Error: overlaps with local certs: skipped

What happened?
Deploy in kubernetes does not work
What did you expect to happen?
May it work
How'd it happen?
Deploy pomerium on kubernetes as described in https://www.pomerium.com/docs/deploy
What's your environment like?

Pomerium version (retrieve with pomerium --version): v0.22
Server Operating System/Architecture/Cloud: Identity Provider Azure AD

What's your config.yaml?
apiVersion: ingress.pomerium.io/v1
kind: Pomerium
metadata:
  name: global
  namespace: pomerium
spec:
  secrets: pomerium/bootstrap
  authenticate:
    url: https://xxxxxxxxxxxx
  identityProvider:
    provider: azure
    secret: pomerium/my-azure-secret
    url: https://xxxxxxxxxxxxx
  certificates:
  - pomerium/my-domain-tls-certificate
  jwtClaimHeaders:
    X-given-name: given_name
    X-name: name
  storage:
    postgres:
      secret: pomerium/postgres-pomerium

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: linkerd-test
  namespace: linkerd-viz
  annotations:
    ingress.pomerium.io/allow_websockets: 'true'
    ingress.pomerium.io/pass_identity_headers: 'true'
    ingress.pomerium.io/policy: |
      allow:
        and:
        - claim/groups: xxxxxxxxxxxxxxxxxxxxxx
spec:
  ingressClassName: pomerium
  tls:
  - hosts:
      - '*.mydomain'
    secretName: my-domain-tls-certificate
  rules:
  - host: linkerd.mydomain
    http:
      paths:
      - pathType: Prefix
        path: "/"
        backend:
          service:
            name: web
            port:
              number: 8084

What did you see in the logs?
...
{"level":"warn","time":"2023-07-24T17:31:23Z","message":"neither `autocert`, `insecure_server` or manually provided certificates were provided, server will be using a self-signed certificate"}
{"level":"error","syncer_id":"databroker","syncer_type":"type.googleapis.com/pomerium.config.Config","domain":"*.mydomain","time":"2023-07-24T17:31:29Z","message":"overlaps with local certs: skipped"}
...
... after some time ....
...
{"level":"warn","time":"2023-07-24T17:51:19Z","msg":"stapling OCSP","service":"autocert","error":"unable to write OCSP staple file for [*.mydomain mydomain]: mkdir /.local: read-only file system"}
...

Additional context
Command 'kubectl describe pomerium global':
...
Status:
  Ingress:
    linkerd-viz/linkerd-test:
      Observed At:          2023-07-24T17:37:53Z
      Observed Generation:  1
      Reconciled:           true
...
Events:
...
  Normal   Updated      45m (x16 over 52m)  pomerium-ingress                        linkerd-viz/linkerd-test: config updated

Command 'kubectl describe ingress linkerd-test -n linkerd-viz':
...
Events:
...
  Normal   Updated      49m (x16 over 55m)  pomerium-ingress  config updated

When I access https:// linkerd.mydomain I receive 404 Not Found nginx.
Thanks

Hello,
couple things here:

I understand you're using wildcard certificates. You only need to reference them in one place - i.e. if you reference them in global CRD certificates section, you do not need to reference them in the Ingress.spec.tls section
I am confused how NGINX is in the picture? is web service == NGINX?
Please check access log by doing kubectl logs -n pomerium deployment/pomerium - I suppose that your request arrived to the destination and it's the destination service that doesn't like it (probably a Host authority?) - please provide the access log entry for your request.

Now logs output this too:
{"level":"info","time":"2023-10-25T19:09:27Z","message":"using /etc/ssl/certs/ca-certificates.crt as the system root certificate authority bundle"}
@wasaga

Ok, but with Ingress.spec.tls or not, same problem.
Sorry, I did not understand your question.

{"level":"info","type":"type.googleapis.com/pomerium.config.Config","id":"ingress-controller","time":"2023-10-25T21:08:16Z","message":"get"}
{"level":"warn","time":"2023-10-25T21:08:16Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"warn","time":"2023-10-25T21:08:16Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"warn","time":"2023-10-25T21:08:16Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"info","record-type":"type.googleapis.com/pomerium.config.Config","record-id":"ingress-controller","time":"2023-10-25T21:08:16Z","message":"put"}
{"level":"info","ts":"2023-10-25T21:08:16Z","msg":"new pomerium config applied","controller":"pomerium-ingress","controllerGroup":"networking.k8s.io","controllerKind":"Ingress","Ingress":{"name":"marquez-test","namespace":"marquez"},"namespace":"marquez","name":"marquez-test","reconcileID":"xxxxxxxxxxxxx"}
{"level":"warn","time":"2023-10-25T21:08:16Z","message":"neither `autocert`, `insecure_server` or manually provided certificates were provided, server will be using a self-signed certificate"}
{"level":"warn","time":"2023-10-25T21:08:16Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"warn","time":"2023-10-25T21:08:16Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"info","syncer_id":"databroker","syncer_type":"type.googleapis.com/pomerium.config.Config","service":"all","config_id":"ingress-controller","version":7,"err_count":0,"time":"2023-10-25T21:08:16Z","message":"set db config info"}
{"level":"info","syncer_id":"databroker","syncer_type":"type.googleapis.com/pomerium.config.Config","service":"all","config_id":"pomerium-crd","version":1,"err_count":0,"time":"2023-10-25T21:08:16Z","message":"set db config info"}
{"level":"warn","time":"2023-10-25T21:08:16Z","message":"neither `autocert`, `insecure_server` or manually provided certificates were provided, server will be using a self-signed certificate"}
{"level":"info","type":"type.googleapis.com/pomerium.config.Config","id":"pomerium-crd","time":"2023-10-25T21:08:16Z","message":"get"}
{"level":"info","type":"type.googleapis.com/pomerium.config.Config","id":"ingress-controller","time":"2023-10-25T21:08:16Z","message":"get"}
{"level":"info","Algorithm":"ES256","KeyID":"xxxxxxxxxxxxxxxx","Public Key":{"use":"sig","kty":"EC","kid":"xxxxxxxxxxxxxxxxxxx","crv":"P-256","alg":"ES256","x":"xxxxxxxxxxxxxxxxx","y":"xxxxxxxxxxxxxx"},"time":"2023-10-25T21:08:16Z","message":"authorize: signing key"}
{"level":"info","service":"envoy","name":"upstream","time":"2023-10-25T21:08:16Z","message":"cds: add 1 cluster(s), remove 0 cluster(s)"}
{"level":"warn","time":"2023-10-25T21:08:16Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"warn","time":"2023-10-25T21:08:16Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"warn","time":"2023-10-25T21:08:16Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"info","service":"envoy","name":"upstream","time":"2023-10-25T21:08:16Z","message":"cds: added/updated 1 cluster(s), skipped 0 unmodified cluster(s)"}
{"level":"info","time":"2023-10-25T21:08:16Z","message":"service registry reporter stopping"}
{"level":"info","syncer_id":"databroker","syncer_type":"type.googleapis.com/pomerium.config.Config","service":"all","config":"databroker","checksum":"bb047254eba6628d","time":"2023-10-25T21:08:16Z","message":"config: updated config"}
{"level":"warn","time":"2023-10-25T21:13:11Z","msg":"stapling OCSP","service":"autocert","error":"no OCSP stapling for [*.xxxxxxxxxxx xxxxxxxxxxx]: parsing OCSP response: ocsp: error from server: unauthorized"}

I think I discovered the problem.
The secret in spec.certificates in kind Pomerium must be in PEM format according to documentation and I'm passing tls.crt and tls.key in secret.
I'll try to change it here and let you know if it works.

My question 2 was why do you see responses from nginx?
In your logs I do not see pomerium access log entries for your domain.
Make sure you're actually talking to pomerium and there's no dns mixup.
If pomerium responds there's x-request-id header set in the response and you can find relevant access and authorization log entries https://www.pomerium.com/docs/capabilities/audit-logs

