release: 0.13.0rc2

Diff: https://github.com/Kong/kong/compare/0.13.0rc1...release/0.13.0rc2

@thibaultcha Just checking since I'm not fully sure on the workflow for release candidates: looking at diffs for 0.12.3 and 0.13.0rc2, the Changelog for 0.12.3 includes the updates for both 0.12.3 and 0.13.0rc2, but the Changelog for 0.13.0rc2 includes neither -- is that correct?

It's on purpose: merging 0.12.3 to master (with the changelog additions) will make the master changelog up to date. Then merging 0.13.0rc2 into next, and then master into next, should bring everything up--to-date and avoid any merging conflict.

@thibaultcha got it!


Panic on out of memory

The default implementation calls ::core::intrinsics::abort, which results in an exception on Cortex M. I think a panic would be better to debug.

@japaric What do you think about this change?


BUG: Exception when setting an empty range using DataFrame.loc

Fixes #9596

lgtm ping on green

Tests are green

thanks!


Refactor use map_err

issue: https://github.com/rust-bitcoin/rust-bitcoin/issues/793
change to using map_err

i have refactor another place too

I approved run but unless I'm too confused something it'll fail on missing commas.


Changed print statement to logging

This fixes this issue: https://github.com/nficano/pytube/issues/61

Thanks for the pr!

I've released 0.3.0

Nice, already updated on my requirements!
Thanks for the lib!

parabéns
-------- Mensagem original --------De : João Ricardo  Data:05/09/2015  23h19  (GMT-03:00) Para: nficano/pytube  Assunto: Re: [pytube] Changed print statement to logging (#62)
Nice, already updated on my requirements!
Thanks for the lib!
—
Reply to this email directly or view it on GitHub.

de nada!


Update exchange-online-powershell-v2.md

Changes requested by Vikram Gupta 2/12/2021.

Docs Build status updates of commit 96e69a4:
:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

exchange/docs-conceptual/exchange-online-powershell-v2.md
:white_check_mark:Succeeded
View (exchange-ps)

For more details, please refer to the build report.
Note: Broken links written as relative paths are included in the above build report. For broken links written as absolute paths or external URLs, see the broken link report.
For any questions, please:Try searching in the Docs contributor and Admin GuideSee the frequently asked questionsPost your question in the Docs support channel

@paul9955, this PR has the same problem as  #7241.

Docs Build status updates of commit 03352a7:
:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

exchange/docs-conceptual/exchange-online-powershell-v2.md
:white_check_mark:Succeeded
View (exchange-ps)

For more details, please refer to the build report.
Note: Broken links written as relative paths are included in the above build report. For broken links written as absolute paths or external URLs, see the broken link report.
For any questions, please:Try searching in the Docs contributor and Admin GuideSee the frequently asked questionsPost your question in the Docs support channel

Docs Build status updates of commit dcb9102:
:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

exchange/docs-conceptual/exchange-online-powershell-v2.md
:white_check_mark:Succeeded
View (exchange-ps)

For more details, please refer to the build report.
Note: Broken links written as relative paths are included in the above build report. For broken links written as absolute paths or external URLs, see the broken link report.
For any questions, please:Try searching in the Docs contributor and Admin GuideSee the frequently asked questionsPost your question in the Docs support channel

Docs Build status updates of commit d737df6:
:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

exchange/docs-conceptual/exchange-online-powershell-v2.md
:white_check_mark:Succeeded
View (exchange-ps)

For more details, please refer to the build report.
Note: Broken links written as relative paths are included in the above build report. For broken links written as absolute paths or external URLs, see the broken link report.
For any questions, please:Try searching in the Docs contributor and Admin GuideSee the frequently asked questionsPost your question in the Docs support channel


Associate arbitrary object to each request?

I need to capture the request and an instance of an object that contains meta-data about the request to store in the database, how do you recommend that? You only return the response text.

The short answer is, is that there isn't an easy way to do that right now (read, no existing function you can hit, that provides this functionality).
There's a couple of slightly harder ways you can accomplish this.
You can write your own imap function:
def imap(requests, stream=False, size=2, exception_handler=None):
    pool = Pool(size)

    def send(r):
        return r.send(stream=stream)

    for request in pool.imap_unordered(send, requests):
        if request.response:
            yield request
        elif exception_handler:
            exception_handler(request, request.exception)

    pool.join()

The difference is instead of yielding request.response, you yield request (which is the AsyncRequest object).
You could then use it like:
a = grequests.get('http://www.example.com/')
a.metadata = something

for result in imap([a]):
    r = result.result
    metadata = result.metadata

Alternatively, you could use a side dict to store your metadata in, and come back to it later, ala....
import uuid
from datetime import datetime
urls = [ 'http://www.example.com/', 'http://www.google.com/' ]
queue = []
metadata = {}
for url in urls:
    id = uuid.UUID4()
    metadata[id] = { sent: datetime.now() }
    queue.append(grequests.get(url, headers={'x-correlation-id': id}))

for result in grequests.imap(queue):
    corr_id = result.request.headers['x-correlation-id']
    meta = metadata[corr_id]
    # do stuff
    ...
    # clean up the metadata when done
    del metadata[corr_id]

I'm using the '#' char to pass my data thru the requested url.
Any string that comes after '#' means nothing to the request params so it's like sending it without your additional data.
It's useful when it's not much data..
You can specify only index and then find the metadata with the index that provided.
For example, lets say i'm want to send a request to this url:
http://google.com
I want to "attach" an object to it so I add the object index to the url:
http://google.com#{object-id}
then, when i'm iterating the responses, im getting the id via the response.url attribute:
index=response.url.split("#")[1]
object_data = object_list[index]
Should solve your problem...
:)

Hello,
I am using grequests.map function with certain no of requests ( say 100). How do I ensure the response is in the same order of the requests made?
Please help.
-Mani

I needed to do the same thing.  The approach I took was to modify the AsyncRequest class to support a metadata argument as follows:
class AsyncRequest(object):
    """ Asynchronous request.

    Accept same parameters as ``Session.request`` and some additional:

    :param session: Session which will do request
    :param callback: Callback called on response.
                     Same as passing ``hooks={'response': callback}``
    :param metadata: optional dict of metadata to return with the executed response object
    """
    def __init__(self, method, url, **kwargs):
        #: Request method
        self.method = method
        #: URL to request
        self.url = url
        #: Associated ``Session``
        self.session = kwargs.pop('session', None)
        if self.session is None:
            self.session = Session()

        callback = kwargs.pop('callback', None)
        if callback:
            kwargs['hooks'] = {'response': callback}

        # Save metadata (if any)
        self.metadata = kwargs.pop('metadata', None)

        #: The rest arguments for ``Session.request``
        self.kwargs = kwargs
        #: Resulting ``Response``
        self.response = None

    def send(self, **kwargs):
        """
        Prepares request based on parameter passed to constructor and optional ``kwargs```.
        Then sends request and saves response to :attr:`response`

        :returns: ``Response``
        """
        merged_kwargs = {}
        merged_kwargs.update(self.kwargs)
        merged_kwargs.update(kwargs)

        try:
            self.response = self.session.request(self.method,
                                                self.url, **merged_kwargs)
            # Save metadata to response
            self.response.metadata = self.metadata

        except Exception as e:
            self.exception = e
            self.traceback = traceback.format_exc()
        return self

If the response successfully executes this dict is available via the response.metadata property.  If an exception is thrown it is still available in the request.metadata property
While this seems to work I have not done much testing.  Opinions on validity of this solution are welcomed.

Some good recipes exist for doing this and I don't think adding the feature directly is super helpful. Closing for now :)


[DateTimePicker] Absolute range not working

What package is this for?

[x] React
[ ] Angular

Describe the bug
DateTimePicker range absolute select doesnt work when also have preset.
https://carbon-addons-iot-react.com/?path=/story/watson-iot-experimental-datetime-picker--selected-preset
To Reproduce
Steps to reproduce the behavior:

Go to 'https://carbon-addons-iot-react.com/?path=/story/watson-iot-experimental-datetime-picker--selected-preset'
Click on 'Custom range'
Click on 'Absolute'
Try to have a range for absolute

Expected behavior
Absolute selector should work with preset default and enable a range selector.
Environment/versions:

OS:  MacOS
Browser:  chrome,
carbon-addons-iot-react version:  v2.115.0]

Additional context

Specific timeline issues / requests

ApplicationSuite release 8.2 (Oct)

:tada: This issue has been resolved in version 2.130.1 :tada:
The release is available on:

npm package (@latest dist-tag)
GitHub release

Your semantic-release bot :package::rocket:


Getting error when trying to copy files

my log id: a5584f38e33f0f057579671c

Hi @JustBru00, thanks for the report.  It looks like you happened upon a way to crash the file system while writing a file.  I'll probably be able to get a fix into master tomorrow, and it should be in the next Windows release (next week?).  Sorry for the inconvenience!

The fix (keybase/kbfs#748) is now in master. Hopefully we'll get a new Windows release out soon.
If you're looking for a workaround, the only thing I can think of is to delete all 0-byte files in your KBFS that are more than a week or two old. Then restart KBFS, and try to copy your file in again.  Maybe not very helpful, I know.

Thanks for looking into it I can wait until the fix is put out. 😄


Removed comment from MLMD gRPC server config

The issue resolved by this Pull Request:
Resolves https://issues.redhat.com/browse/RHOAIENG-15689
(Along with https://github.com/opendatahub-io/data-science-pipelines-operator/pull/742)
Description of your changes:

This PR removes a comment incompatible with the MLMD gRPC server config syntax.
Testing instructions

This was tested by @jgarciao in a cluster.
Checklist

[x] The commits are squashed in a cohesive manner and have meaningful messages.
[x] Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
[x] The developer has manually tested the changes and verified that the changes work

A new image has been built to help with testing out this PR: quay.io/opendatahub/data-science-pipelines-operator:pr-749
An OCP cluster where you are logged in as cluster admin is required.
To use this image run the following:
cd $(mktemp -d)
git clone git@github.com:opendatahub-io/data-science-pipelines-operator.git
cd data-science-pipelines-operator/
git fetch origin pull/749/head
git checkout -b pullrequest 9ca772569af473a1fb80af3711729461ef3193bc
oc new-project opendatahub
make deploy IMG="quay.io/opendatahub/data-science-pipelines-operator:pr-749"

More instructions here on how to deploy and test a Data Science Pipelines Application.

I would have been tempted to put the comment higher up as a yaml comment, but nbd
/lgtm
/approve


mtcnn optimization is input dependent

Your optimization of mtcnn is specifically designed for 720p input image. While other size may be   scaled or padded to fit into 720p. The failure case may be an input of portrait rather than landscape. In this case, images are heavily squeezed and make it impossible to detect small faces. Is there any plan to make it input independent?

You are right.  I've optimized MTCNN PNet based for 1280x720 image inputs, and it does not work very well for portrait inputs.  But I don't plan to update the code to better support other cases for now.  I think interested readers should be able to modify 'mtcnn/det1_relu.prototxt' and 'utils/mtcnn.py' by themselves.
In order to handle input images of multiple different input shapes, one might consider prebuilding TRT-PNet with a few different input shapes and select the best one at runtime.


Fix buttons alignment (#398)

Issue link
https://github.com/tasitlabs/tasit/issues/398

Auto-close the issue?

Closes #398
Types of changes

Bug fix (non-breaking change that fixes an issue)

@pedrobergamini Nicely done - thanks!


Add helpers from darvaza/shared/x

ListCopy/ListCopyFn
MapListCopy/MapListCopyFn
MapValueOr

to drop darvaza.org/darvaza/shared/x

Summary by CodeRabbit

New Features

Added functions for copying lists (ListCopy, ListCopyFn) and maps (MapListCopy, MapListCopyFn), enhancing data manipulation capabilities.
Introduced MapValue for retrieving values from maps with a default return option.

