Troubleshooting

Reset your Comply password

If you forget your password, you can reset it in the user admin console.

SSH into your Comply node and run the following commands to retrieve the admin username and password:

kubectl exec $(kubectl get pod -l app.kubernetes.io/name=comply-auth -o jsonpath="{.items[0].metadata.name}") -- /bin/bash -c 'cat /etc/keycloak/admin-user'

kubectl exec $(kubectl get pod -l app.kubernetes.io/name=comply-auth -o jsonpath="{.items[0].metadata.name}") -- /bin/bash -c 'cat /etc/keycloak/admin-password'

Navigate to https://<COMPLY-HOSTNAME>/auth/admin using the FQDN of your Comply node.
Login using the credentials from step 1.
Navigate to Users.
Click View all users and select the user account you want to update, and click Edit.
Select the Credentials tab and the reset password.

Reset the platform admin console

As part of the installation process, the platform admin console generates a password for you. You can update this password to one of your choosing after installation.

To reset the platform admin console password, run:
```
kubectl -n default kots reset-password
```
The system prompts you to enter a new password of your choosing.
If the command fails with an unknown command "kots" for "kubectl" error it's because /usr/local/bin is not in the path. To address this error, either update the path to include /usr/local/bin, or run:
```
/usr/local/bin/kubectl-kots reset-password default
```

Access logs

If you run into issues with Puppet Comply, you can download the relevant log files. The Comply logs are stored in the platform admin console.

Navigate to the platform admin console — https://<PLATFORM-ADMIN-CONSOLE-ADDRESS>:8800.
Select the Troubleshoot tab, and click Analyse Comply.
Download the bundle of log files.

Resolve Comply domain

If the Puppet Comply gatekeeper is unable to resolve the Comply domain, try the following troubleshooting steps.

When you assign a hostname to Comply, it needs to be resolved by the pods in your Kubernetes cluster. A preflight check verifies the domain you specified in the configuration is resolvable. You must ensure that the nodes can resolve their own hostnames, through either local host mapping or a reachable DNS server.

To verify your whether your hostname is resolvable, run the following commands:
```
kubectl exec $(kubectl get pod -l app=kotsadm -o jsonpath="{.items[0].metadata.name}") -- /bin/sh -c 'curl --SI <hostname>'
```
If the hostname was resolved, the command returns an exit code 0 with no output.

If the hostname cannot be resolved, the command returns an exit code 6. Proceed to step 2 to add DNS entries.
To add DNS entries for CoreDNS, run the following command to open the CoreDNS configuration maps:
```
kubectl -n kube-system edit configmaps coredns
```

Add a hosts entry below kubernetes. This is where you configure the DNS entry for Comply. For example:

kubernetes cluster.local in-addr.arpa ip6.arpa {
   pods insecure
   fallthrough in-addr.arpa ip6.arpa
   ttl 30
}
hosts {
  10.23.24.25 comply.mycompany.net comply // IP_address canonical_hostname [aliases...]
  fallthrough
}
prometheus :9153

Run the command from step 1 to verify whether the DNS entry was updated:

kubectl exec $(kubectl get pod -l app=kotsadm -o jsonpath="{.items[0].metadata.name}") -- /bin/sh -c 'curl --SI <hostname>'

Re-run the preflight checks.

Update the platform admin console's TLS certificate

A self-signed TLS certificate secures the connection between your browser and the platform admin console. Once the initial platform admin console setup process is complete, you can upload new certificates by enabling changes to the installation's Kubernetes secrets.

Use this process if you choose not to add a TLS certificate when installing the platform admin console, or if you need to update your existing TLS certificate.

Enable changes to your installation's kotsadm-tls Kubernetes secret by running:
```
kubectl -n default annotate secret kotsadm-tls acceptAnonymousUploads=1
```

Restart the kurl-proxy pod to deploy the change by running:

kubectl delete pods $(kubectl get pods -A | grep kurl-proxy | awk '{print $2}')

Once the kurl-rpoxy pod restarts and is back up and running, navigate to https://<HOSTNAME>:8800/tls and upload your new TLS certificate.