I tested pomerium ingress controller locally following https://www.pomerium.com/docs/deploy/k8s/quickstart step by step, and same problem. Seems my certificate is completely ignored:
"message":"neither autocert, insecure_server or manually provided certificates were provided, server will be using a self-signed certificate"}
Pod logs:
I1027 12:57:39.823650       1 request.go:690] Waited for 1.036440278s due to client-side throttling, not priority and fairness, request: GET:https://<IP_ADDRESS>:443/apis/source.toolkit.fluxcd.io/v1beta2?timeout=32s
{"level":"info","ts":"2023-10-27T12:57:39Z","logger":"controller-runtime.metrics","msg":"Metrics server is starting to listen","addr":"localhost:41441"}
{"level":"info","ts":"2023-10-27T12:57:39Z","msg":"Starting server","path":"/metrics","kind":"metrics","addr":"<IP_ADDRESS>:41441"}
{"level":"info","ts":"2023-10-27T12:57:39Z","msg":"Starting EventSource","controller":"bootstrap pod/pomerium-b6f9dc578-8659r","controllerGroup":"ingress.pomerium.io","controllerKind":"Pomerium","source":"kind source: *v1.Pomerium"}
{"level":"info","ts":"2023-10-27T12:57:39Z","msg":"Starting EventSource","controller":"bootstrap pod/pomerium-b6f9dc578-8659r","controllerGroup":"ingress.pomerium.io","controllerKind":"Pomerium","source":"kind source: *v1.Secret"}
{"level":"info","ts":"2023-10-27T12:57:39Z","msg":"Starting Controller","controller":"bootstrap pod/pomerium-b6f9dc578-8659r","controllerGroup":"ingress.pomerium.io","controllerKind":"Pomerium"}
{"level":"info","ts":"2023-10-27T12:57:40Z","msg":"Starting workers","controller":"bootstrap pod/pomerium-b6f9dc578-8659r","controllerGroup":"ingress.pomerium.io","controllerKind":"Pomerium","worker count":1}
{"level":"warn","time":"2023-10-27T12:59:08Z","message":"neither `autocert`, `insecure_server` or manually provided certificates were provided, server will be using a self-signed certificate"}
{"level":"info","envoy_version":"1.25.5+b1095c058415dfb2261e695a0f144311a7dc346b6eb47ecbb0a01b7de2c7299f","version":"v0.0.0","time":"2023-10-27T12:59:08Z","message":"cmd/pomerium"}
{"level":"info","address":"<IP_ADDRESS>:45921","time":"2023-10-27T12:59:08Z","message":"grpc: dialing"}
{"level":"info","outbound_port":"45921","databroker_urls":["http://<IP_ADDRESS>:5443"],"time":"2023-10-27T12:59:08Z","message":"config: starting databroker config source syncer"}
{"level":"info","service":"all","config":"databroker","checksum":"87b634f1ef4e5355","time":"2023-10-27T12:59:08Z","message":"config: updated config"}
{"level":"info","ts":"2023-10-27T12:59:08Z","msg":"config updated","controller":"bootstrap pod/pomerium-b6f9dc578-8659r","controllerGroup":"ingress.pomerium.io","controllerKind":"Pomerium","Pomerium":{"name":"global"},"namespace":"","name":"global","reconcileID":"ebbcfb42-dd93-4da3-9bea-90c21e15091a"}
{"level":"warn","time":"2023-10-27T12:59:08Z","message":"neither `autocert`, `insecure_server` or manually provided certificates were provided, server will be using a self-signed certificate"}
{"level":"info","time":"2023-10-27T12:59:08Z","logger":"maintenance","msg":"started background certificate maintenance","service":"autocert","cache":"0xc000e00400"}
{"level":"info","service":"autocert-manager","addr":":8080","time":"2023-10-27T12:59:08Z","message":"starting http redirect server"}
{"level":"info","grpc-port":"43873","http-port":"34961","outbound-port":"45921","metrics-port":"45687","debug-port":"45723","acme-tls-alpn-port":"33399","time":"2023-10-27T12:59:08Z","message":"server started"}
{"level":"info","time":"2023-10-27T12:59:08Z","message":"envoy: starting envoy process"}
{"level":"info","path":"/tmp/pomerium-envoy1907169401/envoy","checksum":"b1095c058415dfb2261e695a0f144311a7dc346b6eb47ecbb0a01b7de2c7299f","time":"2023-10-27T12:59:08Z","message":"running envoy"}
{"level":"info","pid":22,"time":"2023-10-27T12:59:08Z","message":"envoy: start monitoring subprocess"}
{"level":"info","time":"2023-10-27T12:59:08Z","message":"enabled authenticate service"}
{"level":"info","Algorithm":"ES256","KeyID":"ee281ec4fc46c9d43b796aa94d943e533a0b44ae5a1e9c7bd7b955ae8b839bc5","Public Key":{"use":"sig","kty":"EC","kid":"ee281ec4fc46c9d43b796aa94d943e533a0b44ae5a1e9c7bd7b955ae8b839bc5","crv":"P-256","alg":"ES256","x":"9z7uALUyv_T0qqxX6oxk6mJGJAKddecjSrppNPhxaQQ","y":"jBPRZtGanS3ArHtSmcWHDoctlcMycGNibHaZiFPzD2M"},"time":"2023-10-27T12:59:08Z","message":"authorize: signing key"}
{"level":"info","address":"<IP_ADDRESS>:45921","time":"2023-10-27T12:59:08Z","message":"grpc: dialing"}
{"level":"info","time":"2023-10-27T12:59:08Z","message":"enabled authorize service"}
{"level":"info","Algorithm":"ES256","KeyID":"ee281ec4fc46c9d43b796aa94d943e533a0b44ae5a1e9c7bd7b955ae8b839bc5","Public Key":{"use":"sig","kty":"EC","kid":"ee281ec4fc46c9d43b796aa94d943e533a0b44ae5a1e9c7bd7b955ae8b839bc5","crv":"P-256","alg":"ES256","x":"9z7uALUyv_T0qqxX6oxk6mJGJAKddecjSrppNPhxaQQ","y":"jBPRZtGanS3ArHtSmcWHDoctlcMycGNibHaZiFPzD2M"},"time":"2023-10-27T12:59:08Z","message":"authorize: signing key"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"initializing epoch 0 (base id=105364320, hot restart version=11.104)"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"statically linked extensions:"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.matching.http.custom_matchers: envoy.matching.custom_matchers.trie_matcher"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.matching.http.input: envoy.matching.inputs.destination_ip, envoy.matching.inputs.destination_port, envoy.matching.inputs.direct_source_ip, envoy.matching.inputs.dns_san, envoy.matching.inputs.request_headers, envoy.matching.inputs.request_trailers, envoy.matching.inputs.response_headers, envoy.matching.inputs.response_trailers, envoy.matching.inputs.server_name, envoy.matching.inputs.source_ip, envoy.matching.inputs.source_port, envoy.matching.inputs.source_type, envoy.matching.inputs.status_code_class_input, envoy.matching.inputs.status_code_input, envoy.matching.inputs.subject, envoy.matching.inputs.uri_san"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.stats_sinks: envoy.dog_statsd, envoy.graphite_statsd, envoy.metrics_service, envoy.stat_sinks.dog_statsd, envoy.stat_sinks.graphite_statsd, envoy.stat_sinks.hystrix, envoy.stat_sinks.metrics_service, envoy.stat_sinks.statsd, envoy.stat_sinks.wasm, envoy.statsd"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.access_loggers.extension_filters: envoy.access_loggers.extension_filters.cel"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.dubbo_proxy.protocols: dubbo"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.formatter: envoy.formatter.metadata, envoy.formatter.req_without_query"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.http.custom_response: envoy.extensions.http.custom_response.local_response_policy, envoy.extensions.http.custom_response.redirect_policy"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.request_id: envoy.request_id.uuid"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.health_checkers: envoy.health_checkers.redis, envoy.health_checkers.thrift"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.transport_sockets.downstream: envoy.transport_sockets.alts, envoy.transport_sockets.quic, envoy.transport_sockets.raw_buffer, envoy.transport_sockets.starttls, envoy.transport_sockets.tap, envoy.transport_sockets.tcp_stats, envoy.transport_sockets.tls, raw_buffer, starttls, tls"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.access_loggers: envoy.access_loggers.file, envoy.access_loggers.http_grpc, envoy.access_loggers.open_telemetry, envoy.access_loggers.stderr, envoy.access_loggers.stdout, envoy.access_loggers.tcp_grpc, envoy.access_loggers.wasm, envoy.file_access_log, envoy.http_grpc_access_log, envoy.open_telemetry_access_log, envoy.stderr_access_log, envoy.stdout_access_log, envoy.tcp_grpc_access_log, envoy.wasm_access_log"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.internal_redirect_predicates: envoy.internal_redirect_predicates.allow_listed_routes, envoy.internal_redirect_predicates.previous_routes, envoy.internal_redirect_predicates.safe_cross_scheme"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.route.early_data_policy: envoy.route.early_data_policy.default"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.path.match: envoy.path.match.uri_template.uri_template_matcher"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.resource_monitors: envoy.resource_monitors.fixed_heap, envoy.resource_monitors.injected_resource"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.guarddog_actions: envoy.watchdog.abort_action, envoy.watchdog.profile_action"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.retry_priorities: envoy.retry_priorities.previous_priorities"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.tracers: envoy.dynamic.ot, envoy.tracers.datadog, envoy.tracers.dynamic_ot, envoy.tracers.opencensus, envoy.tracers.opentelemetry, envoy.tracers.skywalking, envoy.tracers.xray, envoy.tracers.zipkin, envoy.zipkin"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.connection_handler: envoy.connection_handler.default"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.load_balancing_policies: envoy.load_balancing_policies.least_request, envoy.load_balancing_policies.random, envoy.load_balancing_policies.round_robin"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  network.connection.client: default, envoy_internal"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.http.original_ip_detection: envoy.http.original_ip_detection.custom_header, envoy.http.original_ip_detection.xff"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.resolvers: envoy.ip"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.http.stateful_header_formatters: envoy.http.stateful_header_formatters.preserve_case, preserve_case"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.regex_engines: envoy.regex_engines.google_re2"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.common.key_value: envoy.key_value.file_based"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.http.header_validators: envoy.http.header_validators.envoy_default"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.quic.server.crypto_stream: envoy.quic.crypto_stream.server.quiche"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.grpc_credentials: envoy.grpc_credentials.aws_iam, envoy.grpc_credentials.default, envoy.grpc_credentials.file_based_metadata"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.thrift_proxy.protocols: auto, binary, binary/non-strict, compact, twitter"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.udp_packet_writer: envoy.udp_packet_writer.default, envoy.udp_packet_writer.gso"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.retry_host_predicates: envoy.retry_host_predicates.omit_canary_hosts, envoy.retry_host_predicates.omit_host_metadata, envoy.retry_host_predicates.previous_hosts"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.compression.compressor: envoy.compression.brotli.compressor, envoy.compression.gzip.compressor, envoy.compression.zstd.compressor"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  quic.http_server_connection: quic.http_server_connection.default"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.matching.common_inputs: envoy.matching.common_inputs.environment_variable"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.http.cache: envoy.extensions.http.cache.file_system_http_cache, envoy.extensions.http.cache.simple"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.tls.cert_validator: envoy.tls.cert_validator.default, envoy.tls.cert_validator.spiffe"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.config.validators: envoy.config.validators.minimum_clusters, envoy.config.validators.minimum_clusters_validator"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.bootstrap: envoy.bootstrap.internal_listener, envoy.bootstrap.wasm, envoy.extensions.network.socket_interface.default_socket_interface"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.clusters: envoy.cluster.eds, envoy.cluster.logical_dns, envoy.cluster.original_dst, envoy.cluster.static, envoy.cluster.strict_dns, envoy.clusters.aggregate, envoy.clusters.dynamic_forward_proxy, envoy.clusters.redis"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.dubbo_proxy.serializers: dubbo.hessian2"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.listener_manager_impl: envoy.listener_manager_impl.default"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.matching.network.input: envoy.matching.inputs.application_protocol, envoy.matching.inputs.destination_ip, envoy.matching.inputs.destination_port, envoy.matching.inputs.direct_source_ip, envoy.matching.inputs.dns_san, envoy.matching.inputs.server_name, envoy.matching.inputs.source_ip, envoy.matching.inputs.source_port, envoy.matching.inputs.source_type, envoy.matching.inputs.subject, envoy.matching.inputs.transport_protocol, envoy.matching.inputs.uri_san"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.matching.network.custom_matchers: envoy.matching.custom_matchers.trie_matcher"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.thrift_proxy.transports: auto, framed, header, unframed"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.quic.proof_source: envoy.quic.proof_source.filter_chain"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.wasm.runtime: envoy.wasm.runtime.null, envoy.wasm.runtime.v8"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.filters.network: envoy.echo, envoy.ext_authz, envoy.filters.network.connection_limit, envoy.filters.network.direct_response, envoy.filters.network.dubbo_proxy, envoy.filters.network.echo, envoy.filters.network.ext_authz, envoy.filters.network.http_connection_manager, envoy.filters.network.local_ratelimit, envoy.filters.network.mongo_proxy, envoy.filters.network.ratelimit, envoy.filters.network.rbac, envoy.filters.network.redis_proxy, envoy.filters.network.sni_cluster, envoy.filters.network.sni_dynamic_forward_proxy, envoy.filters.network.tcp_proxy, envoy.filters.network.thrift_proxy, envoy.filters.network.wasm, envoy.filters.network.zookeeper_proxy, envoy.http_connection_manager, envoy.mongo_proxy, envoy.ratelimit, envoy.redis_proxy, envoy.tcp_proxy"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.upstream_options: envoy.extensions.upstreams.http.v3.HttpProtocolOptions, envoy.extensions.upstreams.tcp.v3.TcpProtocolOptions, envoy.upstreams.http.http_protocol_options, envoy.upstreams.tcp.tcp_protocol_options"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.transport_sockets.upstream: envoy.transport_sockets.alts, envoy.transport_sockets.http_11_proxy, envoy.transport_sockets.internal_upstream, envoy.transport_sockets.quic, envoy.transport_sockets.raw_buffer, envoy.transport_sockets.starttls, envoy.transport_sockets.tap, envoy.transport_sockets.tcp_stats, envoy.transport_sockets.tls, envoy.transport_sockets.upstream_proxy_protocol, raw_buffer, starttls, tls"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.http.early_header_mutation: envoy.http.early_header_mutation.header_mutation"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.dubbo_proxy.filters: envoy.filters.dubbo.router"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.path.rewrite: envoy.path.rewrite.uri_template.uri_template_rewriter"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.filters.http.upstream: envoy.buffer, envoy.filters.http.admission_control, envoy.filters.http.buffer, envoy.filters.http.upstream_codec"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.http.stateful_session: envoy.http.stateful_session.cookie, envoy.http.stateful_session.header"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.matching.action: envoy.matching.actions.format_string, filter-chain-name"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.rbac.matchers: envoy.rbac.matchers.upstream_ip_port"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.rate_limit_descriptors: envoy.rate_limit_descriptors.expr"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.compression.decompressor: envoy.compression.brotli.decompressor, envoy.compression.gzip.decompressor, envoy.compression.zstd.decompressor"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.quic.connection_id_generator: envoy.quic.deterministic_connection_id_generator"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.filters.http: envoy.bandwidth_limit, envoy.buffer, envoy.cors, envoy.csrf, envoy.ext_authz, envoy.ext_proc, envoy.fault, envoy.filters.http.adaptive_concurrency, envoy.filters.http.admission_control, envoy.filters.http.alternate_protocols_cache, envoy.filters.http.aws_lambda, envoy.filters.http.aws_request_signing, envoy.filters.http.bandwidth_limit, envoy.filters.http.buffer, envoy.filters.http.cache, envoy.filters.http.cdn_loop, envoy.filters.http.composite, envoy.filters.http.compressor, envoy.filters.http.cors, envoy.filters.http.csrf, envoy.filters.http.custom_response, envoy.filters.http.decompressor, envoy.filters.http.dynamic_forward_proxy, envoy.filters.http.ext_authz, envoy.filters.http.ext_proc, envoy.filters.http.fault, envoy.filters.http.file_system_buffer, envoy.filters.http.gcp_authn, envoy.filters.http.grpc_http1_bridge, envoy.filters.http.grpc_http1_reverse_bridge, envoy.filters.http.grpc_json_transcoder, envoy.filters.http.grpc_stats, envoy.filters.http.grpc_web, envoy.filters.http.header_to_metadata, envoy.filters.http.health_check, envoy.filters.http.ip_tagging, envoy.filters.http.jwt_authn, envoy.filters.http.local_ratelimit, envoy.filters.http.lua, envoy.filters.http.match_delegate, envoy.filters.http.oauth2, envoy.filters.http.on_demand, envoy.filters.http.original_src, envoy.filters.http.rate_limit_quota, envoy.filters.http.ratelimit, envoy.filters.http.rbac, envoy.filters.http.router, envoy.filters.http.set_metadata, envoy.filters.http.stateful_session, envoy.filters.http.tap, envoy.filters.http.wasm, envoy.grpc_http1_bridge, envoy.grpc_json_transcoder, envoy.grpc_web, envoy.health_check, envoy.ip_tagging, envoy.local_rate_limit, envoy.lua, envoy.rate_limit, envoy.router"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.filters.listener: envoy.filters.listener.http_inspector, envoy.filters.listener.original_dst, envoy.filters.listener.original_src, envoy.filters.listener.proxy_protocol, envoy.filters.listener.tls_inspector, envoy.listener.http_inspector, envoy.listener.original_dst, envoy.listener.original_src, envoy.listener.proxy_protocol, envoy.listener.tls_inspector"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.filters.udp_listener: envoy.filters.udp.dns_filter, envoy.filters.udp_listener.udp_proxy"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.upstreams: envoy.filters.connection_pools.tcp.generic"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.matching.input_matchers: envoy.matching.matchers.consistent_hashing, envoy.matching.matchers.ip"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.network.dns_resolver: envoy.network.dns_resolver.cares, envoy.network.dns_resolver.getaddrinfo"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  envoy.thrift_proxy.filters: envoy.filters.thrift.header_to_metadata, envoy.filters.thrift.payload_to_metadata, envoy.filters.thrift.rate_limit, envoy.filters.thrift.router"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"HTTP header map info:"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  request header map: 672 bytes: :authority,:method,:path,:protocol,:scheme,accept,accept-encoding,access-control-request-headers,access-control-request-method,access-control-request-private-network,authentication,authorization,cache-control,cdn-loop,connection,content-encoding,content-length,content-type,expect,grpc-accept-encoding,grpc-timeout,if-match,if-modified-since,if-none-match,if-range,if-unmodified-since,keep-alive,origin,pragma,proxy-connection,proxy-status,referer,te,transfer-encoding,upgrade,user-agent,via,x-client-trace-id,x-envoy-attempt-count,x-envoy-decorator-operation,x-envoy-downstream-service-cluster,x-envoy-downstream-service-node,x-envoy-expected-rq-timeout-ms,x-envoy-external-address,x-envoy-force-trace,x-envoy-hedge-on-per-try-timeout,x-envoy-internal,x-envoy-ip-tags,x-envoy-is-timeout-retry,x-envoy-max-retries,x-envoy-original-path,x-envoy-original-url,x-envoy-retriable-header-names,x-envoy-retriable-status-codes,x-envoy-retry-grpc-on,x-envoy-retry-on,x-envoy-upstream-alt-stat-name,x-envoy-upstream-rq-per-try-timeout-ms,x-envoy-upstream-rq-timeout-alt-response,x-envoy-upstream-rq-timeout-ms,x-envoy-upstream-stream-duration-ms,x-forwarded-client-cert,x-forwarded-for,x-forwarded-host,x-forwarded-port,x-forwarded-proto,x-ot-span-context,x-request-id"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  request trailer map: 120 bytes: "}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  response header map: 432 bytes: :status,access-control-allow-credentials,access-control-allow-headers,access-control-allow-methods,access-control-allow-origin,access-control-allow-private-network,access-control-expose-headers,access-control-max-age,age,cache-control,connection,content-encoding,content-length,content-type,date,etag,expires,grpc-message,grpc-status,keep-alive,last-modified,location,proxy-connection,proxy-status,server,transfer-encoding,upgrade,vary,via,x-envoy-attempt-count,x-envoy-decorator-operation,x-envoy-degraded,x-envoy-immediate-health-check-fail,x-envoy-ratelimited,x-envoy-upstream-canary,x-envoy-upstream-healthchecked-cluster,x-envoy-upstream-service-time,x-request-id"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"  response trailer map: 144 bytes: grpc-message,grpc-status"}
