sign .hlkx file

Hello,
Need help with signing Windows HLK submission.  The HLK will create an .hlkx package file that I can sign using signtool.  But AzureSignTool is returning this error: "The file cannot be signed because it is not a recoginized file type for signing or it is corrupt."

Are there example files that we can use? At first glance it looks like an OPC file, so we may already have the code for that but I don't know how to create or validate those files.
https://docs.microsoft.com/en-us/windows-hardware/test/hlk/user/hlk-signing-with-an-hsm#code-samples
/cc @vcsjones

Claire,
I am working to provide a hlkx file produced with a sample driver.  As to validation, I only know of looking at the file properties, Digital Signatures tab.
Thanks, Bill
From: Claire Novotny @.>
Sent: Saturday, February 12, 2022 6:14 AM
To: dotnet/SignService @.>
Cc: Bill Tang @.>; Author @.>
Subject: Re: [dotnet/SignService] sign .hlkx file (Issue #422)
[ External Sender ]
Are there example files that we can use? At first glance it looks like an OPC file, so we may already have the code for that but I don't know how to create or validate those files.
https://docs.microsoft.com/en-us/windows-hardware/test/hlk/user/hlk-signing-with-an-hsm#code-sampleshttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows-hardware%2Ftest%2Fhlk%2Fuser%2Fhlk-signing-with-an-hsm%23code-samples&data=04|01|bill.tang%40dtexsystems.com|3df57c4dbf2a4041ed5108d9ee31df3f|44618ca58bdf4162badc3f07869c4fab|0|0|637802720254004958|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=nzFuO9nrlECIpsKbWWn3WkWce5SXATPvanAyI8nEJPk%3D&reserved=0
/cc @vcsjoneshttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fvcsjones&data=04|01|bill.tang%40dtexsystems.com|3df57c4dbf2a4041ed5108d9ee31df3f|44618ca58bdf4162badc3f07869c4fab|0|0|637802720254004958|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=5jNLPmrMs2kjTk6naMdYkItvg2VhW6Gv%2BDG3nhumkM0%3D&reserved=0

Reply to this email directly, view it on GitHubhttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fdotnet%2FSignService%2Fissues%2F422%23issuecomment-1037236955&data=04|01|bill.tang%40dtexsystems.com|3df57c4dbf2a4041ed5108d9ee31df3f|44618ca58bdf4162badc3f07869c4fab|0|0|637802720254004958|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=f0vPiw0ggnE4%2BncUyL3xQhCuKziPe0SPLwmJMmTdCtQ%3D&reserved=0, or unsubscribehttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAXXIMCWKZRYKEQG5WJCNZYTU2ZTJLANCNFSM5OF5U7KA&data=04|01|bill.tang%40dtexsystems.com|3df57c4dbf2a4041ed5108d9ee31df3f|44618ca58bdf4162badc3f07869c4fab|0|0|637802720254004958|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=q0U9z9aPrETopxB5TAvGkV7Z%2FaTVSZEZEloOSECZqaU%3D&reserved=0.
Triage notifications on the go with GitHub Mobile for iOShttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapps.apple.com%2Fapp%2Fapple-store%2Fid1477376905%3Fct%3Dnotification-email%26mt%3D8%26pt%3D524675&data=04|01|bill.tang%40dtexsystems.com|3df57c4dbf2a4041ed5108d9ee31df3f|44618ca58bdf4162badc3f07869c4fab|0|0|637802720254004958|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=Y%2Fd23bCTRt7n46q81Rj3nqLEFe%2BEbCGeTQf9GCAJFEk%3D&reserved=0 or Androidhttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom.github.android%26referrer%3Dutm_campaign%253Dnotification-email%2526utm_medium%253Demail%2526utm_source%253Dgithub&data=04|01|bill.tang%40dtexsystems.com|3df57c4dbf2a4041ed5108d9ee31df3f|44618ca58bdf4162badc3f07869c4fab|0|0|637802720254004958|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=pei8b1DzdsBWBlWz1y3hD8iYQtoaG5QeuuvvTpUNwzA%3D&reserved=0.
You are receiving this because you authored the thread.Message ID<EMAIL_ADDRESS>This communication is intended for the addressee named and may contain confidential or commercially sensitive information. It should be considered as 'Commercial in Confidence'. Reproduction, dissemination or distribution of this message is prohibited unless authorized by the original sender. The content of this email and any attachments may be subject to Copyright by the original author, and therefore cannot be reproduced without the copyright owner's specific written permission. Any opinion expressed in this email is not necessarily that of the Dtex Group of Companies or its Directors unless specifically stated as such. Although Anti-Virus software is used by the original Author, and all care is taken in the transmission of this communication, no warranty as to this email, or any of its attachments, being "uncorrupted", "unaltered" and "virus free" is implied or given. If you receive this email in error, please delete it from your system immediately and notify the sender at the above email address. Your cooperation is appreciated and requested.

Claire,
Attached is a sample hlkx file for signing.  As to validation, I only know of looking at the file properties, Digital Signatures tab.
Thanks, Bill
From: Claire Novotny @.>
Sent: Saturday, February 12, 2022 6:14 AM
To: dotnet/SignService @.>
Cc: Bill Tang @.>; Author @.>
Subject: Re: [dotnet/SignService] sign .hlkx file (Issue #422)
[ External Sender ]
Are there example files that we can use? At first glance it looks like an OPC file, so we may already have the code for that but I don't know how to create or validate those files.
https://docs.microsoft.com/en-us/windows-hardware/test/hlk/user/hlk-signing-with-an-hsm#code-sampleshttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows-hardware%2Ftest%2Fhlk%2Fuser%2Fhlk-signing-with-an-hsm%23code-samples&data=04|01|bill.tang%40dtexsystems.com|3df57c4dbf2a4041ed5108d9ee31df3f|44618ca58bdf4162badc3f07869c4fab|0|0|637802720254004958|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=nzFuO9nrlECIpsKbWWn3WkWce5SXATPvanAyI8nEJPk%3D&reserved=0
/cc @vcsjoneshttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fvcsjones&data=04|01|bill.tang%40dtexsystems.com|3df57c4dbf2a4041ed5108d9ee31df3f|44618ca58bdf4162badc3f07869c4fab|0|0|637802720254004958|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=5jNLPmrMs2kjTk6naMdYkItvg2VhW6Gv%2BDG3nhumkM0%3D&reserved=0

Reply to this email directly, view it on GitHubhttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fdotnet%2FSignService%2Fissues%2F422%23issuecomment-1037236955&data=04|01|bill.tang%40dtexsystems.com|3df57c4dbf2a4041ed5108d9ee31df3f|44618ca58bdf4162badc3f07869c4fab|0|0|637802720254004958|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=f0vPiw0ggnE4%2BncUyL3xQhCuKziPe0SPLwmJMmTdCtQ%3D&reserved=0, or unsubscribehttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAXXIMCWKZRYKEQG5WJCNZYTU2ZTJLANCNFSM5OF5U7KA&data=04|01|bill.tang%40dtexsystems.com|3df57c4dbf2a4041ed5108d9ee31df3f|44618ca58bdf4162badc3f07869c4fab|0|0|637802720254004958|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=q0U9z9aPrETopxB5TAvGkV7Z%2FaTVSZEZEloOSECZqaU%3D&reserved=0.
Triage notifications on the go with GitHub Mobile for iOShttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapps.apple.com%2Fapp%2Fapple-store%2Fid1477376905%3Fct%3Dnotification-email%26mt%3D8%26pt%3D524675&data=04|01|bill.tang%40dtexsystems.com|3df57c4dbf2a4041ed5108d9ee31df3f|44618ca58bdf4162badc3f07869c4fab|0|0|637802720254004958|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=Y%2Fd23bCTRt7n46q81Rj3nqLEFe%2BEbCGeTQf9GCAJFEk%3D&reserved=0 or Androidhttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom.github.android%26referrer%3Dutm_campaign%253Dnotification-email%2526utm_medium%253Demail%2526utm_source%253Dgithub&data=04|01|bill.tang%40dtexsystems.com|3df57c4dbf2a4041ed5108d9ee31df3f|44618ca58bdf4162badc3f07869c4fab|0|0|637802720254004958|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=pei8b1DzdsBWBlWz1y3hD8iYQtoaG5QeuuvvTpUNwzA%3D&reserved=0.
You are receiving this because you authored the thread.Message ID<EMAIL_ADDRESS>This communication is intended for the addressee named and may contain confidential or commercially sensitive information. It should be considered as 'Commercial in Confidence'. Reproduction, dissemination or distribution of this message is prohibited unless authorized by the original sender. The content of this email and any attachments may be subject to Copyright by the original author, and therefore cannot be reproduced without the copyright owner's specific written permission. Any opinion expressed in this email is not necessarily that of the Dtex Group of Companies or its Directors unless specifically stated as such. Although Anti-Virus software is used by the original Author, and all care is taken in the transmission of this communication, no warranty as to this email, or any of its attachments, being "uncorrupted", "unaltered" and "virus free" is implied or given. If you receive this email in error, please delete it from your system immediately and notify the sender at the above email address. Your cooperation is appreciated and requested.

