[Bug]: Unable to spinup a new cluster with a basic kube.tf

Description
Hello, I'm unable to spin up a fresh cluster.
I already use k3s on some local servers (1 node), and it works great in minutes.
I've tried entry-level VMs from hetzner (both cpx11 and cax11), could this be the culprit ?
The idea was a 3 nodes control plane and 2 nodes for the workers
I'm trying this project for the first time and I've followed the repo instructions. Terraform version 1.7.4, packer version 1.9.4
Terraform returns timeout errors; I tried to recreate the project from scratch multiple times, and I've also tried to tweak the version in kube.tf
module.kube-hetzner.null_resource.agents["0-0-agent-cax11-Falk"]: Still creating... [14m0s elapsed]
module.kube-hetzner.null_resource.agents["0-0-agent-cax11-Falk"]: Still creating... [14m10s elapsed]
module.kube-hetzner.null_resource.agents["0-0-agent-cax11-Falk"]: Still creating... [14m20s elapsed]
module.kube-hetzner.null_resource.agents["0-0-agent-cax11-Falk"]: Still creating... [14m30s elapsed]
╷
│ Error: remote-exec provisioner error
│
│   with module.kube-hetzner.null_resource.agents["1-0-agent-cax11-Nurem"],
│   on .terraform/modules/kube-hetzner/agents.tf line 108, in resource "null_resource" "agents":
│  108:   provisioner "remote-exec" {
│
│ error executing "/tmp/terraform_1884041684.sh": Process exited with status 124
╵
╷
│ Error: remote-exec provisioner error
│
│   with module.kube-hetzner.null_resource.agents["0-0-agent-cax11-Falk"],
│   on .terraform/modules/kube-hetzner/agents.tf line 108, in resource "null_resource" "agents":
│  108:   provisioner "remote-exec" {
│
│ error executing "/tmp/terraform_730851596.sh": Process exited with status 124
╵
╷
│ Error: remote-exec provisioner error
│
│   with module.kube-hetzner.null_resource.kustomization,
│   on .terraform/modules/kube-hetzner/init.tf line 279, in resource "null_resource" "kustomization":
│  279:   provisioner "remote-exec" {
│
│ error executing "/tmp/terraform_1994718852.sh": Process exited with status 1

I tried to ssh into the instances to debug a little bit:
instance1 and instance2, both files have the same content (with different names):
**k3s-agent-cax11-Nurem-twe:/tmp # cat /tmp/terraform_1884041684.sh**
#!/bin/sh
systemctl start k3s-agent 2> /dev/null
timeout 120 bash <<EOF
  until systemctl status k3s-agent > /dev/null; do
    systemctl start k3s-agent 2> /dev/null
    echo "Waiting for the k3s agent to start..."
    sleep 2
  done
EOF

systemctl status k3s-agent
k3s-agent-cax11-Nurem-twe:/tmp # systemctl status k3s-agent
● k3s-agent.service - Lightweight Kubernetes
     Loaded: loaded (/etc/systemd/system/k3s-agent.service; enabled; preset: disabled)
     Active: activating (start) since Mon 2024-02-26 23:26:49 UTC; 52s ago
       Docs: https://k3s.io
    Process: 12886 ExecStartPre=/bin/sh -xc ! /usr/bin/systemctl is-enabled --quiet nm-cloud-setup.service 2>/dev/null (code=exited, status=0/SUCCESS)
    Process: 12888 ExecStartPre=/sbin/modprobe br_netfilter (code=exited, status=0/SUCCESS)
    Process: 12891 ExecStartPre=/sbin/modprobe overlay (code=exited, status=0/SUCCESS)
   Main PID: 12893 (k3s-agent)
      Tasks: 18
        CPU: 1.253s
     CGroup: /system.slice/k3s-agent.service
             ├─12893 "/usr/local/bin/k3s agent"
             └─12905 "containerd "

Logs from journalctl -u k3s-agent
node1
Feb 26 23:28:39 k3s-agent-cax11-Nurem-twe k3s[13085]: I0226 23:28:39.982925   13085 iptables.go:283] bootstrap done
Feb 26 23:28:39 k3s-agent-cax11-Nurem-twe k3s[13085]: I0226 23:28:39.985231   13085 iptables.go:283] bootstrap done
Feb 26 23:29:24 k3s-agent-cax11-Nurem-twe k3s[13085]: time="2024-02-26T23:29:24Z" level=error msg="Remotedialer proxy error" error="websocket: close 1006 (abnormal closure): unexpected EOF"
Feb 26 23:29:29 k3s-agent-cax11-Nurem-twe k3s[13085]: time="2024-02-26T23:29:29Z" level=info msg="Connecting to proxy" url="wss://<IP_ADDRESS>:6443/v1-k3s/connect"
Feb 26 23:29:29 k3s-agent-cax11-Nurem-twe k3s[13085]: time="2024-02-26T23:29:29Z" level=error msg="Failed to connect to proxy. Empty dialer response" error="dial tcp <IP_ADDRESS>:6443: connect: connection refused"
Feb 26 23:29:29 k3s-agent-cax11-Nurem-twe k3s[13085]: time="2024-02-26T23:29:29Z" level=error msg="Remotedialer proxy error" error="dial tcp <IP_ADDRESS>:6443: connect: connection refused"
Feb 26 23:29:34 k3s-agent-cax11-Nurem-twe k3s[13085]: time="2024-02-26T23:29:34Z" level=info msg="Connecting to proxy" url="wss://<IP_ADDRESS>:6443/v1-k3s/connect"
Feb 26 23:29:38 k3s-agent-cax11-Nurem-twe k3s[13085]: time="2024-02-26T23:29:38Z" level=error msg="Error getting the node object: etcdserver: leader changed"
Feb 26 23:29:38 k3s-agent-cax11-Nurem-twe k3s[13085]: time="2024-02-26T23:29:38Z" level=fatal msg="etcdserver: leader changed"
Feb 26 23:29:38 k3s-agent-cax11-Nurem-twe systemd[1]: k3s-agent.service: Main process exited, code=exited, status=1/FAILURE
Feb 26 23:29:38 k3s-agent-cax11-Nurem-twe systemd[1]: k3s-agent.service: Failed with result 'exit-code'.
Feb 26 23:29:38 k3s-agent-cax11-Nurem-twe systemd[1]: Failed to start Lightweight Kubernetes.
Feb 26 23:29:38 k3s-agent-cax11-Nurem-twe systemd[1]: k3s-agent.service: Consumed 1.787s CPU time.
Feb 26 23:29:43 k3s-agent-cax11-Nurem-twe systemd[1]: k3s-agent.service: Scheduled restart job, restart counter is at 42.

node2 logs
Feb 26 23:32:01 k3s-agent-cax11-Falk-usw k3s[12647]: time="2024-02-26T23:32:01Z" level=error msg="Remotedialer proxy error" error="websocket: close 1006 (abnormal closure): unexpected EOF"
Feb 26 23:32:01 k3s-agent-cax11-Falk-usw k3s[12647]: E0226 23:32:01.662017   12647 controller.go:193] "Failed to update lease" err="Put \"https://<IP_ADDRESS>:6444/apis/coordination.k8s.io/v1/namespaces/kube-node-lease/leases/k3s-agent-cax11-falk-usw?timeout=10s\": read tcp <IP_ADDRESS>:52016->127.>
Feb 26 23:32:01 k3s-agent-cax11-Falk-usw k3s[12647]: E0226 23:32:01.663221   12647 controller.go:193] "Failed to update lease" err="Put \"https://<IP_ADDRESS>:6444/apis/coordination.k8s.io/v1/namespaces/kube-node-lease/leases/k3s-agent-cax11-falk-usw?timeout=10s\": read tcp <IP_ADDRESS>:52022->127.>
Feb 26 23:32:01 k3s-agent-cax11-Falk-usw k3s[12647]: E0226 23:32:01.664213   12647 controller.go:193] "Failed to update lease" err="Put \"https://<IP_ADDRESS>:6444/apis/coordination.k8s.io/v1/namespaces/kube-node-lease/leases/k3s-agent-cax11-falk-usw?timeout=10s\": read tcp <IP_ADDRESS>:52032->127.>
Feb 26 23:32:01 k3s-agent-cax11-Falk-usw k3s[12647]: E0226 23:32:01.665802   12647 controller.go:193] "Failed to update lease" err="Put \"https://<IP_ADDRESS>:6444/apis/coordination.k8s.io/v1/namespaces/kube-node-lease/leases/k3s-agent-cax11-falk-usw?timeout=10s\": read tcp <IP_ADDRESS>:52040->127.>
Feb 26 23:32:01 k3s-agent-cax11-Falk-usw k3s[12647]: E0226 23:32:01.666678   12647 controller.go:193] "Failed to update lease" err="Put \"https://<IP_ADDRESS>:6444/apis/coordination.k8s.io/v1/namespaces/kube-node-lease/leases/k3s-agent-cax11-falk-usw?timeout=10s\": read tcp <IP_ADDRESS>:52046->127.>
Feb 26 23:32:01 k3s-agent-cax11-Falk-usw k3s[12647]: I0226 23:32:01.666713   12647 controller.go:116] "failed to update lease using latest lease, fallback to ensure lease" err="failed 5 attempts to update lease"
Feb 26 23:32:06 k3s-agent-cax11-Falk-usw k3s[12647]: time="2024-02-26T23:32:06Z" level=info msg="Connecting to proxy" url="wss://<IP_ADDRESS>:6443/v1-k3s/connect"
Feb 26 23:32:06 k3s-agent-cax11-Falk-usw k3s[12647]: time="2024-02-26T23:32:06Z" level=error msg="Failed to connect to proxy. Empty dialer response" error="dial tcp <IP_ADDRESS>:6443: connect: connection refused"
Feb 26 23:32:06 k3s-agent-cax11-Falk-usw k3s[12647]: time="2024-02-26T23:32:06Z" level=error msg="Remotedialer proxy error" error="dial tcp <IP_ADDRESS>:6443: connect: connection refused"
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw k3s[12647]: E0226 23:32:07.464787   12647 reflector.go:147] k8s.io/client-go@v1.28.6-k3s1/tools/cache/reflector.go:229: Failed to watch *v1.CSIDriver: the server is currently unable to handle the request (get csidrivers.storage.k8s.io) - error from a p>
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw k3s[12647]: E0226 23:32:07.464933   12647 reflector.go:147] k8s.io/client-go@v1.28.6-k3s1/tools/cache/reflector.go:229: Failed to watch *v1.Node: the server is currently unable to handle the request (get nodes) - error from a previous attempt: read tcp>
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw k3s[12647]: E0226 23:32:07.464986   12647 reflector.go:147] k8s.io/client-go@v1.28.6-k3s1/tools/cache/reflector.go:229: Failed to watch *v1.Node: the server is currently unable to handle the request (get nodes) - error from a previous attempt: read tcp>
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw k3s[12647]: E0226 23:32:07.465414   12647 reflector.go:147] k8s.io/client-go@v1.28.6-k3s1/tools/cache/reflector.go:229: Failed to watch *v1.RuntimeClass: the server is currently unable to handle the request (get runtimeclasses.node.k8s.io) - error from>
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw k3s[12647]: E0226 23:32:07.465451   12647 reflector.go:147] object-"kube-system"/"kube-root-ca.crt": Failed to watch *v1.ConfigMap: the server is currently unable to handle the request (get configmaps) - error from a previous attempt: read tcp 127.0.0.>
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw k3s[12647]: E0226 23:32:07.465472   12647 reflector.go:147] k8s.io/client-go@v1.28.6-k3s1/tools/cache/reflector.go:229: Failed to watch *v1.Service: the server is currently unable to handle the request (get services) - error from a previous attempt: re>
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw k3s[12647]: E0226 23:32:07.465506   12647 reflector.go:147] k8s.io/client-go@v1.28.6-k3s1/tools/cache/reflector.go:229: Failed to watch *v1.Pod: the server is currently unable to handle the request (get pods) - error from a previous attempt: read tcp 1>
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw k3s[12647]: E0226 23:32:07.466622   12647 reflector.go:147] k8s.io/client-go@v1.28.6-k3s1/tools/cache/reflector.go:229: Failed to watch *v1.Endpoints: the server is currently unable to handle the request (get endpoints) - error from a previous attempt:>
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw k3s[12647]: E0226 23:32:07.466783   12647 reflector.go:147] k8s.io/client-go@v1.28.6-k3s1/tools/cache/reflector.go:229: Failed to watch *v1.Node: the server is currently unable to handle the request (get nodes) - error from a previous attempt: read tcp>
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw k3s[12647]: E0226 23:32:07.466882   12647 reflector.go:147] k8s.io/client-go@v1.28.6-k3s1/tools/cache/reflector.go:229: Failed to watch *v1.EndpointSlice: the server is currently unable to handle the request (get endpointslices.discovery.k8s.io) - erro>
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw k3s[12647]: E0226 23:32:07.466956   12647 reflector.go:147] k8s.io/client-go@v1.28.6-k3s1/tools/cache/reflector.go:229: Failed to watch *v1.Service: the server is currently unable to handle the request (get services) - error from a previous attempt: re>
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw k3s[12647]: E0226 23:32:07.707289   12647 controller.go:146] "Failed to ensure lease exists, will retry" err="apiserver not ready" interval="200ms"
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw k3s[12647]: time="2024-02-26T23:32:07Z" level=error msg="Error getting the node object: apiserver not ready"
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw k3s[12647]: time="2024-02-26T23:32:07Z" level=fatal msg="apiserver not ready"
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw systemd[1]: k3s-agent.service: Main process exited, code=exited, status=1/FAILURE
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw systemd[1]: k3s-agent.service: Failed with result 'exit-code'.
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw systemd[1]: k3s-agent.service: Unit process 2661 (containerd-shim) remains running after unit stopped.
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw systemd[1]: Failed to start Lightweight Kubernetes.
Feb 26 23:32:07 k3s-agent-cax11-Falk-usw systemd[1]: k3s-agent.service: Consumed 2.179s CPU time.
Feb 26 23:32:12 k3s-agent-cax11-Falk-usw systemd[1]: k3s-agent.service: Scheduled restart job, restart counter is at 42.