{"level":"info","time":"2023-10-27T12:59:08Z","message":"enabled databroker service"}
{"level":"info","address":"<IP_ADDRESS>:45921","time":"2023-10-27T12:59:08Z","message":"grpc: dialing"}
{"level":"info","address":"<IP_ADDRESS>:45921","time":"2023-10-27T12:59:08Z","message":"grpc: dialing"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"runtime: layers:\\n  - name: static_layer_0\\n    static_layer:\\n      re2:\\n        max_program_size:\\n          error_level: 1048576\\n          warn_level: 1024\\n      overload:\\n        global_downstream_max_connections: 50000"}
{"level":"info","service":"envoy","name":"admin","time":"2023-10-27T12:59:08Z","message":"admin address: /tmp/pomerium-envoy-admin.sock"}
{"level":"info","service":"envoy","name":"config","time":"2023-10-27T12:59:08Z","message":"loading tracing configuration"}
{"level":"info","service":"envoy","name":"config","time":"2023-10-27T12:59:08Z","message":"loading 0 static secret(s)"}
{"level":"info","service":"envoy","name":"config","time":"2023-10-27T12:59:08Z","message":"loading 1 cluster(s)"}
{"level":"info","service":"envoy","name":"config","time":"2023-10-27T12:59:08Z","message":"loading 0 listener(s)"}
{"level":"info","service":"envoy","name":"config","time":"2023-10-27T12:59:08Z","message":"loading stats configuration"}
{"level":"info","service":"envoy","name":"runtime","time":"2023-10-27T12:59:08Z","message":"RTDS has finished initialization"}
{"level":"info","service":"envoy","name":"upstream","time":"2023-10-27T12:59:08Z","message":"cm init: initializing cds"}
{"level":"info","time":"2023-10-27T12:59:08Z","message":"enabled proxy service"}
{"level":"warn","time":"2023-10-27T12:59:08Z","message":"proxy: configuration has no policies"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"starting main dispatch loop"}
{"level":"info","addr":"<IP_ADDRESS>:43873","time":"2023-10-27T12:59:08Z","message":"starting control-plane gRPC server"}
{"level":"info","addr":"<IP_ADDRESS>:34961","time":"2023-10-27T12:59:08Z","message":"starting control-plane http server"}
{"level":"info","addr":"<IP_ADDRESS>:45723","time":"2023-10-27T12:59:08Z","message":"starting control-plane debug server"}
{"level":"info","addr":"<IP_ADDRESS>:45687","time":"2023-10-27T12:59:08Z","message":"starting control-plane metrics server"}
{"level":"info","name":"identity_manager","duration":30000,"time":"2023-10-27T12:59:08Z","message":"acquire lease"}
{"level":"info","time":"2023-10-27T12:59:08Z","message":"using in-memory store"}
{"level":"info","service":"envoy","name":"upstream","time":"2023-10-27T12:59:08Z","message":"cds: add 7 cluster(s), remove 0 cluster(s)"}
{"level":"info","service":"identity_manager","syncer_id":"identity_manager","syncer_type":"","time":"2023-10-27T12:59:08Z","message":"initial sync"}
{"level":"info","type":"","time":"2023-10-27T12:59:08Z","message":"sync latest"}
{"level":"info","service":"identity_manager","syncer_id":"identity_manager","syncer_type":"","time":"2023-10-27T12:59:08Z","message":"listening for updates"}
{"level":"info","service":"identity_manager","sessions":0,"users":0,"time":"2023-10-27T12:59:08Z","message":"initial sync complete"}
{"level":"info","server_version":13410585744877032546,"record_version":0,"time":"2023-10-27T12:59:08Z","message":"sync"}
{"level":"info","service":"envoy","name":"upstream","time":"2023-10-27T12:59:08Z","message":"cds: added/updated 6 cluster(s), skipped 1 unmodified cluster(s)"}
{"level":"info","service":"envoy","name":"upstream","time":"2023-10-27T12:59:08Z","message":"cm init: all clusters initialized"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T12:59:08Z","message":"all clusters initialized. initializing init manager"}
{"level":"info","service":"envoy","name":"upstream","time":"2023-10-27T12:59:08Z","message":"lds: add/update listener \\'http-ingress\\'"}
{"level":"info","service":"envoy","name":"upstream","time":"2023-10-27T12:59:08Z","message":"lds: add/update listener \\'grpc-ingress\\'"}
{"level":"info","service":"envoy","name":"upstream","time":"2023-10-27T12:59:08Z","message":"lds: add/update listener \\'metrics-ingress-4587868786652142039\\'"}
{"level":"info","service":"envoy","name":"upstream","time":"2023-10-27T12:59:08Z","message":"lds: add/update listener \\'outbound-ingress\\'"}
{"level":"info","service":"envoy","name":"config","time":"2023-10-27T12:59:08Z","message":"all dependencies initialized. starting workers"}
{"level":"info","name":"ingress-controller","duration":30000,"time":"2023-10-27T12:59:09Z","message":"acquire lease"}
{"level":"info","syncer_id":"databroker","syncer_type":"type.googleapis.com/pomerium.config.Config","time":"2023-10-27T12:59:09Z","message":"initial sync"}
{"level":"info","type":"type.googleapis.com/pomerium.config.Config","time":"2023-10-27T12:59:09Z","message":"sync latest"}
{"level":"info","syncer_id":"databroker","syncer_type":"type.googleapis.com/pomerium.config.Config","time":"2023-10-27T12:59:09Z","message":"listening for updates"}
{"level":"info","server_version":13410585744877032546,"record_version":0,"time":"2023-10-27T12:59:09Z","message":"sync"}
{"level":"info","time":"2023-10-27T12:59:09Z","message":"using in-memory registry"}
I1027 12:59:10.265817       1 request.go:690] Waited for 1.047578895s due to client-side throttling, not priority and fairness, request: GET:https://<IP_ADDRESS>:443/apis/core.strimzi.io/v1beta2?timeout=32s
{"level":"info","ts":"2023-10-27T12:59:10Z","logger":"controller-runtime.metrics","msg":"Metrics server is starting to listen","addr":"localhost:44023"}
{"level":"info","ts":"2023-10-27T12:59:10Z","msg":"Starting server","path":"/metrics","kind":"metrics","addr":"<IP_ADDRESS>:44023"}
{"level":"info","ts":"2023-10-27T12:59:10Z","msg":"Starting EventSource","controller":"pomerium-ingress","controllerGroup":"networking.k8s.io","controllerKind":"Ingress","source":"kind source: *v1.Ingress"}
{"level":"info","ts":"2023-10-27T12:59:10Z","msg":"Starting EventSource","controller":"pomerium-crd","controllerGroup":"ingress.pomerium.io","controllerKind":"Pomerium","source":"kind source: *v1.Pomerium"}
{"level":"info","ts":"2023-10-27T12:59:10Z","msg":"Starting EventSource","controller":"pomerium-ingress","controllerGroup":"networking.k8s.io","controllerKind":"Ingress","source":"kind source: *v1.IngressClass"}
{"level":"info","ts":"2023-10-27T12:59:10Z","msg":"Starting EventSource","controller":"pomerium-ingress","controllerGroup":"networking.k8s.io","controllerKind":"Ingress","source":"kind source: *v1.Secret"}
{"level":"info","ts":"2023-10-27T12:59:10Z","msg":"Starting EventSource","controller":"pomerium-ingress","controllerGroup":"networking.k8s.io","controllerKind":"Ingress","source":"kind source: *v1.Service"}
{"level":"info","ts":"2023-10-27T12:59:10Z","msg":"Starting EventSource","controller":"pomerium-ingress","controllerGroup":"networking.k8s.io","controllerKind":"Ingress","source":"kind source: *v1.Endpoints"}
{"level":"info","ts":"2023-10-27T12:59:10Z","msg":"Starting EventSource","controller":"pomerium-crd","controllerGroup":"ingress.pomerium.io","controllerKind":"Pomerium","source":"kind source: *v1.Secret"}
{"level":"info","ts":"2023-10-27T12:59:10Z","msg":"Starting Controller","controller":"pomerium-ingress","controllerGroup":"networking.k8s.io","controllerKind":"Ingress"}
{"level":"info","ts":"2023-10-27T12:59:10Z","msg":"Starting Controller","controller":"pomerium-crd","controllerGroup":"ingress.pomerium.io","controllerKind":"Pomerium"}
{"level":"info","ts":"2023-10-27T12:59:10Z","logger":"initial-sync","msg":"starting..."}
{"level":"info","ts":"2023-10-27T12:59:10Z","msg":"Starting workers","controller":"pomerium-crd","controllerGroup":"ingress.pomerium.io","controllerKind":"Pomerium","worker count":1}
{"level":"info","ts":"2023-10-27T12:59:10Z","msg":"Starting workers","controller":"pomerium-ingress","controllerGroup":"networking.k8s.io","controllerKind":"Ingress","worker count":1}
{"level":"info","type":"type.googleapis.com/pomerium.config.Config","id":"pomerium-crd","time":"2023-10-27T12:59:10Z","message":"get"}
{"level":"info","type":"type.googleapis.com/pomerium.config.Config","id":"ingress-controller","time":"2023-10-27T12:59:10Z","message":"get"}
{"level":"info","ts":"2023-10-27T12:59:10Z","logger":"initial-sync","msg":"complete"}
{"level":"info","record-type":"type.googleapis.com/pomerium.config.Config","record-id":"pomerium-crd","time":"2023-10-27T12:59:10Z","message":"put"}
{"level":"info","type":"type.googleapis.com/pomerium.config.Config","id":"ingress-controller","time":"2023-10-27T12:59:10Z","message":"get"}
{"level":"info","ts":"2023-10-27T12:59:10Z","msg":"new pomerium config applied","controller":"pomerium-crd","controllerGroup":"ingress.pomerium.io","controllerKind":"Pomerium","Pomerium":{"name":"global"},"namespace":"","name":"global","reconcileID":"87243220-8849-4c23-8410-5c7d79101220"}
{"level":"info","syncer_id":"databroker","syncer_type":"type.googleapis.com/pomerium.config.Config","service":"all","config_id":"pomerium-crd","version":1,"err_count":0,"time":"2023-10-27T12:59:10Z","message":"set db config info"}
{"level":"info","Algorithm":"ES256","KeyID":"ee281ec4fc46c9d43b796aa94d943e533a0b44ae5a1e9c7bd7b955ae8b839bc5","Public Key":{"use":"sig","kty":"EC","kid":"ee281ec4fc46c9d43b796aa94d943e533a0b44ae5a1e9c7bd7b955ae8b839bc5","crv":"P-256","alg":"ES256","x":"9z7uALUyv_T0qqxX6oxk6mJGJAKddecjSrppNPhxaQQ","y":"jBPRZtGanS3ArHtSmcWHDoctlcMycGNibHaZiFPzD2M"},"time":"2023-10-27T12:59:10Z","message":"authorize: signing key"}
{"level":"info","service":"envoy","name":"upstream","time":"2023-10-27T12:59:10Z","message":"lds: add/update listener \\'http-ingress\\'"}
{"level":"info","time":"2023-10-27T12:59:10Z","message":"service registry reporter stopping"}
{"level":"warn","time":"2023-10-27T12:59:10Z","message":"proxy: configuration has no policies"}
{"level":"info","syncer_id":"databroker","syncer_type":"type.googleapis.com/pomerium.config.Config","service":"all","config":"databroker","checksum":"3b621a2b5eeeb2aa","time":"2023-10-27T12:59:10Z","message":"config: updated config"}
{"level":"info","ts":"2023-10-27T12:59:10Z","msg":"deprecated config","controller":"pomerium-crd","controllerGroup":"ingress.pomerium.io","controllerKind":"Pomerium","Pomerium":{"name":"global"},"namespace":"","name":"global","reconcileID":"87243220-8849-4c23-8410-5c7d79101220","key":"storage","docs":"https://www.pomerium.com/docs/topics/data-storage#persistence","msg":"please specify a persistent storage backend"}
{"level":"info","ts":"2023-10-27T12:59:10Z","msg":"config updated","controller":"pomerium-crd","controllerGroup":"ingress.pomerium.io","controllerKind":"Pomerium","Pomerium":{"name":"global"},"namespace":"","name":"global","reconcileID":"87243220-8849-4c23-8410-5c7d79101220"}
{"level":"info","type":"type.googleapis.com/pomerium.config.Config","id":"ingress-controller","time":"2023-10-27T12:59:10Z","message":"get"}
{"level":"warn","time":"2023-10-27T12:59:10Z","message":"neither `autocert`, `insecure_server` or manually provided certificates were provided, server will be using a self-signed certificate"}
{"level":"info","type":"type.googleapis.com/pomerium.config.Config","id":"pomerium-crd","time":"2023-10-27T12:59:10Z","message":"get"}
{"level":"info","type":"type.googleapis.com/pomerium.config.Config","id":"ingress-controller","time":"2023-10-27T12:59:55Z","message":"get"}
{"level":"warn","time":"2023-10-27T12:59:55Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"warn","time":"2023-10-27T12:59:55Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"warn","time":"2023-10-27T12:59:55Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"info","record-type":"type.googleapis.com/pomerium.config.Config","record-id":"ingress-controller","time":"2023-10-27T12:59:56Z","message":"put"}
{"level":"warn","time":"2023-10-27T12:59:56Z","message":"neither `autocert`, `insecure_server` or manually provided certificates were provided, server will be using a self-signed certificate"}
{"level":"info","ts":"2023-10-27T12:59:56Z","msg":"new pomerium config applied","controller":"pomerium-ingress","controllerGroup":"networking.k8s.io","controllerKind":"Ingress","Ingress":{"name":"verify","namespace":"teste"},"namespace":"teste","name":"verify","reconcileID":"448fb9f9-8410-4067-9313-6ec3c99f0d77"}
{"level":"warn","time":"2023-10-27T12:59:56Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"warn","time":"2023-10-27T12:59:56Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"info","syncer_id":"databroker","syncer_type":"type.googleapis.com/pomerium.config.Config","service":"all","config_id":"ingress-controller","version":2,"err_count":0,"time":"2023-10-27T12:59:56Z","message":"set db config info"}
{"level":"info","syncer_id":"databroker","syncer_type":"type.googleapis.com/pomerium.config.Config","service":"all","config_id":"pomerium-crd","version":1,"err_count":0,"time":"2023-10-27T12:59:56Z","message":"set db config info"}
{"level":"warn","time":"2023-10-27T12:59:56Z","message":"neither `autocert`, `insecure_server` or manually provided certificates were provided, server will be using a self-signed certificate"}
{"level":"info","type":"type.googleapis.com/pomerium.config.Config","id":"pomerium-crd","time":"2023-10-27T12:59:56Z","message":"get"}
{"level":"info","Algorithm":"ES256","KeyID":"ee281ec4fc46c9d43b796aa94d943e533a0b44ae5a1e9c7bd7b955ae8b839bc5","Public Key":{"use":"sig","kty":"EC","kid":"ee281ec4fc46c9d43b796aa94d943e533a0b44ae5a1e9c7bd7b955ae8b839bc5","crv":"P-256","alg":"ES256","x":"9z7uALUyv_T0qqxX6oxk6mJGJAKddecjSrppNPhxaQQ","y":"jBPRZtGanS3ArHtSmcWHDoctlcMycGNibHaZiFPzD2M"},"time":"2023-10-27T12:59:56Z","message":"authorize: signing key"}
{"level":"info","type":"type.googleapis.com/pomerium.config.Config","id":"ingress-controller","time":"2023-10-27T12:59:56Z","message":"get"}
{"level":"warn","time":"2023-10-27T12:59:56Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"warn","time":"2023-10-27T12:59:56Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"warn","time":"2023-10-27T12:59:56Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"info","service":"envoy","name":"upstream","time":"2023-10-27T12:59:56Z","message":"cds: add 1 cluster(s), remove 0 cluster(s)"}
{"level":"info","service":"envoy","name":"upstream","time":"2023-10-27T12:59:56Z","message":"cds: added/updated 1 cluster(s), skipped 0 unmodified cluster(s)"}
{"level":"info","time":"2023-10-27T12:59:56Z","message":"service registry reporter stopping"}
{"level":"info","syncer_id":"databroker","syncer_type":"type.googleapis.com/pomerium.config.Config","service":"all","config":"databroker","checksum":"a2b8b79f0310cf9b","time":"2023-10-27T12:59:56Z","message":"config: updated config"}
{"level":"info","type":"type.googleapis.com/pomerium.config.Config","id":"ingress-controller","time":"2023-10-27T13:11:38Z","message":"get"}
{"level":"warn","time":"2023-10-27T13:11:38Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"warn","time":"2023-10-27T13:11:38Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"warn","time":"2023-10-27T13:11:38Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"info","record-type":"type.googleapis.com/pomerium.config.Config","record-id":"ingress-controller","time":"2023-10-27T13:11:38Z","message":"put"}
{"level":"info","ts":"2023-10-27T13:11:38Z","msg":"new pomerium config applied","controller":"pomerium-ingress","controllerGroup":"networking.k8s.io","controllerKind":"Ingress","Ingress":{"name":"verify","namespace":"teste"},"namespace":"teste","name":"verify","reconcileID":"1ce7bf22-ba05-43dc-a56f-e5f2ad58b778"}
{"level":"warn","time":"2023-10-27T13:11:38Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"warn","time":"2023-10-27T13:11:38Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"info","syncer_id":"databroker","syncer_type":"type.googleapis.com/pomerium.config.Config","service":"all","config_id":"ingress-controller","version":3,"err_count":0,"time":"2023-10-27T13:11:38Z","message":"set db config info"}
{"level":"info","syncer_id":"databroker","syncer_type":"type.googleapis.com/pomerium.config.Config","service":"all","config_id":"pomerium-crd","version":1,"err_count":0,"time":"2023-10-27T13:11:38Z","message":"set db config info"}
{"level":"warn","time":"2023-10-27T13:11:38Z","message":"neither `autocert`, `insecure_server` or manually provided certificates were provided, server will be using a self-signed certificate"}
{"level":"info","type":"type.googleapis.com/pomerium.config.Config","id":"pomerium-crd","time":"2023-10-27T13:11:38Z","message":"get"}
{"level":"info","Algorithm":"ES256","KeyID":"ee281ec4fc46c9d43b796aa94d943e533a0b44ae5a1e9c7bd7b955ae8b839bc5","Public Key":{"use":"sig","kty":"EC","kid":"ee281ec4fc46c9d43b796aa94d943e533a0b44ae5a1e9c7bd7b955ae8b839bc5","crv":"P-256","alg":"ES256","x":"9z7uALUyv_T0qqxX6oxk6mJGJAKddecjSrppNPhxaQQ","y":"jBPRZtGanS3ArHtSmcWHDoctlcMycGNibHaZiFPzD2M"},"time":"2023-10-27T13:11:38Z","message":"authorize: signing key"}
{"level":"info","service":"envoy","name":"upstream","time":"2023-10-27T13:11:38Z","message":"lds: add/update listener \\'http-ingress\\'"}
{"level":"info","time":"2023-10-27T13:11:38Z","message":"service registry reporter stopping"}
{"level":"info","syncer_id":"databroker","syncer_type":"type.googleapis.com/pomerium.config.Config","service":"all","config":"databroker","checksum":"8c96d714c3b6d387","time":"2023-10-27T13:11:38Z","message":"config: updated config"}
{"level":"info","service":"envoy","name":"main","time":"2023-10-27T13:14:08Z","message":"shutting down parent after drain"}
{"level":"info","type":"type.googleapis.com/pomerium.config.Config","id":"ingress-controller","time":"2023-10-27T13:18:41Z","message":"get"}
{"level":"warn","time":"2023-10-27T13:18:41Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"warn","time":"2023-10-27T13:18:41Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"warn","time":"2023-10-27T13:18:41Z","message":"config: set_authorization_header is deprecated, use ${pomerium.id_token} or ${pomerium.access_token} in set_request_headers instead"}
{"level":"warn","time":"2023-10-27T13:18:41Z","message":"neither `autocert`, `insecure_server` or manually provided certificates were provided, server will be using a self-signed certificate"}
{"level":"info","type":"type.googleapis.com/pomerium.config.Config","id":"pomerium-crd","time":"2023-10-27T13:18:41Z","message":"get"}

