Implement SPIFFE bundle client and enable istiod xDS authn based on SPIFFE bundles

Enable Istiod to retrieve extra root cert from SPIFFE bundle endpoint for XDS client authn. This can make sure istiod can enforce strict client authn when the client is using a cert issued by a custom CA, as long as a SPIFFE bundle endpoint is offered. In this case, Istiod is still able to verify the cert using the root cert retrieved via the SPIFFE bundle endpoint.
[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[ X ] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[ X ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure

@myidpt: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

lint_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test lint_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@myidpt: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

lint_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test lint_istio

gencheck_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test gencheck_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@howardjohn Retrieving the root at installation time sounds like a good idea. It does tolerate potential issues due to connection to SPIFFE bundle endpoint.

@costinm I admit we need to support loading multiple root certs for the workloads, but this PR is to solve the istiod authenticating xDS client issue.
I'm glad to create follow up PRs to retrieve certs for istio agents. ConfigMap doesn't seem like a good idea. I'd prefer istio-agent directly pulling the bundle from the endpoint (the endpoint can be exposed on Istiod).

Agreed config map is not ideal - for this kind of use case we need to periodically rotate the root, because it changes. That's also the main reason I'm asking for multiple root support...
Note that config map plus a cron could be used even today - without code changes, and it's very reasonable to expect integration with external CAs to have some CA-specific code running in the cluster - for example as a signer for the K8S API or to distribute the roots.
I'm not asking for agent to pull directly in this PR ( or to pull multiple roots in this PR ), just to make sure we can deal with multiple sources and to have the code in a place where it can be reused by
future PRs that add this to agent.
Right now Istiod is distributing the roots as a config map - I am not entirely sure if 2 roots are tested.
Keep in mind that some CAs may rotate quite often - in particular given the lack of revocation support. I don't see how we can avoid support for multiple roots.

Sorry - just realized my comments contradict each other. I asked to add this to ProxyConfig - and it may be ok as first step, but we already have an official Istio API to configure how to verify client certificates, in Gateway caCertificates.  So the proper API discussion will be if we should on extending Gateway to support a list of URLs where we would fetch caCertificates for MUTUAL client authentication, and possibly DestinationRule with a similar/consistent config (it also has a 'caCertificates' option).
In other words - if we want to support downloading root CAs - either for spifee validation or for non-spiffee (PEM) - we should do it consistently and update the stable APIs, possibly starting with experimental setting in ProxyConfig but with the path to the beta APIs.

@myidpt: PR needs rebase.

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@myidpt: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

lint_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test lint_istio

gencheck_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test gencheck_istio

integ-telemetry-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-telemetry-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@myidpt: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

lint_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test lint_istio

gencheck_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test gencheck_istio

integ-telemetry-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-telemetry-k8s-tests_istio

integ-multicluster-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-multicluster-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@myidpt: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

lint_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test lint_istio

gencheck_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test gencheck_istio

integ-telemetry-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-telemetry-k8s-tests_istio

integ-multicluster-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-multicluster-k8s-tests_istio

integ-pilot-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-pilot-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@myidpt: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

lint_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test lint_istio

gencheck_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test gencheck_istio

integ-telemetry-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-telemetry-k8s-tests_istio

integ-multicluster-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-multicluster-k8s-tests_istio

integ-pilot-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-pilot-k8s-tests_istio

release-test_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test release-test_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@myidpt: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

lint_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test lint_istio

gencheck_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test gencheck_istio

integ-telemetry-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-telemetry-k8s-tests_istio

integ-multicluster-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-multicluster-k8s-tests_istio

integ-pilot-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-pilot-k8s-tests_istio

release-test_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test release-test_istio

integ-operator-controller-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-operator-controller-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@myidpt: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

lint_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test lint_istio

gencheck_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test gencheck_istio

integ-telemetry-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-telemetry-k8s-tests_istio

integ-multicluster-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-multicluster-k8s-tests_istio

integ-pilot-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-pilot-k8s-tests_istio

release-test_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test release-test_istio

integ-operator-controller-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-operator-controller-tests_istio

integ-distroless-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-distroless-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@myidpt: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

lint_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test lint_istio

gencheck_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test gencheck_istio

integ-telemetry-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-telemetry-k8s-tests_istio

integ-multicluster-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-multicluster-k8s-tests_istio

integ-pilot-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-pilot-k8s-tests_istio

release-test_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test release-test_istio

integ-operator-controller-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-operator-controller-tests_istio

integ-distroless-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-distroless-k8s-tests_istio

integ-mixer-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-mixer-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@myidpt: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

lint_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test lint_istio

gencheck_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test gencheck_istio

integ-telemetry-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-telemetry-k8s-tests_istio

integ-multicluster-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-multicluster-k8s-tests_istio

integ-pilot-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-pilot-k8s-tests_istio

release-test_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test release-test_istio

integ-operator-controller-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-operator-controller-tests_istio

integ-distroless-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-distroless-k8s-tests_istio

integ-mixer-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-mixer-k8s-tests_istio

integ-security-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-security-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@myidpt: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

gencheck_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test gencheck_istio

integ-telemetry-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-telemetry-k8s-tests_istio

integ-multicluster-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-multicluster-k8s-tests_istio

integ-pilot-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-pilot-k8s-tests_istio

release-test_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test release-test_istio

integ-operator-controller-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-operator-controller-tests_istio

integ-distroless-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-distroless-k8s-tests_istio

integ-mixer-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-mixer-k8s-tests_istio

integ-security-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-security-k8s-tests_istio

lint_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test lint_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@myidpt: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

gencheck_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test gencheck_istio

integ-telemetry-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-telemetry-k8s-tests_istio

integ-multicluster-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-multicluster-k8s-tests_istio

integ-pilot-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-pilot-k8s-tests_istio

release-test_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test release-test_istio

integ-operator-controller-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-operator-controller-tests_istio

integ-distroless-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-distroless-k8s-tests_istio

integ-mixer-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-mixer-k8s-tests_istio

integ-security-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-security-k8s-tests_istio

lint_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test lint_istio

integ-galley-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-galley-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@myidpt: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

gencheck_istio
33a6ab274b78ad859f8aee81839bb8de3e6ba3c0
link
/test gencheck_istio

integ-telemetry-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-telemetry-k8s-tests_istio

integ-multicluster-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-multicluster-k8s-tests_istio

integ-pilot-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-pilot-k8s-tests_istio

release-test_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test release-test_istio

integ-operator-controller-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-operator-controller-tests_istio

integ-distroless-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-distroless-k8s-tests_istio

integ-mixer-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-mixer-k8s-tests_istio

integ-security-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-security-k8s-tests_istio

lint_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test lint_istio

integ-galley-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-galley-k8s-tests_istio

unit-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test unit-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@myidpt: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-telemetry-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-telemetry-k8s-tests_istio

integ-multicluster-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-multicluster-k8s-tests_istio

integ-pilot-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-pilot-k8s-tests_istio

release-test_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test release-test_istio

integ-operator-controller-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-operator-controller-tests_istio

integ-distroless-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-distroless-k8s-tests_istio

integ-mixer-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-mixer-k8s-tests_istio

integ-security-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-security-k8s-tests_istio

lint_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test lint_istio

integ-galley-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-galley-k8s-tests_istio

unit-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test unit-tests_istio

gencheck_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test gencheck_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@myidpt: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-telemetry-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-telemetry-k8s-tests_istio

integ-multicluster-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-multicluster-k8s-tests_istio

integ-pilot-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-pilot-k8s-tests_istio

release-test_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test release-test_istio

integ-operator-controller-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-operator-controller-tests_istio

integ-distroless-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-distroless-k8s-tests_istio

integ-mixer-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-mixer-k8s-tests_istio

integ-security-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-security-k8s-tests_istio

integ-galley-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-galley-k8s-tests_istio

unit-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test unit-tests_istio

gencheck_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test gencheck_istio

lint_istio
4dd4c08a2493653620b27614d6c85bf126a2d929
link
/test lint_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@myidpt: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-telemetry-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-telemetry-k8s-tests_istio

integ-multicluster-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-multicluster-k8s-tests_istio

integ-pilot-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-pilot-k8s-tests_istio

release-test_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test release-test_istio

integ-operator-controller-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-operator-controller-tests_istio

integ-distroless-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-distroless-k8s-tests_istio

integ-mixer-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-mixer-k8s-tests_istio

integ-security-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-security-k8s-tests_istio

integ-galley-k8s-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test integ-galley-k8s-tests_istio

unit-tests_istio
def17d9389e4f215a9b2880e09e11cddbdbd02f1
link
/test unit-tests_istio

lint_istio
4dd4c08a2493653620b27614d6c85bf126a2d929
link
/test lint_istio

gencheck_istio
4dd4c08a2493653620b27614d6c85bf126a2d929
link
/test gencheck_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@costinm I think I resolved some of your comments. Now the spiffe client can retrieve multiple root certs from different endpoints, and return a map from trustdomain to root certs. With this PR, Istiod isn't able to verify trust domains against the root cert it used for the cert verification. It's not very simple so I will defer it to another PR.

@costinm I'll make a following PR to do the same implementation for istio-agent, so that workloads can load multiple root certs. I'm not sure I fully understand your opinion about the API, but I know the problem. I think that warrants a short design, probably we don't need to resolve in this PR.

@costinm @howardjohn Can you take another look?

