsx)(t.h3,{id:"deploy-emojivoto",children:"Deploy emojivoto"}),"\n",(0,i.jsx)(t.p,{children:"Now that the coordinator has a manifest set, which defines the emojivoto deployment as an allowed workload,\nwe can deploy the application:"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-sh",children:"kubectl apply -f deployment/\n"})}),"\n",(0,i.jsx)(t.admonition,{title:"Inter-deployment communication",type:"note",children:(0,i.jsxs)(t.p,{children:["The Contrast Coordinator issues mesh certificates after successfully validating workloads.\nThese certificates can be used for secure inter-deployment communication. The Initializer\nsends an attestation report to the Coordinator, retrieves certificates and a private key in return\nand writes them to a ",(0,i.jsx)(t.code,{children:"volumeMount"}),". The service mesh sidecar is configured to use the credentials\nfrom the ",(0,i.jsx)(t.code,{children:"volumeMount"})," when communicating with other parts of the deployment over mTLS.\nThe public facing frontend for voting uses the mesh certificate without client authentication."]})}),"\n",(0,i.jsx)(t.h2,{id:"voters-perspective-verifying-the-ballot",children:"Voter's perspective: Verifying the ballot"}),"\n",(0,i.jsx)(t.p,{children:"As voters, we want to verify the fairness and confidentiality of the deployment before\ndeciding to vote. Regardless of the scale of our distributed deployment, Contrast only\nneeds a single remote attestation step to verify the deployment. By doing remote attestation\nof the Coordinator, we transitively verify those systems the Coordinator has already attested\nor will attest in the future. Successful verification of the Coordinator means that\nwe can be sure it will enforce the configured manifest."}),"\n",(0,i.jsx)(t.h3,{id:"attest-the-coordinator",children:"Attest the Coordinator"}),"\n",(0,i.jsx)(t.p,{children:"A potential voter can verify the Contrast deployment using the verify\ncommand:"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-sh",children:'contrast verify -c "${coordinator}:1313"\n'})}),"\n",(0,i.jsxs)(t.p,{children:["The CLI will attest the Coordinator using embedded reference values. If the command succeeds,\nthe Coordinator deployment was successfully verified to be running in the expected Confidential\nComputing environment with the expected code version. The Coordinator will then return its\nconfiguration over the established TLS channel. The CLI will store this information, namely the root\ncertificate of the mesh (",(0,i.jsx)(t.code,{children:"mesh-ca.pem"}),") and the history of manifests, into the ",(0,i.jsx)(t.code,{children:"verify/"})," directory.\nIn addition, the policies referenced in the manifest history are also written into the same directory."]}),"\n",(0,i.jsx)(t.h3,{id:"manifest-history-and-artifact-audit",children:"Manifest history and artifact audit"}),"\n",(0,i.jsxs)(t.p,{children:["In the next step, the Coordinator configuration that was written by the ",(0,i.jsx)(t.code,{children:"verify"})," command needs to be audited.\nA potential voter should inspect the manifest and the referenced policies. They could delegate\nthis task to an entity they trust."]}),"\n",(0,i.jsx)(t.h3,{id:"confidential-connection-to-the-attested-workload",children:"Confidential connection to the attested workload"}),"\n",(0,i.jsxs)(t.p,{children:["After ensuring the configuration of the Coordinator fits the expectation, you can securely connect\nto the workloads using the Coordinator's ",(0,i.jsx)(t.code,{children:"mesh-ca.pem"})," as a trusted CA certificate."]}),"\n",(0,i.jsx)(t.p,{children:"To access the web frontend, expose the service on a public IP address via a LoadBalancer service:"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-sh",children:"frontendIP=$(kubectl get svc web-svc -o=jsonpath='{.status.loadBalancer.ingress[0].ip}')\necho \"Frontend is available at https://$frontendIP, you can visit it in your browser.\"\n"})}),"\n",(0,i.jsxs)(t.p,{children:["Using ",(0,i.jsx)(t.code,{children:"openssl"}),", the certificate of the service can be validated with the ",(0,i.jsx)(t.code,{children:"mesh-ca.pem"}),":"]}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-sh",children:"openssl s_client -CAfile verify/mesh-ca.pem -verify_return_error -connect ${frontendIP}:443 < /dev/null\n"})}),"\n",(0,i.jsx)(t.h2,{id:"certificate-san-and-manifest-update-optional",children:"Certificate SAN and manifest update (optional)"}),"\n",(0,i.jsx)(t.p,{children:"By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed\nvia load balancer IP in this demo. Tools like curl check the certificate for IP entries in the SAN field.\nValidation fails since the certificate contains no IP entries as a subject alternative name (SAN).\nFor example, a connection attempt using the curl and the mesh CA certificate with throw the following error:"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-sh",children:"$ curl --cacert ./verify/mesh-ca.pem \"https://${frontendIP}:443\"\ncurl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34'\n"})}),"\n",(0,i.jsx)(t.h3,{id:"configure-the-service-san-in-the-manifest",children:"Configure the service SAN in the manifest"}),"\n",(0,i.jsxs)(t.p,{children:["The ",(0,i.jsx)(t.code,{children:"Policies"})," section of the manifest maps policy hashes to a list of SANs. To enable certificate verification\nof the web frontend with tools like curl, edit the policy with your favorite editor and add the ",(0,i.jsx)(t.code,{children:"frontendIP"})," to\nthe list that already contains the ",(0,i.jsx)(t.code,{children:'"web"'})," DNS entry:"]}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-diff",children:' "Policies": {\n ...\n "99dd77cbd7fe2c4e1f29511014c14054a21a376f7d58a48d50e9e036f4522f6b": [\n "web",\n- "*"\n+ "*",\n+ "203.0.113.34"\n ],\n'})}),"\n",(0,i.jsx)(t.h3,{id:"update-the-manifest",children:"Update the manifest"}),"\n",(0,i.jsx)(t.p,{children:"Next, set the changed manifest at the coordinator with:"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-sh",children:'contrast set -c "${coordinator}:1313" deployment/\n'})}),"\n",(0,i.jsxs)(t.p,{children:["The Contrast Coordinator will rotate the mesh ca certificate on the manifest update. Workload certificates issued\nafter the manifest are thus issued by another certificate authority and services receiving the new CA certificate chain\nwon't trust parts of the deployment that got their certificate issued before the update. This way, Contrast ensures\nthat parts of the deployment that received a security update won't be infected by parts of the deployment at an older\npatch level that may have been compromised. The ",(0,i.jsx)(t.code,{children:"mesh-ca.pem"})," is updated with the new CA certificate chain."]}),"\n",(0,i.jsx)(t.h3,{id:"rolling-out-the-update",children:"Rolling out the update"}),"\n",(0,i.jsx)(t.p,{children:"The Coordinator has the new manifest set, but the different containers of the app are still\nusing the older certificate authority. The Contrast Initializer terminates after the initial attestation\nflow and won't pull new certificates on manifest updates."}),"\n",(0,i.jsx)(t.p,{children:"To roll out the update, use:"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-sh",children:"kubectl rollout restart deployment/emoji\nkubectl rollout restart deployment/vote-bot\nkubectl rollout restart deployment/voting\nkubectl rollout restart deployment/web\n"})}),"\n",(0,i.jsx)(t.p,{children:"After the update has been rolled out, connecting to the frontend using curl will successfully validate\nthe service certificate and return the HTML document of the voting site:"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-sh",children:'curl --cacert ./mesh-ca.pem "https://${frontendIP}:443"\n'})})]})}function h(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},69314:(e,t,n)=>{n.d(t,{A:()=>o});const o=n.p+"assets/images/emoijvoto-3fb48da575d6d4adf76cc90caa35d762.png"},28453:(e,t,n)=>{n.d(t,{R:()=>a,x:()=>r});var o=n(96540);const i={},s=o.createContext(i);function a(e){const t=o.useContext(s);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),o.createElement(s.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/2334.a23ce334.js b/pr-preview/pr-1071/assets/js/2334.a23ce334.js
deleted file mode 100644
index 7e65c1b8e9..0000000000
--- a/pr-preview/pr-1071/assets/js/2334.a23ce334.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[2334],{62334:(e,n,t)=>{t.d(n,{Zp:()=>Rn});var r=t(8058),o=t(28894),i=0;const u=function(e){var n=++i;return(0,o.A)(e)+n};var a=t(39142),s=t(34098),d=t(74722),c=Math.ceil,h=Math.max;const f=function(e,n,t,r){for(var o=-1,i=h(c((n-e)/(t||1)),0),u=Array(i);i--;)u[r?i:++o]=e,e+=t;return u};var v=t(6832),l=t(74342);const g=function(e){return function(n,t,r){return r&&"number"!=typeof r&&(0,v.A)(n,t,r)&&(t=r=void 0),n=(0,l.A)(n),void 0===t?(t=n,n=0):t=(0,l.A)(t),r=void 0===r?n0;--a)if(r=n[a].dequeue()){o=o.concat(_(e,n,t,r,!0));break}}return o}(t.graph,t.buckets,t.zeroIdx);return s.A(d.A(o,(function(n){return e.outEdges(n.v,n.w)})))}function _(e,n,t,o,i){var u=i?[]:void 0;return r.A(e.inEdges(o.v),(function(r){var o=e.edge(r),a=e.node(r.v);i&&u.push({v:r.v,w:r.w}),a.out-=o,E(n,t,a)})),r.A(e.outEdges(o.v),(function(r){var o=e.edge(r),i=r.w,u=e.node(i);u.in-=o,E(n,t,u)})),e.removeNode(o.v),u}function E(e,n,t){t.out?t.in?e[t.out-t.in+n].enqueue(t):e[e.length-1].enqueue(t):e[0].enqueue(t)}function x(e){var n="greedy"===e.graph().acyclicer?y(e,function(e){return function(n){return e.edge(n).weight}}(e)):function(e){var n=[],t={},o={};function i(u){Object.prototype.hasOwnProperty.call(o,u)||(o[u]=!0,t[u]=!0,r.A(e.outEdges(u),(function(e){Object.prototype.hasOwnProperty.call(t,e.w)?n.push(e):i(e.w)})),delete t[u])}return r.A(e.nodes(),i),n}(e);r.A(n,(function(n){var t=e.edge(n);e.removeEdge(n),t.forwardName=n.name,t.reversed=!0,e.setEdge(n.w,n.v,t,u("rev"))}))}var O=t(42837),k=t(99354),N=t(39188);const P=function(e,n){return(0,k.A)(e,n,(function(n,t){return(0,N.A)(e,t)}))};var j=t(76875),C=t(67525);const I=function(e){return(0,C.A)((0,j.A)(e,void 0,s.A),e+"")}((function(e,n){return null==e?{}:P(e,n)}));var L=t(23068),T=t(72559);const M=function(e,n){return e>n};var R=t(29008);const F=function(e){return e&&e.length?(0,T.A)(e,R.A,M):void 0};var D=t(26666),S=t(52528),G=t(79841),V=t(23958);const B=function(e,n){var t={};return n=(0,V.A)(n,3),(0,G.A)(e,(function(e,r,o){(0,S.A)(t,r,n(e,r,o))})),t};var q=t(69592),Y=t(86452),z=t(48585),$=t(41917);const J=function(){return $.A.Date.now()};function Z(e,n,t,r){var o;do{o=u(r)}while(e.hasNode(o));return t.dummy=n,e.setNode(o,t),o}function H(e){var n=new p.T({multigraph:e.isMultigraph()}).setGraph(e.graph());return r.A(e.nodes(),(function(t){e.children(t).length||n.setNode(t,e.node(t))})),r.A(e.edges(),(function(t){n.setEdge(t,e.edge(t))})),n}function K(e,n){var t,r,o=e.x,i=e.y,u=n.x-o,a=n.y-i,s=e.width/2,d=e.height/2;if(!u&&!a)throw new Error("Not possible to find intersection inside of the rectangle");return Math.abs(a)*s>Math.abs(u)*d?(a<0&&(d=-d),t=d*u/a,r=d):(u<0&&(s=-s),t=s,r=s*a/u),{x:o+t,y:i+r}}function Q(e){var n=d.A(g(W(e)+1),(function(){return[]}));return r.A(e.nodes(),(function(t){var r=e.node(t),o=r.rank;q.A(o)||(n[o][r.order]=t)})),n}function U(e,n,t,r){var o={width:0,height:0};return arguments.length>=4&&(o.rank=t,o.order=r),Z(e,"border",o,n)}function W(e){return F(d.A(e.nodes(),(function(n){var t=e.node(n).rank;if(!q.A(t))return t})))}function X(e,n){var t=J();try{return n()}finally{console.log(e+" time: "+(J()-t)+"ms")}}function ee(e,n){return n()}function ne(e,n,t,r,o,i){var u={width:0,height:0,rank:i,borderType:n},a=o[n][i-1],s=Z(e,"border",u,t);o[n][i]=s,e.setParent(s,r),a&&e.setEdge(a,s,{weight:1})}function te(e){var n=e.graph().rankdir.toLowerCase();"bt"!==n&&"rl"!==n||function(e){r.A(e.nodes(),(function(n){ie(e.node(n))})),r.A(e.edges(),(function(n){var t=e.edge(n);r.A(t.points,ie),Object.prototype.hasOwnProperty.call(t,"y")&&ie(t)}))}(e),"lr"!==n&&"rl"!==n||(!function(e){r.A(e.nodes(),(function(n){ue(e.node(n))})),r.A(e.edges(),(function(n){var t=e.edge(n);r.A(t.points,ue),Object.prototype.hasOwnProperty.call(t,"x")&&ue(t)}))}(e),re(e))}function re(e){r.A(e.nodes(),(function(n){oe(e.node(n))})),r.A(e.edges(),(function(n){oe(e.edge(n))}))}function oe(e){var n=e.width;e.width=e.height,e.height=n}function ie(e){e.y=-e.y}function ue(e){var n=e.x;e.x=e.y,e.y=n}function ae(e){e.graph().dummyChains=[],r.A(e.edges(),(function(n){!function(e,n){var t=n.v,r=e.node(t).rank,o=n.w,i=e.node(o).rank,u=n.name,a=e.edge(n),s=a.labelRank;if(i===r+1)return;e.removeEdge(n);var d,c,h=void 0;for(c=0,++r;ru.lim&&(a=u,s=!0);var d=Ae.A(n.edges(),(function(n){return s===Be(e,e.node(n.v),a)&&s!==Be(e,e.node(n.w),a)}));return de(d,(function(e){return he(n,e)}))}function Ve(e,n,t,o){var i=t.v,u=t.w;e.removeEdge(i,u),e.setEdge(o.v,o.w,{}),Fe(e),Me(e,n),function(e,n){var t=pe.A(e.nodes(),(function(e){return!n.node(e).parent})),o=function(e,n){return Ie(e,n,"pre")}(e,t);o=o.slice(1),r.A(o,(function(t){var r=e.node(t).parent,o=n.edge(t,r),i=!1;o||(o=n.edge(r,t),i=!0),n.node(t).rank=n.node(r).rank+(i?o.minlen:-o.minlen)}))}(e,n)}function Be(e,n,t){return t.low<=n.lim&&n.lim<=t.lim}function qe(e){switch(e.graph().ranker){case"network-simplex":default:ze(e);break;case"tight-tree":!function(e){ce(e),fe(e)}(e);break;case"longest-path":Ye(e)}}Te.initLowLimValues=Fe,Te.initCutValues=Me,Te.calcCutValue=Re,Te.leaveEdge=Se,Te.enterEdge=Ge,Te.exchangeEdges=Ve;var Ye=ce;function ze(e){Te(e)}var $e=t(38207),Je=t(89463);function Ze(e){var n=Z(e,"root",{},"_root"),t=function(e){var n={};function t(o,i){var u=e.children(o);u&&u.length&&r.A(u,(function(e){t(e,i+1)})),n[o]=i}return r.A(e.children(),(function(e){t(e,1)})),n}(e),o=F($e.A(t))-1,i=2*o+1;e.graph().nestingRoot=n,r.A(e.edges(),(function(n){e.edge(n).minlen*=i}));var u=function(e){return Je.A(e.edges(),(function(n,t){return n+e.edge(t).weight}),0)}(e)+1;r.A(e.children(),(function(r){He(e,n,i,u,o,t,r)})),e.graph().nodeRankFactor=i}function He(e,n,t,o,i,u,a){var s=e.children(a);if(s.length){var d=U(e,"_bt"),c=U(e,"_bb"),h=e.node(a);e.setParent(d,a),h.borderTop=d,e.setParent(c,a),h.borderBottom=c,r.A(s,(function(r){He(e,n,t,o,i,u,r);var s=e.node(r),h=s.borderTop?s.borderTop:r,f=s.borderBottom?s.borderBottom:r,v=s.borderTop?o:2*o,l=h!==f?1:i-u[a]+1;e.setEdge(d,h,{weight:v,minlen:l,nestingEdge:!0}),e.setEdge(f,c,{weight:v,minlen:l,nestingEdge:!0})})),e.parent(a)||e.setEdge(n,d,{weight:0,minlen:i+u[a]})}else a!==n&&e.setEdge(n,a,{weight:0,minlen:t})}var Ke=t(68675);const Qe=function(e){return(0,Ke.A)(e,5)};function Ue(e,n,t){var o=function(e){var n;for(;e.hasNode(n=u("_root")););return n}(e),i=new p.T({compound:!0}).setGraph({root:o}).setDefaultNodeLabel((function(n){return e.node(n)}));return r.A(e.nodes(),(function(u){var a=e.node(u),s=e.parent(u);(a.rank===n||a.minRank<=n&&n<=a.maxRank)&&(i.setNode(u),i.setParent(u,s||o),r.A(e[t](u),(function(n){var t=n.v===u?n.w:n.v,r=i.edge(t,u),o=q.A(r)?0:r.weight;i.setEdge(t,u,{weight:e.edge(n).weight+o})})),Object.prototype.hasOwnProperty.call(a,"minRank")&&i.setNode(u,{borderLeft:a.borderLeft[n],borderRight:a.borderRight[n]}))})),i}var We=t(52851);const Xe=function(e,n,t){for(var r=-1,o=e.length,i=n.length,u={};++rn||i&&u&&s&&!a&&!d||r&&u&&s||!t&&s||!o)return 1;if(!r&&!i&&!d&&e=a?s:s*("desc"==t[r]?-1:1)}return e.index-n.index};const hn=function(e,n,t){n=n.length?(0,tn.A)(n,(function(e){return(0,Ce.A)(e)?function(n){return(0,rn.A)(n,1===e.length?e[0]:e)}:e})):[R.A];var r=-1;n=(0,tn.A)(n,(0,an.A)(V.A));var o=(0,on.A)(e,(function(e,t,o){return{criteria:(0,tn.A)(n,(function(n){return n(e)})),index:++r,value:e}}));return un(o,(function(e,n){return cn(e,n,t)}))};const fn=(0,t(24326).A)((function(e,n){if(null==e)return[];var t=n.length;return t>1&&(0,v.A)(e,n[0],n[1])?n=[]:t>2&&(0,v.A)(n[0],n[1],n[2])&&(n=[n[0]]),hn(e,(0,nn.A)(n,1),[])}));function vn(e,n){for(var t=0,r=1;r0;)n%2&&(t+=c[n+1]),c[n=n-1>>1]+=e.weight;h+=e.weight*t}))),h}function gn(e,n){var t={};return r.A(e,(function(e,n){var r=t[e.v]={indegree:0,in:[],out:[],vs:[e.v],i:n};q.A(e.barycenter)||(r.barycenter=e.barycenter,r.weight=e.weight)})),r.A(n.edges(),(function(e){var n=t[e.v],r=t[e.w];q.A(n)||q.A(r)||(r.indegree++,n.out.push(t[e.w]))})),function(e){var n=[];function t(e){return function(n){n.merged||(q.A(n.barycenter)||q.A(e.barycenter)||n.barycenter>=e.barycenter)&&function(e,n){var t=0,r=0;e.weight&&(t+=e.barycenter*e.weight,r+=e.weight);n.weight&&(t+=n.barycenter*n.weight,r+=n.weight);e.vs=n.vs.concat(e.vs),e.barycenter=t/r,e.weight=r,e.i=Math.min(n.i,e.i),n.merged=!0}(e,n)}}function o(n){return function(t){t.in.push(n),0==--t.indegree&&e.push(t)}}for(;e.length;){var i=e.pop();n.push(i),r.A(i.in.reverse(),t(i)),r.A(i.out,o(i))}return d.A(Ae.A(n,(function(e){return!e.merged})),(function(e){return I(e,["vs","i","barycenter","weight"])}))}(Ae.A(t,(function(e){return!e.indegree})))}function pn(e,n){var t,o=function(e,n){var t={lhs:[],rhs:[]};return r.A(e,(function(e){n(e)?t.lhs.push(e):t.rhs.push(e)})),t}(e,(function(e){return Object.prototype.hasOwnProperty.call(e,"barycenter")})),i=o.lhs,u=fn(o.rhs,(function(e){return-e.i})),a=[],d=0,c=0,h=0;i.sort((t=!!n,function(e,n){return e.barycentern.barycenter?1:t?n.i-e.i:e.i-n.i})),h=An(a,u,h),r.A(i,(function(e){h+=e.vs.length,a.push(e.vs),d+=e.barycenter*e.weight,c+=e.weight,h=An(a,u,h)}));var f={vs:s.A(a)};return c&&(f.barycenter=d/c,f.weight=c),f}function An(e,n,t){for(var r;n.length&&(r=D.A(n)).i<=t;)n.pop(),e.push(r.vs),t++;return t}function wn(e,n,t,o){var i=e.children(n),u=e.node(n),a=u?u.borderLeft:void 0,c=u?u.borderRight:void 0,h={};a&&(i=Ae.A(i,(function(e){return e!