I have a private AWS setup an I want to change the AWS URL which kip is trying to connect

I have a private AWS setup an I want to change the AWS URL..How do I do that
Right now I guess its going to public AWS env..I see options of key ID and  region can I explicitly set URL as well?
Error: error initializing provider kip: error configuring cloud client: Error setting up cloud client: Could not configure AWS cloud client authorization: Error validationg connection to AWS: RequestError: send request failed
caused by: Post https://ec2.us-east-1.amazonaws.com/: x509: certificate signed by unknown authority
@myechuri

I did try giving the VPC ID in my provider yaml..dint work out..
Any help here @myechuri  @justnoise

@saiharshitachava : can you please clarify the following?

How did you deploy kip?

a) Did you provision a new cluster using https://github.com/elotl/kip/tree/master/deploy/terraform-aws by following documentation at https://github.com/elotl/kip#installation-option-1-create-a-minimal-k8s-cluster?
Or
b) Did you deploy kip onto an existing cluster using https://github.com/elotl/kip#installation-option-2-using-an-existing-cluster ? If you used this option, did you use AWS Credentials Option 1 - Configuring AWS API keys or AWS Credentials Option 2 - Instance Profile Credentials?

Can you please share contents of your provider.yaml after redacting sensitive information? Thanks!

@myechuri I deployed kip on existing cluster using the files in base
I used the option of api keys
apiVersion: v1
cloud:
aws:
region: "us-east-1"
accessKeyID: ""
secretAccessKey: ""
vpcID: "Gave my internal VPC ID found in AWS VPC section"
etcd:
internal:
dataDir: /opt/kip/data
cells:
bootImageSpec:
owners:<PHONE_NUMBER>0dd1
filters: name=elotl-kip-*
defaultInstanceType: "t3.small"
defaultVolumeSize: "2G"
nametag: kip
itzo:
url: https://itzo-kip-download.s3.amazonaws.com
version: latest
kubelet:
cpu: "2"
memory: "2Gi"
pods: "2"

Thanks, @saiharshitachava . Can you please clarify if you filled in accessKeyID and secretAccessKey in your provider.yaml or did you leave them empty?
accessKeyID: ""
secretAccessKey: ""

Nope I did give them..I just stripped them out before posting here @myechuri

Thanks, @saiharshitachava . A couple more questions:

When you say I have a private AWS setup, do you mean you have a private VPC or something else?

In your provider.yaml, can you please confirm that the vpcID listed below does contain the cluster that you are trying to deploy kip to?

vpcID: "Gave my internal VPC ID found in AWS VPC section"

Is the cluster you are deploying kip to an EKS cluster or provisioned via kops or some other provisioner?

When you say I have a private AWS setup, do you mean you have a private VPC or something else?---Yes we have a private VPC
In your provider.yaml, can you please confirm that the vpcID listed below does contain the cluster that you are trying to deploy kip to?---I have an existing cluster in onprem..Im trying to estblish virtual kubelet which is of AWS provider in onprem cluster
Is the cluster you are deploying kip to an EKS cluster or provisioned via kops or some other provisioner?--Im trying from an onprem cluster

Thanks, @saiharshitachava , super helpful.
Do you have a VPN Gateway set up for the target VPC?
We have successfully deployed kip on an existing on-prem cluster and shipping pods to AWS with a VPN Gateway using https://github.com/elotl/kip/tree/master/deploy/terraform-vpn#vpn-setup . Hence curious to learn if you have VPN Gateway for the VPC.

Im sorry Im like quite new to AWS as well:)
So you are saying unless I create a Site to Site VPN Connection AWS VPC cannot communicate with onprem..?
And kip deploy from onprem to AWS definetely should go through VPN connections to work?
I dont see any VPN connections for my VPC

Thanks, @saiharshitachava .
VPN is not necessary - asked because i wanted to find out what your current setup involved.

Can you please add subnetID key value pair in provider.yaml? https://github.com/elotl/kip/blob/master/deploy/manifests/kip/overlays/minikube/provider.yaml#L9
Where did you get your provider.yaml template from?

Can you please share more about your on-prem control plane? Are you running a VMware k8s control plane, OpenShift control plane, minikube, or some other control plane?