@myidpt: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

release-test_istio
ccdcc876d3c731601031d6f618875668f85aecc3
link
/test release-test_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@myidpt: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-pilot-k8s-tests_istio
4312c566dbcfc5b2dc643ac9c0dbb87bdd0c53ff
link
/test integ-pilot-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@myidpt: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-security-k8s-tests_istio
57b8be1b0964fa1f7012a75aa9e6875aa468bc01
link
/test integ-security-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/test integ-security-k8s-tests_istio

@myidpt: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-security-k8s-tests_istio
57b8be1b0964fa1f7012a75aa9e6875aa468bc01
link
/test integ-security-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/test integ-security-k8s-tests_istio


Add attributeMetadata to response of api-search-query adapter

Related Issues

Add attributeMetadata to response object of api-search-query search adapter to support loadByAttributeMetadata feature.
Short Description and Why It's Useful

It is missing yet and api-search-query wouldn't support the loadByAttributeMetadata feature.
Which Environment This Relates To
Check your case. In case of any doubts please read about Release Cycle

[x] Test version (https://test.storefrontcloud.io) - this is a new feature or improvement for Vue Storefront. I've created branch from develop branch and want to merge it back to develop
[ ] RC version (https://next.storefrontcloud.io) - this is a stabilisation fix for Release Candidate of Vue Storefront. I've created branch from release branch and want to merge it back to release
[ ] Stable version (https://demo.storefrontcloud.io) - this is an important fix for current stable version. I've created branch from hotfix or master branch and want to merge it back to hotfix

Upgrade Notes and Changelog

[x] No upgrade steps required (100% backward compatibility and no breaking changes)
[x] I've updated the Upgrade notes and Changelog on how to port existing Vue Storefront sites with this new feature

IMPORTANT NOTICE - Remember to update CHANGELOG.md with description of your change
Contribution and Currently Important Rules Acceptance

[x] I read and followed contribution rules

I saw that this is already solved in master branch with version 1.12 and PR #4491.

@cewald yes, it is solved in master. It was added to release branch, but as I see develop wasn't sync with master after release. I will update develop


Specify implementation details

We should add the requirement for a Dockerfile. Also, for languages that have alternative modes of execution (like ruby yjit), we should adapt the Dockerfile-<alt> naming convention.


Message exchange issues in example

Running the continuous mode of the example doesn't behave as expected.

TCP

Fragmented

Client -> Server: Works as expected, message displayed on terminal
Server -> Client: Works as expected, message displayed on terminal

Continuous

Client -> Server: Works as expected, new file is created and content written immediately
Server -> Client: File created on runtime start, but no content written to. Only if client runtime is closed, content is written twice

TLS

Fragmented

Client -> Server: No message seems received
Server -> Client: No response, but expected if server doesn't receive a message

Continuous

Client -> Server: No message seems received, no new file created
Server -> Client: No response, but expected if server doesn't receive a message

This behaviour is tested in unit tests using stringstream. No bugs found here, example works with file stream.

Add ::std::flush to ostream to immediately update the stream. Won't fix all issues, but makes the file being updated while runtime is running

The continuous TCP message from server to client is not sent twice, but the same message is sent on connection init and message received

Not TLS messages sent because I forgot to create certificates before.
With 5dad8e6330ad3e9392f9842bf4871b78242d7fd1 the certificates are created automatically when compiling the example


Backport Multi-Node support to 1.15/stable

I have been using microk8s v1.17/stable for the past few weeks and have enjoyed using the multi-node support to utilise 2 laptops for my k8s cluster.
I have now found out that our company has to support v1.15 of k8s for production installations (such as PKS/EKS) so have had to downgrade microk8s back to 1.15/stable to make sure that we don't accidentally introduce configuration that is not compatible with that version.
However, this downgrade has meant that I no longer have the ability to use multi-node, as I see that it was introduced into microk8s v1.16
I am sure that it does not depend on the specific Kubernetes version so I am asking whether it would be possible to 'back-port' the multi-node support back to the 1.15/stable channel.
I have attached my inspection-report (as requested in the template)
inspection-report-20200401_192455.tar.gz

Hi @sishbi, unfortunately there is not enough incentive to back port clustering to v1.15.

We are now using v1.17 so this is no longer required.


Post the Governing Rules to the Wiki

We as a community have made a number of decisions on how we do things.  Some of this is written down in the community slides, some has been discussion during meetings with verbal agreement, etc.  Now is the time to post the rules for the following;

How do we add / new benchmarks?
How do we have the standard_set?
How do we do code reviews?
Etc.

Here is a placeholder page...https://github.com/GoogleCloudPlatform/PerfKitBenchmarker/wiki/Governing-Rules

Done


Accept filename argument

It would be nice if OnlyM would accept a filename as an argument. This would allow:

dragging files on to the OnlyM icon
setting the default app for media types as OnlyM, thus allowing double clicking of files that would launch OnlyM with the file listed in the queue.

In fact it would be even better if it could accept multiple files or even directories.

@jomast thanks for your feedback. I have added a command-line option to override the media folder ("/source=..."), but I won't be adding support for handling particular file extensions or opening individual media files as this complicates the design which is based on the presence of a "media folder". Thanks again! Antony


[e-internalisation] HTML annotations wrongly merged

With the attached input I get the attached output. The output has some wrongly merged and repeated text, and the string "undefined" appears.
html-output.txt
html-input.txt

any news on this, @katia-vistatec ? Is this depending on a separate issue?

test.txt

Hi Felix,
in case I have in the original html city, the span of the enrichment is not applied. Should it appear?I have attached the file for input and output.

Should it appear?

Yes, I think so.

Hi Felix,
I have pushed the changes to the repository.

looks good, thanks!


Update CONTRIBUTING.md with new manuals links

What kind of changes does this PR include?

Something else!

Description
Add links to the MAINTAINERS.md and SUPPORTSQUAD.md manuals inside CONTRIBUTING.md

Perfect, and helpful as always, @Yan-Thomas! LGTM!


[5.4] Deprecate class based listener maker

Deprecate class based listener maker to avoid code duplication and usage of call_user_func and call_user_func_array functions in favour of direct calls of $listener.

I don't really want to change class logic on a point release.


XCM. Migrate to XMC config v6

Migrate to XCM config V6 changing the constant in the code
XCM transfers V6 config is located in nova-utils repo https://github.com/novasamatech/nova-utils/tree/master/xcm/v6
Update the config in order to use transfers.json for production, trasfers_dev.json for dev
Update the code for new config version if needed

Updated the priority for Fellowship release. So that the user may top up collectives account in the Spektr.

Temp removed Moonbeam \ Moonriver XCMs:

https://github.com/novasamatech/nova-spektr/issues/2678

need enable it in that issue

Status verification: ❌
What has been verified:

Polkadotxcm (Limited_teleport_assets) ❌ (filtered)
Comparison data - comparison.pdf
Xcmpallet (Limited_reserve_transfer_assets) ✅
Xtokens (Transfer_multiasset) ❌ (AssetHasNoReserve)
Comparison data -

compared with novaWallet's one

Reproduced:

https://assethub-polkadot.subscan.io/extrinsic/7840797-2

Old with New:

New with NovaWallet:

Status verification: ✅


RSS to PostAgent on Discord, can't figure out how to make it work

I'm so sorry for posting again T _T I really have no idea what I'm doing and I can't make heads or tails of the Liquid Interpolation article.
feed: https://rss.simplecast.com/podcasts/52/rss
current setup:

{
"post_url": "https://discordapp.com/api/webhooks/424037023133990912/buhkFmHuZ[redacted]TS3eN2qBO33m_u3jpn3W-7ppDTH_hSfCrxdD",
"expected_receive_period_in_days": "10",
"content_type": "json",
"method": "post",
"payload": {
"content": "{{item.title}}{% line_break %}{% line_break %} {{item.description}}{% line_break %} <{{item.link}}>"
},
"headers": {
"Content-Type": "application/json"
},
"emit_events": "true",
"no_merge": "false",
"output_mode": "clean"
}

Or is it **{{title}}**{% line_break %}{% line_break %} {{description}}{% line_break %} <{{link}}>
or is it **{{channel.item | map: 'title'}}**{% line_break %}{% line_break %} {{channel.item | map: 'description'}}{% line_break %} <{{channel.item | map: 'link'}}>?
God I'm beyond noob I am so sorry. I tried and I failed.

Thank you! I'm waiting to see if it works aha;
This is the filter for my tumblr RSS:

{
"expected_receive_period_in_days": "1",
"keep_event": "true",
"rules": [
{
"type": "field!=value",
"value": "klance",
"path": "$.category"
},
],
"message": ""
}

It should filter out anything tagged klance, however is it possible to make an exception rule for when tags are tagged with "general"?
i.e. blacklist klance, whitelist general which takes priority over the blacklisted term

?? I'm not sure why it's in html, I only wanted it to post the permalink of the post

Sorry me neither, the RSS Agent should only put the plain url as text in the url of it's Events. Did you check how the Events look that come from the RSS Agent?

i.e. blacklist klance, whitelist general which takes priority over the blacklisted term
And if so, how would I do that?

At the moment you are doing a string comparison, so if the category is not equal to klance it will never equal general. You could switch the type to !regex for the blacklist and add another rule with regex for general and set must_match to 1. That should allow events with general in category or events that do not have klance in it.

Sorry me neither, the RSS Agent should only put the plain url as text in the url of it's Events. Did you check how the Events look that come from the RSS Agent?