==a&&e!==c})));var f=function(e,n){return d.A(n,(function(n){var t=e.inEdges(n);if(t.length){var r=Je.A(t,(function(n,t){var r=e.edge(t),o=e.node(t.v);return{sum:n.sum+r.weight*o.order,weight:n.weight+r.weight}}),{sum:0,weight:0});return{v:n,barycenter:r.sum/r.weight,weight:r.weight}}return{v:n}}))}(e,i);r.A(f,(function(n){if(e.children(n.v).length){var r=wn(e,n.v,t,o);h[n.v]=r,Object.prototype.hasOwnProperty.call(r,"barycenter")&&(i=n,u=r,q.A(i.barycenter)?(i.barycenter=u.barycenter,i.weight=u.weight):(i.barycenter=(i.barycenter*i.weight+u.barycenter*u.weight)/(i.weight+u.weight),i.weight+=u.weight))}var i,u}));var v=gn(f,t);!function(e,n){r.A(e,(function(e){e.vs=s.A(e.vs.map((function(e){return n[e]?n[e].vs:e})))}))}(v,h);var l=pn(v,o);if(a&&(l.vs=s.A([a,l.vs,c]),e.predecessors(a).length)){var g=e.node(e.predecessors(a)[0]),p=e.node(e.predecessors(c)[0]);Object.prototype.hasOwnProperty.call(l,"barycenter")||(l.barycenter=0,l.weight=0),l.barycenter=(l.barycenter*l.weight+g.order+p.order)/(l.weight+2),l.weight+=2}return l}function bn(e){var n=W(e),t=mn(e,g(1,n+1),"inEdges"),o=mn(e,g(n-1,-1,-1),"outEdges"),i=function(e){var n={},t=Ae.A(e.nodes(),(function(n){return!e.children(n).length})),o=F(d.A(t,(function(n){return e.node(n).rank}))),i=d.A(g(o+1),(function(){return[]})),u=fn(t,(function(n){return e.node(n).rank}));return r.A(u,(function t(o){if(!z.A(n,o)){n[o]=!0;var u=e.node(o);i[u.rank].push(o),r.A(e.successors(o),t)}})),i}(e);_n(e,i);for(var u,a=Number.POSITIVE_INFINITY,s=0,c=0;c<4;++s,++c){yn(s%2?t:o,s%4>=2);var h=vn(e,i=Q(e));hs||d>n[o].lim));i=o,o=r;for(;(o=e.parent(o))!==i;)a.push(o);return{path:u.concat(a.reverse()),lca:i}}(e,n,o.v,o.w),u=i.path,a=i.lca,s=0,d=u[s],c=!0;t!==o.w;){if(r=e.node(t),c){for(;(d=u[s])!==a&&e.node(d).maxRankt){var r=n;n=t,t=r}var o=e[n];o||(e[n]=o={}),o[t]=!0}function In(e,n,t){if(n>t){var r=n;n=t,t=r}return!!e[n]&&Object.prototype.hasOwnProperty.call(e[n],t)}function Ln(e,n,t,o,i){var u={},a=function(e,n,t,o){var i=new p.T,u=e.graph(),a=function(e,n,t){return function(r,o,i){var u,a=r.node(o),s=r.node(i),d=0;if(d+=a.width/2,Object.prototype.hasOwnProperty.call(a,"labelpos"))switch(a.labelpos.toLowerCase()){case"l":u=-a.width/2;break;case"r":u=a.width/2}if(u&&(d+=t?u:-u),u=0,d+=(a.dummy?n:e)/2,d+=(s.dummy?n:e)/2,d+=s.width/2,Object.prototype.hasOwnProperty.call(s,"labelpos"))switch(s.labelpos.toLowerCase()){case"l":u=s.width/2;break;case"r":u=-s.width/2}return u&&(d+=t?u:-u),u=0,d}}(u.nodesep,u.edgesep,o);return r.A(n,(function(n){var o;r.A(n,(function(n){var r=t[n];if(i.setNode(r),o){var u=t[o],s=i.edge(u,r);i.setEdge(u,r,Math.max(a(e,n,o),s||0))}o=n}))})),i}(e,n,t,i),s=i?"borderLeft":"borderRight";function d(e,n){for(var t=a.nodes(),r=t.pop(),o={};r;)o[r]?e(r):(o[r]=!0,t.push(r),t=t.concat(n(r))),r=t.pop()}return d((function(e){u[e]=a.inEdges(e).reduce((function(e,n){return Math.max(e,u[n.v]+a.edge(n))}),0)}),a.predecessors.bind(a)),d((function(n){var t=a.outEdges(n).reduce((function(e,n){return Math.min(e,u[n.w]-a.edge(n))}),Number.POSITIVE_INFINITY),r=e.node(n);t!==Number.POSITIVE_INFINITY&&r.borderType!==s&&(u[n]=Math.max(u[n],t))}),a.successors.bind(a)),r.A(o,(function(e){u[e]=u[t[e]]})),u}function Tn(e){var n,t=Q(e),o=O.A(jn(e,t),function(e,n){var t={};function o(n,o,i,u,a){var s;r.A(g(o,i),(function(o){s=n[o],e.node(s).dummy&&r.A(e.predecessors(s),(function(n){var r=e.node(n);r.dummy&&(r.ordera)&&Cn(t,n,s)}))}))}return Je.A(n,(function(n,t){var i,u=-1,a=0;return r.A(t,(function(r,s){if("border"===e.node(r).dummy){var d=e.predecessors(r);d.length&&(i=e.node(d[0]).order,o(t,a,s,u,i),a=s,u=i)}o(t,a,t.length,i,n.length)})),t})),t}(e,t)),i={};r.A(["u","d"],(function(u){n="u"===u?t:$e.A(t).reverse(),r.A(["l","r"],(function(t){"r"===t&&(n=d.A(n,(function(e){return $e.A(e).reverse()})));var a=("u"===u?e.predecessors:e.successors).bind(e),s=function(e,n,t,o){var i={},u={},a={};return r.A(n,(function(e){r.A(e,(function(e,n){i[e]=e,u[e]=e,a[e]=n}))})),r.A(n,(function(e){var n=-1;r.A(e,(function(e){var r=o(e);if(r.length){r=fn(r,(function(e){return a[e]}));for(var s=(r.length-1)/2,d=Math.floor(s),c=Math.ceil(s);d<=c;++d){var h=r[d];u[e]===e&&n{var n=t(" buildLayoutGraph",(()=>function(e){var n=new p.T({multigraph:!0,compound:!0}),t=$n(e.graph());return n.setGraph(O.A({},Dn,zn(t,Fn),I(t,Sn))),r.A(e.nodes(),(function(t){var r=$n(e.node(t));n.setNode(t,L.A(zn(r,Gn),Vn)),n.setParent(t,e.parent(t))})),r.A(e.edges(),(function(t){var r=$n(e.edge(t));n.setEdge(t,O.A({},qn,zn(r,Bn),I(r,Yn)))})),n}(e)));t(" runLayout",(()=>function(e,n){n(" makeSpaceForEdgeLabels",(()=>function(e){var n=e.graph();n.ranksep/=2,r.A(e.edges(),(function(t){var r=e.edge(t);r.minlen*=2,"c"!==r.labelpos.toLowerCase()&&("TB"===n.rankdir||"BT"===n.rankdir?r.width+=r.labeloffset:r.height+=r.labeloffset)}))}(e))),n(" removeSelfEdges",(()=>function(e){r.A(e.edges(),(function(n){if(n.v===n.w){var t=e.node(n.v);t.selfEdges||(t.selfEdges=[]),t.selfEdges.push({e:n,label:e.edge(n)}),e.removeEdge(n)}}))}(e))),n(" acyclic",(()=>x(e))),n(" nestingGraph.run",(()=>Ze(e))),n(" rank",(()=>qe(H(e)))),n(" injectEdgeLabelProxies",(()=>function(e){r.A(e.edges(),(function(n){var t=e.edge(n);if(t.width&&t.height){var r=e.node(n.v),o={rank:(e.node(n.w).rank-r.rank)/2+r.rank,e:n};Z(e,"edge-proxy",o,"_ep")}}))}(e))),n(" removeEmptyRanks",(()=>function(e){var n=Y.A(d.A(e.nodes(),(function(n){return e.node(n).rank}))),t=[];r.A(e.nodes(),(function(r){var o=e.node(r).rank-n;t[o]||(t[o]=[]),t[o].push(r)}));var o=0,i=e.graph().nodeRankFactor;r.A(t,(function(n,t){q.A(n)&&t%i!=0?--o:o&&r.A(n,(function(n){e.node(n).rank+=o}))}))}(e))),n(" nestingGraph.cleanup",(()=>function(e){var n=e.graph();e.removeNode(n.nestingRoot),delete n.nestingRoot,r.A(e.edges(),(function(n){e.edge(n).nestingEdge&&e.removeEdge(n)}))}(e))),n(" normalizeRanks",(()=>function(e){var n=Y.A(d.A(e.nodes(),(function(n){return e.node(n).rank})));r.A(e.nodes(),(function(t){var r=e.node(t);z.A(r,"rank")&&(r.rank-=n)}))}(e))),n(" assignRankMinMax",(()=>function(e){var n=0;r.A(e.nodes(),(function(t){var r=e.node(t);r.borderTop&&(r.minRank=e.node(r.borderTop).rank,r.maxRank=e.node(r.borderBottom).rank,n=F(n,r.maxRank))})),e.graph().maxRank=n}(e))),n(" removeEdgeLabelProxies",(()=>function(e){r.A(e.nodes(),(function(n){var t=e.node(n);"edge-proxy"===t.dummy&&(e.edge(t.e).labelRank=t.rank,e.removeNode(n))}))}(e))),n(" normalize.run",(()=>ae(e))),n(" parentDummyChains",(()=>En(e))),n(" addBorderSegments",(()=>function(e){r.A(e.children(),(function n(t){var o=e.children(t),i=e.node(t);if(o.length&&r.A(o,n),Object.prototype.hasOwnProperty.call(i,"minRank")){i.borderLeft=[],i.borderRight=[];for(var u=i.minRank,a=i.maxRank+1;ubn(e))),n(" insertSelfEdges",(()=>function(e){var n=Q(e);r.A(n,(function(n){var t=0;r.A(n,(function(n,o){var i=e.node(n);i.order=o+t,r.A(i.selfEdges,(function(n){Z(e,"selfedge",{width:n.label.width,height:n.label.height,rank:i.rank,order:o+ ++t,e:n.e,label:n.label},"_se")})),delete i.selfEdges}))}))}(e))),n(" adjustCoordinateSystem",(()=>function(e){var n=e.graph().rankdir.toLowerCase();"lr"!==n&&"rl"!==n||re(e)}(e))),n(" position",(()=>Mn(e))),n(" positionSelfEdges",(()=>function(e){r.A(e.nodes(),(function(n){var t=e.node(n);if("selfedge"===t.dummy){var r=e.node(t.e.v),o=r.x+r.width/2,i=r.y,u=t.x-o,a=r.height/2;e.setEdge(t.e,t.label),e.removeNode(n),t.label.points=[{x:o+2*u/3,y:i-a},{x:o+5*u/6,y:i-a},{x:o+u,y:i},{x:o+5*u/6,y:i+a},{x:o+2*u/3,y:i+a}],t.label.x=t.x,t.label.y=t.y}}))}(e))),n(" removeBorderNodes",(()=>function(e){r.A(e.nodes(),(function(n){if(e.children(n).length){var t=e.node(n),r=e.node(t.borderTop),o=e.node(t.borderBottom),i=e.node(D.A(t.borderLeft)),u=e.node(D.A(t.borderRight));t.width=Math.abs(u.x-i.x),t.height=Math.abs(o.y-r.y),t.x=i.x+t.width/2,t.y=r.y+t.height/2}})),r.A(e.nodes(),(function(n){"border"===e.node(n).dummy&&e.removeNode(n)}))}(e))),n(" normalize.undo",(()=>function(e){r.A(e.graph().dummyChains,(function(n){var t,r=e.node(n),o=r.edgeLabel;for(e.setEdge(r.edgeObj,o);r.dummy;)t=e.successors(n)[0],e.removeNode(n),o.points.push({x:r.x,y:r.y}),"edge-label"===r.dummy&&(o.x=r.x,o.y=r.y,o.width=r.width,o.height=r.height),n=t,r=e.node(n)}))}(e))),n(" fixupEdgeLabelCoords",(()=>function(e){r.A(e.edges(),(function(n){var t=e.edge(n);if(Object.prototype.hasOwnProperty.call(t,"x"))switch("l"!==t.labelpos&&"r"!==t.labelpos||(t.width-=t.labeloffset),t.labelpos){case"l":t.x-=t.width/2+t.labeloffset;break;case"r":t.x+=t.width/2+t.labeloffset}}))}(e))),n(" undoCoordinateSystem",(()=>te(e))),n(" translateGraph",(()=>function(e){var n=Number.POSITIVE_INFINITY,t=0,o=Number.POSITIVE_INFINITY,i=0,u=e.graph(),a=u.marginx||0,s=u.marginy||0;function d(e){var r=e.x,u=e.y,a=e.width,s=e.height;n=Math.min(n,r-a/2),t=Math.max(t,r+a/2),o=Math.min(o,u-s/2),i=Math.max(i,u+s/2)}r.A(e.nodes(),(function(n){d(e.node(n))})),r.A(e.edges(),(function(n){var t=e.edge(n);Object.prototype.hasOwnProperty.call(t,"x")&&d(t)})),n-=a,o-=s,r.A(e.nodes(),(function(t){var r=e.node(t);r.x-=n,r.y-=o})),r.A(e.edges(),(function(t){var i=e.edge(t);r.A(i.points,(function(e){e.x-=n,e.y-=o})),Object.prototype.hasOwnProperty.call(i,"x")&&(i.x-=n),Object.prototype.hasOwnProperty.call(i,"y")&&(i.y-=o)})),u.width=t-n+a,u.height=i-o+s}(e))),n(" assignNodeIntersects",(()=>function(e){r.A(e.edges(),(function(n){var t,r,o=e.edge(n),i=e.node(n.v),u=e.node(n.w);o.points?(t=o.points[0],r=o.points[o.points.length-1]):(o.points=[],t=u,r=i),o.points.unshift(K(i,t)),o.points.push(K(u,r))}))}(e))),n(" reversePoints",(()=>function(e){r.A(e.edges(),(function(n){var t=e.edge(n);t.reversed&&t.points.reverse()}))}(e))),n(" acyclic.undo",(()=>function(e){r.A(e.edges(),(function(n){var t=e.edge(n);if(t.reversed){e.removeEdge(n);var r=t.forwardName;delete t.reversed,delete t.forwardName,e.setEdge(n.w,n.v,t,r)}}))}(e)))}(n,t))),t(" updateInputGraph",(()=>function(e,n){r.A(e.nodes(),(function(t){var r=e.node(t),o=n.node(t);r&&(r.x=o.x,r.y=o.y,n.children(t).length&&(r.width=o.width,r.height=o.height))})),r.A(e.edges(),(function(t){var r=e.edge(t),o=n.edge(t);r.points=o.points,Object.prototype.hasOwnProperty.call(o,"x")&&(r.x=o.x,r.y=o.y)})),e.graph().width=n.graph().width,e.graph().height=n.graph().height}(e,n)))}))}var Fn=["nodesep","edgesep","ranksep","marginx","marginy"],Dn={ranksep:50,edgesep:20,nodesep:50,rankdir:"tb"},Sn=["acyclicer","ranker","rankdir","align"],Gn=["width","height"],Vn={width:0,height:0},Bn=["minlen","weight","width","height","labeloffset"],qn={minlen:1,weight:1,width:0,height:0,labeloffset:10,labelpos:"r"},Yn=["labelpos"];function zn(e,n){return B(I(e,n),Number)}function $n(e){var n={};return r.A(e,(function(e,t){n[t.toLowerCase()]=e})),n}},37981:(e,n,t)=>{t.d(n,{T:()=>w});var r=t(39142),o=t(89610),i=t(27422),u=t(94092),a=t(66401),s=t(8058),d=t(69592),c=t(13588),h=t(24326),f=t(99902),v=t(53533);const l=(0,h.A)((function(e){return(0,f.A)((0,c.A)(e,1,v.A,!0))}));var g=t(38207),p=t(89463),A="\0";class w{constructor(e={}){this._isDirected=!Object.prototype.hasOwnProperty.call(e,"directed")||e.directed,this._isMultigraph=!!Object.prototype.hasOwnProperty.call(e,"multigraph")&&e.multigraph,this._isCompound=!!Object.prototype.hasOwnProperty.call(e,"compound")&&e.compound,this._label=void 0,this._defaultNodeLabelFn=r.A(void 0),this._defaultEdgeLabelFn=r.A(void 0),this._nodes={},this._isCompound&&(this._parent={},this._children={},this._children[A]={}),this._in={},this._preds={},this._out={},this._sucs={},this._edgeObjs={},this._edgeLabels={}}isDirected(){return this._isDirected}isMultigraph(){return this._isMultigraph}isCompound(){return this._isCompound}setGraph(e){return this._label=e,this}graph(){return this._label}setDefaultNodeLabel(e){return o.A(e)||(e=r.A(e)),this._defaultNodeLabelFn=e,this}nodeCount(){return this._nodeCount}nodes(){return i.A(this._nodes)}sources(){var e=this;return u.A(this.nodes(),(function(n){return a.A(e._in[n])}))}sinks(){var e=this;return u.A(this.nodes(),(function(n){return a.A(e._out[n])}))}setNodes(e,n){var t=arguments,r=this;return s.A(e,(function(e){t.length>1?r.setNode(e,n):r.setNode(e)})),this}setNode(e,n){return Object.prototype.hasOwnProperty.call(this._nodes,e)?(arguments.length>1&&(this._nodes[e]=n),this):(this._nodes[e]=arguments.length>1?n:this._defaultNodeLabelFn(e),this._isCompound&&(this._parent[e]=A,this._children[e]={},this._children[A][e]=!0),this._in[e]={},this._preds[e]={},this._out[e]={},this._sucs[e]={},++this._nodeCount,this)}node(e){return this._nodes[e]}hasNode(e){return Object.prototype.hasOwnProperty.call(this._nodes,e)}removeNode(e){if(Object.prototype.hasOwnProperty.call(this._nodes,e)){var n=e=>this.removeEdge(this._edgeObjs[e]);delete this._nodes[e],this._isCompound&&(this._removeFromParentsChildList(e),delete this._parent[e],s.A(this.children(e),(e=>{this.setParent(e)})),delete this._children[e]),s.A(i.A(this._in[e]),n),delete this._in[e],delete this._preds[e],s.A(i.A(this._out[e]),n),delete this._out[e],delete this._sucs[e],--this._nodeCount}return this}setParent(e,n){if(!this._isCompound)throw new Error("Cannot set parent in a non-compound graph");if(d.A(n))n=A;else{for(var t=n+="";!d.A(t);t=this.parent(t))if(t===e)throw new Error("Setting "+n+" as parent of "+e+" would create a cycle");this.setNode(n)}return this.setNode(e),this._removeFromParentsChildList(e),this._parent[e]=n,this._children[n][e]=!0,this}_removeFromParentsChildList(e){delete this._children[this._parent[e]][e]}parent(e){if(this._isCompound){var n=this._parent[e];if(n!==A)return n}}children(e){if(d.A(e)&&(e=A),this._isCompound){var n=this._children[e];if(n)return i.A(n)}else{if(e===A)return this.nodes();if(this.hasNode(e))return[]}}predecessors(e){var n=this._preds[e];if(n)return i.A(n)}successors(e){var n=this._sucs[e];if(n)return i.A(n)}neighbors(e){var n=this.predecessors(e);if(n)return l(n,this.successors(e))}isLeaf(e){return 0===(this.isDirected()?this.successors(e):this.neighbors(e)).length}filterNodes(e){var n=new this.constructor({directed:this._isDirected,multigraph:this._isMultigraph,compound:this._isCompound});n.setGraph(this.graph());var t=this;s.A(this._nodes,(function(t,r){e(r)&&n.setNode(r,t)})),s.A(this._edgeObjs,(function(e){n.hasNode(e.v)&&n.hasNode(e.w)&&n.setEdge(e,t.edge(e))}));var r={};function o(e){var i=t.parent(e);return void 0===i||n.hasNode(i)?(r[e]=i,i):i in r?r[i]:o(i)}return this._isCompound&&s.A(n.nodes(),(function(e){n.setParent(e,o(e))})),n}setDefaultEdgeLabel(e){return o.A(e)||(e=r.A(e)),this._defaultEdgeLabelFn=e,this}edgeCount(){return this._edgeCount}edges(){return g.A(this._edgeObjs)}setPath(e,n){var t=this,r=arguments;return p.A(e,(function(e,o){return r.length>1?t.setEdge(e,o,n):t.setEdge(e,o),o})),this}setEdge(){var e,n,t,r,o=!1,i=arguments[0];"object"==typeof i&&null!==i&&"v"in i?(e=i.v,n=i.w,t=i.name,2===arguments.length&&(r=arguments[1],o=!0)):(e=i,n=arguments[1],t=arguments[3],arguments.length>2&&(r=arguments[2],o=!0)),e=""+e,n=""+n,d.A(t)||(t=""+t);var u=y(this._isDirected,e,n,t);if(Object.prototype.hasOwnProperty.call(this._edgeLabels,u))return o&&(this._edgeLabels[u]=r),this;if(!d.A(t)&&!this._isMultigraph)throw new Error("Cannot set a named edge when isMultigraph = false");this.setNode(e),this.setNode(n),this._edgeLabels[u]=o?r:this._defaultEdgeLabelFn(e,n,t);var a=function(e,n,t,r){var o=""+n,i=""+t;if(!e&&o>i){var u=o;o=i,i=u}var a={v:o,w:i};r&&(a.name=r);return a}(this._isDirected,e,n,t);return e=a.v,n=a.w,Object.freeze(a),this._edgeObjs[u]=a,b(this._preds[n],e),b(this._sucs[e],n),this._in[n][u]=a,this._out[e][u]=a,this._edgeCount++,this}edge(e,n,t){var r=1===arguments.length?_(this._isDirected,arguments[0]):y(this._isDirected,e,n,t);return this._edgeLabels[r]}hasEdge(e,n,t){var r=1===arguments.length?_(this._isDirected,arguments[0]):y(this._isDirected,e,n,t);return Object.prototype.hasOwnProperty.call(this._edgeLabels,r)}removeEdge(e,n,t){var r=1===arguments.length?_(this._isDirected,arguments[0]):y(this._isDirected,e,n,t),o=this._edgeObjs[r];return o&&(e=o.v,n=o.w,delete this._edgeLabels[r],delete this._edgeObjs[r],m(this._preds[n],e),m(this._sucs[e],n),delete this._in[n][r],delete this._out[e][r],this._edgeCount--),this}inEdges(e,n){var t=this._in[e];if(t){var r=g.A(t);return n?u.A(r,(function(e){return e.v===n})):r}}outEdges(e,n){var t=this._out[e];if(t){var r=g.A(t);return n?u.A(r,(function(e){return e.w===n})):r}}nodeEdges(e,n){var t=this.inEdges(e,n);if(t)return t.concat(this.outEdges(e,n))}}function b(e,n){e[n]?e[n]++:e[n]=1}function m(e,n){--e[n]||delete e[n]}function y(e,n,t,r){var o=""+n,i=""+t;if(!e&&o>i){var u=o;o=i,i=u}return o+"\x01"+i+"\x01"+(d.A(r)?"\0":r)}function _(e,n){return y(e,n.v,n.w,n.name)}w.prototype._nodeCount=0,w.prototype._edgeCount=0},697:(e,n,t)=>{t.d(n,{T:()=>r.T});var r=t(37981)},72559:(e,n,t)=>{t.d(n,{A:()=>o});var r=t(61882);const o=function(e,n,t){for(var o=-1,i=e.length;++o{t.d(n,{A:()=>r});const r=function(e,n){return e{t.d(n,{A:()=>i});var r=t(6240),o=t(38446);const i=function(e,n){var t=-1,i=(0,o.A)(e)?Array(e.length):[];return(0,r.A)(e,(function(e,r,o){i[++t]=n(e,r,o)})),i}},99354:(e,n,t)=>{t.d(n,{A:()=>c});var r=t(66318),o=t(52851),i=t(7819),u=t(25353),a=t(23149),s=t(30901);const d=function(e,n,t,r){if(!