Can you please provide a solution for the above or a working kube.tf as of the latest release ?
Thank you
Roberto Sebastiano
Kube.tf file
locals {
  # You have the choice of setting your Hetzner API token here or define the TF_VAR_hcloud_token env
  # within your shell, such as: export TF_VAR_hcloud_token=xxxxxxxxxxx
  # If you choose to define it in the shell, this can be left as is.

  # Your Hetzner token can be found in your Project > Security > API Token (Read & Write is required).
  hcloud_token = "abcabc"
}

module "kube-hetzner" {
  providers = {
    hcloud = hcloud
  }
  hcloud_token = var.hcloud_token != "" ? var.hcloud_token : local.hcloud_token

  # Then fill or edit the below values. Only the first values starting with a * are obligatory; the rest can remain with their default values, or you
  # could adapt them to your needs.

  # * For local dev, path to the git repo
  # source = "../../kube-hetzner/"
  # If you want to use the latest master branch
  # source = "github.com/kube-hetzner/terraform-hcloud-kube-hetzner"
  # For normal use, this is the path to the terraform registry
  source = "kube-hetzner/kube-hetzner/hcloud"

  # You can optionally specify a version number
  version = "2.12.2"

  # Note that some values, notably "location" and "public_key" have no effect after initializing the cluster.
  # This is to keep Terraform from re-provisioning all nodes at once, which would lose data. If you want to update
  # those, you should instead change the value here and manually re-provision each node. Grep for "lifecycle".

  # Customize the SSH port (by default 22)
  # ssh_port = 2222

  # * Your ssh public key
  ssh_public_key = file("~/.ssh/hetzner_test_ed25519.pub")
  # * Your private key must be "ssh_private_key = null" when you want to use ssh-agent for a Yubikey-like device authentication or an SSH key-pair with a passphrase.
  # For more details on SSH see https://github.com/kube-hetzner/kube-hetzner/blob/master/docs/ssh.md
  ssh_private_key = file("~/.ssh/hetzner_test_ed25519")
  # You can add additional SSH public Keys to grant other team members root access to your cluster nodes.
  # ssh_additional_public_keys = []

  # You can also add additional SSH public Keys which are saved in the hetzner cloud by a label.
  # See https://docs.hetzner.cloud/#label-selector
  # ssh_hcloud_key_label = "role=admin"

  # If you use SSH agent and have issues with SSH connecting to your nodes, you can increase the number of auth tries (default is 2)
  # ssh_max_auth_tries = 10

  # If you want to use an ssh key that is already registered within hetzner cloud, you can pass its id.
  # If no id is passed, a new ssh key will be registered within hetzner cloud.
  # It is important that exactly this key is passed via `ssh_public_key` & `ssh_private_key` variables.
  # hcloud_ssh_key_id = ""

  # These can be customized, or left with the default values
  # * For Hetzner locations see https://docs.hetzner.com/general/others/data-centers-and-connection/
  network_region = "eu-central" # change to `us-east` if location is ash

  # If you want to create the private network before calling this module,
  # you can do so and pass its id here. For example if you want to use a proxy
  # which only listens on your private network. Advanced use case.
  #
  # NOTE1: make sure to adapt network_ipv4_cidr, cluster_ipv4_cidr, and service_ipv4_cidr accordingly.
  #        If your network is created with <IP_ADDRESS>/8, and you use subnet <IP_ADDRESS>/9 for your
  #        non-k3s business, then adapting `network_ipv4_cidr = "<IP_ADDRESS>/9"` should be all you need.
  #
  # NOTE2: square brackets! This must be a list of length 1.
  #
  # existing_network_id = [hcloud_network.your_network.id]

  # If you must change the network CIDR you can do so below, but it is highly advised against.
  # network_ipv4_cidr = "<IP_ADDRESS>/8"

  # Using the default configuration you can only create a maximum of 42 agent-nodepools.
  # This is due to the creation of a subnet for each nodepool with CIDRs being in the shape of 10.[nodepool-index].0.0/16 which collides with k3s' cluster and service IP ranges (defaults below).
  # Furthermore the maximum number of nodepools (controlplane and agent) is 50, due to a hard limit of 50 subnets per network, see https://docs.hetzner.com/cloud/networks/faq/.
  # So to be able to create a maximum of 50 nodepools in total, the values below have to be changed to something outside that range, e.g. `<IP_ADDRESS>/16` and `<IP_ADDRESS>/16` for cluster and service respectively.

  # If you must change the cluster CIDR you can do so below, but it is highly advised against.
  # Never change this value after you already initialized a cluster. Complete cluster redeploy needed!
  # The cluster CIDR must be a part of the network CIDR!
  # cluster_ipv4_cidr = "<IP_ADDRESS>/16"

  # If you must change the service CIDR you can do so below, but it is highly advised against.
  # Never change this value after you already initialized a cluster. Complete cluster redeploy needed!
  # The service CIDR must be a part of the network CIDR!
  # service_ipv4_cidr = "<IP_ADDRESS>/16"

  # If you must change the service IPv4 address of core-dns you can do so below, but it is highly advisd against.
  # Never change this value after you already initialized a cluster. Complete cluster redeploy needed!
  # The service IPv4 address must be part of the service CIDR!
  # cluster_dns_ipv4 = "<IP_ADDRESS>"

  # For the control planes, at least three nodes are the minimum for HA. Otherwise, you need to turn off the automatic upgrades (see README).
  # **It must always be an ODD number, never even!** Search the internet for "split-brain problem with etcd" or see https://rancher.com/docs/k3s/latest/en/installation/ha-embedded/
  # For instance, one is ok (non-HA), two is not ok, and three is ok (becomes HA). It does not matter if they are in the same nodepool or not! So they can be in different locations and of various types.

  # Of course, you can choose any number of nodepools you want, with the location you want. The only constraint on the location is that you need to stay in the same network region, Europe, or the US.
  # For the server type, the minimum instance supported is cpx11 (just a few cents more than cx11) but the cax11 is even cheaper and more powerful (arm64); see https://www.hetzner.com/cloud.

  # IMPORTANT: Before you create your cluster, you can do anything you want with the nodepools, but you need at least one of each, control plane and agent.
  # Once the cluster is up and running, you can change nodepool count and even set it to 0 (in the case of the first control-plane nodepool, the minimum is 1).
  # You can also rename it (if the count is 0), but do not remove a nodepool from the list.

  # You can safely add or remove nodepools at the end of each list. That is due to how subnets and IPs get allocated (FILO).
  # The maximum number of nodepools you can create combined for both lists is 50 (see above).
  # Also, before decreasing the count of any nodepools to 0, it's essential to drain and cordon the nodes in question. Otherwise, it will leave your cluster in a bad state.

  # Before initializing the cluster, you can change all parameters and add or remove any nodepools. You need at least one nodepool of each kind, control plane, and agent.
  # The nodepool names are entirely arbitrary, you can choose whatever you want, but no special characters or underscore, and they must be unique; only alphanumeric characters and dashes are allowed.

  # If you want to have a single node cluster, have one control plane nodepools with a count of 1, and one agent nodepool with a count of 0.

  # Please note that changing labels and taints after the first run will have no effect. If needed, you can do that through Kubernetes directly.

  # Multi-architecture clusters are OK for most use cases, as container underlying images tend to be multi-architecture too.

  # * Example below:

  control_plane_nodepools = [
    {
      name        = "control-plane-1-Nurem",
      server_type = "cax11",
      location    = "nbg1",
      labels      = [],
      taints      = [],
      count       = 1
      # swap_size   = "2G" # remember to add the suffix, examples: 512M, 1G
      # zram_size   = "2G" # remember to add the suffix, examples: 512M, 1G
      # kubelet_args = ["kube-reserved=cpu=250m,memory=1500Mi,ephemeral-storage=1Gi", "system-reserved=cpu=250m,memory=300Mi"]

      # Fine-grained control over placement groups (nodes in the same group are spread over different physical servers):
      # placement_group = "default"

      # Enable automatic backups via Hetzner (default: false)
      # backups = true
    },
    {
      name        = "control-plane-2-Nurem",
      server_type = "cax11",
      location    = "nbg1",
      labels      = [],
      taints      = [],
      count       = 1

      # Fine-grained control over placement groups (nodes in the same group are spread over different physical servers):
      # placement_group = "default"

      # Enable automatic backups via Hetzner (default: false)
      # backups = true
    },
    {
      name        = "control-plane-3-Falk",
      server_type = "cax11",
      location    = "fsn1",
      labels      = [],
      taints      = [],
      count       = 1

      # Fine-grained control over placement groups (nodes in the same group are spread over different physical servers):
      # placement_group = "default"

      # Enable automatic backups via Hetzner (default: false)
      # backups = true
    }
  ]

  agent_nodepools = [
    {
      name        = "agent-cax11-Falk",
      server_type = "cax11",
      location    = "fsn1",
      labels      = [],
      taints      = [],
      count       = 1
      # swap_size   = "2G" # remember to add the suffix, examples: 512M, 1G
      # zram_size   = "2G" # remember to add the suffix, examples: 512M, 1G
      # kubelet_args = ["kube-reserved=cpu=50m,memory=300Mi,ephemeral-storage=1Gi", "system-reserved=cpu=250m,memory=300Mi"]

      # Fine-grained control over placement groups (nodes in the same group are spread over different physical servers):
      # placement_group = "default"

      # Enable automatic backups via Hetzner (default: false)
      # backups = true
    },
    {
      name        = "agent-cax11-Nurem",
      server_type = "cax11",
      location    = "nbg1",
      labels      = [],
      taints      = [],
      count       = 1