Documentation

Updated the README.md to include new exported functions, improving clarity on library capabilities.

v0.14.9 tagged


Get ClientId from env variables

The ClientId is hard coded. It should be accessed through env variables.

We have future plans to make clientId editable via the UI.  Is this for the ability to change the clientId, or are you trying to keep it out of our source code.

Yes, this is for keeping it out of our source code.


More details needed on the behavior of preffered regions in Azure Cosmos DB for MongoDB

When you provision an Azure Cosmos DB for MongoDB in multiple regions with multiple write locations, this page suggests using connection strings with a preferred region encoded in the app name.
The use of the word preferred makes it sound to me like the would be a fallback to other writeable regions if the preferred cannot be reached.
For example, suppose I have my Azure Cosmos DB for Mongo DB instance in WestUs and EastUs and have it writable in both.
Then, in WestUs, I use a connection string that encodes the preferred region as WestUS.
If my WestUS storage instance goes down, is not reachable by my client, or fails for any unknown reason, will this connection string result in automatically attempting to write in EastUs?
If the fallback only occurs in some cases, what are those cases?
Thanks!

Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

ID: 223d16c4-837a-3658-0b7c-90d922e4a10f
Version Independent ID: de3e44ae-092e-1dde-c044-34ffc54db3e3
Content: Configure multi-region writes in your Azure Cosmos DB for MongoDB database
Content Source: articles/cosmos-db/mongodb/how-to-configure-multi-region-write.md
Service: cosmos-db
Sub-service: mongodb
GitHub Login: @gahl-levy
Microsoft Alias: gahllevy

@estalilla-j-docusign
Thanks for your feedback! We will investigate and update as appropriate.

Thanks @Naveenommi-MSFT, that does help!
I do have one more question if you can help.
I suppose that there must be some proxy then that handles the connection and routes it to the right region.
According to https://learn.microsoft.com/en-us/azure/cosmos-db/high-availability#slas, the SLA for Cosmos db with multiple write regions is five 9s. So may I assume that SLA applies when using connection strings with preferred app name and thus this proxy service has a five 9s uptime?

@estalilla-j-docusign
The service allows you to configure your Azure Cosmos DB databases with either a single write region or multiple write regions, and depending on the choice, partition-sets are configured to accept writes in exactly one or all regions.
There is a proxy service that handles the connection and routes it to the right region when using connection strings with a preferred region encoded in the app name. The SLA for Cosmos DB with multiple write regions is five 9s, which means that the proxy service has a high uptime and is designed to provide high availability and fault tolerance for your application.
Note that the preferred write region should be specified without spaces, so it should be "WestUS" instead of "West US".
If you specify multiple regions in the connection string, the client will use the first region in the list that is available. If none of the regions are available, the client will return an error.

If you specify multiple regions in the connection string, the client will use the first region in the list that is available. If none of the regions are available, the client will return an error

This sounds like I need to specify all regions I would want to try, in order. Rather than just my preferred region and letting Cosmos DB figure out what other regions I have and try them in any order if the preferred region is down. Is that right?

@estalilla-j-docusign
We are going to close this thread, if there are any further questions regarding the documentation, please tag me in your reply and we will be happy to continue the conversation.
#Please-close


[🐛] videoQuality not working

Description

const videoOptions = {
  title: '请选择',
  cancelButtonTitle: '取消',
  takePhotoButtonTitle: '拍照',
  chooseFromLibraryButtonTitle: '从相册选取',
  selectionLimit: 1,
  mediaType: 'video',
  videoQuality: 'low',
  durationLimit: 1
};

Original video size is 5.7M, picked vide size is still 5.7M.
Additional Information

Image Picker version: 4.0.5
React Native version: 0.62.0
Platform: iOS
Development Operating System: MacOS

Do you know if this is on iOS only? or both platforms?

@Johan-dutoit I just tested it on iOS.

Just had a look at the code and videoQuality is only for recording new videos.

I'll submit a PR with the changes, if you don't mind testing @Liqiankun.

Keep in mind, that if the video quality is already low, then it won't change anything.

@Johan-dutoit What about android?

If you have the same issue on Android, it can be looked at.

let me check it out

:tada: This issue has been resolved in version 4.1.1 :tada:
The release is available on:

npm package (@latest dist-tag)
GitHub release

Your semantic-release bot :package::rocket:

videoQuality doesn't do anything. The video is always high resolution.

@Johan-dutoit This doesn't seem to work for me either, always the same size no matter what videoQuality is passed when using the picker


Consistent crash when clikcing "[*]" above chat.

Modern Skyblock 3: Departed, plus TwichIntegration and ChatTweaks.
https://paste.ee/p/wREBR
I may have something misconfigured.  It's definitely authenticated with twitch, but the rest of the config is a mystery to me, and I couldn't find a guide anywhere.

I assume some mod is posting an invalid message to the chat. Can you check which messages are in chat when the crash happens (and which mod they're from)? That might narrow it down so that I can reproduce it myself and find a workaround.

https://photos.app.goo.gl/ZsWiuf8J2hPFoCz43 -- screenshot from immediately before I clicked "[*]".

Buildcraft's startup message was the cause.
The latest version of Chat Tweaks contains a workaround for the issue.


Add pyproject.toml for Custom Node Registry

We are building a global registry for custom nodes (similar to PyPI). The registry makes using custom nodes more reliable by reserving globally unique names for each custom node, and supporting semantic versioning.
Here’s some more information on the registry.
Action Required:

[ ] Go to the registry. Login and create a publisher id. Comment it here and we will update the PR (or just merge it and change it yourself).
[ ] Write a short the description.
[ ] Merge the separate Github Actions PR and run the workflow.

If you want to publish the node manually, install the cli and run comfy node publish
Please message me on Discord if you have any questions!

hey @DataCTE, wanted to send a small nudge and ask if you had any questions!


New scene instance type - Background.

In a basic sense, you would have a scene instance with an option that sets it as a background for the current gameplay scene. It would work as follows...

Anything in the background type will be drawn after everything else, meaning that objects and textures in it will only appear whenever there is empty space showing through in the main scene (where the skybox would otherwise be).
Have an option to allow the background scene's sky texture and/or environmental settings override that of the main scene
Objects in general in the background scene would not be able to collide with objects in the main scene, however, you can move objects in the background scene (such as basing their movement on an object in the main scene).

Uses

Using it as a true 3D perspective background in a 2D game
Using it as a skybox with animation and dynamic properties
Using it as a 3D background with 3D games
Dynamic muiti-layered background effects using more than one background scene

Please respond if you think this or something similar would be a good idea to add to Godot
Thanks.

For 1.2 the plan is to completely overhaul the 3D renderer and implement
all these things.

This is now more for the 3.0 milestone actually.

@reduz What's the status on this for 3.0?

Would that kind of layer support also allow to apply post processing to only one layer

Yeah this is pushed to 3.1 unfortunately, it needs a lot of group thinking as well as trial and error.

Moving to the next milestone as 3.1 is now feature frozen.

I have a space sim where I want the skybox to be a scene unto itself, this issue is exactly what I need - a scene that is rendered before everything else.

@Galaxy613 if it is just a skybox you need then you can render it to a Viewport then set the Viewport to the sky in your WorldEnvironment.
This issue is more about having an entire scene running and interacting with the main scene + drawing after the main scene to optimize rendering. However, if its just a skybox you need, its perfectly doable now.

True, I have a skybox up and running now, but having that whole extra scene for the skybox is what I really want for my game. I can think of many other ways to do it, but it would be so much better if Godot had a built-in way to handle background scenes.

Hi Godot team, just to know if this background scene feature was still in your plans for 3.2 milestone.

It might make sense to do this as part of adding support for multiple cameras for viewport, which will need to wait until Vulkan is added (which was why #8215 was closed). I suggest bumping to 4.0.

Feature and improvement proposals for the Godot Engine are now being discussed and reviewed in a dedicated Godot Improvement Proposals (GIP) (godotengine/godot-proposals) issue tracker. The GIP tracker has a detailed issue template designed so that proposals include all the relevant information to start a productive discussion and help the community assess the validity of the proposal for the engine.
The main (godotengine/godot) tracker is now solely dedicated to bug reports and Pull Requests, enabling contributors to have a better focus on bug fixing work. Therefore, we are now closing all older feature proposals on the main issue tracker.
If you are interested in this feature proposal, please open a new proposal on the GIP tracker following the given issue template (after checking that it doesn't exist already). Be sure to reference this closed issue if it includes any relevant discussion (which you are also encouraged to summarize in the new proposal). Thanks in advance!

Superseded by #355.


add App Mesh service mesh chapter

The version thats since been removed was compatible with the "preview" version of App Mesh.
Now that we're in GA, create an App Mesh tutorial compatible with the release version.

TeamRole given to cloud9 instance run by event engine doesn’t have permission of app mesh so hit error when run those commends at "Porting DJ to App Mesh -> Create the Mesh section"
aws appmesh list-meshes
aws appmesh describe-mesh --mesh-name dj-app
An error occurred (AccessDeniedException) when calling the ListMeshes operation: User: arn:aws:sts::446893124341:assumed-role/TeamRole/i-00d4439bdb5e0849d is not authorized to perform: appmesh:ListMeshes on resource: *

Taking a look...

This should be fixed now.  Please reopen if you find the same issue.


Save command line view

The ability to save a json is not available to the command line API. This would be a very useful functionality.

Duplicate of issue #2


Convert model to active model

Motivation
Activemodel don't support Serialize, Deserialize. I deserialize json to Model and wan to insert to db.
There is any convinient wany to convert model to Active model?

Proposed Solutions

Additional Information

Hey @zys864, you could easily convert any Model into ActiveModel with into_active_model method.
_https://docs.rs/sea-orm/0.9.1/sea_orm/entity/trait.IntoActiveModel.html#tymethod.into_active_model_

thanks,it works.

Welcome!


7

Is your feature request related to a problem? Please describe.

Describe the solution you'd like:

Describe alternatives you've considered:

Additional context:

Details

Closing due to missing details, feel free to reopen once more information has been added.


Update MD file on new branch 2017-18-10_08-11-55

:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

split/updateTestCon.md
:white_check_mark:Succeeded

For more details, please refer to the build report.
Note: If you changed an existing file name or deleted a file, broken links in other files to the deleted or renamed file are listed only in the full build report.


Increase CT_NUMBER values

Also add build-time errors to keep them in sync.
Thanks to GitHub user YuDudysheva for reporting this.
Fixes: #6873

Note that OpenSSL does not use either value.  Someone could say that this is an ABI issue, but there's the likely case that if code was using this value, openssl could clobber past their array.  So this is a bugfix I think.

Yeah, I don't know why we have the two constants either.  And we use neither of them!
Oh well.  Thanks. Merged to master and 1.1.0.


Limit to element_composition

Allow limiting the output only to elements denoted in element_composition.
Some Options

Extra Flag fix_element_composition
Allow for forbidden_elements = "1-*" hack, i.e. forbid everything and overrule by element_composition. Currently raising a ValueError due to an empty multiprocess pool.
Set this option per default.

Current workaround:
Manually forbid all elements that are not within your choice of element_composition (inconvenient).

Thanks for the feedback!
The forbidden_elements = "1-*" "hack" should work and thus, this is also partially a bug. Other than that, also a "fix_element_composition" flag or similar might be useful.