(0,a.A)(e))return e;for(var d=-1,c=(n=(0,i.A)(n,e)).length,h=c-1,f=e;null!=f&&++d{t.d(n,{A:()=>d});var r=t(24326),o=t(66984),i=t(6832),u=t(55615),a=Object.prototype,s=a.hasOwnProperty;const d=(0,r.A)((function(e,n){e=Object(e);var t=-1,r=n.length,d=r>2?n[2]:void 0;for(d&&(0,i.A)(n[0],n[1],d)&&(r=1);++t{t.d(n,{A:()=>c});var r=t(23958),o=t(38446),i=t(27422);const u=function(e){return function(n,t,u){var a=Object(n);if(!(0,o.A)(n)){var s=(0,r.A)(t,3);n=(0,i.A)(n),t=function(e){return s(a[e],e,a)}}var d=e(n,t,u);return d>-1?a[s?n[d]:d]:void 0}};var a=t(25707),s=t(18593),d=Math.max;const c=u((function(e,n,t){var o=null==e?0:e.length;if(!o)return-1;var i=null==t?0:(0,s.A)(t);return i<0&&(i=d(o+i,0)),(0,a.A)(e,(0,r.A)(n,3),i)}))},34098:(e,n,t)=>{t.d(n,{A:()=>o});var r=t(13588);const o=function(e){return(null==e?0:e.length)?(0,r.A)(e,1):[]}},48585:(e,n,t)=>{t.d(n,{A:()=>u});var r=Object.prototype.hasOwnProperty;const o=function(e,n){return null!=e&&r.call(e,n)};var i=t(85054);const u=function(e,n){return null!=e&&(0,i.A)(e,n,o)}},9703:(e,n,t)=>{t.d(n,{A:()=>u});var r=t(88496),o=t(92049),i=t(53098);const u=function(e){return"string"==typeof e||!(0,o.A)(e)&&(0,i.A)(e)&&"[object String]"==(0,r.A)(e)}},26666:(e,n,t)=>{t.d(n,{A:()=>r});const r=function(e){var n=null==e?0:e.length;return n?e[n-1]:void 0}},74722:(e,n,t)=>{t.d(n,{A:()=>a});var r=t(45572),o=t(23958),i=t(52568),u=t(92049);const a=function(e,n){return((0,u.A)(e)?r.A:i.A)(e,(0,o.A)(n,3))}},86452:(e,n,t)=>{t.d(n,{A:()=>u});var r=t(72559),o=t(36224),i=t(29008);const u=function(e){return e&&e.length?(0,r.A)(e,i.A,o.A):void 0}},74342:(e,n,t)=>{t.d(n,{A:()=>g});var r=/\s/;const o=function(e){for(var n=e.length;n--&&r.test(e.charAt(n)););return n};var i=/^\s+/;const u=function(e){return e?e.slice(0,o(e)+1).replace(i,""):e};var a=t(23149),s=t(61882),d=/^[-+]0x[0-9a-f]+$/i,c=/^0b[01]+$/i,h=/^0o[0-7]+$/i,f=parseInt;const v=function(e){if("number"==typeof e)return e;if((0,s.A)(e))return NaN;if((0,a.A)(e)){var n="function"==typeof e.valueOf?e.valueOf():e;e=(0,a.A)(n)?n+"":n}if("string"!=typeof e)return 0===e?e:+e;e=u(e);var t=c.test(e);return t||h.test(e)?f(e.slice(2),t?2:8):d.test(e)?NaN:+e};var l=1/0;const g=function(e){return e?(e=v(e))===l||e===-1/0?17976931348623157e292*(e<0?-1:1):e==e?e:0:0===e?e:0}},18593:(e,n,t)=>{t.d(n,{A:()=>o});var r=t(74342);const o=function(e){var n=(0,r.A)(e),t=n%1;return n==n?t?n-t:n:0}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/2387.7f9ca256.js b/pr-preview/pr-1071/assets/js/2387.7f9ca256.js
deleted file mode 100644
index 656ddac028..0000000000
--- a/pr-preview/pr-1071/assets/js/2387.7f9ca256.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[2387],{82387:(s,c,e)=>{e.d(c,{createGitGraphServices:()=>t.b});var t=e(82785);e(19369)}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/2496d21b.ee6432b9.js b/pr-preview/pr-1071/assets/js/2496d21b.ee6432b9.js
deleted file mode 100644
index f60ce7040b..0000000000
--- a/pr-preview/pr-1071/assets/js/2496d21b.ee6432b9.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[995],{83495:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>i,default:()=>h,frontMatter:()=>a,metadata:()=>s,toc:()=>d});const s=JSON.parse('{"id":"about/telemetry","title":"CLI telemetry","description":"The Contrast CLI sends telemetry data to Edgeless Systems when you use CLI commands.","source":"@site/docs/about/telemetry.md","sourceDirName":"about","slug":"/about/telemetry","permalink":"/contrast/pr-preview/pr-1071/next/about/telemetry","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/docs/about/telemetry.md","tags":[],"version":"current","frontMatter":{},"sidebar":"docs","previous":{"title":"Planned features and limitations","permalink":"/contrast/pr-preview/pr-1071/next/features-limitations"}}');var r=n(74848),o=n(28453);const a={},i="CLI telemetry",c={},d=[];function l(e){const t={a:"a",code:"code",em:"em",h1:"h1",header:"header",li:"li",p:"p",ul:"ul",...(0,o.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.header,{children:(0,r.jsx)(t.h1,{id:"cli-telemetry",children:"CLI telemetry"})}),"\n",(0,r.jsx)(t.p,{children:"The Contrast CLI sends telemetry data to Edgeless Systems when you use CLI commands.\nThis allows to understand how Contrast is used and to improve it."}),"\n",(0,r.jsx)(t.p,{children:"The CLI sends the following data:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"The CLI version"}),"\n",(0,r.jsx)(t.li,{children:"The CLI target OS and architecture (GOOS and GOARCH)"}),"\n",(0,r.jsx)(t.li,{children:"The command that was run"}),"\n",(0,r.jsx)(t.li,{children:"The kind of error that occurred (if any)"}),"\n"]}),"\n",(0,r.jsxs)(t.p,{children:["The CLI ",(0,r.jsx)(t.em,{children:"doesn't"})," collect sensitive information.\nThe implementation is open-source and can be reviewed."]}),"\n",(0,r.jsx)(t.p,{children:"IP addresses may be processed or stored for security purposes."}),"\n",(0,r.jsxs)(t.p,{children:["The data that the CLI collects adheres to the Edgeless Systems ",(0,r.jsx)(t.a,{href:"https://www.edgeless.systems/privacy",children:"privacy policy"}),"."]}),"\n",(0,r.jsxs)(t.p,{children:["You can disable telemetry by setting the environment variable ",(0,r.jsx)(t.code,{children:"DO_NOT_TRACK=1"})," before running the CLI."]})]})}function h(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(l,{...e})}):l(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>a,x:()=>i});var s=n(96540);const r={},o=s.createContext(r);function a(e){const t=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),s.createElement(o.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/250ffcdd.ae6e76ac.js b/pr-preview/pr-1071/assets/js/250ffcdd.ae6e76ac.js
deleted file mode 100644
index e79c1009e3..0000000000
--- a/pr-preview/pr-1071/assets/js/250ffcdd.ae6e76ac.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[2343],{30106:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>c,contentTitle:()=>r,default:()=>h,frontMatter:()=>a,metadata:()=>o,toc:()=>d});const o=JSON.parse('{"id":"troubleshooting","title":"Troubleshooting","description":"This section contains information on how to debug your Contrast deployment.","source":"@site/versioned_docs/version-0.8/troubleshooting.md","sourceDirName":".","slug":"/troubleshooting","permalink":"/contrast/pr-preview/pr-1071/0.8/troubleshooting","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.8/troubleshooting.md","tags":[],"version":"0.8","frontMatter":{},"sidebar":"docs","previous":{"title":"Workload deployment","permalink":"/contrast/pr-preview/pr-1071/0.8/deployment"},"next":{"title":"Overview","permalink":"/contrast/pr-preview/pr-1071/0.8/components/overview"}}');var i=t(74848),s=t(28453);const a={},r="Troubleshooting",c={},d=[{value:"Logging",id:"logging",level:2},{value:"CLI",id:"cli",level:3},{value:"Coordinator and Initializer",id:"coordinator-and-initializer",level:3},{value:"Pod fails to start",id:"pod-fails-to-start",level:2},{value:"Regenerating the policies",id:"regenerating-the-policies",level:3},{value:"Pin container images",id:"pin-container-images",level:3},{value:"Validate Contrast components match",id:"validate-contrast-components-match",level:3}];function l(e){const n={admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",p:"p",pre:"pre",ul:"ul",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.header,{children:(0,i.jsx)(n.h1,{id:"troubleshooting",children:"Troubleshooting"})}),"\n",(0,i.jsx)(n.p,{children:"This section contains information on how to debug your Contrast deployment."}),"\n",(0,i.jsx)(n.h2,{id:"logging",children:"Logging"}),"\n",(0,i.jsx)(n.p,{children:"Collecting logs can be a good first step to identify problems in your\ndeployment. Both the CLI and the Contrast Coordinator as well as the Initializer\ncan be configured to emit additional logs."}),"\n",(0,i.jsx)(n.h3,{id:"cli",children:"CLI"}),"\n",(0,i.jsxs)(n.p,{children:["The CLI logs can be configured with the ",(0,i.jsx)(n.code,{children:"--log-level"})," command-line flag, which\ncan be set to either ",(0,i.jsx)(n.code,{children:"debug"}),", ",(0,i.jsx)(n.code,{children:"info"}),", ",(0,i.jsx)(n.code,{children:"warn"})," or ",(0,i.jsx)(n.code,{children:"error"}),". The default is ",(0,i.jsx)(n.code,{children:"info"}),".\nSetting this to ",(0,i.jsx)(n.code,{children:"debug"})," can get more fine-grained information as to where the\nproblem lies."]}),"\n",(0,i.jsx)(n.h3,{id:"coordinator-and-initializer",children:"Coordinator and Initializer"}),"\n",(0,i.jsxs)(n.p,{children:["The logs from the Coordinator and the Initializer can be configured via the\nenvironment variables ",(0,i.jsx)(n.code,{children:"CONTRAST_LOG_LEVEL"}),", ",(0,i.jsx)(n.code,{children:"CONTRAST_LOG_FORMAT"})," and\n",(0,i.jsx)(n.code,{children:"CONTRAST_LOG_SUBSYSTEMS"}),"."]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"CONTRAST_LOG_LEVEL"})," can be set to one of either ",(0,i.jsx)(n.code,{children:"debug"}),", ",(0,i.jsx)(n.code,{children:"info"}),", ",(0,i.jsx)(n.code,{children:"warn"}),", or\n",(0,i.jsx)(n.code,{children:"error"}),", similar to the CLI (defaults to ",(0,i.jsx)(n.code,{children:"info"}),")."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"CONTRAST_LOG_FORMAT"})," can be set to ",(0,i.jsx)(n.code,{children:"text"})," or ",(0,i.jsx)(n.code,{children:"json"}),", determining the output\nformat (defaults to ",(0,i.jsx)(n.code,{children:"text"}),")."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"CONTRAST_LOG_SUBSYSTEMS"})," is a comma-seperated list of subsystems that should\nbe enabled for logging, which are disabled by default. Subsystems include:\n",(0,i.jsx)(n.code,{children:"snp-issuer"}),", ",(0,i.jsx)(n.code,{children:"kds-getter"}),", and ",(0,i.jsx)(n.code,{children:"snp-validator"}),". To enable all subsystems, use\n",(0,i.jsx)(n.code,{children:"*"})," as the value for this environment variable.\nWarnings and error messages from subsystems get printed regardless of whether\nthe subsystem is listed in the ",(0,i.jsx)(n.code,{children:"CONTRAST_LOG_SUBSYSTEMS"})," environment variable."]}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:"To configure debug logging with all subsystems for your Coordinator, add the\nfollowing variables to your container definition."}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:'spec: # v1.PodSpec\n containers:\n image: "ghcr.io/edgelesssys/contrast/coordinator:v0.8.1@sha256:bcd08a03096d38b350853c1dc8a595e0e8dd18e6af651bad4afd6838d842e257"\n name: coordinator\n env:\n - name: CONTRAST_LOG_LEVEL\n value: debug\n - name: CONTRAST_LOG_SUBSYSTEMS\n value: "*"\n # ...\n'})}),"\n",(0,i.jsx)(n.admonition,{type:"info",children:(0,i.jsxs)(n.p,{children:["While the Contrast Coordinator has a policy that allows certain configurations,\nthe Initializer and service mesh don't. When changing environment variables of other\nparts than the Coordinator, ensure to rerun ",(0,i.jsx)(n.code,{children:"contrast generate"})," to update the policy."]})}),"\n",(0,i.jsxs)(n.p,{children:["To access the logs generated by the Coordinator, you can use ",(0,i.jsx)(n.code,{children:"kubectl"})," with the\nfollowing command:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-sh",children:"kubectl logs \n"})}),"\n",(0,i.jsx)(n.h2,{id:"pod-fails-to-start",children:"Pod fails to start"}),"\n",(0,i.jsxs)(n.p,{children:["If the Coordinator or a workload pod fails to even start, it can be helpful to\nlook at the events of the pod during the startup process using the ",(0,i.jsx)(n.code,{children:"describe"}),"\ncommand."]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-sh",children:"kubectl -n events --for pod/\n"})}),"\n",(0,i.jsx)(n.p,{children:"Example output:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:'LAST SEEN TYPE REASON OBJECT MESSAGE\n32m Warning Failed Pod/coordinator-0 kubelet Error: failed to create containerd task: failed to create shim task: "CreateContainerRequest is blocked by policy: ...\n'})}),"\n",(0,i.jsx)(n.p,{children:"A common error, as in this example, is that the container creation was blocked by the\npolicy. Potential reasons are a modification of the deployment YAML without updating\nthe policies afterward, or a version mismatch between Contrast components."}),"\n",(0,i.jsx)(n.h3,{id:"regenerating-the-policies",children:"Regenerating the policies"}),"\n",(0,i.jsx)(n.p,{children:"To ensure there isn't a mismatch between Kubernetes resource YAML and the annotated\npolicies, rerun"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-sh",children:"contrast generate\n"})}),"\n",(0,i.jsx)(n.p,{children:"on your deployment. If any of the policy annotations change, re-deploy with the updated policies."}),"\n",(0,i.jsx)(n.h3,{id:"pin-container-images",children:"Pin container images"}),"\n",(0,i.jsx)(n.p,{children:"When generating the policies, Contrast will download the images specified in your deployment\nYAML and include their cryptographic identity. If the image tag is moved to another\ncontainer image after the policy has been generated, the image downloaded at deploy time\nwill differ from the one at generation time, and the policy enforcement won't allow the\ncontainer to be started in the pod VM."}),"\n",(0,i.jsxs)(n.p,{children:["To ensure the correct image is always used, pin the container image to a fixed ",(0,i.jsx)(n.code,{children:"sha256"}),":"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"image: ubuntu:22.04@sha256:19478ce7fc2ffbce89df29fea5725a8d12e57de52eb9ea570890dc5852aac1ac\n"})}),"\n",(0,i.jsxs)(n.p,{children:["This way, the same image will still be pulled when the container tag (",(0,i.jsx)(n.code,{children:"22.04"}),") is moved\nto another image."]}),"\n",(0,i.jsx)(n.h3,{id:"validate-contrast-components-match",children:"Validate Contrast components match"}),"\n",(0,i.jsx)(n.p,{children:"A version mismatch between Contrast components can cause policy validation or attestation\nto fail. Each Contrast runtime is identifiable based on its (shortened) measurement value\nused to name the runtime class version."}),"\n",(0,i.jsx)(n.p,{children:"First, analyze which runtime class is currently installed in your cluster by running"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-sh",children:"kubectl get runtimeclasses\n"})}),"\n",(0,i.jsx)(n.p,{children:"This should give you output similar to the following one."}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-sh",children:"NAME HANDLER AGE\ncontrast-cc-30bfa8706b542271ec9b7762bbb400af contrast-cc-30bfa8706b542271ec9b7762bbb400af 23d\ncontrast-cc-4d70a6e266cca46dfa8e41d92874e638 contrast-cc-4d70a6e266cca46dfa8e41d92874e638 7d\ncontrast-cc-b817659e094106f61bf6c178c27153ba contrast-cc-b817659e094106f61bf6c178c27153ba 2d19h\ncontrast-cc-beee79ca916b9e5dc59602788cbfb097 contrast-cc-beee79ca916b9e5dc59602788cbfb097 121m\nkata-cc-isolation kata-cc 45d\n"})}),"\n",(0,i.jsx)(n.p,{children:"The output shows that there are four Contrast runtime classes installed (as well as the runtime class provided\nby the AKS CoCo preview, which isn't used by Contrast)."}),"\n",(0,i.jsx)(n.p,{children:"Next, check if the pod that won't start has the correct runtime class configured, and the\nCoordinator uses the exact same runtime:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-sh",children:"kubectl -n get -o=jsonpath='{.spec.runtimeClassName}' pod/\nkubectl -n get -o=jsonpath='{.spec.runtimeClassName}' pod/\n"})}),"\n",(0,i.jsx)(n.p,{children:"The output should list the runtime class the pod is using:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-sh",children:"contrast-cc-beee79ca916b9e5dc59602788cbfb097\ncontrast-cc-beee79ca916b9e5dc59602788cbfb097\n"})}),"\n",(0,i.jsxs)(n.p,{children:["Version information about the currently used CLI can be obtained via the ",(0,i.jsx)(n.code,{children:"version"})," flag:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-sh",children:"contrast --version\n"})}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-sh",children:"contrast version v0.X.0\n\n runtime handler: contrast-cc-beee79ca916b9e5dc59602788cbfb097\n launch digest: beee79ca916b9e5dc59602788cbfb097721cde34943e1583a3918f21011a71c47f371f68e883f5e474a6d4053d931a35\n genpolicy version: 3.2.0.azl1.genpolicy0\n image versions: ghcr.io/edgelesssys/contrast/coordinator@sha256:...\n ghcr.io/edgelesssys/contrast/initializer@sha256:...\n"})})]})}function h(e={}){const{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},28453:(e,n,t)=>{t.d(n,{R:()=>a,x:()=>r});var o=t(96540);const i={},s=o.createContext(i);function a(e){const n=o.useContext(s);return o.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),o.createElement(s.Provider,{value:n},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/2560.c3661469.js b/pr-preview/pr-1071/assets/js/2560.c3661469.js
deleted file mode 100644
index 87abbbe412..0000000000
