Troubleshooting: No Data After Installing Flex Agent via Kubernetes

Overview

You've signed up for Contrast CVE Shield Free tier, installed the Flex Agent via Kubernetes, and connected your first Java application, but it either doesn't show up in Northstar at all, or it shows up with 0 libraries and no data.

This guide walks through what to check, in order, starting with the fastest and easiest methods to try.

Note: Did you install a Contrast agent with the Flex Agent directly instead? See the Troubleshooting guide for your installation method for details.

Prerequisites

• A CVE Shield account with an agent installed.

• A Java application you can connect.

• kubectl access to the cluster and namespace where your application runs.

Step-by-Step Instructions

1. Send some traffic to your application

Northstar doesn't show library or code data until it sees your application actually running. Open your application in a browser, or hit any URL it responds to, and wait about a minute.

If you don't have an easy way to generate traffic yet, a single request to any page or endpoint is enough to get things started.

If you’d rather script it:

curl -s -o /dev/null -w "%{http_code}\n" http://<app-hostname>/<some-endpoint>

2.  Give it a few minutes, then check again

After your first request, it can take a short time for data to appear. Refresh the CVEs page, and check Explorer > Contrast Graph or Administration > Agent management if the CVE Shield table is still empty.

If you still see nothing after a few minutes, move on to the checks below.

3. Check your application limit (422 error)

CVE Shield Free tier supports up to 2 applications and 12 services total. If you're at that limit, a new application won't report data. You'll usually see an upgrade prompt in the UI, and the agent log will show a 422 Application limit reached entry (see the next step for how to view the log).

Go to Explorer > CVEs to check your current count against the limit shown at the top of the page. If you're over, archive or delete unused applications left over from prior test runs, then restart the deployment. See “Force a fresh attempt after any fix” below for the exact command.

4. Search the Community forum

Check the Gather Community forum (linked from your account dropdown) for your exact symptom. This is often the fastest way to confirm what's going on and what fixes it for others.

5. Check your credentials (401 error)

The agent's log lives at /contrast/data/logs/contrast_agent.log by default. To view it:

kubectl exec -it $(kubectl get pod -l app=<app-label> -o jsonpath='{.items[0].metadata.name}') -- tail -50 /contrast/data/logs/contrast_agent.log

If the log is long, filter for known signal phrases instead of scrolling:

kubectl exec -it $(kubectl get pod -l app=<app-label> -o jsonpath='{.items[0].metadata.name}') -- grep -iE "error|fail|limit|401|403|422|successfully created|standalone mode" /contrast/data/logs/contrast_agent.log

A standalone mode warning about the application name being ignored is usually cosmetic, as long as a successful registration line appears further down the log. Confirm the app shows up in Northstar under the name you expect, not as null.

If it shows 401 Unauthorized or “no longer authorized,” your connection token or API key is stale, revoked, or was rotated elsewhere.

Generate a fresh credential from your agent key settings, update it wherever the agent reads it from, then restart the deployment. See “Force a fresh attempt after any fix” below for the exact command.

6. Confirm the agent process is running and attached

If none of the checks above turned up anything, confirm the pod is up and the agent was actually injected:

1. Confirm the pod is running: kubectl get pods -l app=<app-label>. Wait until it shows 1/1 Running. A pod still in ContainerCreating, Init, or Pending won't have written any agent logs yet.
2. Confirm the agent was injected: kubectl get pods -l app=<app-label> -o jsonpath='{.items[0].spec.initContainers[*].name}'. Empty output means the injection never happened.
3. If injection didn't happen, check the label: kubectl get deployment <deployment-name> --show-labels. You're looking for contrast-agent=flex (or whatever value your Flex injector's selector expects). If your setup opts in at the namespace level, also check kubectl get namespace <namespace> --show-labels.

Replace <app-label>, <deployment-name>, and <namespace> with your actual values.

Force a fresh attempt after any fix

Actions like a new credential, a freed-up slot, a fixed label don’t take effect on a process that's already running. Whatever you fixed, restart to make it stick:

kubectl rollout restart deployment <deployment-name>, then confirm agent attachment is enabled before moving on.

Advanced Troubleshooting Steps

Check the agent's connection info

Run java -jar contrast.jar info. If any returned field is null, your token or API key isn't set correctly — reinstall using the install wizard's provided key/token.

Run the built-in connectivity check

Run java -jar contrast.jar diagnostic. This checks whether the agent can resolve DNS and reach Northstar, and flags network, proxy, or TLS issues.

Turn on debug logging

Still stuck? Turn on CONTRAST__AGENT__LOGGER__LEVEL=DEBUG for more detail (use CONTRAST__AGENT__LOGGER__STDOUT=true if you don't have easy access to log files), restart, and check the log again for the 401/422 entries above.

Still no errors at all? 

The agent likely hasn't reached the point of registering yet. Wait a bit longer, then check network connectivity to your organization's agent URL.

Expected Outcome

Your application appears in Explorer > Contrast Graph with library data, and Issues begins showing CVE data as it is detected.

Escalation path

• Free: Post your error message and the steps you've tried in the Gather Community forum. The first time you visit, you need to create an account.