The signing is successful if the .hlkx file is renamed to .psm1  !!!
-Bill
From: Bill Tang
Sent: Tuesday, February 15, 2022 6:10 PM
To: 'dotnet/SignService' @.>; dotnet/SignService @.>
Cc: Author @.***>
Subject: RE: [dotnet/SignService] sign .hlkx file (Issue #422)
Claire,
Attached is a sample hlkx file for signing.  As to validation, I only know of looking at the file properties, Digital Signatures tab.
Thanks, Bill
From: Claire Novotny<EMAIL_ADDRESS>Sent: Saturday, February 12, 2022 6:14 AM
To: dotnet/SignService<EMAIL_ADDRESS>Cc: Bill Tang<EMAIL_ADDRESS>Author<EMAIL_ADDRESS>Subject: Re: [dotnet/SignService] sign .hlkx file (Issue #422)
[ External Sender ]
Are there example files that we can use? At first glance it looks like an OPC file, so we may already have the code for that but I don't know how to create or validate those files.
https://docs.microsoft.com/en-us/windows-hardware/test/hlk/user/hlk-signing-with-an-hsm#code-sampleshttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows-hardware%2Ftest%2Fhlk%2Fuser%2Fhlk-signing-with-an-hsm%23code-samples&data=04|01|bill.tang%40dtexsystems.com|3df57c4dbf2a4041ed5108d9ee31df3f|44618ca58bdf4162badc3f07869c4fab|0|0|637802720254004958|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=nzFuO9nrlECIpsKbWWn3WkWce5SXATPvanAyI8nEJPk%3D&reserved=0
/cc @vcsjoneshttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fvcsjones&data=04|01|bill.tang%40dtexsystems.com|3df57c4dbf2a4041ed5108d9ee31df3f|44618ca58bdf4162badc3f07869c4fab|0|0|637802720254004958|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=5jNLPmrMs2kjTk6naMdYkItvg2VhW6Gv%2BDG3nhumkM0%3D&reserved=0

Reply to this email directly, view it on GitHubhttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fdotnet%2FSignService%2Fissues%2F422%23issuecomment-1037236955&data=04|01|bill.tang%40dtexsystems.com|3df57c4dbf2a4041ed5108d9ee31df3f|44618ca58bdf4162badc3f07869c4fab|0|0|637802720254004958|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=f0vPiw0ggnE4%2BncUyL3xQhCuKziPe0SPLwmJMmTdCtQ%3D&reserved=0, or unsubscribehttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAXXIMCWKZRYKEQG5WJCNZYTU2ZTJLANCNFSM5OF5U7KA&data=04|01|bill.tang%40dtexsystems.com|3df57c4dbf2a4041ed5108d9ee31df3f|44618ca58bdf4162badc3f07869c4fab|0|0|637802720254004958|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=q0U9z9aPrETopxB5TAvGkV7Z%2FaTVSZEZEloOSECZqaU%3D&reserved=0.
Triage notifications on the go with GitHub Mobile for iOShttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapps.apple.com%2Fapp%2Fapple-store%2Fid1477376905%3Fct%3Dnotification-email%26mt%3D8%26pt%3D524675&data=04|01|bill.tang%40dtexsystems.com|3df57c4dbf2a4041ed5108d9ee31df3f|44618ca58bdf4162badc3f07869c4fab|0|0|637802720254004958|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=Y%2Fd23bCTRt7n46q81Rj3nqLEFe%2BEbCGeTQf9GCAJFEk%3D&reserved=0 or Androidhttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom.github.android%26referrer%3Dutm_campaign%253Dnotification-email%2526utm_medium%253Demail%2526utm_source%253Dgithub&data=04|01|bill.tang%40dtexsystems.com|3df57c4dbf2a4041ed5108d9ee31df3f|44618ca58bdf4162badc3f07869c4fab|0|0|637802720254004958|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=pei8b1DzdsBWBlWz1y3hD8iYQtoaG5QeuuvvTpUNwzA%3D&reserved=0.
You are receiving this because you authored the thread.Message ID<EMAIL_ADDRESS>This communication is intended for the addressee named and may contain confidential or commercially sensitive information. It should be considered as 'Commercial in Confidence'. Reproduction, dissemination or distribution of this message is prohibited unless authorized by the original sender. The content of this email and any attachments may be subject to Copyright by the original author, and therefore cannot be reproduced without the copyright owner's specific written permission. Any opinion expressed in this email is not necessarily that of the Dtex Group of Companies or its Directors unless specifically stated as such. Although Anti-Virus software is used by the original Author, and all care is taken in the transmission of this communication, no warranty as to this email, or any of its attachments, being "uncorrupted", "unaltered" and "virus free" is implied or given. If you receive this email in error, please delete it from your system immediately and notify the sender at the above email address. Your cooperation is appreciated and requested.

Attachments don't seem to be coming through the email reply mechanism. Can you please post it to this issue?

Hello Claire,
My organization policy does not allow posting to public forum.  Is there a way to upload the file to you directly?
Is there a beta release of AzureSignTool that accepts the .hlkx file extension.  I can test this.
The hlkx file indeed looks to be an OPC file.  When signed, the signature be can verified by renaming it to a .zip and looking into \package\services\digital-signature
-Bill
From: Claire Novotny @.>
Sent: Wednesday, February 16, 2022 3:18 PM
To: dotnet/SignService @.>
Cc: Bill Tang @.>; Author @.>
Subject: Re: [dotnet/SignService] sign .hlkx file (Issue #422)
[ External Sender ]
Attachments don't seem to be coming through the email reply mechanism. Can you please post it to this issue?

Reply to this email directly, view it on GitHubhttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fdotnet%2FSignService%2Fissues%2F422%23issuecomment-1042401714&data=04|01|bill.tang%40dtexsystems.com|9c7aec7df01e4549c5d808d9f1a28f1e|44618ca58bdf4162badc3f07869c4fab|0|0|637806502781213393|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=gZjmkpG6OziQzDcGNi8GOMRLfEhzjss42ayhnJyWZpM%3D&reserved=0, or unsubscribehttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAXXIMCUHA7H3RQXCY3WZNETU3QWCBANCNFSM5OF5U7KA&data=04|01|bill.tang%40dtexsystems.com|9c7aec7df01e4549c5d808d9f1a28f1e|44618ca58bdf4162badc3f07869c4fab|0|0|637806502781213393|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=ebUvlI4X%2B3oXxY%2FuXGke4u3eurYDM%2F6HFvBuB6%2B8Cvw%3D&reserved=0.
Triage notifications on the go with GitHub Mobile for iOShttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapps.apple.com%2Fapp%2Fapple-store%2Fid1477376905%3Fct%3Dnotification-email%26mt%3D8%26pt%3D524675&data=04|01|bill.tang%40dtexsystems.com|9c7aec7df01e4549c5d808d9f1a28f1e|44618ca58bdf4162badc3f07869c4fab|0|0|637806502781213393|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=ILfBcxGaj0PhSejaqgj%2FQq%2BZeOLPp%2Fl9ZbiHM84YTwg%3D&reserved=0 or Androidhttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom.github.android%26referrer%3Dutm_campaign%253Dnotification-email%2526utm_medium%253Demail%2526utm_source%253Dgithub&data=04|01|bill.tang%40dtexsystems.com|9c7aec7df01e4549c5d808d9f1a28f1e|44618ca58bdf4162badc3f07869c4fab|0|0|637806502781213393|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=0Yj5mYpA8kSe4Vsm2eQuK%2FZZLSEQzJJh27DyvbZ%2Fmwc%3D&reserved=0.
You are receiving this because you authored the thread.Message ID<EMAIL_ADDRESS>This communication is intended for the addressee named and may contain confidential or commercially sensitive information. It should be considered as 'Commercial in Confidence'. Reproduction, dissemination or distribution of this message is prohibited unless authorized by the original sender. The content of this email and any attachments may be subject to Copyright by the original author, and therefore cannot be reproduced without the copyright owner's specific written permission. Any opinion expressed in this email is not necessarily that of the Dtex Group of Companies or its Directors unless specifically stated as such. Although Anti-Virus software is used by the original Author, and all care is taken in the transmission of this communication, no warranty as to this email, or any of its attachments, being "uncorrupted", "unaltered" and "virus free" is implied or given. If you receive this email in error, please delete it from your system immediately and notify the sender at the above email address. Your cooperation is appreciated and requested.