--- a/pr-preview/pr-1071/assets/js/2560.c3661469.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[2560],{83510:(e,t,n)=>{n.d(t,{A:()=>a});n(96540);var o=n(34164),s=n(23230),i=n(85225),r=n(74848);function a(e){let{className:t}=e;return(0,r.jsx)("main",{className:(0,o.A)("container margin-vert--xl",t),children:(0,r.jsx)("div",{className:"row",children:(0,r.jsxs)("div",{className:"col col--6 col--offset-3",children:[(0,r.jsx)(i.A,{as:"h1",className:"hero__title",children:(0,r.jsx)(s.A,{id:"theme.NotFound.title",description:"The title of the 404 page",children:"Page Not Found"})}),(0,r.jsx)("p",{children:(0,r.jsx)(s.A,{id:"theme.NotFound.p1",description:"The first paragraph of the 404 page",children:"We could not find what you were looking for."})}),(0,r.jsx)("p",{children:(0,r.jsx)(s.A,{id:"theme.NotFound.p2",description:"The 2nd paragraph of the 404 page",children:"Please contact the owner of the site that linked you to the original URL and let them know their link is broken."})})]})})})}},72560:(e,t,n)=>{n.r(t),n.d(t,{default:()=>c});n(96540);var o=n(23230),s=n(69817),i=n(53022),r=n(83510),a=n(74848);function c(){const e=(0,o.T)({id:"theme.NotFound.title",message:"Page Not Found"});return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(s.be,{title:e}),(0,a.jsx)(i.A,{children:(0,a.jsx)(r.A,{})})]})}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/2664.509e3099.js b/pr-preview/pr-1071/assets/js/2664.509e3099.js
deleted file mode 100644
index 6f0cf05b80..0000000000
--- a/pr-preview/pr-1071/assets/js/2664.509e3099.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[2664],{82664:(t,e,a)=>{a.d(e,{diagram:()=>Nt});var n=a(83814),i=a(8159),r=a(10009),s=a(20007),l=a(16750),o=function(){var t=(0,r.K2)((function(t,e,a,n){for(a=a||{},n=t.length;n--;a[t[n]]=e);return a}),"o"),e=[1,24],a=[1,25],n=[1,26],i=[1,27],s=[1,28],l=[1,63],o=[1,64],h=[1,65],d=[1,66],u=[1,67],p=[1,68],y=[1,69],g=[1,29],f=[1,30],b=[1,31],x=[1,32],_=[1,33],m=[1,34],E=[1,35],S=[1,36],A=[1,37],C=[1,38],w=[1,39],k=[1,40],O=[1,41],T=[1,42],v=[1,43],R=[1,44],D=[1,45],N=[1,46],P=[1,47],B=[1,48],I=[1,50],M=[1,51],j=[1,52],K=[1,53],L=[1,54],Y=[1,55],U=[1,56],F=[1,57],X=[1,58],z=[1,59],W=[1,60],Q=[14,42],$=[14,34,36,37,38,39,40,41,42,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74],H=[12,14,34,36,37,38,39,40,41,42,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74],q=[1,82],V=[1,83],G=[1,84],J=[1,85],Z=[12,14,42],tt=[12,14,33,42],et=[12,14,33,42,76,77,79,80],at=[12,33],nt=[34,36,37,38,39,40,41,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74],it={trace:(0,r.K2)((function(){}),"trace"),yy:{},symbols_:{error:2,start:3,mermaidDoc:4,direction:5,direction_tb:6,direction_bt:7,direction_rl:8,direction_lr:9,graphConfig:10,C4_CONTEXT:11,NEWLINE:12,statements:13,EOF:14,C4_CONTAINER:15,C4_COMPONENT:16,C4_DYNAMIC:17,C4_DEPLOYMENT:18,otherStatements:19,diagramStatements:20,otherStatement:21,title:22,accDescription:23,acc_title:24,acc_title_value:25,acc_descr:26,acc_descr_value:27,acc_descr_multiline_value:28,boundaryStatement:29,boundaryStartStatement:30,boundaryStopStatement:31,boundaryStart:32,LBRACE:33,ENTERPRISE_BOUNDARY:34,attributes:35,SYSTEM_BOUNDARY:36,BOUNDARY:37,CONTAINER_BOUNDARY:38,NODE:39,NODE_L:40,NODE_R:41,RBRACE:42,diagramStatement:43,PERSON:44,PERSON_EXT:45,SYSTEM:46,SYSTEM_DB:47,SYSTEM_QUEUE:48,SYSTEM_EXT:49,SYSTEM_EXT_DB:50,SYSTEM_EXT_QUEUE:51,CONTAINER:52,CONTAINER_DB:53,CONTAINER_QUEUE:54,CONTAINER_EXT:55,CONTAINER_EXT_DB:56,CONTAINER_EXT_QUEUE:57,COMPONENT:58,COMPONENT_DB:59,COMPONENT_QUEUE:60,COMPONENT_EXT:61,COMPONENT_EXT_DB:62,COMPONENT_EXT_QUEUE:63,REL:64,BIREL:65,REL_U:66,REL_D:67,REL_L:68,REL_R:69,REL_B:70,REL_INDEX:71,UPDATE_EL_STYLE:72,UPDATE_REL_STYLE:73,UPDATE_LAYOUT_CONFIG:74,attribute:75,STR:76,STR_KEY:77,STR_VALUE:78,ATTRIBUTE:79,ATTRIBUTE_EMPTY:80,$accept:0,$end:1},terminals_:{2:"error",6:"direction_tb",7:"direction_bt",8:"direction_rl",9:"direction_lr",11:"C4_CONTEXT",12:"NEWLINE",14:"EOF",15:"C4_CONTAINER",16:"C4_COMPONENT",17:"C4_DYNAMIC",18:"C4_DEPLOYMENT",22:"title",23:"accDescription",24:"acc_title",25:"acc_title_value",26:"acc_descr",27:"acc_descr_value",28:"acc_descr_multiline_value",33:"LBRACE",34:"ENTERPRISE_BOUNDARY",36:"SYSTEM_BOUNDARY",37:"BOUNDARY",38:"CONTAINER_BOUNDARY",39:"NODE",40:"NODE_L",41:"NODE_R",42:"RBRACE",44:"PERSON",45:"PERSON_EXT",46:"SYSTEM",47:"SYSTEM_DB",48:"SYSTEM_QUEUE",49:"SYSTEM_EXT",50:"SYSTEM_EXT_DB",51:"SYSTEM_EXT_QUEUE",52:"CONTAINER",53:"CONTAINER_DB",54:"CONTAINER_QUEUE",55:"CONTAINER_EXT",56:"CONTAINER_EXT_DB",57:"CONTAINER_EXT_QUEUE",58:"COMPONENT",59:"COMPONENT_DB",60:"COMPONENT_QUEUE",61:"COMPONENT_EXT",62:"COMPONENT_EXT_DB",63:"COMPONENT_EXT_QUEUE",64:"REL",65:"BIREL",66:"REL_U",67:"REL_D",68:"REL_L",69:"REL_R",70:"REL_B",71:"REL_INDEX",72:"UPDATE_EL_STYLE",73:"UPDATE_REL_STYLE",74:"UPDATE_LAYOUT_CONFIG",76:"STR",77:"STR_KEY",78:"STR_VALUE",79:"ATTRIBUTE",80:"ATTRIBUTE_EMPTY"},productions_:[0,[3,1],[3,1],[5,1],[5,1],[5,1],[5,1],[4,1],[10,4],[10,4],[10,4],[10,4],[10,4],[13,1],[13,1],[13,2],[19,1],[19,2],[19,3],[21,1],[21,1],[21,2],[21,2],[21,1],[29,3],[30,3],[30,3],[30,4],[32,2],[32,2],[32,2],[32,2],[32,2],[32,2],[32,2],[31,1],[20,1],[20,2],[20,3],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,1],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[43,2],[35,1],[35,2],[75,1],[75,2],[75,1],[75,1]],performAction:(0,r.K2)((function(t,e,a,n,i,r,s){var l=r.length-1;switch(i){case 3:n.setDirection("TB");break;case 4:n.setDirection("BT");break;case 5:n.setDirection("RL");break;case 6:n.setDirection("LR");break;case 8:case 9:case 10:case 11:case 12:n.setC4Type(r[l-3]);break;case 19:n.setTitle(r[l].substring(6)),this.$=r[l].substring(6);break;case 20:n.setAccDescription(r[l].substring(15)),this.$=r[l].substring(15);break;case 21:this.$=r[l].trim(),n.setTitle(this.$);break;case 22:case 23:this.$=r[l].trim(),n.setAccDescription(this.$);break;case 28:r[l].splice(2,0,"ENTERPRISE"),n.addPersonOrSystemBoundary(...r[l]),this.$=r[l];break;case 29:r[l].splice(2,0,"SYSTEM"),n.addPersonOrSystemBoundary(...r[l]),this.$=r[l];break;case 30:n.addPersonOrSystemBoundary(...r[l]),this.$=r[l];break;case 31:r[l].splice(2,0,"CONTAINER"),n.addContainerBoundary(...r[l]),this.$=r[l];break;case 32:n.addDeploymentNode("node",...r[l]),this.$=r[l];break;case 33:n.addDeploymentNode("nodeL",...r[l]),this.$=r[l];break;case 34:n.addDeploymentNode("nodeR",...r[l]),this.$=r[l];break;case 35:n.popBoundaryParseStack();break;case 39:n.addPersonOrSystem("person",...r[l]),this.$=r[l];break;case 40:n.addPersonOrSystem("external_person",...r[l]),this.$=r[l];break;case 41:n.addPersonOrSystem("system",...r[l]),this.$=r[l];break;case 42:n.addPersonOrSystem("system_db",...r[l]),this.$=r[l];break;case 43:n.addPersonOrSystem("system_queue",...r[l]),this.$=r[l];break;case 44:n.addPersonOrSystem("external_system",...r[l]),this.$=r[l];break;case 45:n.addPersonOrSystem("external_system_db",...r[l]),this.$=r[l];break;case 46:n.addPersonOrSystem("external_system_queue",...r[l]),this.$=r[l];break;case 47:n.addContainer("container",...r[l]),this.$=r[l];break;case 48:n.addContainer("container_db",...r[l]),this.$=r[l];break;case 49:n.addContainer("container_queue",...r[l]),this.$=r[l];break;case 50:n.addContainer("external_container",...r[l]),this.$=r[l];break;case 51:n.addContainer("external_container_db",...r[l]),this.$=r[l];break;case 52:n.addContainer("external_container_queue",...r[l]),this.$=r[l];break;case 53:n.addComponent("component",...r[l]),this.$=r[l];break;case 54:n.addComponent("component_db",...r[l]),this.$=r[l];break;case 55:n.addComponent("component_queue",...r[l]),this.$=r[l];break;case 56:n.addComponent("external_component",...r[l]),this.$=r[l];break;case 57:n.addComponent("external_component_db",...r[l]),this.$=r[l];break;case 58:n.addComponent("external_component_queue",...r[l]),this.$=r[l];break;case 60:n.addRel("rel",...r[l]),this.$=r[l];break;case 61:n.addRel("birel",...r[l]),this.$=r[l];break;case 62:n.addRel("rel_u",...r[l]),this.$=r[l];break;case 63:n.addRel("rel_d",...r[l]),this.$=r[l];break;case 64:n.addRel("rel_l",...r[l]),this.$=r[l];break;case 65:n.addRel("rel_r",...r[l]),this.$=r[l];break;case 66:n.addRel("rel_b",...r[l]),this.$=r[l];break;case 67:r[l].splice(0,1),n.addRel("rel",...r[l]),this.$=r[l];break;case 68:n.updateElStyle("update_el_style",...r[l]),this.$=r[l];break;case 69:n.updateRelStyle("update_rel_style",...r[l]),this.$=r[l];break;case 70:n.updateLayoutConfig("update_layout_config",...r[l]),this.$=r[l];break;case 71:this.$=[r[l]];break;case 72:r[l].unshift(r[l-1]),this.$=r[l];break;case 73:case 75:this.$=r[l].trim();break;case 74:let t={};t[r[l-1].trim()]=r[l].trim(),this.$=t;break;case 76:this.$=""}}),"anonymous"),table:[{3:1,4:2,5:3,6:[1,5],7:[1,6],8:[1,7],9:[1,8],10:4,11:[1,9],15:[1,10],16:[1,11],17:[1,12],18:[1,13]},{1:[3]},{1:[2,1]},{1:[2,2]},{1:[2,7]},{1:[2,3]},{1:[2,4]},{1:[2,5]},{1:[2,6]},{12:[1,14]},{12:[1,15]},{12:[1,16]},{12:[1,17]},{12:[1,18]},{13:19,19:20,20:21,21:22,22:e,23:a,24:n,26:i,28:s,29:49,30:61,32:62,34:l,36:o,37:h,38:d,39:u,40:p,41:y,43:23,44:g,45:f,46:b,47:x,48:_,49:m,50:E,51:S,52:A,53:C,54:w,55:k,56:O,57:T,58:v,59:R,60:D,61:N,62:P,63:B,64:I,65:M,66:j,67:K,68:L,69:Y,70:U,71:F,72:X,73:z,74:W},{13:70,19:20,20:21,21:22,22:e,23:a,24:n,26:i,28:s,29:49,30:61,32:62,34:l,36:o,37:h,38:d,39:u,40:p,41:y,43:23,44:g,45:f,46:b,47:x,48:_,49:m,50:E,51:S,52:A,53:C,54:w,55:k,56:O,57:T,58:v,59:R,60:D,61:N,62:P,63:B,64:I,65:M,66:j,67:K,68:L,69:Y,70:U,71:F,72:X,73:z,74:W},{13:71,19:20,20:21,21:22,22:e,23:a,24:n,26:i,28:s,29:49,30:61,32:62,34:l,36:o,37:h,38:d,39:u,40:p,41:y,43:23,44:g,45:f,46:b,47:x,48:_,49:m,50:E,51:S,52:A,53:C,54:w,55:k,56:O,57:T,58:v,59:R,60:D,61:N,62:P,63:B,64:I,65:M,66:j,67:K,68:L,69:Y,70:U,71:F,72:X,73:z,74:W},{13:72,19:20,20:21,21:22,22:e,23:a,24:n,26:i,28:s,29:49,30:61,32:62,34:l,36:o,37:h,38:d,39:u,40:p,41:y,43:23,44:g,45:f,46:b,47:x,48:_,49:m,50:E,51:S,52:A,53:C,54:w,55:k,56:O,57:T,58:v,59:R,60:D,61:N,62:P,63:B,64:I,65:M,66:j,67:K,68:L,69:Y,70:U,71:F,72:X,73:z,74:W},{13:73,19:20,20:21,21:22,22:e,23:a,24:n,26:i,28:s,29:49,30:61,32:62,34:l,36:o,37:h,38:d,39:u,40:p,41:y,43:23,44:g,45:f,46:b,47:x,48:_,49:m,50:E,51:S,52:A,53:C,54:w,55:k,56:O,57:T,58:v,59:R,60:D,61:N,62:P,63:B,64:I,65:M,66:j,67:K,68:L,69:Y,70:U,71:F,72:X,73:z,74:W},{14:[1,74]},t(Q,[2,13],{43:23,29:49,30:61,32:62,20:75,34:l,36:o,37:h,38:d,39:u,40:p,41:y,44:g,45:f,46:b,47:x,48:_,49:m,50:E,51:S,52:A,53:C,54:w,55:k,56:O,57:T,58:v,59:R,60:D,61:N,62:P,63:B,64:I,65:M,66:j,67:K,68:L,69:Y,70:U,71:F,72:X,73:z,74:W}),t(Q,[2,14]),t($,[2,16],{12:[1,76]}),t(Q,[2,36],{12:[1,77]}),t(H,[2,19]),t(H,[2,20]),{25:[1,78]},{27:[1,79]},t(H,[2,23]),{35:80,75:81,76:q,77:V,79:G,80:J},{35:86,75:81,76:q,77:V,79:G,80:J},{35:87,75:81,76:q,77:V,79:G,80:J},{35:88,75:81,76:q,77:V,79:G,80:J},{35:89,75:81,76:q,77:V,79:G,80:J},{35:90,75:81,76:q,77:V,79:G,80:J},{35:91,75:81,76:q,77:V,79:G,80:J},{35:92,75:81,76:q,77:V,79:G,80:J},{35:93,75:81,76:q,77:V,79:G,80:J},{35:94,75:81,76:q,77:V,79:G,80:J},{35:95,75:81,76:q,77:V,79:G,80:J},{35:96,75:81,76:q,77:V,79:G,80:J},{35:97,75:81,76:q,77:V,79:G,80:J},{35:98,75:81,76:q,77:V,79:G,80:J},{35:99,75:81,76:q,77:V,79:G,80:J},{35:100,75:81,76:q,77:V,79:G,80:J},{35:101,75:81,76:q,77:V,79:G,80:J},{35:102,75:81,76:q,77:V,79:G,80:J},{35:103,75:81,76:q,77:V,79:G,80:J},{35:104,75:81,76:q,77:V,79:G,80:J},t(Z,[2,59]),{35:105,75:81,76:q,77:V,79:G,80:J},{35:106,75:81,76:q,77:V,79:G,80:J},{35:107,75:81,76:q,77:V,79:G,80:J},{35:108,75:81,76:q,77:V,79:G,80:J},{35:109,75:81,76:q,77:V,79:G,80:J},{35:110,75:81,76:q,77:V,79:G,80:J},{35:111,75:81,76:q,77:V,79:G,80:J},{35:112,75:81,76:q,77:V,79:G,80:J},{35:113,75:81,76:q,77:V,79:G,80:J},{35:114,75:81,76:q,77:V,79:G,80:J},{35:115,75:81,76:q,77:V,79:G,80:J},{20:116,29:49,30:61,32:62,34:l,36:o,37:h,38:d,39:u,40:p,41:y,43:23,44:g,45:f,46:b,47:x,48:_,49:m,50:E,51:S,52:A,53:C,54:w,55:k,56:O,57:T,58:v,59:R,60:D,61:N,62:P,63:B,64:I,65:M,66:j,67:K,68:L,69:Y,70:U,71:F,72:X,73:z,74:W},{12:[1,118],33:[1,117]},{35:119,75:81,76:q,77:V,79:G,80:J},{35:120,75:81,76:q,77:V,79:G,80:J},{35:121,75:81,76:q,77:V,79:G,80:J},{35:122,75:81,76:q,77:V,79:G,80:J},{35:123,75:81,76:q,77:V,79:G,80:J},{35:124,75:81,76:q,77:V,79:G,80:J},{35:125,75:81,76:q,77:V,79:G,80:J},{14:[1,126]},{14:[1,127]},{14:[1,128]},{14:[1,129]},{1:[2,8]},t(Q,[2,15]),t($,[2,17],{21:22,19:130,22:e,23:a,24:n,26:i,28:s}),t(Q,[2,37],{19:20,20:21,21:22,43:23,29:49,30:61,32:62,13:131,22:e,23:a,24:n,26:i,28:s,34:l,36:o,37:h,38:d,39:u,40:p,41:y,44:g,45:f,46:b,47:x,48:_,49:m,50:E,51:S,52:A,53:C,54:w,55:k,56:O,57:T,58:v,59:R,60:D,61:N,62:P,63:B,64:I,65:M,66:j,67:K,68:L,69:Y,70:U,71:F,72:X,73:z,74:W}),t(H,[2,21]),t(H,[2,22]),t(Z,[2,39]),t(tt,[2,71],{75:81,35:132,76:q,77:V,79:G,80:J}),t(et,[2,73]),{78:[1,133]},t(et,[2,75]),t(et,[2,76]),t(Z,[2,40]),t(Z,[2,41]),t(Z,[2,42]),t(Z,[2,43]),t(Z,[2,44]),t(Z,[2,45]),t(Z,[2,46]),t(Z,[2,47]),t(Z,[2,48]),t(Z,[2,49]),t(Z,[2,50]),t(Z,[2,51]),t(Z,[2,52]),t(Z,[2,53]),t(Z,[2,54]),t(Z,[2,55]),t(Z,[2,56]),t(Z,[2,57]),t(Z,[2,58]),t(Z,[2,60]),t(Z,[2,61]),t(Z,[2,62]),t(Z,[2,63]),t(Z,[2,64]),t(Z,[2,65]),t(Z,[2,66]),t(Z,[2,67]),t(Z,[2,68]),t(Z,[2,69]),t(Z,[2,70]),{31:134,42:[1,135]},{12:[1,136]},{33:[1,137]},t(at,[2,28]),t(at,[2,29]),t(at,[2,30]),t(at,[2,31]),t(at,[2,32]),t(at,[2,33]),t(at,[2,34]),{1:[2,9]},{1:[2,10]},{1:[2,11]},{1:[2,12]},t($,[2,18]),t(Q,[2,38]),t(tt,[2,72]),t(et,[2,74]),t(Z,[2,24]),t(Z,[2,35]),t(nt,[2,25]),t(nt,[2,26],{12:[1,138]}),t(nt,[2,27])],defaultActions:{2:[2,1],3:[2,2],4:[2,7],5:[2,3],6:[2,4],7:[2,5],8:[2,6],74:[2,8],126:[2,9],127:[2,10],128:[2,11],129:[2,12]},parseError:(0,r.K2)((function(t,e){if(!e.recoverable){var a=new Error(t);throw a.hash=e,a}this.trace(t)}),"parseError"),parse:(0,r.K2)((function(t){var e=this,a=[0],n=[],i=[null],s=[],l=this.table,o="",c=0,h=0,d=0,u=s.slice.call(arguments,1),p=Object.create(this.lexer),y={yy:{}};for(var g in this.yy)Object.prototype.hasOwnProperty.call(this.yy,g)&&(y.yy[g]=this.yy[g]);p.setInput(t,y.yy),y.yy.lexer=p,y.yy.parser=this,void 0===p.yylloc&&(p.yylloc={});var f=p.yylloc;s.push(f);var b=p.options&&p.options.ranges;function x(){var t;return"number"!=typeof(t=n.pop()||p.lex()||1)&&(t instanceof Array&&(t=(n=t).pop()),t=e.symbols_[t]||t),t}"function"==typeof y.yy.parseError?this.parseError=y.yy.parseError:this.parseError=Object.getPrototypeOf(this).parseError,(0,r.K2)((function(t){a.length=a.length-2*t,i.length=i.length-t,s.length=s.length-t}),"popStack"),(0,r.K2)(x,"lex");for(var _,m,E,S,A,C,w,k,O,T={};;){if(E=a[a.length-1],this.defaultActions[E]?S=this.defaultActions[E]:(null==_&&(_=x()),S=l[E]&&l[E][_]),void 0===S||!S.length||!S[0]){var v="";for(C in O=[],l[E])this.terminals_[C]&&C>2&&O.push("'"+this.terminals_[C]+"'");v=p.showPosition?"Parse error on line "+(c+1)+":\n"+p.showPosition()+"\nExpecting "+O.join(", ")+", got '"+(this.terminals_[_]||_)+"'":"Parse error on line "+(c+1)+": Unexpected "+(1==_?"end of input":"'"+(this.terminals_[_]||_)+"'"),this.parseError(v,{text:p.match,token:this.terminals_[_]||_,line:p.yylineno,loc:f,expected:O})}if(S[0]instanceof Array&&S.length>1)throw new Error("Parse Error: multiple actions possible at state: "+E+", token: "+_);switch(S[0]){case 1:a.push(_),i.push(p.yytext),s.push(p.yylloc),a.push(S[1]),_=null,m?(_=m,m=null):(h=p.yyleng,o=p.yytext,c=p.yylineno,f=p.yylloc,d>0&&d--);break;case 2:if(w=this.productions_[S[1]][1],T.$=i[i.length-w],T._$={first_line:s[s.length-(w||1)].first_line,last_line:s[s.length-1].last_line,first_column:s[s.length-(w||1)].first_column,last_column:s[s.length-1].last_column},b&&(T._$.range=[s[s.length-(w||1)].range[0],s[s.length-1].range[1]]),void 0!==(A=this.performAction.apply(T,[o,h,c,y.yy,S[1],i,s].concat(u))))return A;w&&(a=a.slice(0,-1*w*2),i=i.slice(0,-1*w),s=s.slice(0,-1*w)),a.push(this.productions_[S[1]][0]),i.push(T.$),s.push(T._$),k=l[a[a.length-2]][a[a.length-1]],a.push(k);break;case 3:return!0}}return!0}),"parse")},rt=function(){return{EOF:1,parseError:(0,r.K2)((function(t,e){if(!this.yy.parser)throw new Error(t);this.yy.parser.parseError(t,e)}),"parseError"),setInput:(0,r.K2)((function(t,e){return this.yy=e||this.yy||{},this._input=t,this._more=this._backtrack=this.done=!1,this.yylineno=this.yyleng=0,this.yytext=this.matched=this.match="",this.conditionStack=["INITIAL"],this.yylloc={first_line:1,first_column:0,last_line:1,last_column:0},this.options.ranges&&(this.yylloc.range=[0,0]),this.offset=0,this}),"setInput"),input:(0,r.K2)((function(){var t=this._input[0];return this.yytext+=t,this.yyleng++,this.offset++,this.match+=t,this.matched+=t,t.match(/(?:\r\n?|\n).*/g)?(this.yylineno++,this.yylloc.last_line++):this.yylloc.last_column++,this.options.ranges&&this.yylloc.range[1]++,this._input=this._input.slice(1),t}),"input"),unput:(0,r.K2)((function(t){var e=t.length,a=t.split(/(?:\r\n?|\n)/g);this._input=t+this._input,this.yytext=this.yytext.substr(0,this.yytext.length-e),this.offset-=e;var n=this.match.split(/(?:\r\n?|\n)/g);this.match=this.match.substr(0,this.match.length-1),this.matched=this.matched.substr(0,this.matched.length-1),a.length-1&&(this.yylineno-=a.length-1);var i=this.yylloc.range;return this.yylloc={first_line:this.yylloc.first_line,last_line:this.yylineno+1,first_column:this.yylloc.first_column,last_column:a?(a.length===n.length?this.yylloc.first_column:0)+n[n.length-a.length].length-a[0].length:this.yylloc.first_column-e},this.options.ranges&&(this.yylloc.range=[i[0],i[0]+this.yyleng-e]),this.yyleng=this.yytext.length,this}),"unput"),more:(0,r.K2)((function(){return this._more=!0,this}),"more"),reject:(0,r.K2)((function(){return this.options.backtrack_lexer?