Skip to main content

Verifying Trust Domain Servers Connectivity

You can check the logs of the Trust Domain Server pods to verify that the Trust Domain servers are connected to the Defakto Control Plane. The following log message indicates a successful connection with the Control Plane:

{
  "logger": "server.controlPlaneAPIServer.relay-listener",
  "msg": "Dialed signer relay successfully"
}

Note that:

  1. The --namespace or -n value is the Kubernetes namespace that was used when installing the Trust Domain Server via Helm.
  2. The deployment name contains the trust domain deployment (tdd) ID that was returned when calling spirlctl trust-domain deployment create....
 kubectl -n $YOUR_TD_DEPLOYMENT_ID-example logs deployment/$YOUR_TD_DEPLOYMENT_ID-spirl-server --container spirl-server | grep "Dialed signer relay successfully"

Every login also names the credential the server used, in the authMethod field. For keyless authentication, look for k8s_token:

kubectl -n $YOUR_TD_DEPLOYMENT_ID-example logs deployment/$YOUR_TD_DEPLOYMENT_ID-spirl-server --container spirl-server \
  | grep -E "Authentication succeeded|Authentication failed|fallback auth method"
{"level":"info","msg":"Authentication succeeded","authMethod":"k8s_token"}

If metrics are enabled, the same result shows up as a count. Expect a non-zero value for auth_method="k8s_token":

kubectl -n $YOUR_TD_DEPLOYMENT_ID-example port-forward deployment/$YOUR_TD_DEPLOYMENT_ID-spirl-server 19090:9090

# In a second terminal:
curl -s localhost:19090/metrics | grep spirl_session
spirl_session_established_total{auth_method="k8s_token"} 1