@bill-dtex After renaming to psm1 and signing with azuresigntool, were you able to submit the signed hlkx file to microsoft hardware submission portal?

No, the signature did not work for submission to the Microsoft Hardware Submission Portal.
A simple verification is to rename it back to .hlkx and use file explorer to look at the file properties, digital signatures tab.
According to this article HLK Signing with an HSMhttps://docs.microsoft.com/en-us/windows-hardware/test/hlk/user/hlk-signing-with-an-hsm, it requires signing via the PackageDigitialSignatureManager APIs.  It will be good if this capability is added to SignService.
In the end, we had to abandon using the Azure Key Vault for the submission.  For now, we are using the old HLK SDK PackageManger APIs with our Authenticode certificate (loaded to the Windows Certificate Store).
-Bill
From: type4ranjan @.>
Sent: Tuesday, March 29, 2022 4:23 AM
To: dotnet/SignService @.>
Cc: Bill Tang @.>; Mention @.>
Subject: Re: [dotnet/SignService] sign .hlkx file (Issue #422)
[ External Sender ]
@bill-dtexhttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fbill-dtex&data=04|01|bill.tang%40dtexsystems.com|d4df8cb4013743b582b208da1176870a|44618ca58bdf4162badc3f07869c4fab|0|0|637841498065888455|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=us2wdLOQb8fdkR6Q3ulOcgnjTyuapfvqsPvserCztKY%3D&reserved=0 After renaming to psm1 and signing with azuresigntool, were you able to submit the signed hlkx file to microsoft hardware submission portal?

Reply to this email directly, view it on GitHubhttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fdotnet%2FSignService%2Fissues%2F422%23issuecomment-1081748074&data=04|01|bill.tang%40dtexsystems.com|d4df8cb4013743b582b208da1176870a|44618ca58bdf4162badc3f07869c4fab|0|0|637841498065888455|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=69fIz%2FjROBQQ9Z7Squ0Ngq6oq%2FEJDgTmP1vbc1bfFHg%3D&reserved=0, or unsubscribehttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAXXIMCUKUMEJ4HOXTSPUDU3VCLR2PANCNFSM5OF5U7KA&data=04|01|bill.tang%40dtexsystems.com|d4df8cb4013743b582b208da1176870a|44618ca58bdf4162badc3f07869c4fab|0|0|637841498065888455|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=3FNKgrHfj2ISAoWNxYU5ucLwq2ge%2F6EEFm9kcaiOSsI%3D&reserved=0.
You are receiving this because you were mentioned.Message ID<EMAIL_ADDRESS>This communication is intended for the addressee named and may contain confidential or commercially sensitive information. It should be considered as 'Commercial in Confidence'. Reproduction, dissemination or distribution of this message is prohibited unless authorized by the original sender. The content of this email and any attachments may be subject to Copyright by the original author, and therefore cannot be reproduced without the copyright owner's specific written permission. Any opinion expressed in this email is not necessarily that of the Dtex Group of Companies or its Directors unless specifically stated as such. Although Anti-Virus software is used by the original Author, and all care is taken in the transmission of this communication, no warranty as to this email, or any of its attachments, being "uncorrupted", "unaltered" and "virus free" is implied or given. If you receive this email in error, please delete it from your system immediately and notify the sender at the above email address. Your cooperation is appreciated and requested.

@bill-dtex Is it possible to share the code that you have used to load the keys and certificate from Azure Key Vault to windows certificate store and sign it using HLK SDK PackageManger APIs?

We are using a non-EV code signing certificate for the HLK SDK PackageManager API that is already installed into the Windows Certificate Store, not extracting from the EV certificate from Azure Key Vault and loading to the Windows Certificate Store.
Here are code snippets using PackageManage API.  But I suspect this will be legacy and the method from here https://docs.microsoft.com/en-us/windows-hardware/test/hlk/user/hlk-signing-with-an-hsm will be the requirement soon.
using Microsoft.Windows.Kits.Hardware.ObjectModel.Submission;
// Sign the package
PackageManager.Sign(sourcePackage, certificate, outputPackage);
private static X509Certificate2 GetCertificateFromStore(string certificateThumbprint, StoreLocation storeLocation)
{
// get first certificate from MY store that matches the thumbprint
}
From: type4ranjan @.>
Sent: Wednesday, March 30, 2022 8:30 AM
To: dotnet/SignService @.>
Cc: Bill Tang @.>; Mention @.>
Subject: Re: [dotnet/SignService] sign .hlkx file (Issue #422)
[ External Sender ]
@bill-dtexhttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fbill-dtex&data=04|01|bill.tang%40dtexsystems.com|8e6ab9c2632f453f3dde08da1262385c|44618ca58bdf4162badc3f07869c4fab|0|0|637842510338769926|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=wnuhHLwgaFapVr69exYaZu53BHdElLwghyxH5xsMxjg%3D&reserved=0 Is it possible to share the code that you have used to load the keys and certificate from Azure Key Vault to windows certificate store and sign it using HLK SDK PackageManger APIs?

Reply to this email directly, view it on GitHubhttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fdotnet%2FSignService%2Fissues%2F422%23issuecomment-1083294165&data=04|01|bill.tang%40dtexsystems.com|8e6ab9c2632f453f3dde08da1262385c|44618ca58bdf4162badc3f07869c4fab|0|0|637842510338769926|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=MUePRkeHi94ZMkIvt58FE%2F1QVM2esZZcgvQKpPJc%2FYg%3D&reserved=0, or unsubscribehttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAXXIMCWXB36CXGL7MK5IY6DVCRXRJANCNFSM5OF5U7KA&data=04|01|bill.tang%40dtexsystems.com|8e6ab9c2632f453f3dde08da1262385c|44618ca58bdf4162badc3f07869c4fab|0|0|637842510338769926|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000&sdata=pLyewZ83ii3%2FURmn5tEXuaUETyjscfU0p%2BWoqZfr4rQ%3D&reserved=0.
You are receiving this because you were mentioned.Message ID<EMAIL_ADDRESS>This communication is intended for the addressee named and may contain confidential or commercially sensitive information. It should be considered as 'Commercial in Confidence'. Reproduction, dissemination or distribution of this message is prohibited unless authorized by the original sender. The content of this email and any attachments may be subject to Copyright by the original author, and therefore cannot be reproduced without the copyright owner's specific written permission. Any opinion expressed in this email is not necessarily that of the Dtex Group of Companies or its Directors unless specifically stated as such. Although Anti-Virus software is used by the original Author, and all care is taken in the transmission of this communication, no warranty as to this email, or any of its attachments, being "uncorrupted", "unaltered" and "virus free" is implied or given. If you receive this email in error, please delete it from your system immediately and notify the sender at the above email address. Your cooperation is appreciated and requested.

This works for submission: https://github.com/monrapps/OpenOpcSignTool


For ease of use there should be a function telling the size of string for bignum_to_string()

Otherwise the user of bignum_to_string() should guess how many characters might be needed?

Hi @yurivict and thanks for your interest in the project :)

Otherwise the user of bignum_to_string() should guess how many characters might be needed?

No guessing is needed, but I completely understand if it's not immediately obvious.
You use two bytes to represent each byte of the bignum (always -> because of hex-string representation).
If you are using e.g. 1024-bit bignums, you need 2048 bits of space + a null-termination byte.
The bignum_to_string function also null-terminates the string for you, so if you pass it "too much memory" it will still work.
From the README (emphasis mine)

No dynamic memory management is utilized, and stdio.h is only used for testing functions parsing to and from hex-strings.

So I consider bignum_to_string and bignum_from_string to be used only for testing and I am not sure I agree that a new function needs to be added.
A quick idea instead would be to make a macro like #define BN_STR_FMT_BUF_SIZE ((2 * BN_ARRAY_SIZE) + 1) or something along that way.
I think that should do the trick, but I haven't tested it - it's just off the top of my head :)


Improve archlinux support

Closes #29
Introduced 'pacman-names' field for external-deps yaml files to define ArchLinux packages with dependent libs
Filled 'pacman-names' field in external-deps yaml files for next libs:

Looks good!
Please also update the installation instruction for Arch, it looks like -DUSERVER_CHECK_PACKAGE_VERSIONS=0 is not required any more https://github.com/userver-framework/userver/blob/4b87e9b9875bf8d758a4997ef64120c27b2860db/scripts/docs/en/userver/tutorial/build.md?plain=1#L215

Many thanks for the wonderful work!