(this._backtrack=!0,this):this.parseError("Lexical error on line "+(this.yylineno+1)+". You can only invoke reject() in the lexer when the lexer is of the backtracking persuasion (options.backtrack_lexer = true).\n"+this.showPosition(),{text:"",token:null,line:this.yylineno})}),"reject"),less:(0,r.K2)((function(t){this.unput(this.match.slice(t))}),"less"),pastInput:(0,r.K2)((function(){var t=this.matched.substr(0,this.matched.length-this.match.length);return(t.length>20?"...":"")+t.substr(-20).replace(/\n/g,"")}),"pastInput"),upcomingInput:(0,r.K2)((function(){var t=this.match;return t.length<20&&(t+=this._input.substr(0,20-t.length)),(t.substr(0,20)+(t.length>20?"...":"")).replace(/\n/g,"")}),"upcomingInput"),showPosition:(0,r.K2)((function(){var t=this.pastInput(),e=new Array(t.length+1).join("-");return t+this.upcomingInput()+"\n"+e+"^"}),"showPosition"),test_match:(0,r.K2)((function(t,e){var a,n,i;if(this.options.backtrack_lexer&&(i={yylineno:this.yylineno,yylloc:{first_line:this.yylloc.first_line,last_line:this.last_line,first_column:this.yylloc.first_column,last_column:this.yylloc.last_column},yytext:this.yytext,match:this.match,matches:this.matches,matched:this.matched,yyleng:this.yyleng,offset:this.offset,_more:this._more,_input:this._input,yy:this.yy,conditionStack:this.conditionStack.slice(0),done:this.done},this.options.ranges&&(i.yylloc.range=this.yylloc.range.slice(0))),(n=t[0].match(/(?:\r\n?|\n).*/g))&&(this.yylineno+=n.length),this.yylloc={first_line:this.yylloc.last_line,last_line:this.yylineno+1,first_column:this.yylloc.last_column,last_column:n?n[n.length-1].length-n[n.length-1].match(/\r?\n?/)[0].length:this.yylloc.last_column+t[0].length},this.yytext+=t[0],this.match+=t[0],this.matches=t,this.yyleng=this.yytext.length,this.options.ranges&&(this.yylloc.range=[this.offset,this.offset+=this.yyleng]),this._more=!1,this._backtrack=!1,this._input=this._input.slice(t[0].length),this.matched+=t[0],a=this.performAction.call(this,this.yy,this,e,this.conditionStack[this.conditionStack.length-1]),this.done&&this._input&&(this.done=!1),a)return a;if(this._backtrack){for(var r in i)this[r]=i[r];return!1}return!1}),"test_match"),next:(0,r.K2)((function(){if(this.done)return this.EOF;var t,e,a,n;this._input||(this.done=!0),this._more||(this.yytext="",this.match="");for(var i=this._currentRules(),r=0;re[0].length)){if(e=a,n=r,this.options.backtrack_lexer){if(!1!==(t=this.test_match(a,i[r])))return t;if(this._backtrack){e=!1;continue}return!1}if(!this.options.flex)break}return e?!1!==(t=this.test_match(e,i[n]))&&t:""===this._input?this.EOF:this.parseError("Lexical error on line "+(this.yylineno+1)+". Unrecognized text.\n"+this.showPosition(),{text:"",token:null,line:this.yylineno})}),"next"),lex:(0,r.K2)((function(){var t=this.next();return t||this.lex()}),"lex"),begin:(0,r.K2)((function(t){this.conditionStack.push(t)}),"begin"),popState:(0,r.K2)((function(){return this.conditionStack.length-1>0?this.conditionStack.pop():this.conditionStack[0]}),"popState"),_currentRules:(0,r.K2)((function(){return this.conditionStack.length&&this.conditionStack[this.conditionStack.length-1]?this.conditions[this.conditionStack[this.conditionStack.length-1]].rules:this.conditions.INITIAL.rules}),"_currentRules"),topState:(0,r.K2)((function(t){return(t=this.conditionStack.length-1-Math.abs(t||0))>=0?this.conditionStack[t]:"INITIAL"}),"topState"),pushState:(0,r.K2)((function(t){this.begin(t)}),"pushState"),stateStackSize:(0,r.K2)((function(){return this.conditionStack.length}),"stateStackSize"),options:{},performAction:(0,r.K2)((function(t,e,a,n){switch(a){case 0:return 6;case 1:return 7;case 2:return 8;case 3:return 9;case 4:return 22;case 5:return 23;case 6:return this.begin("acc_title"),24;case 7:return this.popState(),"acc_title_value";case 8:return this.begin("acc_descr"),26;case 9:return this.popState(),"acc_descr_value";case 10:this.begin("acc_descr_multiline");break;case 11:case 73:this.popState();break;case 12:return"acc_descr_multiline_value";case 13:case 16:case 70:break;case 14:c;break;case 15:return 12;case 17:return 11;case 18:return 15;case 19:return 16;case 20:return 17;case 21:return 18;case 22:return this.begin("person_ext"),45;case 23:return this.begin("person"),44;case 24:return this.begin("system_ext_queue"),51;case 25:return this.begin("system_ext_db"),50;case 26:return this.begin("system_ext"),49;case 27:return this.begin("system_queue"),48;case 28:return this.begin("system_db"),47;case 29:return this.begin("system"),46;case 30:return this.begin("boundary"),37;case 31:return this.begin("enterprise_boundary"),34;case 32:return this.begin("system_boundary"),36;case 33:return this.begin("container_ext_queue"),57;case 34:return this.begin("container_ext_db"),56;case 35:return this.begin("container_ext"),55;case 36:return this.begin("container_queue"),54;case 37:return this.begin("container_db"),53;case 38:return this.begin("container"),52;case 39:return this.begin("container_boundary"),38;case 40:return this.begin("component_ext_queue"),63;case 41:return this.begin("component_ext_db"),62;case 42:return this.begin("component_ext"),61;case 43:return this.begin("component_queue"),60;case 44:return this.begin("component_db"),59;case 45:return this.begin("component"),58;case 46:case 47:return this.begin("node"),39;case 48:return this.begin("node_l"),40;case 49:return this.begin("node_r"),41;case 50:return this.begin("rel"),64;case 51:return this.begin("birel"),65;case 52:case 53:return this.begin("rel_u"),66;case 54:case 55:return this.begin("rel_d"),67;case 56:case 57:return this.begin("rel_l"),68;case 58:case 59:return this.begin("rel_r"),69;case 60:return this.begin("rel_b"),70;case 61:return this.begin("rel_index"),71;case 62:return this.begin("update_el_style"),72;case 63:return this.begin("update_rel_style"),73;case 64:return this.begin("update_layout_config"),74;case 65:return"EOF_IN_STRUCT";case 66:return this.begin("attribute"),"ATTRIBUTE_EMPTY";case 67:this.begin("attribute");break;case 68:case 79:this.popState(),this.popState();break;case 69:case 71:return 80;case 72:this.begin("string");break;case 74:case 80:return"STR";case 75:this.begin("string_kv");break;case 76:return this.begin("string_kv_key"),"STR_KEY";case 77:this.popState(),this.begin("string_kv_value");break;case 78:return"STR_VALUE";case 81:return"LBRACE";case 82:return"RBRACE";case 83:return"SPACE";case 84:return"EOL";case 85:return 14}}),"anonymous"),rules:[/^(?:.*direction\s+TB[^\n]*)/,/^(?:.*direction\s+BT[^\n]*)/,/^(?:.*direction\s+RL[^\n]*)/,/^(?:.*direction\s+LR[^\n]*)/,/^(?:title\s[^#\n;]+)/,/^(?:accDescription\s[^#\n;]+)/,/^(?:accTitle\s*:\s*)/,/^(?:(?!\n||)*[^\n]*)/,/^(?:accDescr\s*:\s*)/,/^(?:(?!\n||)*[^\n]*)/,/^(?:accDescr\s*\{\s*)/,/^(?:[\}])/,/^(?:[^\}]*)/,/^(?:%%(?!\{)*[^\n]*(\r?\n?)+)/,/^(?:%%[^\n]*(\r?\n)*)/,/^(?:\s*(\r?\n)+)/,/^(?:\s+)/,/^(?:C4Context\b)/,/^(?:C4Container\b)/,/^(?:C4Component\b)/,/^(?:C4Dynamic\b)/,/^(?:C4Deployment\b)/,/^(?:Person_Ext\b)/,/^(?:Person\b)/,/^(?:SystemQueue_Ext\b)/,/^(?:SystemDb_Ext\b)/,/^(?:System_Ext\b)/,/^(?:SystemQueue\b)/,/^(?:SystemDb\b)/,/^(?:System\b)/,/^(?:Boundary\b)/,/^(?:Enterprise_Boundary\b)/,/^(?:System_Boundary\b)/,/^(?:ContainerQueue_Ext\b)/,/^(?:ContainerDb_Ext\b)/,/^(?:Container_Ext\b)/,/^(?:ContainerQueue\b)/,/^(?:ContainerDb\b)/,/^(?:Container\b)/,/^(?:Container_Boundary\b)/,/^(?:ComponentQueue_Ext\b)/,/^(?:ComponentDb_Ext\b)/,/^(?:Component_Ext\b)/,/^(?:ComponentQueue\b)/,/^(?:ComponentDb\b)/,/^(?:Component\b)/,/^(?:Deployment_Node\b)/,/^(?:Node\b)/,/^(?:Node_L\b)/,/^(?:Node_R\b)/,/^(?:Rel\b)/,/^(?:BiRel\b)/,/^(?:Rel_Up\b)/,/^(?:Rel_U\b)/,/^(?:Rel_Down\b)/,/^(?:Rel_D\b)/,/^(?:Rel_Left\b)/,/^(?:Rel_L\b)/,/^(?:Rel_Right\b)/,/^(?:Rel_R\b)/,/^(?:Rel_Back\b)/,/^(?:RelIndex\b)/,/^(?:UpdateElementStyle\b)/,/^(?:UpdateRelStyle\b)/,/^(?:UpdateLayoutConfig\b)/,/^(?:$)/,/^(?:[(][ ]*[,])/,/^(?:[(])/,/^(?:[)])/,/^(?:,,)/,/^(?:,)/,/^(?:[ ]*["]["])/,/^(?:[ ]*["])/,/^(?:["])/,/^(?:[^"]*)/,/^(?:[ ]*[\$])/,/^(?:[^=]*)/,/^(?:[=][ ]*["])/,/^(?:[^"]+)/,/^(?:["])/,/^(?:[^,]+)/,/^(?:\{)/,/^(?:\})/,/^(?:[\s]+)/,/^(?:[\n\r]+)/,/^(?:$)/],conditions:{acc_descr_multiline:{rules:[11,12],inclusive:!1},acc_descr:{rules:[9],inclusive:!1},acc_title:{rules:[7],inclusive:!1},string_kv_value:{rules:[78,79],inclusive:!1},string_kv_key:{rules:[77],inclusive:!1},string_kv:{rules:[76],inclusive:!1},string:{rules:[73,74],inclusive:!1},attribute:{rules:[68,69,70,71,72,75,80],inclusive:!1},update_layout_config:{rules:[65,66,67,68],inclusive:!1},update_rel_style:{rules:[65,66,67,68],inclusive:!1},update_el_style:{rules:[65,66,67,68],inclusive:!1},rel_b:{rules:[65,66,67,68],inclusive:!1},rel_r:{rules:[65,66,67,68],inclusive:!1},rel_l:{rules:[65,66,67,68],inclusive:!1},rel_d:{rules:[65,66,67,68],inclusive:!1},rel_u:{rules:[65,66,67,68],inclusive:!1},rel_bi:{rules:[],inclusive:!1},rel:{rules:[65,66,67,68],inclusive:!1},node_r:{rules:[65,66,67,68],inclusive:!1},node_l:{rules:[65,66,67,68],inclusive:!1},node:{rules:[65,66,67,68],inclusive:!1},index:{rules:[],inclusive:!1},rel_index:{rules:[65,66,67,68],inclusive:!1},component_ext_queue:{rules:[],inclusive:!1},component_ext_db:{rules:[65,66,67,68],inclusive:!1},component_ext:{rules:[65,66,67,68],inclusive:!1},component_queue:{rules:[65,66,67,68],inclusive:!1},component_db:{rules:[65,66,67,68],inclusive:!1},component:{rules:[65,66,67,68],inclusive:!1},container_boundary:{rules:[65,66,67,68],inclusive:!1},container_ext_queue:{rules:[65,66,67,68],inclusive:!1},container_ext_db:{rules:[65,66,67,68],inclusive:!1},container_ext:{rules:[65,66,67,68],inclusive:!1},container_queue:{rules:[65,66,67,68],inclusive:!1},container_db:{rules:[65,66,67,68],inclusive:!1},container:{rules:[65,66,67,68],inclusive:!1},birel:{rules:[65,66,67,68],inclusive:!1},system_boundary:{rules:[65,66,67,68],inclusive:!1},enterprise_boundary:{rules:[65,66,67,68],inclusive:!1},boundary:{rules:[65,66,67,68],inclusive:!1},system_ext_queue:{rules:[65,66,67,68],inclusive:!1},system_ext_db:{rules:[65,66,67,68],inclusive:!1},system_ext:{rules:[65,66,67,68],inclusive:!1},system_queue:{rules:[65,66,67,68],inclusive:!1},system_db:{rules:[65,66,67,68],inclusive:!1},system:{rules:[65,66,67,68],inclusive:!1},person_ext:{rules:[65,66,67,68],inclusive:!1},person:{rules:[65,66,67,68],inclusive:!1},INITIAL:{rules:[0,1,2,3,4,5,6,8,10,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,81,82,83,84,85],inclusive:!0}}}}();function st(){this.yy={}}return it.lexer=rt,(0,r.K2)(st,"Parser"),st.prototype=it,it.Parser=st,new st}();o.parser=o;var h,d=o,u=[],p=[""],y="global",g="",f=[{alias:"global",label:{text:"global"},type:{text:"global"},tags:null,link:null,parentBoundary:""}],b=[],x="",_=!1,m=4,E=2,S=(0,r.K2)((function(){return h}),"getC4Type"),A=(0,r.K2)((function(t){let e=(0,r.jZ)(t,(0,r.D7)());h=e}),"setC4Type"),C=(0,r.K2)((function(t,e,a,n,i,r,s,l,o){if(null==t||null==e||null==a||null==n)return;let c={};const h=b.find((t=>t.from===e&&t.to===a));if(h?c=h:b.push(c),c.type=t,c.from=e,c.to=a,c.label={text:n},null==i)c.techn={text:""};else if("object"==typeof i){let[t,e]=Object.entries(i)[0];c[t]={text:e}}else c.techn={text:i};if(null==r)c.descr={text:""};else if("object"==typeof r){let[t,e]=Object.entries(r)[0];c[t]={text:e}}else c.descr={text:r};if("object"==typeof s){let[t,e]=Object.entries(s)[0];c[t]=e}else c.sprite=s;if("object"==typeof l){let[t,e]=Object.entries(l)[0];c[t]=e}else c.tags=l;if("object"==typeof o){let[t,e]=Object.entries(o)[0];c[t]=e}else c.link=o;c.wrap=$()}),"addRel"),w=(0,r.K2)((function(t,e,a,n,i,r,s){if(null===e||null===a)return;let l={};const o=u.find((t=>t.alias===e));if(o&&e===o.alias?l=o:(l.alias=e,u.push(l)),l.label=null==a?{text:""}:{text:a},null==n)l.descr={text:""};else if("object"==typeof n){let[t,e]=Object.entries(n)[0];l[t]={text:e}}else l.descr={text:n};if("object"==typeof i){let[t,e]=Object.entries(i)[0];l[t]=e}else l.sprite=i;if("object"==typeof r){let[t,e]=Object.entries(r)[0];l[t]=e}else l.tags=r;if("object"==typeof s){let[t,e]=Object.entries(s)[0];l[t]=e}else l.link=s;l.typeC4Shape={text:t},l.parentBoundary=y,l.wrap=$()}),"addPersonOrSystem"),k=(0,r.K2)((function(t,e,a,n,i,r,s,l){if(null===e||null===a)return;let o={};const c=u.find((t=>t.alias===e));if(c&&e===c.alias?o=c:(o.alias=e,u.push(o)),o.label=null==a?{text:""}:{text:a},null==n)o.techn={text:""};else if("object"==typeof n){let[t,e]=Object.entries(n)[0];o[t]={text:e}}else o.techn={text:n};if(null==i)o.descr={text:""};else if("object"==typeof i){let[t,e]=Object.entries(i)[0];o[t]={text:e}}else o.descr={text:i};if("object"==typeof r){let[t,e]=Object.entries(r)[0];o[t]=e}else o.sprite=r;if("object"==typeof s){let[t,e]=Object.entries(s)[0];o[t]=e}else o.tags=s;if("object"==typeof l){let[t,e]=Object.entries(l)[0];o[t]=e}else o.link=l;o.wrap=$(),o.typeC4Shape={text:t},o.parentBoundary=y}),"addContainer"),O=(0,r.K2)((function(t,e,a,n,i,r,s,l){if(null===e||null===a)return;let o={};const c=u.find((t=>t.alias===e));if(c&&e===c.alias?o=c:(o.alias=e,u.push(o)),o.label=null==a?{text:""}:{text:a},null==n)o.techn={text:""};else if("object"==typeof n){let[t,e]=Object.entries(n)[0];o[t]={text:e}}else o.techn={text:n};if(null==i)o.descr={text:""};else if("object"==typeof i){let[t,e]=Object.entries(i)[0];o[t]={text:e}}else o.descr={text:i};if("object"==typeof r){let[t,e]=Object.entries(r)[0];o[t]=e}else o.sprite=r;if("object"==typeof s){let[t,e]=Object.entries(s)[0];o[t]=e}else o.tags=s;if("object"==typeof l){let[t,e]=Object.entries(l)[0];o[t]=e}else o.link=l;o.wrap=$(),o.typeC4Shape={text:t},o.parentBoundary=y}),"addComponent"),T=(0,r.K2)((function(t,e,a,n,i){if(null===t||null===e)return;let r={};const s=f.find((e=>e.alias===t));if(s&&t===s.alias?r=s:(r.alias=t,f.push(r)),r.label=null==e?{text:""}:{text:e},null==a)r.type={text:"system"};else if("object"==typeof a){let[t,e]=Object.entries(a)[0];r[t]={text:e}}else r.type={text:a};if("object"==typeof n){let[t,e]=Object.entries(n)[0];r[t]=e}else r.tags=n;if("object"==typeof i){let[t,e]=Object.entries(i)[0];r[t]=e}else r.link=i;r.parentBoundary=y,r.wrap=$(),g=y,y=t,p.push(g)}),"addPersonOrSystemBoundary"),v=(0,r.K2)((function(t,e,a,n,i){if(null===t||null===e)return;let r={};const s=f.find((e=>e.alias===t));if(s&&t===s.alias?r=s:(r.alias=t,f.push(r)),r.label=null==e?{text:""}:{text:e},null==a)r.type={text:"container"};else if("object"==typeof a){let[t,e]=Object.entries(a)[0];r[t]={text:e}}else r.type={text:a};if("object"==typeof n){let[t,e]=Object.entries(n)[0];r[t]=e}else r.tags=n;if("object"==typeof i){let[t,e]=Object.entries(i)[0];r[t]=e}else r.link=i;r.parentBoundary=y,r.wrap=$(),g=y,y=t,p.push(g)}),"addContainerBoundary"),R=(0,r.K2)((function(t,e,a,n,i,r,s,l){if(null===e||null===a)return;let o={};const c=f.find((t=>t.alias===e));if(c&&e===c.alias?o=c:(o.alias=e,f.push(o)),o.label=null==a?{text:""}:{text:a},null==n)o.type={text:"node"};else if("object"==typeof n){let[t,e]=Object.entries(n)[0];o[t]={text:e}}else o.type={text:n};if(null==i)o.descr={text:""};else if("object"==typeof i){let[t,e]=Object.entries(i)[0];o[t]={text:e}}else o.descr={text:i};if("object"==typeof s){let[t,e]=Object.entries(s)[0];o[t]=e}else o.tags=s;if("object"==typeof l){let[t,e]=Object.entries(l)[0];o[t]=e}else o.link=l;o.nodeType=t,o.parentBoundary=y,o.wrap=$(),g=y,y=e,p.push(g)}),"addDeploymentNode"),D=(0,r.K2)((function(){y=g,p.pop(),g=p.pop(),p.push(g)}),"popBoundaryParseStack"),N=(0,r.K2)((function(t,e,a,n,i,r,s,l,o,c,h){let d=u.find((t=>t.alias===e));if(void 0!==d||(d=f.find((t=>t.alias===e)),void 0!==d)){if(null!=a)if("object"==typeof a){let[t,e]=Object.entries(a)[0];d[t]=e}else d.bgColor=a;if(null!=n)if("object"==typeof n){let[t,e]=Object.entries(n)[0];d[t]=e}else d.fontColor=n;if(null!=i)if("object"==typeof i){let[t,e]=Object.entries(i)[0];d[t]=e}else d.borderColor=i;if(null!=r)if("object"==typeof r){let[t,e]=Object.entries(r)[0];d[t]=e}else d.shadowing=r;if(null!=s)if("object"==typeof s){let[t,e]=Object.entries(s)[0];d[t]=e}else d.shape=s;if(null!=l)if("object"==typeof l){let[t,e]=Object.entries(l)[0];d[t]=e}else d.sprite=l;if(null!=o)if("object"==typeof o){let[t,e]=Object.entries(o)[0];d[t]=e}else d.techn=o;if(null!=c)if("object"==typeof c){let[t,e]=Object.entries(c)[0];d[t]=e}else d.legendText=c;if(null!=h)if("object"==typeof h){let[t,e]=Object.entries(h)[0];d[t]=e}else d.legendSprite=h}}),"updateElStyle"),P=(0,r.K2)((function(t,e,a,n,i,r,s){const l=b.find((t=>t.from===e&&t.to===a));if(void 0!==l){if(null!=n)if("object"==typeof n){let[t,e]=Object.entries(n)[0];l[t]=e}else l.textColor=n;if(null!=i)if("object"==typeof i){let[t,e]=Object.entries(i)[0];l[t]=e}else l.lineColor=i;if(null!=r)if("object"==typeof r){let[t,e]=Object.entries(r)[0];l[t]=parseInt(e)}else l.offsetX=parseInt(r);if(null!