      # Fine-grained control over placement groups (nodes in the same group are spread over different physical servers):
      # placement_group = "default"

      # Enable automatic backups via Hetzner (default: false)
      # backups = true
    },
    /* {
      name        = "storage",
      server_type = "cpx21",
      location    = "fsn1",
      # Fully optional, just a demo.
      labels      = [
        "node.kubernetes.io/server-usage=storage"
      ],
      taints      = [],
      count       = 1

      # In the case of using Longhorn, you can use Hetzner volumes instead of using the node's own storage by specifying a value from 10 to 10000 (in GB)
      # It will create one volume per node in the nodepool, and configure Longhorn to use them.
      # Something worth noting is that Volume storage is slower than node storage, which is achieved by not mentioning longhorn_volume_size or setting it to 0.
      # So for something like DBs, you definitely want node storage, for other things like backups, volume storage is fine, and cheaper.
      # longhorn_volume_size = 20

      # Enable automatic backups via Hetzner (default: false)
      # backups = true
    }, */
    # Egress nodepool useful to route egress traffic using Hetzner Floating IPs (https://docs.hetzner.com/cloud/floating-ips)
    # used with Cilium's Egress Gateway feature https://docs.cilium.io/en/stable/gettingstarted/egress-gateway/
    # See the https://github.com/kube-hetzner/terraform-hcloud-kube-hetzner#examples for an example use case.
    /* {
      name        = "egress",
      server_type = "cx21",
      location    = "fsn1",
      labels = [
        "node.kubernetes.io/role=egress"
      ],
      taints = [
        "node.kubernetes.io/role=egress:NoSchedule"
      ],
      floating_ip = true
      count = 1
    },
    # Arm based nodes
    {
      name        = "agent-arm-small",
      server_type = "cax11",
      location    = "fsn1",
      labels      = [],
      taints      = [],
      count       = 1
    } */
  ]
  # Add custom control plane configuration options here.
  # E.g to enable monitoring for etcd, proxy etc:
  # control_planes_custom_config = {
  #  etcd-expose-metrics = true,
  #  kube-controller-manager-arg = "bind-address=<IP_ADDRESS>",
  #  kube-proxy-arg ="metrics-bind-address=<IP_ADDRESS>",
  #  kube-scheduler-arg = "bind-address=<IP_ADDRESS>",
  # }

  # You can enable encrypted wireguard for the CNI by setting this to "true". Default is "false".
  # FYI, Hetzner says "Traffic between cloud servers inside a Network is private and isolated, but not automatically encrypted."
  # Source: https://docs.hetzner.com/cloud/networks/faq/#is-traffic-inside-hetzner-cloud-networks-encrypted
  # It works with all CNIs that we support.
  # Just note, that if Cilium with cilium_values, the responsibility of enabling of disabling Wireguard falls on you.
  # enable_wireguard = true

  # * LB location and type, the latter will depend on how much load you want it to handle, see https://www.hetzner.com/cloud/load-balancer
  load_balancer_type     = "lb11"
  load_balancer_location = "nbg1"

  # Disable IPv6 for the load balancer, the default is false.
  #load_balancer_disable_ipv6 = true

  # Disables the public network of the load balancer. (default: false).
  # load_balancer_disable_public_network = true

  # Specifies the algorithm type of the load balancer. (default: round_robin).
  # load_balancer_algorithm_type = "least_connections"

  # Specifies the interval at which a health check is performed. Minimum is 3s (default: 15s).
  # load_balancer_health_check_interval = "15s"

  # Specifies the timeout of a single health check. Must not be greater than the health check interval. Minimum is 1s (default: 10s).
  # load_balancer_health_check_timeout = "10s"

  # Specifies the number of times a health check is retried before a target is marked as unhealthy. (default: 3)
  # load_balancer_health_check_retries = 3

  ### The following values are entirely optional (and can be removed from this if unused)

  # You can refine a base domain name to be use in this form of nodename.base_domain for setting the reserve dns inside Hetzner
  # base_domain = "test.excelleratedbooks.kube"

  # Cluster Autoscaler
  # Providing at least one map for the array enables the cluster autoscaler feature, default is disabled
  # By default we set a compatible version with the default initial_k3s_channel, to set another one,
  # have a look at the tag value in https://github.com/kubernetes/autoscaler/blob/master/charts/cluster-autoscaler/values.yaml
  # ⚠ Based on how the autoscaler works with this project, you can only choose either x86 instances or ARM server types for ALL autoscaler nodepools.
  # If you are curious, it's ok to have a multi-architecture cluster, as most underlying container images are multi-architecture too.
  #
  # ⚠ Setting labels and taints will only work on cluster-autoscaler images versions released after > 20 October 2023. Or images built from master after that date.
  #
  # * Example below:
  # autoscaler_nodepools = [
  #   {
  #     name        = "autoscaled-small"
  #     server_type = "cpx21"
  #     location    = "fsn1"
  #     min_nodes   = 0
  #     max_nodes   = 5
  #     labels      = {
  #       "node.kubernetes.io/role": "peak-workloads"
  #     }
  #     taints      =
  #     [{
  #        key: "node.kubernetes.io/role"
  #        value: "peak-workloads"
  #        effect: "NoExecute"
  #     }]
  #   }
  # ]

  # ⚠ Deprecated, will be removed after a new Cluster Autoscaler version has been released which support the new way of setting labels and taints. See above.
  # Add extra labels on nodes started by the Cluster Autoscaler
  # This argument is not used if autoscaler_nodepools is not set, because the Cluster Autoscaler is installed only if autoscaler_nodepools is set
  # autoscaler_labels = [
  #   "node.kubernetes.io/role=peak-workloads"
  # ]

  # Add extra taints on nodes started by the Cluster Autoscaler
  # This argument is not used if autoscaler_nodepools is not set, because the Cluster Autoscaler is installed only if autoscaler_nodepools is set
  # autoscaler_taints = [
  #   "node.kubernetes.io/role=specific-workloads:NoExecute"
  # ]

  # Configuration of the Cluster Autoscaler binary
  #
  # These arguments and variables are not used if autoscaler_nodepools is not set, because the Cluster Autoscaler is installed only if autoscaler_nodepools is set.
  #
  # Image and version of Kubernetes Cluster Autoscaler for Hetzner Cloud:
  #   - cluster_autoscaler_image: Image of Kubernetes Cluster Autoscaler for Hetzner Cloud to be used.
  #   - cluster_autoscaler_version: Version of Kubernetes Cluster Autoscaler for Hetzner Cloud. Should be aligned with Kubernetes version.
  #
  # Logging related arguments are managed using separate variables:
  #   - cluster_autoscaler_log_level: Controls the verbosity of logs (--v), the value is from 0 to 5, default is 4, for max debug info set it to 5.
  #   - cluster_autoscaler_log_to_stderr: Determines whether to log to stderr (--logtostderr).
  #   - cluster_autoscaler_stderr_threshold: Sets the threshold for logs that go to stderr (--stderrthreshold).
  #
  # Example (using the default values):
  #
  # cluster_autoscaler_image = "registry.k8s.io/autoscaling/cluster-autoscaler"
  # cluster_autoscaler_version = "v1.27.3"
  # cluster_autoscaler_log_level = 4
  # cluster_autoscaler_log_to_stderr = true
  # cluster_autoscaler_stderr_threshold = "INFO"

  # Additional Cluster Autoscaler binary configuration
  #
  # cluster_autoscaler_extra_args can be used for additional arguments. The default is an empty array.
  #
  # Please note that following arguments are managed by terraform-hcloud-kube-hetzner or the variables above and should not be set manually:
  #   - --v=${var.cluster_autoscaler_log_level}
  #   - --logtostderr=${var.cluster_autoscaler_log_to_stderr}
  #   - --stderrthreshold=${var.cluster_autoscaler_stderr_threshold}
  #   - --cloud-provider=hetzner
  #   - --nodes ...
  #
  # See the Cluster Autoscaler FAQ for the full list of arguments: https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#what-are-the-parameters-to-ca
  #
  # Example:
  #
  # cluster_autoscaler_extra_args = [
  #   "--ignore-daemonsets-utilization=true",
  #   "--enforce-node-group-min-size=true",
  # ]

  # Enable etcd snapshot backups to S3 storage.
  # Just provide a map with the needed settings (according to your S3 storage provider) and backups to S3 will
  # be enabled (with the default settings for etcd snapshots).
  # Cloudflare's R2 offers 10GB, 10 million reads and 1 million writes per month for free.
  # For proper context, have a look at https://docs.k3s.io/datastore/backup-restore.
  # etcd_s3_backup = {
  #   etcd-s3-endpoint        = "xxxx.r2.cloudflarestorage.com"
  #   etcd-s3-access-key      = "<access-key>"
  #   etcd-s3-secret-key      = "<secret-key>"
  #   etcd-s3-bucket          = "k3s-etcd-snapshots"
  # }

  # To enable Hetzner Storage Box support, you can enable csi-driver-smb, default is "false".
  # enable_csi_driver_smb = true

  # To enable iscid without setting enable_longhorn = true, set enable_iscsid = true. You will need this if
  # you install your own version of longhorn outside of this module.
  # Default is false. If enable_longhorn=true, this variable is ignored and iscsid is enabled anyway.
  # enable_iscsid = true

  # To use local storage on the nodes, you can enable Longhorn, default is "false".
  # See a full recap on how to configure agent nodepools for longhorn here https://github.com/kube-hetzner/terraform-hcloud-kube-hetzner/discussions/373#discussioncomment-3983159
  # Also see Longhorn best practices here https://gist.github.com/ifeulner/d311b2868f6c00e649f33a72166c2e5b
  # enable_longhorn = true

  # By default, longhorn is pulled from https://charts.longhorn.io.
  # If you need a version of longhorn which assures compatibility with rancher you can set this variable to https://charts.rancher.io.
  # longhorn_repository = "https://charts.rancher.io"

  # The namespace for longhorn deployment, default is "longhorn-system".
  # longhorn_namespace = "longhorn-system"

  # The file system type for Longhorn, if enabled (ext4 is the default, otherwise you can choose xfs).
  # longhorn_fstype = "xfs"

  # how many replica volumes should longhorn create (default is 3).
  # longhorn_replica_count = 1

  # When you enable Longhorn, you can go with the default settings and just modify the above two variables OR you can add a longhorn_values variable
  # with all needed helm values, see towards the end of the file in the advanced section.
  # If that file is present, the system will use it during the deploy, if not it will use the default values with the two variable above that can be customized.
  # After the cluster is deployed, you can always use HelmChartConfig definition to tweak the configuration.

  # Also, you can choose to use a Hetzner volume with Longhorn. By default, it will use the nodes own storage space, but if you add an attribute of
  # longhorn_volume_size (⚠ not a variable, just a possible agent nodepool attribute) with a value between 10 and 10000 GB to your agent nodepool definition, it will create and use the volume in question.
  # See the agent nodepool section for an example of how to do that.