[Question] Android API version compatibility

Hi,
Thanks for this plugin. The README.md says that Android API 14+ is supported. However, the getting started says

You MUST set your Target version to API 25+ and Compile against API 25+

Why this difference? Which level of Android API is supported?
Thanks

This is your compile and target, not minimum.
Watch this: https://channel9.msdn.com/Shows/XamarinShow/Snack-Pack-11-Understanding-Android-API-Level-Settings


ASP.NET MVC version of GOV.UK template

Replaces #138
This is the scripts required to generate an ASP.NET MVC template package for the govuk_template. I've tidied up the Ruby and moved some things around.
Original PR contents:

Hi, I spoke with Tom Scott today about some work I've been doing to get the template and frontend toolkit integrated with ASP.NET MVC. He suggested I create a pull request so you can see what I have done.

I've created a new rake task, build:razor, which will create a nuget package (similar to a ruby gem) containing the files for easy install into an ASP.NET MVC website. I kept this separate in the rakelib folder, but this can easily be merged into your rakefile.

The razor_processor.rb is based off play_processor.rb. The template engine in Play is actually based of Razor which is used in ASP.NET MVC which made this an easy task. I inherited the razor_packager.rb from tar_packager.rb and added code to create a nuget package.

I've never written Ruby before so sorry if anything is a bit messy.

To create the nuget package nuget.exe is required, which I have placed in a "tools" folder. As this is a .NET exe (and the only way to create a nuget package), it requires mono to be installed on the machine. I have this working fine on an Ubuntu 14.10 machine. I wasn't sure on your exact development environment but assumed Linux, although this should work fine on OSX too.

One step I have not done is to publish this package to www.nuget.org. This is very similar to www.rubygems.org! If you are happy with what I have done then I will help with the publishing step. I didn't want to start publishing packages without approval.

I've modified the folder structure of what is inside the nuget package to better reflect common ASP.NET conventions. This puts all sass files in a "Content" folder, all javascript in a "Scripts" folder, and the main layout page in "Views/Shared".

As I'm also interested in using the Frontend Toolkit, I've created a new repository to create a nuget package for that. It's based on how you are creating the gem and npm packages. Again, I've not got it to actually publish it yet, it only creates a local package, but this is an easy step to have once you have an account on www.nuget.org. You can see my new repository here https://github.com/daveraine/govuk_frontend_toolkit_nupkg. Again, I've modified the folder structure in the package for ASP.NET conventions.

Please let me know if you have any questions.

Still todo:

[x] Verify this approach generates the correct package
[ ] Add tests
[ ] Install Mono on CI tools
[ ] Get this to upload the package to Nuget automatically

@daveraine can you verify that this still does what you expect?

Hi, looking good and still working fine. Just a comment on setting the version, there isn't a need to do it in both the .nuspec file and from the command line call. I'd done it from the command line as it was easier than feeding the version into the .nuspec file.
Also, regarding the nuget.exe download, the latest version can always be downloaded from here: http://nuget.org/nuget.exe. Also calling
nuget.exe update -self

will get the exe to update itself.

@daveraine okay I've updated this again. Could you take another look? (Sorry about the ask - no-one here knows much about ASP.NET so we need help!)

No problem, happy to help.
All working correctly.

I've rebased onto master made some small changes to make this mergeable from a git point of view.
I think the .travis.yml should have the mono (and nuget?) dependencies added (some information here: http://docs.travis-ci.com/user/languages/csharp/), as will our internal CI puppet.

Only the Mono runtime is required, nothing is getting built in C#, so I'm not sure if you will need to add Mono to your travis configuration as I'd imagine that would be the Mono SDK. However, I'm unfamiliar with travis, and that might be the only way to get the Mono runtime as a dependency.

@daveraine thanks, I was mistaken about Travis - it doesn't try to test-build the packages (though I think it should).

I think apt-get install mono-devel should give you the CLI mono command.

That will give the full SDK, I think apt-get install mono-runtime will be enough.

I've found an issue with the template generation. I've rebased my own copy of this branch from master and made the update in razor_processor.rb. You can see the updates here:
https://github.com/daveraine/govuk_template/blob/update-dotnet-mvc-nuget-package/build_tools/compiler/razor_processor.rb
The update is to use @Html.Raw() to output the strings, as if they contain html they are not output correctly.
Not sure the best way about getting this update to you, I'm not sure if I can do  pull request to a pull request if it has been rebased?

This PR has been here for almost a year, is it still relevant? Would someone care to check this please?

I'm going to close this for now - if someone needs this version of the template, please let us know and we'll pick this back up.
In the mean time i've rebased the branch, fixed conflicts and added @daveraine's commit - so the unit tests pass and the branch is in a state someone can pickup more easily.
I also had a very quick go at getting mono working in Travis, which didn't work.
As

Thanks @dsingleton for moving my update over. As you say, this branch is in a state that someone can pick it up and carry on with it if needed.


Configure console's URL of digdag server

digdag server runs server and it also runs digdag-ui.
If you runs td operator on it, digdag-ui shows a link to the job but its URL is for aws, and there's no configuration to change it. If you want to change it you need to edit confg/config.js and build digdag.jar; that's inconvenient.
Add configuration to change jobUrl and so on.
For example, in the above case, the link points the job on console in our production. But, we may want to custom the link of the job on our dev-ec2, etc.
Note that since the endpoint may differ per workflow, config.js should have a mapping table from td.endpoint to console URL.

There is no activity. Close.


parameterise the default template

Instead of hard coding the 'enable physics' checkbox and layout drop down, give users the ability to provide their own template.

That might already be possible, I'd have to check. There is some template parsing code in place.
More straight-forward would be to let users hide or show those options with a simple toggle. I don't think I have that yet, but it might be easy to add..

ml-visjs-graph.js already allows it for the network graph, but that is not exposed in the grove wrapping components. I think we need to open a ticket there, though I also think it is a bit of a sharp knife.


How to run inference with image that is not square-shaped?

In yolov4-inference-demo.py, it assumes the height and width of the image are equal.
How should I change the code to perform inference on image that is not square?
The figure below shows the part that throws error when doing inference with rectangular image.
It defines idx based on int(resized_image_w/out_blob_w) and int(resized_image_h/out_blob_h), which are equal.
How should I change this part when, for example image size is 1080x1920?

@yankee624
Your screenshot is the inference program of scaled-yolov4.
see FAQ https://github.com/TNTWEN/OpenVINO-YOLOV4/issues/10  num 4
Just change the input size of tfmodel ,test with inference demo to see if the demo could Identify model‘s  input size

@TNTWEN
Yes I am actually talking about the inference program.
I checked the FAQ and changed the input size of the model.
But, when doing the inference with the changed model, the postprocessing part (in the above screenshot) becomes the problem.
It seems to modify the width and height somehow, but I can't understand what it's doing.
So I don't know how to change that postprocessing part if I use non-square input images


Allow user properties to override generated properties in emr bootstrap

@LuQQiu @madanadit

Merged build finished. Test PASSed.

Test PASSed.
Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/Alluxio-PR-Builder/10060/
Test PASSed.

alluxio-bot, merge this please.


Add new API key regex to JSON and add common_pattern logic

This PR adds the regex for Riot Games Developer API Keys, MongoDB Cloud connection strings and SerpAPI keys.
Additionally, adding a common-pattern flag that allows for a more broader search of common API key patterns. However, this can yield false-positives.

I don't think it is wise to have the common patterns due to the false positives. If you remove it then this PR should be good to be merged

Thank you, it all looks good now!


Interaction Manager throws Errors in IE if renderer is off-screen

Hello everyone,
calling the 'getBoundingClientRect' method (InteractionManager.js, line: 332) on an off-screen DOM-Element causes IE to throw an error. All other browsers return a 'ClientRect'-Object with all properties set to 0.
A simple solution would be to check if the 'parentElement' property is null and if so set point.x and point.y to infinity (well, thats what happens in all other browsers :D)
regards zOadT

FYI: known IE issue: https://connect.microsoft.com/IE/feedback/details/829392/calling-getboundingclientrect-on-an-html-element-that-has-not-been-added-to-the-dom-causes-unspecified-error
Closed as it is fixed in EDGE, but no fix issued on IE <= 11

See my comment in https://github.com/pixijs/pixi.js/issues/1930
For me it seems to be the same issue as this, and it is still an issue as well. I agree with zOadT about how to resolve this.
For us it does not work in IE11 either..