=s)if("object"==typeof s){let[t,e]=Object.entries(s)[0];l[t]=parseInt(e)}else l.offsetY=parseInt(s)}}),"updateRelStyle"),B=(0,r.K2)((function(t,e,a){let n=m,i=E;if("object"==typeof e){const t=Object.values(e)[0];n=parseInt(t)}else n=parseInt(e);if("object"==typeof a){const t=Object.values(a)[0];i=parseInt(t)}else i=parseInt(a);n>=1&&(m=n),i>=1&&(E=i)}),"updateLayoutConfig"),I=(0,r.K2)((function(){return m}),"getC4ShapeInRow"),M=(0,r.K2)((function(){return E}),"getC4BoundaryInRow"),j=(0,r.K2)((function(){return y}),"getCurrentBoundaryParse"),K=(0,r.K2)((function(){return g}),"getParentBoundaryParse"),L=(0,r.K2)((function(t){return null==t?u:u.filter((e=>e.parentBoundary===t))}),"getC4ShapeArray"),Y=(0,r.K2)((function(t){return u.find((e=>e.alias===t))}),"getC4Shape"),U=(0,r.K2)((function(t){return Object.keys(L(t))}),"getC4ShapeKeys"),F=(0,r.K2)((function(t){return null==t?f:f.filter((e=>e.parentBoundary===t))}),"getBoundaries"),X=F,z=(0,r.K2)((function(){return b}),"getRels"),W=(0,r.K2)((function(){return x}),"getTitle"),Q=(0,r.K2)((function(t){_=t}),"setWrap"),$=(0,r.K2)((function(){return _}),"autoWrap"),H=(0,r.K2)((function(){u=[],f=[{alias:"global",label:{text:"global"},type:{text:"global"},tags:null,link:null,parentBoundary:""}],g="",y="global",p=[""],b=[],p=[""],x="",_=!1,m=4,E=2}),"clear"),q=(0,r.K2)((function(t){let e=(0,r.jZ)(t,(0,r.D7)());x=e}),"setTitle"),V={addPersonOrSystem:w,addPersonOrSystemBoundary:T,addContainer:k,addContainerBoundary:v,addComponent:O,addDeploymentNode:R,popBoundaryParseStack:D,addRel:C,updateElStyle:N,updateRelStyle:P,updateLayoutConfig:B,autoWrap:$,setWrap:Q,getC4ShapeArray:L,getC4Shape:Y,getC4ShapeKeys:U,getBoundaries:F,getBoundarys:X,getCurrentBoundaryParse:j,getParentBoundaryParse:K,getRels:z,getTitle:W,getC4Type:S,getC4ShapeInRow:I,getC4BoundaryInRow:M,setAccTitle:r.SV,getAccTitle:r.iN,getAccDescription:r.m7,setAccDescription:r.EI,getConfig:(0,r.K2)((()=>(0,r.D7)().c4),"getConfig"),clear:H,LINETYPE:{SOLID:0,DOTTED:1,NOTE:2,SOLID_CROSS:3,DOTTED_CROSS:4,SOLID_OPEN:5,DOTTED_OPEN:6,LOOP_START:10,LOOP_END:11,ALT_START:12,ALT_ELSE:13,ALT_END:14,OPT_START:15,OPT_END:16,ACTIVE_START:17,ACTIVE_END:18,PAR_START:19,PAR_AND:20,PAR_END:21,RECT_START:22,RECT_END:23,SOLID_POINT:24,DOTTED_POINT:25},ARROWTYPE:{FILLED:0,OPEN:1},PLACEMENT:{LEFTOF:0,RIGHTOF:1,OVER:2},setTitle:q,setC4Type:A},G=(0,r.K2)((function(t,e){return(0,n.tk)(t,e)}),"drawRect"),J=(0,r.K2)((function(t,e,a,n,i,r){const s=t.append("image");s.attr("width",e),s.attr("height",a),s.attr("x",n),s.attr("y",i);let o=r.startsWith("data:image/png;base64")?r:(0,l.J)(r);s.attr("xlink:href",o)}),"drawImage"),Z=(0,r.K2)(((t,e,a)=>{const n=t.append("g");let i=0;for(let r of e){let t=r.textColor?r.textColor:"#444444",e=r.lineColor?r.lineColor:"#444444",s=r.offsetX?parseInt(r.offsetX):0,l=r.offsetY?parseInt(r.offsetY):0,o="";if(0===i){let t=n.append("line");t.attr("x1",r.startPoint.x),t.attr("y1",r.startPoint.y),t.attr("x2",r.endPoint.x),t.attr("y2",r.endPoint.y),t.attr("stroke-width","1"),t.attr("stroke",e),t.style("fill","none"),"rel_b"!==r.type&&t.attr("marker-end","url("+o+"#arrowhead)"),"birel"!==r.type&&"rel_b"!==r.type||t.attr("marker-start","url("+o+"#arrowend)"),i=-1}else{let t=n.append("path");t.attr("fill","none").attr("stroke-width","1").attr("stroke",e).attr("d","Mstartx,starty Qcontrolx,controly stopx,stopy ".replaceAll("startx",r.startPoint.x).replaceAll("starty",r.startPoint.y).replaceAll("controlx",r.startPoint.x+(r.endPoint.x-r.startPoint.x)/2-(r.endPoint.x-r.startPoint.x)/4).replaceAll("controly",r.startPoint.y+(r.endPoint.y-r.startPoint.y)/2).replaceAll("stopx",r.endPoint.x).replaceAll("stopy",r.endPoint.y)),"rel_b"!==r.type&&t.attr("marker-end","url("+o+"#arrowhead)"),"birel"!==r.type&&"rel_b"!==r.type||t.attr("marker-start","url("+o+"#arrowend)")}let c=a.messageFont();dt(a)(r.label.text,n,Math.min(r.startPoint.x,r.endPoint.x)+Math.abs(r.endPoint.x-r.startPoint.x)/2+s,Math.min(r.startPoint.y,r.endPoint.y)+Math.abs(r.endPoint.y-r.startPoint.y)/2+l,r.label.width,r.label.height,{fill:t},c),r.techn&&""!==r.techn.text&&(c=a.messageFont(),dt(a)("["+r.techn.text+"]",n,Math.min(r.startPoint.x,r.endPoint.x)+Math.abs(r.endPoint.x-r.startPoint.x)/2+s,Math.min(r.startPoint.y,r.endPoint.y)+Math.abs(r.endPoint.y-r.startPoint.y)/2+a.messageFontSize+5+l,Math.max(r.label.width,r.techn.width),r.techn.height,{fill:t,"font-style":"italic"},c))}}),"drawRels"),tt=(0,r.K2)((function(t,e,a){const n=t.append("g");let i=e.bgColor?e.bgColor:"none",r=e.borderColor?e.borderColor:"#444444",s=e.fontColor?e.fontColor:"black",l={"stroke-width":1,"stroke-dasharray":"7.0,7.0"};e.nodeType&&(l={"stroke-width":1});let o={x:e.x,y:e.y,fill:i,stroke:r,width:e.width,height:e.height,rx:2.5,ry:2.5,attrs:l};G(n,o);let c=a.boundaryFont();c.fontWeight="bold",c.fontSize=c.fontSize+2,c.fontColor=s,dt(a)(e.label.text,n,e.x,e.y+e.label.Y,e.width,e.height,{fill:"#444444"},c),e.type&&""!==e.type.text&&(c=a.boundaryFont(),c.fontColor=s,dt(a)(e.type.text,n,e.x,e.y+e.type.Y,e.width,e.height,{fill:"#444444"},c)),e.descr&&""!==e.descr.text&&(c=a.boundaryFont(),c.fontSize=c.fontSize-2,c.fontColor=s,dt(a)(e.descr.text,n,e.x,e.y+e.descr.Y,e.width,e.height,{fill:"#444444"},c))}),"drawBoundary"),et=(0,r.K2)((function(t,e,a){let i=e.bgColor?e.bgColor:a[e.typeC4Shape.text+"_bg_color"],r=e.borderColor?e.borderColor:a[e.typeC4Shape.text+"_border_color"],s=e.fontColor?e.fontColor:"#FFFFFF",l="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAIAAADYYG7QAAACD0lEQVR4Xu2YoU4EMRCGT+4j8Ai8AhaH4QHgAUjQuFMECUgMIUgwJAgMhgQsAYUiJCiQIBBY+EITsjfTdme6V24v4c8vyGbb+ZjOtN0bNcvjQXmkH83WvYBWto6PLm6v7p7uH1/w2fXD+PBycX1Pv2l3IdDm/vn7x+dXQiAubRzoURa7gRZWd0iGRIiJbOnhnfYBQZNJjNbuyY2eJG8fkDE3bbG4ep6MHUAsgYxmE3nVs6VsBWJSGccsOlFPmLIViMzLOB7pCVO2AtHJMohH7Fh6zqitQK7m0rJvAVYgGcEpe//PLdDz65sM4pF9N7ICcXDKIB5Nv6j7tD0NoSdM2QrU9Gg0ewE1LqBhHR3BBdvj2vapnidjHxD/q6vd7Pvhr31AwcY8eXMTXAKECZZJFXuEq27aLgQK5uLMohCenGGuGewOxSjBvYBqeG6B+Nqiblggdjnc+ZXDy+FNFpFzw76O3UBAROuXh6FoiAcf5g9eTvUgzy0nWg6I8cXHRUpg5bOVBCo+KDpFajOf23GgPme7RSQ+lacIENUgJ6gg1k6HjgOlqnLqip4tEuhv0hNEMXUD0clyXE3p6pZA0S2nnvTlXwLJEZWlb7cTQH1+USgTN4VhAenm/wea1OCAOmqo6fE1WCb9WSKBah+rbUWPWAmE2Rvk0ApiB45eOyNAzU8xcTvj8KvkKEoOaIYeHNA3ZuygAvFMUO0AAAAASUVORK5CYII=";switch(e.typeC4Shape.text){case"person":l="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAIAAADYYG7QAAACD0lEQVR4Xu2YoU4EMRCGT+4j8Ai8AhaH4QHgAUjQuFMECUgMIUgwJAgMhgQsAYUiJCiQIBBY+EITsjfTdme6V24v4c8vyGbb+ZjOtN0bNcvjQXmkH83WvYBWto6PLm6v7p7uH1/w2fXD+PBycX1Pv2l3IdDm/vn7x+dXQiAubRzoURa7gRZWd0iGRIiJbOnhnfYBQZNJjNbuyY2eJG8fkDE3bbG4ep6MHUAsgYxmE3nVs6VsBWJSGccsOlFPmLIViMzLOB7pCVO2AtHJMohH7Fh6zqitQK7m0rJvAVYgGcEpe//PLdDz65sM4pF9N7ICcXDKIB5Nv6j7tD0NoSdM2QrU9Gg0ewE1LqBhHR3BBdvj2vapnidjHxD/q6vd7Pvhr31AwcY8eXMTXAKECZZJFXuEq27aLgQK5uLMohCenGGuGewOxSjBvYBqeG6B+Nqiblggdjnc+ZXDy+FNFpFzw76O3UBAROuXh6FoiAcf5g9eTvUgzy0nWg6I8cXHRUpg5bOVBCo+KDpFajOf23GgPme7RSQ+lacIENUgJ6gg1k6HjgOlqnLqip4tEuhv0hNEMXUD0clyXE3p6pZA0S2nnvTlXwLJEZWlb7cTQH1+USgTN4VhAenm/wea1OCAOmqo6fE1WCb9WSKBah+rbUWPWAmE2Rvk0ApiB45eOyNAzU8xcTvj8KvkKEoOaIYeHNA3ZuygAvFMUO0AAAAASUVORK5CYII=";break;case"external_person":l="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAIAAADYYG7QAAAB6ElEQVR4Xu2YLY+EMBCG9+dWr0aj0Wg0Go1Go0+j8Xdv2uTCvv1gpt0ebHKPuhDaeW4605Z9mJvx4AdXUyTUdd08z+u6flmWZRnHsWkafk9DptAwDPu+f0eAYtu2PEaGWuj5fCIZrBAC2eLBAnRCsEkkxmeaJp7iDJ2QMDdHsLg8SxKFEJaAo8lAXnmuOFIhTMpxxKATebo4UiFknuNo4OniSIXQyRxEA3YsnjGCVEjVXD7yLUAqxBGUyPv/Y4W2beMgGuS7kVQIBycH0fD+oi5pezQETxdHKmQKGk1eQEYldK+jw5GxPfZ9z7Mk0Qnhf1W1m3w//EUn5BDmSZsbR44QQLBEqrBHqOrmSKaQAxdnLArCrxZcM7A7ZKs4ioRq8LFC+NpC3WCBJsvpVw5edm9iEXFuyNfxXAgSwfrFQ1c0iNda8AdejvUgnktOtJQQxmcfFzGglc5WVCj7oDgFqU18boeFSs52CUh8LE8BIVQDT1ABrB0HtgSEYlX5doJnCwv9TXocKCaKbnwhdDKPq4lf3SwU3HLq4V/+WYhHVMa/3b4IlfyikAduCkcBc7mQ3/z/Qq/cTuikhkzB12Ae/mcJC9U+Vo8Ej1gWAtgbeGgFsAMHr50BIWOLCbezvhpBFUdY6EJuJ/QDW0XoMX60zZ0AAAAASUVORK5CYII="}const o=t.append("g");o.attr("class","person-man");const c=(0,n.PB)();switch(e.typeC4Shape.text){case"person":case"external_person":case"system":case"external_system":case"container":case"external_container":case"component":case"external_component":c.x=e.x,c.y=e.y,c.fill=i,c.width=e.width,c.height=e.height,c.stroke=r,c.rx=2.5,c.ry=2.5,c.attrs={"stroke-width":.5},G(o,c);break;case"system_db":case"external_system_db":case"container_db":case"external_container_db":case"component_db":case"external_component_db":o.append("path").attr("fill",i).attr("stroke-width","0.5").attr("stroke",r).attr("d","Mstartx,startyc0,-10 half,-10 half,-10c0,0 half,0 half,10l0,heightc0,10 -half,10 -half,10c0,0 -half,0 -half,-10l0,-height".replaceAll("startx",e.x).replaceAll("starty",e.y).replaceAll("half",e.width/2).replaceAll("height",e.height)),o.append("path").attr("fill","none").attr("stroke-width","0.5").attr("stroke",r).attr("d","Mstartx,startyc0,10 half,10 half,10c0,0 half,0 half,-10".replaceAll("startx",e.x).replaceAll("starty",e.y).replaceAll("half",e.width/2));break;case"system_queue":case"external_system_queue":case"container_queue":case"external_container_queue":case"component_queue":case"external_component_queue":o.append("path").attr("fill",i).attr("stroke-width","0.5").attr("stroke",r).attr("d","Mstartx,startylwidth,0c5,0 5,half 5,halfc0,0 0,half -5,halfl-width,0c-5,0 -5,-half -5,-halfc0,0 0,-half 5,-half".replaceAll("startx",e.x).replaceAll("starty",e.y).replaceAll("width",e.width).replaceAll("half",e.height/2)),o.append("path").attr("fill","none").attr("stroke-width","0.5").attr("stroke",r).attr("d","Mstartx,startyc-5,0 -5,half -5,halfc0,half 5,half 5,half".replaceAll("startx",e.x+e.width).replaceAll("starty",e.y).replaceAll("half",e.height/2))}let h=ht(a,e.typeC4Shape.text);switch(o.append("text").attr("fill",s).attr("font-family",h.fontFamily).attr("font-size",h.fontSize-2).attr("font-style","italic").attr("lengthAdjust","spacing").attr("textLength",e.typeC4Shape.width).attr("x",e.x+e.width/2-e.typeC4Shape.width/2).attr("y",e.y+e.typeC4Shape.Y).text("<<"+e.typeC4Shape.text+">>"),e.typeC4Shape.text){case"person":case"external_person":J(o,48,48,e.x+e.width/2-24,e.y+e.image.Y,l)}let d=a[e.typeC4Shape.text+"Font"]();return d.fontWeight="bold",d.fontSize=d.fontSize+2,d.fontColor=s,dt(a)(e.label.text,o,e.x,e.y+e.label.Y,e.width,e.height,{fill:s},d),d=a[e.typeC4Shape.text+"Font"](),d.fontColor=s,e.techn&&""!==e.techn?.text?dt(a)(e.techn.text,o,e.x,e.y+e.techn.Y,e.width,e.height,{fill:s,"font-style":"italic"},d):e.type&&""!==e.type.text&&dt(a)(e.type.text,o,e.x,e.y+e.type.Y,e.width,e.height,{fill:s,"font-style":"italic"},d),e.descr&&""!==e.descr.text&&(d=a.personFont(),d.fontColor=s,dt(a)(e.descr.text,o,e.x,e.y+e.descr.Y,e.width,e.height,{fill:s},d)),e.height}),"drawC4Shape"),at=(0,r.K2)((function(t){t.append("defs").append("symbol").attr("id","database").attr("fill-rule","evenodd").attr("clip-rule","evenodd").append("path").attr("transform","scale(.5)").attr("d","M12.258.001l.256.004.255.005.253.008.251.01.249.012.247.015.246.016.242.019.241.02.239.023.236.024.233.027.231.028.229.031.225.032.223.034.22.036.217.038.214.04.211.041.208.043.205.045.201.046.198.048.194.05.191.051.187.053.183.054.18.056.175.057.172.059.168.06.163.061.16.063.155.064.15.066.074.033.073.033.071.034.07.034.069.035.068.035.067.035.066.035.064.036.064.036.062.036.06.036.06.037.058.037.058.037.055.038.055.038.053.038.052.038.051.039.05.039.048.039.047.039.045.04.044.04.043.04.041.04.04.041.039.041.037.041.036.041.034.041.033.042.032.042.03.042.029.042.027.042.026.043.024.043.023.043.021.043.02.043.018.044.017.043.015.044.013.044.012.044.011.045.009.044.007.045.006.045.004.045.002.045.001.045v17l-.001.045-.002.045-.004.045-.006.045-.007.045-.009.044-.011.045-.012.044-.013.044-.015.044-.017.043-.018.044-.02.043-.021.043-.023.043-.024.043-.026.043-.027.042-.029.042-.03.042-.032.042-.033.042-.034.041-.036.041-.037.041-.039.041-.04.041-.041.04-.043.04-.044.04-.045.04-.047.039-.048.039-.05.039-.051.039-.052.038-.053.038-.055.038-.055.038-.058.037-.058.037-.06.037-.06.036-.062.036-.064.036-.064.036-.066.035-.067.035-.068.035-.069.035-.07.034-.071.034-.073.033-.074.033-.15.066-.155.064-.16.063-.163.061-.168.06-.172.059-.175.057-.18.056-.183.054-.187.053-.191.051-.194.05-.198.048-.201.046-.205.045-.208.043-.211.041-.214.04-.217.038-.22.036-.223.034-.225.032-.229.031-.231.028-.233.027-.236.024-.239.023-.241.02-.242.019-.246.016-.247.015-.249.012-.251.01-.253.008-.255.005-.256.004-.258.001-.258-.001-.256-.004-.255-.005-.253-.008-.251-.01-.249-.012-.247-.015-.245-.016-.243-.019-.241-.02-.238-.023-.236-.024-.234-.027-.231-.028-.228-.031-.226-.032-.223-.034-.22-.036-.217-.038-.214-.04-.211-.041-.208-.043-.204-.045-.201-.046-.198-.048-.195-.05-.19-.051-.187-.053-.184-.054-.179-.056-.176-.057-.172-.059-.167-.06-.164-.061-.159-.063-.155-.064-.151-.066-.074-.033-.072-.033-.072-.034-.07-.034-.069-.035-.068-.035-.067-.035-.066-.035-.064-.036-.063-.036-.062-.036-.061-.036-.06-.037-.058-.037-.057-.037-.056-.038-.055-.038-.053-.038-.052-.038-.051-.039-.049-.039-.049-.039-.046-.039-.046-.04-.044-.04-.043-.04-.041-.04-.04-.041-.039-.041-.037-.041-.036-.041-.034-.041-.033-.042-.032-.042-.03-.042-.029-.042-.027-.042-.026-.043-.024-.043-.023-.043-.021-.043-.02-.043-.018-.044-.017-.043-.015-.044-.013-.044-.012-.044-.011-.045-.009-.044-.007-.045-.006-.045-.004-.045-.002-.045-.001-.045v-17l.001-.045.002-.045.004-.045.006-.045.007-.045.009-.044.011-.045.012-.044.013-.044.015-.044.017-.043.018-.044.02-.043.021-.043.023-.043.024-.043.026-.043.027-.042.029-.042.03-.042.032-.042.033-.042.034-.041.036-.041.037-.041.039-.041.04-.041.041-.04.043-.04.044-.04.046-.04.046-.039.049-.039.049-.039.051-.039.052-.038.053-.038.055-.038.056-.038.057-.037.058-.037.06-.037.061-.036.062-.036.063-.036.064-.036.066-.035.067-.035.068-.035.069-.035.07-.034.072-.034.072-.033.074-.033.151-.066.155-.064.159-.063.164-.061.167-.06.172-.059.176-.057.179-.056.184-.054.187-.053.19-.051.195-.05.198-.048.201-.046.204-.045.208-.043.211-.041.214-.04.217-.038.22-.036.223-.034.226-.032.228-.031.231-.028.234-.027.236-.024.238-.023.241-.02.243-.019.245-.016.247-.015.249-.012.251-.01.253-.008.255-.005.256-.004.258-.001.258.001zm-9.258 20.499v.01l.001.021.003.021.004.022.005.021.006.022.007.022.009.023.01.022.011.023.012.023.013.023.015.023.016.024.017.023.018.024.019.024.021.024.022.025.023.024.024.025.052.049.056.05.061.051.066.051.07.051.075.051.079.052.084.052.088.052.092.052.097.052.102.051.105.052.11.052.114.051.119.051.123.051.127.05.131.05.135.05.139.048.144.049.147.047.152.047.155.047.16.045.163.045.167.043.171.043.176.041.178.041.183.039.187.039.19.037.194.035.197.035.202.033.204.031.209.03.212.029.216.027.219.025.222.024.226.021.23.02.233.018.236.016.24.015.243.012.246.01.249.008.253.005.256.004.259.001.26-.001.257-.004.254-.005.25-.008.247-.011.244-.012.241-.014.237-.016.233-.018.231-.021.226-.021.224-.024.22-.026.216-.027.212-.028.21-.031.205-.031.202-.034.198-.034.194-.036.191-.037.187-.039.183-.04.179-.04.175-.042.172-.043.168-.044.163-.045.16-.046.155-.046.152-.047.148-.048.143-.049.139-.049.136-.05.131-.05.126-.05.123-.051.118-.052.114-.051.11-.052.106-.052.101-.052.096-.052.092-.052.088-.053.083-.051.079-.052.074-.052.07-.051.065-.051.06-.051.056-.05.051-.05.023-.024.023-.025.021-.024.02-.024.019-.024.018-.024.017-.024.015-.023.014-.024.013-.023.012-.023.01-.023.01-.022.008-.022.006-.022.006-.022.004-.022.004-.021.001-.021.001-.021v-4.127l-.077.055-.08.053-.083.054-.085.053-.087.052-.09.052-.093.051-.095.05-.097.05-.1.049-.102.049-.105.048-.106.047-.109.047-.111.046-.114.045-.115.045-.118.044-.12.043-.122.042-.124.042-.126.041-.128.04-.13.04-.132.038-.134.038-.135.037-.138.037-.139.035-.142.035-.143.034-.144.033-.147.032-.148.031-.15.03-.151.03-.153.029-.154.027-.156.027-.158.026-.159.025-.161.024-.162.023-.163.022-.165.021-.166.02-.167.019-.169.018-.169.017-.171.016-.173.015-.173.014-.175.013-.175.012-.177.011-.178.01-.179.008-.179.008-.181.006-.182.005-.182.004-.184.003-.184.002h-.37l-.184-.002-.184-.003-.182-.004-.182-.005-.181-.006-.179-.008-.179-.008-.178-.01-.176-.011-.176-.012-.175-.013-.173-.014-.172-.015-.171-.016-.17-.017-.169-.018-.167-.019-.166-.02-.165-.021-.163-.022-.162-.023-.161-.024-.159-.025-.157-.026-.156-.027-.155-.027-.153-.029-.151-.03-.15-.03-.148-.031-.146-.032-.145-.033-.143-.034-.141-.035-.14-.035-.137-.037-.136-.037-.134-.038-.132-.038-.13-.04-.128-.04-.126-.041-.124-.042-.122-.042-.12-.044-.117-.043-.116-.045-.113-.045-.112-.046-.109-.047-.106-.047-.105-.048-.102-.049-.1-.049-.097-.05-.095-.05-.093-.052-.09-.051-.087-.052-.085-.053-.083-.054-.08-.054-.077-.054v4.127zm0-5.654v.011l.001.021.003.021.004.021.005.022.006.022.007.022.009.022.01.022.011.023.012.023.013.023.015.024.016.023.017.024.018.024.019.024.021.024.022.024.023.025.024.024.052.05.056.05.061.05.066.051.07.051.075.052.079.051.084.052.088.052.092.052.097.052.102.052.105.052.11.051.114.051.119.052.123.05.127.051.131.05.135.049.139.049.144.048.147.048.152.047.155.046.16.045.163.045.167.044.171.042.176.042.178.04.183.04.187.038.19.037.194.036.197.034.202.033.204.032.209.03.212.028.216.027.219.025.222.024.226.022.23.02.233.018.236.016.24.014.243.012.246.01.249.008.253.006.256.003.259.001.26-.001.257-.003.254-.006.25-.008.247-.01.244-.012.241-.015.237-.016.233-.018.231-.02.226-.022.224-.024.22-.025.216-.027.212-.029.21-.03.205-.032.202-.033.198-.035.194-.036.191-.037.187-.039.183-.039.179-.041.175-.042.172-.043.168-.044.163-.045.16-.045.155-.047.152-.047.148-.048.143-.048.139-.05.136-.049.131-.05.126-.051.123-.051.118-.051.114-.052.11-.052.106-.052.101-.052.096-.052.092-.052.088-.052.083-.052.079-.052.074-.051.07-.052.065-.051.06-.05.056-.051.051-.049.023-.025.023-.024.021-.025.02-.024.019-.024.018-.024.017-.024.015-.023.014-.023.013-.024.012-.022.01-.023.01-.023.008-.022.006-.022.006-.022.004-.021.004-.022.001-.021.001-.021v-4.139l-.077.054-.08.054-.083.054-.085.052-.087.053-.09.051-.093.051-.095.051-.097.05-.1.049-.102.049-.105.