Let's implement this feature, as it would also simplify the access to isomers (-> if fix_element_composition is true, we would get isomers only anyway). Brought up by @gasevic.
Points to consider

Charge should not be set randomly, because for true structural isomers, we don't want IP/EA comparisons but only structural differences
For the special case, that people want isomers but randomized charges, we can still implement a flag (--random-charges) with which people can turn the random charge assignment on and off and maybe optionally give a preference for closed-shell and open-shell cases (e.g., 0 and 1 (IMHO most default ones))


Change "commit" and "reveal" terminology to "commit" and "inscribe"

Just to make it clear that the second transaction is the inscription transaction, and is where the inscription ID comes from.

Actually I think current terminology is fine.


Add Autocorrection for MissingEnableComment

When theme-check-disable is used in the middle of a theme file, the corresponding theme-check-enable comment should also be added.
Prior work: Shopify/theme-check#504

We don't have that check anymore.


example: add an example of mTLS

Description
It would be helpful to show how to set up mTLS for both TLS providers.

Seconded.  Is it possible to execute an mTLS connection with s2n-quic?
I have looked through the types, and it seems that there is no exposed way to specify the TlsConfig.  Is there a plan to make tls::Provider public, so one could specify, say, their own Rustls ClientConfig and ServerConfig?

mTLS is supported today in both providers; we just don't have good examples of how to do that.
Both of the rustls endpoints allow you to create a struct for a given config, so you'll have to set up your own with their builders:
https://github.com/aws/s2n-quic/blob/37ad090b2bd8e766972a8bd95f439c8df37c6438/quic/s2n-quic-rustls/src/server.rs#L34
https://github.com/aws/s2n-quic/blob/37ad090b2bd8e766972a8bd95f439c8df37c6438/quic/s2n-quic-rustls/src/client.rs#L36
The s2n-tls provider supports mTLS directly:
https://github.com/aws/s2n-quic/blob/37ad090b2bd8e766972a8bd95f439c8df37c6438/quic/s2n-quic-tls/src/server.rs#L160
https://github.com/aws/s2n-quic/blob/37ad090b2bd8e766972a8bd95f439c8df37c6438/quic/s2n-quic-tls/src/client.rs#L124

I took a swing at an example using a rustls::ServecConfig and rustls::Client config (see #1601).  It was rather painless.
I can make an example for s2n-tls as well.

Great thanks for doing that!

@rrichardson thanks for the rustls example! If you wanted to make an example for s2n-tls that would be super awesome. I can help review

The s2n-tls portion still needs to be done

Hello, I just made a pull request to add a s2n-tls mtls example, and needs to be reviewed, thanks!😄


⚠ 🔍 PDS Search API has degraded performance

In b607e33, 🔍 PDS Search API (https://pds.nasa.gov/api/search/1/products) experienced degraded performance:

HTTP code: 200
Response time: 11 ms

Resolved: 🔍 PDS Search API performance has improved in 5cde712 after 20 days, 22 hours, 51 minutes.


Swap endian-ness in tools on big endian hosts

When the host running the SDK is not little endian, all data that is exchanged with the Pico must be converted to/from little endian byte order.
Instead of sprinking explicit swaps around the code, I used available mechanisms for doing the swaps implicitly.  Unfortunately, there is no such mechanism that works with both C and C++, so because the code base mixes C and C++ double mechanisms need to be employed...
The C++ fix also suffers from the fact that some structures are declared as __attribute__((packed)), which requires the contents to be POD.  Because of this, the little_endian template is not allowed to have a constructor.  This is not a problem in the SDK itself, but in picotool it would have been convenient to be able to create std::vector<little_endian<uint32_t>> program with an initializer.

@kilograham may feel differently (and his opinion matters much more than mine), but I think it might be simpler to keep everything on the Pico little-endian, and rely on the host-side tools (elf2uf2, picotool, etc.) to do any necessary conversion if the host itself isn't little-endian?
Otherwise you might have some Picos presenting a little-endian host interface, and other Picos presenting a big-endian host interface, depending only on what firmware has been flashed to them, and that might get a bit confusing?
(Of course, that's assuming that I'm correctly understanding what this PR is trying to do, which I might not be? :shrug: )

@lurch I think there may be a misunderstanding here.  What the code does it make the data being accessed as little endian, regardless of the systems actual endianness.  On a system which is already little endian, such as the Pico itself, this is a no-operation (and in fact the macros will expand to nothing).  There is nothing here that will make anything big endian on the Pico.  All conversions happen on the host side (and only if the host is big endian).

All conversions happen on the host side (and only if the host is big endian).

Cool, please accept my apologies for my misunderstanding (I'm more of a Python guy than a low-level C guy). Is a similar patch needed for https://github.com/raspberrypi/picotool or does this PR already encompass that?

@lurch Yes, I have a patch for picotool too.  It depends on this patch though, so I wanted to test the waters here first before submitting it.  :smile:

Just out of curiosity, what big-endian host machine / OS / environment are you using?

@lurch RCS Talos II (POWER9) with Gentoo Linux is my main host.  I also have a big endian Raspberry Pi 3.  :smile_cat:

@lurch RCS Talos II (POWER9) with Gentoo Linux is my main host. I also have a big endian Raspberry Pi 3. 😸

I'd presumed you were on a Dec Alpha or a VAX or some such. Huh.

@aallan All ARM-v8 cores from ARM are bi-endian.  VAX is little-endian only, though, having been designed in the 1970:s, just like x86.  :laughing:

All ARM-v8 cores from ARM are bi-endian. VAX is little-endian only, though, having been designed in the 1970:s, just like x86. 😆

Having used a VAX a lot during my undergrad I have total false memories of it being big endian at that point. Huh. Guess I was brain washed by my many years on Dec Alphas during my postgrad years. 🤷♂

can you rebase this on develop

@kilograham Sure thing!

I'm a bit torn over this; scalar_storage_order isn't supported on clang (even gcc mode). I don't believe we have any non target device which touches this which isn't C++ anyway.
I'd be tempted perhaps to do (i will keep trying to think of a nice way to do this with typedefs - I guess we can guard with an #ifdef)
#ifndef le_uint32_t
#define le_uint32_t uint32_t
#endif

in the headers (or in a common one if we have one which works across elf2uf2, picotool, regular build etc)
And that way we defer everything to the user.
C code, can continue to have to reverse byte orders manually (or wrap the structure with another one which reverses the byte order using scalar_storage_order - if that's what they choose to do)
In our C++ we can define le_uint32_t to be stored_little_endian<uint32_t> before including the header

I'm a bit torn over this; scalar_storage_order isn't supported on clang (even gcc mode).

Ah, ok.  In that case at the very least there should be a conditional #error to catch the case where you use clang on a big-endian host.  But not using it at all might be preferable.

I don't believe we have any non target device which touches this which isn't C++ anyway.

Maybe I mistunderstand your point here, but C code compiled for the host using the relevant structs exist in the file picoboot_connection.c (which is in picotool, but the header file picoboot.h that it gets the structs from is in pico-sdk).
Of course, changing this file to C++ could be an option.

In our C++ we can define le_uint32_t to be stored_little_endian<uint32_t> before including the header

Right, but wouldn't it make sense for platform.h to make that define and provide the appropriate template?  If you don't like e.g. uf2.h getting an added #include "pico/platform.h", the C++ source code could be required to include it from the top level instead.  Or I guess a new header file with a different name.  It just doesn't seem like this wheel should have to be reinvented by each client.  :smile_cat:

@kilograham I reworked the patch to work along the lines you described.  The SDK patch wasn't affected that much.  The picotool patch became a bit more messy when picoboot_connection.c can't rely on __attribute__((scalar_storage_order)) anymore, but it's not too bad.  I'll open a PR for that repo to so you can take a look.

Moved to 1.2.1 as I think i want to put the stuff in platform.h after all

FYI, the pico-sdk autopkgtest failed on (big endian) s390x before but with the (rebased) patch from this pull request it passes now: https://ci.debian.net/packages/p/pico-sdk/testing/s390x/47384722/


Add grade equiv to student charts

Hey @alexsoble!
Still refactoring here to make this PR more DRY - but tagging you here in case you have any feedback!

@alexsoble - Here is the failing test:

To get the grade level equivalent figure into the chart, I added a fifth item to the array (a "quad") that creates the x and y values that eventually populate the tooltip... this fifth item is causing the test to fail.  If you see a better way to pass in the data, I am happy to change it up.  Also happy to amend the test.

@pauledwardmitchell -- Yes! If you update the test to passing we should be good to go!  👍

tests passing! @alexsoble

OK awesome @pauledwardmitchell! Let me import the real grade level equivalent data into Insights and then I'll merge this in.

Hey @pauledwardmitchell -- one quick thing I noticed looking at the data -- we seem to be missing one digit. For example, when a student's grade level equivalent is "4.2", we're displaying it on Highcharts as "4". My intuition would be to keep the extra information after the decimal point, what do you think?

Hey @alexsoble - let's totally keep the decimal.
I'll fix it right up

@pauledwardmitchell groovy!

@pauledwardmitchell I'm importing the STAR grade_equivalent data into Insights now so that we can merge in your PR and push to production.

👍

Hey @pauledwardmitchell! I merged and pushed to master. Looks okay but there are a few things that seem weird to me... (1) The values are showing integers only, not decimals — not sure to_f did the trick. We should double check this in the demo data. (2) It looks like null values are being displayed as 0, which isn't right — let's handle null. These can wait for Monday I think but we should tackle them first thing next week.

@alexsoble - Hmmmmmmm - thanks for this feedback. I'll look into it presently.


HTTP POST: ResourceWarning: unclosed file <_io.BufferedRandom name=36>

There is a resource leek that I cannot determine from my code. I guess it's from bottle.
Bottle v0.12.18 server starting up (using WSGIRefServer())...
Listening on http://irsdev:5000/
Hit Ctrl-C to quit.

On Fileupload (via tracemalloc):

/devel/anaconda3/envs/asdf/bin/bottle.py:1672: ResourceWarning: unclosed file <_io.BufferedRandom name=36>
def fset(self, value): ls.var = value
Object allocated at (most recent call last):
File "/devel/anaconda3/envs/asdf/lib/python3.7/tempfile.py", lineno 622
newline=newline, encoding=encoding)

Function:
@route('/api/<threshold:float>', method='POST')
def func(threshold=0.5):

Command:
curl -X POST -F<EMAIL_ADDRESS>http://irsdev:5000/api/0.5

At some point you probably access request.body. And if the body is too big it puts it into a temporary file (opens a file). From what I can see you're responsible for closing the file. Unless you do, you get the warning. Such warnings are displayed only in debug mode. To get more lines of traceback, run it with PYTHONTRACEMALLOC=N, where N is the desired number of lines of the traceback.

Turns out using NamedTemporaryFile instead of TemporaryFile fixes the ResourceWarning in most cases because NamedTemporaryFile (indirectly) implements __del__ to explicitly close (and remove) the file. This is not needed for TemporaryFile because these are unlinked immediately, which is why these are still technically 'open' when the garbage collector collects the file, which in turn triggers the warning.
Only downside is that on a hard crash, a temporary file may remain on disk, so this is not an ideal solution. Deprecating a request.body that lives longer than the request and switching back to TemporaryFile might be the cleaner option. Until then, I'll consider this fixed (in master). I'll keep one of the related issues open.

I know that this is old, but for anyone who stumbles upon this: even if you're not directly accessing request.body but rather referencing your uploaded file with request.files.get("NAME").file , you still need to close the body with request.body.close(), otherwise you'll also get this warning.


Ignore blank lines and comments at the end of query files for datafusion-cli

Which issue does this PR close?
Close #7071
Rationale for this change
For better usability.
What changes are included in this PR?
Changed exec::exec_from_lines to ignore blank lines and comments at the end of query files for datafusion-cli.
Are these changes tested?
Manually tested with query files which contain the following queries.
select now();

select now();

-- Some comments

Then, datafusion-cli doesn't complain.
+--------------------------------+
| now()                          |
+--------------------------------+
| 2023-07-24T18:22:06.373420703Z |
+--------------------------------+
1 row in set. Query took 0.005 seconds.