That was fixed in pixiv4


Use built-in bookmarks feed parameter

Hi @svendahlstrand, I'm experimenting with adding some feed URLs as built-in parameters that plug-ins can access. I'm starting with the bookmarks JSON feed.
This pull request just changes your shortcode to use the built-in parameter, so no copy/paste settings configuration is necessary.
Lemme know if you have any thoughts. My only concern is that some feed URLs like this are kind of private-ish, but I think the user intent of installing the plug-in should be enough to give access to the setting. (Also relates to the other discussion about auto-installing plug-ins… Which maybe should be avoided after all.)

Hello @manton, this is great, thanks! 🎉
And yes, there's definitely a lot of shady activity plug-in developers could get up to, like stealing those private-ish URLs. But also create content (pages and blog posts) on behalf of the user or why not rewrite all URL:s linking to micro.blog to micr0.blog? Or why not build a botnet of Micro.blog-hosted blogs? 😅 In the end, it's all about trust.

Good point. And we also already make available some other "private" data like bookshelves to plug-ins. Misbehaving plug-ins can always be removed from the directory, but I'm not expecting any problems.


Question: Formatting for code hints

Howdy, quick question really about how to format jsdoc info
So currently, with ionic, we're just inlining markdown in our code as part of our doc build process. Unfortunately, this is problematic with your plugin as it outputs everything as one long string

Now my question is, if were to format this a bit more with ngdoc/jsdoc style tags, would the preview window pick up that formatting?

if were to format this a bit more with ngdoc/jsdoc style tags, would the preview window pick up that formatting

We just pass the doc comment as it is from the TypeScript language service to atom autocomplete
Would love to have input from https://github.com/atom/autocomplete-plus/issues :rose:

Good to know :smile:
Will pass this along
Thanks


ntpd: insecure config, no way to modify it

Issue description
The ntp.conf file generated by the ntpd.nix derivation has no default restriction, so is wide open if UDP port 123 is open in the firewall.
Steps to reproduce
services.ntp.enable = true;
Technical details
ntp.conf should include a default restriction along the lines of:
restrict    default limited kod nomodify notrap noquery nopeer
restrict -6 default limited kod nomodify notrap noquery nopeer
restrict    source  limited kod nomodify notrap noquery

Or at the very least have a way to specify extra config as a string.

Thanks, please add some small notes as to why one would want this to the options for those people who don't know by heart what the restrictions are about.

@reardencode Yes


chore(deps): upgrade configuration

Upgrades project dependencies. See details in workflow run.

Automatically created by projen via the "upgrade-configuration-2.x" workflow

⚪ Backport skipped
The pull request was not backported as there were no branches to backport to. If this is a mistake, please apply the desired version labels or run the backport tool manually.
Manual backport
To create the backport manually run:
backport --pr 1074

Questions ?
Please refer to the Backport tool documentation


Collision with Babel.js

I cannot figure out why, but running a simple one liner application as the following
var request = require('request');

using babel-node throws a rather strange error:
/usr/share/javascript/node-uuid/uuid.js:225
  if (_global.define && define.amd) {
             ^
TypeError: Cannot read property 'define' of undefined

Any ideas why that might be the case?

@yan-foto What are you trying to do? Here it's working.
Which version of Babel and Request?

Seems to be working for me, also quick look at the node-uuid's code showed me that there is no such line there. You are probably using an older version or something?

I use node v0.10.25, It might be the problem. I will test it with the latest version and get back to you if the problem persists. I will close the issue for the moment.

@yan-foto did you find the problem?

@mmahalwy I did not go after at. I suppose it was a local porblem.

Any update on this?????? I am getting the same error.


[Feature] Introduce a JNI connector

What type of PR is this：

[ ] bug
[x] feature
[ ] enhancement
[ ] refactor
[ ] others

introduce a JNI connector In order to quickly access the data source of the java ecosystem.

Notes for review:
Reviewer should read comments in OffHeapTable.java to understand the memory layout design used to interact with C++ in BE.
/**
 * We use off-heap memory to save the off-heap table data
 * and a custom memory layout to be parsed by Starrocks BE written in C++.
 *
 * Off-heap table memory layout details:
 * 1. A single data column is stored continuously in off-heap memory.
 * 2. Different data columns are stored in different locations in off-heap memory.
 * 3. Introduce null indicator columns to determine if a field is empty or not.
 * 4. Introduce a meta column to save the memory addresses of different data columns,
 *    the memory addresses of null indicator columns and number of rows.
 *
 * Meta column layout:
 * Meta column start address: | number of rows |
 *                            | null indicator start address of fixed length column-A |
 *                            | data column start address of the fixed length column-A  |
 *                            | ... |
 *                            | null indicator start address of variable length column-B |
 *                            | offset column start address of the variable length column-B |
 *                            | data column start address of the variable length column-B |
 *                            | ... |
 *
 * Null indicator column layout:
 * Null column start address: | 1-byte boolean | 1-byte boolean | 1-byte boolean | ... |
 *                 Row index: -------row 0-------------row 1------------row 2----- ... -
 *
 * Data column layout:
 * Data columns are divided into two storage types: fixed length column and variable length column.
 *
 * For fixed length column like BOOLEAN/INT/LONG, we use first-level index addressing method.
 * (1) Get data column start address from meta column.
 * (2) Use column start address to read the data of fixed length.
 * Fixed length column memory layout:
 * Data column start address of fixed length column: | X-bytes | X-bytes | X-bytes | ... |
 * INT column of 4 bytes for example:
 * Fixed length column start address: | 4-bytes INT | 4-bytes INT | 4-bytes INT | ... |
 *                         Row index:  ----row 0---------row 1---------row 2----- ... -
 *
 *
 * For variable length column like STRING/DECIMAL, we use secondary-level index addressing method.
 * (1) Get data column start address from meta column.
 * (2) Get the field start memory address from offset column at a row index.
 * (2) Get the field start memory address from offset column at the next row index to compute the filed length.
 * (4) Use the data start address and the field length to read the data of variable length.
 * Variable length column memory layout:
 * Offset column start address of variable length column: : | 4-bytes INT | 4-bytes INT | 4-bytes INT | ... |
 * Data column start address of variable length column: | X-bytes | Y-bytes | Z-bytes | ... |
 * STRING column for example:
 * Offset column start address: | 4-bytes INT | 4-bytes INT | 4-bytes INT | ... |
 *                   Row index:  ----row 0---------row 1---------row 2----- ... -
 * Variable length column start address: |    (length of row 0)-bytes    | (length of row 1)-bytes | ... |
 *                                       |                               |
 *                 column start address + offset of row 0    column start address + length of row 1
 */

suggest rename java-utils to java-native-utils

we should add java-utils-xxx.jar and jni-connector-xxx.jar to JNI class path
void JVMFunctionHelper::_init() {
    std::string home = getenv("STARROCKS_HOME");
    std::vector<std::string> class_paths = {home + "/lib/udf-extensions-jar-with-dependencies.jar",
                                            home + "/lib/starrocks-jdbc-bridge-jar-with-dependencies.jar"};
    for (auto path : class_paths) {
        _add_class_path(path);
    }

run starrocks_admit_test

run starrocks_admit_test


Generate New Appcenter Secret

Describe the solution you'd like
Often times users can have their secrets compromised. There should be an option to generate a new  secret for an app rather than creating a whole new project entirely as have  happened several times. Usually because a lot of  other things  like build configs and signing  keys  and  store accounts are already configured
Describe alternatives you've considered
Creating new Projects  and reconfiguring everything

Hi @johnxy84, we've debated on renaming App Secret to something else because it isn't really intended to be a true secret. Users can only send analytics/crash logs to our ingestion service with that key to generate fake event data and/or perform certain update checks for public distribution groups. Rather than allow for new regeneration, would it be better for us to clarify that we don't view that guid as something that exposes any risk if compromised?

I'm sort of the opinion that spamming the developer with wrong analytical data or crash events poses as a form of risk as decisions can be carried out due to this data.

Hi All,
I was re-directed to here from the App center support team. I would like to +1 on this feature request.
Often when we use AppCenter to release to customers/users, we want analytics/crash reports.
However we don't want the dev/tester usage to be included in that -- so It would be great to be able to create multiple secrets in the one project on AppCenter to separate the two environments. Or at least filter the analytics outcome to separate the two somehow.
We use AzureDevOps as a repository and mostly everything is handled with our CICD pipeline. Just for convenience sake we have a branch for releasing to our devs/testers, and another branch for releasing to respective app stores. It would work great for us if we can assign a different AppCenter Secret for each of those branches so the analytics gathered is clearly separated.

it isn't really intended to be a true secret
I agree that documenting its purpose is a good move, but having an option to regenerate/revoke still seems pretty important functionality.


