[BUG] Exception updating the admin password : /usr/share/opensearch/config/opensearch-security/internal_users.yml: Device or resource busy

What is the bug?
Exception when running security plugin with opensearch on main branch(3.0.0)
OPENSEARCH_INITIAL_ADMIN_PASSWORD is set
DISABLE_INSTALL_DEMO_CONFIG is set to false
Suspicious log Exception updating the admin password : /usr/share/opensearch/config/opensearch-security/internal_users.yml: Device or resource busy
OpenSearch install type: rpm/deb on Linux 5.10.173-154.642.amzn2.x86_64 amd64
OpenSearch config dir: /usr/share/opensearch/config/
OpenSearch config file: /usr/share/opensearch/config/opensearch.yml
OpenSearch bin dir: /usr/share/opensearch/bin/
OpenSearch plugins dir: /usr/share/opensearch/plugins/
OpenSearch lib dir: /usr/share/opensearch/lib/
Detected OpenSearch Version: 3.0.0
Detected OpenSearch Security Version: <IP_ADDRESS>
Admin password set successfully.
Exception updating the admin password : /usr/share/opensearch/config/opensearch-security/internal_users.yml: Device or resource busy

Error stack traces:
[2023-12-22T10:24:38,513][ERROR][o.o.b.OpenSearchUncaughtExceptionHandler] [opensearch-cluster-master-1] uncaught exception in thread [main]
org.opensearch.bootstrap.StartupException: java.lang.IllegalStateException: failed to load plugin class [org.opensearch.security.OpenSearchSecurityPlugin]
	at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:184) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.OpenSearch.execute(OpenSearch.java:171) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:104) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138) ~[opensearch-cli-3.0.0.jar:3.0.0]
	at org.opensearch.cli.Command.main(Command.java:101) ~[opensearch-cli-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:137) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:103) ~[opensearch-3.0.0.jar:3.0.0]
Caused by: java.lang.IllegalStateException: failed to load plugin class [org.opensearch.security.OpenSearchSecurityPlugin]
	at org.opensearch.plugins.PluginsService.loadPlugin(PluginsService.java:791) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.plugins.PluginsService.loadBundle(PluginsService.java:731) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.plugins.PluginsService.loadBundles(PluginsService.java:533) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.plugins.PluginsService.<init>(PluginsService.java:195) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.node.Node.<init>(Node.java:484) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.node.Node.<init>(Node.java:411) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:242) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.Bootstrap.setup(Bootstrap.java:242) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.Bootstrap.init(Bootstrap.java:404) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:180) ~[opensearch-3.0.0.jar:3.0.0]
	... 6 more
Caused by: java.lang.reflect.InvocationTargetException
	at java.base/jdk.internal.reflect.DirectConstructorHandleAccessor.newInstance(DirectConstructorHandleAccessor.java:74) ~[?:?]
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:502) ~[?:?]
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:486) ~[?:?]
	at org.opensearch.plugins.PluginsService.loadPlugin(PluginsService.java:782) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.plugins.PluginsService.loadBundle(PluginsService.java:731) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.plugins.PluginsService.loadBundles(PluginsService.java:533) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.plugins.PluginsService.<init>(PluginsService.java:195) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.node.Node.<init>(Node.java:484) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.node.Node.<init>(Node.java:411) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:242) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.Bootstrap.setup(Bootstrap.java:242) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.Bootstrap.init(Bootstrap.java:404) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:180) ~[opensearch-3.0.0.jar:3.0.0]
	... 6 more
uncaught exception in thread [main]
Caused by: org.opensearch.OpenSearchSecurityException: Error while initializing transport SSL layer from PEM: OpenSearchException[Unable to read /usr/share/opensearch/config/esnode.pem (/usr/share/opensearch/config/esnode.pem). Please make sure this files exists and is readable regarding to permissions. Property: plugins.security.ssl.transport.pemcert_filepath]
	at org.opensearch.security.ssl.DefaultSecurityKeyStore.initTransportSSLConfig(DefaultSecurityKeyStore.java:495) ~[?:?]
	at org.opensearch.security.ssl.DefaultSecurityKeyStore.initSSLConfig(DefaultSecurityKeyStore.java:309) ~[?:?]
	at org.opensearch.security.ssl.DefaultSecurityKeyStore.<init>(DefaultSecurityKeyStore.java:215) ~[?:?]
	at org.opensearch.security.ssl.OpenSearchSecuritySSLPlugin.<init>(OpenSearchSecuritySSLPlugin.java:235) ~[?:?]
	at org.opensearch.security.OpenSearchSecurityPlugin.<init>(OpenSearchSecurityPlugin.java:297) ~[?:?]
	at java.base/jdk.internal.reflect.DirectConstructorHandleAccessor.newInstance(DirectConstructorHandleAccessor.java:62) ~[?:?]
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:502) ~[?:?]
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:486) ~[?:?]
	at org.opensearch.plugins.PluginsService.loadPlugin(PluginsService.java:782) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.plugins.PluginsService.loadBundle(PluginsService.java:731) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.plugins.PluginsService.loadBundles(PluginsService.java:533) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.plugins.PluginsService.<init>(PluginsService.java:195) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.node.Node.<init>(Node.java:484) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.node.Node.<init>(Node.java:411) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:242) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.Bootstrap.setup(Bootstrap.java:242) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.Bootstrap.init(Bootstrap.java:404) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:180) ~[opensearch-3.0.0.jar:3.0.0]
	... 6 more
Caused by: org.opensearch.OpenSearchException: Unable to read /usr/share/opensearch/config/esnode.pem (/usr/share/opensearch/config/esnode.pem). Please make sure this files exists and is readable regarding to permissions. Property: plugins.security.ssl.transport.pemcert_filepath
	at org.opensearch.security.ssl.DefaultSecurityKeyStore.checkPath(DefaultSecurityKeyStore.java:1172) ~[?:?]
	at org.opensearch.security.ssl.DefaultSecurityKeyStore.resolve(DefaultSecurityKeyStore.java:287) ~[?:?]
	at org.opensearch.security.ssl.DefaultSecurityKeyStore.initTransportSSLConfig(DefaultSecurityKeyStore.java:465) ~[?:?]
	at org.opensearch.security.ssl.DefaultSecurityKeyStore.initSSLConfig(DefaultSecurityKeyStore.java:309) ~[?:?]
	at org.opensearch.security.ssl.DefaultSecurityKeyStore.<init>(DefaultSecurityKeyStore.java:215) ~[?:?]
	at org.opensearch.security.ssl.OpenSearchSecuritySSLPlugin.<init>(OpenSearchSecuritySSLPlugin.java:235) ~[?:?]
	at org.opensearch.security.OpenSearchSecurityPlugin.<init>(OpenSearchSecurityPlugin.java:297) ~[?:?]
	at java.base/jdk.internal.reflect.DirectConstructorHandleAccessor.newInstance(DirectConstructorHandleAccessor.java:62) ~[?:?]
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:502) ~[?:?]
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:486) ~[?:?]
	at org.opensearch.plugins.PluginsService.loadPlugin(PluginsService.java:782) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.plugins.PluginsService.loadBundle(PluginsService.java:731) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.plugins.PluginsService.loadBundles(PluginsService.java:533) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.plugins.PluginsService.<init>(PluginsService.java:195) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.node.Node.<init>(Node.java:484) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.node.Node.<init>(Node.java:411) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:242) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.Bootstrap.setup(Bootstrap.java:242) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.Bootstrap.init(Bootstrap.java:404) ~[opensearch-3.0.0.jar:3.0.0]
	at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:180) ~[opensearch-3.0.0.jar:3.0.0]
	... 6 more
java.lang.IllegalStateException: failed to load plugin class [org.opensearch.security.OpenSearchSecurityPlugin]
Likely root cause: OpenSearchException[Unable to read /usr/share/opensearch/config/esnode.pem (/usr/share/opensearch/config/esnode.pem). Please make sure this files exists and is readable regarding to permissions. Property: plugins.security.ssl.transport.pemcert_filepath]
	at org.opensearch.security.ssl.DefaultSecurityKeyStore.checkPath(DefaultSecurityKeyStore.java:1172)
	at org.opensearch.security.ssl.DefaultSecurityKeyStore.resolve(DefaultSecurityKeyStore.java:287)
	at org.opensearch.security.ssl.DefaultSecurityKeyStore.initTransportSSLConfig(DefaultSecurityKeyStore.java:465)
	at org.opensearch.security.ssl.DefaultSecurityKeyStore.initSSLConfig(DefaultSecurityKeyStore.java:309)
	at org.opensearch.security.ssl.DefaultSecurityKeyStore.<init>(DefaultSecurityKeyStore.java:215)
	at org.opensearch.security.ssl.OpenSearchSecuritySSLPlugin.<init>(OpenSearchSecuritySSLPlugin.java:235)
	at org.opensearch.security.OpenSearchSecurityPlugin.<init>(OpenSearchSecurityPlugin.java:297)
	at java.base/jdk.internal.reflect.DirectConstructorHandleAccessor.newInstance(DirectConstructorHandleAccessor.java:62)
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:502)
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:486)
	at org.opensearch.plugins.PluginsService.loadPlugin(PluginsService.java:782)
	at org.opensearch.plugins.PluginsService.loadBundle(PluginsService.java:731)
	at org.opensearch.plugins.PluginsService.loadBundles(PluginsService.java:533)
	at org.opensearch.plugins.PluginsService.<init>(PluginsService.java:195)
	at org.opensearch.node.Node.<init>(Node.java:484)
	at org.opensearch.node.Node.<init>(Node.java:411)
	at org.opensearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:242)
	at org.opensearch.bootstrap.Bootstrap.setup(Bootstrap.java:242)
	at org.opensearch.bootstrap.Bootstrap.init(Bootstrap.java:404)
	at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:180)
	at org.opensearch.bootstrap.OpenSearch.execute(OpenSearch.java:171)
	at org.opensearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:104)
	at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
	at org.opensearch.cli.Command.main(Command.java:101)
	at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:137)
	at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:103)
For complete error details, refer to the log at /usr/share/opensearch/logs/opensearch-cluster.log

How can one reproduce the bug?
Steps to reproduce the behavior:

Go to '...'
Click on '....'
Scroll down to '....'
See error

What is the expected behavior?
A clear and concise description of what you expected to happen.
What is your host/environment?

OS: [e.g. iOS]
Version [e.g. 22]
Plugins

Do you have any screenshots?
If applicable, add screenshots to help explain your problem.
Do you have any additional context?
Add any other context about the problem.