048-.106.047-.109.047-.111.046-.114.045-.115.044-.118.044-.12.044-.122.042-.124.042-.126.041-.128.04-.13.039-.132.039-.134.038-.135.037-.138.036-.139.036-.142.035-.143.033-.144.033-.147.033-.148.031-.15.03-.151.03-.153.028-.154.028-.156.027-.158.026-.159.025-.161.024-.162.023-.163.022-.165.021-.166.02-.167.019-.169.018-.169.017-.171.016-.173.015-.173.014-.175.013-.175.012-.177.011-.178.009-.179.009-.179.007-.181.007-.182.005-.182.004-.184.003-.184.002h-.37l-.184-.002-.184-.003-.182-.004-.182-.005-.181-.007-.179-.007-.179-.009-.178-.009-.176-.011-.176-.012-.175-.013-.173-.014-.172-.015-.171-.016-.17-.017-.169-.018-.167-.019-.166-.02-.165-.021-.163-.022-.162-.023-.161-.024-.159-.025-.157-.026-.156-.027-.155-.028-.153-.028-.151-.03-.15-.03-.148-.031-.146-.033-.145-.033-.143-.033-.141-.035-.14-.036-.137-.036-.136-.037-.134-.038-.132-.039-.13-.039-.128-.04-.126-.041-.124-.042-.122-.043-.12-.043-.117-.044-.116-.044-.113-.046-.112-.046-.109-.046-.106-.047-.105-.048-.102-.049-.1-.049-.097-.05-.095-.051-.093-.051-.09-.051-.087-.053-.085-.052-.083-.054-.08-.054-.077-.054v4.139zm0-5.666v.011l.001.02.003.022.004.021.005.022.006.021.007.022.009.023.01.022.011.023.012.023.013.023.015.023.016.024.017.024.018.023.019.024.021.025.022.024.023.024.024.025.052.05.056.05.061.05.066.051.07.051.075.052.079.051.084.052.088.052.092.052.097.052.102.052.105.051.11.052.114.051.119.051.123.051.127.05.131.05.135.05.139.049.144.048.147.048.152.047.155.046.16.045.163.045.167.043.171.043.176.042.178.04.183.04.187.038.19.037.194.036.197.034.202.033.204.032.209.03.212.028.216.027.219.025.222.024.226.021.23.02.233.018.236.017.24.014.243.012.246.01.249.008.253.006.256.003.259.001.26-.001.257-.003.254-.006.25-.008.247-.01.244-.013.241-.014.237-.016.233-.018.231-.02.226-.022.224-.024.22-.025.216-.027.212-.029.21-.03.205-.032.202-.033.198-.035.194-.036.191-.037.187-.039.183-.039.179-.041.175-.042.172-.043.168-.044.163-.045.16-.045.155-.047.152-.047.148-.048.143-.049.139-.049.136-.049.131-.051.126-.05.123-.051.118-.052.114-.051.11-.052.106-.052.101-.052.096-.052.092-.052.088-.052.083-.052.079-.052.074-.052.07-.051.065-.051.06-.051.056-.05.051-.049.023-.025.023-.025.021-.024.02-.024.019-.024.018-.024.017-.024.015-.023.014-.024.013-.023.012-.023.01-.022.01-.023.008-.022.006-.022.006-.022.004-.022.004-.021.001-.021.001-.021v-4.153l-.077.054-.08.054-.083.053-.085.053-.087.053-.09.051-.093.051-.095.051-.097.05-.1.049-.102.048-.105.048-.106.048-.109.046-.111.046-.114.046-.115.044-.118.044-.12.043-.122.043-.124.042-.126.041-.128.04-.13.039-.132.039-.134.038-.135.037-.138.036-.139.036-.142.034-.143.034-.144.033-.147.032-.148.032-.15.03-.151.03-.153.028-.154.028-.156.027-.158.026-.159.024-.161.024-.162.023-.163.023-.165.021-.166.02-.167.019-.169.018-.169.017-.171.016-.173.015-.173.014-.175.013-.175.012-.177.01-.178.01-.179.009-.179.007-.181.006-.182.006-.182.004-.184.003-.184.001-.185.001-.185-.001-.184-.001-.184-.003-.182-.004-.182-.006-.181-.006-.179-.007-.179-.009-.178-.01-.176-.01-.176-.012-.175-.013-.173-.014-.172-.015-.171-.016-.17-.017-.169-.018-.167-.019-.166-.02-.165-.021-.163-.023-.162-.023-.161-.024-.159-.024-.157-.026-.156-.027-.155-.028-.153-.028-.151-.03-.15-.03-.148-.032-.146-.032-.145-.033-.143-.034-.141-.034-.14-.036-.137-.036-.136-.037-.134-.038-.132-.039-.13-.039-.128-.041-.126-.041-.124-.041-.122-.043-.12-.043-.117-.044-.116-.044-.113-.046-.112-.046-.109-.046-.106-.048-.105-.048-.102-.048-.1-.05-.097-.049-.095-.051-.093-.051-.09-.052-.087-.052-.085-.053-.083-.053-.08-.054-.077-.054v4.153zm8.74-8.179l-.257.004-.254.005-.25.008-.247.011-.244.012-.241.014-.237.016-.233.018-.231.021-.226.022-.224.023-.22.026-.216.027-.212.028-.21.031-.205.032-.202.033-.198.034-.194.036-.191.038-.187.038-.183.04-.179.041-.175.042-.172.043-.168.043-.163.045-.16.046-.155.046-.152.048-.148.048-.143.048-.139.049-.136.05-.131.05-.126.051-.123.051-.118.051-.114.052-.11.052-.106.052-.101.052-.096.052-.092.052-.088.052-.083.052-.079.052-.074.051-.07.052-.065.051-.06.05-.056.05-.051.05-.023.025-.023.024-.021.024-.02.025-.019.024-.018.024-.017.023-.015.024-.014.023-.013.023-.012.023-.01.023-.01.022-.008.022-.006.023-.006.021-.004.022-.004.021-.001.021-.001.021.001.021.001.021.004.021.004.022.006.021.006.023.008.022.01.022.01.023.012.023.013.023.014.023.015.024.017.023.018.024.019.024.02.025.021.024.023.024.023.025.051.05.056.05.06.05.065.051.07.052.074.051.079.052.083.052.088.052.092.052.096.052.101.052.106.052.11.052.114.052.118.051.123.051.126.051.131.05.136.05.139.049.143.048.148.048.152.048.155.046.16.046.163.045.168.043.172.043.175.042.179.041.183.04.187.038.191.038.194.036.198.034.202.033.205.032.21.031.212.028.216.027.22.026.224.023.226.022.231.021.233.018.237.016.241.014.244.012.247.011.25.008.254.005.257.004.26.001.26-.001.257-.004.254-.005.25-.008.247-.011.244-.012.241-.014.237-.016.233-.018.231-.021.226-.022.224-.023.22-.026.216-.027.212-.028.21-.031.205-.032.202-.033.198-.034.194-.036.191-.038.187-.038.183-.04.179-.041.175-.042.172-.043.168-.043.163-.045.16-.046.155-.046.152-.048.148-.048.143-.048.139-.049.136-.05.131-.05.126-.051.123-.051.118-.051.114-.052.11-.052.106-.052.101-.052.096-.052.092-.052.088-.052.083-.052.079-.052.074-.051.07-.052.065-.051.06-.05.056-.05.051-.05.023-.025.023-.024.021-.024.02-.025.019-.024.018-.024.017-.023.015-.024.014-.023.013-.023.012-.023.01-.023.01-.022.008-.022.006-.023.006-.021.004-.022.004-.021.001-.021.001-.021-.001-.021-.001-.021-.004-.021-.004-.022-.006-.021-.006-.023-.008-.022-.01-.022-.01-.023-.012-.023-.013-.023-.014-.023-.015-.024-.017-.023-.018-.024-.019-.024-.02-.025-.021-.024-.023-.024-.023-.025-.051-.05-.056-.05-.06-.05-.065-.051-.07-.052-.074-.051-.079-.052-.083-.052-.088-.052-.092-.052-.096-.052-.101-.052-.106-.052-.11-.052-.114-.052-.118-.051-.123-.051-.126-.051-.131-.05-.136-.05-.139-.049-.143-.048-.148-.048-.152-.048-.155-.046-.16-.046-.163-.045-.168-.043-.172-.043-.175-.042-.179-.041-.183-.04-.187-.038-.191-.038-.194-.036-.198-.034-.202-.033-.205-.032-.21-.031-.212-.028-.216-.027-.22-.026-.224-.023-.226-.022-.231-.021-.233-.018-.237-.016-.241-.014-.244-.012-.247-.011-.25-.008-.254-.005-.257-.004-.26-.001-.26.001z")}),"insertDatabaseIcon"),nt=(0,r.K2)((function(t){t.append("defs").append("symbol").attr("id","computer").attr("width","24").attr("height","24").append("path").attr("transform","scale(.5)").attr("d","M2 2v13h20v-13h-20zm18 11h-16v-9h16v9zm-10.228 6l.466-1h3.524l.467 1h-4.457zm14.228 3h-24l2-6h2.104l-1.33 4h18.45l-1.297-4h2.073l2 6zm-5-10h-14v-7h14v7z")}),"insertComputerIcon"),it=(0,r.K2)((function(t){t.append("defs").append("symbol").attr("id","clock").attr("width","24").attr("height","24").append("path").attr("transform","scale(.5)").attr("d","M12 2c5.514 0 10 4.486 10 10s-4.486 10-10 10-10-4.486-10-10 4.486-10 10-10zm0-2c-6.627 0-12 5.373-12 12s5.373 12 12 12 12-5.373 12-12-5.373-12-12-12zm5.848 12.459c.202.038.202.333.001.372-1.907.361-6.045 1.111-6.547 1.111-.719 0-1.301-.582-1.301-1.301 0-.512.77-5.447 1.125-7.445.034-.192.312-.181.343.014l.985 6.238 5.394 1.011z")}),"insertClockIcon"),rt=(0,r.K2)((function(t){t.append("defs").append("marker").attr("id","arrowhead").attr("refX",9).attr("refY",5).attr("markerUnits","userSpaceOnUse").attr("markerWidth",12).attr("markerHeight",12).attr("orient","auto").append("path").attr("d","M 0 0 L 10 5 L 0 10 z")}),"insertArrowHead"),st=(0,r.K2)((function(t){t.append("defs").append("marker").attr("id","arrowend").attr("refX",1).attr("refY",5).attr("markerUnits","userSpaceOnUse").attr("markerWidth",12).attr("markerHeight",12).attr("orient","auto").append("path").attr("d","M 10 0 L 0 5 L 10 10 z")}),"insertArrowEnd"),lt=(0,r.K2)((function(t){t.append("defs").append("marker").attr("id","filled-head").attr("refX",18).attr("refY",7).attr("markerWidth",20).attr("markerHeight",28).attr("orient","auto").append("path").attr("d","M 18,7 L9,13 L14,7 L9,1 Z")}),"insertArrowFilledHead"),ot=(0,r.K2)((function(t){t.append("defs").append("marker").attr("id","sequencenumber").attr("refX",15).attr("refY",15).attr("markerWidth",60).attr("markerHeight",40).attr("orient","auto").append("circle").attr("cx",15).attr("cy",15).attr("r",6)}),"insertDynamicNumber"),ct=(0,r.K2)((function(t){const e=t.append("defs").append("marker").attr("id","crosshead").attr("markerWidth",15).attr("markerHeight",8).attr("orient","auto").attr("refX",16).attr("refY",4);e.append("path").attr("fill","black").attr("stroke","#000000").style("stroke-dasharray","0, 0").attr("stroke-width","1px").attr("d","M 9,2 V 6 L16,4 Z"),e.append("path").attr("fill","none").attr("stroke","#000000").style("stroke-dasharray","0, 0").attr("stroke-width","1px").attr("d","M 0,1 L 6,7 M 6,1 L 0,7")}),"insertArrowCrossHead"),ht=(0,r.K2)(((t,e)=>({fontFamily:t[e+"FontFamily"],fontSize:t[e+"FontSize"],fontWeight:t[e+"FontWeight"]})),"getC4ShapeFont"),dt=function(){function t(t,e,a,i,r,s,l){n(e.append("text").attr("x",a+r/2).attr("y",i+s/2+5).style("text-anchor","middle").text(t),l)}function e(t,e,a,i,s,l,o,c){const{fontSize:h,fontFamily:d,fontWeight:u}=c,p=t.split(r.Y2.lineBreakRegex);for(let r=0;r=this.data.widthLimit||a>=this.data.widthLimit||this.nextData.cnt>gt)&&(e=this.nextData.startx+t.margin+bt.nextLinePaddingX,n=this.nextData.stopy+2*t.margin,this.nextData.stopx=a=e+t.width,this.nextData.starty=this.nextData.stopy,this.nextData.stopy=i=n+t.height,this.nextData.cnt=1),t.x=e,t.y=n,this.updateVal(this.data,"startx",e,Math.min),this.updateVal(this.data,"starty",n,Math.min),this.updateVal(this.data,"stopx",a,Math.max),this.updateVal(this.data,"stopy",i,Math.max),this.updateVal(this.nextData,"startx",e,Math.min),this.updateVal(this.nextData,"starty",n,Math.min),this.updateVal(this.nextData,"stopx",a,Math.max),this.updateVal(this.nextData,"stopy",i,Math.max)}init(t){this.name="",this.data={startx:void 0,stopx:void 0,starty:void 0,stopy:void 0,widthLimit:void 0},this.nextData={startx:void 0,stopx:void 0,starty:void 0,stopy:void 0,cnt:0},_t(t.db.getConfig())}bumpLastMargin(t){this.data.stopx+=t,this.data.stopy+=t}},_t=(0,r.K2)((function(t){(0,r.hH)(bt,t),t.fontFamily&&(bt.personFontFamily=bt.systemFontFamily=bt.messageFontFamily=t.fontFamily),t.fontSize&&(bt.personFontSize=bt.systemFontSize=bt.messageFontSize=t.fontSize),t.fontWeight&&(bt.personFontWeight=bt.systemFontWeight=bt.messageFontWeight=t.fontWeight)}),"setConf"),mt=(0,r.K2)(((t,e)=>({fontFamily:t[e+"FontFamily"],fontSize:t[e+"FontSize"],fontWeight:t[e+"FontWeight"]})),"c4ShapeFont"),Et=(0,r.K2)((t=>({fontFamily:t.boundaryFontFamily,fontSize:t.boundaryFontSize,fontWeight:t.boundaryFontWeight})),"boundaryFont"),St=(0,r.K2)((t=>({fontFamily:t.messageFontFamily,fontSize:t.messageFontSize,fontWeight:t.messageFontWeight})),"messageFont");function At(t,e,a,n,s){if(!e[t].width)if(a)e[t].text=(0,i.bH)(e[t].text,s,n),e[t].textLines=e[t].text.split(r.Y2.lineBreakRegex).length,e[t].width=s,e[t].height=(0,i.ru)(e[t].text,n);else{let a=e[t].text.split(r.Y2.lineBreakRegex);e[t].textLines=a.length;let s=0;e[t].height=0,e[t].width=0;for(const r of a)e[t].width=Math.max((0,i.Un)(r,n),e[t].width),s=(0,i.ru)(r,n),e[t].height=e[t].height+s}}(0,r.K2)(At,"calcC4ShapeTextWH");var Ct=(0,r.K2)((function(t,e,a){e.x=a.data.startx,e.y=a.data.starty,e.width=a.data.stopx-a.data.startx,e.height=a.data.stopy-a.data.starty,e.label.y=bt.c4ShapeMargin-35;let n=e.wrap&&bt.wrap,r=Et(bt);r.fontSize=r.fontSize+2,r.fontWeight="bold",At("label",e,n,r,(0,i.Un)(e.label.text,r)),ut.drawBoundary(t,e,bt)}),"drawBoundary"),wt=(0,r.K2)((function(t,e,a,n){let r=0;for(const s of n){r=0;const n=a[s];let l=mt(bt,n.typeC4Shape.text);switch(l.fontSize=l.fontSize-2,n.typeC4Shape.width=(0,i.Un)("\xab"+n.typeC4Shape.text+"\xbb",l),n.typeC4Shape.height=l.fontSize+2,n.typeC4Shape.Y=bt.c4ShapePadding,r=n.typeC4Shape.Y+n.typeC4Shape.height-4,n.image={width:0,height:0,Y:0},n.typeC4Shape.text){case"person":case"external_person":n.image.width=48,n.image.height=48,n.image.Y=r,r=n.image.Y+n.image.height}n.sprite&&(n.image.width=48,n.image.height=48,n.image.Y=r,r=n.image.Y+n.image.height);let o=n.wrap&&bt.wrap,c=bt.width-2*bt.c4ShapePadding,h=mt(bt,n.typeC4Shape.text);if(h.fontSize=h.fontSize+2,h.fontWeight="bold",At("label",n,o,h,c),n.label.Y=r+8,r=n.label.Y+n.label.height,n.type&&""!==n.type.text){n.type.text="["+n.type.text+"]",At("type",n,o,mt(bt,n.typeC4Shape.text),c),n.type.Y=r+5,r=n.type.Y+n.type.height}else if(n.techn&&""!==n.techn.text){n.techn.text="["+n.techn.text+"]",At("techn",n,o,mt(bt,n.techn.text),c),n.techn.Y=r+5,r=n.techn.Y+n.techn.height}let d=r,u=n.label.width;if(n.descr&&""!==n.descr.text){At("descr",n,o,mt(bt,n.typeC4Shape.text),c),n.descr.Y=r+20,r=n.descr.Y+n.descr.height,u=Math.max(n.label.width,n.descr.width),d=r-5*n.descr.textLines}u+=bt.c4ShapePadding,n.width=Math.max(n.width||bt.width,u,bt.width),n.height=Math.max(n.height||bt.height,d,bt.height),n.margin=n.margin||bt.c4ShapeMargin,t.insert(n),ut.drawC4Shape(e,n,bt)}t.bumpLastMargin(bt.c4ShapeMargin)}),"drawC4ShapeArray"),kt=class{static{(0,r.K2)(this,"Point")}constructor(t,e){this.x=t,this.y=e}},Ot=(0,r.K2)((function(t,e){let a=t.x,n=t.y,i=e.x,r=e.y,s=a+t.width/2,l=n+t.height/2,o=Math.abs(a-i),c=Math.abs(n-r),h=c/o,d=t.height/t.width,u=null;return n==r&&ai?u=new kt(a,l):a==i&&nr&&(u=new kt(s,n)),a>i&&n=h?new kt(a,l+h*t.width/2):new kt(s-o/c*t.height/2,n+t.height):a=h?new kt(a+t.width,l+h*t.width/2):new kt(s+o/c*t.height/2,n+t.height):ar?u=d>=h?new kt(a+t.width,l-h*t.width/2):new kt(s+t.height/2*o/c,n):a>i&&n>r&&(u=d>=h?new kt(a,l-t.width/2*h):new kt(s-t.height/2*o/c,n)),u}),"getIntersectPoint"),Tt=(0,r.K2)((function(t,e){let a={x:0,y:0};a.x=e.x+e.width/2,a.y=e.y+e.height/2;let n=Ot(t,a);return a.x=t.x+t.width/2,a.y=t.y+t.height/2,{startPoint:n,endPoint:Ot(e,a)}}),"getIntersectPoints"),vt=(0,r.K2)((function(t,e,a,n){let r=0;for(let s of e){r+=1;let t=s.wrap&&bt.wrap,e=St(bt);"C4Dynamic"===n.db.getC4Type()&&(s.label.text=r+": "+s.label.text);let l=(0,i.Un)(s.label.text,e);At("label",s,t,e,l),s.techn&&""!==s.techn.text&&(l=(0,i.Un)(s.techn.text,e),At("techn",s,t,e,l)),s.descr&&""!==s.descr.text&&(l=(0,i.Un)(s.descr.text,e),At("descr",s,t,e,l));let o=a(s.from),c=a(s.to),h=Tt(o,c);s.startPoint=h.startPoint,s.endPoint=h.endPoint}ut.drawRels(t,e,bt)}),"drawRels");function Rt(t,e,a,n,i){let r=new xt(i);r.data.widthLimit=a.data.widthLimit/Math.min(ft,n.length);for(let[s,l]of n.entries()){let n=0;l.image={width:0,height:0,Y:0},l.sprite&&(l.image.width=48,l.image.height=48,l.image.Y=n,n=l.image.Y+l.image.height);let o=l.wrap&&bt.wrap,c=Et(bt);if(c.fontSize=c.fontSize+2,c.fontWeight="bold",At("label",l,o,c,r.data.widthLimit),l.label.Y=n+8,n=l.label.Y+l.label.height,l.type&&""!==l.type.text){l.type.text="["+l.type.text+"]",At("type",l,o,Et(bt),r.data.widthLimit),l.type.Y=n+5,n=l.type.Y+l.type.height}if(l.descr&&""!==l.descr.text){let t=Et(bt);t.fontSize=t.fontSize-2,At("descr",l,o,t,r.data.widthLimit),l.descr.Y=n+20,n=l.descr.Y+l.descr.height}if(0==s||s%ft==0){let t=a.data.startx+bt.diagramMarginX,e=a.data.stopy+bt.diagramMarginY+n;r.setData(t,t,e,e)}else{let t=r.data.stopx!==r.data.startx?r.data.stopx+bt.diagramMarginX:r.data.startx,e=r.data.starty;r.setData(t,t,e,e)}r.name=l.alias;let h=i.db.getC4ShapeArray(l.alias),d=i.db.getC4ShapeKeys(l.alias);d.length>0&&wt(r,t,h,d),e=l.alias;let u=i.db.getBoundarys(e);u.length>0&&Rt(t,e,r,u,i),"global"!==l.alias&&Ct(t,l,r),a.data.stopy=Math.max(r.data.stopy+bt.c4ShapeMargin,a.data.stopy),a.data.stopx=Math.max(r.data.stopx+bt.c4ShapeMargin,a.data.stopx),pt=Math.max(pt,a.data.stopx),yt=Math.max(yt,a.data.stopy)}}(0,r.K2)(Rt,"drawInsideBoundary");var Dt={drawPersonOrSystemArray:wt,drawBoundary:Ct,setConf:_t,draw:(0,r.K2)((function(t,e,a,n){bt=(0,r.D7)().c4;const i=(0,r.D7)().securityLevel;let l;"sandbox"===i&&(l=(0,s.Ltv)("#i"+e));const o="sandbox"===i?(0,s.Ltv)(l.nodes()[0].contentDocument.body):(0,s.Ltv)("body");let c=n.db;n.db.setWrap(bt.wrap),gt=c.getC4ShapeInRow(),ft=c.getC4BoundaryInRow(),r.Rm.debug(`C:${JSON.stringify(bt,null,2)}`);const h="sandbox"===i?o.select(`[id="${e}"]`):(0,s.Ltv)(`[id="${e}"]`);ut.insertComputerIcon(h),ut.insertDatabaseIcon(h),ut.insertClockIcon(h);let d=new xt(n);d.setData(bt.diagramMarginX,bt.diagramMarginX,bt.diagramMarginY,bt.diagramMarginY),d.data.widthLimit=screen.availWidth,pt=bt.diagramMarginX,yt=bt.diagramMarginY;const u=n.db.getTitle();Rt(h,"",d,n.db.getBoundarys(""),n),ut.insertArrowHead(h),ut.insertArrowEnd(h),ut.insertArrowCrossHead(h),ut.insertArrowFilledHead(h),vt(h,n.db.getRels(),n.db.getC4Shape,n),d.data.stopx=pt,d.data.stopy=yt;const p=d.data;let y=p.stopy-p.starty+2*bt.diagramMarginY;const g=p.stopx-p.startx+2*bt.diagramMarginX;u&&h.append("text").text(u).attr("x",(p.stopx-p.startx)/2-4*bt.diagramMarginX).attr("y",p.starty+bt.diagramMarginY),(0,r.a$)(h,y,g,bt.useMaxWidth);const f=u?60:0;h.attr("viewBox",p.startx-bt.diagramMarginX+" -"+(bt.diagramMarginY+f)+" "+g+" "+(y+f)),r.Rm.debug("models:",p)}),"draw")},Nt={parser:d,db:V,renderer:Dt,styles:(0,r.K2)((t=>`.person {\n stroke: ${t.personBorder};\n fill: ${t.personBkg};\n }\n`),"getStyles"),init:(0,r.K2)((({c4:t,wrap:e})=>{Dt.setConf(t),V.setWrap(e)}),"init")}},83814:(t,e,a)=>{a.d(e,{CP:()=>c,HT:()=>d,PB:()=>h,aC:()=>o,lC:()=>s,m:()=>l,tk:()=>r});var n=a(10009),i=a(16750),r=(0,n.K2)(((t,e)=>{const a=t.append("rect");if(a.attr("x",e.x),a.attr("y",e.y),a.attr("fill",e.fill),a.attr("stroke",e.stroke),a.attr("width",e.width),a.attr("height",e.height),e.name&&a.attr("name",e.name),e.rx&&a.attr("rx",e.rx),e.ry&&a.attr("ry",e.ry),void 0!==e.attrs)for(const n in e.attrs)a.attr(n,e.attrs[n]);return e.class&&a.attr("class",e.class),a}),"drawRect"),s=(0,n.K2)(((t,e)=>{const a={x:e.startx,y:e.starty,width:e.stopx-e.startx,height:e.stopy-e.starty,fill:e.fill,stroke:e.stroke,class:"rect"};r(t,a).lower()}),"drawBackgroundRect"),l=(0,n.K2)(((t,e)=>{const a=e.text.replace(n.H1," "),i=t.append("text");i.attr("x",e.x),i.attr("y",e.y),i.attr("class","legend"),i.style("text-anchor",e.anchor),e.class&&i.attr("class",e.class);const r=i.append("tspan");return r.attr("x",e.x+2*e.textMargin),r.text(a),i}),"drawText"),o=(0,n.K2)(((t,e,a,n)=>{const r=t.append("image");r.attr("x",e),r.attr("y",a);const s=(0,i.J)(n);r.attr("xlink:href",s)}),"drawImage"),c=(0,n.K2)(((t,e,a,n)=>{const r=t.append("use");r.attr("x",e),r.attr("y",a);const s=(0,i.J)(n);r.attr("xlink:href",`#${s}`)}),"drawEmbeddedImage"),h=(0,n.K2)((()=>({x:0,y:0,width:100,height:100,fill:"#EDF2AE",stroke:"#666",anchor:"start",rx:0,ry:0})),"getNoteRect"),d=(0,n.K2)((()=>({x:0,y:0,width:100,height:100,"text-anchor":"start",style:"#666",textMargin:0,rx:0,ry:0,tspan:!0})),"getTextObj")}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/26742c3b.ba01b343.js b/pr-preview/pr-1071/assets/js/26742c3b.ba01b343.js
