From a2b27d6a85aaba10cb717d560ba673543a398183 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Wei=C3=9Fe?= Date: Thu, 8 Jan 2026 16:11:37 +0100 Subject: [PATCH 1/2] e2e: enable Coordinator debug logs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel Weiße --- charts/templates/coordinator.yaml | 4 ++++ charts/values.yaml | 2 ++ test/e2e/helm/helm.go | 1 + 3 files changed, 7 insertions(+) diff --git a/charts/templates/coordinator.yaml b/charts/templates/coordinator.yaml index bf98de4c9..e6ddb6f7d 100644 --- a/charts/templates/coordinator.yaml +++ b/charts/templates/coordinator.yaml @@ -40,6 +40,10 @@ spec: serviceAccountName: marblerun-coordinator containers: - env: + {{- if .Values.coordinator.debugLogging }} + - name: EDG_DEBUG_LOGGING + value: "1" + {{- end }} - name: EDG_COORDINATOR_MESH_ADDR value: "{{ .Values.coordinator.meshServerHost }}:{{ .Values.coordinator.meshServerPort }}" - name: EDG_COORDINATOR_CLIENT_ADDR diff --git a/charts/values.yaml b/charts/values.yaml index ac8e8b85e..51833139b 100644 --- a/charts/values.yaml +++ b/charts/values.yaml @@ -75,6 +75,8 @@ coordinator: sealDir: "/coordinator/data/" # OE_SIMULATION needs be set to "1" when running on systems without SGX1+FLC capabilities simulation: false + # Enable debug logging in the coordinator + debugLogging: false probes: readiness: diff --git a/test/e2e/helm/helm.go b/test/e2e/helm/helm.go index dca7ce57b..b93bf2f58 100644 --- a/test/e2e/helm/helm.go +++ b/test/e2e/helm/helm.go @@ -79,6 +79,7 @@ func (h *Helm) InstallChart( "tenantID": os.Getenv(constants.EnvAzureTenantID), "clientSecret": os.Getenv(constants.EnvAzureClientSecret), }, + "debugLogging": true, }, } values = mergeMaps(values, extraValues) From e5dfb4ae90fe2baecd9b7237747c802fd38ee5d0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Wei=C3=9Fe?= Date: Mon, 12 Jan 2026 10:12:19 +0100 Subject: [PATCH 2/2] seal: re-seal kek if seal mode changes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel Weiße --- coordinator/seal/distributed/seal.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/coordinator/seal/distributed/seal.go b/coordinator/seal/distributed/seal.go index e7e30ad8c..71a789ed6 100644 --- a/coordinator/seal/distributed/seal.go +++ b/coordinator/seal/distributed/seal.go @@ -211,7 +211,17 @@ func (s *Sealer) SetSealMode(mode seal.Mode) { s.mux.Lock() defer s.mux.Unlock() s.log.Debug("Setting seal mode", zap.Int("sealMode", int(mode))) + + needsResealing := s.mode != mode && s.keyEncryptionKey != nil + s.mode = mode + + if needsResealing { + s.log.Debug("Seal mode changed: resealing key encryption key") + if err := s.sealKEK(context.Background()); err != nil { + s.log.Error("Failed to reseal key encryption key after seal mode change", zap.Error(err)) + } + } } // sealKEK seals the sealer's key encryption key using the enclave's product or unique key (if not disabled).