Description's coming out as

"description": "    ",

@ _@
Oh, thank you!

Description's coming out as

That looks correct, above you mentioned that you used {{url}} in you PostAgent.
Events from the RssAgent look like this:
  {
    "id": "https://vld-news.tumblr.com/post/172907231732",
    "url": "https://vld-news.tumblr.com/post/172907231732",
    "urls": [
      "https://vld-news.tumblr.com/post/172907231732"
    ],
    "links": [
      {
        "href": "https://vld-news.tumblr.com/post/172907231732"
      }
    ],
    "title": "voltron:When you get hit in the feels",
    "description": "

voltron:

When you get hit in the feels

",
    "content": "

voltron:

When you get hit in the feels

",
    "image": null,
    "enclosure": null,
    "authors": [

    ],
    "categories": [
      "keith",
      "vld social",
      "s5",
      "5.04",
      "gifs"
    ],
    "date_published": "2018-04-13T18:07:49-05:00",
    "last_updated": "2018-04-13T18:07:49-05:00"
  }

So {{url}} will only post the url, but the description includes a bunch of HTML.

Yeah, I put {{url}}, but for some reason it seemed to be spewing the description. Anyway, changing "no merge" to true seemed to have fixed it. o7 thank youuu

Nice, glad it's working now!


genome_db.assembly_default has been removed in e82

Also, we can simply take all the GenomeDBs regardless of their first/last_release status

BTW, this function only does direct SQL queries on the database handle. Is it possible to have a Compara DBAdaptor instead ? We could then move the queries to our side and it would be easier to maintain

Hi Matthieu
If you want to have them in the API, that would be fine. We do use a lot of SQL in ConfigPacker because it’s grabbing things like track summaries that are not needed anywhere else and hence have historically not been incorporated into the respective APIs, but it does make the code harder to maintain.
Cheers
Anne

On 3 Sep 2015, at 09:07, Matthieu Muffato<EMAIL_ADDRESS>wrote:
BTW, this function only does direct SQL queries on the database handle. Is it possible to have a Compara DBAdaptor instead ? We could then move the queries to our side and it would be easier to maintain
—
Reply to this email directly or view it on GitHub https://github.com/Ensembl/ensembl-webcode/pull/284#issuecomment-137372701.

ah, you think it would make things harder :)
My question mainly is whether it is possible to have a DBAdaptor. We don't need to move the code, but making API calls would make the ConfigPacker more resilient to schema changes (and slightly slower)

I meant that using SQL makes ConfigPacker harder for the webteam to maintain, because we have to keep up with schema changes.
Anne

On 3 Sep 2015, at 13:04, Matthieu Muffato<EMAIL_ADDRESS>wrote:
ah, you think it would make things harder :)
My question mainly is whether it is possible to have a DBAdaptor. We don't need to move the code, but making API calls would make the ConfigPacker more resilient to schema changes (and slightly slower)
—
Reply to this email directly or view it on GitHub https://github.com/Ensembl/ensembl-webcode/pull/284#issuecomment-137417727.

right, we're on the same line, then :)
This time, I just forgot to check if the schema was directly used by other repos, but I'll add a note to our SOP so that we don't miss it next time


Provide ipa_url and plist_url to s3 templates when available

I need both the ipa url and the plist url for the html s3 template (to provide an iPad friendly link as well as a link download to desktop), so I've added them and modified the templates to use the new template variables.
This breaks backwards compatibility with the templates, but I thought that having "url" represent two different urls in different files would be more confusing.

Sorry, we can't break any fastlane actions, it is very important to not break any existing setups, so we need to find a way to introduce this change without breaking things

Adding plist_url and ipa_url in addition to the existing url would be backwards compatible

@sgtsquiggs Yes adding those in addition the existing value would be great. Please let me know if you plan to update this PR to make that change (otherwise please close.) Thanks!

Thanks for the PR @sgtsquiggs! :cake:


Add the possibility to have several keys/values checked for one HTTP-FORMATTED tile

I'm thinking about something like:
{
    "type": "HTTP-FORMATTED",
    "params": {
        "url": "http://localhost/count",
        "format": "JSON",
        "keys": [
            {"key": "celery", "regex": "offline"},
            {"key": "S3", "regex": "offline"}
        ]
    }
}

This could be checked with one simple HTTP request.

Monitoror Core has cache. So if you create 10 tiles with the same URL and different checks, it will only request the URL a single time.
Please use a group with as many HTTP formatted tiles as you want :)

Good to know. That's actually what I did but didn't know it was using only one request. Thanks

Monitoror Core has cache. So if you create 10 tiles with the same URL and different checks, it will only request the URL a single time.
Please use a group with as many HTTP formatted tiles as you want :)

Good to know. That's actually what I did but didn't know it was using only one request. Thanks


Nomination pools/external balances

#85ztnncug

Task linked: CU-85ztnncug Android. Display staked pool balance in main balance


Figure out how to populate SymbolTable with all symbols from TextDocument

At the moment, there's no easy way to create a SymbolTable that would comprehensively cover s.TextDocument. Just GlobalSymbolTable is not enough, because it only looks into TextDocument.symbols and doesn't recur into hardlinks.
As a result, SymbolInformationPrinter from Metap, PrettyType from Scalafix and RscCompat from Rsc all hack around this by having a mutable something that tracks hardlinks as they are discovered. This is clearly suboptimal - both UX-wise and duplicate-wise.

I'm not confident we will find a generic solution here. I think we will need more experimental data to figure out how to best deal with hardlinks. I propose to close this for now unless you have as concrete suggestion.


UNKNOWN EVENT log messages, no messages from bot

I have a setup that properly connects to a private IRC server and a 3.0.0 MM instance.
Unfortunately, it just logs "UNKNOWN EVENT" when typing anything on both sides. Here's what happens (log entries redacted for privacy):
Writing to IRC channel
level=info msg="UNKNOWN EVENT: &irc.Event{Code:\"PRIVMSG\", Raw:\":mynick!dv@somehostname PRIVMSG #test :yo\", Nick:\"mynick\", Host:\"somehostname\", Source:\"mynick!dv@somehostname\", User:\"dv\", Arguments:[]string{\"#test\", \"yo\"}, Connection:(*irc.Connection)(0xc8203c0360)}" module=irc

Writing to MM Channel
level=info msg="UNKNOWN EVENT: &irc.Event{Code:\"412\", Raw:\":the.irc.server 412 bot-username :No text to send\", Nick:\"\", Host:\"\", Source:\"the.irc.server\", User:\"\", Arguments:[]string{\"bot-username\", \"No text to send\"}, Connection:(*irc.Connection)(0xc8203c0360)}" module=irc

Not sure if its a misconfiguration or a bug.

The "bot" is a dedicated user, it only relays messages from other users. Not from itself, don't login via the webinterface as the bot, but use your own account.

Yes, that's what I've done :) Note that it doesn't relay anything in either direction at the moment.
For reference, here's my config (redacted of course):
[IRC]
server="irc.example.com"
port=6697
UseTLS=true
SkipTLSVerify=true
nick="mmbot"
UseSlackCircumfix=false
IgnoreNicks=""
RemoteNickFormat="<{NICK}> "

[mattermost]
server="mm.example.com"
login="irrc"
password="thepassword"
team="myteam"
showjoinpart=true
SkipTLSVerify=false
PrefixMessagesWithNick=true
NickFormatter=plain
NicksPerRow=4

[general]
GiphyAPIKey=dc6zaTOxFJmzC

[channel "Town Square"]
irc="#test"
mattermost="Town Square"

Try changing mattermost="Town Square" to mattermost=town-square
Channel must be same as in Web url

Thanks a lot, this solved it! Added a PR to explicitly mention this.


[Bookcase : Improvement] : Poor User Interface (UI) and Lack of Responsiveness in "Bookcase" Project

Project Name: Bookcase
Issue Description:
During my evaluation of the "Bookcase" project, I noticed several issues related to the User Interface (UI) that negatively impact the user experience and make it challenging to understand and utilize the application effectively. The primary concerns are as follows:

Lack of Alignment and Design: The UI elements are not well aligned, and the overall design lacks coherence. This leads to a cluttered appearance, making it difficult for users to navigate and understand the functionality of the application.
Non-responsive Design: The project does not adapt to different screen sizes and devices. As a result, the application appears distorted or becomes unusable on smaller screens, such as mobile devices or tablets.
Inefficient Placement of Search Box: The search box is not located in the navigation bar, which is a standard placement for search functionality. This makes it inconvenient for users to search for specific books while browsing through the application.

Screenshot :

Proposed Solutions:
To address these issues and improve the overall user experience, I suggest the following solutions:

Responsiveness: Make the "Bookcase" project responsive to different screen sizes and devices. Implement responsive design techniques, such as using CSS media queries and fluid layout, to ensure that the application adapts and displays appropriately on various devices.
Search Bar Placement: Move the search box to the navigation bar, providing a more intuitive and accessible location for users. This placement will enhance usability by allowing users to search for books from any page within the application.
Enhance UI Design: Improve the visual appeal and usability of the UI by enhancing the overall design. Consider the following aspects:

Ensure proper alignment and spacing of UI elements, creating a clean and organized interface.
Use consistent typography, color schemes, and visual elements throughout the application to provide a cohesive and professional appearance.
Utilize appropriate visual cues, such as icons or labels, to guide users and help them understand the functionality of different elements.
Implement intuitive navigation patterns and user-friendly interactions to enhance the user experience.