Describe pomerium global:
Name:         global
Namespace:
Labels:       <none>
Annotations:  <none>
API Version:  ingress.pomerium.io/v1
Kind:         Pomerium
Metadata:
  Creation Timestamp:  2023-10-27T12:59:08Z
  Generation:          1
  Resource Version:    2271191
  UID:                 568451c2-aeb9-4cb9-b6f5-d6c38116433a
Spec:
  Authenticate:
    URL:  https://authenticate.pomerium.app
  Certificates:
    pomerium/pomerium-wildcard-tls
  Secrets:  pomerium/bootstrap
Status:
  Ingress:
    teste/verify:
      Observed At:          2023-10-27T13:18:41Z
      Observed Generation:  3
      Reconciled:           true
  Settings Status:
    Observed At:          2023-10-27T12:59:10Z
    Observed Generation:  1
    Reconciled:           true
    Warnings:
      storage: please specify a persistent storage backend, please see https://www.pomerium.com/docs/topics/data-storage#persistence
Events:
  Type     Reason      Age                  From                                    Message
  ----     ------      ----                 ----                                    -------
  Normal   Updated     22m                  bootstrap pod/pomerium-b6f9dc578-8659r  config updated
  Warning  Validation  22m                  pomerium-crd                            storage: please specify a persistent storage backend, please see https://www.pomerium.com/docs/topics/data-storage#persistence
  Normal   Updated     22m                  pomerium-crd                            config updated
  Normal   Updated     3m18s (x4 over 22m)  pomerium-ingress                        teste/verify: config updated