I got the provider yaml from base ..I changed a few parameters for testing sake
https://github.com/elotl/kip/blob/master/deploy/manifests/kip/base
We run IBM Cloud private on vmware nodes..
I will also try adding subnet details and let you know the results
Also the main thing I noticed here is kip trying to reach might be public cloud here(I guess)..Is there a way I can pass my private AWS URL which we use to login to AWS clusters..You think this would be an issue here?  @myechuri
caused by: Post https://ec2.us-east-1.amazonaws.com/: x509: certificate signed by unknown authority

Thanks, @saiharshitachava .
Look forward to hearing back on what you saw after subnetID is added.
Kip uses aws-sdk-goclient to setup EC2 session. Can you please share a little more details on private AWS URL that you use to connect to AWS sdk? Is it a custom endpoint URL? i am wondering if your URL is similar to custom endpoint hence asking.

Hi @saiharshitachava, thank you for giving Kip a try!  I'm sorry to hear that you experienced problems with your setup.  If I understand it correctly, you are attempting to connect to AWS from your on premise kubernetes cluster.  The problem you are encountering is that your company connects to the AWS API using a custom endpoint, not the default public endpoint for ec2 in us-east-1: https://ec2.us-east-1.amazonaws.com/.  In other words, if you were to connect to AWS using the AWS CLI, you would be specifying --endpoint-url on the command line.
Kip does not currently support customizing the AWS service endpoint but it should be a small/quick code change to make the endpoint customizable.  I'll add another option in provider.yaml cloud.aws.endpointURL that will be passed through into the AWS session config in Kip.

Thanks, @justnoise !
@saiharshitachava : we will ping you shortly once https://github.com/elotl/kip/pull/143 is merged.

Thanks everyone @myechuri @justnoise for a quick code change. .Please let me know once this is merged..
I will try it out :)

The change has been merged and we cut a new release.  You'll want to update kip/deploy/manifests/kip/base/provider.yaml and add endpointURL: "https://your-private-aws-url.com to the cloud.aws section and then re-apply the manifests with: kustomize build base | kubectl apply -f -

Thanks for the fix @justnoise @myechuri
Looks like we have our console integrated with sso and uses saml profile for auth..Does this changes anything with the parameters we are giving?
Does this config need any extra parameters in the provider.yaml?

@saiharshitachava : What is the output of authentication using saml profile? Is there a way to get an access_key_id, secret_access_key and (possibly) asession token?  Can you create an aws shared credential file? Based on the output of the SSO authentication workflow, we can figure out if the existing parameters in provider.yaml are sufficient or not. Thanks!

@myechuri  Yes I have a credential file which has ID,Key and the session token in it

Thanks for clarifying, @saiharshitachava . We will scope out adding session token to provider.yaml and share an update by end of day friday. Thank you for your patience!

I was a bit slow to realize that, while we can add a session token to provider.yaml, it is possible to specify the session token with an environment variable: AWS_SESSION_TOKEN.  That value can be added to kip's container definition (in statefulset.yaml):
      containers:
      - name: kip
        image: elotl/kip:latest
        env
        - name: AWS_SESSION_TOKEN
          value: <session token value>

It might not be necessary for this use case, it's good to note that the credentials values in provider.yaml (accessKeyID, secretAccessKey and sessionToken) can all be passed as environment variables:

AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY
AWS_SESSION_TOKEN

While those values can be hard-coded into a manifest, they can also be stored as kubernetes secrets which has an extra bit of security if your cluster has enabled encryption of secret data at rest:
---
apiVersion: v1
kind: Secret
metadata:
  name: kip-aws-secrets
type: Opaque
data:
  AWS_ACCESS_KEY_ID: <base64 encoded accessKeyID>
  AWS_SECRET_ACCESS_KEY: <base64 encoded secretAccessKey>
  AWS_SESSION_TOKEN: <base64 encoded sessionToken>

The Kip pod in the Kip StatefulSet can be extended to set environment variables from the secret:
      containers:
        name: kip
        image: elotl/kip:latest
        envFrom:
        - secretRef:
            name: kip-aws-secrets

If this configuration is used, the environment varaibles will override the corresponding values in provider.yaml (I would also suggest the values in provider.yaml be removed to prevent confusion).

Thanks, @justnoise .
@saiharshitachava : please let us know if passing AWS_SESSION_TOKEN via environment variable unblocks you. Thanks!