Hey! @TusharKesarwani I have found this problem and looked into it and I believe I can solve it by doing all the explained process.

Hey @harshit-paneri , I am willing to contribute to this issue by examining the code and making the required modifications. Additionally, I can perform testing to verify the correct functioning of the search functionality.
Thank you for your attention to this matter. I look forward to your response and the opportunity to assist in resolving this issue.


fix #329 : Add configurability to ImagePullPolicy to support offline environments by allowing IfNotPresent option.

 Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.jim.sj seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.You have signed the CLA already but the status is still pending? Let us recheck it.

@Lyt99 PTAL.  By the way, is this project still being updated? It seems like a long time since the last release version was published.

@Lyt99 PTAL. By the way, is this project still being updated? It seems like a long time since the last release version was published.

Hi, thanks for your contribution!
This project is still being updated. We're reviewing the features and architecture for the project, so the progress has slowed down for a while. We almost finished the internal review, and it will be back to activate development soon.

@Lyt99
And also, please sign the CLA, thanks :)

CLA signed, and code updated. This tool looks great! Hope to see it continue to grow and develop.

The pr has been merged. Thank you!


Update default.tensor plugin

This PR is a holding branch for all updates the default.tensor plugin.
Already implemented:

[x] The tensor network is by default unentangled (separate nodes for each qubit), and only becomes entangled as necessary from multi-qubit gates
[x] Added the ability to use a matrix product state representation to represent the simulated quantum state/circuit.
[x] Some significant refactoring, simplification, and polishing
[x] Communsurate updates to the child default.tensor.tf device

Remaining to-dos:

[ ] Builds are failing for Python version 3.5, since TensorNetwork requires Python 3.6 or above since September 2019 (v0.2+; this backend uses v0.3+).

Possible future updates/features/improvements:

I'm hoping to add the ability for users to set truncation parameters for the MPS representation (max_singular_values or max_truncation_error)

Determine if we can get some simplifications/speedups by canonicalizing the MPS network

Currently contraction_method only has an effect on the "exact" representation. Right now I don't think it is worthwhile to use the custom contraction methods for MPS, since the MPS representation works slightly differently than a "vanilla" TensorNetwork network, and certain MPS expectation value computations are already available as one-liners from TensorNetwork's MPS module. However, I can picture it might be confusing to have a argument that is only valid if another argument has a particular form. Ideas/suggestions appreciated

There seem to be some unit tests that are present in default.qubit but are absent from default.tensor (e.g., unit tests of the expval functionality without tensor products). I can't recall if there was a reason for this, but it would be good to add those tests if we can

Similarly, there are tests that only test default.tensor, but don't test the child device default.tensor.tf. Should we parametrize all tests in test_default_tensor.py to work with both devices?

Port this simulator to QubitDevice? I'm strongly leaning towards no here, since I think there is some logic in QubitDevice that might be incompatible with the tensor network implementation, or at the very least would lead to significant work to refactor (for likely no user gain). Happy to hear thoughts if this isn't the case

Even if we don't port to QubitDevice, that class introduces a new initialization argument analytic. Unfortunately, this parameter is not just used internally within QubitDevices, but is also used by the JacobianQNode to determine which default step size to use (and the default step sizes can differ by 6 orders of magnitude!). The simple fix is to just set self.analytic=True within the tensor network simulator, even though it is not subclassing QubitDevice, but this feels off somehow.

@josh146 I consider the implementation now complete (and code has all been reviewed), but I'd appreciate your thoughts on the remaining possible items.

With respect to the failing test, there are two options I suggest:

Just remove the Python 3.5 build from the .travis.yml file, or

Remove tensornetwork from the requirements.txt, and instead hardcode it into the travis.yml file, so that it only gets installed on the Python 3.6, 3.7, and 3.8 builds.

Python 3.5 EOL is September this year, so I recommend just option (1), and we can deprecate Python 3.5 support for the release after this one.

Actually, calling super().__init__(analytic=True) should solve this issue, while also implicitly setting self.analytic=True? This doesn't feel hacky to me.

This won't work because super here refers to Device, which does not have any argument analytic. The problem here is that JacobianQNode is implicitly assuming that any device which does not have the attribute analytic must be working with a finite number of shots. As I  mentioned, we can just add that attribute to default.tensor and everything will work as expected, but they we have an undocumented attribute shadowing a documented attribute from another class (ideally it would be document in both within the call signature)

This won't work because super here refers to Device, which does not have any argument analytic.

Oh, true. I forgot that QubitDevice has this in the init signature, but Device doesn't.

we have an undocumented attribute shadowing a documented attribute from another class (ideally it would be document in both within the call signature)

I'm happy with having this as a temporary solution to merge this PR, but we should also make an issue so we don't forget to address it.

@co9olguy, @antalszava: what is the status of this PR? Is it just a matter of linting, or do some of the tests still need to change?

:fireworks:


[BUG] Right after updating the driver, I can see two devices in midi.exe.

It may be an issue that has already been reported.
Right after updating the driver, I can see two devices in midi.exe.

First time connecting to Raspberry Pi Pico with notesend.uf installed

sendnote.uf2.zip

Open Device manager
Update KNOTE16 driver to USBMidi2.AXC
midi2 endpoint monitor

KNOTE16 is displayed twice.

🎹 KNOTE16
🎹 KNOTE16
🔁 Diagnostics Loopback A
🔁 Diagnostics Loopback B
🔙 (Cancel)

After Windows restert, KNOTE16 is displayed once.
Windows.MIDI.Services.App.SDK.Runtime.-.Developer.Preview.<IP_ADDRESS>94.2233-x64.exe
Windows.MIDI.Services.Console.-.Developer.Preview.<IP_ADDRESS>94.2233-x64.exe
Windows.MIDI.Services.In-Box.Service.-.Developer.Preview.<IP_ADDRESS>94.2233-x64.exe

Were you able to get endpoint properties on both of them? I would assume would have an Id that has "KS" and the other "KSA"
If Windows didn't tell us the KSA device was removed, there's not anything we can do, so trying to sort out if that's the case.

I've seen this too after using 'have disk' to use the new USB driver for a MIDI 1.0 keyboard.

Just a reminder that you likely do not need to reboot. Instead, just restart the service.

I also had a bug in the aggregate abstraction: it was not removing endpoints properly. This will be fixed in DP7

Reopening after auto-close. Will close once verified in-box

Thanks, We talked about this on Discord. Will check on DP7 .Yep ,this happens after installing the MIDI 2.0 driver and not plug in/out the device or restarting the service.


Command line sync utility linking TD file to Jira Epic

My company built a utility that helps us out a lot with Threat Modeling - we have a 2-way sync utility that pushes open (non-mitigated) vulnerabilities into a a named Jira Epic as a simpler way to build backlog for our dev team. Once closed in Jira, the items get marked as closed in TD.
threat-mvp-master.zip

Sure, here it is.

Many thanks @jcoupal for the logo. Will update the OWASP project page when we know where the utility is going.
We are having discussions as to where your utility should sit in the repo structure ... it may have its own repo under a Threat Dragon github organisation, or may go into a utility directory in this repo. Not sure which one ...

Migrated to new issue in the OWASP area repo : https://github.com/OWASP/threat-dragon-core/issues/17


Why do we need to provide the client's private key to the etcd server

Hi,
could somebody please explain why, when configuring a secure etcd cluster (step 7), we need to provide the client's private key (the private key of the api server in our case)?
I've never seen this in HTTPS 2 way ssl, for me, this key should never go out of the server.
Thanks.

The same certificate/key are being used for, I presume, simplicity in the tutorial. I obviously always set up entirely different certs/keys for etcd (and even peer cert/key), and do not use the API server's certs/keys. I even set up a separate cert/key for each API server, and have a bunch of etcd-client cert/keys for each API server, and you can then use etcd .. --client-crl-file to allow revocation of a compromised client. I guess you can take this as a basic tutorial, and then secure as per best practices if you plan on using it in Production.
As per the comment right at the top of README.md:

The results of this tutorial should not be viewed as production ready, and may receive limited
support from the community, but don't let that stop you from learning!

Hi @tokiwinter, thanks for your answer. I agree with you, in production, we should do things like you describe.
But I still cannot understand the need of using the client key even for certificate revocation. In order to revoke a certificate using the CRL, the CA only needs the public key, it should be the same from the client side.
Sorry for insisting...

@khaldoune - I agree with you, maybe you misunderstood my comment - my clients keys (and certs for that matter) do not go anywhere near my etcd servers. The etcd client keypairs are on the respective API servers, not on the etcd server. The only thing that gets shared around is the CA certificate.

@tokiwinter OK, so there is no need to specify this parameter right?

@khaldoune - lets clarify - which parameters are you talking about - --key-file and --peer-key-file? You totally and definitely do need those parameters for TLS to work for the etcd server (the former), and peer TLS between etcd members (the latter). If you, like I, have security concerns, you need to generate dedicated certificates/keys (I do this twice for each etcd server, one "keypair" for the server, one for peering), the certs appropriately signed by the correct CA, and distribute those, and then generate client certs/keys, again with the right extensions, for use by your kube-apiserver's via their --etcd-<blah> options.
All this is probably why it was omitted from the tutorial, as this isn't a PKI tutorial. I have my entire k8s cluster setup automated, and use pyOpenSSL to take the headache out of all this.