please disregard that error message it is coming from pomerium core on very initial start before the configuration from kubernetes is synced to it.
your problem is not with certs. you do not have traffic coming to pomerium-proxy service. there is not a single access log entry in your log output. please do kubectl describe -n pomerium pomerium-proxy and see whether it has correct external IP address that matches your DNS entries.
please do curl -kv https://your-server/.well-known/pomerium/jwks.json. the output should look like below.
< HTTP/2 200
< accept-ranges: bytes
< cache-control: max-age=60
< content-length: 236
< content-type: application/json
< etag: "19e1c1febb9e21dd"
< vary: Accept-Encoding,Origin
< date: Fri, 27 Oct 2023 14:19:24 GMT
< x-envoy-upstream-service-time: 2
< x1: v1
< x13: v3
< x2: v2
< server: envoy
< x-request-id: e4e115cd-e13f-9549-9ccd-a2d639901166
<

{"keys":[{"use":"sig","kty":"EC","kid":"d20cf4224985ba04567cafb69aa2b9e5912c68a8a9bd316526b5e89b9dc97186","crv":"P-256","alg":"ES256","x":"PRhFADKJj6i6bFq9TMaKEismYNlS1dNaWIII3PUebYg","y":"dDObt0PxTKUE-7yk5AMimW4cEepLWB1XSZF06pG2e0Y"}]}

It was a problem with my loadbalancer external IP. Now I can connect, but only I use the annotation ingress.pomerium.io/allow_public_unauthenticated_access: "true" in my ingress, then it works without problems.
However, with the Azure IDP, when accessing the page I am redirected to log into Azure, and at the end of the login it returns me:
500 Internal Server Error
Internal Server Error: Internal/urlutil: malformed unix timestamp field
Pomerium deployment logs:
{"level":"info","type":"type.googleapis.com/user.ServiceAccount","query":"","offset":0,"limit":1,"filter":{"$or":[{"id":""},{"$index":""}]},"time":"2023-11-09T13:11:27Z","message":"query"}
{"level":"info","type":"type.googleapis.com/session.Session","query":"","offset":0,"limit":1,"filter":{"$or":[{"id":""},{"$index":""}]},"time":"2023-11-09T13:11:27Z","message":"query"}
{"level":"info","service":"authorize","request-id":"981ddfed-8bf0-44c5-8578-04e48eeed69e","check-request-id":"981ddfed-8bf0-44c5-8578-04e48eeed69e","method":"GET","path":"/","host":"myhost.myhost","ip":"myipXXXX","user":"","email":"","allow":false,"allow-why-false":["user-unauthenticated"],"deny":false,"deny-why-false":[],"time":"2023-11-09T13:11:27Z","message":"authorize check"}
{"level":"info","service":"envoy","upstream-cluster":"","method":"GET","authority":"myhost.myhost","path":"/","user-agent":"Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/116.0","referer":"","forwarded-for":"myipXXXX","request-id":"981ddfed-8bf0-44c5-8578-04e48eeed69e","duration":16.246075,"size":1423,"response-code":302,"response-code-details":"ext_authz_denied","time":"2023-11-09T13:11:27Z","message":"http-request"}

Ingress:
  annotations:
    ingress.pomerium.io/allow_websockets: 'true'
    ingress.pomerium.io/pass_identity_headers: 'true'
    ingress.pomerium.io/allow_any_authenticated_user: 'true'
    ingress.pomerium.io/secure_upstream: 'true'
    ingress.pomerium.io/policy: |
      allow:
        and:
        - claim/groups: 'XXXXXXXXXMYADGROUPXXXXXXX'

I discovered the problem, my identityProvider secret containing client_id and client_secret had an enter (\n) at the end of values :(
Now it's working, thank you very much for your support

@andreyolv Thanks for following up - I'm closing this issue assuming your problem has been solved!


Exonum datatypes interface and newType()

The current definition of Exonum datatypes works, but it can probably be improved as follows.
Each datatype has a set of methods
DataType.prototype = {
  serialize: function () {
    // serializes the value as Uint8Array
  },
  hash: function () {
    // calculates the hash of the serialized data
    // internally, simply calls nacl's hash on this.serialize()
  },
  isFixedLength: function () {
    // Whether the datatype has fixed byte length. It determines how the fields of this type
    // are (de)serialized as fields of other types
  }
};
Datatype.deserialize = function (bytes) {
  // deserializes the value from Uint8Array
};

Example:
// Built-in types
var x = new exonum.types.Uint8(120);
x.serialize(); // === Uint8Array([ 120 ])
x.hash(); // === exonum.types.Hash([ ... ])
var y = exonum.types.Uint8.deserialize(new Uint8Array([ 125 ]));
// Constructed types
var SomeType = exonum.types.newType({ /* type spec */ });
var z = new SomeType(/* initializer; TBD */);
z.serialize();
z.hash();
SomeType.deserialize(new Uint8Array([ /* ... */ ]));

This interface could be especially useful for datatypes constructed with newType(), but it could work for primitive/predefined datatypes for consistency.
Possible problems/topics for discussion:

Primitive integer datatypes cease to behave like integers. For example, x + y in the example above will cease working properly (although it could be partially brought back by defining the valueOf method). But it may be a good thing; we probably wouldn't want to allow arbitrary operations on datatypes. Raw values could be extracted from primitive types in a uniform fashion, e.g., via raw property.
deserialize may double as a constructor: If the constructor is supplied with a Uint8Array, then deserialization is performed. Note that this will work for hashes, pubkeys and signatures.
newType() should be discussed in detail in another issue; I feel that its interface is not optimal either

@slowli can we close this issue due Exonum had migrated to protobuf?

Sure.


Read operate with exceptions

I adapted the read operation handling to throw exceptions on negative return codes so that the methods behave like the other rados methods.