While I was debugging the issue in my stack, I found this commit https://github.com/opensearch-project/security/commit/17748b9e7edb143ff108d45483e2333f70ab15df might potentially be backward incompatible.
In my opensearch setup(for testing purpose), I manage the security configuration in opensearch.yml and internal_users.yml by myself(write permission to these files are removed). So I don't need security plugin to setup it for me. But I DO need security plugin to setup demo certificates files.
Previously, with the old install_demo_configuration.sh, demo certificates setup was happened before setting up admin user, so even the script exit when setting up admin user, the demo certificate files are still created.
Now, in the new implementation, it seems admin user setup is before certificates setup, so if that failed, demo certificates won't be created.
securitySettingsConfigurer.configureSecuritySettings();
certificateGenerator.createDemoCertificates();

[Triage] Hi @ruanyl, thank you for filing this issue. Someone will follow-up to try to diagnose this bug and make a fix if one is possible. Thank you for posting the logs and reproduction steps!

@ruanyl seen the same issue with helm charts and with OpenSearch 2.12.0, One common cause is having multiple VolumeMounts on the same path, especially in subdirectories, which can lead to the "device or resource busy" error. With the new the install_demo_configuration.sh updating the internal_users.yml file hence you see this error Device or resource busy.
I was able to make this work by adding the following and creating the internal_users.yml  as configmap
extraVolumes:
  - name: internal-users-emptydir
    emptyDir: {}
  - name: internal-users
    configMap:
      name: internal-users
      items:
      - key: internal_users.yml
        path: internal_users.yml

extraVolumeMounts:
    - name: internal-users-emptydir
      mountPath: /usr/share/opensearch/config/opensearch-security/
      subPath: internal_users.yml
    - name: internal-users
      mountPath: /tmp/internal_users.yml
      subPath: internal_users.yml

extraInitContainers:
  - name: internal-users-init-container
    image: busybox
    command: ['sh', '-c', 'cp /tmp/internalusers/internal_users.yml /tmp/internal_users.yml']
    volumeMounts:
    - mountPath: /tmp/internal_users.yml
      subPath: internal_users.yml
      name: internal-users-emptydir
    - name: internal-users
      mountPath: /tmp/internalusers/internal_users.yml
      subPath: internal_users.yml

What it technically does it:

The internal_users.yml is not created as an seperate configmap.
The configmap is 1st mounted to a /tmp/ directory from above configmap.
This   internal_users.yml now part of the /tmp/ folder acts as a new mount and later copied to /usr/share/opensearch/config/opensearch-security/.
During startup the security index is now created with the user data part of the internal_users.yml avoiding the error Device or resource busy

This error shows because the demo setup requires an admin password to be supplied, which demo config then generates hash and writes to internal_users.yml. But since docker has locked the file path with the mount for custom internal_users.yml, it throws this error. Currently, there is no way to just use demo certificates and supply custom internal_users. This could be a future improvement for the tool.

Wouldn't it be better to actually check internal_users.yml if it contains strong admin password before trying to write into it? Read is compatible with k8s mount. Right now, we can't update to 2.12 even though we have already set strong admin password (through mounting custom internal_users.yml) - the deployment is broken because it is trying to write into read-only file, just like OP brought up.

@geckiss We can do that, but that opens up the possibility to add any string as password for admin user. Since the values are stored as hash, there is no way to validate the strength of the updated password. I understand that this would solve the problem at hand, but the responsibility would then be onto the user to supply strong password.
However, if the use-case for providing a custom internal_users.yml and utilizing the demo setup tool solely for demo certificates generation, wouldn't it be better if certificate generation would be a separate toggle-able feature?

I tried the workaround provided by @prudhvigodithi but the problem is that the directory /usr/share/opensearch/config/opensearch-security/ ends completely empty besides the internal_users.yml file
To fix the issue, I opted for copying all the files from the opensearch image to the emptydir volume
extraVolumes:
  - name: security-emptydir
    emptyDir: {}
  - name: internal-users
    configMap:
      name: internal-users
      items:
      - key: internal_users.yml
        path: internal_users.yml

extraVolumeMounts:
    - name: security-emptydir
      mountPath: /usr/share/opensearch/config/opensearch-security/

extraInitContainers:
  - image: opensearchproject/opensearch:2.12.0
    name: init-security-dir
    command:
      - sh
      - -c
      - cp /usr/share/opensearch/config/opensearch-security/* /tmp/emptydir/
      - cp /tmp/internal_users.yml /tmp/emptydir/internal_users.yml
    volumeMounts:
    - name: security-emptydir
      mountPath: /tmp/emptydir
    - name: internal-users
      mountPath: /tmp/internal_users.yml
      subPath: internal_users.yml

Hey @fmr-disy do you have this dataComplete: false in your values file?
https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml#L352
Adding @bbarani @peterzhuamazon

Hey @fmr-disy did you try with the dataComplete: false in your values file? https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml#L352 Adding @bbarani @peterzhuamazon

Thanks for your quick reaction. I tested it setting the parameter securityConfig.config.dataComplete to false and it makes no difference. Unless you add all the security configuration files in securityConfig.config.data. Please see here: https://github.com/opensearch-project/helm-charts/blob/0dfa6066e9a8fb5a4cf76ffcfcd02650e2ee6090/charts/opensearch/templates/statefulset.yaml#L476

Hey @fmr-disy, following are my values.yaml and internal_users.yml files, following the steps above https://github.com/opensearch-project/security/issues/3891#issuecomment-1958398284, can you please test agin?
_meta:
  type: "internalusers"
  config_version: 2

# Define your internal users here

## Demo users

admin:
  hash: "$2y$12$ZPHBXj3AHQ3OBW0afObVT.G9bmEUguVrotnu3MsL/Q74WP.aNSjqi"
  reserved: false
  backend_roles:
  - "admin"
  description: "Demo admin user"

kibanaserver:
  hash: "$2y$12$fYudyhWT/xks1IZhko5Osuja3yrpt8NrQjXN.HdACfIs4uMy5TGKC"
  reserved: true
  description: "Demo OpenSearch Dashboards user"

kibanaro:
  hash: "$2y$12$O7ZpyD71zss2i.KafEA9GeRtKs8Ch2hSN8HtbcT1xCUwJPWVN7Y3u"
  reserved: false
  backend_roles:
  - "kibanauser"
  - "readall"
  attributes:
    attribute1: "value1"
    attribute2: "value2"
    attribute3: "value3"
  description: "Demo OpenSearch Dashboards read only user"

logstash:
  hash: "$2y$12$.iY36ILKEixrPF1ioV8in.vNlFVCW8wsy1Gf9m.mXlbT0U9QmvBK2"
  reserved: false
  backend_roles:
  - "logstash"
  description: "Demo logstash user"

readall:
  hash: "$2y$12$15huaUhaiNxHiP0JIhf.QeB9NVsB/nTiSytIT1DQJfXCEKKJaIy8C"
  reserved: false
  backend_roles:
  - "readall"
  description: "Demo readall user"

snapshotrestore:
  hash: "$2y$12$dyT.lMC1GdPwOVBSxfnS5ebGBH9S2.SkVI/F6D6ASy90oX8SdAxV."
  reserved: false
  backend_roles:
  - "snapshotrestore"
  description: "Demo snapshotrestore user"

---
clusterName: "opensearch-cluster"
nodeGroup: "master"

# If discovery.type in the opensearch configuration is set to "single-node",
# this should be set to "true"
# If "true", replicas will be forced to 1
singleNode: false

# The service that non master groups will try to connect to when joining the cluster
# This should be set to clusterName + "-" + nodeGroup for your master group
masterService: "opensearch-cluster-master"

# OpenSearch roles that will be applied to this nodeGroup
# These will be set as environment variable "node.roles". E.g. node.roles=master,ingest,data,remote_cluster_client
roles:
  - master
  - ingest
  - data
  - remote_cluster_client

replicas: 3

# if not set, falls back to parsing .Values.imageTag, then .Chart.appVersion.
majorVersion: ""

global:
  # Set if you want to change the default docker registry, e.g. a private one.
  dockerRegistry: ""

# Allows you to add any config files in {{ .Values.opensearchHome }}/config
opensearchHome: /usr/share/opensearch

# such as opensearch.yml and log4j2.properties
config:
  # # Values must be YAML literal style scalar / YAML multiline string.
  # # <filename>: |
  # #   <formatted-value(s)>
  # # log4j2.properties: |
  # #   status = error
  # #
  # #   appender.console.type = Console
  # #   appender.console.name = console
  # #   appender.console.layout.type = PatternLayout
  # #   appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n
  # #
  # #   rootLogger.level = info
  # #   rootLogger.appenderRef.console.ref = console
  opensearch.yml: |
    cluster.name: opensearch-cluster

    # Bind to all interfaces because we don't know what IP address Docker will assign to us.
    network.host: <IP_ADDRESS>

    # Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again.
    # Implicitly done if ".singleNode" is set to "true".
    # discovery.type: single-node

    # Start OpenSearch Security Demo Configuration
    # WARNING: revise all the lines below before you go into production
    plugins:
      security:
        ssl:
          transport:
            pemcert_filepath: esnode.pem
            pemkey_filepath: esnode-key.pem
            pemtrustedcas_filepath: root-ca.pem
            enforce_hostname_verification: false
          http:
            enabled: true
            pemcert_filepath: esnode.pem
            pemkey_filepath: esnode-key.pem
            pemtrustedcas_filepath: root-ca.pem
        allow_unsafe_democertificates: true
        allow_default_init_securityindex: true
        authcz:
          admin_dn:
            - CN=kirk,OU=client,O=client,L=test,C=de
        audit.type: internal_opensearch
        enable_snapshot_restore_privilege: true
        check_snapshot_restore_write_privileges: true
        restapi:
          roles_enabled: ["all_access", "security_rest_api_access"]
        system_indices:
          enabled: true
          indices:
            [
              ".opendistro-alerting-config",
              ".opendistro-alerting-alert*",
              ".opendistro-anomaly-results*",
              ".opendistro-anomaly-detector*",
              ".opendistro-anomaly-checkpoints",
              ".opendistro-anomaly-detection-state",
              ".opendistro-reports-*",
              ".opendistro-notifications-*",
              ".opendistro-notebooks",
              ".opendistro-asynchronous-search-response*",
            ]
    ######## End OpenSearch Security Demo Configuration ########
  # log4j2.properties:

# Extra environment variables to append to this nodeGroup
# This will be appended to the current 'env:' key. You can use any of the kubernetes env
# syntax here
extraEnvs: []
#  - name: MY_ENVIRONMENT_VAR
#    value: the_value_goes_here
# Chart version 2.18.0 and App Version OpenSearch 2.12.0 onwards a custom strong password needs to be provided in order to setup demo admin user.
# Cluster will not spin-up without this unless demo config install is disabled.
#  - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
#    value: <strong-password>