Ok Ok, further reading has clarified things for me, especially the example 3:
https://coreos.com/etcd/docs/latest/op-guide/security.html
So --key-file and --peer-key-file are both the SERVER keys used by clients when ETCD acts as server, they may be different if we have two different keypairs for peers and clients.
It's clear now, the client's private key remains private :) So everything is OK.
Thanks for your help.

@khaldoune - cool, the confusing aspect in this tutorial is that the same cert/key is being used for both the server, peers, and the client, across the entire control plane, as well as for the API server's TLS iteself. Not ideal, but again, there is a big note in the README saying this isn't production-ready and is for learning purposes only. Don't check what the service account key is in this tutorial (hint: it's the CA private key 😱).

@tokiwinter Yes I've seen it lol
But this tutorial is very good, I've learned several things. No I'm able to challenge what the installation tools (like kubespray and others) do.

@khaldoune - agree 100% there - it is an amazing resource. It does exactly what it is supposed to do, and that is concentrate on showing how the various k8s components hang together. Dragging folks into production-grade PKI implementation would drive a lot of people away, and obscure the true purpose. I used it as the basis for my own python-based deployment tool, and extended it a lot to make it production ready. Big 👍 to @kelseyhightower for putting this together.

Yes big thanks to @kelseyhightower
@tokiwinter Existing deployment tools dont have full coverage, especially when several cloud technologies are involved (Azure and OpenStack for me).
It's a great challenge...

Of note, @bgeesaman is working on hardening-kubernetes/from-scratch to give all the PKI and other security details you could ever want, following on from his work on improving the default security posture of Kubernetes cluster installers.

@omkensey - watched and starred - nice!


feat: added error page

Added error page for the website. It has a home page button to redirect to home when clicked.
fixes: #98
https://github.com/user-attachments/assets/6e726441-5d5f-4962-9757-7114e07fdac0

@rahulvarma2005 Good Work!


ESP32C6 does not join, as it cannot find PAN to join for HA_on_off_light example (TZ-927)

Answers checklist.

[X] I have read the documentation ESP Zigbee SDK Programming Guide and tried the debugging tips, the issue is not addressed there.
[X] I have updated ESP Zigbee libs (esp-zboss-lib and esp-zigbee-lib) to the latest version, with corresponding IDF version, and checked that the issue is present there.
[X] I have searched the issue tracker for a similar issue and not found a similar issue.

IDF version.
v5.2.2
esp-zigbee-lib version.
1.3.2
esp-zboss-lib version.
1.3.2
Espressif SoC revision.
ESP32C6
What is the expected behavior?
I expect it to connect to my zigbee2mqtt coorinator without issue.
What is the actual behavior?
After starting the Zigbee Stack it start the steering process, which fails every time with the following debug logs:
I (1469) ESP_ZB_ON_OFF_LIGHT: Start network steering
ZBOSS: commissioning/bdb/zdo_commissioning_bdb.c:349   dev type 2, joined 0, ext_pan_id 0, authenticated 0, tclk_valid 1
ZBOSS: zdo/zdo_commissioning.c:210   Can't find PAN to join to! param 25
ZBOSS: commissioning/bdb/zdo_commissioning_bdb.c:549   COMMISSIONING_STOP: app signal 10 comm status 3
I (3739) ESP_ZB_ON_OFF_LIGHT: Network steering was not successful (status: ESP_FAIL)

Steps to reproduce.

Load HA_on_off_example
Update dependency-versions to match most recent ones
Flash to device
Monitor

More Information.
This is what I can see in Wireshark when sniffing the traffic.

It seems like there is a response with the Extended PAN ID but I am not sure if it is received on the ESP. Leaving the ESP running these lines appear over and over again: Beacon Request -> Zigbee Response with EPID -> repeat.
As I am very new to using Zigbee on an ESP I am not sure how to proceed from here and how to get the device to pair with my coordinator?
I am using zigbee2mqtt with a network attached Zigstar UZG-1 as coordinator device. zigbee2mqtt is setup to use channel 25 as well as a network encryption key. All other purchased devices (e.g. from Aqara) are joining without issue in the current setup. Therefore I assume the issue lies within some missing or incorrect configuration on the ESP part.
Thanks a lot for your input :)

@matthiasbuettner159 ,
The issue is likely not a bug but rather a device pairing problem. Could you please attach the Wireshark packet and network key for me? I need to understand the exact network pairing process.

By the way, esp-idf v5.1.3 is recommended for use with esp-zigbee-sdk v1.3.2.

Hey,
thanks already for your responses. I also tried with esp-idf v.5.1.3 and the same issue occurs. I tried using versions 5.1.3, 5.1.4, 5.2.2 and 5.3. All with the same problem.
Here is the wireshark capture: Pairing-Error.zip
The network key is: 15:25:3E:41:A9:8F:16:76:20:83:57:AB:08:08:CE:EA
Additionally here are the logs I receive in VSCode: VSCode-Terminal-logs.txt
There is one other sensor in my test zigbee network which might have sent some data during the capture - just to have mentioned it.

@matthiasbuettner159 ,
Based on the Wireshark packet provided by you, the issue appears to be triggered by the "Association Permit: False" of Beacon. This indicates that the network of the coordinator "MyHome43" is closed. As a result the Zigbee device can not find an available network to join.

@xieqinan ,
thank you very much. As mentioned I am using zigbee2mqtt as broker and there I have enabled the setting to always allow new devices to join. And I am puzzled why it is not working in this scenario, as I can join other devices without problems.
Do you have a suggestion what I could try? Otherwise I will reach out to the zigbee2mqtt community :)

@matthiasbuettner159
I have found the network created by the 57:e6:39:8c:d9:70:ca:97 device is open, it may related with the another limitation for device joining is the low Link Quality Indicator (LQI) value set in the SDK. If the link between the coordinator and the end device is weak, the end device may reject choosing it as its parent. By default, the smallest LQI value for network joining is 32. You can use the esp_zb_secur_network_min_join_lqi_set() function to set a lower LQI threshold.

@xieqinan ,
I also just checked again and saw that the MyHome43 is not my network but the one you mentioned is. Here I also see the Association Permit as True.
I will try to lower the threshold, but I would not understand why the LQI is that low, as I am trying to connect basically right next to my coordinator. Is there a way to see the LQI during the joining process?

@xieqinan @matthiasbuettner159
Is the problem with the low lqi solved?
I use:
espressif/esp-zboss-lib: "=1.1.2"
espressif/esp-zigbee-lib: "=1.1.2"
espressif/led_strip: "=2.0.0"
Required IDF version
idf:
version: ">=5.1.3"

For those who also struggled with this:
I had to go super close (less than 1 meter) to the coordinator to successfully pair it.
I also set in the code before the "zigbee stack initialization" message: esp_zb_secur_network_min_join_lqi_set(0);, however I do not know and did not test if that made a difference.

@BaWe155 ,
The version you used is old, could you please test again with the esp-zigbee-sdk v1.5.1?

@ss89 ,
Could you please provide more details on how to reproduce your issue? I tried running the HA_color_dimmable_light and HA_color_dimmable_switch examples from the esp-zigbee-sdk master branch on an ESP32-H2 without any changes, and they were able to form a network even at distances greater than 5 meters.


Textmate grammar bug

Describe the bug

Package/Software version:
tinymist extension version: v0.11.1.

fixed by #128


youtube-dl ogg url

Hi,
As -g simulation option returns video/mp4 format, I was wondering if there is any way to get the raw video url for the .ogg format?

Yes, if ogg is served by hoster and youtube-dl knows how to extract it.

Thank you for the answer.


Optimize CI

At the moment on average it takes 15 minutes for PR checks to pass the CI.

we are building ARM images but we are not testing them on each pull request this is adding some 5-7 minutes per each check
GKE cluster is really flaky and sometimes it takes 3 runs to make it pass
It never fails in the same place twice

Yes I missed that. On top of helm we should run CLI tests as well.


[Problem]: avahi-daemon init script was removed in Debian 12

Description / Beschreibung
The init-script (/etc/init.d/avahi-daemon) had been removed in the current version of Debian/avahi-daemon package.
The setup_avahi.sh script is still using it and failing to start the daemon. The command to run the daemon should be updated to avahi-daemon -D or something similar.
Image version
v9.0.0
Docker logs / Docker Protokoll
root@dd4e417e6916:/opt/scripts# ./setup_avahi.sh
[setup_avahi.sh] Avahi-daemon is NOT installed. Going to install it now... Done.
[setup_avahi.sh] Configuring avahi-daemon... Done.
[setup_avahi.sh] Configuring dbus... Done.
[setup_avahi.sh] Starting dbus... Done.
[setup_avahi.sh] Starting avahi-daemon... Done.
root@dd4e417e6916:/opt/scripts# tail avahi_startup.log
Setting up dbus-bin (1.14.10-1~deb12u1) ...
Setting up dbus-daemon (1.14.10-1~deb12u1) ...
Setting up dbus (1.14.10-1~deb12u1) ...
invoke-rc.d: could not determine current runlevel
invoke-rc.d: policy-rc.d denied execution of start.
Setting up avahi-daemon (0.8-10) ...
invoke-rc.d: could not determine current runlevel
invoke-rc.d: policy-rc.d denied execution of force-reload.
Processing triggers for libc-bin (2.36-9+deb12u3) ...
./setup_avahi.sh: line 35: /etc/init.d/avahi-daemon: No such file or directory
root@dd4e417e6916:/opt/scripts#

Can you please test dev tag? I`ll go for a Hotfix without a new beta.
Regards,
André

@buanet  dev looks good 👍 avahi-daemon is running and homekit works as expected. Thanks! :)


add top back to top  button

Title of the Pull Request

[ ] Have you renamed the PR Title in a meaningful way?