  # To disable Hetzner CSI storage, you can set the following to "true", default is "false".
  # disable_hetzner_csi = true

  # If you want to use a specific Hetzner CCM and CSI version, set them below; otherwise, leave them as-is for the latest versions.
  # hetzner_ccm_version = ""
  # hetzner_csi_version = ""

  # If you want to specify the Kured version, set it below - otherwise it'll use the latest version available.
  # kured_version = ""

  # If you want to enable the Nginx ingress controller (https://kubernetes.github.io/ingress-nginx/) instead of Traefik, you can set this to "nginx". Default is "traefik".
  # By the default we load optimal Traefik and Nginx ingress controller config for Hetzner, however you may need to tweak it to your needs, so to do,
  # we allow you to add a traefik_values and nginx_values, see towards the end of this file in the advanced section.
  # After the cluster is deployed, you can always use HelmChartConfig definition to tweak the configuration.
  # If you want to disable both controllers set this to "none"
  ingress_controller = "none"
  # Namespace in which to deploy the ingress controllers. Defaults to the ingress_controller variable, eg (nginx, traefik)
  #ingress_target_namespace = "nginx-ingress"

  # You can change the number of replicas for selected ingress controller here. The default 0 means autoselecting based on number of agent nodes (1 node = 1 replica, 2 nodes = 2 replicas, 3+ nodes = 3 replicas)
  #ingress_replica_count = 2

  # Use the klipperLB (similar to metalLB), instead of the default Hetzner one, that has an advantage of dropping the cost of the setup.
  # Automatically "true" in the case of single node cluster (as it does not make sense to use the Hetzner LB in that situation).
  # It can work with any ingress controller that you choose to deploy.
  # Please note that because the klipperLB points to all nodes, we automatically allow scheduling on the control plane when it is active.
  # enable_klipper_metal_lb = "true"

  # If you want to configure additional arguments for traefik, enter them here as a list and in the form of traefik CLI arguments; see https://doc.traefik.io/traefik/reference/static-configuration/cli/
  # They are the options that go into the additionalArguments section of the Traefik helm values file.
  # We already add "providers.kubernetesingress.ingressendpoint.publishedservice" by default so that Traefik works automatically with services such as External-DNS and ArgoCD.
  # Example:
  # traefik_additional_options = ["--log.level=DEBUG", "--tracing=true"]

  # By default traefik image tag is an empty string which uses latest image tag.
  # The default is "".
  # traefik_image_tag = "v3.0.0-beta5"

  # By default traefik is configured to redirect http traffic to https, you can set this to "false" to disable the redirection.
  # The default is true.
  # traefik_redirect_to_https = false

  # Enable or disable Horizontal Pod Autoscaler for traefik.
  # The default is true.
  # traefik_autoscaling = false

  # Enable or disable pod disruption budget for traefik. Values are maxUnavailable: 33% and minAvailable: 1.
  # The default is true.
  # traefik_pod_disruption_budget = false

  # Enable or disable default resource requests and limits for traefik. Values requested are 100m & 50Mi and limits 300m & 150Mi.
  # The default is true.
  # traefik_resource_limits = false

  # If you want to configure additional ports for traefik, enter them here as a list of objects with name, port, and exposedPort properties.
  # Example:
  # traefik_additional_ports = [{name = "example", port = 1234, exposedPort = 1234}]

  # If you want to configure additional trusted IPs for traefik, enter them here as a list of IPs (strings).
  # Example for Cloudflare:
  # traefik_additional_trusted_ips = [
  #   "<IP_ADDRESS>/20",
  #   "<IP_ADDRESS>/22",
  #   "<IP_ADDRESS>/22",
  #   "<IP_ADDRESS>/22",
  #   "<IP_ADDRESS>/18",
  #   "<IP_ADDRESS>/18",
  #   "<IP_ADDRESS>/20",
  #   "<IP_ADDRESS>/20",
  #   "<IP_ADDRESS>/22",
  #   "<IP_ADDRESS>/17",
  #   "<IP_ADDRESS>/15",
  #   "<IP_ADDRESS>/13",
  #   "<IP_ADDRESS>/14",
  #   "<IP_ADDRESS>/13",
  #   "<IP_ADDRESS>/22",
  #   "2400:cb00::/32",
  #   "2606:4700::/32",
  #   "2803:f800::/32",
  #   "2405:b500::/32",
  #   "2405:8100::/32",
  #   "2a06:98c0::/29",
  #   "2c0f:f248::/32"
  # ]

  # If you want to disable the metric server set this to "false". Default is "true".
  # enable_metrics_server = false

  # If you want to enable the k3s built-in local-storage controller set this to "true". Default is "false".
  # enable_local_storage = false

  # If you want to allow non-control-plane workloads to run on the control-plane nodes, set this to "true". The default is "false".
  # True by default for single node clusters, and when enable_klipper_metal_lb is true. In those cases, the value below will be ignored.
  # allow_scheduling_on_control_plane = true

  # If you want to disable the automatic upgrade of k3s, you can set below to "false".
  # Ideally, keep it on, to always have the latest Kubernetes version, but lock the initial_k3s_channel to a kube major version,
  # of your choice, like v1.25 or v1.26. That way you get the best of both worlds without the breaking changes risk.
  # For production use, always use an HA setup with at least 3 control-plane nodes and 2 agents, and keep this on for maximum security.

  # The default is "true" (in HA setup i.e. at least 3 control plane nodes & 2 agents, just keep it enabled since it works flawlessly).
  # automatically_upgrade_k3s = false

  # The default is "true" (in HA setup it works wonderfully well, with automatic roll-back to the previous snapshot in case of an issue).
  # IMPORTANT! For non-HA clusters i.e. when the number of control-plane nodes is < 3, you have to turn it off.
  # automatically_upgrade_os = false

  # If you need more control over kured and the reboot behaviour, you can pass additional options to kured.
  # For example limiting reboots to certain timeframes. For all options see: https://kured.dev/docs/configuration/
  # By default, the kured lock does not expire and is only released once a node successfully reboots. You can add the option
  # "lock-ttl" : "30m", if you have a single node which sometimes gets stuck. Note however, that in that case, kured continuous
  # draining the next node because the lock was released. You may end up with all nodes drained and your cluster completely down.
  # The default options are: `--reboot-command=/usr/bin/systemctl reboot --pre-reboot-node-labels=kured=rebooting --post-reboot-node-labels=kured=done --period=5m`
  # Defaults can be overridden by using the same key.
  # kured_options = {
  #   "reboot-days": "su",
  #   "start-time": "3am",
  #   "end-time": "8am",
  #   "time-zone": "Local",
  #   "lock-ttl" : "30m",
  # }

  # Allows you to specify either stable, latest, testing or supported minor versions.
  # see https://rancher.com/docs/k3s/latest/en/upgrades/basic/ and https://update.k3s.io/v1-release/channels
  # ⚠ If you are going to use Rancher addons for instance, it's always a good idea to fix the kube version to latest - 0.01,
  # ⚠ Rancher currently only supports v1.25 and earlier versions: https://github.com/rancher/rancher/issues/41113
  # The default is "v1.28".
  # initial_k3s_channel = "stable"

  # The cluster name, by default "k3s"
  # cluster_name = ""

  # Whether to use the cluster name in the node name, in the form of {cluster_name}-{nodepool_name}, the default is "true".
  # use_cluster_name_in_node_name = false

  # Extra k3s registries. This is useful if you have private registries and you want to pull images without additional secrets.
  # Or if you want to proxy registries for various reasons like rate-limiting.
  # It will create the registries.yaml file, more info here https://docs.k3s.io/installation/private-registry.
  # Note that you do not need to get this right from the first time, you can update it when you want during the life of your cluster.
  # The default is blank.
  /* k3s_registries = <<-EOT
    mirrors:
      hub.my_registry.com:
        endpoint:
          - "hub.my_registry.com"
    configs:
      hub.my_registry.com:
        auth:
          username: username
          password: password
  EOT */

  # Additional environment variables for the host OS on which k3s runs. See for example https://docs.k3s.io/advanced#configuring-an-http-proxy .
  # additional_k3s_environment = {
  #   "CONTAINERD_HTTP_PROXY" : "http://your.proxy:port",
  #   "CONTAINERD_HTTPS_PROXY" : "http://your.proxy:port",
  #   "NO_PROXY" : "<IP_ADDRESS>/8,<IP_ADDRESS>/8,",
  # }

  # Additional commands to execute on the host OS before the k3s install, for example fetching and installing certs.
  # preinstall_exec = [
  #   "curl https://somewhere.over.the.rainbow/ca.crt > /root/ca.crt",
  #   "trust anchor --store /root/ca.crt",
  # ]

  # Additional flags to pass to the k3s server command (the control plane).
  # k3s_exec_server_args = "--kube-apiserver-arg enable-admission-plugins=PodTolerationRestriction,PodNodeSelector"

  # Additional flags to pass to the k3s agent command (every agents nodes, including autoscaler nodepools).
  # k3s_exec_agent_args = "--kubelet-arg kube-reserved=cpu=100m,memory=200Mi,ephemeral-storage=1Gi"

  # The vars below here passes it to the k3s config.yaml. This way it persist across reboots
  # k3s_global_kubelet_args = ["kube-reserved=cpu=100m,ephemeral-storage=1Gi", "system-reserved=cpu=memory=200Mi", "image-gc-high-threshold=50", "image-gc-low-threshold=40"]
  # k3s_control_plane_kubelet_args = []
  # k3s_agent_kubelet_args = []

  # If you want to allow all outbound traffic you can set this to "false". Default is "true".
  # restrict_outbound_traffic = false

  # Allow access to the Kube API from the specified networks. The default is ["<IP_ADDRESS>/0", "::/0"].
  # Allowed values: null (disable Kube API rule entirely) or a list of allowed networks with CIDR notation.
  # For maximum security, it's best to disable it completely by setting it to null. However, in that case, to get access to the kube api,
  # you would have to connect to any control plane node via SSH, as you can run kubectl from within these.
  # Please be advised that this setting has no effect on the load balancer when the use_control_plane_lb variable is set to true. This is
  # because firewall rules cannot be applied to load balancers yet.
  # firewall_kube_api_source = null

  # Allow SSH access from the specified networks. Default: ["<IP_ADDRESS>/0", "::/0"]
  # Allowed values: null (disable SSH rule entirely) or a list of allowed networks with CIDR notation.
  # Ideally you would set your IP there. And if it changes after cluster deploy, you can always update this variable and apply again.
  # firewall_ssh_source = ["<IP_ADDRESS>/32"]

  # Adding extra firewall rules, like opening a port
  # More info on the format here https://registry.terraform.io/providers/hetznercloud/hcloud/latest/docs/resources/firewall
  # extra_firewall_rules = [
  #   {
  #     description = "For Postgres"
  #     direction       = "in"
  #     protocol        = "tcp"
  #     port            = "5432"
  #     source_ips      = ["<IP_ADDRESS>/0", "::/0"]
  #     destination_ips = [] # Won't be used for this rule
  #   },
  #   {
  #     description = "To Allow ArgoCD access to resources via SSH"
  #     direction       = "out"
  #     protocol        = "tcp"
  #     port            = "22"
  #     source_ips      = [] # Won't be used for this rule
  #     destination_ips = ["<IP_ADDRESS>/0", "::/0"]
  #   }
  # ]

  # If you want to configure a different CNI for k3s, use this flag
  # possible values: flannel (Default), calico, and cilium
  # As for Cilium, we allow infinite configurations via helm values, please check the CNI section of the readme over at https://github.com/kube-hetzner/terraform-hcloud-kube-hetzner/#cni.
  # Also, see the cilium_values at towards the end of this file, in the advanced section.
  # ⚠ Depending on your setup, sometimes you need your control-planes to have more than
  # 2GB of RAM if you are going to use Cilium, otherwise the pods will not start.
  # cni_plugin = "cilium"

  # You can choose the version of Cilium that you want. By default we keep the version up to date and configure Cilium with compatible settings according to the version.
  # cilium_version = "v1.14.0"

  # Set native-routing mode ("native") or tunneling mode ("tunnel"). Default: tunnel
  # cilium_routing_mode = "native"

  # Used when Cilium is configured in native routing mode. The CNI assumes that the underlying network stack will forward packets to this destination without the need to apply SNAT. Default: value of "cluster_ipv4_cidr"
  # cilium_ipv4_native_routing_cidr = "<IP_ADDRESS>/8"

  # Enables egress gateway to redirect and SNAT the traffic that leaves the cluster. Default: false
  # cilium_egress_gateway_enabled = true