# Allows you to load environment variables from kubernetes secret or config map
envFrom: []
# - secretRef:
#     name: env-secret
# - configMapRef:
#     name: config-map

# A list of secrets and their paths to mount inside the pod
# This is useful for mounting certificates for security and for mounting
# the X-Pack license
secretMounts: []

hostAliases: []
# - ip: "<IP_ADDRESS>"
#   hostnames:
#   - "foo.local"
#   - "bar.local"

image:
  repository: "opensearchproject/opensearch"
  # override image tag, which is .Chart.AppVersion by default
  tag: ""
  pullPolicy: "IfNotPresent"

podAnnotations: {}
  # iam.amazonaws.com/role: es-cluster

# OpenSearch Statefulset annotations
openSearchAnnotations: {}

# additionals labels
labels: {}

opensearchJavaOpts: "-Xmx512M -Xms512M"

resources:
  requests:
    cpu: "1000m"
    memory: "100Mi"

initResources: {}
#  limits:
#     cpu: "25m"
#     memory: "128Mi"
#  requests:
#     cpu: "25m"
#     memory: "128Mi"

sidecarResources: {}
#   limits:
#     cpu: "25m"
#     memory: "128Mi"
#   requests:
#     cpu: "25m"
#     memory: "128Mi"

networkHost: "<IP_ADDRESS>"

rbac:
  create: false
  serviceAccountAnnotations: {}
  serviceAccountName: ""
  # Controls whether or not the Service Account token is automatically mounted to /var/run/secrets/kubernetes.io/serviceaccount
  automountServiceAccountToken: false

podSecurityPolicy:
  create: false
  name: ""
  spec:
    privileged: true
    fsGroup:
      rule: RunAsAny
    runAsUser:
      rule: RunAsAny
    seLinux:
      rule: RunAsAny
    supplementalGroups:
      rule: RunAsAny
    volumes:
      - secret
      - configMap
      - persistentVolumeClaim
      - emptyDir

persistence:
  enabled: true
  # Set to false to disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk.
  enableInitChown: true
  # override image, which is busybox by default
  # image: busybox
  # override image tag, which is latest by default
  # imageTag:
  labels:
    # Add default labels for the volumeClaimTemplate of the StatefulSet
    enabled: false
  # OpenSearch Persistent Volume Storage Class
  # If defined, storageClassName: <storageClass>
  # If set to "-", storageClassName: "", which disables dynamic provisioning
  # If undefined (the default) or set to null, no storageClassName spec is
  #   set, choosing the default provisioner.  (gp2 on AWS, standard on
  #   GKE, AWS & OpenStack)
  #
  # storageClass: "-"
  accessModes:
    - ReadWriteOnce
  size: 8Gi
  annotations: {}

extraVolumes:
  - name: internal-users-emptydir
    emptyDir: {}
  - name: internal-users
    configMap:
      name: internal-users
      items:
      - key: internal_users.yml
        path: internal_users.yml

extraVolumeMounts:
    - name: internal-users-emptydir
      mountPath: /usr/share/opensearch/config/opensearch-security/
      subPath: internal_users.yml
    - name: internal-users
      mountPath: /tmp/internal_users.yml
      subPath: internal_users.yml

extraContainers: []
  # - name: do-something
  #   image: busybox
  #   command: ['do', 'something']

extraInitContainers:
  - name: internal-users-init-container
    image: busybox
    command: ['sh', '-c', 'cp /tmp/internalusers/internal_users.yml /tmp/internal_users.yml']
    volumeMounts:
    - mountPath: /tmp/internal_users.yml
      subPath: internal_users.yml
      name: internal-users-emptydir
    - name: internal-users
      mountPath: /tmp/internalusers/internal_users.yml
      subPath: internal_users.yml
  #- name: do-somethings
  #  image: busybox
  #  command: ['cp', '/tmp/internal_users.yml', '/usr/share/opensearch/config/opensearch-security/internal_users.yml']

# This is the PriorityClass settings as defined in
# https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
priorityClassName: ""

# By default this will make sure two pods don't end up on the same node
# Changing this to a region would allow you to spread pods across regions
antiAffinityTopologyKey: "kubernetes.io/hostname"

# Hard means that by default pods will only be scheduled if there are enough nodes for them
# and that they will never end up on the same node. Setting this to soft will do this "best effort".
# Setting this to custom will use what is passed into customAntiAffinity.
antiAffinity: "soft"

# Allows passing in custom anti-affinity settings as defined in
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
# Using this parameter requires setting antiAffinity to custom.
customAntiAffinity: {}

# This is the node affinity settings as defined in
# https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature
nodeAffinity: {}

# This is the pod affinity settings as defined in
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
podAffinity: {}

# This is the pod topology spread constraints
# https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
topologySpreadConstraints: []

# The default is to deploy all pods serially. By setting this to parallel all pods are started at
# the same time when bootstrapping the cluster
podManagementPolicy: "Parallel"

# The environment variables injected by service links are not used, but can lead to slow OpenSearch boot times when
# there are many services in the current namespace.
# If you experience slow pod startups you probably want to set this to `false`.
enableServiceLinks: true

protocol: https
httpPort: 9200
transportPort: 9300
metricsPort: 9600
httpHostPort: ""
transportHostPort: ""

service:
  labels: {}
  labelsHeadless: {}
  headless:
    annotations: {}
  type: ClusterIP
  # The IP family and IP families options are to set the behaviour in a dual-stack environment
  # Omitting these values will let the service fall back to whatever the CNI dictates the defaults
  # should be
  #
  # ipFamilyPolicy: SingleStack
  # ipFamilies:
  # - IPv4
  nodePort: ""
  annotations: {}
  httpPortName: http
  transportPortName: transport
  metricsPortName: metrics
  loadBalancerIP: ""
  loadBalancerSourceRanges: []
  externalTrafficPolicy: ""

updateStrategy: RollingUpdate

# This is the max unavailable setting for the pod disruption budget
# The default value of 1 will make sure that kubernetes won't allow more than 1
# of your pods to be unavailable during maintenance
maxUnavailable: 1

podSecurityContext:
  fsGroup: 1000
  runAsUser: 1000

securityContext:
  capabilities:
    drop:
      - ALL
  # readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 1000

securityConfig:
  enabled: true
  path: "/usr/share/opensearch/config/opensearch-security"
  actionGroupsSecret:
  configSecret:
  internalUsersSecret:
  rolesSecret:
  rolesMappingSecret:
  tenantsSecret:
  # The following option simplifies securityConfig by using a single secret and
  # specifying the config files as keys in the secret instead of creating
  # different secrets for for each config file.
  # Note that this is an alternative to the individual secret configuration
  # above and shouldn't be used if the above secrets are used.
  config:
    # There are multiple ways to define the configuration here:
    # * If you define anything under data, the chart will automatically create
    #   a secret and mount it. This is best option to choose if you want to override all the
    #   existing yml files at once.
    # * If you define securityConfigSecret, the chart will assume this secret is
    #   created externally and mount it. This is best option to choose if your intention is to
    #   only update a single yml file.
    # * It is an error to define both data and securityConfigSecret.
    securityConfigSecret: ""
    dataComplete: false
    data:
      config.yml: |
        _meta:
          type: "config"
          config_version: 2

        config:
          dynamic:
            # Set filtered_alias_mode to 'disallow' to forbid more than 2 filtered aliases per index
            # Set filtered_alias_mode to 'warn' to allow more than 2 filtered aliases per index but warns about it (default)
            # Set filtered_alias_mode to 'nowarn' to allow more than 2 filtered aliases per index silently
            #filtered_alias_mode: warn
            #do_not_fail_on_forbidden: false
            kibana:
              multitenancy_enabled: false
            #server_username: kibanaserver
            #index: '.kibana'
            http:
              anonymous_auth_enabled: true
              xff:
                enabled: false
                internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern
                #internalProxies: '.*' # trust all internal proxies, regex pattern
                #remoteIpHeader:  'x-forwarded-for'
                ###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help
                ###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For
                ###### and here https://tools.ietf.org/html/rfc7239
                ###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve
            authc:
              kerberos_auth_domain:
                http_enabled: false
                transport_enabled: false
                order: 6
                http_authenticator:
                  type: kerberos
                  challenge: true
                  config:
                    # If true a lot of kerberos/security related debugging output will be logged to standard out
                    krb_debug: false
                    # If true then the realm will be stripped from the user name
                    strip_realm_from_principal: true
                authentication_backend:
                  type: noop
              basic_internal_auth_domain:
                description: "Authenticate via HTTP Basic against internal users database"
                http_enabled: true
                transport_enabled: true
                order: 4
                http_authenticator:
                  type: basic
                  challenge: true
                authentication_backend:
                  type: intern
              proxy_auth_domain:
                description: "Authenticate via proxy"
                http_enabled: false
                transport_enabled: false
                order: 3
                http_authenticator:
                  type: proxy
                  challenge: false
                  config:
                    user_header: "x-proxy-user"
                    roles_header: "x-proxy-roles"
                authentication_backend:
                  type: noop
              jwt_auth_domain:
                description: "Authenticate via Json Web Token"
                http_enabled: false
                transport_enabled: false
                order: 0
                http_authenticator:
                  type: jwt
                  challenge: false
                  config:
                    signing_key: "base64 encoded HMAC key or public RSA/ECDSA pem key"
                    jwt_header: "Authorization"
                    jwt_url_parameter: null
                    roles_key: null
                    subject_key: null
                authentication_backend:
                  type: noop
              clientcert_auth_domain:
                description: "Authenticate via SSL client certificates"
                http_enabled: false
                transport_enabled: false
                order: 2
                http_authenticator:
                  type: clientcert
                  config:
                    username_attribute: cn #optional, if omitted DN becomes username
                  challenge: false
                authentication_backend:
                  type: noop
              ldap:
                description: "Authenticate via LDAP or Active Directory"
                http_enabled: false
                transport_enabled: false
                order: 5
                http_authenticator:
                  type: basic
                  challenge: false
                authentication_backend:
                  # LDAP authentication backend (authenticate users against a LDAP or Active Directory)
                  type: ldap
                  config:
                    # enable ldaps
                    enable_ssl: false
                    # enable start tls, enable_ssl should be false
                    enable_start_tls: false
                    # send client certificate
                    enable_ssl_client_auth: false
                    # verify ldap hostname
                    verify_hostnames: true
                    hosts:
                    - localhost:8389
                    bind_dn: null
                    password: null
                    userbase: 'ou=people,dc=example,dc=com'
                    # Filter to search for users (currently in the whole subtree beneath userbase)
                    # {0} is substituted with the username
                    usersearch: '(sAMAccountName={0})'
                    # Use this attribute from the user as username (if not set then DN is used)
                    username_attribute: null
            authz:
              roles_from_myldap:
                description: "Authorize via LDAP or Active Directory"
                http_enabled: false
                transport_enabled: false
                authorization_backend:
                  # LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too)
                  type: ldap
                  config:
                    # enable ldaps
                    enable_ssl: false
                    # enable start tls, enable_ssl should be false
                    enable_start_tls: false
                    # send client certificate
                    enable_ssl_client_auth: false
                    # verify ldap hostname
                    verify_hostnames: true
                    hosts:
                    - localhost:8389
                    bind_dn: null
                    password: null
                    rolebase: 'ou=groups,dc=example,dc=com'
                    # Filter to search for roles (currently in the whole subtree beneath rolebase)
                    # {0} is substituted with the DN of the user
                    # {1} is substituted with the username
                    # {2} is substituted with an attribute value from user's directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute
                    rolesearch: '(member={0})'
                    # Specify the name of the attribute which value should be substituted with {2} above
                    userroleattribute: null
                    # Roles as an attribute of the user entry
                    userrolename: disabled
                    #userrolename: memberOf
                    # The attribute in a role entry containing the name of that role, Default is "name".
                    # Can also be "dn" to use the full DN as rolename.
                    rolename: cn
                    # Resolve nested roles transitive (roles which are members of other roles and so on ...)
                    resolve_nested_roles: true
                    userbase: 'ou=people,dc=example,dc=com'
                    # Filter to search for users (currently in the whole subtree beneath userbase)
                    # {0} is substituted with the username
                    usersearch: '(uid={0})'
                    # Skip users matching a user name, a wildcard or a regex pattern
                    #skip_users:
                    #  - 'cn=Michael Jackson,ou*people,o=TEST'
                    #  - '/\S*/'
              roles_from_another_ldap:
                description: "Authorize via another Active Directory"
                http_enabled: false
                transport_enabled: false
                authorization_backend:
                  type: ldap
      roles.yml: |
        _meta:
          type: "roles"
          config_version: 2