Related Issue

Closes: #89
Description

How Has This Been Tested? ⚙

Screenshots 📷

Type of change
What sort of changes have you made:

[ ] Bug fix (non-breaking change which fixes an issue)
[ ] New feature (non-breaking change which adds functionality)
[ ] Code style update (formatting, local variables)
[ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
[ ] This change requires a documentation update

Checklist

[ ] My code follows the code style of this project.
[ ] I have followed the contribution guidelines
[ ] I have performed a self-review of my own code.
[ ] I have ensured my changes don't generate any new warnings or errors.
[ ] I have updated the documentation (if necessary).
[ ] I have resolved all merge conflicts.

Share a video for this

Hey @RishabxBhardwaj , share me a video for this pr and I will merge this

Will you share ?

here is the video = https://drive.google.com/file/d/1czkRFVOIU3smyoOi1FSxrbdJj3dlB8tx/view?usp=drivesdk

First setup the project in your local PC then run and contribute. I am not taking this as you have not setup

Tell me if you do properly or should I close this

Close them
On Sat, 19 Oct 2024 at 9:21 AM, K Om Senapati @.***>
wrote:

Tell me if you do properly or should I close this
—
Reply to this email directly, view it on GitHub
https://github.com/kom-senapati/bot-verse/pull/90#issuecomment-2423551993,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/BLLQBODR766TJRRDZRH2YLDZ4HJMPAVCNFSM6AAAAABP3FXBWOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDIMRTGU2TCOJZGM
.
You are receiving this because you were assigned.Message ID:
@.***>


Add std.getopt.config.helpLike to std.getopt module

The new directive std.getopt.config.helpLike allows to use command-line arguments like additional 'help' arguments. The argument following this new directive is treated like '-h' or '--help'.
A common use-case is an option to just output the (git-)version of a programm and then return with no error.
In the current implementation of getOpt() it is needed to check the args array passed to main() to contain your special option '--version'.
With this patch the option can be added to your getOpt() call. This increases readability of code and removed special case-handling of arguments before calling getOpt().

Is it really a problem to check for the --version option after parsing instead? E.g.,
void main(string[] args)
{
    import std.getopt;

    bool showVersion;
    // ...

    auto result = args.getopt(
        "version", &showVersion,
        // ...
    );
    if (showVersion) {
        printVersion();
        return;
    }
    if (result.helpWanted) {
        printHelp();
        return;
    }
}

As far as I can tell, most commonly-used command-line programs do not preemptively check for --version in the way proposed by this PR. Some examples:
$ cat --asdf --version
cat: unrecognized option '--asdf'
Try 'cat --help' for more information.
$ git --asdf --version
unknown option: --asdf
usage: git [--version] [--help] [-C <path>] [-c <name>=<value>]
           [--exec-path[=<path>]] [--html-path] [--man-path] [--info-path]
           [-p | --paginate | -P | --no-pager] [--no-replace-objects] [--bare]
           [--git-dir=<path>] [--work-tree=<path>] [--namespace=<name>]
           <command> [<args>]

Is it really a problem to check for the --version option after parsing instead? E.g.,
void main(string[] args)
{
    import std.getopt;

    bool showVersion;
    // ...

    auto result = args.getopt(
        "version", &showVersion,
        // ...
    );
    if (showVersion) {
        printVersion();
        return;
    }
    if (result.helpWanted) {
        printHelp();
        return;
    }
}

As far as I can tell, most commonly-used command-line programs do not preemptively check for --version in the way proposed by this PR. Some examples:
$ cat --asdf --version
cat: unrecognized option '--asdf'
Try 'cat --help' for more information.
$ git --asdf --version
unknown option: --asdf
usage: git [--version] [--help] [-C <path>] [-c <name>=<value>]
           [--exec-path[=<path>]] [--html-path] [--man-path] [--info-path]
           [-p | --paginate | -P | --no-pager] [--no-replace-objects] [--bare]
           [--git-dir=<path>] [--work-tree=<path>] [--namespace=<name>]
           <command> [<args>]

The intended action of '--version' is to output just the version info the tool and exit without any error.
But if you set some other commandline option to be 'required', you can NOT specify a single '--version' anymore. You will get an exception if the required argument is not specified.
This is ttrue for mostly all our D scripts - we want to output the --version in our CI pipelines to trackdown problems with outdated scripts. But in normal operation without --version, we usually have one or two required arguments to enforce proper usage of the script.
The proposed patch removes the need for any special hacks outside of getopt(). Just denote a commandline argument to be 'helplike' circumvents the required checks and return without exception. Then it is possible to check if the 'helplike' argument is set and we can either output the version OR the help text and exit.
This improves readability and removed special extra tests from the main() function. So I see a clear use-case for this option. You can also easily find outer usecases  like '--morehelp' to output extra long help texts without out being forced to set '--help' all the time. Or e.g. '--help-backend', '--help-whatever' style options, which output different kind of helptexts. This can be easily implemented as some kind of CL arg with 'helpLike' properity set.

Example:
    ...
    auto helpInformation = getopt(args,
            std.getopt.config.required,
            "mode|m", "Operation Mode.", &argOpMode,
           ...
           "version", "Print version tag", &argPrintVersion);
    ...

If you try to pass just --version to the programm, then it will abort with an exception. You can workaround this by also passing --help. But we just want to pass --version on the commandline. And we do not want special extra code to check, if --version is on the commandline before we call getopt().
So this patch adds:
    ...
    auto helpInformation = getopt(args,
            std.getopt.config.required,
            "mode|m", "Operation Mode.", &argOpMode,
           ...
            std.getopt.config.helpLike,
           "version", "Print version tag", &argPrintVersion);
    ...

Now you can just pass --version. No need to have special checks before we call getopt(). There is also no need to pass --help in addition as a workaround. The commandline argument is now defined together will all other arguments in the call to getopt() and if --version is found, it is handled and the helpWanted flag is set as well. The exception is delayed and only thrown, if no helpWanted flag is set at the end of the commandline processing.
I hope, this will clarify the intention of this pull-request.

By the way, I'm a bit skeptical about the need for this because I'm skeptical about required options in the first place (I can't think of a single command line program with required - arguments), but I'll leave that judgement to @atilaneves .

I use the requiredflag a lot in my D scripts at work. The call to getopt() is wrapped into a try{}section and the exception message is printed without a stack trace. This avoids any additional checks in the main() function, and users of the scripts see a sufficient error messages, when required options are missing.
Sure, these checks could be done in main(). But there IS a requiredoption, so we are going to use it. However, there is the need to circumvent the required flag, when arguments like --version are given on the CL to just output the version or similiar. The --help is still available to print out useful help and examples.
This patch adds this feature.  Maybe the option can be split into an circumventRequired and helpOption option, which could be combined, when needed.

Reworked changelog and example.

I don't understand the use case for this, and second the doubts already "voiced" in this PR.


{maint} modulesync 0794b2c

This can be merged, created https://tickets.puppetlabs.com/browse/MODULES-3547 to account for acceptance failure.


update the OAuth key request for jwk integration

The current implementation works with CA Layer 7 JWK implementation; however, we found some issues with Okta integration with desktop Mcafee local firewall and proxy.
There are two places that need to be changed.

Remove the kid from the URL parameter. Unlike light-oauth2 to get the specific kid certificate, JWK gets all the certificates in one response. So there is no need for the additional parameter for JWK. Some servers can tolerate the additional path parameter but we cannot depend on it.

Need to make the host header configurable in the client.yml and default to the localhost for backward compatibility. The Mcafee desktop proxy rejects the request if the host is not the same as the target server. To make it configurable, we can allow the user to update it in the client.yml to workaround the issue.

 update the OAuth key request for jwk integration light-4j master


a  problem

java.io.EOFException
at java.util.zip.GZIPInputStream.readUByte(Unknown Source)
at java.util.zip.GZIPInputStream.readUShort(Unknown Source)
at java.util.zip.GZIPInputStream.readUInt(Unknown Source)
at java.util.zip.GZIPInputStream.readTrailer(Unknown Source)
at java.util.zip.GZIPInputStream.read(Unknown Source)
at java.io.BufferedInputStream.read1(Unknown Source)
at java.io.BufferedInputStream.read(Unknown Source)
at java.io.FilterInputStream.read(Unknown Source)
at org.jsoup.helper.DataUtil.readToByteBuffer(DataUtil.java:154)
at org.jsoup.helper.HttpConnection$Response.execute(HttpConnection.java:560)
at org.jsoup.helper.HttpConnection$Response.execute(HttpConnection.java:493)
at org.jsoup.helper.HttpConnection.execute(HttpConnection.java:205)
at org.jsoup.helper.HttpConnection.get(HttpConnection.java:194)
at cn.rsvp.collector.site.BaseUnitCollector.extractUrls(BaseUnitCollector.java:116)
at cn.rsvp.collector.site.TongChengCollector.generateSeedUrlsList(TongChengCollector.java:36)
at cn.rsvp.collector.site.BaseUnitCollector.execute(BaseUnitCollector.java:60)
at cn.rsvp.collector.site.TongChengCollector.main(TongChengCollector.java:185)

Do you have more details, like what site and a code snippet? Does it work in other browsers? Looks like a corrupt gzip output from the service.