  # You can choose the version of Calico that you want. By default, the latest is used.
  # More info on available versions can be found at https://github.com/projectcalico/calico/releases
  # Please note that if you are getting 403s from Github, it's also useful to set the version manually. However there is rarely a need for that!
  # calico_version = "v3.25.0"

  # If you want to disable the k3s kube-proxy, use this flag. The default is "false".
  # Ensure that your CNI is capable of handling all the functionalities typically covered by kube-proxy.
  # disable_kube_proxy = true

  # If you want to disable the k3s default network policy controller, use this flag!
  # Both Calico and Ciliun cni_plugin values override this value to true automatically, the default is "false".
  # disable_network_policy = true

  # If you want to disable the automatic use of placement group "spread". See https://docs.hetzner.com/cloud/placement-groups/overview/
  # We advise to not touch that setting, unless you have a specific purpose.
  # The default is "false", meaning it's enabled by default.
  # placement_group_disable = true

  # By default, we allow ICMP ping in to the nodes, to check for liveness for instance. If you do not want to allow that, you can. Just set this flag to true (false by default).
  # block_icmp_ping_in = true

  # You can enable cert-manager (installed by Helm behind the scenes) with the following flag, the default is "true".
  # enable_cert_manager = false

  # IP Addresses to use for the DNS Servers, the defaults are the ones provided by Hetzner https://docs.hetzner.com/dns-console/dns/general/recursive-name-servers/.
  # The number of different DNS servers is limited to 3 by Kubernetes itself.
  # It's always a good idea to have at least 1 IPv4 and 1 IPv6 DNS server for robustness.
  dns_servers = [
    "<IP_ADDRESS>",
    "<IP_ADDRESS>",
    "2606:4700:4700::1111",
  ]

  # When this is enabled, rather than the first node, all external traffic will be routed via a control-plane loadbalancer, allowing for high availability.
  # The default is false.
  # use_control_plane_lb = true

  # When the above use_control_plane_lb is enabled, you can change the lb type for it, the default is "lb11".
  # control_plane_lb_type = "lb21"

  # When the above use_control_plane_lb is enabled, you can change to disable the public interface for control plane load balancer, the default is true.
  # control_plane_lb_enable_public_interface = false

  # Let's say you are not using the control plane LB solution above, and still want to have one hostname point to all your control-plane nodes.
  # You could create multiple A records of to let's say cp.cluster.my.org pointing to all of your control-plane nodes ips.
  # In which case, you need to define that hostname in the k3s TLS-SANs config to allow connection through it. It can be hostnames or IP addresses.
  # additional_tls_sans = ["cp.cluster.my.org"]

  # lb_hostname Configuration:
  #
  # Purpose:
  # The lb_hostname setting optimizes communication between services within the Kubernetes cluster
  # when they use domain names instead of direct service names. By associating a domain name directly
  # with the Hetzner Load Balancer, this setting can help reduce potential communication delays.
  #
  # Scenario:
  # If Service B communicates with Service A using a domain (e.g., `a.mycluster.domain.com`) that points
  # to an external Load Balancer, there can be a slowdown in communication.
  #
  # Guidance:
  # - If your internal services use domain names pointing to an external LB, set lb_hostname to a domain
  #   like `mycluster.domain.com`.
  # - Create an A record pointing `mycluster.domain.com` to your LB's IP.
  # - Create a CNAME record for `a.mycluster.domain.com` (or xyz.com) pointing to `mycluster.domain.com`.
  #
  # Technical Note:
  # This setting sets the `load-balancer.hetzner.cloud/hostname` in the Hetzner LB definition, suitable for
  # both Nginx and Traefik ingress controllers.
  #
  # Recommendation:
  # This setting is optional. If services communicate using direct service names, you can leave this unset.
  # For inter-namespace communication, use `.service_name` as per Kubernetes norms.
  #
  # Example:
  # lb_hostname = "mycluster.domain.com"

  # You can enable Rancher (installed by Helm behind the scenes) with the following flag, the default is "false".
  # ⚠ Rancher currently only supports Kubernetes v1.25 and earlier, you will need to set initial_k3s_channel to a supported version: https://github.com/rancher/rancher/issues/41113
  # When Rancher is enabled, it automatically installs cert-manager too, and it uses rancher's own self-signed certificates.
  # See for options https://rancher.com/docs/rancher/v2.0-v2.4/en/installation/resources/advanced/helm2/helm-rancher/#choose-your-ssl-configuration
  # The easiest thing is to leave everything as is (using the default rancher self-signed certificate) and put Cloudflare in front of it.
  # As for the number of replicas, by default it is set to the number of control plane nodes.
  # You can customized all of the above by adding a rancher_values variable see at the end of this file in the advanced section.
  # After the cluster is deployed, you can always use HelmChartConfig definition to tweak the configuration.
  # IMPORTANT: Rancher's install is quite memory intensive, you will require at least 4GB if RAM, meaning cx21 server type (for your control plane).
  # ALSO, in order for Rancher to successfully deploy, you have to set the "rancher_hostname".
  # enable_rancher = true

  # If using Rancher you can set the Rancher hostname, it must be unique hostname even if you do not use it.
  # If not pointing the DNS, you can just port-forward locally via kubectl to get access to the dashboard.
  # If you already set the lb_hostname above and are using a Hetzner LB, you do not need to set this one, as it will be used by default.
  # But if you set this one explicitly, it will have preference over the lb_hostname in rancher settings.
  # rancher_hostname = "rancher.xyz.dev"

  # When Rancher is deployed, by default is uses the "latest" channel. But this can be customized.
  # The allowed values are "stable" or "latest".
  # rancher_install_channel = "stable"

  # Finally, you can specify a bootstrap-password for your rancher instance. Minimum 48 characters long!
  # If you leave empty, one will be generated for you.
  # (Can be used by another rancher2 provider to continue setup of rancher outside this module.)
  # rancher_bootstrap_password = ""

  # Separate from the above Rancher config (only use one or the other). You can import this cluster directly on an
  # an already active Rancher install. By clicking "import cluster" choosing "generic", giving it a name and pasting
  # the cluster registration url below. However, you can also ignore that and apply the url via kubectl as instructed
  # by Rancher in the wizard, and that would register your cluster too.
  # More information about the registration can be found here https://rancher.com/docs/rancher/v2.6/en/cluster-provisioning/registered-clusters/
  # rancher_registration_manifest_url = "https://rancher.xyz.dev/v3/import/xxxxxxxxxxxxxxxxxxYYYYYYYYYYYYYYYYYYYzzzzzzzzzzzzzzzzzzzzz.yaml"

  # Extra commands to be executed after the `kubectl apply -k` (useful for post-install actions, e.g. wait for CRD, apply additional manifests, etc.).
  # extra_kustomize_deployment_commands=""

  # Extra values that will be passed to the `extra-manifests/kustomization.yaml.tpl` if its present.
  # extra_kustomize_parameters={}

  # See an working example for just a manifest.yaml, a HelmChart and a HelmChartConfig examples/kustomization_user_deploy/README.md

  # It is best practice to turn this off, but for backwards compatibility it is set to "true" by default.
  # See https://github.com/kube-hetzner/terraform-hcloud-kube-hetzner/issues/349
  # When "false". The kubeconfig file can instead be created by executing: "terraform output --raw kubeconfig > cluster_kubeconfig.yaml"
  # Always be careful to not commit this file!
  # create_kubeconfig = false

  # Don't create the kustomize backup. This can be helpful for automation.
  # create_kustomization = false

  # Export the values.yaml files used for the deployment of traefik, longhorn, cert-manager, etc.
  # This can be helpful to use them for later deployments like with ArgoCD.
  # The default is false.
  # export_values = true

  # MicroOS snapshot IDs to be used. Per default empty, the most recent image created using createkh will be used.
  # We recommend the default, but if you want to use specific IDs you can.
  # You can fetch the ids with the hcloud cli by running the "hcloud image list --selector 'microos-snapshot=yes'" command.
  # microos_x86_snapshot_id = "1234567"
  # microos_arm_snapshot_id = "1234567"

  ### ADVANCED - Custom helm values for packages above (search _values if you want to located where those are mentioned upper in this file)
  # ⚠ Inside the _values variable below are examples, up to you to find out the best helm values possible, we do not provide support for customized helm values.
  # Please understand that the indentation is very important, inside the EOTs, as those are proper yaml helm values.
  # We advise you to use the default values, and only change them if you know what you are doing!

  # Cilium, all Cilium helm values can be found at https://github.com/cilium/cilium/blob/master/install/kubernetes/cilium/values.yaml
  # Be careful when maintaining your own cilium_values, as the choice of available settings depends on the Cilium version used. See also the cilium_version setting to fix a specific version.
  # The following is an example, please note that the current indentation inside the EOT is important.
  /*   cilium_values = <<EOT
ipam:
  mode: kubernetes
k8s:
  requireIPv4PodCIDR: true
kubeProxyReplacement: true
routingMode: native
ipv4NativeRoutingCIDR: "<IP_ADDRESS>/8"
endpointRoutes:
  enabled: true
loadBalancer:
  acceleration: native
bpf:
  masquerade: true
encryption:
  enabled: true
  type: wireguard
MTU: 1450
  EOT */

  # Cert manager, all cert-manager helm values can be found at https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/values.yaml
  # The following is an example, please note that the current indentation inside the EOT is important.
  /*   cert_manager_values = <<EOT
installCRDs: true
replicaCount: 3
webhook:
  replicaCount: 3
cainjector:
  replicaCount: 3
  EOT */

  # csi-driver-smb, all csi-driver-smb helm values can be found at https://github.com/kubernetes-csi/csi-driver-smb/blob/master/charts/latest/csi-driver-smb/values.yaml
  # The following is an example, please note that the current indentation inside the EOT is important.
  /*   csi_driver_smb_values = <<EOT
controller:
  name: csi-smb-controller
  replicas: 1
  runOnMaster: false
  runOnControlPlane: false
  resources:
    csiProvisioner:
      limits:
        memory: 300Mi
      requests:
        cpu: 10m
        memory: 20Mi
    livenessProbe:
      limits:
        memory: 100Mi
      requests:
        cpu: 10m
        memory: 20Mi
    smb:
      limits:
        memory: 200Mi
      requests:
        cpu: 10m
        memory: 20Mi
  EOT */

  # Longhorn, all Longhorn helm values can be found at https://github.com/longhorn/longhorn/blob/master/chart/values.yaml
  # The following is an example, please note that the current indentation inside the EOT is important.
  /*   longhorn_values = <<EOT
defaultSettings:
  defaultDataPath: /var/longhorn
persistence:
  defaultFsType: ext4
  defaultClassReplicaCount: 3
  defaultClass: true
  EOT */

  # If you want to use a specific Traefik helm chart version, set it below; otherwise, leave them as-is for the latest versions.
  # traefik_version = ""

  # Traefik, all Traefik helm values can be found at https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml
  # The following is an example, please note that the current indentation inside the EOT is important.
  /*   traefik_values = <<EOT
deployment:
  replicas: 1
globalArguments: []
service:
  enabled: true
  type: LoadBalancer
  annotations:
    "load-balancer.hetzner.cloud/name": "k3s"
    "load-balancer.hetzner.cloud/use-private-ip": "true"
    "load-balancer.hetzner.cloud/disable-private-ingress": "true"
    "load-balancer.hetzner.cloud/location": "nbg1"
    "load-balancer.hetzner.cloud/type": "lb11"
    "load-balancer.hetzner.cloud/uses-proxyprotocol": "true"

ports:
  web:
    redirectTo:
      port: websecure
      priority: 10

    proxyProtocol:
      trustedIPs:
        - <IP_ADDRESS>/32
        - <IP_ADDRESS>/8
    forwardedHeaders:
      trustedIPs:
        - <IP_ADDRESS>/32
        - <IP_ADDRESS>/8
  websecure:
    proxyProtocol:
      trustedIPs:
        - <IP_ADDRESS>/32
        - <IP_ADDRESS>/8
    forwardedHeaders:
      trustedIPs:
        - <IP_ADDRESS>/32
        - <IP_ADDRESS>/8
  EOT */