        # Restrict users so they can only view visualization and dashboard on OpenSearchDashboards
        kibana_read_only:
          reserved: true

        # The security REST API access role is used to assign specific users access to change the security settings through the REST API.
        security_rest_api_access:
          reserved: true

        # Allows users to view monitors, destinations and alerts
        alerting_read_access:
          reserved: true
          cluster_permissions:
            - 'cluster:admin/opendistro/alerting/alerts/get'
            - 'cluster:admin/opendistro/alerting/destination/get'
            - 'cluster:admin/opendistro/alerting/destination/email_group/search'
            - 'cluster:admin/opendistro/alerting/destination/email_account/search'
            - 'cluster:admin/opendistro/alerting/monitor/get'
            - 'cluster:admin/opendistro/alerting/monitor/search'

        # Allows users to view and acknowledge alerts
        alerting_ack_alerts:
          reserved: true
          cluster_permissions:
            - 'cluster:admin/opendistro/alerting/alerts/*'

        # Allows users to use all alerting functionality
        alerting_full_access:
          reserved: true
          cluster_permissions:
            - 'cluster_monitor'
            - 'cluster:admin/opendistro/alerting/*'
          index_permissions:
            - index_patterns:
                - '*'
              allowed_actions:
                - 'indices_monitor'
                - 'indices:admin/aliases/get'
                - 'indices:admin/mappings/get'

        # Allow users to read Anomaly Detection detectors and results
        anomaly_read_access:
          reserved: true
          cluster_permissions:
            - 'cluster:admin/opendistro/ad/detector/info'
            - 'cluster:admin/opendistro/ad/detector/search'
            - 'cluster:admin/opendistro/ad/detectors/get'
            - 'cluster:admin/opendistro/ad/result/search'
            - 'cluster:admin/opendistro/ad/tasks/search'
            - 'cluster:admin/opendistro/ad/detector/validate'
            - 'cluster:admin/opendistro/ad/result/topAnomalies'

        # Allows users to use all Anomaly Detection functionality
        anomaly_full_access:
          reserved: true
          cluster_permissions:
            - 'cluster_monitor'
            - 'cluster:admin/opendistro/ad/*'
          index_permissions:
            - index_patterns:
                - '*'
              allowed_actions:
                - 'indices_monitor'
                - 'indices:admin/aliases/get'
                - 'indices:admin/mappings/get'

        # Allows users to read Notebooks
        notebooks_read_access:
          reserved: true
          cluster_permissions:
            - 'cluster:admin/opendistro/notebooks/list'
            - 'cluster:admin/opendistro/notebooks/get'

        # Allows users to all Notebooks functionality
        notebooks_full_access:
          reserved: true
          cluster_permissions:
            - 'cluster:admin/opendistro/notebooks/create'
            - 'cluster:admin/opendistro/notebooks/update'
            - 'cluster:admin/opendistro/notebooks/delete'
            - 'cluster:admin/opendistro/notebooks/get'
            - 'cluster:admin/opendistro/notebooks/list'

        # Allows users to read observability objects
        observability_read_access:
          reserved: true
          cluster_permissions:
            - 'cluster:admin/opensearch/observability/get'
            - 'cluster:admin/opensearch/ppl'

        # Allows users to all Observability functionality
        observability_full_access:
          reserved: true
          cluster_permissions:
            - 'cluster:admin/opensearch/observability/create'
            - 'cluster:admin/opensearch/observability/update'
            - 'cluster:admin/opensearch/observability/delete'
            - 'cluster:admin/opensearch/observability/get'

        # Allows users to read and download Reports
        reports_instances_read_access:
          reserved: true
          cluster_permissions:
            - 'cluster:admin/opendistro/reports/instance/list'
            - 'cluster:admin/opendistro/reports/instance/get'
            - 'cluster:admin/opendistro/reports/menu/download'

        # Allows users to read and download Reports and Report-definitions
        reports_read_access:
          reserved: true
          cluster_permissions:
            - 'cluster:admin/opendistro/reports/definition/get'
            - 'cluster:admin/opendistro/reports/definition/list'
            - 'cluster:admin/opendistro/reports/instance/list'
            - 'cluster:admin/opendistro/reports/instance/get'
            - 'cluster:admin/opendistro/reports/menu/download'

        # Allows users to all Reports functionality
        reports_full_access:
          reserved: true
          cluster_permissions:
            - 'cluster:admin/opendistro/reports/definition/create'
            - 'cluster:admin/opendistro/reports/definition/update'
            - 'cluster:admin/opendistro/reports/definition/on_demand'
            - 'cluster:admin/opendistro/reports/definition/delete'
            - 'cluster:admin/opendistro/reports/definition/get'
            - 'cluster:admin/opendistro/reports/definition/list'
            - 'cluster:admin/opendistro/reports/instance/list'
            - 'cluster:admin/opendistro/reports/instance/get'
            - 'cluster:admin/opendistro/reports/menu/download'

        # Allows users to use all asynchronous-search functionality
        asynchronous_search_full_access:
          reserved: true
          cluster_permissions:
            - 'cluster:admin/opendistro/asynchronous_search/*'
          index_permissions:
            - index_patterns:
                - '*'
              allowed_actions:
                - 'indices:data/read/search*'

        # Allows users to read stored asynchronous-search results
        asynchronous_search_read_access:
          reserved: true
          cluster_permissions:
            - 'cluster:admin/opendistro/asynchronous_search/get'

        # Allows user to use all index_management actions - ism policies, rollups, transforms
        index_management_full_access:
          reserved: true
          cluster_permissions:
            - "cluster:admin/opendistro/ism/*"
            - "cluster:admin/opendistro/rollup/*"
            - "cluster:admin/opendistro/transform/*"
          index_permissions:
            - index_patterns:
                - '*'
              allowed_actions:
                - 'indices:admin/opensearch/ism/*'

        # Allows users to use all cross cluster replication functionality at leader cluster
        cross_cluster_replication_leader_full_access:
          reserved: true
          index_permissions:
            - index_patterns:
                - '*'
              allowed_actions:
                - "indices:admin/plugins/replication/index/setup/validate"
                - "indices:data/read/plugins/replication/changes"
                - "indices:data/read/plugins/replication/file_chunk"

        # Allows users to use all cross cluster replication functionality at follower cluster
        cross_cluster_replication_follower_full_access:
          reserved: true
          cluster_permissions:
            - "cluster:admin/plugins/replication/autofollow/update"
          index_permissions:
            - index_patterns:
                - '*'
              allowed_actions:
                - "indices:admin/plugins/replication/index/setup/validate"
                - "indices:data/write/plugins/replication/changes"
                - "indices:admin/plugins/replication/index/start"
                - "indices:admin/plugins/replication/index/pause"
                - "indices:admin/plugins/replication/index/resume"
                - "indices:admin/plugins/replication/index/stop"
                - "indices:admin/plugins/replication/index/update"
                - "indices:admin/plugins/replication/index/status_check"

        # Allow users to read ML stats/models/tasks
        ml_read_access:
          reserved: true
          cluster_permissions:
            - 'cluster:admin/openserach/ml/stats'
            - 'cluster:admin/opensearch/ml/models/get'
            - 'cluster:admin/opensearch/ml/models/search'
            - 'cluster:admin/opensearch/ml/tasks/get'
            - 'cluster:admin/opensearch/ml/tasks/search'

        # Allows users to read Notifications config/channels
        notifications_read_access:
          reserved: true
          cluster_permissions:
            - 'cluster:admin/opensearch/notifications/configs/get'
            - 'cluster:admin/opensearch/notifications/features'
            - 'cluster:admin/opensearch/notifications/channels/get'

        # Allows users to see snapshots, repositories, and snapshot management policies
        snapshot_management_read_access:
          reserved: true
          cluster_permissions:
            - 'cluster:admin/opensearch/snapshot_management/policy/get'
            - 'cluster:admin/opensearch/snapshot_management/policy/search'
            - 'cluster:admin/opensearch/snapshot_management/policy/explain'
            - 'cluster:admin/repository/get'
            - 'cluster:admin/snapshot/get'

        # Allows users to use all ML functionality
        ml_full_access:
          reserved: true
          cluster_permissions:
            - 'cluster_monitor'
            - 'cluster:admin/opensearch/ml/*'
          index_permissions:
            - index_patterns:
                - '*'
              allowed_actions:
                - 'indices_monitor'