Thanks! Seem good. However, is it possible that you add a Unit Test to verify this?
The tests can be run against a real Ceph cluster which you can bootstrap with vstart.sh if needed.
Tests would be very nice to verify stuff still works.

You are right. Sorry, that I have forgotten the tests.
I also enabled two existing tests that have been missing a test annotation. I hope this ok.

Seems good to me. Tests are good to have.


47 app messages

Closes #47

Codecov Report

Merging #50 (de73162) into release-candidate (bdb94a9) will decrease coverage by 0.09%.
The diff coverage is 98.68%.

@@                  Coverage Diff                  @@
##           release-candidate      #50      +/-   ##
=====================================================
- Coverage             100.00%   99.90%   -0.10%
=====================================================
  Files                     42       49       +7
  Lines                   1026     1104      +78
=====================================================
+ Hits                    1026     1103      +77
- Misses                     0        1       +1

Impacted Files
Coverage Δ

source/YugiAcademy/YugiAcademy/settings.py
100.00% <ø> (ø)

source/YugiAcademy/Messages/messages/message.py
96.42% <96.42%> (ø)

source/YugiAcademy/Messages/admin.py
100.00% <100.00%> (ø)

source/YugiAcademy/Messages/apps.py
100.00% <100.00%> (ø)

source/YugiAcademy/Messages/messages/__init__.py
100.00% <100.00%> (ø)

...ugiAcademy/Messages/messages/tests/test_message.py
100.00% <100.00%> (ø)

...ce/YugiAcademy/Messages/migrations/0001_initial.py
100.00% <100.00%> (ø)

source/YugiAcademy/Messages/models/__init__.py
100.00% <100.00%> (ø)

source/YugiAcademy/YuGiOh/admin.py
100.00% <0.00%> (ø)

...YugiAcademy/Accounts/user_profiles/user_profile.py
100.00% <0.00%> (ø)

... and 2 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.


KAFKA-17513: Move LogSegmentsTest to storage module

As title
Committer Checklist (excluded from commit message)

[ ] Verify design and implementation
[ ] Verify test coverage and CI build status
[ ] Verify documentation (including upgrade notes)

@chia7712   I have fixed the code, PTAL


Display device sensor data

@snehmehta please refer the Figma design and let's have a chat once you're ready to pick this up


Require reviewers' approval before the PR can be merged

Codecov Report

Merging #6143 (60fbbf7) into dev (edb8f3c) will decrease coverage by 0.01%.
The diff coverage is n/a.

:exclamation: Current head 60fbbf7 differs from pull request most recent head e07462a. Consider uploading reports for the commit e07462a to get more accurate results

@@             Coverage Diff              @@
##                dev    #6143      +/-   ##
============================================
- Coverage     39.52%   39.51%   -0.02%
+ Complexity     3382     3380       -2
============================================
  Files           650      650
  Lines         25975    25975
  Branches       2871     2871
============================================
- Hits          10267    10263       -4
- Misses        14768    14770       +2
- Partials        940      942       +2

Impacted Files
Coverage Δ

...ache/dolphinscheduler/server/log/LoggerServer.java
78.26% <0.00%> (-8.70%)
:arrow_down:

...inscheduler/common/thread/ThreadPoolExecutors.java
19.23% <0.00%> (-1.93%)
:arrow_down:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update edb8f3c...e07462a. Read the comment docs.


Merge patches from the old repository

There's a bunch of patches attached to the old repository tracker. I think it should be worth to check them out and apply to our codebase.

[x] Feature: added color
[x] Rendering of accent symbols
[x] incorrect image size when using subscript
[x] Background isn't drawn when using a single char
[x] Image size: Italic support
[x] Incorrect XML serialization in different regions
[x] Feature: Render geometry & output as SVG
[x] Loading of predefined formulas
[x] Added whitespace and % rendering

Ideally we should treat these patches as our own pull requests: we should try our best to reproduce the mentioned issues (probably even write the unit tests), and merge the changes afterwards. The maintainer on duty (well, probably myself) should notify the patch authors that the patches are being merged here.

Thanks to @gsomix, we've merged all the patches. I've notified all the possibly interested parties about that.


[realsense2] release to kinetic/ubuntu 16.04

Per #410 with 5 people also agreeing this needs to happen...
Please stop closing tickets that are open and needing action just because there's been no movement. Issues are issues regardless if anyone's touched them.

I understand your concern at cases being closed after a period of inactivity.  It is necessary to close cases though to make it easier to keep track of issues that are still clearly awaiting a response (sometimes the creator of a message will stop responding to further requests for information, for example).
If you need to highlight an issue that has been closed but you still need assistance with, you are welcome to create a new case yourself and provide a link to the closed one for the reference of the Intel team members.

Yeah but closing a ticket because no one on the Intel side has actually fixed the issue at hand isn't an acceptable way of running an issue tracker in my opinion. That system is closing legitimate issues and concerns because no one fixed the underlying problem in over a year.
No one fixing the issue isn't the same thing as the issue no longer appearing.

Some issues take longer than others to fix.  This is especially so in cases where the fix needs to go in the firmware.  It is necessary to be far more careful with additions to firmware than it is with SDK updates due to the risk of 'bricking' the camera with a faulty firmware.
Intel do track unresolved issues, I promise, and maintain a list of unresolved issues in the release notes of both the SDK and the firmware.

That's understandable, but similarly Intel has chosen to support this driver as part of its choice to enter the robotics space and have active ROS support, I don't see how an issue from Microsoft, Google, etc being a reason for tickets summary closed while still exhibiting the behavior. I don't think many of the tickets closed fall into this category, and even this one which just involves a 20 minute bloom release we've been waiting on for nearly a year.
I totally appreciate the fact that you all are working on making a ROS driver, but closing issues that you haven't had time to touch isn't an acceptable way to run an open source project effecting literally hundreds of robotics companies.

Thanks so much for your constructive feedback.   Your passion demonstrates how much you care.  :).  There isn't much else I could add to the debate as I am not an Intel employee, so hopefully one of the Intel guys on this forum such as @doronhi can continue it with you.  Thanks again!

Sorry guys, I can't see how much I can contribute. You are both perfectly right.
The technical support team does wonders, helping filter out the issues.
Some issues get closed by mistake.
Some issues take way too long to solve.
Some features take way too long to be incorporated.
This specific issue, creating a release package, should not have been closed. It is very important in my opinion.

Agreed, in the meantime I've bee using this in a makefile, is there any better work around? (especially given I've got manually update the url for each version)
ifeq ($(wildcard ./src/realsense*/.),)
	wget https://github.com/intel-ros/realsense/archive/2.2.3.tar.gz
	tar -C ./src -zxvf 2.2.3.tar.gz
	rm 2.2.3.tar.gz
	@echo "$(G_COLOR) Realsense ROS and system packages installed $(NO_COLOR)"
else
	@echo "$(G_COLOR) Realsense ROS package source already exists, skipping $(NO_COLOR)"
endif

No technical reason why kinetic is the latest supported version. Just technicalities..

@SteveMacenski This should be resolved. Any other question about this? Looking forward to your update. Thanks!

This is still a problem, please stop closing tickets without action.
Issues are issues regardless if anyone’s working on it.


[Feature] Add Prow as community bot in KubeVela

Is your feature request related to a problem? Please describe.

Prow bot is popular in the cloud-native community, it would be nice if we can integrate it to the KubeVela community and use it for issue labeling, reviewing requests, etc.
Describe the solution you'd like

Describe alternatives you've considered

Additional context

/assign

@FogDong what sort of feature do you want to see via prow for now? It is worth noting that test infra is actively working on integrating GitHub actions workflow with prow. So in the future, we can directly leverage GitHub workflows scripts for testing via prow. But for now, what are the required use cases? Like do we want something like Slack infra or what? An elaborate explanation would be appreciated.

We'd like to replace kubevela-bot with prow. In this way, we can use the /label, /retest capabilities, with kubevela-bot, we can only use it for /assign, so it's better to use a mature bot like prow.

Sure that would be great. I would like to work on this one.

@sbdtu5498 Prow needs extra machine to deploy and there is also issues for exposing a url for github to call webhook. Therefore, for now we can focus on some simple command.
#5936 gives a example of how to add support for "/retest" command. Maybe you can follow it and try to develop the "/label" command.

Yes, Prow requires a host Kubernetes cluster to work. So are you currently planning to stick to the GitHub actions or migrate stuff to Prow? and regarding #5936, sure thing, I would follow the work and write actions for /label accordingly.

Yes. Currently we do not find the resource to how the Prow, especially a DNS for calling webhook. So I would recommend to use the GitHub action until we got other more resources.


A slight misalignment of the dc digital board to the left will cause a short when closing back the shielding

A slight misalignment of the dc digital board to the left (about a degree or less) will cause a short when closing back the shielding, no amount of isolation will fix it (I literally taped the board at one point), the short will cause PSUs without protections (including the original one) to eventually start sparking, then burning. (yes, this happened to me!) Realigning the board fixed it, but this design makes it literally a fire harzard if the install is slightly off (we are talking a degree or less shift to the left). Fortunately for me the Pico PSU I usually use has protections against short or things could have gone really bad, the original PSU sparked all over and had a very bad burnt smell when I tried it for less than 2 seconds.

Can you confirm the vinyl backing is covering up the esp2866 WiFi solder points. One of the two bottom points is 3.3v and if not properly isolated then a direct short can happen.

I just relooked at this. There is nothing remotely close to touching the board in either direction.

Sorry for the late reply, yes I can confirm the vinyl is on, I also looked and did not see anything that did contact myself, I even taped the whole board, the only thing I can think of is the screw itself. Whenever it was shifted to the left it caused a short.

Your cause is likely from not reinstalling the plastic protector piece under the PSU when using the original.
"the original PSU sparked all over and had a very bad burnt smell when I tried it for less than 2 seconds."
Its impossible for the PSU to spark on the secondary side as this would have never been allowed in Europe, even in 1998.  The PSU has a built in fuse which wouldn't allow this.  It appears your primary side (240v) shorted because of the missing plastic piece that goes under the PSU.  This has happened to other users as well.

The plastic was below the PSU, I also tested a pico psu (that's what I used originally), and it detected the short (and would cut power to the board), whereas the fuse on the PSU did not trigger (I was using a 220V PSU if tthat information helps).

If the primary side of the PSU shorted, than it could cause all sorts of havok in the system so after switching to the Pico, the damage was already done.
Again, Its impossible for the PSU to short on the secondary side and throw sparks.  This is something the DCHDMI could not have caused no matter what.  And out of the 1500 installs, you happen to the be the only one.  If the unit only need to be barely moved and it would blow the system there would be numerous reports.
And to restate the fact there is an image with the DCHDMI board showing it cannot short against anything.

All I can tell is the short happened, I am not going to cause it on purpose for obvious reasons. The part of the PSU that had the burnt smell was the bottom part (the one closest to the power button). Again, the plastic part was definitely under the PSU, heck I put it even when I use the pico psu even though that's typically useless.
I suspect one of the mounting screws may have caused the short.