Are there any user-facing changes?
No.

I merged up from main to get the fix for https://github.com/apache/arrow-datafusion/issues/7078 and hope to merge this when tests pass


GPP Carousel Bug

in safari w/ one item in the carousel
cc @garrengotthardt

thanks @owendodd ! i think luckily this is just an artsy admin only issue (but cc @starsirius to confirm) - that fair booth its pulling in info for is an upcoming booth for which no works have been added and no cover image exists so its not published but for artsy admins the carousel is still trying to pull in the unpublished booth


Search 'using namespace std' should start from the (point-min)

Search 'using namespace std' should start from the (point-min).

Replace this with a summary of what you've changed and why, followed by a list of issues it affects, if any.
Fix: #0000
Ref: #0000
Close: #0000

[x] I searched the issue tracker and this hasn't been PRed before.
[x] My changes are not on the do-not-PR list for this project.
[ ] My commits conform to the git conventions.
[ ] My changes are visual; I've included before and after screenshots.
[x] I am blindly checking these off.
[x] Any relevant issues or PRs have been linked to.
[ ] This a draft PR; I need more time to finish it.

Thanks for your help!


Destroy the Banner

Must do it to avoid the error: Multiple locks on web thread not allowed
How do it: removeFromSuperview the bannerView and set nil on him

Thanks @dulvui


question: can this be made to work on chrome? any equivalent extension on chrome?

question: can this be made to work on chrome? any equivalent extension on chrome?

I don't know. As my goal was to support mainly/only Firefox, I did not avoid Firefox-specific parts of the WebExtension API, and I may even have intentionally used some of them if they provided better functionality than the alternatives common with other browsers. Additionally, some security and privacy aspects rely on how things work on Firefox and porting the code to work on Chrome may end up compromising privacy and/or security.
I myself don't use Chrome so I don't have interest or expertise to do it. I am also somewhat ideologically opposed to using Chrome due to its issues with privacy and browser monoculturalization (of which at least the latter applies also to Chromium, Edge, and other Chromium derivatives). My stance on this is not so strict though that I would categorically deny nice things to Chrome users, so I am not opposed to someone else doing the work.
So if someone wants to port LSR to work in Chrome, I can take a look at the patch they come up with. Provided it does not compromise the add-on's functionality in Firefox, it can be merged here. Otherwise the port will have to live in a separate branch or fork. In any case the author of the port will effectively volunteer themself as the add-on's Chrome tester and maintainer ;-)
(Tagging this as wontfix because I will not be doing it, but leaving open (for now) in case someone else wants to.)


(maint) Use transducers for database streaming

This commit changes the database streaming we do for the query-eng to
use transducers which allows us to significantly simplify the interface
for our streaming functions.

Test PASSed.
Refer to this link for build results (access rights to CI server needed):
https://jenkins.puppetlabs.com/job/platform_puppetdb_intn-sys_pr/1269/

need to fix some of the error handling

No use leaving this open while Ryan's gone, gonna reopen once I can grab him for some help

@ajroetker do we have a new ticket to track this?


Removes Vec allocation

It looks like you are allocating a Vec and then immediately turning it back into an iterator, you can skip the allocation and just use the env::args iterator directly

Looks like OP is relatively new to Rust. Not trying to discourage at all, I think this project could lead to something interesting!
As for another big sore thumb, you don't need to return true in your check_if_dir function, just return the condition


Discuss what's involved with moving current Jekyll site to the Dummy app

Let's discuss what needs to happen to get the current Jekyll site into the Dummy app of the main addon.

Legacy doc versions. Can we just copy static output from current site and put it into /public?
Autobuilding. Right now GitHub autobuilds/deploys the docs after a change. Will we be able to achieve something similar, every time the dummy app is updated? There's an ember-cli-gh-pages plugin that build the app and pushes the static output to the gh-pages branch. Will Travis be able to do this for us? I really want this to be automated.
Markdown files. It'd be great if we could have the option to still author parts of the Guides that don't need dynamic/Ember content in Markdown. Easy to read, easy for newbies to edit. I think I experimented with this a year ago, with an addon that takes .md files and renders them to html and then .hbs so they end up as regular hbs templates in the final step.

Anything else I'm missing? Anyone have more thoughts here, or want to volunteer to help?


Customize integrity error message (question)

Question
Hello, I would like to know what is the correct way to do the following in backpack.
I have a  :
Section Model -> has many products
Product Model -> belongs to a Section
I have integrity and relations defined in db and models.
When I try to delete a Section with products the database throws a "Integrity constraint violation", thats fine is working as expected.
What I want to do is customize the error that is show in backpack "NOT deleted, There's been an error. Your item might not have been deleted.", with (for example) "Hey mate are you crazy, there will be a lot of crying products if you let them orphaned"
I understand that the best way to do that is asking first for the existence of Products in that Section before delete and show a message and abort if they exists, and not capture the message for database (I'm was used to that in .net for example), so I tried to do it with :

laravel events
laravel observers
overwrite destroy() in my controller

No matter what I do the problem is always the same the Alert::error(...)->flash(); only shows after a I exit the current url and load another (and after the message from backpack has showed), there is no way that I can overwrite the message of backpack and stay gracefully in the grid, even if I do a redirect to the current url.
I have wasted many hours with this, and I'm sure that I'm missing something obvious because is a very common use case and can't be so cumbersome.

Hi @androidedev ,
You should be able to customize the message by overwriting the destroy() method in your controller AND customizing the delete button. If you create a blade file in your resources/views/vendor/backpack/crud/buttons/delete.blade.php, Backpack will pick up that one instead of the one in the package. That's where the message logic is right now, unfortunately. So to sum up:

overwrite destroy() to check that relationships do not exist before deleting; return a custom message as an AJAX response instead of the standard one;
overwrite buttons.delete view to show the message passed by the destroy() method, instead of the standard one;

Hope it helps.
Cheers!
P.S. Alternatively, you could overwrite the message with a generic one, by just publishing the CRUD lang files. But you'd still have to overwrite the destroy() method. I think the method above provides better UX.

Thank you @tabacitu I will try the second path, I don't like to overwrite the backpack views if I can avoid it.


⚠ Turnos 24x7 has degraded performance

In da82846, Turnos 24x7 (https://reservas-dev.alternativasinteligentes.com/) experienced degraded performance:

HTTP code: 200
Response time: 1421 ms

Resolved: Turnos 24x7 performance has improved in 77e64ba.


Add f!felix

lets push the meme as far as possible then

https://ufile.io/rcsgm

dont post malicious file here kthx

Its not malicious lol. Thats the download for the zip file. tested it myself is safe

No promises tho

use imgur's api for that as well

discretely removing that from the 1.2.3 and planning it to the 1.3.3 since im not motivated enough lul

Referenced in #103


feat: municipaliy page

:tada: This PR is included in version 1.28.0 :tada:
The release is available on GitHub release
Your semantic-release bot :package::rocket:


Donut Chart directive, styles, ng-docs, and unit test

The styles for the donut chart need to live in angular-patternfly#master (in new angular-patternfly.css file) since the donut chart implementation is being generated by angular-patternfly (there is no equivalent in patternfly#master)

Do we have a coding standard on var blah = function(variable){}; vs var blah = function (variable) {};?  I see both in this PR.

Missing tests for the mixin factory.

LGTM

Hi Walden,
I believe I have addressed all of your issues that are within the scope of this PR.
Thanks for all the feedback,

Dave
p.s. I will squash all commits into a single one before merge

LGTM, thanks!


Page lifecycle api updates

Fix minor content issues and update author photo.

Whoops!
There were 2 warnings that will prevent this PR from being merged. Please take a look, and either fix, or provide a justification for why they can't be fixed.
WARNINGS
src/content/en/updates/2018/07/page-lifecycle-api.md#L706 - Line must be at most 100 characters
src/content/en/updates/2018/07/page-lifecycle-api.md#L925 - Line must be at most 100 characters

:tada: This has been pushed live to https://developers.google.com/web/


SELinux prevents access to existing sub-directories in statically provisioned PVs

Describe the bug
When using static provisioning in OpenShift 4.7 with Scale CSI v2.2.0 to gain access to an entire IBM Spectrum Scale file system (e.g. mounted at /mnt/fs1 in CNSA) with existing data then SELinux on the worker node prevents access to existing sub-directories even when running the pod under OpenShift with cluster-admin role. This was observed with IBM Spectrum Scale CNSA v<IP_ADDRESS> and CSI v2.2.0 on x86 and OpenShift 4.7.17.
To Reproduce

We have an existing file system in IBM Spectrum Scale that we want to make available in OpenShift with static provisioning:

File system attributes on CNSA:
sh-4.4# mmlscluster
GPFS cluster information
========================
  GPFS cluster name:         ibm-spectrum-scale.ibm-spectrum-scale.ocp4.scale.ibm.com
  GPFS cluster id:<PHONE_NUMBER>4533218545

sh-4.4# mmlsfs fs1 --uid
flag                value                    description
------------------- ------------------------ -----------------------------------
 --uid              099B6A7A:5EB99721        File system UID

sh-4.4# mmremotefs show
Local Name  Remote Name  Cluster name       Mount Point        Mount Options    Automount  Drive  Priority
fs1         ess3000_1M   ess3000.bda.scale.ibm.com /mnt/fs1           rw               yes          -        0

File system attributes on remote storage cluster:
[root@fscc-sr650-12 dynamic2]# mmlscluster

GPFS cluster information
========================
  GPFS cluster name:         ess3000.bda.scale.ibm.com
  GPFS cluster id:<PHONE_NUMBER>87177715

[root@fscc-sr650-12 dynamic2]# mmlsfs ess3000_1M --uid
flag                value                    description
------------------- ------------------------ -----------------------------------
 --uid              099B6A7A:5EB99721        File system UID

[root@fscc-sr650-12 GPFS]# mmlsfs ess3000_1M -Q --perfileset-quota --filesetdf
flag                value                    description
------------------- ------------------------ -----------------------------------
 --filesetdf        yes                      Fileset df enabled?
 -Q                 user;group;fileset       Quotas accounting enabled
                    user;group;fileset       Quotas enforced
                    none                     Default quotas enabled
 --perfileset-quota no                       Per-fileset quota enforcement

[root@fscc-sr650-12 GPFS]# mmlsconfig enforceFilesetQuotaOnRoot
enforceFilesetQuotaOnRoot yes

[root@fscc-sr650-12 GPFS]# mmlsconfig controlSetxattrImmutableSELinux
controlSetxattrImmutableSELinux yes

[root@fscc-sr650-12 dynamic2]# ls -al /gpfs/ess3000_1M/
total 262
drwxr-xr-x. 13 root       root       262144 Aug 30 13:42 .
drwxr-xr-x.  5 root       root           62 Apr 14 22:42 ..
drwxrwxrwx.  2 root       root         4096 Aug 30 11:37 nfs-export

[root@fscc-sr650-12 dynamic2]# ls -al /gpfs/ess3000_1M/nfs-export/
total 258
drwxrwxrwx.  2 root root   4096 Aug 30 14:33 .
drwxr-xr-x. 13 root root 262144 Aug 30 13:42 ..
-rw-r--r--.  1 root root   1148 Aug 25 19:00 fstab
-rw-r--r--.  1 root root    158 Aug 25 19:00 hosts
-rw-rw-rw-.  1 root root      0 Aug 30 11:37 readall

Create a static PV pv000 for that GPFS root directory (mounted at /mnt/fs1 with CNSA <IP_ADDRESS>):