deleted file mode 100644
index f5226ce5fb..0000000000
--- a/pr-preview/pr-1071/assets/js/26742c3b.ba01b343.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[3108],{45694:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>u,frontMatter:()=>o,metadata:()=>s,toc:()=>d});const s=JSON.parse('{"id":"architecture/secrets","title":"Secrets & recovery","description":"When the Coordinator is configured with the initial manifest, it generates a random secret seed.","source":"@site/versioned_docs/version-0.9/architecture/secrets.md","sourceDirName":"architecture","slug":"/architecture/secrets","permalink":"/contrast/pr-preview/pr-1071/0.9/architecture/secrets","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-0.9/architecture/secrets.md","tags":[],"version":"0.9","frontMatter":{},"sidebar":"docs","previous":{"title":"Attestation","permalink":"/contrast/pr-preview/pr-1071/0.9/architecture/attestation"},"next":{"title":"Certificate authority","permalink":"/contrast/pr-preview/pr-1071/0.9/architecture/certificates"}}');var i=r(74848),n=r(28453);const o={},a="Secrets & recovery",c={},d=[{value:"Persistence",id:"persistence",level:2},{value:"Recovery",id:"recovery",level:2}];function h(e){const t={code:"code",h1:"h1",h2:"h2",header:"header",p:"p",...(0,n.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.header,{children:(0,i.jsx)(t.h1,{id:"secrets--recovery",children:"Secrets & recovery"})}),"\n",(0,i.jsx)(t.p,{children:"When the Coordinator is configured with the initial manifest, it generates a random secret seed.\nFrom this seed, it uses an HKDF to derive the CA root key and a signing key for the manifest history.\nThis derivation is deterministic, so the seed can be used to bring any Coordinator to this Coordinator's state."}),"\n",(0,i.jsxs)(t.p,{children:["The secret seed is returned to the user on the first call to ",(0,i.jsx)(t.code,{children:"contrast set"}),", encrypted with the user's public seed share owner key.\nIf no seed share owner key is provided, a key is generated and stored in the working directory."]}),"\n",(0,i.jsx)(t.h2,{id:"persistence",children:"Persistence"}),"\n",(0,i.jsxs)(t.p,{children:["The Coordinator runs as a ",(0,i.jsx)(t.code,{children:"StatefulSet"})," with a dynamically provisioned persistent volume.\nThis volume stores the manifest history and the associated runtime policies.\nThe manifest isn't considered sensitive information, because it needs to be passed to the untrusted infrastructure in order to start workloads.\nHowever, the Coordinator must ensure its integrity and that the persisted data corresponds to the manifests set by authorized users.\nThus, the manifest is stored in plain text, but is signed with a private key derived from the Coordinator's secret seed."]}),"\n",(0,i.jsx)(t.h2,{id:"recovery",children:"Recovery"}),"\n",(0,i.jsxs)(t.p,{children:["When a Coordinator starts up, it doesn't have access to the signing secret and can thus not verify the integrity of the persisted manifests.\nIt needs to be provided with the secret seed, from which it can derive the signing key that verifies the signatures.\nThis procedure is called recovery and is initiated by the workload owner.\nThe CLI decrypts the secret seed using the private seed share owner key, verifies the Coordinator and sends the seed through the ",(0,i.jsx)(t.code,{children:"Recover"})," method.\nThe Coordinator recovers its key material and verifies the manifest history signature."]})]})}function u(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(h,{...e})}):h(e)}},28453:(e,t,r)=>{r.d(t,{R:()=>o,x:()=>a});var s=r(96540);const i={},n=s.createContext(i);function o(e){const t=s.useContext(n);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:o(e.components),s.createElement(n.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/27004ef7.d11dfe88.js b/pr-preview/pr-1071/assets/js/27004ef7.d11dfe88.js
deleted file mode 100644
index a859205298..0000000000
--- a/pr-preview/pr-1071/assets/js/27004ef7.d11dfe88.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[2154],{23003:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>i,toc:()=>c});const i=JSON.parse('{"id":"features-limitations","title":"Planned features and limitations","description":"This section lists planned features and current limitations of Contrast.","source":"@site/versioned_docs/version-1.1/features-limitations.md","sourceDirName":".","slug":"/features-limitations","permalink":"/contrast/pr-preview/pr-1071/1.1/features-limitations","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-1.1/features-limitations.md","tags":[],"version":"1.1","frontMatter":{},"sidebar":"docs","previous":{"title":"Observability","permalink":"/contrast/pr-preview/pr-1071/1.1/architecture/observability"},"next":{"title":"Telemetry","permalink":"/contrast/pr-preview/pr-1071/1.1/about/telemetry"}}');var r=n(74848),s=n(28453);const o={},a="Planned features and limitations",l={},c=[{value:"Availability",id:"availability",level:2},{value:"Kubernetes features",id:"kubernetes-features",level:2},{value:"Runtime policies",id:"runtime-policies",level:2},{value:"Tooling integration",id:"tooling-integration",level:2},{value:"Automatic recovery and high availability",id:"automatic-recovery-and-high-availability",level:2}];function d(e){const t={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",header:"header",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.header,{children:(0,r.jsx)(t.h1,{id:"planned-features-and-limitations",children:"Planned features and limitations"})}),"\n",(0,r.jsx)(t.p,{children:"This section lists planned features and current limitations of Contrast."}),"\n",(0,r.jsx)(t.h2,{id:"availability",children:"Availability"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Platform support"}),": At present, Contrast is exclusively available on Azure AKS, supported by the ",(0,r.jsx)(t.a,{href:"https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers-on-aks-preview",children:"Confidential Container preview for AKS"}),". Expansion to other cloud platforms is planned, pending the availability of necessary infrastructure enhancements."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Bare-metal support"}),": Support for running ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/getting-started/bare-metal",children:"Contrast on bare-metal Kubernetes"})," is available for AMD SEV-SNP and Intel TDX."]}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"kubernetes-features",children:"Kubernetes features"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Persistent volumes"}),": Contrast only supports volumes with ",(0,r.jsx)(t.a,{href:"https://kubernetes.io/docs/concepts/storage/persistent-volumes/#volume-mode",children:(0,r.jsx)(t.code,{children:"volumeMode: Block"})}),". These block devices are provided by the untrusted environment and should be treated accordingly. We plan to provide transparent encryption on top of block devices in a future release."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Port forwarding"}),": This feature ",(0,r.jsx)(t.a,{href:"https://github.com/kata-containers/kata-containers/issues/1693",children:"isn't yet supported by Kata Containers"}),". You can ",(0,r.jsx)(t.a,{href:"https://docs.edgeless.systems/contrast/deployment#connect-to-the-contrast-coordinator",children:"deploy a port-forwarder"})," as a workaround."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Resource limits"}),": There is an existing bug on AKS where container memory limits are incorrectly applied. The current workaround involves using only memory requests instead of limits."]}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"runtime-policies",children:"Runtime policies"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Coverage"}),": While the enforcement of workload policies generally functions well, ",(0,r.jsx)(t.a,{href:"https://github.com/microsoft/kata-containers/releases/tag/3.2.0.azl0.genpolicy",children:"there are scenarios not yet fully covered"}),". It's crucial to review deployments specifically for these edge cases."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Order of events"}),": The current policy evaluation mechanism on API requests isn't stateful, so it can't ensure a prescribed order of events. Consequently, there's no guaranteed enforcement that the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/service-mesh",children:"service mesh sidecar"})," container runs ",(0,r.jsx)(t.em,{children:"before"})," the workload container. This order ensures that all traffic between pods is securely encapsulated within TLS connections."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Absence of events"}),": Policies can't ensure certain events have happened. A container, such as the ",(0,r.jsx)(t.a,{href:"/contrast/pr-preview/pr-1071/1.1/components/service-mesh",children:"service mesh sidecar"}),", can be omitted entirely. Environment variables may be missing."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Volume integrity checks"}),": While persistent volumes aren't supported yet, integrity checks don't currently cover other objects such as ",(0,r.jsx)(t.code,{children:"ConfigMaps"})," and ",(0,r.jsx)(t.code,{children:"Secrets"}),"."]}),"\n"]}),"\n",(0,r.jsx)(t.admonition,{type:"warning",children:(0,r.jsx)(t.p,{children:"The policy limitations, in particular the missing guarantee that our service mesh sidecar has been started before the workload container affects the service mesh implementation of Contrast. Currently, this requires inspecting the iptables rules on startup or terminating TLS connections in the workload directly."})}),"\n",(0,r.jsx)(t.h2,{id:"tooling-integration",children:"Tooling integration"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"CLI availability"}),": The CLI tool is currently only available for Linux. This limitation arises because certain upstream dependencies haven't yet been ported to other platforms."]}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"automatic-recovery-and-high-availability",children:"Automatic recovery and high availability"}),"\n",(0,r.jsx)(t.p,{children:"The Contrast Coordinator is a singleton and can't be scaled to more than one instance.\nWhen this instance's pod is restarted, for example for node maintenance, it needs to be recovered manually.\nIn a future release, we plan to support distributed Coordinator instances that can recover automatically."})]})}function h(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>o,x:()=>a});var i=n(96540);const r={},s=i.createContext(r);function o(e){const t=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),i.createElement(s.Provider,{value:t},e.children)}}}]);
\ No newline at end of file
diff --git a/pr-preview/pr-1071/assets/js/270470f6.5faa0f56.js b/pr-preview/pr-1071/assets/js/270470f6.5faa0f56.js
deleted file mode 100644
index 7bf37ae892..0000000000
--- a/pr-preview/pr-1071/assets/js/270470f6.5faa0f56.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkcontrast_docs=self.webpackChunkcontrast_docs||[]).push([[8671],{67669:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>a,contentTitle:()=>c,default:()=>l,frontMatter:()=>o,metadata:()=>s,toc:()=>h});const s=JSON.parse('{"id":"components/service-mesh","title":"Service mesh","description":"The Contrast service mesh secures the communication of the workload by automatically","source":"@site/versioned_docs/version-1.0/components/service-mesh.md","sourceDirName":"components","slug":"/components/service-mesh","permalink":"/contrast/pr-preview/pr-1071/1.0/components/service-mesh","draft":false,"unlisted":false,"editUrl":"https://github.com/edgelesssys/contrast/edit/main/docs/versioned_docs/version-1.0/components/service-mesh.md","tags":[],"version":"1.0","frontMatter":{},"sidebar":"docs","previous":{"title":"Policies","permalink":"/contrast/pr-preview/pr-1071/1.0/components/policies"},"next":{"title":"Attestation","permalink":"/contrast/pr-preview/pr-1071/1.0/architecture/attestation"}}');var i=t(74848),r=t(28453);const o={},c="Service mesh",a={},h=[{value:"Configuring the proxy",id:"configuring-the-proxy",level:2},{value:"Ingress",id:"ingress",level:3},{value:"Egress",id:"egress",level:3}];function d(e){const n={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",p:"p",pre:"pre",ul:"ul",...(0,r.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.header,{children:(0,i.jsx)(n.h1,{id:"service-mesh",children:"Service mesh"})}),"\n",(0,i.jsxs)(n.p,{children:["The Contrast service mesh secures the communication of the workload by automatically\nwrapping the network traffic inside mutual TLS (mTLS) connections. The\nverification of the endpoints in the connection establishment is based on\ncertificates that are part of the\n",(0,i.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/1.0/architecture/certificates",children:"PKI of the Coordinator"}),"."]}),"\n",(0,i.jsxs)(n.p,{children:["The service mesh can be enabled on a per-workload basis by adding a service mesh\nconfiguration to the workload's object annotations. During the ",(0,i.jsx)(n.code,{children:"contrast generate"}),"\nstep, the service mesh is added as a ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/",children:"sidecar\ncontainer"})," to\nall workloads which have a specified configuration. The service mesh container first\nsets up ",(0,i.jsx)(n.code,{children:"iptables"})," rules based on its configuration and then starts\n",(0,i.jsx)(n.a,{href:"https://www.envoyproxy.io/",children:"Envoy"})," for TLS origination and termination."]}),"\n",(0,i.jsx)(n.h2,{id:"configuring-the-proxy",children:"Configuring the proxy"}),"\n",(0,i.jsx)(n.p,{children:"The service mesh container can be configured using the following object annotations:"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"contrast.edgeless.systems/servicemesh-ingress"})," to configure ingress."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"contrast.edgeless.systems/servicemesh-egress"})," to configure egress."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"contrast.edgeless.systems/servicemesh-admin-interface-port"})," to configure the Envoy\nadmin interface. If not specified, no admin interface will be started."]}),"\n"]}),"\n",(0,i.jsxs)(n.p,{children:["If you aren't using the automatic service mesh injection and want to configure the\nservice mesh manually, set the environment variables ",(0,i.jsx)(n.code,{children:"CONTRAST_INGRESS_PROXY_CONFIG"}),",\n",(0,i.jsx)(n.code,{children:"CONTRAST_EGRESS_PROXY_CONFIG"})," and ",(0,i.jsx)(n.code,{children:"CONTRAST_ADMIN_PORT"})," in the service mesh sidecar directly."]}),"\n",(0,i.jsx)(n.h3,{id:"ingress",children:"Ingress"}),"\n",(0,i.jsxs)(n.p,{children:["All TCP ingress traffic is routed over Envoy by default. Since we use\n",(0,i.jsx)(n.a,{href:"https://docs.kernel.org/networking/tproxy.html",children:"TPROXY"}),", the destination address\nremains the same throughout the packet handling."]}),"\n",(0,i.jsxs)(n.p,{children:["Any incoming connection is required to present a client certificate signed by the\n",(0,i.jsx)(n.a,{href:"/contrast/pr-preview/pr-1071/1.0/architecture/certificates#usage-of-the-different-certificates",children:"mesh CA certificate"}),".\nEnvoy presents a certificate chain of the mesh\ncertificate of the workload and the intermediate CA certificate as the server certificate."]}),"\n",(0,i.jsxs)(n.p,{children:["If the deployment contains workloads which should be reachable from outside the\nService Mesh, while still handing out the certificate chain, disable client\nauthentication by setting the annotation ",(0,i.jsx)(n.code,{children:"contrast.edgeless.systems/servicemesh-ingress"})," as\n",(0,i.jsx)(n.code,{children:"##false"}),". Separate multiple entries with ",(0,i.jsx)(n.code,{children:"##"}),". You can choose any\ndescriptive string identifying the service on the given port for the ",(0,i.jsx)(n.code,{children:"