@myechuri  from the logs it looks like it took creds from env variables..
But the problem is still there I did build a new image by adding our internal proxy (thought below was something with firewall between env) even that dint help
Is there a way you know off to disable the cert check --ssl verify=false or something so that we can bypass this error?
I0703 15:11:01.788467       1 aws.go:94] Checking for credential errors
I0703 15:11:01.788541       1 aws.go:99] Using credentials from EnvConfigCredentials
I0703 15:11:01.788575       1 aws.go:105] Validating read access
Error: error initializing provider kip: error configuring cloud client: Error setting up cloud client: Could not configure AWS cloud client authorization: Error validationg connection to AWS: RequestError: send request failed
caused by: Post https://ec2.us-east-1.amazonaws.com/: x509: certificate signed by unknown authority

Thanks, @saiharshitachava . We'll look into possible ways to disable cert check and get back shortly.

@myechuri Could you let me know where kip actually checks for the trusted root certs..Assuming this is go and debian flavour will it search under /etc/ssl/certs/ca-certificates.crt
If thats the case can I replace this cert with my internal trusted certs?would it cause any issues with the startup?

@saiharshitachava : since replacing default certs with your internal trusted certs is a better option than disabling cert check, we will explore both paths and report back on the quickest path to unblock you.

@saiharshitachava: @justnoise confirmed that you are correct.  The certs are located at /etc/ssl/certs/ca-certificates.crt . Replacing or appending your internal certificate onto /etc/ssl/certs/ca-certificates.crt in the kip container is a good way to go.
We've also made a release with another parameter in provider.yaml: insecureTLSSkipVerify.  That can be used to turn off checking TLS certs.  As the name of the parameter suggests, this flag should only be used for testing.
cloud:
  aws:
    endpointURL: <internal endpoint value>
    insecureTLSSkipVerify: true

@justnoise has done his best to test this out but since we cannot reproduce your exact setup in our environment he tested out with a MITM proxy - that setup proved to be problematic with AWS's authentication system. Please let us know if there are issues using insecureTLSSkipVerify in your setup. Thanks!

@myechuri  @justnoise  Good news is AWS checks got passed..yay !!
but now I'm having 509 cert errors while accessing  kubernetes cluster and I believe there is something wrong the api certs..I tried giving the MASTER_URI and the cluter dns manually but my understanding is these should be picked by default..
When I gave these two manually it went on checking for network-agent which it failed to find but its there in the cluster..So I believe something is going wrong when connecting to kubernetes cluster here..
Are there any custm certs u are generating to connect to kube api cluster?how is authentication done to api server from kip container?
E0705 10:32:18.551874       1 reflector.go:156] k8s.io/client-go/informers/factory.go:135: Failed to list *v1.Secret: Gethttps://8001/api/v1/secrets?limit=500&resourceVersion=0: x509: certificate is valid for kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local, , not
I0705 10:32:18.557903       1 config.go:245] Validated access to AWS
I0705 10:32:18.639260       1 network.go:147] Current vpc:  <IP_ADDRESS>/25
I0705 10:32:18.639283       1 network.go:154] Getting subnets and availability zones for VPC vpc-
I0705 10:32:18.828488       1 network.go:154] Getting subnets and availability zones for VPC vpc-
I0705 10:32:19.017534       1 aws.go:172] cells will run in a private subnet (no route to internet gateway)
I0705 10:32:19.017697       1 config.go:444] controller will connect to nodes via private IPs
I0705 10:32:19.185258       1 security_groups.go:73] security group name kip-stvmugsmfvgwpmnxzdq2lge23m-cellsecuritygroup [sg-0f416f2248be24ac3]
I0705 10:32:19.185282       1 server.go:152] ensuring region has not changed
I0705 10:32:19.369980       1 helpers.go:49] host nameservers [sever ips] searches [private domain name]
Error: error initializing provider kip: creating DNS configurer: missing or misconfigured kube-dns service

@saiharshitachava : good to hear that replacing default certs with your trusted root cert worked!
Let me get back on the missing kube-dns service issue shortly. @justnoise is currently on the road and will be back online on tuesday. @ldx and i will look into the issue and share an update latest by monday. Sorry for the delay!