Knative service doesn't appear to update sink address if it changes on GitHubSource

Describe the bug
I modified the sink of an existing GitHubSource, but it continued to deliver events to the previous sink. I updated the sink from a k8s service named "event-display" to a k8s service named "el-github-listener".
The GitHubSource spec appears correct (output of kubectl describe). However, there is a knative service that I'm assuming is responsible for delivering the event payload to my sink (its owner reference is the GitHubSource I created), and its spec appears wrong. The K_SINK env var is set to "http://event-display.dogfood.svc.cluster.local", i.e. the old address. When I delete this service, a new one is recreated with the correct K_SINK env var (http://el-github-listener.dogfood.svc.cluster.local).
Expected behavior
When I edit the GitHubSource to use a new sink address, it sends events to that sink without having to delete and recreate the GitHubSource.
To Reproduce
Original EventSource config:
apiVersion: sources.knative.dev/v1alpha1
kind: GitHubSource
metadata:
  name: github-push
  namespace: dogfood
spec:
  eventTypes:
    - push
  ownerAndRepository: lbernick/web-app-demo
  accessToken:
    secretKeyRef:
      name: knative-githubsecret
      key: accessToken
  secretToken:
    secretKeyRef:
      name: knative-githubsecret
      key: secretToken
  sink:
    ref:
      url: http://event-display.dogfood.svc.cluster.local

I updated the sink to point to http://el-github-listener.dogfood.svc.cluster.local.
Knative release version
$ kn version
Version:      v1.8.1
Build Date:   2022-10-20 16:09:37
Git Revision: 1db36698
Supported APIs:
* Serving
  - serving.knative.dev/v1 (knative-serving v1.8.0)
* Eventing
  - sources.knative.dev/v1 (knative-eventing v1.8.0)
  - eventing.knative.dev/v1 (knative-eventing v1.8.0)

/remove-lifecycle stale

@lbernick are you using github.yaml or mt-github.yaml to install eventing-github?
https://github.com/knative-sandbox/eventing-github/releases/tag/knative-v1.8.0

I followed installation docs here which use github.yaml.


Enable CI

We already have a travis configuration for this repository and it is running at https://github.com/anacierdem/libdragon. Can you also enable for https://github.com/DragonMinded/libdragon so that any PR will trigger a test. Currently deployments are only enabled on anacierdem/libdragon and will not cause an issue. I will update the changelog and deploy when necessary.

Enabled~


kube-dns-3841192733-98vm5             0/3       CrashLoopBackOff

Environment:

vmware workstation 12

OS (Linux 3.10.0-514.26.2.el7.x86_64 x86_64\n"):

[root@k8s-master kubernetes]# cat /etc/os-release
NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"

Version of Ansible (ansible --version):

[root@k8s-master kubernetes]# ansible --version
ansible <IP_ADDRESS>
  config file =
  configured module search path = Default w/o overrides
  python version = 2.7.5 (default, Nov  6 2016, 00:28:07) [GCC 4.8.5 20150623 (Red Hat 4.8.5-11)]

Kubespray version (commit) (git rev-parse --short HEAD):
use ansible-playbook to deploy.
Network plugin used:
default calico
Copy of your inventory file:
[kube-master]
# node1
# node2
k8s-master

[etcd]
# node1
# node2
# node3
k8s-master

[kube-node]
# node2
# node3
# node4
# node5
# node6
k8s-node1
k8s-node2

[k8s-cluster:children]
kube-node
kube-master

Command used to invoke ansible:
ansible-playbook -i inventory/inventory cluster.yml  --skip-tags=download

Output of ansible run:

PLAY RECAP *******************************************************************************************************************************************************************************************************************************************************************
k8s-master                 : ok=193  changed=40   unreachable=0    failed=0
k8s-node1                  : ok=173  changed=44   unreachable=0    failed=0
k8s-node2                  : ok=141  changed=32   unreachable=0    failed=0
localhost                  : ok=3    changed=0    unreachable=0    failed=0

The question：
[root@k8s-master kubespray]# kubectl get nodes
NAME         STATUS                     AGE       VERSION
k8s-master   Ready,SchedulingDisabled   1h        v1.6.7+coreos.0
k8s-node1    Ready                      1h        v1.6.7+coreos.0
k8s-node2    Ready                      1h        v1.6.7+coreos.0

[root@k8s-master kubespray]# kubectl get pod --namespace=kube-system
NAME                                  READY     STATUS             RESTARTS   AGE
kube-apiserver-k8s-master             1/1       Running            0          1h
kube-controller-manager-k8s-master    1/1       Running            0          1h
kube-dns-3841192733-3gt4j             3/3       Running            0          1h
kube-dns-3841192733-98vm5             1/3       CrashLoopBackOff   74         1h
kube-proxy-k8s-master                 1/1       Running            0          1h
kube-proxy-k8s-node1                  1/1       Running            0          1h
kube-proxy-k8s-node2                  1/1       Running            1          1h
kube-scheduler-k8s-master             1/1       Running            0          1h
kubedns-autoscaler-1833630871-kl6h4   1/1       Running            0          1h
nginx-proxy-k8s-node1                 1/1       Running            0          1h
nginx-proxy-k8s-node2                 1/1       Running            1          1h

[root@k8s-master kubespray]# kubectl describe pod kube-dns-3841192733-98vm5  --namespace=kube-system
Name:		kube-dns-3841192733-98vm5
Namespace:	kube-system
Node:		k8s-node2/<IP_ADDRESS>
Start Time:	Thu, 03 Aug 2017 10:55:13 +0800
Labels:		k8s-app=kube-dns
		pod-template-hash=3841192733
Annotations:	kubernetes.io/created-by={"kind":"SerializedReference","apiVersion":"v1","reference":{"kind":"ReplicaSet","namespace":"kube-system","name":"kube-dns-3841192733","uid":"26f7bd9e-77f7-11e7-b315-000c2973...
		scheduler.alpha.kubernetes.io/critical-pod=
Status:		Running
IP:		<IP_ADDRESS>
Controllers:	ReplicaSet/kube-dns-3841192733
Containers:
  kubedns:
    Container ID:	docker://a81d06f91f4f9258a206ca6c52b06a1580da0549f9349e2e7f39b7eff9ced52f
    Image:		gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.14.2
    Image ID:		docker-pullable://registry.cn-hangzhou.aliyuncs.com/golden/k8s-dns-kube-dns-amd64@sha256:a19dc86abee24d5b612419d5eb1f6590e0e43fd06eed45d6c01551e894bc98e8
    Ports:		10053/UDP, 10053/TCP, 10055/TCP
    Args:
      --domain=cluster.local.
      --dns-port=10053
      --config-dir=/kube-dns-config
      --v=2
    State:		Waiting
      Reason:		CrashLoopBackOff
    Last State:		Terminated
      Reason:		Error
      Exit Code:	255
      Started:		Thu, 03 Aug 2017 12:18:07 +0800
      Finished:		Thu, 03 Aug 2017 12:19:07 +0800
    Ready:		False
    Restart Count:	22
    Limits:
      memory:	170Mi
    Requests:
      cpu:	100m
      memory:	70Mi
    Liveness:	http-get http://:10054/healthcheck/kubedns delay=60s timeout=5s period=10s #success=1 #failure=5
    Readiness:	http-get http://:8081/readiness delay=3s timeout=5s period=10s #success=1 #failure=3
    Environment:
      PROMETHEUS_PORT:	10055
    Mounts:
      /kube-dns-config from kube-dns-config (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-3zdmd (ro)
  dnsmasq:
    Container ID:	docker://9f4a206ba43c47574ebcf740c13529737c5750733e7bda19ae6b4261876c0e78
    Image:		gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:1.14.2
    Image ID:		docker-pullable://registry.cn-hangzhou.aliyuncs.com/google-containers/k8s-dns-dnsmasq-nanny-amd64@sha256:70b157a6695e5dddc5a3741c401c0507f0fd9326376c77162c690f5f5e82a264
    Ports:		53/UDP, 53/TCP
    Args:
      -v=2
      -logtostderr
      -configDir=/etc/k8s/dns/dnsmasq-nanny
      -restartDnsmasq=true
      --
      -k
      --cache-size=1000
      --log-facility=-
      --server=/cluster.local/<IP_ADDRESS>#10053
      --server=/in-addr.arpa/<IP_ADDRESS>#10053
      --server=/ip6.arpa/<IP_ADDRESS>#10053
    State:		Running
      Started:		Thu, 03 Aug 2017 12:19:41 +0800
    Last State:		Terminated
      Reason:		Error
      Exit Code:	137
      Started:		Thu, 03 Aug 2017 12:12:47 +0800
      Finished:		Thu, 03 Aug 2017 12:14:27 +0800
    Ready:		True
    Restart Count:	25
    Requests:
      cpu:		150m
      memory:		20Mi
    Liveness:		http-get http://:10054/healthcheck/dnsmasq delay=60s timeout=5s period=10s #success=1 #failure=5
    Environment:	<none>
    Mounts:
      /etc/k8s/dns/dnsmasq-nanny from kube-dns-config (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-3zdmd (ro)
  sidecar:
    Container ID:	docker://790b80b09ed34a792802f53e9f2b230f56073e647cac6052b23e32493f21f803
    Image:		gcr.io/google_containers/k8s-dns-sidecar-amd64:1.14.2
    Image ID:		docker-pullable://registry.cn-hangzhou.aliyuncs.com/google-containers/k8s-dns-sidecar-amd64@sha256:7568f2adae47ebac0e40bc3fd6358b27e5c8894627d2d48e7748e159b02403ac
    Port:		10054/TCP
    Args:
      --v=2
      --logtostderr
      --probe=kubedns,<IP_ADDRESS>:10053,kubernetes.default.svc.cluster.local,5,A
      --probe=dnsmasq,<IP_ADDRESS>:53,kubernetes.default.svc.cluster.local,5,A
    State:		Waiting
      Reason:		CrashLoopBackOff
    Last State:		Terminated
      Reason:		Error
      Exit Code:	2
      Started:		Thu, 03 Aug 2017 12:14:37 +0800
      Finished:		Thu, 03 Aug 2017 12:15:47 +0800
    Ready:		False
    Restart Count:	27
    Requests:
      cpu:		10m
      memory:		20Mi
    Liveness:		http-get http://:10054/metrics delay=60s timeout=5s period=10s #success=1 #failure=5
    Environment:	<none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-3zdmd (ro)
Conditions:
  Type		Status
  Initialized 	True
  Ready 	False
  PodScheduled 	True
Volumes:
  kube-dns-config:
    Type:	ConfigMap (a volume populated by a ConfigMap)
    Name:	kube-dns
    Optional:	true
  default-token-3zdmd:
    Type:	Secret (a volume populated by a Secret)
    SecretName:	default-token-3zdmd
    Optional:	false
QoS Class:	Burstable
Node-Selectors:	<none>
Tolerations:	CriticalAddonsOnly=:Exists
Events:
  FirstSeen	LastSeen	Count	From			SubObjectPath	Type		Reason		Message
  ---------	--------	-----	----			-------------	--------	------		-------
  59m		59m		2	kubelet, k8s-node2			Warning		FailedSync	Error syncing pod, skipping: failed to "StartContainer" for "kubedns" with CrashLoopBackOff: "Back-off 20s restarting failed container=kubedns pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"