        # Anonymous access role
        opendistro_security_anonymous_role:
          reserved: true
          cluster_permissions:
            # For using _cat/indices
            - 'cluster:monitor/state'
            - 'cluster:monitor/health'
            - 'cluster:monitor/nodes/info'
            # To enable read access to ISM
            - cluster:admin/opendistro/ism/policy/search
            - cluster:admin/opendistro/ism/managedindex/explain
            - cluster:admin/opendistro/rollup/search
            - cluster:admin/opendistro/transform/get_transforms
            # To enable read access to various ISM Jobs
            - cluster:admin/opendistro/rollup/explain
            - cluster:admin/opendistro/ism/policy/get
            - cluster:admin/opendistro/rollup/get
            - cluster:admin/opendistro/transform/explain
            - cluster:admin/opendistro/transform/get
            # To enable read access to security analytics
            - cluster:admin/opensearch/securityanalytics/rule/search
            - cluster:admin/opensearch/securityanalytics/detector/search
            - cluster:admin/opensearch/securityanalytics/findings/get
            - cluster:admin/opensearch/securityanalytics/alerts/get
            - cluster:admin/opensearch/securityanalytics/detector/get
            # For using sql join query
            - "indices:data/read/scroll*"
          index_permissions:
            - index_patterns:
              - ".kibana"
              - ".kibana-6"
              - ".kibana_*"
              - ".opensearch_dashboards"
              - ".opensearch_dashboards-6"
              - ".opensearch_dashboards_*"
              allowed_actions:
                - "read"
            - index_patterns:
              - ".tasks"
              - ".management-beats"
              - "*:.tasks"
              - "*:.management-beats"
              allowed_actions:
                - "read"
            - index_patterns:
              - 'opensearch_dashboards_sample_data_logs'
              - 'opensearch_dashboards_sample_data_flights'
              - 'opensearch_dashboards_sample_data_ecommerce'
              allowed_actions:
                - "read"
            - index_patterns:
              - '*'
              allowed_actions:
                - "read"
                - "indices:data/read/mget"
                - "indices:data/read/msearch"
                - "indices:data/read/mtv"
                - "indices:admin/get"
                - "indices:admin/aliases/exists*"
                - "indices:admin/aliases/get*"
                - "indices:admin/mappings/get"
                - "indices:data/read/scroll"
                - "indices:monitor/settings/get"
                - "indices:monitor/stats"
          tenant_permissions:
            - tenant_patterns:
              - '*'
              allowed_actions:
                - "kibana_all_read"
      roles_mapping.yml: |
        _meta:
          type: "rolesmapping"
          config_version: 2

        # Define your roles mapping here

        opendistro_security_anonymous_role:
          backend_roles:
          - "opendistro_security_anonymous_backendrole"

        alerting_read_access:
          backend_roles:
          - "opendistro_security_anonymous_backendrole"

        anomaly_read_access:
          backend_roles:
          - "opendistro_security_anonymous_backendrole"

        notebooks_read_access:
          backend_roles:
          - "opendistro_security_anonymous_backendrole"

        observability_read_access:
          backend_roles:
          - "opendistro_security_anonymous_backendrole"

        reports_instances_read_access:
          backend_roles:
          - "opendistro_security_anonymous_backendrole"

        reports_read_access:
          backend_roles:
          - "opendistro_security_anonymous_backendrole"

        asynchronous_search_read_access:
          backend_roles:
          - "opendistro_security_anonymous_backendrole"

        ml_read_access:
          backend_roles:
          - "opendistro_security_anonymous_backendrole"

        notifications_read_access:
          backend_roles:
          - "opendistro_security_anonymous_backendrole"

        snapshot_management_read_access:
          backend_roles:
          - "opendistro_security_anonymous_backendrole"

        ## Demo roles mapping

        all_access:
          reserved: false
          backend_roles:
          - "admin"
          description: "Maps admin to all_access"

        own_index:
          reserved: false
          users:
          - "*"
          description: "Allow full access to an index named like the username"

        logstash:
          reserved: false
          backend_roles:
          - "logstash"

        kibana_user:
          reserved: false
          backend_roles:
          - "kibanauser"
          description: "Maps kibanauser to kibana_user"

        readall:
          reserved: false
          backend_roles:
          - "readall"

        manage_snapshots:
          reserved: false
          backend_roles:
          - "snapshotrestore"

        kibana_server:
          reserved: true
          users:
          - "kibanaserver"

      action_groups.yml: |
        _meta:
          type: "actiongroups"
          config_version: 2
      tenants.yml: |
        _meta:
          type: "tenants"
          config_version: 2

        # Define your tenants here

        ## Demo tenants
        admin_tenant:
          reserved: false
          description: "Demo tenant for admin user"
      whitelist.yml: |
        config:
          enabled: false
          requests:
            /_cluster/settings:
              - GET
            /_cat/nodes:
              - GET
      nodes_dn.yml: |
        _meta:
          type: "nodesdn"
          config_version: 2
      audit.yml: |
        _meta:
          type: "audit"
          config_version: 2

        config:
          # enable/disable audit logging
          enabled: true

          audit:
            # Enable/disable REST API auditing
            enable_rest: true

            # Categories to exclude from REST API auditing
            disabled_rest_categories:
              - AUTHENTICATED
              - GRANTED_PRIVILEGES

            # Enable/disable Transport API auditing
            enable_transport: true

            # Categories to exclude from Transport API auditing
            disabled_transport_categories:
              - AUTHENTICATED
              - GRANTED_PRIVILEGES

            # Users to be excluded from auditing. Wildcard patterns are supported. Eg:
            # ignore_users: ["test-user", "employee-*"]
            ignore_users:
              - kibanaserver

            # Requests to be excluded from auditing. Wildcard patterns are supported. Eg:
            # ignore_requests: ["indices:data/read/*", "SearchRequest"]
            ignore_requests: []

            # Log individual operations in a bulk request
            resolve_bulk_requests: false

            # Include the body of the request (if available) for both REST and the transport layer
            log_request_body: true

            # Logs all indices affected by a request. Resolves aliases and wildcards/date patterns
            resolve_indices: true

            # Exclude sensitive headers from being included in the logs. Eg: Authorization
            exclude_sensitive_headers: true

          compliance:
            # enable/disable compliance
            enabled: true

            # Log updates to internal security changes
            internal_config: true

            # Log external config files for the node
            external_config: false

            # Log only metadata of the document for read events
            read_metadata_only: true

            # Map of indexes and fields to monitor for read events. Wildcard patterns are supported for both index names and fields. Eg:
            # read_watched_fields: {
            #   "twitter": ["message"]
            #   "logs-*": ["id", "attr*"]
            # }
            read_watched_fields: {}

            # List of users to ignore for read events. Wildcard patterns are supported. Eg:
            # read_ignore_users: ["test-user", "employee-*"]
            read_ignore_users:
              - kibanaserver

            # Log only metadata of the document for write events
            write_metadata_only: true

            # Log only diffs for document updates
            write_log_diffs: false

            # List of indices to watch for write events. Wildcard patterns are supported
            # write_watched_indices: ["twitter", "logs-*"]
            write_watched_indices: []

            # List of users to ignore for write events. Wildcard patterns are supported. Eg:
            # write_ignore_users: ["test-user", "employee-*"]
            write_ignore_users:
              - kibanaserver

# How long to wait for opensearch to stop gracefully
terminationGracePeriod: 120

sysctlVmMaxMapCount: 262144

startupProbe:
  tcpSocket:
    port: 9200
  initialDelaySeconds: 5
  periodSeconds: 10
  timeoutSeconds: 3
  failureThreshold: 30

livenessProbe: {}
  # periodSeconds: 20
  # timeoutSeconds: 5
  # failureThreshold: 10
  # successThreshold: 1
  # initialDelaySeconds: 10
  # tcpSocket:
  #   port: 9200

readinessProbe:
  tcpSocket:
    port: 9200
  periodSeconds: 5
  timeoutSeconds: 3
  failureThreshold: 3

## Use an alternate scheduler.
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
##
schedulerName: ""

imagePullSecrets: []
nodeSelector: {}
tolerations: []

# Enabling this will publically expose your OpenSearch instance.
# Only enable this if you have security enabled on your cluster
ingress:
  enabled: false
  # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName
  # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress
  # ingressClassName: nginx

  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
  ingressLabels: {}
  path: /
  hosts:
    - chart-example.local
  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

nameOverride: ""
fullnameOverride: ""

masterTerminationFix: false

opensearchLifecycle: {}
  # preStop:
  #   exec:
  #     command: ["/bin/sh", "-c", "echo Hello from the preStart handler > /usr/share/message"]
  # postStart:
  #   exec:
  #     command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]

lifecycle: {}
  # preStop:
  #   exec:
  #     command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
  # postStart:
  #   exec:
  #     command:
  #       - bash
  #       - -c
  #       - |
  #         #!/bin/bash
  #         # Add a template to adjust number of shards/replicas1
  #         TEMPLATE_NAME=my_template
  #         INDEX_PATTERN="logstash-*"
  #         SHARD_COUNT=8
  #         REPLICA_COUNT=1
  #         ES_URL=http://localhost:9200
  #         while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done
  #         curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}'

keystore: []
# To add secrets to the keystore:
#  - secretName: opensearch-encryption-key

networkPolicy:
  create: false
  ## Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now.
  ## In order for a Pod to access OpenSearch, it needs to have the following label:
  ## {{ template "uname" . }}-client: "true"
  ## Example for default configuration to access HTTP port:
  ## opensearch-master-http-client: "true"
  ## Example for default configuration to access transport port:
  ## opensearch-master-transport-client: "true"

  http:
    enabled: false

# Deprecated
# please use the above podSecurityContext.fsGroup instead
fsGroup: ""

## Set optimal sysctl's through securityContext. This requires privilege. Can be disabled if
## the system has already been preconfigured. (Ex: https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html)
## Also see: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
sysctl:
  enabled: false

## Set optimal sysctl's through privileged initContainer.
sysctlInit:
  enabled: false
  # override image, which is busybox by default
  # image: busybox
  # override image tag, which is latest by default
  # imageTag:

## Enable to add 3rd Party / Custom plugins not offered in the default OpenSearch image.
plugins:
  enabled: false
  installList: []
  # - example-fake-plugin

# -- Array of extra K8s manifests to deploy
extraObjects: []
  # - apiVersion: secrets-store.csi.x-k8s.io/v1
  #   kind: SecretProviderClass
  #   metadata:
  #     name: argocd-secrets-store
  #   spec:
  #     provider: aws
  #     parameters:
  #       objects: |
  #         - objectName: "argocd"
  #           objectType: "secretsmanager"
  #           jmesPath:
  #               - path: "client_id"
  #                 objectAlias: "client_id"
  #               - path: "client_secret"
  #                 objectAlias: "client_secret"
  #     secretObjects:
  #     - data:
  #       - key: client_id
  #         objectName: client_id
  #       - key: client_secret
  #         objectName: client_secret
  #       secretName: argocd-secrets-store
  #       type: Opaque
  #       labels:
  #         app.kubernetes.io/part-of: argocd
  # - |
  #    apiVersion: policy/v1
  #    kind: PodDisruptionBudget
  #    metadata:
  #      name: {{ template "opensearch.uname" . }}
  #      labels:
  #        {{- include "opensearch.labels" . | nindent 4 }}
  #    spec:
  #      minAvailable: 1
  #      selector:
  #        matchLabels:
  #          {{- include "opensearch.selectorLabels" . | nindent 6 }}


datastore: implement shared slices for autogenerated keys

suggested by @emilk in https://github.com/rerun-io/rerun/pull/1727#discussion_r1156813046

Done.