We create a static PV for the directory /mnt/fs1 on CNSA which is backed by a remote filesystem /gpfs/ess3000_1M on a remote storage cluster.
In order to allow a direct binding between the PVC and the specific PV holding the specific data we make use of Kubernetes labels and use a faked storage class name "static" which is used as some sort of annotation or identifier rather than a real storage class (which it isn't) - this prevents that the default storage class (if any should be defined) is applied instead rather than matching the specific PV from the pool of statically provisioned PVs with the PVC and its specific labels (in case the storage class is omitted in the PVC).
[gero@oc6314270534]$ cat pv000.yaml
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv000
  labels:
    product: ibm-spectrum-scale
    type: test
spec:
  storageClassName: static
  capacity:
    storage: 100Gi
  accessModes:
    - ReadWriteMany
  csi:
    driver: spectrumscale.csi.ibm.com
    volumeHandle: "17399599334533218545;099B6A7A:5EB99721;path=/mnt/fs1"

[gero@oc6314270534]$ oc apply -f pv000.yaml
persistentvolume/pv000 created

[gero@oc6314270534]$ oc get pv
NAME                             CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS      CLAIM                                                         STORAGECLASS                  REASON   AGE
pv000                            100Gi      RWX            Retain           Available                                                                 static                                 3s

Create PVC for that volume

The following PVC achieves a direct 1:1 match between the claim and the specifc PV created above with the labels and the faked storage class name as selectors:
[gero@oc6314270534]$ cat pvc000.yaml
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: pvc000
spec:
  storageClassName: static
  accessModes:
  - ReadWriteMany
  resources:
    requests:
      storage: 100Gi
  selector:
    matchLabels:
      product: ibm-spectrum-scale
      type: test

[gero@oc6314270534]$ oc apply -f pvc000.yaml
persistentvolumeclaim/pvc000 created

[gero@oc6314270534]$ oc get pvc
NAME     STATUS   VOLUME   CAPACITY   ACCESS MODES   STORAGECLASS   AGE
pvc000   Bound    pv000    100Gi      RWX            static         4s

Create pod as user with cluster-admin role

[gero@oc6314270534]$ cat pod.yaml
kind: Pod
apiVersion: v1
metadata:
  name: pod
spec:
  containers:
    - name: test
      image: registry.access.redhat.com/ubi8/ubi-minimal:latest
      command: [ "/bin/sh", "-c", "--" ]
      args: [ "while true; do echo $(hostname) $(date +%Y%m%d-%H:%M:%S) | tee -a /train/train1.log ; sleep 5 ; done;" ]
      volumeMounts:
        - name: vol1
          mountPath: "/data"
  volumes:
    - name: vol1
      persistentVolumeClaim:
        claimName: pvc000

[gero@oc6314270534]$ oc apply -f pod.yaml
pod/pod created

[gero@oc6314270534]$ oc get pods
NAME   READY   STATUS              RESTARTS   AGE
pod    1/1     Running             0          13s

Verify that access to existing sub-directories is denied by SELinux

[gero@oc6314270534]$ oc rsh pod

sh-4.4# id
uid=0(root) gid=0(root) groups=0(root)
sh-4.4# whoami
root

sh-4.4# df -h
Filesystem      Size  Used Avail Use% Mounted on
overlay         446G   29G  418G   7% /
tmpfs            64M     0   64M   0% /dev
tmpfs           126G     0  126G   0% /sys/fs/cgroup
shm              64M     0   64M   0% /dev/shm
tmpfs           126G  105M  126G   1% /etc/hostname
fs1              15T  6.5G   15T   1% /data
/dev/sda4       446G   29G  418G   7% /etc/hosts
tmpfs           126G   28K  126G   1% /run/secrets/kubernetes.io/serviceaccount
tmpfs           126G     0  126G   0% /proc/acpi
tmpfs           126G     0  126G   0% /proc/scsi
tmpfs           126G     0  126G   0% /sys/firmware

sh-4.4# ls -al /data
total 262
drwxr-xr-x. 13 root       root       262144 Aug 30 11:42 .
dr-xr-xr-x.  1 root       root           18 Aug 30 12:10 ..
drwxrwxrwx.  2 root       root         4096 Aug 30 09:37 nfs-export

# Read/Write access to mount point /data is granted
sh-4.4# touch /data/testfile
sh-4.4# ls -al /data/
total 262
drwxr-xr-x. 13 root       root       262144 Aug 30 12:11 .
dr-xr-xr-x.  1 root       root           18 Aug 30 12:10 ..
-rw-r--r--.  1 root       root            0 Aug 30 12:11 testfile
drwxrwxrwx.  2 root       root         4096 Aug 30 09:37 nfs-export
sh-4.4# rm /data/testfile

# Read/Write access to existing sub-directory under mount point /data is denied by SELinux
sh-4.4# ls -al /data/nfs-export/
ls: cannot open directory '/data/nfs-export/': Permission denied
sh-4.4# cat /data/nfs-export/hosts
cat: /data/nfs-export/hosts: Permission denied
sh-4.4# cat /data/nfs-export/hostss
cat: /data/nfs-export/hostss: No such file or directory
sh-4.4# cat /data/nfs-export/readall
cat: /data/nfs-export/readall: Permission denied
sh-4.4# ls -al /data/nfs-export/readall
ls: cannot access '/data/nfs-export/readall': Permission denied

sh-4.4# stat /data/
  File: /data/
  Size: 262144    	Blocks: 512        IO Block: 262144 directory
Device: 100039h/1048633d	Inode: 3           Links: 13
Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2021-08-30 12:11:52.072513451 +0000
Modify: 2021-08-30 12:11:58.880299000 +0000
Change: 2021-08-30 12:11:58.880299000 +0000
 Birth: -

sh-4.4# stat /data/nfs-export/
  File: /data/nfs-export/
  Size: 4096      	Blocks: 1          IO Block: 262144 directory
Device: 100039h/1048633d	Inode: 19456       Links: 2
Access: (0777/drwxrwxrwx)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2021-08-30 09:38:09.693424826 +0000
Modify: 2021-08-30 09:37:56.904677000 +0000
Change: 2021-08-30 09:37:56.904677000 +0000
 Birth: -

sh-4.4# ls -al /data/nfs-export/
ls: cannot open directory '/data/nfs-export/': Permission denied

sh-4.4# cat /data/nfs-export/hosts
cat: /data/nfs-export/hosts: Permission denied

Check the SELinux logs on the OpenShift worker node where pod is running

[gero@oc6314270534]$ oc get pods -o wide
NAME   READY   STATUS    RESTARTS   AGE     IP             NODE                          NOMINATED NODE   READINESS GATES
pod    1/1     Running   0          3m19s   <IP_ADDRESS>   worker04.ocp4.scale.ibm.com   <none>           <none>

root@worker04 core]# aureport -a

AVC Report
===============================================================
# date time comm subj syscall class permission obj result event
===============================================================
41. 08/30/2021 12:11:11 ls system_u:system_r:container_t:s0:c20,c25 257 dir read unconfined_u:object_r:unlabeled_t:s0 denied 281388
42. 08/30/2021 12:11:16 ls system_u:system_r:container_t:s0:c20,c25 257 dir read system_u:object_r:unlabeled_t:s0 denied 281389
43. 08/30/2021 12:11:23 cat system_u:system_r:container_t:s0:c20,c25 257 file read system_u:object_r:unlabeled_t:s0 denied 281391
44. 08/30/2021 12:11:30 sh system_u:system_r:container_t:s0:c20,c25 257 dir read system_u:object_r:unlabeled_t:s0 denied 281392
45. 08/30/2021 12:11:33 cat system_u:system_r:container_t:s0:c20,c25 257 file read unconfined_u:object_r:unlabeled_t:s0 denied 281393
46. 08/30/2021 12:12:17 ls system_u:system_r:container_t:s0:c20,c25 257 dir read system_u:object_r:unlabeled_t:s0 denied 281397
47. 08/30/2021 12:12:24 cat system_u:system_r:container_t:s0:c20,c25 257 file read system_u:object_r:unlabeled_t:s0 denied 281438

[root@worker04 core]# ausearch -m avc | tail -20
----
time->Mon Aug 30 12:11:30 2021
type=PROCTITLE msg=audit(1630325490.681:281392): proctitle="/bin/sh"
type=SYSCALL msg=audit(1630325490.681:281392): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=564bd8f6e290 a2=90800 a3=0 items=0 ppid=2508113 pid=2508123 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4294967295 comm="sh" exe="/usr/bin/bash" subj=system_u:system_r:container_t:s0:c20,c25 key=(null)
type=AVC msg=audit(1630325490.681:281392): avc:  denied  { read } for  pid=2508123 comm="sh" name="nfs-export" dev="gpfs" ino=19456 scontext=system_u:system_r:container_t:s0:c20,c25 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0
----
time->Mon Aug 30 12:11:33 2021
type=PROCTITLE msg=audit(1630325493.138:281393): proctitle=2F7573722F62696E2F636F72657574696C73002D2D636F72657574696C732D70726F672D73686562616E673D636174002F7573722F62696E2F636174002F646174612F6E66732D6578706F72742F72656164616C6C
type=SYSCALL msg=audit(1630325493.138:281393): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7ffd810e6e06 a2=0 a3=0 items=0 ppid=2508123 pid=2509511 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4294967295 comm="cat" exe="/usr/bin/coreutils" subj=system_u:system_r:container_t:s0:c20,c25 key=(null)
type=AVC msg=audit(1630325493.138:281393): avc:  denied  { read } for  pid=2509511 comm="cat" name="readall" dev="gpfs" ino=66048 scontext=system_u:system_r:container_t:s0:c20,c25 tcontext=unconfined_u:object_r:unlabeled_t:s0 tclass=file permissive=0
----
time->Mon Aug 30 12:12:17 2021
type=PROCTITLE msg=audit(1630325537.086:281397): proctitle=2F7573722F62696E2F636F72657574696C73002D2D636F72657574696C732D70726F672D73686562616E673D6C73002F7573722F62696E2F6C73002D616C002F646174612F6E66732D6578706F72742F
type=SYSCALL msg=audit(1630325537.086:281397): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=55e0aab62820 a2=90800 a3=0 items=0 ppid=2508123 pid=2510912 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4294967295 comm="ls" exe="/usr/bin/coreutils" subj=system_u:system_r:container_t:s0:c20,c25 key=(null)
type=AVC msg=audit(1630325537.086:281397): avc:  denied  { read } for  pid=2510912 comm="ls" name="nfs-export" dev="gpfs" ino=19456 scontext=system_u:system_r:container_t:s0:c20,c25 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0
----
time->Mon Aug 30 12:12:24 2021
type=PROCTITLE msg=audit(1630325544.123:281438): proctitle=2F7573722F62696E2F636F72657574696C73002D2D636F72657574696C732D70726F672D73686562616E673D636174002F7573722F62696E2F636174002F646174612F6E66732D6578706F72742F686F737473
type=SYSCALL msg=audit(1630325544.123:281438): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7fff423cee08 a2=0 a3=0 items=0 ppid=2508123 pid=2511180 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4294967295 comm="cat" exe="/usr/bin/coreutils" subj=system_u:system_r:container_t:s0:c20,c25 key=(null)
type=AVC msg=audit(1630325544.123:281438): avc:  denied  { read } for  pid=2511180 comm="cat" name="hosts" dev="gpfs" ino=26112 scontext=system_u:system_r:container_t:s0:c20,c25 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=0

It appears we have full RW access to the root or first level of the file system backed by the static PV (/mnt/fs1) but we do not have any access to existing sub-directories in that directory /mnt/fs1/nfs-export). Even if the sub-directory's permissions is set to chmod 777.
Here, the statically provisioned PV is backed by the directory /mnt/fs1 in IBM Spectrum Scale which holds the sub-directory "nfs-export".
Expected behavior
When using static provisioning with IBM Spectrum Scale CSI to grant access to an existing directory (i.e. existing data) in IBM Spectrum Scale then it is expected that access to the sub-directories in that directory is available and not prevented by SELinux (as long as the file system UID/GID permissions allow it).
Environment
OpenShift Cluster w/CNSA:

CNSA v<IP_ADDRESS>
CSI v2.2.0

[gero@oc6314270534]$ oc get clusterversion
NAME      VERSION   AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.7.19    True        False         49d     Cluster version is 4.7.19

Storage cluster:

[root@fscc-sr650-12 dynamic2]# mmdiag
Current GPFS build: "<IP_ADDRESS> ".
Built on Jul  1 2021 at 16:02:28

[root@fscc-sr650-12]# rpm -qa | grep gpfs
gpfs.gskit-8.0.55-19.x86_64
gpfs.crypto-5.1.1-2.x86_64
gpfs.docs-5.1.1-2.noarch
gpfs.gnr-5.1.1-2.x86_64
gpfs.gnr.base-1.0.0-0.x86_64
gpfs.gss.pmcollector-5.1.1-2.el8.x86_64
gpfs.msg.en_US-5.1.1-2.noarch
gpfs.adv-5.1.1-2.x86_64
gpfs.gui-5.1.1-2.noarch
gpfs.gss.pmsensors-5.1.1-2.el8.x86_64
gpfs.base-5.1.1-2.x86_64
gpfs.gpl-5.1.1-2.noarch
gpfs.afm.cos-1.0.0-3.x86_64
gpfs.license.dmd-5.1.1-2.x86_64
gpfs.java-5.1.1-2.x86_64
gpfs.compression-5.1.1-2.x86_64

It seems that access to the sub-directories of a statically provisioned PV is not prevented by SELinux if the static PV itself is not backed by the root fileset of an IBM Spectrum Scale file system directly (e.g. mounted at /mnt/fs1).
If the static PV is instead backed  by a sub-directory located under the IBM Spectrum Scale file system's root directory (e.g. /mnt/fs1/nfs-export) then access to sub-directories in that directory works as expected and is not prevented by SELinux.
For example, if we only want to grant access to a sub-directory /mnt/fs1/nfs-export in IBM Spectrum Scale and not to the entire IBM Spectrum Scale file system mounted at /mnt/fs1 and all its sub-directories then it seems to work ok.
With a static PV backed by a sub-directory /mnt/fs1/nfs-export in IBM Spectrum Scale
[gero@oc6314270534]$ cat pv000.yaml
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv000
  labels:
    product: ibm-spectrum-scale
    type: test
spec:
  storageClassName: static
  capacity:
    storage: 100Gi
  accessModes:
    - ReadWriteMany
  csi:
    driver: spectrumscale.csi.ibm.com
    volumeHandle: "17399599334533218545;099B6A7A:5EB99721;path=/mnt/fs1/nfs-export"

and a PVC
[gero@oc6314270534]$ cat pvc000.yaml
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: pvc000
spec:
  storageClassName: static
  accessModes:
  - ReadWriteMany
  resources:
    requests:
      storage: 100Gi
  selector:
    matchLabels:
      product: ibm-spectrum-scale
      type: test

mounted in the pod at /data/fs1/nfs-export
[gero@oc6314270534]$ cat pod.yaml
kind: Pod
apiVersion: v1
metadata:
  name: pod
spec:
  containers:
    - name: test
      image: registry.access.redhat.com/ubi8/ubi-minimal:latest
      command: [ "/bin/sh", "-c", "--" ]
      args: [ "while true; do echo $(hostname) $(date +%Y%m%d-%H:%M:%S) | tee -a /train/train1.log ; sleep 5 ; done;" ]
      volumeMounts:
        - name: vol1
          mountPath: "/data/fs1/nfs-export"
  volumes:
    - name: vol1
      persistentVolumeClaim:
        claimName: pvc000

we have full access to all sub-directories and their files of this backing directory:
[gero@oc6314270534]$ oc rsh pod
sh-4.4# id
uid=0(root) gid=0(root) groups=0(root)

sh-4.4# ls -al /data/fs1/nfs-export/
total 3
drwxrwxrwx. 4 root root 4096 Aug 30 13:57 .
drwxr-xr-x. 3 root root   24 Aug 30 14:03 ..
drwxrwxrwx. 2 root root 4096 Aug 30 13:59 dir1
drwxr-xr-x. 2 root root 4096 Aug 30 13:58 dir2
-rw-r--r--. 1 root root 1148 Aug 25 17:00 fstab
-rw-r--r--. 1 root root  158 Aug 25 17:00 hosts
-rw-rw-rw-. 1 root root    0 Aug 30 09:37 readall

sh-4.4# ls -al /data/fs1/nfs-export/dir1
total 2
drwxrwxrwx. 2 root root 4096 Aug 30 13:59 .
drwxrwxrwx. 4 root root 4096 Aug 30 13:57 ..
-rw-r--r--. 1 root root  547 Aug 30 13:58 config
-rwxrwxrwx. 1 root root  451 Aug 30 13:59 crontab

sh-4.4# ls -al /data/fs1/nfs-export/dir2
total 2
drwxr-xr-x. 2 root root 4096 Aug 30 13:58 .
drwxrwxrwx. 4 root root 4096 Aug 30 13:57 ..
-rw-r--r--. 1 root root  547 Aug 30 13:58 config
sh-4.4# tail -1 /data/fs1/nfs-export/dir1/config

It seems that SELinux prevents access to sub-directories of the backing directory in a statically provisioned PV only in case the static PV's volumeHandle (e.g. "17399599334533218545;099B6A7A:5EB99721;path=/mnt/fs1") is pointing directly to the root fileset of an IBM Spectrum Scale file system (i.e. the root of an entire IBM Spectrum Scale file system).
In this case when granting access to an entire IBM Spectrum Scale file system with a statically provisioned PV (e.g. path=/mnt/fs1) the expected behavior would be to have full access to all sub-directories as determined by the individual file system permissions and access not to be prevented by SELinux on the worker nodes.

Looks like in case of root fileset PVC, OCP did not relabel the existing subdirectory. Saying because of following selinux log-

read system_u:object_r:unlabeled_t:s0

Can you verify by running ?

ls -lZ /mnt/fs1
ls -lZ /mnt/fs1/nfs-export

Few other things to check-

Is SELinux in permissive or enforcing mode on storage cluster?
Is there any different in ls -lZ output on storage vs OCP cluster?
Can you try the same thing with selinuxContext as MustRunAs in SCC? - https://www.ibm.com/docs/en/spectrum-scale-csi?topic=pods-considerations-mounting-read-write-many-rwx-volumes
Please also check the SELinuz considerations section here- https://www.ibm.com/docs/en/spectrum-scale-csi?topic=planning-deployment-considerations

Storage cluster SELinux settings for this Issue are:
[root@fscc-sr650-12 ~]# mmdsh -Nall -f1 getenforce
fab3-3a.bda.scale.ibm.com:  Enforcing
fab3-3b.bda.scale.ibm.com:  Enforcing
node12.bda.scale.ibm.com:  Enforcing
When I first run into this issue I had SELinux : Disabled  on all nodes in the storage cluster which was supposed to be the default on the ESS. When I opened this issue I already had changed the setting to Enforcing and also freshly created the directory nfs-export which was then used for the exercise described in this issue.
If the SELinux settings on the storage cluster do matter then what is the required SELinux setting on the IBM Spectrum Scale storage cluster / ESS used with CNSA/CSI on OpenShift?

File listing with ls -lZ on storage and client cluster
Note that most of the other directories here were created when SELinux was disabled. The nfs-export directory referred to in this Issue was freshly created after enabling SELinux: Enforcing on the storage cluster.
gero:~$ oc rsh ibm-spectrum-scale-core-75l5b
sh-4.4# ls -lZ /mnt/fs1
total 6
drwxr-xr-x. 5 root       root       system_u:object_r:container_file_t:s0:c20,c25    4096 Feb 15  2021 DAAA
drwxr-xr-x. 2 root       root       system_u:object_r:container_file_t:s0:c10,c25    4096 Mar 23 22:02 MYDATA
drwxrwxrwx. 2 root       root       unconfined_u:object_r:unlabeled_t:s0             4096 Apr  9 17:58 cpd-volumes
drwxr-xr-x. 4 root       root       unconfined_u:object_r:unlabeled_t:s0             4096 Jun 24 17:34 demo
drwxr-xr-x. 2 root       root       unconfined_u:object_r:unlabeled_t:s0             4096 Jul 23 11:25 mvi
-rw-r--r--. 1 root       root       system_u:object_r:container_file_t:s0:c20,c25       0 Aug 30 11:00 myNewFile
drwxrwxrwx. 5 root       root       system_u:object_r:container_file_t:s0:c20,c25    4096 Sep 13 12:46 nfs-export
drwxrwxrwx. 2 root       root       unconfined_u:object_r:unlabeled_t:s0             4096 Apr 18 18:41 sherlock
drwxrwx--x. 3 root       root       system_u:object_r:unlabeled_t:s0                 4096 Jul 22 19:25 spectrum-scale-csi-volume-store
drwxr-xr-x. 2 root       root       system_u:object_r:container_file_t:s0:c249,c1012 4096 Jun 24 22:08 test
drwxrwxrwx. 2 root       root       unconfined_u:object_r:unlabeled_t:s0             4096 Jun  7 16:08 wmla
drwxrwxrwx. 9<PHONE_NUMBER><PHONE_NUMBER> system_u:object_r:container_file_t:s0:c24,c27    4096 May  6 20:39 wmla-afm

[root@fscc-sr650-12 ~]# ls -lZ /gpfs/ess3000_1M/
total 6
drwxr-xr-x. 5 root       root       system_u:object_r:container_file_t:s0:c20,c25    4096 Feb 15  2021 DAAA
drwxr-xr-x. 2 root       root       system_u:object_r:container_file_t:s0:c10,c25    4096 Mar 23 23:02 MYDATA
drwxrwxrwx. 2 root       root       unconfined_u:object_r:unlabeled_t:s0             4096 Apr  9 19:58 cpd-volumes
drwxr-xr-x. 4 root       root       unconfined_u:object_r:unlabeled_t:s0             4096 Jun 24 19:34 demo
drwxr-xr-x. 2 root       root       unconfined_u:object_r:unlabeled_t:s0             4096 Jul 23 13:25 mvi
-rw-r--r--. 1 root       root       system_u:object_r:container_file_t:s0:c20,c25       0 Aug 30 13:00 myNewFile
drwxrwxrwx. 5 root       root       system_u:object_r:container_file_t:s0:c20,c25    4096 Sep 13 14:46 nfs-export
drwxrwxrwx. 2 root       root       unconfined_u:object_r:unlabeled_t:s0             4096 Apr 18 20:41 sherlock
drwxrwx--x. 3 root       root       system_u:object_r:unlabeled_t:s0                 4096 Jul 22 21:25 spectrum-scale-csi-volume-store
drwxr-xr-x. 2 root       root       system_u:object_r:container_file_t:s0:c249,c1012 4096 Jun 25 00:08 test
drwxrwxrwx. 2 root       root       unconfined_u:object_r:unlabeled_t:s0             4096 Jun  7 18:08 wmla
drwxrwxrwx. 9<PHONE_NUMBER><PHONE_NUMBER> system_u:object_r:container_file_t:s0:c24,c27    4096 May  6 22:39 wmla-afm

The output from the CNSA cluster and storage cluster looks the same to me.
All files in the nfs-export sub-directory carry the same SELinux flags:
Storage cluster:
[root@fscc-sr650-12 ~]# ls -lZ /gpfs/ess3000_1M/nfs-export/
-rw-r--r--. 1 root root system_u:object_r:container_file_t:s0:c20,c25<PHONE_NUMBER> Sep  8 15:46 dd10.out
-rw-r--r--. 1 root root system_u:object_r:container_file_t:s0:c20,c25<PHONE_NUMBER> Sep  8 15:47 dd11.out
...