Manually create redlists for the different languages

To use each time a crawl has been done and stopword-trainer is to be used

Redlist and cutoff is the manual part of the work.

Just to get started on the manual work:
Dictionary search engine for Northern Sami, Lule Sami and South Sami, that has translations to Norwegian.
https://nb.glosbe.com/sma/nb/jeemie

Added three files to redlists-folder, all with empty arrays for now.


Update pre-commit hook to python 3.7

Currently 3.6, but environment.yml specifies 3.7 for the dev environment. Update the hook configuration to match

Closing this issue as the PR was merged! thank you @kysolvik !!


Update MD file on new branch 2017-12-02_13-41-18

:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

split/updateTestRef1.md
:white_check_mark:Succeeded

For more details, please refer to the build report.
Note: If you changed an existing file name or deleted a file, broken links in other files to the deleted or renamed file are listed only in the full build report.


A PR was merged directly onto master

#1753 got merged directly to master instead of next, that should be undone and applied to next to follow current release practices.
@isiahmeadows volunteered to do this work in gitter.
The commit in question: 000eec90d85324df34fc51827d6c2bf2d75e11d9

That was my mistake, BTW. Apologies for the mess. 😉  😦

Fixed.

Pushed revert for 000eec9 to master
Pushed cherry-pick for 000eec9 to next
Gandalf has already rebuilt the bundles on next.

Here's a thought to avoid future issues: have Gandalf automatically comment on new PRs targeting master, to avoid future scenarios like this.

@isiahmeadows #1784 for my proposal on how to avoid this.


create /etc/rclone.conf: Permission denied

init container error.
message:
Create rclone.conf file.
/usr/local/bin/docker-entrypoint.sh: line 6: can't create /etc/rclone.conf: Permission denied

Hi @majian159, can you give me more details about the environment and what custom settings did you use and what version of the operator? Thank you!

mysql-operator version 0.3.1
my resources
apiVersion: v1
kind: Secret
metadata:
  name: my-secret
type: Opaque
data:
  # root password is required to be specified
  ROOT_PASSWORD: bm90LXNvLXNlY3VyZQ==
---
apiVersion: mysql.presslabs.org/v1alpha1
kind: MysqlCluster
metadata:
  name: my-cluster
spec:
  replicas: 2
  secretName: my-secret

Hi @majian159
Is it OpenShift or Kubernetes?
What Pod Security Policy do you have?

@majian159 Can you show me the sidecar(init container) image? It's very strange to get that error because starting with v0.3 the rclone.conf is written to /tmp/rclone.conf, not /etc, see the code, /etc/rclone.conf was used only in version v0.2.
Did you do an upgrade from v0.2, recently?

I am using kubernetes v1.16.2.
I have not set any Pod Security Policy, Should be default?
@delgod

I reinstalled using helm and the problem disappeared, thank you very much.
@delgod
@AMecea


Call graph edges should have a branch indicator and a popup branch selector

Edges in the call graph that execute more than once should have an indicator showing the number of executions and which execution is currently selected, in the same way as code in the code editor. Hovering over this indicator brings up the branch selector popup.

Example: https://seecode.run/#-KY-onw1le4g9DWIiCed


Angular app bootstrapped with platformBrowserDynamic bundles compiler.js

Been trying to dive through this for some time now, but running into a bit of a dead end, as my deep understanding of some of this stuff is limited.
My bundle size is getting rather large, and a huge chunk of it is Angular's compiler. This seems to only be required because I'm using platformBrowserDynamic instead of platformBrowser. If I flip that over, it drops out and ends up being 460+kB smaller parsed size (115+kB gzipped), which is a significant change.
However, without that, it's not actually working as single-spa states the angularPlatform should be platformBrowserDynamic. Is this a fundamental requirement or should I be able to use the AoT version?

Are you seeing an error when you pass in platformBrowser as the angularPlatform? I see that we require an angularPlatform to be passed in, but we definitely allow for a different platform than platformBrowserDynamic.
Also, if you could provide code samples and stacktraces, that might help me understand what issue you're seeing.

I think the issue is that for me, the fix (ie. getting compiler out of the bundle) is to use platformBrowser instead of platformBrowserDynamic. But for that, it requires bootstrapping via a different method. In single-spa-angular, it calls bootstrapModule on the provided angularPlatform, but for platformBrowser, it would require calling bootstrapModuleFactory instead.
Again, though, this is based on my limited understanding of the entire process, obtained while trying to trim down my bundle size.

A tiny bit more info here: http://www.syntaxsuccess.com/viewarticle/ahead-of-time-compilation-in-angular-2.0 in the Bootstrapping section

@joeldenning - Had any time to look at this any further?

@clpalmer I'm looking into this now, as part of #31 -- thanks for linking me to those resources, i'll check them out and see what i can figure out.

I learned some more about this -- dead code elimination and tree shaking is not working which is what causes the bundle to be so huge. Likely because somehow we're using the fesm5 version of @angular/platform-browser-dynamic instead of es2015 version. See https://twitter.com/Joelbdenning/status/1111390464685412352 for more info

I managed to get it to shake out the compiler without changes to your code, but had to hack it a bit and pass in a wrapper object that contains a function bootstrapModule that internally calls bootstrapModuleFactory on the platformBrowser object. I think it's probably be sufficient if you just checked for the existence of the two functions on the provided angularPlatform we pass in and call the appropriate one.

I just released<EMAIL_ADDRESS>which has a change to how you call singleSpaAngular() such that angular can statically analyze the code and replace platformBrowserDynamic() with platformBrowser(). Bundle size on a hello world app went from 500kb to 250kb.
Want to try it out and let me know if it works for you? See https://github.com/CanopyTax/single-spa-angular/releases/tag/v3.0.0-beta.10

I'm closing this, since it is fixed with #43. Feel free to ask further questions or reopen if 3.0.0-beta.10 doesn't work for you

Thanks @joeldenning! Working nicely. Same bundle size as my hack-around wrapper function before, but eliminates the warning about no bootstrap in main module.

Awesome, happy to hear this 👍


Dev/liuru/dsts plugin

Dsts plugin for Kafka 2.3 -- Based on Dsts plugin for kafka 1,1 ( e.g, https://github.com/microsoft/kafka/pull/27 and https://github.com/microsoft/kafka/pull/29).
Changes in AzPubSubAclAuthorizer.scala:

use Kafka uniform wrapped log utility methods (avoid logging class not found exception).
Kafka ACL related class and methods in Kafka 1.1 are deprecated in Kafka2.3 - use the new ones.
Kafka 2.3 introduced PatternType for Resource.

Change in KafkaZkClient.scala

add a new public method - conditionalSetOrCreateAclsForResource.

 Thank you for your submission, we really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.:x: Hiskyliu sign nowYou have signed the CLA already but the status is still pending? Let us recheck it.


Create content to the 'Property-Property Plot' section of the report

Content should include delta T plots, and similar prop-prop plots (look for inspiration for such plots in the SOCAT QC Editor).

Suggestion on how to facilitate the prop-prop plots section:
In KPI_main.py file:
Need to adjust the structure of the 'render_dict' in order to avoid a lot of duplication in this dictionary:

Change the 'meas_config' and 'calc_config' from dictionaries to lists, containing only the name of the parameter to include in these report sections (in other words: use the existing dictionary keys as list elements, remove the dictionary values)
Add a 'custom_vocab_config' to the 'render_dict', containing only the vocab configs of the parameters in the new 'meas_config' and 'calc_config' list (see point 1)
Loop through the 'custon_prop_config's x-axis and y-axis parameters, and add those missing ones to the 'custom_vocab_config'.

In base.html:
Due to the above changes in the 'render_dict', we need to make adjustments in the base.html template file: all indexing in the previous 'meas_config' and 'calc_config' need to be changed since this information is now moved to the 'custom_vocab_config'.

Simple DeltaT plot function have been created, and gets included in the report. Look at how this was included when adding more such prop-prop plots.


pump spark version from 3.2.2 to 3.3.1

Related Issues/PRs

Testing pump spark version from 3.2.2 to 3.3.0, submit PR to get a snapshot.
What changes are proposed in this pull request?
Pump Spark Version from 3.2.2 to 3.3.0
How is this patch tested?

[ ] I have written tests (not required for typo or doc fix) and confirmed the proposed feature/bug-fix/change works.

Does this PR change any dependencies?

[x] No. You can skip this section.
[ ] Yes. Make sure the dependencies are resolved correctly, and list changes here.

Does this PR add a new feature? If so, have you added samples on website?

[x] No. You can skip this section.
[ ] Yes. Make sure you have added samples following below steps.

Find the corresponding markdown file for your new feature in website/docs/documentation folder.
Make sure you choose the correct class estimators/transformers and namespace.
Follow the pattern in markdown file and add another section for your new API, including pyspark, scala (and .NET potentially) samples.
Make sure the DocTable points to correct API link.
Navigate to website folder, and run yarn run start to make sure the website renders correctly.
Don't forget to add <!--pytest-codeblocks:cont--> before each python code blocks to enable auto-tests for python samples.
Make sure the WebsiteSamplesTests job pass in the pipeline.

/azp run

Codecov Report

Merging #1668 (ba72ee2) into master (965231a) will decrease coverage by 81.03%.
The diff coverage is n/a.