:x: Not done: this is about shared slices, not caches slices.


Cow: Watch grsba.com

Cow requests the watch of the watch_keyword grsba\.com. See the MS search here and the Stack Exchange search in text, in URLs, and in code.

grsba\.com has been seen in 1 true positive, 0 false positives, and 0 NAAs.

Approved by Dragonrage in Charcoal HQ


Single slot Image compilation fails when trying to build for TF-M NS Application on MPS2 board

Describe the bug

I am trying to  build a Non-Secure sample application for the mps2_an521 board. This build uses the TF-M BL2 port of MCUBoot. I want to enable the Single slot mechanism and therefore want TF-M and Zephyr to be merged as a single image to be loaded into a single MCUboot slot. When I enable the necessary macro on Zephyr west, the compilation fails.
To Reproduce

west build -p -b mps2_an521_ns samples/hello_world/ -DCONFIG_MCUBOOT_BOOTLOADER_MODE_SINGLE_APP=y -DCONFIG_SINGLE_APPLICATION_SLOT=y

I get the undefined symbol error.
zephyr/build/zephyr/misc/generated/extra_kconfig_options.conf:3: warning: attempt to assign the value 'y' to the undefined symbol SINGLE_APPLICATION_SLOT
Parsing /home/js/workdisk/zephyr_pristine/zephyr/Kconfig

I have tried -DCONFIG_MCUBOOT_SINGLE_APPLICATION_SLOT=y and -DSINGLE_APPLICATION_SLOT=y macros. I am not sure if the macro I am using is incorrect or if the build fails becasue of a bug on the zephyr side.
Thanks

@jayashree505 any chance you can bisect this?  It seems like a regression that likely got introduced recently.

I tried the same command for other boards supporting Trustzone - lpcxpresso55s69_ns, stm32l562e_dk_ns, with -DCONFIG_TFM_MCUBOOT_IMAGE_NUMBER=1 option included in build and I see the same behavior.
The build fails with Error: Image size (0x3fe1845) + trailer (0x1b0) exceeds requested size 0x3c000 Exceeded size error during the signing step. Are you asking if I can sign it manually?
I am also confused about that. In the Single image slot mechanism, should TF-M + Zephyr be merged and signed or should they be signed separately and merged?

@d3zd3z FYI this is the other TF-M looking issue we saw today.  @ithinuel


Closing a file opened in micro after a long time crashes main thread.

What system are you running Yazi on?
Linux Wayland
What terminal are you running Yazi in?
foot version: 1.16.2 +pgo +ime +graphemes -assertions
Yazi version
yazi 0.1.5 (63f81f6 2024-01-03)
Did you try the latest main branch to see if the problem has already been fixed?
Tried, but the problem is still present
Describe the bug
Closing a file opened in micro after a long time leads to:
The application panicked (crashed).
  index out of bounds: the len is 19459 but the index is 19673
in /home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/ratatui-0.25.0/src/buffer.rs, line 229
thread: main

This happened consistently on 2 files that I opened at roughly the same time.
I think this time the culprit is, that I left the files open for quite a long time, at least half an hour, as editing and closing files quickly does not lead to this crash.
This is similar to #456, but as it seems time-based it might be a buffer overflow type issue, as buffer.rs is mentioned.
Expected Behavior
No crash, por favor.
To Reproduce
See above.
Configuration
No response
Anything else?
No response

The error occured again. This time I copy and pasted a lot from and to the file, while not having it open for long.
So the crash seems not so time-based after all, but instead on how much data is modified.

Could you try running Yazi in debug mode by cargo run and copy more error information when the error occurs? The current error message is too vague and isn't helpful for troubleshooting.

This crash is quite difficult to reproduce, but this time I got it again with RUST_BACKTRACE=full.
Backtrace (most recent call first):
  File "<unknown>", line 0, in __libc_start_main

The application panicked (crashed).
  index out of bounds: the len is 5580 but the index is 5580
in /home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/ratatui-0.25.0/src/buffer.rs, line 229
thread: main

Unfortunately, this still doesn't help reproduce the issue.
From the logs, it seems that the error occurred within the ratatui TUI library used by Yazi. However, it's unclear what caused it. Is there any stack trace information above this error? That would be very helpful.

That is all I got.
I'll rebuild yazi with -C debuginfo=2 this time, but if theres a better way to obtain more information, please let me know.

Are you building in debug mode (cargo build) or release mode (cargo build --release)?

Oh yeah I was building it in release mode. Im using makepkg and I did not notice that.

Crashed again. But Im still only getting this:
Backtrace (most recent call first):
  File "<unknown>", line 0, in __libc_start_main

The application panicked (crashed).
  index out of bounds: the len is 20735 but the index is 20864
in /home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/ratatui-0.25.0/src/buffer.rs, line 229
thread: main

Hi, please use the code from https://github.com/sxyazi/yazi/issues/475 this PR, I've added some verbose logging. It might get very large if your operations are frequent, sorry I couldn't find a better way to reproduce it :)
If it crashes again, please paste the last part of ~/.local/state/yazi/yazi.log here (sensitive information may need to be removed).

So far I got these two unique errors.
  2024-01-06T14:00:24.371050Z ERROR yazi_scheduler::preload::preload: Preload task `mime.lua` returned 2
    at yazi-scheduler/src/preload/preload.rs:42

  2024-01-06T14:01:17.666306Z ERROR yazi_plugin::isolate::peek: cancelled
stack traceback:
	[string "yazi-plugin/src/isolate/peek.rs:29:21"]:1: in main chunk

    at yazi-plugin/src/isolate/peek.rs:49

They are unrelated errors related to preloading not the crash.

Just got the crash again, but no corresponding log entry....

Please paste the last 30 lines of ~/.local/state/yazi/yazi.log here

  2024-01-07T04:01:19.333213Z ERROR yazi_scheduler::preload::preload: Preload task `mime.lua` returned 2
    at yazi-scheduler/src/preload/preload.rs:42

  2024-01-07T04:01:29.379128Z ERROR yazi_scheduler::preload::preload: Preload task `mime.lua` returned 2
    at yazi-scheduler/src/preload/preload.rs:42

  2024-01-07T04:01:31.240015Z ERROR yazi_plugin::isolate::peek: cancelled
stack traceback:
	[string "yazi-plugin/src/isolate/peek.rs:29:21"]:1: in main chunk

    at yazi-plugin/src/isolate/peek.rs:49

  2024-01-07T04:02:02.619301Z ERROR yazi_plugin::isolate::peek: cancelled
stack traceback:
	[string "yazi-plugin/src/isolate/peek.rs:29:21"]:1: in main chunk

    at yazi-plugin/src/isolate/peek.rs:49

  2024-01-07T04:03:24.555160Z ERROR yazi_scheduler::preload::preload: Preload task `mime.lua` returned 2
    at yazi-scheduler/src/preload/preload.rs:42

  2024-01-07T04:23:00.847791Z ERROR yazi_scheduler::preload::preload: Preload task `mime.lua` returned 2
    at yazi-scheduler/src/preload/preload.rs:42

  2024-01-07T04:23:14.875292Z ERROR yazi_scheduler::preload::preload: Preload task `mime.lua` returned 2
    at yazi-scheduler/src/preload/preload.rs:42

  2024-01-07T04:23:26.632945Z ERROR yazi_scheduler::preload::preload: Preload task `mime.lua` returned 2
    at yazi-scheduler/src/preload/preload.rs:42

It seems like the changes in https://github.com/sxyazi/yazi/pull/483 haven't taken effect.
Are you building Yazi from that PR? If so, do a yazi -V should yield this output:
yazi 0.1.5 (5f80021 2024-01-06)

where 5f80021 is the commit hash in that PR.

Ok hold on. Im recompiling only using cargo. Makepkg seems to have messed with the whole thing.