CNSA:
sh-4.4# ls -lZ /mnt/fs1/nfs-export
-rw-r--r--. 1 root root system_u:object_r:container_file_t:s0:c20,c25<PHONE_NUMBER> Sep  8 13:46 dd10.out
-rw-r--r--. 1 root root system_u:object_r:container_file_t:s0:c20,c25<PHONE_NUMBER> Sep  8 13:47 dd11.out
...

Please also note my first comment.

When mounting a static PV of /mnt/fs1 (the root directory of a Spectrum Scale fs)  into the Pod then SELinux prevents access to all the sub-directories in there, for example, also nfs-exports.

When mounting a static PV of a sub-directory of the same Spectrum Scale root fs into the Pod, e.g. /mnt/fs1/nfs-export, with the very same deployment and environment then everything works fine including full access to all the sub-directories in nfs-export.

So it only fails when mounting an entire Spectrum Scale root file system via a static PV.

@amdabhad Please check this.

Issue 1. When a directory A is used for a PV, and in turn used by a pod then inside the pod, the sub-directories of A are not accessible.

Solution:
a. Enable SELinux on storage cluster nodes where scale is installed
b. Add a label container_file_t recursively to the directory which you want use as storage for CNSA.
Following are the steps to add the required label to a directory e.g. /ibm/fs1 recursively:

  semanage fcontext -a -t container_file_t "/ibm/fs1(/.*)?"
  restorecon -R -v /ibm/fs1

Issue 2. When multiple pods are accessing same/nested path - the pods created earlier lose access to the common path due to relabeling.

Solution:
a. Create a new SCC (or edit the existing SCC used by your app) with a constant label
e.g.

   seLinuxContext:
	seLinuxOptions:
	  level: "s0:c50,c100"

b. In order for multiple pods to have access to a common path, the pods must use above SCC.
@gfschmidt Please have a look at these solutions and let me know if any concerns.

Summary of open issues:

When using a static PV backed by an entire IBM Spectrum Scale file system (e.g., /mnt/fs1) then no SELinux relabeling takes place and the pod mounting the PV has no access to the data because no SELinux relabeling takes place. This behavior is not expected. With a regular directory in the IBM Spectrum file system (e.g., /mnt/fs1/dir1) SELinux relabeling takes place and access is ensured for the pod mounting the PV.

PV -> volumeHandle: "17399599334539944523;099B6A7A:5EB99721;path=/mnt/fs1"         <- no SELinux relabeling
PV -> volumeHandle: "17399599334539944523;099B6A7A:5EB99721;path=/mnt/fs1/dir1"  <- SELinux relabeling

A definitive direction if SELinux needs to be enabled or disabled on the IBM Spectrum Scale storage cluster (i.e. set to enforcing | permissive | disabled and targeted | minimum/mls) is missing in the official documentation. As far as I know the default setting with IBM ESS SELinux is typically disabled on the ESS IO nodes. Is setting SELinux to enabled on ESS IO nodes required without impacting overall performance (e.g., metadata operations)?

@gfschmidt , thank you for the detailed try outs and updates in this issue.
HPO team is also at the same state that the IBM SS FS (/mnt/fs1) is mounted onto the Noobaa pod using the namespacestore which will vary whenever we reinstall Noobaa on the OCP cluster. We are in 5121 stream and there is no proper automatic method to set this looks like
On SC we are doing Permissive and we have issues when working on the complete solution of creating objects etc
-- We mount the /mnt/fs1 as is on the pod (static PV)
-- We have created user directories on the SC with appropriate permissions on RWX
-- on OCP cluster we deploy the HPO solution (CNSA+CSI+HPO-DAS)
-- For Object access we create the user account with the pre-created directory on SC passed for the DAS service
-- From App node we try to create the IO using user credentials and then we run into this issue of Access Denied while trying to create objects into that directory.
@amdabhad / CSI team this has been discussed with @deeghuge few times with live debugging and we need an E2E solution without any manual changes on SC.
Noobaa suggested a solution to openup c0.c1023 (as temporary workaround)  until this issue is fixed, which we see as a security loop hole by HPO team.
Can we reanalyze and get the Fix here ?

@gfschmidt --> you can refer to Noobaa defect 6761 that has all the details w/r/t scc changing for each install of Noobaa in openshift-storage ns

@amdabhad
Could you comment on what happens if we followed step 1 of "semanage, restorecon" and then the cluster nodes rebooted. After the SS FS is mounted, the steps needs to be repeated ?
Cluster rebooted for us as shown below
mmdsh -N all uptime
rkomandu-ss5121-x-master.fyre.ibm.com:   03:21:40 up 5 days, 13:10,  3 users,  load average: 0.23, 0.10, 0.09
rkomandu-ss5121-x-worker2.fyre.ibm.com:   03:21:40 up 5 days, 13:10,  0 users,  load average: 0.42, 0.12, 0.03
rkomandu-ss5121-x-worker1.fyre.ibm.com:   03:21:40 up 5 days, 13:12,  0 users,  load average: 0.06, 0.07, 0.05

@rkomandu If you are following step 1, I think you will have to perform this step again when the nodes are rebooted, because I have seen the scale operations like mmount change the labels.

When mounting the root of the volume - how does the Pod definition looks like and how does it the mount appear on the node where pod was scheduled? i.e - can you post precise mount options that was visible once volume was mounted on the node?

Hi @gnufied , On worker node filesystem is mounted at /var/mnt/gpfs1.
sh-4.4# mount| grep gpfs
gpfs1 on /var/mnt/gpfs1 type gpfs (rw,relatime,seclabel)

sh-4.4# ls -laZ /var/mnt/gpfs1
total 259
drwxr-xr-x. 6 root root system_u:object_r:unlabeled_t:s0      262144 Jan 14 11:59 .
drwxr-xr-x. 3 root root system_u:object_r:var_t:s0                19 Jan  8 10:13 ..
dr-xr-xr-x. 2 root root system_u:object_r:unlabeled_t:s0        8192 Jan  1  1970 .snapshots
drwxr-xr-x. 3 root root system_u:object_r:unlabeled_t:s0        4096 Jan 14 12:00 existing-data
drwxrwx--x. 3 root root system_u:object_r:unlabeled_t:s0        4096 Jan  8 10:14 primary-fileset-gpfs1-14926875306623591168
drwxrwx--x. 3 root root system_u:object_r:container_file_t:s0   4096 Jan 13 11:56 pvc-26d9e4db-e15f-4b26-97d3-6e7eb0d10e06
drwxrwx--x. 3 root root system_u:object_r:unlabeled_t:s0        4096 Jan  8 10:17 pvc-5f40b561-4351-4bca-be3e-299f7de77493

This is the describe output of pv,pvc and pod
<EMAIL_ADDRESS>~]# kubectl describe pv dirpv
Name:            dirpv
Labels:          <none>
Annotations:     pv.kubernetes.io/bound-by-controller: yes
Finalizers:      [kubernetes.io/pv-protection external-attacher/spectrumscale-csi-ibm-com]
StorageClass:
Status:          Bound
Claim:           test/pvc-dirpv
Reclaim Policy:  Retain
Access Modes:    RWX
VolumeMode:      Filesystem
Capacity:        2Gi
Node Affinity:   <none>
Message:
Source:
    Type:              CSI (a Container Storage Interface (CSI) volume source)
    Driver:            spectrumscale.csi.ibm.com
    FSType:
    VolumeHandle:<PHONE_NUMBER>6623591168;15250B0A:61D925EC;path=/mnt/gpfs1
    ReadOnly:          false
    VolumeAttributes:  <none>
Events:                <none>

<EMAIL_ADDRESS>~]# kubectl describe pvc pvc-dirpv
Name:          pvc-dirpv
Namespace:     test
StorageClass:
Status:        Bound
Volume:        dirpv
Labels:        <none>
Annotations:   pv.kubernetes.io/bind-completed: yes
               pv.kubernetes.io/bound-by-controller: yes
Finalizers:    [kubernetes.io/pvc-protection]
Capacity:      2Gi
Access Modes:  RWX
VolumeMode:    Filesystem
Used By:       csi-scale-staticdemo-pod
Events:        <none>

<EMAIL_ADDRESS>~]# oc describe pod csi-scale-staticdemo-pod
Name:         csi-scale-staticdemo-pod
Namespace:    test
Priority:     0
Node:         worker0.dg01.cp.fyre.ibm.com/<IP_ADDRESS>
Start Time:   Tue, 01 Feb 2022 23:08:29 -0800
Labels:       app=nginx
Annotations:  k8s.v1.cni.cncf.io/network-status:
                [{
                    "name": "openshift-sdn",
                    "interface": "eth0",
                    "ips": [
                        "<IP_ADDRESS>"
                    ],
                    "default": true,
                    "dns": {}
                }]
              k8s.v1.cni.cncf.io/networks-status:
                [{
                    "name": "openshift-sdn",
                    "interface": "eth0",
                    "ips": [
                        "<IP_ADDRESS>"
                    ],
                    "default": true,
                    "dns": {}
                }]
              openshift.io/scc: anyuid
Status:       Running
IP:           <IP_ADDRESS>
IPs:
  IP:  <IP_ADDRESS>
Containers:
  web-server:
    Container ID:   cri-o://249d3072b9532f80fda2a06d1d4b2ab9c9f54e317c9c3045aa065c811732adf4
    Image:          nginx
    Image ID:       docker.io/library/nginx@sha256:2834dc507516af02784808c5f48b7cbe38b8ed5d0f4837f16e78d00deb7e7767
    Port:           80/TCP
    Host Port:      0/TCP
    State:          Running
      Started:      Tue, 01 Feb 2022 23:08:48 -0800
    Ready:          True
    Restart Count:  0
    Environment:    <none>
    Mounts:
      /usr/share/nginx/html/scale from mypvc (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-nkvkt (ro)
Conditions:
  Type              Status
  Initialized       True
  Ready             True
  ContainersReady   True
  PodScheduled      True
Volumes:
  mypvc:
    Type:       PersistentVolumeClaim (a reference to a PersistentVolumeClaim in the same namespace)
    ClaimName:  pvc-dirpv
    ReadOnly:   false
  kube-api-access-nkvkt:
    Type:                    Projected (a volume that contains injected data from multiple sources)
    TokenExpirationSeconds:  3607
    ConfigMapName:           kube-root-ca.crt
    ConfigMapOptional:       <nil>
    DownwardAPI:             true
    ConfigMapName:           openshift-service-ca.crt
    ConfigMapOptional:       <nil>
QoS Class:                   BestEffort
Node-Selectors:              kubernetes.io/hostname=worker0.dg01.cp.fyre.ibm.com
Tolerations:                 node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                             node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type    Reason                  Age    From                     Message
  ----    ------                  ----   ----                     -------
  Normal  Scheduled               7m27s  default-scheduler        Successfully assigned test/csi-scale-staticdemo-pod to worker0.dg01.cp.fyre.ibm.com
  Normal  SuccessfulAttachVolume  7m27s  attachdetach-controller  AttachVolume.Attach succeeded for volume "dirpv"
  Normal  AddedInterface          7m18s  multus                   Add eth0 [<IP_ADDRESS>/22] from openshift-sdn
  Normal  Pulling                 7m18s  kubelet                  Pulling image "nginx"
  Normal  Pulled                  7m8s   kubelet                  Successfully pulled image "nginx" in 9.425617632s
  Normal  Created                 7m8s   kubelet                  Created container web-server
  Normal  Started                 7m8s   kubelet                  Started container web-server