  59m	59m	1	kubelet, k8s-node2	spec.containers{sidecar}	Normal	Killing		Killing container with docker id 3c9b0b052514: pod "kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)" container "sidecar" is unhealthy, it will be killed and re-created.
  59m	59m	1	kubelet, k8s-node2	spec.containers{kubedns}	Normal	Started		Started container with docker id 5db552060a2b
  59m	59m	1	kubelet, k8s-node2	spec.containers{kubedns}	Normal	Created		Created container with docker id 5db552060a2b; Security:[seccomp=unconfined]
  59m	59m	1	kubelet, k8s-node2	spec.containers{dnsmasq}	Normal	Killing		Killing container with docker id 7bef7de03d6d: pod "kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)" container "dnsmasq" is unhealthy, it will be killed and re-created.
  59m	59m	1	kubelet, k8s-node2	spec.containers{dnsmasq}	Normal	Started		Started container with docker id 323dd27a01d2
  59m	59m	1	kubelet, k8s-node2	spec.containers{dnsmasq}	Normal	Created		Created container with docker id 323dd27a01d2; Security:[seccomp=unconfined]
  58m	58m	1	kubelet, k8s-node2	spec.containers{sidecar}	Normal	Killing		Killing container with docker id dd9c6256b2e7: pod "kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)" container "sidecar" is unhealthy, it will be killed and re-created.
  57m	57m	1	kubelet, k8s-node2	spec.containers{dnsmasq}	Normal	Killing		Killing container with docker id 323dd27a01d2: pod "kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)" container "dnsmasq" is unhealthy, it will be killed and re-created.
  58m	57m	3	kubelet, k8s-node2					Warning	FailedSync	Error syncing pod, skipping: failed to "StartContainer" for "kubedns" with CrashLoopBackOff: "Back-off 40s restarting failed container=kubedns pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"

  56m	56m	1	kubelet, k8s-node2	spec.containers{sidecar}	Normal	Killing		Killing container with docker id 5987337b15c1: pod "kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)" container "sidecar" is unhealthy, it will be killed and re-created.
  55m	55m	1	kubelet, k8s-node2	spec.containers{dnsmasq}	Normal	Killing		Killing container with docker id 7060918cd885: pod "kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)" container "dnsmasq" is unhealthy, it will be killed and re-created.
  56m	55m	7	kubelet, k8s-node2					Warning	FailedSync	Error syncing pod, skipping: failed to "StartContainer" for "kubedns" with CrashLoopBackOff: "Back-off 1m20s restarting failed container=kubedns pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"

  54m	54m	1	kubelet, k8s-node2	spec.containers{sidecar}	Normal	Killing		Killing container with docker id e001cc7ecc3d: pod "kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)" container "sidecar" is unhealthy, it will be killed and re-created.
  54m	53m	5	kubelet, k8s-node2					Warning	FailedSync	Error syncing pod, skipping: failed to "StartContainer" for "kubedns" with CrashLoopBackOff: "Back-off 2m40s restarting failed container=kubedns pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"

  52m	52m	3	kubelet, k8s-node2		Warning	FailedSync	Error syncing pod, skipping: [failed to "StartContainer" for "dnsmasq" with CrashLoopBackOff: "Back-off 2m40s restarting failed container=dnsmasq pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "sidecar" with CrashLoopBackOff: "Back-off 2m40s restarting failed container=sidecar pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "kubedns" with CrashLoopBackOff: "Back-off 2m40s restarting failed container=kubedns pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
]
  52m	51m	4	kubelet, k8s-node2		Warning	FailedSync	Error syncing pod, skipping: [failed to "StartContainer" for "kubedns" with CrashLoopBackOff: "Back-off 2m40s restarting failed container=kubedns pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "dnsmasq" with CrashLoopBackOff: "Back-off 2m40s restarting failed container=dnsmasq pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "sidecar" with CrashLoopBackOff: "Back-off 2m40s restarting failed container=sidecar pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
]
  51m	50m	6	kubelet, k8s-node2		Warning	FailedSync	Error syncing pod, skipping: [failed to "StartContainer" for "dnsmasq" with CrashLoopBackOff: "Back-off 2m40s restarting failed container=dnsmasq pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "sidecar" with CrashLoopBackOff: "Back-off 2m40s restarting failed container=sidecar pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
]
  50m	50m	2	kubelet, k8s-node2		Warning	FailedSync	Error syncing pod, skipping: [failed to "StartContainer" for "kubedns" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=kubedns pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "dnsmasq" with CrashLoopBackOff: "Back-off 2m40s restarting failed container=dnsmasq pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "sidecar" with CrashLoopBackOff: "Back-off 2m40s restarting failed container=sidecar pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
]
  50m	50m	3	kubelet, k8s-node2		Warning	FailedSync	Error syncing pod, skipping: [failed to "StartContainer" for "kubedns" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=kubedns pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "dnsmasq" with CrashLoopBackOff: "Back-off 2m40s restarting failed container=dnsmasq pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
]
  44m	44m	1	kubelet, k8s-node2		Warning	FailedSync	Error syncing pod, skipping: [failed to "StartContainer" for "sidecar" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=sidecar pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "dnsmasq" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=dnsmasq pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
]
  1h	44m	3	kubelet, k8s-node2	spec.containers{kubedns}	Warning	Unhealthy	Liveness probe failed: Get http://<IP_ADDRESS>:10054/healthcheck/kubedns: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
  20m	13m	12	kubelet, k8s-node2					Warning	FailedSync	Error syncing pod, skipping: failed to "StartContainer" for "dnsmasq" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=dnsmasq pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"

  34m	8m	4	kubelet, k8s-node2		Warning	FailedSync	Error syncing pod, skipping: [failed to "StartContainer" for "sidecar" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=sidecar pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "kubedns" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=kubedns pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
]
  32m	7m	15	kubelet, k8s-node2		Warning	FailedSync	Error syncing pod, skipping: failed to "StartContainer" for "sidecar" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=sidecar pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"

  49m	6m	16	kubelet, k8s-node2		Warning	FailedSync	Error syncing pod, skipping: failed to "StartContainer" for "kubedns" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=kubedns pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"