Update eps scale for TSS2 RAV4

This makes EPS and CMD torque match up better for the TSS2 RAV4. cgw1968 sent me a route to find his safetyParam (https://my.comma.ai/cabana/?route=179669092c53e325|2020-11-27--01-56-35&exp=1638011939&sig=Rb9C5ynMbZVqAwZNjPvVuphXD%2FgA2pKj0aX8fVzXBus%3D&max=35&url=https%3A%2F%2Fchffrprivate-vzn.azureedge.net%2Fchffrprivate3%2Fv2%2F179669092c53e325%2Fcb81dc9aaa0b3f2ea3dad974d6e5c8be_2020-11-27--01-56-35)
Before, at 0.73:

Current at 0.56:

Close up at 0.56:

Do I need to change this for the DBC as well? I noticed from zorrobyte's PR #2513 for the Prius he found a safetyParam of ~0.55 for the TSS2 Prius, and birdman is using 0.53 for his TSS2 Corolla #2581. Perhaps all TSS2 (hybrid or not) are 0.56?

I can't agree on "Perhaps all TSS2 (hybrid or not) are 0.56?" For my Corolla SE 2021 I've found 50 to match EPS and CMD. But birdman's and my Corollas are different if I recall right. (But I haven't tuned INDI and didn't touched steerup as he do, I just fixed safetyParam first)

I'm hesitant to start changing these since we've found that the scaling isn't exactly linear. We'll look into this more and come up with something better.


v2: How to migrate indexHtml

Question
I am using a custom index.html in my app, and see that the indexHtml property has been removed. How can I still be using a custom index.html file in v2?
indexHtml: 'theme/index.html',

hey all. not sure why this was closed--the migration guide does not discuss this.  @draperunner, did you solve this?  @rakannimer, do you feel it's covered elsewhere?

Hey, the indexHtml property was mostly used to put some metadata in the page's head tag.
You can do that using Gatsby theme shadowing as shown here : https://www.docz.site/docs/add-favicon-and-metadata
Is there something else you're trying to do with it ?

Greetings!  Ya I need to slap in a few extra Script tags globally.  I'm not clear on what yet, but there's probably a Gatsby API I need to hook into now?

Yep, you will need to shadow the wrapper component and use react-helmet-async to include your scripts as shown here : https://www.docz.site/docs/add-favicon-and-metadata

@rakannimer I have copied and pasted the example from the documentation and added an apple maps script tag and it isn't showing up in the head tag.  Any suggestions?

@rakannimer is it not possible to add scripts to the ?

looks like my issue is with helmet...if you are dependent upon a global like stripe, google maps, etc and you are using helmet you have to set a listener for when the script loads...
https://github.com/nfl/react-helmet/issues/146

I guess you could also use something like react-load-script to listen to the script loading and react when it happens.

@rakannimer i had done that originally.  Unfortunately, I'm still running into the same problem I did with Storybook - clicking on the different links in the sidebar rerenders the whole component tree including the wrapper.
I am using a MapkitJS wrapper to authorize my mapkit token once...so the consequence of a rerender of the wrapper forces all subsequent map loads to fail.  Is the intended behavior of the wrapper to only load once?


Async composition cancellation test

Refs: https://github.com/metarhia/metasync/issues/348

Landed in ea2a48a


Make v.0.0.22

Fix a bug that occurred with episode labels if only one post-exposure time point was specified.

Hi Venexia, the test on the dummy data has failed (both here on the GHA workflow) and on my machine locally with the message
[1] "Define episode labels"
     Error in data.frame(episode = 0:length(cut_points), time_period = c("days_pre",  :
       arguments imply differing number of rows: 3, 2
     Execution halted

so I think we need a little fix to this somewhere (I have meetings for a bit, hopefully get to this later/tomorrow)


AOT: Encountered undefined provider! Error: The Angular AoT build failed.

It's caused by @chatie/db: https://github.com/Chatie/db/issues/30

Usually this means you have a circular dependencies (might be caused by using 'barrel' index.ts files.

$ ionic cordova build browser --prod

? Looks like a fresh checkout! No ./node_modules directory found. Would you like to install project dependencies? Yes
Installing dependencies may take several minutes!
> npm i
✔ Running command - done!
Running app-scripts build: --prod --platform browser --target cordova
[04:17:35]  build prod started ...
[04:17:35]  clean started ...
[04:17:35]  clean finished in 1 ms
[04:17:35]  copy started ...
[04:17:35]  deeplinks started ...
[04:17:35]  deeplinks finished in 57 ms
[04:17:35]  ngc started ...
[04:17:38]  typescript error
            Encountered undefined provider! Usually this means you have a circular dependencies (might be caused by
            using 'barrel' index.ts files.

Error: The Angular AoT build failed. See the issues above
    at /home/zixia/chatie/app/node_modules/@ionic/app-scripts/dist/aot/aot-compiler.js:237:55
    at step (/home/zixia/chatie/app/node_modules/@ionic/app-scripts/dist/aot/aot-compiler.js:32:23)
    at Object.next (/home/zixia/chatie/app/node_modules/@ionic/app-scripts/dist/aot/aot-compiler.js:13:53)
    at fulfilled (/home/zixia/chatie/app/node_modules/@ionic/app-scripts/dist/aot/aot-compiler.js:4:58)
    at <anonymous>
[04:17:39]  copy finished in 3.40 s

See Also

https://github.com/ionic-team/ionic-app-scripts/issues/885
https://stackoverflow.com/questions/42764013/circular-dependency-when-exporting-a-service-stub-along-library
https://stackoverflow.com/questions/49713890/angular-lazy-loaded-module-dependencies-encountered-undefined-provider
https://stackoverflow.com/a/39302282/1123955

Any news about this issue ?

Still fighting with it... have no idea about how to fix it, surfing StackOverflow and GitHub issues all day...

@nblavoie please see https://github.com/Chatie/db/issues/30#issuecomment-380327881


stats() on CMYK image: vips_colourspace: no known route from 'cmyk' to 'b-w'

The following code (with a CMYK JPEG as input) gives the error outlined below:
const sharp = require('sharp')
sharp('cmyk.jpg')
  .stats()
  .then(res => console.log('SUCCESS', res))
  .catch(err => console.error('ERROR', err))

Output:
ERROR [Error: vips_colourspace: no known route from 'cmyk' to 'b-w']

The following seems to work:
const sharp = require('sharp')
sharp('cmyk.jpg')
  .toColorspace('srgb')
  .toBuffer()
  .then(res => sharp(res).stats())
  .then(res => console.log('SUCCESS', res))
  .catch(err => console.error('ERROR', err))

Hi, is this a CMYK JPEG that is missing a profile? There's no logic in sharp's stats pipeline to deal with this. (sharp does have custom logic for this in the usual processing pipeline, which is why that works.)
We could add logic to stats to deal with this but the forthcoming libvips v8.8.0 will add its own internal fallback CMYK profile anyway so it's probably best to just wait and we can instead remove all the logic around this from sharp.

I wouldn't know - I'm told it's just a standard jpeg exported from photoshop. No big deal for me since I can just convert it to a different colorspace when this happens, just figured it might be a bug since you could resize it without issues. Anyway- feel free to close if you feel like this is covered by the new libvips 👍

Let's leave this open as I'd like to add a test for this scenario after the next libvips upgrade. Thanks for reporting.

Commit 417cca6 adds this as a test, which now passes, and switches to use libvips' new built-in profiles. This will be in v0.23.0.

sharp v0.23.0 / libvips v8.8.1 is now available.

Hi. Sorry to chime-in that late, but I can't get this to work either:
  sharp(file)
    .toColorspace('lch')
    .toBuffer()
    .then(data => sharp(data).stats())
    .then(stats => console.log(stats))
    .catch(error => signale.error('Failed getting stats. ' + error.message));

This returns the same stats, whether I convert to 'srgb', or 'lch', or 'lab'. Am I not understanding the stats function correctly? I thought it would give me the stats for the L, C, H channels, which would be different than stats for R, G, B channels.
Thanks


Update the rates on the registration page

Update the rates on the registration page or state that there is an additional processing fees. Otherwise people will email you that 40 + 40 is not 82.7

Fixed and deployed.


Refactor

Description
Convert packages to internal if they dont need to be exposed

Codecov Report

Merging #425 into master will decrease coverage by 0.16%.
The diff coverage is 41.26%.

@@            Coverage Diff             @@
##           master     #425      +/-   ##
==========================================
- Coverage   58.02%   57.86%   -0.17%
==========================================
  Files          45       46       +1
  Lines        5670     5698      +28
==========================================
+ Hits         3290     3297       +7
- Misses       2078     2098      +20
- Partials      302      303       +1

Impacted Files
Coverage Δ

enforcer/utils/tokens/custom.go
0% <ø> (ø)
:arrow_up:

internal/supervisor/iptablesctrl/acls.go
52.8% <ø> (ø)

internal/monitor/instance/docker/extractor.go
27.27% <ø> (ø)

utils/crypto/crypto.go
78.08% <ø> (ø)

utils/cgnetcls/netcls.go
0% <ø> (ø)

enforcer/utils/secrets/compactpki.go
85.45% <ø> (ø)
:arrow_up:

internal/supervisor/ipsetctrl/acls.go
85.9% <ø> (ø)

enforcer/utils/pkiverifier/pkiverifier.go
95.55% <ø> (ø)
:arrow_up:

internal/monitor/instance/linux/processor.go
47.9% <ø> (ø)

internal/supervisor/iptablesctrl/ipsets.go
50.7% <ø> (ø)

... and 21 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1e72e53...35db140. Read the comment docs.


Not able to specify reference image directory for a test target using Swift

As it is pointed out in the README there are three ways of setting reference image directories. The recommended option (2) works fine for most of the cases. However since it is on a scheme level if you have a scheme executing tests from multiple targets, the $(SOURCE_ROOT)/$(PROJECT_NAME)Tests/ReferenceImages approach doesn't seem to work very well.
An example would be:

FBSnapshotTestCaseDemo workspace has few other projects inside - let say FrameworkA and FrameworkB
FrameworkA project has a test target that uses FBSnapshotTestCase
FrameworkA project has a FrameworkA scheme where the FB_REFERENCE_IMAGE_DIR environment variable is configured - running tests with that scheme works fine
FBSnapshotTestCaseDemo has a FBSnapshotTestCaseDemo scheme that includes the tests from FrameworkA and FrameworkB: running the tests fails because FB_REFERENCE_IMAGE_DIR is not specified in FBSnapshotTestCaseDemo

I guess in a setup like this one (which is pretty common if you have modular project with multiple frameworks) the reference image directories should be specified per target which sounds like the option (1). I was not able to make that work though and then read in Apple's Interoperability guide that
The Swift compiler does not include a preprocessor. I'm not sure if it is a limitation or I'm missing something in the configuration, I can put together a sample project if needed. Any advices are welcome.

It is possible to achieve what you want. It is not necessary to use $(PROJECT_NAME) in the path to the image directories.
For instance, in my two targets, I have simply defined the same Environment Variables of:
$(SOURCE_ROOT)/AcceptanceTests/ReferenceImages
$(SOURCE_ROOT)/AcceptanceTests/FailureDiffs
When the tests are run in either target, they place generated snapshots in these same directories. When the images are created, for both reference images and test images, they are placed in folders that are prepended with the target name, so there is no problem with collision conflicts.

@robbertvanginkel do you want to share some notes on how we do reference images per target?