Finally:
Backtrace (most recent call first):
  File "/home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/ratatui-0.25.0/src/buffer.rs", line 259, in ratatui::buffer::Buffer::index_of
    debug_assert!(
  File "/home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/ratatui-0.25.0/src/buffer.rs", line 228, in ratatui::buffer::Buffer::get_mut
    let i = self.index_of(x, y);
  File "/home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/ratatui-0.25.0/src/buffer.rs", line 383, in ratatui::buffer::Buffer::set_style
    self.get_mut(x, y).set_style(style);
  File "/home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/ratatui-0.25.0/src/widgets/paragraph.rs", line 284, in <ratatui::widgets::paragraph::Paragraph as ratatui::widgets::Widget>::render
    buf.set_style(area, self.style);
  File "/home/max/yazi/yazi-plugin/src/elements/paragraph.rs", line 81, in <yazi_plugin::elements::paragraph::Paragraph as yazi_plugin::elements::elements::Renderable>::render
    p.render(self.area, buf)
  File "/home/max/yazi/yazi-plugin/src/elements/paragraph.rs", line 84, in <yazi_plugin::elements::paragraph::Paragraph as yazi_plugin::elements::elements::Renderable>::clone_render
    fn clone_render(&self, buf: &mut ratatui::buffer::Buffer) { Box::new(self.clone()).render(buf) }
  File "/home/max/yazi/yazi-fm/src/components/preview.rs", line 26, in <yazi::components::preview::Preview as ratatui::widgets::Widget>::render
    w.clone_render(buf);
  File "/home/max/yazi/yazi-fm/src/root.rs", line 30, in <yazi::root::Root as ratatui::widgets::Widget>::render
    components::Preview::new(self.cx).render(area, buf);
  File "/home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/ratatui-0.25.0/src/terminal.rs", line 616, in ratatui::terminal::Frame::render_widget
    widget.render(area, self.buffer);
  File "/home/max/yazi/yazi-fm/src/app/commands/render.rs", line 19, in yazi::app::commands::render::<impl yazi::app::app::App>::render::{{closure}}::{{closure}}
    f.render_widget(Root::new(&self.cx), f.size());
  File "/home/max/yazi/yazi-fm/src/lives/lives.rs", line 39, in yazi::lives::lives::Lives::scope::{{closure}}
    f(scope);
  File "/home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/mlua-0.9.2/src/lua.rs", line 1855, in mlua::lua::Lua::scope
    f(&Scope::new(self))
  File "/home/max/yazi/yazi-fm/src/lives/lives.rs", line 26, in yazi::lives::lives::Lives::scope
    let result = LUA.scope(|scope| {
  File "/home/max/yazi/yazi-fm/src/app/commands/render.rs", line 17, in yazi::app::commands::render::<impl yazi::app::app::App>::render::{{closure}}
    Lives::scope(&self.cx, |_| {
  File "/home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/ratatui-0.25.0/src/terminal.rs", line 333, in ratatui::terminal::Terminal<B>::draw
    f(&mut frame);
  File "/home/max/yazi/yazi-fm/src/app/commands/render.rs", line 16, in yazi::app::commands::render::<impl yazi::app::app::App>::render
    let frame = term.draw(|f| {
  File "/home/max/yazi/yazi-fm/src/app/commands/stop.rs", line 31, in yazi::app::commands::stop::<impl yazi::app::app::App>::stop
    self.render().unwrap();
  File "/home/max/yazi/yazi-fm/src/executor.rs", line 87, in yazi::executor::Executor::app
    on!(stop);
  File "/home/max/yazi/yazi-fm/src/executor.rs", line 64, in yazi::executor::Executor::dispatch
    Layer::App => self.app(e),
  File "/home/max/yazi/yazi-fm/src/app/app.rs", line 82, in yazi::app::app::App::dispatch_call
    Executor::new(self).dispatch(&exec, layer);
  File "/home/max/yazi/yazi-fm/src/app/app.rs", line 35, in yazi::app::app::App::run::{{closure}}
    Event::Call(exec, layer) => app.dispatch_call(exec, layer),
  File "/home/max/yazi/yazi-fm/src/main.rs", line 42, in yazi::main::{{closure}}
    app::App::run().await
  File "/home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-1.35.1/src/runtime/park.rs", line 282, in tokio::runtime::park::CachedParkThread::block_on::{{closure}}
    if let Ready(v) = crate::runtime::coop::budget(|| f.as_mut().poll(&mut cx)) {
  File "/home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-1.35.1/src/runtime/coop.rs", line 107, in tokio::runtime::coop::with_budget
    f()
  File "/home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-1.35.1/src/runtime/coop.rs", line 73, in tokio::runtime::coop::budget
    with_budget(Budget::initial(), f)
  File "/home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-1.35.1/src/runtime/park.rs", line 282, in tokio::runtime::park::CachedParkThread::block_on
    if let Ready(v) = crate::runtime::coop::budget(|| f.as_mut().poll(&mut cx)) {
  File "/home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-1.35.1/src/runtime/context/blocking.rs", line 66, in tokio::runtime::context::blocking::BlockingRegionGuard::block_on
    park.block_on(f)
  File "/home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-1.35.1/src/runtime/scheduler/multi_thread/mod.rs", line 87, in tokio::runtime::scheduler::multi_thread::MultiThread::block_on::{{closure}}
    blocking.block_on(future).expect("failed to park thread")
  File "/home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-1.35.1/src/runtime/context/runtime.rs", line 65, in tokio::runtime::context::runtime::enter_runtime
    return f(&mut guard.blocking);
  File "/home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-1.35.1/src/runtime/scheduler/multi_thread/mod.rs", line 86, in tokio::runtime::scheduler::multi_thread::MultiThread::block_on
    crate::runtime::context::enter_runtime(handle, true, |blocking| {
  File "/home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-1.35.1/src/runtime/runtime.rs", line 350, in tokio::runtime::runtime::Runtime::block_on
    Scheduler::MultiThread(exec) => exec.block_on(&self.handle.inner, future),
  File "/home/max/yazi/yazi-fm/src/main.rs", line 42, in yazi::main
    app::App::run().await

The application panicked (crashed).
  Trying to access position outside the buffer: x=214, y=1, area=Rect { x: 0, y: 0, width: 167, height: 24 }
in /home/max/.cargo/registry/src/index.crates.io-6f17d22bba15001f/ratatui-0.25.0/src/buffer.rs, line 259
thread: main

Wow this is a perfect log, let me try to fix it!

This is the terminal output.
In hindsight, your PR was not necessary.
It was my fault for not correctly understanding my systems package management tools, which lead to the debug binary never being added to my systems packages, which is why I never got any verbose output.
So that was never your fault.
Sorry for wasting time and effort.

Never mind, I just enjoy solving problems and relishing the process ;)
I pushed new code to that PR. Please try it out to see if it works.

Im glad that I didnt cause any inconveniences, but fueled your problem solving interests instead.
Im also pretty sure the new code fixes the issue, as nothing has crashed under the circumstances under which I would have expected the crash.

Nice to hear the problem has gone, let's merge the PR!


Handle the comment specific type not recognized by pyarrow

This PR propose just to convert the specific Comment type of lxml that is not recognized by pyarrow (the underlying format used by datasets)

I'm merging it, but don't hesitate to leave a review afterwards :)


[Feature] More APIs added

Currently we use following APIs
a) Weather: OpenWeather
b) Places/Maps/Paths: Google Places API
More APIs can be research out that can do other domain like rainfall, pizza order.
This will help us adding more type of chatbot.

Hi @satyammittal, I would like to contribute to this issue. Can you guide me through it?

Currently we are going to support following things:
a) Google Places API:

Get stores information

Type of stores like eating, shopping

Whether it is open or not

Popular one

Show the direction with map embedded in chat itself.

b) Weather API:

Past and Future information

How much temperature it feels? With humidity and all

Temperature at specific place.

c) Task Schedular:

Plan some tasks at user provided time. It sends the alert{mail/notification} to the user.
Sets alarm using chat

d) SplitWise in chat

manage your expense with friends name saved in chat. Chat will alert you about your saving and current balance.

Suggestions are welcome.

We can use news API to fetch the news according user's location and other specifications.
API is available at https://newsapi.org
and python package is also available at https://github.com/mattlisiv/newsapi-python
I have developed the chatbot using the news API.


Rails 6 support?

Has anyone been able to fork this gem into rails 6 ?

Created a fork that supports ActiveRecord 6
https://github.com/FelipeRiveraC/acts_as_bookable/blob/master/README.md

Fork supporting AR 6.1.7 - https://github.com/Bongs/acts_as_bookable

Is there a fork that also supports rails7 ?


Feature: Update existing index configuration when possible

Motivation
We currently delete all related data for an index when it's updated and create new relationships from the submitted configuration.
While this works, it is noisy in Xperience's CI repository - adding 1 index path will delete all languages, channels, and paths for an index.
This also makes more difficult to use CD because removing the deleted objects will require a RestoreMode of Full which isn't compatible with most PROD environments after an initial release.
Proposed solution
We should track the identifiers of the related objects in the LuceneIndexConfigurationComponent and use that to update items that already exist, only deleting when appropriate.
Additional context
I saved a search index without making any changes to it and this is the result in the CI repository.

The paths that were deleted locally will need to also be deleted in non-local environments, except manually.

Thank you for your recommendation. We'll evaluate its feasibility and provide regular updates on its integration progress.

Approved for development.

We have created GitHub release v7.0.0 which enhances this integration with index configuration. Items no longer get  deleted when it is not necessary


Better handling of multiple hosts in VirtualService

Problem
When user specifies more then one host in VirtualService, in envoy configuration there should be only one virutal host with all required domains.
Alternatives
Instead specifying multiple hosts in VirutalService, user can use EnvoyFilter to apply patch which will add custom domain to virtual host.
In my opinion it is problematic, because when application expose more then one port, user will need to patch multiple virtual hosts.
Affected product area
[ ] Ambient
[ ] Docs
[ ] Dual Stack
[ ] Installation
[ ] Networking
[x] Performance and Scalability
[ ] Extensions and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
Affected features
[ ] Multi Cluster
[ ] Virtual Machine
[ ] Multi Control Plane
Additional context
We are migrating from our in-house envoy based service-mesh to istio.
We need to add custom host domain in VirtualService for easy migration to Istio from our own envoy based service-mesh. Without that migration will be very problematic for us.
We are fighting with huge difference in memory usage of data plane. We were looking what can cause such problems. And we find out that, if you specify multiple hosts in VirtualService it will create the same number of virtual hosts in envoy. Those virtual hosts are almost identical, the only difference is in name and list of domains.
So we removed additional hosts from VirutalService and memory consumption of istio data-plane drastically decrease.
In small service the difference is 100MB.

For service with */* the difference is 3.5.GB

After that we patched envoy with EnvoyFilter to add custom domains to virtual hosts and we didn't observed any significant changes in memory consumption.
How to reproduce that
You just need to apply VirtualService
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: <service-name>-route
  namespace: <namespace>
spec:
  hosts:
  - <service-name>.<namespace>.svc.cluster.default
  - custom.name
  - other.name
  http:
    - route:
      - destination:
          host: <service-name>.<namespace>.svc.cluster.default