  1h	6m	21	kubelet, k8s-node2	spec.containers{dnsmasq}	Warning	Unhealthy	Liveness probe failed: Get http://<IP_ADDRESS>:10054/healthcheck/dnsmasq: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
  1h	5m	19	kubelet, k8s-node2	spec.containers{sidecar}	Normal	Pulled		Container image "gcr.io/google_containers/k8s-dns-sidecar-amd64:1.14.2" already present on machine
  12m	5m	5	kubelet, k8s-node2					Warning	FailedSync	Error syncing pod, skipping: [failed to "StartContainer" for "dnsmasq" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=dnsmasq pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "kubedns" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=kubedns pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
]
  44m	4m	51	kubelet, k8s-node2		Warning	FailedSync	Error syncing pod, skipping: [failed to "StartContainer" for "kubedns" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=kubedns pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "dnsmasq" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=dnsmasq pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
]
  54m	4m	27	kubelet, k8s-node2	spec.containers{dnsmasq}	Normal	Killing		(events with common reason combined)
  1h	4m	23	kubelet, k8s-node2	spec.containers{sidecar}	Warning	Unhealthy	Liveness probe failed: Get http://<IP_ADDRESS>:10054/metrics: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
  49m	4m	31	kubelet, k8s-node2					Warning	FailedSync	(events with common reason combined)
  1h	2m	15	kubelet, k8s-node2	spec.containers{kubedns}	Normal	Pulled		Container image "gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.14.2" already present on machine
  45m	1m	17	kubelet, k8s-node2					Warning	FailedSync	Error syncing pod, skipping: [failed to "StartContainer" for "dnsmasq" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=dnsmasq pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "sidecar" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=sidecar pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
]
  1h	1m	91	kubelet, k8s-node2	spec.containers{kubedns}	Warning	Unhealthy	Readiness probe failed: Get http://<IP_ADDRESS>:8081/readiness: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
  46m	1m	6	kubelet, k8s-node2					Warning	FailedSync	Error syncing pod, skipping: [failed to "StartContainer" for "dnsmasq" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=dnsmasq pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "sidecar" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=sidecar pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "kubedns" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=kubedns pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
]
  45m	1m	11	kubelet, k8s-node2		Warning	FailedSync	Error syncing pod, skipping: [failed to "StartContainer" for "sidecar" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=sidecar pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "kubedns" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=kubedns pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "dnsmasq" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=dnsmasq pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
]
  48m	1m	57	kubelet, k8s-node2		Warning	FailedSync	Error syncing pod, skipping: [failed to "StartContainer" for "kubedns" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=kubedns pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "dnsmasq" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=dnsmasq pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "sidecar" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=sidecar pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
]
  59m	45s	43	kubelet, k8s-node2	spec.containers{sidecar}	Normal	Started		(events with common reason combined)
  59m	45s	43	kubelet, k8s-node2	spec.containers{sidecar}	Normal	Created		(events with common reason combined)
  1h	45s	18	kubelet, k8s-node2	spec.containers{dnsmasq}	Normal	Pulled		Container image "gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:1.14.2" already present on machine
  49m	16s	49	kubelet, k8s-node2					Warning	FailedSync	Error syncing pod, skipping: [failed to "StartContainer" for "kubedns" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=kubedns pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
, failed to "StartContainer" for "sidecar" with CrashLoopBackOff: "Back-off 5m0s restarting failed container=sidecar pod=kube-dns-3841192733-98vm5_kube-system(2c5a8946-77f7-11e7-b315-000c29735600)"
]
  59m	16s	647	kubelet, k8s-node2	spec.containers{kubedns}	Warning	BackOff	Back-off restarting failed docker container
[root@k8s-master kubespray]#

the logs:
[root@k8s-master kubespray]# kubectl logs kube-dns-3841192733-98vm5 -c kubedns  --namespace=kube-system
I0803 04:18:07.891782       1 dns.go:48] version: 1.14.1-16-gff416ee
I0803 04:18:07.895104       1 server.go:70] Using configuration read from directory: /kube-dns-config with period 10s
I0803 04:18:07.895201       1 server.go:113] FLAG: --alsologtostderr="false"
I0803 04:18:07.895231       1 server.go:113] FLAG: --config-dir="/kube-dns-config"
I0803 04:18:07.895239       1 server.go:113] FLAG: --config-map=""
I0803 04:18:07.895243       1 server.go:113] FLAG: --config-map-namespace="kube-system"
I0803 04:18:07.895246       1 server.go:113] FLAG: --config-period="10s"
I0803 04:18:07.895255       1 server.go:113] FLAG: --dns-bind-address="<IP_ADDRESS>"
I0803 04:18:07.895259       1 server.go:113] FLAG: --dns-port="10053"
I0803 04:18:07.895265       1 server.go:113] FLAG: --domain="cluster.local."

I0803 04:18:08.896880       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:09.396930       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:09.897192       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:10.396988       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:10.896985       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:18:10.902413       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:18:10.902554       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:18:11.397083       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:11.897059       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:12.396887       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:12.896929       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:13.397139       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:13.897123       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:18:13.908867       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:18:13.909156       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:18:14.396965       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:14.897073       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:15.397285       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:15.897207       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:16.396174       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:16.897106       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:18:16.914789       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:18:16.914923       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:18:17.397103       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:17.896291       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:18.396513       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:18.896368       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:19.396581       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:19.897031       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:18:19.921233       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:18:19.921256       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:18:20.396446       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:20.897215       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:21.396261       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:21.897082       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:22.396869       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:22.896789       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:18:22.931870       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:18:22.931869       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:18:23.396893       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:23.896658       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:24.396587       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:24.896141       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:25.396507       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:25.896707       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:18:25.936727       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:18:25.937316       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:18:26.396957       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:26.896977       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:27.397178       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:27.896168       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:28.397031       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:28.897111       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:18:28.942230       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:18:28.942279       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:18:29.396310       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:29.896850       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:30.397048       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:30.896278       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:31.396456       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:31.896951       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:18:31.949008       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:18:31.949023       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:18:32.396747       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:32.897225       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:33.396297       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:33.897102       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:34.396412       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:34.896683       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:18:34.955200       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:18:34.955272       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:18:35.397422       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:35.897046       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:36.396380       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:36.896352       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:37.396763       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:37.896202       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:18:37.961117       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:18:37.961153       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:18:38.396716       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:38.897047       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:39.397139       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:39.897410       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:40.396337       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:40.896216       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:18:40.967223       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:18:40.967261       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:18:41.397360       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:41.896264       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:42.396843       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:42.897113       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:43.397013       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:43.896346       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:18:43.973440       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:18:43.973518       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:18:44.397088       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:44.897010       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:45.396505       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:45.897058       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:46.397338       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:46.897066       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:18:46.980430       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:18:46.980462       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:18:47.396302       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:47.897045       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:48.397023       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:48.896900       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:49.396560       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:49.897958       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:18:49.988552       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:18:49.988583       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:18:50.396664       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:50.897112       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:51.397026       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:51.896701       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:52.396782       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:52.896505       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:18:52.997285       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:18:52.997301       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:18:53.396601       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:53.897182       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:54.397355       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:54.896748       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:55.396319       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:55.896660       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:18:56.004506       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:18:56.004644       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:18:56.396640       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:56.896921       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:57.396304       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:57.896354       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:58.396517       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:58.896940       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:18:59.010882       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:18:59.011046       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:18:59.397542       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:18:59.896846       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:19:00.397089       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:19:00.897015       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:19:01.396944       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:19:01.897039       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:19:02.017239       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:19:02.017256       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:19:02.397158       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:19:02.896773       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:19:03.396850       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:19:03.896908       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:19:04.397151       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:19:04.897193       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
E0803 04:19:05.024809       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Endpoints: Get https://<IP_ADDRESS>:443/api/v1/endpoints?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
E0803 04:19:05.024814       1 reflector.go:199] k8s.io/dns/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1.Service: Get https://<IP_ADDRESS>:443/api/v1/services?resourceVersion=0: dial tcp <IP_ADDRESS>:443: getsockopt: no route to host
I0803 04:19:05.397319       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:19:05.897037       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:19:06.396963       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:19:06.897126       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
I0803 04:19:07.396730       1 dns.go:174] Waiting for services and endpoints to be initialized from apiserver...
F0803 04:19:07.896742       1 dns.go:168] Timeout waiting for initialization

@pennpeng Did you fix this issue? If so, how? I'm having the same problem.

I hit same issue. Maybe caused by iptables rules. The "<IP_ADDRESS>" ip is kubernetes cluster ip address.

I am trying to fix this.

iptables flush  work for me
just run this command $iptables flush
and delete that dns pod
thanks @SStar1314