  # If you want to use a specific Nginx helm chart version, set it below; otherwise, leave them as-is for the latest versions.
  # nginx_version = ""

  # Nginx, all Nginx helm values can be found at https://github.com/kubernetes/ingress-nginx/blob/main/charts/ingress-nginx/values.yaml
  # You can also have a look at https://kubernetes.github.io/ingress-nginx/, to understand how it works, and all the options at your disposal.
  # The following is an example, please note that the current indentation inside the EOT is important.
  /*   nginx_values = <<EOT
controller:
  watchIngressWithoutClass: "true"
  kind: "DaemonSet"
  config:
    "use-forwarded-headers": "true"
    "compute-full-forwarded-for": "true"
    "use-proxy-protocol": "true"
  service:
    annotations:
      "load-balancer.hetzner.cloud/name": "k3s"
      "load-balancer.hetzner.cloud/use-private-ip": "true"
      "load-balancer.hetzner.cloud/disable-private-ingress": "true"
      "load-balancer.hetzner.cloud/location": "nbg1"
      "load-balancer.hetzner.cloud/type": "lb11"
      "load-balancer.hetzner.cloud/uses-proxyprotocol": "true"
  EOT */

  # Rancher, all Rancher helm values can be found at https://rancher.com/docs/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/
  # The following is an example, please note that the current indentation inside the EOT is important.
  /*   rancher_values = <<EOT
ingress:
  tls:
    source: "rancher"
hostname: "rancher.example.com"
replicas: 1
bootstrapPassword: "supermario"
  EOT */

}

provider "hcloud" {
  token = var.hcloud_token != "" ? var.hcloud_token : local.hcloud_token
}

terraform {
  required_version = ">= 1.5.0"
  required_providers {
    hcloud = {
      source  = "hetznercloud/hcloud"
      version = ">= 1.43.0"
    }
  }
}

output "kubeconfig" {
  value     = module.kube-hetzner.kubeconfig
  sensitive = true
}

variable "hcloud_token" {
  sensitive = true
  default   = ""
}

Screenshots
No response
Platform
Mac

@roberto-sebastiano Indeed, I have been able to reproduce with your kube.tf.

@roberto-sebastiano Indeed, I have been able to reproduce with your kube.tf.

Any workaround to play with the whole thing for testing ?
A working kube.tf to start with ?
Thanks

@roberto-sebastiano  I'll be damned. It was the uppercase in your nodepool names, remove them and everything should work. I will make sure to include that precision in kube.tf.example.

FYI. The lowercase requirement has been added to the latest kube.tf.example, thanks for finding this bug.


chore(deps): upgrade dev dependencies

Upgrades project dependencies. See details in workflow run.

Automatically created by projen via the "upgrade-dev-dependencies-2.x" workflow

⚪ Backport skipped
The pull request was not backported as there were no branches to backport to. If this is a mistake, please apply the desired version labels or run the backport tool manually.
Manual backport
To create the backport manually run:
backport --pr 1860

Questions ?
Please refer to the Backport tool documentation


Shift to parentheses

One feature I miss terribly is the mapping of a single press of the left/right shift key to ( / ). Is this possible now, or yet to come?

https://github.com/tekezo/Karabiner-Elements/issues/8 contains an interesting workaround for a similar problem -- it works if you have Keyboard Maestro.

With the new complex modifications feature that also enabled Hyper you can now also map shift to parens again! 🎉
Here is how I did it:  https://github.com/martinklepsch/dotfiles/commit/83e4989d7ea3afb2809e74b34e77d8111136b5d8

That is very nice, and works very well with US keyboard layout. I switch back and forth between a few different layouts, among them Swedish which has (, ) mapped to shift + 8, 9. Is there a way of getting a parenthesis directly? It is not a big issue for me, since I use the shifts to parentheses when I program, for which I use US layout, anyway, but a more general solution would be nice.

@martinklepsch did you manage to get 'complex_modifications' to work?  I did not, I add them to the json file, Karabiner-Elements shows them up in the UI, but nothing changes.
                    {
                        "description": "Post ( if left_shift pressed alone",
                        "from": {
                            "key_code": "left_shift",
                            "modifiers": {
                                "optional": [
                                    "any"
                                ]
                            }
                        },
                        "to": [
                            {
                                "key_code": "left_shift",
                                "modifiers": []
                            }
                        ],
                        "to_if_alone": [
                            {
                                "key_code": "9",
                                "modifiers": [
                                    "left_shift"
                                ]
                            }
                        ],
                        "type": "basic"
                    },
                    {
                        "description": "Post ) if right_shift is pressed alone",
                        "from": {
                            "key_code": "right_shift",
                            "modifiers": {
                                "optional": [
                                    "any"
                                ]
                            }
                        },
                        "to": [
                            {
                                "key_code": "right_shift",
                                "modifiers": []
                            }
                        ],
                        "to_if_alone": [
                            {
                                "key_code": "0",
                                "modifiers": [
                                    "right_shift"
                                ]
                            }
                        ],
                        "type": "basic"
                    }
                ]

FWIW, I am on Karabiner-Elements v0.91.11

Nevermind, mistake on my side, I got the configuration schema wrong -- I had added these to 'rules', instead of 'rules.manipulators'..

I changed my config so that the shift to parens thing is implemented as a separate complex modification: https://github.com/martinklepsch/dotfiles/blob/6a2f4d555c763ae806cd8e875be821a52746914a/config/karabiner/karabiner.json#L16


feat: authorize admins and mods to post proposals

This PR allows admins and moderators to post a proposal regardless of their voting power.

Can this be merged?


Add References clearly detailed in the code

@mattpalermo I'm not sure if this is taken care of anywhere already but
Here's my experience, have the source code somewhere on your machine, go to build the add-in, so for me I know how to build the Excel .xlsm from the source then add the modules all groovy, then I compile...
I know that there are some refs need adding and I could just go through and hit compile and add in the references on what error messages I get back
Or I have to go back to the documentation and find the list
What I'm thinking is that the list is added to the first module the user will see,

So maybe add in some comments:

Add in the following references:

Microsoft Scripting Runtime
Microsoft Visual Basic for Applications Extensibility 5.3
Windows Script Host Object Model
Microsoft Shell Controls And Automation

Now that I've just added them to the config .cls I may just leave them in there
Let me know what you think

Good points. Easier the better. I think it's a bit weird to put it in an arbitrary module. Think about what happens when that module is no longer the first to show up. Have you considered creating an empty module with the comments and naming it such that it will always appear first? I'm not sure if this is possible but if you name it something like "aaa_references" it might show up first.


Web - Chat - When the window is minimized, the Enter key does not work for sending messages

If you haven’t already, check out our contributing guidelines for onboarding and email<EMAIL_ADDRESS>to request to join our Slack channel!

Action Performed:

Go to URL https://staging.new.expensify.com/
Login with any account
Minimize the windows
Go to any chat
Write any message in composer and press Enter key

Expected Result:
Cursor goes to the next line
Actual Result:
Message send
Workaround:
Unknown
Platforms:

Which of our officially supported platforms is this issue occurring on?

[ ] Android / native
[ ] Android / Chrome
[ ] iOS / native
[ ] iOS / Safari
[ ] Windows / Chrome
[ ] MacOS / Desktop

Version Number: <IP_ADDRESS>
Reproducible in staging?: Yes
Reproducible in production?: yes
If this was caught during regression testing, add the test name, ID and link from TestRail:
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Notes/Photos/Videos: Any additional supporting documentation
https://user-images.githubusercontent.com/93399543/231888863-0362e62e-c7a7-44e5-a755-b68c955dd6d3.mov

Expensify/Expensify Issue URL:
Issue reported by: Applause - Internal Team
Slack conversation:
View all open jobs on GitHub

Triggered auto assignment to @Christinadobrzyn (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

Bug0 Triage Checklist (Main S/O)

[ ] This "bug" occurs on a supported platform (ensure Platforms in OP are ✅)
[ ] This bug is not a duplicate report (check E/App issues and #expensify-bugs)

If it is, comment with a link to the original report, close the issue and add any novel details to the original issue instead

[ ] This bug is reproducible using the reproduction steps in the OP. S/O

If the reproduction steps are clear and you're unable to reproduce the bug, check with the reporter and QA first, then close the issue.
If the reproduction steps aren't clear and you determine the correct steps, please update the OP.

[ ] This issue is filled out as thoroughly and clearly as possible

Pay special attention to the title, results, platforms where the bug occurs, and if the bug happens on staging/production.

[ ] I have reviewed and subscribed to the linked Slack conversation to ensure Slack/Github stay in sync

Hum, I don't follow what "Minimize the windows" means? @kbecciv can you clarify the test steps again for me?

Hello @Christinadobrzyn! You can try change the screen size from 1536746  to 742702

@Christinadobrzyn Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!

Thanks @kbecciv I'm still not able to replicate the issue (also, I'm not sure if the video in the OP is for this issue)

Go to URL https://staging.new.expensify.com/ on Mac Chrome
Login with any account
Change the size of the window to something smaller (or is there a setting that should do this? If yes, what are the steps to change the setting)?
Go to any chat
Write any message in composer and press Enter key

Can you confirm these are the correct steps? If yes, what should I see that is wrong?

@Christinadobrzyn Not sure about Mac, but able to reproduce it on Windows/Chrome.
There are two screenshot added wit the size of browser. On 742 * 702 size of browser the Enter key does not work.
https://user-images.githubusercontent.com/93399543/232841536-b3a2e674-a96b-4f1d-b97c-d461581cbde1.mp4

This looks like a duplicate issue of this - https://github.com/Expensify/App/issues/17206 so going to close this.


option to create an object only once in multi-iteration jobs

Type of change

[ ] Refactor
[ ] New feature
[ ] Bug fix
[x] Optimization
[ ] Documentation Update

Description
In certain cases on creating cluster wide resources like clusterroles, operator spec CRDs, network spec, they would not have to run for every iteration although it is idempotent, this additional option let us attempt just once during the  iteration within a job.
We have many of such scenarios with ICNI implementaion like serviceaccount, SRIOV specs, ICNI CRDs are required to run only once within a job.
example object, when jobIteration is > 1
      - objectTemplate: serviceaccount.yml
        replicas: 1
        runonce: true

      - objectTemplate: pod.yml
        replicas: 1

Related Tickets & Documents

Related Issue #
Closes #

Checklist before requesting a review

[x] I have performed a self-review of my code.
[ ] If it is a core feature, I have added thorough tests.

I normally recommend to use a different job with just one iteration to create this kind of objects, but this feature can be useful for other scenarios as well


#5038391: Improve Actions error (impacts also Form and Modal)

Closes #5038391
Test Plan
tests performed

A Test Plan is used to show what you tested to make sure your code works fine. You should write here all that you did to test, and provide some results of your testing.

These results can be screenshots, query results, or even just pointers to unit tests that successfully passed.

tests not performed (domain coverage)

At times not everything can be tested, and writing what hasn't been tested is just as important as writing what has been tested.

An example of partial test is a field displaying 4 possible values. If 3 values are tested, with screenshots, and 1 is not, then it should be mentioned here.

@gabro this PR has been here unreviewed for a while. I just rebased it on main. Should we merge it?


[Rokfin] Search & login

Please follow the guide below

You will be asked some questions, please read them carefully and answer honestly
Put an x into all the boxes [ ] relevant to your pull request (like that [x])
Use Preview tab to see how your pull request will actually look like

Before submitting a pull request make sure you have:

[x] At least skimmed through contributing guidelines including yt-dlp coding conventions
[x] Searched the bugtracker for similar pull requests
[ ] Checked the code with flake8

In order to be accepted and merged into yt-dlp each piece of code must be in public domain or released under Unlicense. Check one of the following options:

[x] I am the original author of this code and I am willing to release it under Unlicense
[ ] I am not the original author of this code but it is in public domain or released under Unlicense (provide reliable evidence)

What is the purpose of your pull request?