/mnt/gpfs1 and /var/mnt/gpfs1 is same thing on worker node
sh-4.4# ls -lZa /mnt/gpfs1
total 259
drwxr-xr-x. 6 root root system_u:object_r:unlabeled_t:s0              262144 Jan 14 11:59 .
drwxr-xr-x. 3 root root system_u:object_r:var_t:s0                        19 Jan  8 10:13 ..
dr-xr-xr-x. 2 root root system_u:object_r:unlabeled_t:s0                8192 Jan  1  1970 .snapshots
drwxr-xr-x. 3 root root system_u:object_r:container_file_t:s0:c20,c26   4096 Jan 14 12:00 existing-data
drwxrwx--x. 3 root root system_u:object_r:unlabeled_t:s0                4096 Jan  8 10:14 primary-fileset-gpfs1-14926875306623591168
drwxrwx--x. 3 root root system_u:object_r:container_file_t:s0           4096 Jan 13 11:56 pvc-26d9e4db-e15f-4b26-97d3-6e7eb0d10e06
drwxrwx--x. 3 root root system_u:object_r:unlabeled_t:s0                4096 Jan  8 10:17 pvc-5f40b561-4351-4bca-be3e-299f7de77493
sh-4.4# ls -lZa /var/mnt/gpfs1
total 259
drwxr-xr-x. 6 root root system_u:object_r:unlabeled_t:s0              262144 Jan 14 11:59 .
drwxr-xr-x. 3 root root system_u:object_r:var_t:s0                        19 Jan  8 10:13 ..
dr-xr-xr-x. 2 root root system_u:object_r:unlabeled_t:s0                8192 Jan  1  1970 .snapshots
drwxr-xr-x. 3 root root system_u:object_r:container_file_t:s0:c20,c26   4096 Jan 14 12:00 existing-data
drwxrwx--x. 3 root root system_u:object_r:unlabeled_t:s0                4096 Jan  8 10:14 primary-fileset-gpfs1-14926875306623591168
drwxrwx--x. 3 root root system_u:object_r:container_file_t:s0           4096 Jan 13 11:56 pvc-26d9e4db-e15f-4b26-97d3-6e7eb0d10e06
drwxrwx--x. 3 root root system_u:object_r:unlabeled_t:s0                4096 Jan  8 10:17 pvc-5f40b561-4351-4bca-be3e-299f7de77493

Before pod actually see data, there is additional softlink get created on host which looks like as this
sh-4.4# ls -lZ /var/lib/kubelet/pods/7d736e8c-e4da-4e41-8705-1734529dcfe9/volumes/kubernetes.io~csi/dirpv/mount
lrwxrwxrwx. 1 root root system_u:object_r:container_var_lib_t:s0 10 Feb  2 07:08 /var/lib/kubelet/pods/7d736e8c-e4da-4e41-8705-1734529dcfe9/volumes/kubernetes.io~csi/dirpv/mount -> /mnt/gpfs1

The spec says:
  // For volumes with an access type of mount, the SP SHALL place the
  // mounted directory at target_path.

And in this case target path is just a symlink. The first problem is - since target path is symlink, selinux detection does not work. We expect target path to be a mount point.

@gnufied it does work with softlink when softlink point to directory inside the filesystem for example if we use /mnt/gpfs1/xyz  but it does not work when softlink points to mount point of filesystem eg /mnt/gpfs1

how does the target path looks like when softlink points to a directory inside filesystem? The bottom line is - SELinux detection currrently is not working in k8s if target path is a symlink.
If you think it works correctly if volume is a subdirectory - then I would say it may be completely a fluke(I would not trust the result). Also, who is creating mount points like /mnt/gpfs on nodes? Why are we mounting volumes in such non-standard locations?

Once pod with subdirectory is running, can you post the output of /proc/self/mountinfo from worker node?

This is rather surprising. The code in kubernetes works like following:

Using the node-publish target path we try to determine if path is mounted in /proc/self/mountinfo and has seclabel on it - https://github.com/kubernetes/kubernetes/blob/master/pkg/volume/csi/csi_mounter.go#L277
https://github.com/kubernetes/kubernetes/blob/master/pkg/volume/util/hostutil/hostutil_linux.go#L238

We do not evaluate the symlink before determing the selinux support and hence it should not work. We can setup a call to go over this if you prefer. You can find me on kubernetes slack or coreos (redhat) slack.

@jsafrane Here is some background on why softlink was chosen over bind-mounts
User can mount Spectrum Scale(GPFS) filesystem on any path on Kubernetes worker nodes. There can be more than one filesystem on single Kubernetes cluster. Now to use bind mount (NodePublish) all these path must be available inside CSI pod. This can be done by either exposing these filesystem's mountpoint inside CSI pod or expose whole host's /(root) inside CSI pod. To avoid the customisation(exposing path of filesystem every time customer add new filesystem ) or exposing host's / (root) inside the CSI pod, softlink approach was taken.

If I understand it correctly, the CSI driver has only /var/lib/kubelet as a HostPath volume in its pod and it creates a symlink there to /mnt/gpfs1. This symlink is broken in the driver (the driver does not have GPFS mounted) and it's only resolved by kubelet on the host.
That's...  unexpected.

There can be more than one filesystem on Kubernetes node.

This requires someone to configure and mount GPFS on every single host. That's defeats the purpose of CSI - details about the storage should be in the driver container and not on the host. I know the line between the host and CSI driver can be blurry, e.g. iscsid and multipathd can run on the host, still, having full storage mounted on the host is something I've never seen.
Did you consider mounting the GPFS volumes inside the driver container, e.g. based on a ConfigMap with all the filesystems to mount, and then providing bind-mounts from it?

I agree with your suggestions but there is some background/design aspect for the approach taken

gpfs requires client to be installed on each worker node where gpfs data need to accessed
gpfs client is containerised very recently and as of today it only support OCP with RHCOS worker node.
CSI had started early for supporting Vanila k8s as well as OCP with RHEL worker nodes.
as of today gpfs does not support selective mount hence whenever mount whole filesystem become visible.
As you are suggesting  "mounting the GPFS volumes inside the driver container" can be done but it require gpfs client being truly containerised(available for all k8s variant) or CSI driver managing things based on where it is running.

Just for further reference: In addition to my comment with the SELinux namespace annotations above (see gfschmidt commented on Oct 26, 2021 I summarized major considerations for using static provisioning with shared data access in IBM Spectrum Scale on OpenShift in the following blog post: Advanced Static Volume Provisioning with IBM Spectrum Scale on Red Hat OpenShift  (i.e. distinct mapping of static PVs to PVCs using labels or claimRef, ensure proper uid/gid and SELinux context with namespace annotations or pod/container securityContext ).

@deeghuge could you please help put FQI labels?

Just some additional information on this SELinux relabeling topic that might be helpful:
If someone wants to see SELinux relabeling in action and understand how the standard SELinux relabling works when pods in different namespaces access the same data on IBM Spectrum Scale I recorded and shared some demos:

DATA SHARING DONE WRONG WITH ACCESS DENIED BY SELINUX
DATA SHARING DONE RIGHT WITH CUSTOM SCC

The first demo shows what happens when the same data in IBM Spectrum Scale is accessed by three non-privileged users in OpenShift from three namespaces without taking the SELinux security context into account. The users are regular users running in their own namespaces under the "restricted" SCC (security context constraints). Here the "restricted" SCC enforces a MustRunAs policy on the SELinux security context and the default value for the SELinux MCS label is taken from the pre-allocated values given in the annotations of the namespace where the pod is running. So the pod in each namespace runs with another default SELinux MCS label and as soon as a pod is started and mounts the volume the whole data in the mounted volume is relabeled with the default SELinux MCS label of the namespace. In this case each user shuts out all other users from accessing the pods if no further precautions with regard to SELinux relabeling are taken.
This demo shows how the pre-allocated default values from the namespace for the SELinux MCS label, uid and fsGroup are applied and how each user locks out any previous user from accessing the shared data as soon as the user starts a pod.
This second demo shows how you can define and apply a custom SCC to ensure that different non-privileged users in three namespaces can safely access the same data in IBM Spectrum Scale across worker nodes in a RWX (read-write-many) access mode with a proper SELinux context and individual uid/gid file permissions. We show how to grant access to a custom SCC ("shared-scc") via a service account (plus role and rolebinding) in the user namespace as well as by assigning the custom SCC directly to the user (could also be a group of users). Here the pods in each namespace run with the same SELinux MCS label as defined in the custom SCC ("shared-scc"). The PVs have been provisioned as shown in the first demo above.
The PVs for the two demos have been provisioned as shown in the this demo: ADVANCED VOLUME PROVISIONING FOR DATA SHARING.
This presentation gives a good summary of the SELinux issue and how to safely mitigate it with custom SCCs. The setup used in the videos and more information is available in my blog post here.
SELinux relabeling may also lead to ContainerCreationErrors on large volumes with many files under some circumstances if a timeout of 120sec is hit and the relabeling did not successfully finish in that time. My blog post above also shows one way how to disable SELinux relabeling on a volume today by using a custom SCC and "spc_t" in this section which is based on one of two solutions proposed in a Red Hat artice.

Note that the same behavior as described in this issue above also applies if the backing directory of a statically provisioned volume is actually an IBM Spectrum Scale fileset (instead of a regular directory). An entire IBM Spectrum Scale file system or a fileset  behaves in a similar way when specified as backing directory in the volumeHandle of a statically provisioned volume as both are actually filesets (an entire IBM Spectrum Scale file system is a root fileset).
In this case no automatic SELinux relabeling by OpenShift takes place which can be seen as an advantage as the pre-existing permissions and SELinux attributes in the file system / fileset are honored. Here the storage admin keeps full control over the access permissions of the data in the file system and can generally or selectively grant access to applications in OpenShift.
For example, the storage admin could grant general access to the data in a fileset accessed by pods/containers in OpenShift through a statically provisioned PV by setting the SELinux MCS label on an entire fileset (or just selected sub-directories or objects within the fileset) to "system_u:object_r:container_file_t:s0" on the IBM Spectrum Scale storage cluster (Note: The option -R will recursively change the SELinux label on all files and directories at the specified destination):
# chcon -R "system_u:object_r:container_file_t:s0" /[absolute path-to-fileset]/[fileset link point]

This would only have to be done once as the applied SELinux settings will persist. If SELinux is not enabled on the storage cluster the manual SElinux relabeling could also be done by a cluster admin on OpenShift by running a debug pod, for example
# oc debug node/[worker-node] -- chroot /host chcon -R 'system_u:object_r:container_file_t:s0' /mnt/[local-Scale-file-system-name]/[relative-path-to-fileset]/[fileset-link-point]

Note: As always when executing commands as root user: Be very cautious and careful when doing the SELinux relabeling by running the chcon command directly in a debug pod on an OpenShift worker node. When done wrong you can harm your system!
Without adding a specific category (like c7, c28) to the SELinux MCS label "container_file_t:s0" the data can be accessed by any pod/container independent of the specific SELinux MCS category that is assigned to the pod/container process by OpenShift like, for example, "container_t:s0:c7,c28" because the empty set of SELinux categories is also part of every process set. Any pod/container means, of course, any pod/container that has been given explicit access to the data through a statically provisioned PV.
The storage admin can even set the SELinux MCS labels more selectively with specific categories on selected (or all) objects in the fileset if needed but that would also entail to carefully align the SELinux labels in the file system with the SELinux security context of the pods/containers in OpenShift which is dependent on the OpenShift Security Context Constraints (SCCs) as well as the user, group, service account and pre-allocated defaults from the namespace. Please refer to my blog post here for more information.

Issue if fixed in CNSA 5.1.7. Please reopen if you still see issue on latest CNSA.