I did some research into this, and @babbage is spot on. If you use SOURCE_ROOT, you can have per target environment variables that have different directories. The only tricky part, is that in Xcode you may have to select that scheme (and add it to begin with) for the framework before you run tests:

Hope this helped! Please reach out if you need more guidance.


Electrical Build Errors

Electrical Build Errors
Electrical Build, Page 22, blue text box, “In addition, Figure 19 shows how we routed
the wires through the rocker-bogie, and then from the rocker-bogie into the main
body.”  Figure 19 should read Figure 21.
Electrical Build, Page 23, table, “2x 24AWG & 4x 30AWG”.  No 24AWG wire is specified in the parts list, only 16, 20 and 30AWG.  Presume to use 20AWG in place of 24AWG in this build.
James Phelan
Mars rover project lead
Houston Robotics

Fixed the first reference number issue in 71ad24c.
I'll follow up with Eric and verify what size of wire we're using and then update those docs accordingly.

Confirmed that we use 20AWG and 30AWG on our rover, not 24AWG.  I've updated the build documents accordingly to match the parts list.


⚠ Secret-Cinema has degraded performance

In 72d56ef, Secret-Cinema ($SC) experienced degraded performance:

HTTP code: 200
Response time: 21621 ms

Resolved: Secret-Cinema performance has improved in 72e1be5 after 5 minutes.


Change to make height dynamic based on the number of rows

Closes #4

sure let’s try it out!

I have tested it by slicing the array of files in data folder - looked nice and even for 1 data point all the way to all of them :D


(GH-2186) Add resolve and force options for module subcommand

This adds a new --[no-]resolve flag, which defaults to true, that will
allow users to install the Puppetfile without resolving the modules
enumerated in modules key in Bolt config. This also adds functionality
for the --force flag for the bolt module add command which allows
users to forcibly write to an unmanaged Puppetfile. No release notes as
this will ship dark until the full workflow is implemented.
Closes #2186
!no-release-note

CLA signed by all contributors.


Card not responsive

Proposed changes:
Cards in second section is not responsive.
Please assign me this task.

Please allocate this task to me. I'm capable of tackling it as I possess all the requisite skills to address the matter at hand.

Please assign this issue it to me as I have the required skills to do it

please assign this project I would like to work.


A few changes recently on project management

As many of you might notice, I started to drive a few changes to this project in order to address some of the long term problems we face.

Releases are more frequent. Instead of asking users to wait for years, now updates are shipped almost monthly.
Patches are merged more aggressively. The patch controller mechanism introduced earlier now allows individual patches to be turned on/off via registry keys/environment variables/app.config, so it ensures that we can ship patches and enable most of them by default. The users can help test them out, and disable those broken in their cases flexibly.

I'd like to implement the following workflow officially,

We aim for monthly release cycle (I created 2.17 for August). If there is nothing to ship, then that month can skip.
We aim to put all necessary patches in the future under patch controller, and ship them as quickly as we can.

What to do next is to determine which patches can graduate from patch controller. I assume that after 12-24 months of shipping, we should be confident that a patch is stable enough to stay in the code base. Then we can graduate it from the patch controller and merge permanently.
I also started to close issues that are not urgent or less likely to be worked on, so that we have a shorter list to track.
@roken Any idea?

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Bumped the release number to 3.0, for a few reasons,

We still have 3.0 alpha builds everywhere, which in fact are older than our latest 2.x releases. We need a way to make them all obsolete, and the best is to ship an official 3.0 release.
2.10-2.16 releases are already of a large scope than 2.0-2.9 releases (more themes, new theming interface and extensibility, and patch controller mechanism). We should have bumped the version number earlier to mark the huge changes, though it is not late now.
As proposed by this issue, we can and shall move to a monthly patching cycle.

I think a major version number change would be suitable to be executed now.
Would start to work on this on Aug 16 if no obligation is received.


Add prerequisites for practice exercises

This PR is related to #983 , it will deal with the following exercises :
meetup

hamming

raindrops

nucleotide-count

In order to evaluate the prerequisites in the best way, I'm doing the exercise then I'm reviewing the exercise's proof of work and the submitted solutions.

Left my thoughts on the exercises in the PR. The issue description also mentions "meetup". Not sure what's up with that. thinking

Oops, looks like I forgot to push this one's commit. It's done now :)


"apache.jfrog.io" no more available. Where are the .deb packages now?

Hello there!
Description
Same as #4489, the Debian repository hosted on https://apache.jfrog.io/artifactory/couchdb-deb/ is not available anymore.
Steps to Reproduce
Follow https://docs.couchdb.org/en/latest/install/unix.html#installation-using-the-apache-couchdb-convenience-binary-packages
Expected Behaviour
An official valid Debian repository for CouchDB, or at least an official communication about discontinuation of the repository.

Duplicate of #5010


Resolves issues with 2 bad links in the README.md for this repo.

These were the bad links:
Status code [404:NotFound] - Link: https://github.com/github/site-policy/blob/main/github/site-policy/github-privacy-statement
Status code [404:NotFound] - Link: https://github.com/github/site-policy/blob/main/github/site-policy/github-terms-of-service#q-changes-to-these-terms
I think I've now linked them correctly with this PR.
This was found by an new experimental hobby project that I have just created: https://github.com/MrCull/GitHub-Repo-ReadMe-Dead-Link-Finder
If this has been in any way helpful then please consider giving the above Repo a Star.

Thanks @MrCull 😃


DApp Tutorials

Context
Current Dapp tutorials are spread out across many sites, and out of date.
Goal: Update tutorials and move them into documenation
Existing Tutorials

Transactions: https://blog.cryptape.com/construct-and-send-your-first-ckb-transaction#heading-5-sign-a-transaction
xUDT: ?
Spore: https://docs.spore.pro/tutorials/create-first-spore/
"Hello CKB" https://github.com/cryptape/ckb-tutorial/blob/ada7d3729b0f2d360e86bd8a6ed6da40397f98bb/js/index.ts#L86-L94
MultiSig: ?

Tutorials should be split into the following steps:

Summary: 2-3 lines on what devs will learn
Setup: Dev Environment (1 line)
Start: copy code and start project (use defaults and hardcoded address for local-chains)
Understand: Learn about key parts of DApp.
Customize: Customize and config project.
Next: What should developers need to do after this.

For each DApp tutorial

[ ] Create Github repo for Dapp code
[ ] DApps should have simple web UI.
[ ] DApps should be deployed and can be interacted with on Testnet
[ ] Write content for tutorial

Tutorials

[ ] Token Transfer + view balance (need wallet)
[ ] xUDT
[ ] Spore
[ ] Hello World CKB

// call notes: Keep examples in separate file.
Test first version of the docs with team
Mon/Tue -> first doc example out

first version on examples:
https://github.com/nervosnetwork/docs.nervos.org/pulls?q=is%3Apr+is%3Aclosed+base%3Adevelop-v2+example
Updates will be added into separate projects/issues


feat(url): 6 new URL helpers in new section

Summary
This pull request introduces a new category "URL" and adds six new utility functions for URL manipulation:

cleanPath: Removes duplicate slashes from a URL.
onlyPath: Extracts only the path from a URL, removing any query or fragment.
withLeadingSlash: Adds a leading slash to a URL if it is not already present.
withoutLeadingSlash: Removes the leading slash from a URL if it is present.
withTrailingSlash: Adds a trailing slash to a URL if it is not already present.
withoutTrailingSlash: Removes the trailing slash from a URL if it is present.

Related issue, if any:
There is no related issue.
This is a merge of the Helpers4 library and new helpers.
Cf. discussion #279
For any code change,

[x] Related documentation has been updated, if needed
[x] Related tests have been added or updated, if needed
[x] Related benchmarks have been added or updated, if needed
[ ] Release notes in next-minor.md or next-major.md have been added, if needed

Does this PR introduce a breaking change?
No
Bundle impact

Status
File
Size [^1337]

A
src/url/cleanPath.ts
86

A
src/url/onlyPath.ts
89

A
src/url/withLeadingSlash.ts
80

A
src/url/withTrailingSlash.ts
90

A
src/url/withoutLeadingSlash.ts
89

A
src/url/withoutTrailingSlash.ts
102

[^1337]: Function size includes the import dependencies of the function.

Thanks for the PR! 🎉
I assume you're aware of the URL standard Web API, which backend runtimes (e.g. Node.js, Bun, Deno) also support. With that in mind, I'd like to better understand your thinking here.

What makes your functions essential when that API already exists? Are any of them already achievable using just the URL web API?
In what contexts are these functions indispensable? How do you envision them being used?


Give ID to Input Element

Hi, it's me again!
So I want to change my cursor focus to another input with Enter key to speed up data input process.
Unfortunately, we cannot use el.nextElementSibling or el.nextSibling in BootstrapVue, since the input element placed within the <b-form-group>.
I think I can use ID to identify every input element within a form and jump from one to another input easily.
So, can you add one more props, say inputId, and pass it value to the ID attribute to the <input /> element?
Or maybe you have a better solution for this problem, let me know.
Thanks

Hey. I think you can use inputElCustomAttributes prop.
Perhaps you can give an id like this:
<cool-select
  id="my-id"
/>

I think the focus will work when the focus is on this identifier (my-id).

Hi,
inputElCustomAttributes is the solution here. Thank you!
Sorry for the trouble :grimacing:


Add tags to the docker image

It would be great if you can tag the docker image with the release version instead of using latest.

Hello.
I published images tagged by versions.


Fix typo

I think the second "VC-WIN32" should be "VC-WIN64", according to the commit message of 8c16829.

Oops. You're entirely correct. Thanks for noticing.

+1

This is a trivial patch, I hope we all agree

I agree this is trivial and does not require a CLA as long as @xiaoyinl also considers this trivial.

I agree this is trivial.

Could some OpenSSL member merge this? Or do I need to do something before it can be merged?

it will happen, soon. :)

@richsalz Thanks! Sorry for my impatience.

Merged. Sorry for the delay.


Try to use numpy's Mersenne Twister implementation

tries to use as much MT19937 machinery from numpy as possible; some numpy functions are not extern so had to be reproduced in randomc.h
steals the shared library from numpy -- I doubt it is cross platform as currently written in setup.py

The idea I had was to just try using what's accessible in numpy to see if I could get something to work.  I'm not expecting that this is the final solution.  Since random functions from numpy must be used, I wanted to see what is accessible from C++.  There is some that you can get at in a hacky way, but I'm interested to learn more.
It looks like there used to be a Mersenne Twister implementation in scipy, but was removed.  It looks like there are many implementations available if you think it's worth using one of those over numpy's.  It would be much easier to use the numpy implementation if I could change some headers to declare functions as extern, maybe that's something we can look into.
Some numbers are produced by the test script you provided in the original PR.  I don't know if they are the correct ones, you'll have to let me know.

Can we not use a Python object directly from within C++ using something like this or this?

Can we not use a Python object directly from within C++ using something like this or this? I'd be happy to try it out if you think that might work.

Yeah, that looks like it might work.  I've never done it before, but you could give it try, I'll be interested to see how it goes.  You might try numpy's random module API

Actually what I want to do is call a method of the existing Python object from C++, which seems more challenging. Maybe the easiest thing is to modify the C++ class and pass in as arguments all the random numbers that will be needed.


update development instructions

Update development SSH key transfer instructions.

created on staging repo https://github.com/lucimobility/luci-sdk-staging/pull/11