[ ] Bug fix
[ ] Improvement
[ ] New extractor
[x] New feature

Description of your pull request and other information
Add Rokfin site search and login.
Closes #2991

Rebase on master

[ ] I am the original author of this code and I am willing to release it under Unlicense ??

I mean you can't be the author of nothing...

That was going to be the next "??"!

This was split off from #1534. So I assume OP decided to open a PR before cleaning up and committing the actual code to the branch. As long as the code is committed before un-drafting the PR, it's fine

@pukkandan I've checked the "I am the original author ..." box. Does this solve the licensing problem?

I have made a force-push to clean up the commit history. You don't need to keep merging unless there is a conflict. It doesn't accomplish anything

I noticed you requested a re-review, but many of my earlier comments are still unaddressed?

@pukkandan GitHub hides some of the conversations when it thinks there are too many of them. 11 of them were hidden in my case. Not showing these conversations by default makes them easy to miss, and I assumed them to have already been resolved.

Yes, it also hides some conversations as "outdated" when you change some surrounding code. I recommend uncollapsing and double-checking the comments when you think you are done

@pukkandan Hopefully, I have addressed all the issues except those related to the _authentication_active() function which you seem to be working on. Perhaps you can merge RokfinSearchIE?

See previous unresolved comments

Which ones? Didn't I address them all?

I've marked all addressed ones as "resolved". Anything that isn't marked as such is pending

This looks like a bug in the merged section:
$ yt-dlp.sh https://rokfin.com/stream/8892
[Rokfin] stream/8892: Downloading webpage
ERROR: [Rokfin] stream/8892: Unable to download webpage: HTTP Error 404: Not Found (caused by <HTTPError 404: 'Not Found'>); please report this issue on  https://github.com/yt-dlp/yt-dlp/issues?q= , filling out the appropriate issue template. Confirm you are on the latest version using  yt-dlp -U

The user should not have to file a bug report when the video does not exist.

pls verify my changes


MT7921K not detected

Hello,
I assembled Wlan PI M4 with Mediatek MT7921K. I have message "NO WI-FI ADAPTER" on display.
I use image image_v3.1.3-2023-07-11-wlanpi-os.zip
Please fix it.
Deafult login/password wlanpi/wlanpi don't work.

I've just tested M4 with the 3.1.3 image and everything is working fine. So it shouldn't be a systemic issue.
Default credentials are working fine too. Have you SSH'd in? Did you get the prompt to change default password to your own?

Did Mediatek MT7921K work fine for you on the 3.1.2 image?

No, MR7921K don't work on 3.1.2 also.
login/password wlanpi/wlanpi also don't work on image image_v3.1.2-2023-02-04-wlanpi-os.zip
I made fresh flash card over Balena Ether and login over ssh over ethernet on first boot.

Are you specifying the username in your ssh command?
ssh<EMAIL_ADDRESS>(replace the IP address with your WLAN Pi’s)

I use putty. I reading guide https://userguide.wlanpi.com/wlan-pi-os/faq/default-password
Varian 1:
login as: wlanpi
<EMAIL_ADDRESS>password:
Access denied
<EMAIL_ADDRESS>password:
Access denied
<EMAIL_ADDRESS>password:
Variant 2:
login as<EMAIL_ADDRESS>wlanpi<EMAIL_ADDRESS>password:
Access denied
wlanpi<EMAIL_ADDRESS>password:
Access denied
password: wlanpi , not caps lock

Not able to reproduce on this end. Are you sure hitting the right IP?
On Wed, Jul 12, 2023 at 7:58 AM gcastle2007 @.***>
wrote:

I also change hash in /etc/shadow to hash what i know password. But I
message "access denied" in putty and "permission denied" in ubuntu.
—
Reply to this email directly, view it on GitHub
https://github.com/WLAN-Pi/pi-gen/issues/44#issuecomment-1632484083, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AEFQT4D5I7CWSA6HCDVN52DXP2NPLANCNFSM6AAAAAA2HED2UM
.
You are receiving this because you are subscribed to this thread.Message
ID: @.***>

--
Thank you,
Jerry Olla

Yes, absolulty. I have in network 3 devices - notebook, access point with dhcp server and device wlan pi m4.
I have write video. You can watch. What I make not correctly?
https://youtu.be/VaPy6pb0MBs

back to topic:
image 3.1.2
root@wlanpi-365:/home/wlanpi# lspci
root@wlanpi-365:/home/wlanpi# lsusb
Bus 001 Device 003: ID 0e8d:0608 MediaTek Inc. Wireless_Device
Bus 001 Device 002: ID 1a40:0101 Terminus Technology Inc. Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

root@wlanpi-365:/home/wlanpi# nmcli --get-values GENERAL.DEVICE,GENERAL.TYPE device show
pan0
bridge

eth0
ethernet

lo
loopback

adapter photo
obviously the card is inserted, but is not recognized as a pci wi-fi adapter

@jiribrejcha  on a fresh 3.1.3 image - same problem. any suggestions how to fix mt7921k on wlanpi m4?

Please provide the output of dmesg | grep pcie
You should see something like this

wlanpi@wlanpi-b14:~ $ dmesg | grep pcie
[    8.947114] OF: overlay: WARNING: memory leak will occur if overlay removed, property: /scb/pcie@7d500000/status
[    8.947728] brcm-pcie fd500000.pcie: host bridge /scb/pcie@7d500000 ranges:
[    8.947752] brcm-pcie fd500000.pcie:   No bus range found for /scb/pcie@7d500000, using [bus 00-ff]
[    8.947793] brcm-pcie fd500000.pcie:      MEM 0x0600000000..0x063fffffff -> 0x00c0000000
[    8.947832] brcm-pcie fd500000.pcie:   IB MEM 0x0000000000..0x007fffffff -> 0x0000000000
[    8.952717] brcm-pcie fd500000.pcie: PCI host bridge to bus 0000:00
[    8.956995] pci_bus 0000:01: supply vpcie3v3 not found, using dummy regulator
[    8.958196] pci_bus 0000:01: supply vpcie3v3aux not found, using dummy regulator
[    8.958275] pci_bus 0000:01: supply vpcie12v not found, using dummy regulator
[    8.989004] brcm-pcie fd500000.pcie: link up, 5.0 GT/s PCIe x1 (SSC)

I use putty. I reading guide https://userguide.wlanpi.com/wlan-pi-os/faq/default-password
Varian 1:
login as: wlanpi<EMAIL_ADDRESS>password: Access denied<EMAIL_ADDRESS>password: Access denied<EMAIL_ADDRESS>password:
Variant 2:
login as<EMAIL_ADDRESS>wlanpi<EMAIL_ADDRESS>password: Access denied wlanpi<EMAIL_ADDRESS>password: Access denied
password: wlanpi , not caps lock

@gcastle2007, can you please try to use a different SSH client? It sounds like it might perhaps some settings in Putty.

@jolla
root@wlanpi-365:/home/wlanpi#  dmesg | grep pcie
[    8.897844] OF: overlay: WARNING: memory leak will occur if overlay removed, property: /scb/pcie@7d500000/status
[    8.902902] brcm-pcie fd500000.pcie: host bridge /scb/pcie@7d500000 ranges:
[    8.902936] brcm-pcie fd500000.pcie:   No bus range found for /scb/pcie@7d500000, using [bus 00-ff]
[    8.902976] brcm-pcie fd500000.pcie:      MEM 0x0600000000..0x063fffffff -> 0x00c0000000
[    8.903021] brcm-pcie fd500000.pcie:   IB MEM 0x0000000000..0x007fffffff -> 0x0000000000
[    8.907122] brcm-pcie fd500000.pcie: PCI host bridge to bus 0000:00
[    8.909242] pci_bus 0000:01: supply vpcie3v3 not found, using dummy regulator
[    8.909355] pci_bus 0000:01: supply vpcie3v3aux not found, using dummy regulator
[    8.909406] pci_bus 0000:01: supply vpcie12v not found, using dummy regulator
[    9.238486] brcm-pcie fd500000.pcie: link down

Based on this message, it looks like either you have a bad MT7921K or MCUzone board.
[    9.238486] brcm-pcie fd500000.pcie: link down
Do you have a different m.2 Wi-Fi module your can try in the m.2 slot?
Also, I would recommend picking up the newer mt7922 Wi-Fi module, it supports 160MHz channels and so far has proved to be more stable than the 7921K has been.

@jolla some intel ax200\ax210 is ok for test purpose?

Yes
On Sat, Jul 29, 2023 at 12:48 PM nimbo78 @.***> wrote:

@jolla https://github.com/jolla some intel ax200\ax210 is ok for test
purpose?
—
Reply to this email directly, view it on GitHub
https://github.com/WLAN-Pi/pi-gen/issues/44#issuecomment-1656805209, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AEFQT4CEI2OQ6OZBTID5WXLXSVEG5ANCNFSM6AAAAAA2HED2UM
.
You are receiving this because you were mentioned.Message ID:
@.***>

--
Thank you,
Jerry Olla

seems like intel ax210 doesn't work too
root@wlanpi-365:/home/wlanpi# dmesg | grep pcie
[    8.569441] OF: overlay: WARNING: memory leak will occur if overlay removed, property: /scb/pcie@7d500000/status
[    8.570122] brcm-pcie fd500000.pcie: host bridge /scb/pcie@7d500000 ranges:
[    8.570150] brcm-pcie fd500000.pcie:   No bus range found for /scb/pcie@7d500000, using [bus 00-ff]
[    8.570191] brcm-pcie fd500000.pcie:      MEM 0x0600000000..0x063fffffff -> 0x00c0000000
[    8.570229] brcm-pcie fd500000.pcie:   IB MEM 0x0000000000..0x007fffffff -> 0x0000000000
[    8.577329] brcm-pcie fd500000.pcie: PCI host bridge to bus 0000:00
[    8.600063] pci_bus 0000:01: supply vpcie3v3 not found, using dummy regulator
[    8.600187] pci_bus 0000:01: supply vpcie3v3aux not found, using dummy regulator
[    8.600242] pci_bus 0000:01: supply vpcie12v not found, using dummy regulator
[    8.927158] brcm-pcie fd500000.pcie: link down

Yes, unfortunately it looks like the issue is a hardware issue with the MCUzone board. Perhaps a pin is bent or damaged on the m.2 socket. You'll likely need to get a replacement MCUzone board.

Hey folks - having a similar issue here with a Comfast CF-953AX / MT7921au - seeing the "No Wi-Fi Adapter" message, but in my case the pcie link is up and I see the adapter in the list of USB devices as "MediaTek Inc. Wireless_Device". Any thoughts?
I feel like I might be missing something obvious from Adrian G's killer guide.
wlanpi@wlanpi-64a:~ $ dmesg | grep pcie
[    1.348892] brcm-pcie fd500000.pcie: host bridge /scb/pcie@7d500000 ranges:
[    1.348959] brcm-pcie fd500000.pcie:   No bus range found for /scb/pcie@7d500000, using [bus 00-ff]
[    1.349066] brcm-pcie fd500000.pcie:      MEM 0x0600000000..0x063fffffff -> 0x00c0000000
[    1.349166] brcm-pcie fd500000.pcie:   IB MEM 0x0000000000..0x00bfffffff -> 0x0400000000
[    1.350146] brcm-pcie fd500000.pcie: PCI host bridge to bus 0000:00
[    1.354536] pci_bus 0000:01: supply vpcie3v3 not found, using dummy regulator
[    1.354801] pci_bus 0000:01: supply vpcie3v3aux not found, using dummy regulator
[    1.354949] pci_bus 0000:01: supply vpcie12v not found, using dummy regulator
[    1.404846] brcm-pcie fd500000.pcie: link up, 5.0 GT/s PCIe x1 (SSC)
[   18.533100] OF: overlay: WARNING: memory leak will occur if overlay removed, property: /scb/pcie@7d500000/status

Since your issue is with USB Wi-Fi modules this would be a separate issue, I've created a separate issue to track it

well, that was HW issue :)
The damper between the CM4 and the expansion card is too thick and the contact between the CM4 and the expansion card was lost in several places. So I just threw away the damper rings and it works like a charm.
Sorry to bother you


Fix returnStatusToPool

[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[ ] Networking
[x] Performance and Scalability
[ ] Policies and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
Pull Request Attributes
Please check any characteristics that apply to this pull request.
[x] Does not have any changes that may affect Istio users.