Then just grab config from envoy via istioctl d envoy.
I were using bookinfo example app. And here is example route config with multiple virtual hosts
{
  "version_info": "2024-06-20T13:08:57Z/12",
  "route_config": {
    "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
    "name": "9080",
    "virtual_hosts": [
      {
        "name": "custom.name:9080",
        "domains": [
          "custom.name"
        ],
        "routes": [
          {
            "match": {
              "prefix": "/"
            },
            "route": {
              "cluster": "outbound|9080||reviews.default.svc.cluster.local",
              "timeout": "0s",
              "retry_policy": {
                "retry_on": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                "num_retries": 2,
                "retry_host_predicate": [
                  {
                    "name": "envoy.retry_host_predicates.previous_hosts",
                    "typed_config": {
                      "@type": "type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
                    }
                  }
                ],
                "host_selection_retry_max_attempts": "5",
                "retriable_status_codes": [
                  503
                ]
              },
              "max_grpc_timeout": "0s"
            },
            "metadata": {
              "filter_metadata": {
                "istio": {
                  "config": "/apis/networking.istio.io/v1alpha3/namespaces/default/virtual-service/reviews-route"
                }
              }
            },
            "decorator": {
              "operation": "reviews.default.svc.cluster.local:9080/*"
            }
          }
        ],
        "include_request_attempt_count": true
      },
      {
        "name": "other.name:9080",
        "domains": [
          "other.name"
        ],
        "routes": [
          {
            "match": {
              "prefix": "/"
            },
            "route": {
              "cluster": "outbound|9080||reviews.default.svc.cluster.local",
              "timeout": "0s",
              "retry_policy": {
                "retry_on": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                "num_retries": 2,
                "retry_host_predicate": [
                  {
                    "name": "envoy.retry_host_predicates.previous_hosts",
                    "typed_config": {
                      "@type": "type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
                    }
                  }
                ],
                "host_selection_retry_max_attempts": "5",
                "retriable_status_codes": [
                  503
                ]
              },
              "max_grpc_timeout": "0s"
            },
            "metadata": {
              "filter_metadata": {
                "istio": {
                  "config": "/apis/networking.istio.io/v1alpha3/namespaces/default/virtual-service/reviews-route"
                }
              }
            },
            "decorator": {
              "operation": "reviews.default.svc.cluster.local:9080/*"
            }
          }
        ],
        "include_request_attempt_count": true
      },
      {
        "name": "reviews.default.svc.cluster.local:9080",
        "domains": [
          "reviews.default.svc.cluster.local",
          "reviews",
          "reviews.default.svc",
          "reviews.default",
          "<IP_ADDRESS>"
        ],
        "routes": [
          {
            "match": {
              "prefix": "/"
            },
            "route": {
              "cluster": "outbound|9080||reviews.default.svc.cluster.local",
              "timeout": "0s",
              "retry_policy": {
                "retry_on": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                "num_retries": 2,
                "retry_host_predicate": [
                  {
                    "name": "envoy.retry_host_predicates.previous_hosts",
                    "typed_config": {
                      "@type": "type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
                    }
                  }
                ],
                "host_selection_retry_max_attempts": "5",
                "retriable_status_codes": [
                  503
                ]
              },
              "max_grpc_timeout": "0s"
            },
            "metadata": {
              "filter_metadata": {
                "istio": {
                  "config": "/apis/networking.istio.io/v1alpha3/namespaces/default/virtual-service/reviews-route"
                }
              }
            },
            "decorator": {
              "operation": "reviews.default.svc.cluster.local:9080/*"
            }
          }
        ],
        "include_request_attempt_count": true
      },
      {
        "name": "allow_any",
        "domains": [
          "*"
        ],
        "routes": [
          {
            "match": {
              "prefix": "/"
            },
            "route": {
              "cluster": "PassthroughCluster",
              "timeout": "0s",
              "max_grpc_timeout": "0s"
            },
            "name": "allow_any"
          }
        ],
        "include_request_attempt_count": true
      }
    ],
    "validate_clusters": false,
    "max_direct_response_body_size_bytes": 1048576,
    "ignore_port_in_host_matching": true
  },
  "last_updated": "2024-06-20T13:08:57.834Z"
}

Possible implementation
I'm not very familiar with istio code, but I briefly checked and it should be very easy to implement.
Here hosts from VirtualService are split based on existence in service registy.
And then here it is used to create virtual host. I think that it just need a little changes to create one virtual host with all required domains.

Do you see any problems for such change?

We actually have exact logic like this for gateways: https://github.com/istio/istio/blob/044be69f174a7afe8a827ddc4e9717df7ee97cd3/pilot/pkg/networking/core/gateway.go#L579 but not for mesh. So probably similar logic could be applied


Wait longer to find out what port number test child processes report.

Speculative fix. CircleCI is failing these tests, and I suspect it's just load.

See eg. https://circleci.com/gh/login-box/dropwizard-heroku/37


🎁 [Feature Request]: Remove all std imports

What is the feature you would like to see?
This crate could be used in no-std crates if all imports to std were removed
Luckily, all the std imports are imports that can be replaced by core, so this is a no brainer

Great improvement, thanks!


Russian Language

add Russian Language

This has already been merged, https://github.com/Reverp/Toxy/pull/63


add MalformedURLException

Might be useful for someone, I needed it in a project and I took inspiration from https://github.com/scala-js/scala-js/pull/1407

Can one of the admins verify this patch?

ok to test

Hi, thanks for the contribution. Could you please sign the Scala CLA if you have not already done so?

Code looks good. Please make the first character in the commit message upper case.

That's all

Test PASSed.
Refer to this link for build results (access rights to CI server needed):
https://scala-webapps.epfl.ch/jenkins/job/scalajs-pr/1569/
https://scala-webapps.epfl.ch/jenkins/job/scalajs-matrix-build/2038/
Test PASSed.

CLA signed, commit message amended, thank you!

LGTM

The next release is around when @sjrd has strong mode done I assume. Since it will bring binary backwards incompatible changes, we'll probably want to pack as many of these as possible in there.
Sorry I can't be more specific about that. @sjrd, do you have a timeline?

Test PASSed.
Refer to this link for build results (access rights to CI server needed):
https://scala-webapps.epfl.ch/jenkins/job/scalajs-pr/1570/
https://scala-webapps.epfl.ch/jenkins/job/scalajs-matrix-build/2039/
Test PASSed.

A couple weeks. That's the most precise I can give at the moment.


Use exact " diffusers " 0.25.1 to enable position net

People who already have diffusers 0.26.x installed are missing the " position net " embedding. That's actually been commented out of the current diffusers code. However we should ensure that 0.25.1 is installed for everyone , including users who have a newer version thanks ..
—   Diffusers " position net " :
[ https://github.com/search?q=repo%3Ahuggingface%2Fdiffusers%20positionnet&type=code ]

This fixes [ #25 ]

I'll update the support for diffuser to newest 0.26.1


Merge artman CI and CD into one workflow.

The docker image release flow requires the success of all the tests. And those prerequisites must be defined in one workflow.

@lukesneeringer should we merge this?

Probably; let's see if the tests can pass.

I did that in #449, closing this one.


Refactor dockerswarm refresh for testing

We were missing testing on the behaviour of the configuration
unmarshalling.
This PR adds a refresh command that can be used to test that we
use the correct refresh function.
Signed-off-by: Julien Pivotto<EMAIL_ADDRESS>

:+1:


Awesome Bot

Hey!
That's the bot I was looking for. We could add some sort of Spoiler command? For spoiler season

Thanks, glad you like it!
I like the idea of bringing spoilers to the bot. What do you think the command should do?
Show the new spoilers of the last day or something?


uya IR Device showing in HB Accessories, but not sending it to HK

Hi there,
I have configured Tuya IR plugins and it fetch IR devices and I can see them in Accessories and I can turn on/off no problem however, it is not sending it to HomeKit. Any thought?
Cheers,

I have resolved the issue by adding the IR device manually using a code


Tedge operation plugins to migrate legacy config file contents

Proposed changes
The tedge-config-plugin and tedge-log-plugin will migrate their legacy counterparts' configuration files, if found during initialization.

[x] tedge-config-plugin code update
[x] tedge-log-plugin code update
[ ] System tests

Types of changes

[ ] Bugfix (non-breaking change which fixes an issue)
[ ] New feature (non-breaking change which adds functionality)
[x] Improvement (general improvements like code refactoring that doesn't explicitly fix a bug or add any new functionality)
[ ] Documentation Update (if none of the other choices apply)
[ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)

Paste Link to the issue

Checklist

[ ] I have read the CONTRIBUTING doc
[ ] I have signed the CLA (in all commits with git commit -s)
[ ] I ran cargo fmt as mentioned in CODING_GUIDELINES
[ ] I used cargo clippy as mentioned in CODING_GUIDELINES
[ ] I have added tests that prove my fix is effective or that my feature works
[ ] I have added necessary documentation (if appropriate)

Further comments

I've modified the existing system test, and added one for the tedge-log-configuration as well.


fix #25 : use httpS instead of http

According to https://www.stackage.org/lts-7.3/package/http-client-<IP_ADDRESS> :

Note that, if you want to make HTTPS secure connections, you should use http-client-tls in addition to this library.

Thanks!
If I recall correctly, we are using wreq for requests, and it already uses http-client-tls behind the scene. So this should not be a problem.

@madjar As a side effect swithcing from http to https restore the commits identifiers. (issue #25)
Because nixos.org website provide 2 differents answers :+1:
$ curl --head http://nixos.org/channels/nixos-unstable/
HTTP/1.1 301 Moved Permanently
Date: Sat, 12 Aug 2017 20:36:26 GMT
Server: Apache/2.4.26 (Unix) OpenSSL/1.0.2l
Location: https://nixos.org/channels/nixos-unstable/
Content-Type: text/html; charset=iso-8859-1

$ curl --head https://nixos.org/channels/nixos-unstable/
HTTP/1.1 302 Found
Date: Sat, 12 Aug 2017 20:36:33 GMT
Server: Apache/2.4.26 (Unix) OpenSSL/1.0.2l
Strict-Transport-Security: max-age=86400
Location: https://d3g5gsiof5omrk.cloudfront.net/nixos/unstable/nixos-17.09pre112691.abdb58e407/


lomiri.telephony-service: Fix build after fixed strictDeps

Description of changes
CMake script expects qmake binary. We don't plan on using it because it gives garbage, just patch out the check for its presence.
Started being broken after CMake strictDeps got fixed in #318226.
Things done

Built on platform(s)

[x] x86_64-linux
[ ] aarch64-linux
[ ] x86_64-darwin
[ ] aarch64-darwin

For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)

[ ] sandbox = relaxed
[ ] sandbox = true

[x] Tested, as applicable:

NixOS test(s) (look inside nixos/tests)
and/or package tests
or, for functions and "core" functionality, tests in lib/tests or pkgs/test
made sure NixOS tests are linked to the relevant packages

[ ] Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
[ ] Tested basic functionality of all binary files (usually in ./result/bin/)
24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)

[ ] (Package updates) Added a release notes entry if the change is major or breaking
[ ] (Module updates) Added a release notes entry if the change is significant
[ ] (Module addition) Added a release notes entry if adding a new NixOS module

[x] Fits CONTRIBUTING.md.

Add a :+1: reaction to pull requests you find important.

No problem! It happens.


fix: add missing default for -text-line-height

Fixes #1034.
Please ignore this PR if !default is actually missing for a reason.

Codecov Report

:exclamation: No coverage uploaded for pull request base (main@164e765). Click here to learn what that means.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main    #1373   +/-   ##
=======================================
  Coverage        ?   74.51%
=======================================
  Files           ?       42
  Lines           ?     1240
  Branches        ?      324
=======================================
  Hits            ?      924
  Misses          ?      235
  Partials        ?       81

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.


docs: Start logging page

Framed as "Logging" as ideally I think we'd add some kind of Node logging framework and set up better collecting options, and errors of all kinds should be included in that.


Fetch all cars from Sahibinden by Onur YAŞAR

Fetch all cars from Sahibinden feature added
Native ads don't fetch already because of the "try finally" block.

Screenshot:

It is also possible to use Selenium webdriver chrome without the chrome driver.