 Take ten seconds to tell us how you rate us. Have a feature suggestion?


AuthorizationPolicy field not work because of principal not found

Bug Description
Tried the spec below:
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: service
  namespace: ns1
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        namespaces:
        - ns1
    to:
    - operation:
        ports:
        - "8080"
  - to:
    - operation:
        paths:
        - /metrics
        ports:
        - "8080"

however it does not work.
The same configuration works on version 1.15.3.
Suspect that there's some impacts after https://github.com/istio/istio/pull/42031 get merged, and the configuration becomes different which causes the bug.
Version
master branch

Additional Information
No response

/cc @kyessenov

That PR is not part of 1.16.

Yes, my PR was after 1.16, so this is something different.

Note this requires MTLS to work. Are you sure mtls is used?
Add rbac:debug logs to the issue

Thanks, will try to replicate and investigate. Surprised we don't have test coverage, so we need to close that gap as well.

Works for me. Can you make sure you have a clean build? Things can go wrong if you use stale envoy marked as version 1.17.

This is real, thank you for reporting. Still not sure what's happening after some debugging.

The policy is doing the right thing. httpbin workload listens on port 80, while you only allow port 8000. If I change it to 80, it works.

The policy is doing the right thing. httpbin workload listens on port 80, while you only allow port 8000. If I change it to 80, it works.

@kyessenov Thanks for trying and debugging. However I was tried both 80/8080 and didn't work for me.
Do you have the same config like this?
{
  "policies": {
    "ns[default]-policy[httpbin]-rule[0]": {
      "permissions": [
        {
          "and_rules": {
            "rules": [
              {
                "or_rules": {
                  "rules": [
                    {
                      "url_path": {
                        "path": {
                          "exact": "/headers"
                        }
                      }
                    }
                  ]
                }
              },
              {
                "or_rules": {
                  "rules": [
                    {
                      "destination_port": 80
                    }
                  ]
                }
              }
            ]
          }
        }
      ],
      "principals": [
        {
          "and_ids": {
            "ids": [
              {
                "or_ids": {
                  "ids": [
                    {
                      "filter_state": {
                        "key": "io.istio.peer_principal",
                        "string_match": {
                          "safe_regex": {
                            "google_re2": {},
                            "regex": ".*/ns/default/.*"
                          }
                        }
                      }
                    }
                  ]
                }
              }
            ]
          }
        }
      ]
    }
  }
}

The 1.15.3's config is like
{
  "policies": {
    "ns[default]-policy[httpbin]-rule[0]": {
      "permissions": [
        {
          "and_rules": {
            "rules": [
              {
                "or_rules": {
                  "rules": [
                    {
                      "url_path": {
                        "path": {
                          "exact": "/headers"
                        }
                      }
                    }
                  ]
                }
              },
              {
                "or_rules": {
                  "rules": [
                    {
                      "destination_port": 80
                    }
                  ]
                }
              }
            ]
          }
        }
      ],
      "principals": [
        {
          "and_ids": {
            "ids": [
              {
                "or_ids": {
                  "ids": [
                    {
                      "authenticated": {
                        "principal_name": {
                          "safe_regex": {
                            "google_re2": {},
                            "regex": ".*/ns/default/.*"
                          }
                        }
                      }
                    }
                  ]
                }
              }
            ]
          }
        }
      ]
    }
  }
}

Only 1.15.3's config works, and I think the only change is from authenticated to filter_state.

Yes, I tried with both and 80 works. It takes a bit of time to update. I also tried on a standalone envoy just to be sure. Can you try again with 80?

@kyessenov Thanks for the help. I just tried a pure kind environment with the latest Istio built from the master branch. It works as expected.


Update to git Vello, new releases of Color, Peniko

@DJMcNab I think someone should separate the MSRV update out of this and handle the noisy changes from that separately ... I've started with cleaning up some stuff as separate PRs (#232, #233).

I have a corresponding branch in xilem already, just not pushed yet, I think.

@DJMcNab Now that Color and Peniko are released, I'd like to get this in here so that we're getting closer to what we need for the upcoming Parley release (and once this is in here, I'll do the same for Xilem).

The PR title might need to change.

Ah, I'd changed the title in the commit but not in the PR.

@DJMcNab Updated!


Semantically order style attributes by default

#105 implemented intuitive ordering of attributes (see issue #60).
Additional we should also order the value of style attributes. This should finally ensure a constant output across runs of Scour on the same file. Ordering should probably be done alphabetically.

Do you think a simple "split-on-semicolor, sort, join again" is enough for this? Or do you imagine something more sophisticated in case the values themself contain semicolons?

Yes, I guess that should be sufficient. At least that's what we're doing in [repairStyle()](https://github.com/scour-project/scour/blob/3929426a5aabbb6819b0d9eb473492e1aa075a7d/scour/scour.py#L1436).
Do you have a scenario in mind where this approach might fail?

No, nothing specific. Just thinking... See #107 for the trivial patch.


AWS console access to list and read resources.

Required access to test ingress and other deployments poweruser-eks should have access to list and read EKS cluster resources.
┆Issue is synchronized with this Jira Bug by Unito

https://docs.aws.amazon.com/eks/latest/userguide/security_iam_id-based-policy-examples.html#policy_example3
please refer this document, look for "View nodes and workloads for all clusters in the AWS Management Console".

@bradfordcp I understand that we are trying to configure some complex security policies, but this is slowing us down a TON. I recommend that we talk about this next week on our call and pause work on AWS till @chaitu6022 has console access and maybe admin access in a project.

I got the access, This issue is resolved.


collection.ensureIndex is deprecated

(node:5028) DeprecationWarning: collection.ensureIndex is deprecated. Use createIndexes instead.
when running node server.js

DeprecationWarning: collection.ensureIndex is deprecated. Use createIndexes instead.
when running node addFields.js


Implement Same Look for File Picker and Subtitle Picker

Is there a way we can have the same look for file picker as the one we have for choosing subtitles? Screenshots for reference:

The first is the file picker, and here you can't see more of the file names because of that icon on the right. However, the subtitle picker doesn't have that issue, so we can see the file names more clearly. Is it possible to have the same look for both, as in, without that icon on the right? It'll make it easier to select episodes, because we can see more of the names.

This is the UI of the system file chooser and there are no options to change things like that.


Deprecated?

Could you please explain why we shouldn't use this anymore? (as you recently added to the README)
I'm using it in my project and am not sure what's wrong with it.

I hate promises https://github.com/cloudflare/cf-ui/blob/master/discussions/broken-promises.md

hi @happylinks Ive offered to maintain this project on behalf of @thejameskyle so that we can keep the project alive for those that find it useful.


Add map(…) and flatMap(…) to OptionalAssert

Summary
If you're dealing with Optionals whose values return Optionals, you end u with a lot of nesting. It would be cool if these could be flattened out like this:
Example
Optiona<Foo> foo = Optional.of(foo);

assertThat(foo).hasValueSatisfying(it -> {
  assertThat(it.methodReturningAnOptional()).hasValueSatisfying(inner -> {
    assertThat(inner.methodReturningNoOptional()).isEqualTo(reference);
  }
}

Note, how you constantly have to nest expressions and also rewrap the values obtained from the method call into new asserts.
It would be cool if one could rather write this instead:
assertThat(foo)
  .flatMap(it -> it.methodReturningAnOptional())
  .map(it -> it.methodReturningNoOptional())
  .isEqualTo(reference);

I currently have this custom assert class in my code to achieve this:
public class OptionalAssert<T> extends AbstractAssert<OptionalAssert<T>, Optional<T>> {

  public OptionalAssert(Optional<T> actual) {
    super(actual, OptionalAssert.class);
  }

  public static <T> OptionalAssert<T> optionalAssertThat(Optional<T> optional) {
    return new OptionalAssert<T>(optional);
  }

  public <S> OptionalAssert<S> flatMap(Function<T, Optional<S>> function) {

    Assertions.assertThat(actual).isPresent();

    return optionalAssertThat(actual.flatMap(function));
  }

  public <S> AbstractObjectAssert<?, S> map(Function<T, S> function) {

    Assertions.assertThat(actual).isPresent();

    return Assertions.assertThat(actual.map(function).orElseThrow(() -> new IllegalStateException()));
  }
}

I guess that can be improved to report good error messages in case of a flat map step producing an empty Optional, but it does the trick for me now.

Oh, and the reason I rather want to map and flat map on the assertions is that it would allow to find out which mapping step produced the empty Optional, whereas when mapping on the Optional directly, that information is lost.

Good idea, map and flatMap will add more functional/fluent style to assertions which is nice.

@olivergierke the current implementation does not fail if map or flatMap produce an empty Optional, this is left to the user to check for that (chaining with contains assertion for example).

I'm closing the issue but might reopen it if needed.


feat: support Google Domain ddns

Fixes: #283.
config

log

A question here, we just used jQuery here, if that's ok to migrate to ES 5. If so, I'd like to have a try (after #367 is done).

A question here, we just used jQuery here, if that's ok to migrate to ES 5. If so, I'd like to have a try (after #367 is done).

ok. We shoud consider the i18n of the web interface.


Added tests

Hi guys,
I saw your todo and wrote a couple of tests. Please review my work and provide feedback.
Thanks!
Matt

Thanks for the PR! We just released v2.0.0 of this SDK with a different API, if you're still up for it would you want to update the tests to work with the new API?

Hi! Sure, I don't have too much time this week but I'll try to rewrite it.