@wzshiming: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

release-notes_istio
4f9bb1a3cfc8f9d79fdd7bdcb44a8b4bcf70043b
link
/test release-notes_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/retest

@wzshiming: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

release-notes_istio
4f9bb1a3cfc8f9d79fdd7bdcb44a8b4bcf70043b
link
/test release-notes_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/test release-notes_istio

What user facing bugs does this fix? I am very hesitant to make any changes to galley/ since we are planning to remove it ASAP


Adding points: form for attributes not showing.

I am working on a modified version here: https://github.com/osmottawa/CrowdiD
When adding a new point, the form to enter attributes is not showing. I am not sure why.
If anyone has a clue for me, I will be eternally grateful beyond the grave!

uiz commented 3 minutes ago
After some testing, the difference with a new point added on the map is in the panelwrap div. It receives a style="right: -100%". Other elements have "right: 0%".

This is very odd. By playing with the styling in console, the form shows up. To fill it you have to search the feature.

Issues like this are going to be tricky to debug, in part because of how you copied the iD code.  It looks like you don't have a true fork of iD, but instead you copied the files somewhere and checked them into git.  It's totally ok for you do this, but it means that our codebases have diverged and you won't be able to accept any new changes to the iD code.
Before you get too far into this project, you should probably read this excellent guide:
How to maintain a git remote fork.
To summarize - it's really hard to keep a fork in sync with the main project.  There are 2 main approaches:

Change the iD code, then always rebase your changes onto the end of the upstream project's head.   So your project will always be "iD + some commits".  Whenever you update iD, you'll run git rebase or git cherry-pick and fix whatever conflicts happen.  macrocosm/iD and strava/iD work this way.
Don't touch the iD code, and instead write scripts that replace things in iD.  You might use cp, sed, perl, or whatever tool to reach into iD and perform surgery on parts of it.  nationalparkservice/places-editor works this way (see npmapInstall.js)

So, in cases where your code does something that iD doesn't do - obviously it's from something you did to it!  A good way to figure out what happened is to use the git bisect command - it lets you specify a "good" commit and a "bad" commit, and will check out different versions of your code to narrow down which commit introduced the bug.
Hope this was all helpful!

Thank you, it was very helpful.
My problem is that I had no control over the development. Our IT did this and didn't follow recommendations. I didn't have time to start over.
I was stuck fixing their work. It's been a big headache to work this way. I was in damage control on left on my own to fix a broken app and I had no idea what they did to it.
I plan on starting it from scratch exactly like you suggested which is what should have happened in the first place.
Thanks, Bryan.
Sent from my iPhone

On Oct 16, 2016, at 11:55 PM, Bryan Housel<EMAIL_ADDRESS>wrote:
Issues like this are going to be tricky to debug, in part because of how you copied the iD code. It looks like you don't have a true fork of iD, but instead you copied the files somewhere and checked them into git. It's totally ok for you do this, but it means that our codebases have diverged and you won't be able to accept any new changes to the iD code.
Before you get too far into this project, you should probably read this excellent guide:
How to maintain a git remote fork.
To summarize - it's really hard to keep a fork in sync with the main project. There are 2 main approaches:

Change the iD code, then always rebase your changes onto the end of the upstream project's head. So your project will always be "iD + some commits". Whenever you update iD, you'll run git rebase or git cherry-pick and fix whatever conflicts happen. macrocosm/iD and strava/iD work this way.
Don't touch the iD code, and instead write scripts that replace things in iD. You might use cp, sed, perl, or whatever tool to reach into iD and perform surgery on parts of it. nationalparkservice/places-editor works this way (see npmapInstall.js)

So, in cases where your code does something that iD doesn't do - obviously it's from something you did to it! A good way to figure out what happened is to use the git bisect command - it lets you specify a "good" commit and a "bad" commit, and will check out different versions of your code to narrow down which commit introduced the bug.
Hope this was all helpful!
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.


[Refactor][PipelinePlanV200] better to use ID but not transformationRule.

What and why to refactor
In GitHub, Jenkins, Jira, and so on.
Plugins use the transformationRule to makeDataSourcePipelinePlanV200, but not ID as follows:

And now  we can get the TransformationRules by ID from the database on PrepareTaskData

so it is better to use ID.
Describe the solution you'd like
change it to save TransformationRuleId but not TransformationRules in Options.
Related issues
#3468

fixed by v0.15.0


Spelling

Generated by https://github.com/jsoref/spelling f; to maintain your repo, please consider fchurn

Coverage remained the same at 92.244% when pulling 1da86dbba67bf9da77def20d6a5d1c88c29dcf3c on jsoref:spelling into 4646e7f7e5c8665e64afb05bfbf49c670e20b71f on joohoi:master.

Thanks for the PR! The tool looks really good too. I didn't have the time to go through all of the options, but I'll definately (intended typo, as it's one of the words I tend to write wrong all the time) will be using this in the future. I wonder if there's a suggested way to automate all this in Travis job for example, but I'll create an feature request issue in your repo regarding this.

@joohoi https://github.com/checkstyle/checkstyle/blob/master/.ci/test-spelling-unknown-words.sh is what I did for the checkstyle project. I've been meaning to offer it to other projects.

I'll check it out later on, thanks!


Delete Repo folder when the process is done

Whenever the Scheduler is idle it can clear the cloned repos folder.

The Scheduler now delete all repos when it's completely idle. Instead repos should be deleted when they are no longer needed.


Please add composer.json

Hello!
Please register this library as composer package.

Thanks, but we're not going to add support for anything beyond npm & bower, every new package manager is a maintenance burden. npm is the future for anything JS-related, bower is a temporary solution for people for whom npm is not enough yet.
Feel free to maintain such a package yourself if you want, though.

BTW, I see https://github.com/components/jquery already has a composer.json file. Is that not enough?


Passing binary location to native test script.

jenkins script has already determined if it is meant for noJit, so it will pass appropriate location to inner script.
Fixes #1266

@dotnet-bot test nojit please

@dotnet-bot test nojit tests please

@akroshg Once those pass, LGTM

Thanks @dilijev. Merging this in.


Use spring-cloud-task dependency directly in the BOM

The one coming from spring-cloud-dependencies is outdated.

This issue is resolved.


FB musical chairs replaces the manage_pages and publish_pages scopes

https://developers.facebook.com/docs/facebook-login/permissions/#reference-manage_pages
Existing users of manage_pages will not be affected, but new users like myself are getting errors that manage_pages does not exist. FB is forcing everyone to migrate to the new granular scopes.

Thanks for the fix
Any plans on merging this?
I know next to nothing about Lua, is it posible to just mount the patched file as a docker volume as a temporary fix?

@jaceee The repo owner seems very busy at the moment - feel free to use the public Docker image which contains this fix:
https://hub.docker.com/repository/docker/gdhgdh/multistreamer
If you prefer to build your own, the Dockerfile is literally two lines:
FROM jprjr/multistreamer:12.2.4-1
RUN sed -i 's/manage_pages,publish_pages/pages_manage_metadata,pages_read_engagement,pages_read_user_content,pages_manage_posts,pages_manage_engagement/' /home/
multistreamer/lib/multistreamer/networks/facebook.lua


Published package is not main branch

Hello,
I found your package whilst looking for Home Assistant Sonnen battery component that uses the V2 API.
It seemed to be just what I need and I noticed a comment about it not working quite right, I forked it and got everything working from the main branch.
I've just found the dev branch is being published to PyPi and is quite different to main and version numbers are quite different.
This is unexpected, only the main branch should be published when it's stable enough to release, so you only get a new version when dev branch is merged into main at release points.
I expected you're testing the package and publishing it to PyPi for that purpose, but that means any one using your package will get dev code, which they won't be expecting. (like me using main branch and its not the published package version)
You can set the default branch in your repo to 'dev' and use pip to install the dev package from github without publishing it to PyPi.
see how to use a github package default branch:  https://pip.pypa.io/en/stable/cli/pip_install/#vcs-support
pip install "git+https://github.com/Katamave/sonnen_api_v2.git"
I'd like to help with development, if you're OK with that.
My goal is to get weltmeyer Sonnenbatterie HA custom component working with your V2 API.
My plan is to make a wrapper that takes the place of  weltmeyer "sonnenbatterie" API package and passes the calls to your API package, so the Sonnenbatterie component works without any modification. It will do this by using the same package name "sonnenbatterie" and be installed instead of weltmeyer package.
My ultimate goal with all this is to get HomeAssistant to send an alert when SonnenBatterie status changes to "offgrid" and make a component to show backup buffer usage when that happens.
Are you a Home Assistant user too? Does this sound like something you might like to use?
Look forward to your thoughts on all this.
Regards, Mark

Hi, yes im HA user too. I have messed up with dev branch most of the time as im just a hobby dev :).
I have done some changes about 2 weeks ago but forgot to merge them... :). I can do it later tomorrow.
I have got some problems with data from remaining_capacity_wh api call and dont know why. Problem is still present.
Data im recieving is too high.
I have a 22000wh system and with full charge api reports around 44000wh (maybe its a problem with configuration of my installlation).
I have asked sonnen but they told me that there is no support for a api.
Feel free to contribute if you like :).

Hey, thanks for getting back to me.
Originally thought this package might have been abandoned when last changes were 2 years ago when I forked it.
You can see my changelog in the pull request I cancelled when I found new work on dev branch was in PyPi.
If you have a stable version on dev branch, merge that into main and publish main to PyPi.
I'll add your new changes to my work and try the pull request against to get backup buffer functions into the package.
Enable discussions on your repo and we can talk about stuff in discussions instead of this issue.
I also get wrong values for remaining_capacity_wh, it's not double but close to double. I think maybe there is a way to calculate it from other numbers.
(I'm a dev btw, did a few refactors to make maintenance easier in the future)


feat: add vector.Sum using AVX512

Description
edit: this PR also includes #545
Adds vector.Sum(...) using AVX512 instructions when available.
Rough bench on r7i.xlarge instance gives 70-80% perf improvement for a vector with 1<<20 elements.
benchmark                        old ns/op     new ns/op     delta
BenchmarkElementVecOps/Sum-4     1689581       340038        -79.87%
BenchmarkElementVecOps/Sum-4     1679356       340570        -79.72%

Inspired with some modifications from https://github.com/a16z/vectorized-fields .
TODO

[ ] ensure https://github.com/a16z/vectorized-fields sets a License file
[ ] ensure the Barrett reduction bounds are met (i.e. 2 conditional sub enough) with proof
[ ] add test cases for edge cases in Barrett reduction

moving back to draft, will consolidate with other vecops (refactoring + better tests + cleaner)


add failing test case for #111

Similar to the example in #111.
Maybe it is nice to also test whether the the original value and the final value don't refer to the same object? To make sure the set happened (since the value was actually changed more or less).

I've added a possible fix for the issue.
It removes queued updates from this.__diffs inside a cortex when a value is set that matches the original value.
It uses the removeCallback inside pubsub (which was previously unused).
Would this be an acceptable solution?

I've removed the possible fix from this PR as it took the wrong route (see #111).
But I hope the failing test is important enough to merge?