sealing: re-seal KEK if seal mode changes

charts/templates/coordinator.yaml

@@ -40,6 +40,10 @@ spec:
       serviceAccountName: marblerun-coordinator
       containers:
         - env:
+          {{- if .Values.coordinator.debugLogging }}
+          - name: EDG_DEBUG_LOGGING
+            value: "1"
+          {{- end }}
           - name: EDG_COORDINATOR_MESH_ADDR
             value: "{{ .Values.coordinator.meshServerHost }}:{{ .Values.coordinator.meshServerPort }}"
           - name: EDG_COORDINATOR_CLIENT_ADDR

charts/values.yaml

@@ -75,6 +75,8 @@ coordinator:
   sealDir: "/coordinator/data/"
   # OE_SIMULATION needs be set to "1" when running on systems without SGX1+FLC capabilities
   simulation: false
+  # Enable debug logging in the coordinator
+  debugLogging: false
 
   probes:
     readiness:

coordinator/seal/distributed/seal.go

@@ -211,7 +211,17 @@ func (s *Sealer) SetSealMode(mode seal.Mode) {
 	s.mux.Lock()
 	defer s.mux.Unlock()
 	s.log.Debug("Setting seal mode", zap.Int("sealMode", int(mode)))
+
+	needsResealing := s.mode != mode && s.keyEncryptionKey != nil
+
 	s.mode = mode
+
+	if needsResealing {
+		s.log.Debug("Seal mode changed: resealing key encryption key")
+		if err := s.sealKEK(context.Background()); err != nil {
+			s.log.Error("Failed to reseal key encryption key after seal mode change", zap.Error(err))
+		}
+	}
 }
 
 // sealKEK seals the sealer's key encryption key using the enclave's product or unique key (if not disabled).

test/e2e/helm/helm.go

@@ -79,6 +79,7 @@ func (h *Helm) InstallChart(
 				"tenantID":     os.Getenv(constants.EnvAzureTenantID),
 				"clientSecret": os.Getenv(constants.EnvAzureClientSecret),
 			},
+			"debugLogging": true,
 		},
 	}
 	values = mergeMaps(values, extraValues)