@myechuri  @ldx  @justnoise I was actually trying to check with curl calls with the existing certs init-cert container is generating.however I think there should be a public cert parameter to give the ca cert same as api cert and key which we give in env vars(--client-ca-file )
Also The certs which are generated by init-cert somehow are not getting authenticated even with the ca cert..So I thought of using my existing manager.crt and key which would have a cluster scope access for crds and all..
kube-system-data-kip-provider-0-pvc-b27ea69d-bb8e-11ea-9f5e-005056ab3b00/kubelet-pki # curl --cacert /etc/cfc/kubelet/ca.crt --key kip-provider-0.key --cert kip-provider-0.crt https://<IP_ADDRESS>:443/api/v1/secrets
{
"kind": "Status",
"apiVersion": "v1",
"metadata": {
},
"status": "Failure",
"message": "Unauthorized",
"reason": "Unauthorized",
"code": 401
I replaced all the API related parameters in the statefulset and used manager certs in place of init-cert which are being generated.. and gave custom kube-config path
But somehow I guess it needs public ca cert to authenticate..I still see these errors..might be a new env variable needs to be added in kip to take this cert as input?
1 server.go:423] Could not create new Cell Controller: Error ensuring k8s cell CRD exists in controller: Get https://<IP_ADDRESS>:443/apis/apiextensions.k8s.io/v1beta1/customresourcedefinitions/cells.kip.elotl.co?timeout=30s: x509: cannot validate certificate for <IP_ADDRESS> because it doesn't contain any IP SANs

I was actually trying to check with curl calls with the existing certs init-cert container is generating.however I think there should be a public cert parameter to give the ca cert same as api cert and key which we give in env vars(--client-ca-file )

The certificate/key generated by init cert will be used by port 10250 in Kip, not as a client cert.
To connect to the Kubernetes API server, Kip will use its service account token at /var/run/secrets/kubernetes.io/serviceaccount (so Kip uses regular in-pod authentication via InClusterConfig()).

1 server.go:423] Could not create new Cell Controller: Error ensuring k8s cell CRD exists in controller: Get https://<IP_ADDRESS>:443/apis/apiextensions.k8s.io/v1beta1/customresourcedefinitions/cells.kip.elotl.co?timeout=30s: x509: cannot validate certificate for <IP_ADDRESS> because it doesn't contain any IP SANs

You're getting that error because the API server certificate does not have <IP_ADDRESS> as a SAN in it. If you use curl, you can check the names in the server certificate via curl -v "https://<IP_ADDRESS>:443/" (look for subjectAltName:). Try to use that as your kubernetes API server hostname.

@saiharshitachava : please let us know if subjectAltName mentioned in the above comment does not help get past the error. Thanks!

@saiharshitachava : checking in to see if you were able to make progress? Let us know if you are still blocked!

@myechuri  I will likely test this tomorrow (IST) and get back..

@saiharshitachava : any luck with getting past the error? Thanks!

Sorry for the huge delay..
Im gonna start working on this again today..
will keep the thread posted

Im facing issues with the init-cert and Im pretty sure its somethign with my env as this worked earlier..
CERT_DAT variable for init-cert is getting added with the kubectl versions not sure where these are coming from though..
These start when the create.csr script starts..This adds to CERT_DIT variable along with cert at the end and the base 64 decode fails..

envsubst
/opt/kubectl/1.14
/opt/kubectl/1.15
/opt/kubectl/1.16
/opt/kubectl/1.17
/opt/kubectl/1.18
using /opt/kubectl/1.14/kubectl
certificatesigningrequest.certificates.k8s.io/kip-1594912492 created

@myechuri have you seen this before..I know its somethign specific to my env but just cross checking if you guys have seen this before

@saiharshitachava maybe the CSR approval fails or it takes a long time and times out? Can you provide logs from the init-cert container?
Can you check the CSR via kubectl, e.g. if init-cert created kip-1594912492 then kubectl get -oyaml csr kip-1594912492 too?

@ldx everything is created fine but when we see the cert_data variable in get_csr.sh we see that the the envsubst values like mentioned are added to the variable along with the cert
As a result base64 decode is failing..im clueless right now from where these versions of kubectl are getting attached to the variable

This variable to be specific https://github.com/elotl/kip/blob/master/scripts/init-cert/csr/get-cert.sh#L53

echo '/opt/kubectl/1.14
/opt/kubectl/1.15
/opt/kubectl/1.16
/opt/kubectl/1.17
/opt/kubectl/1.18
LS0tLS1CRUdJTiBDRVJUSUZJQ0FU+++++++++cert+++++++'

base64 -d
base64: invalid input

@saiharshitachava OIC what you mean. I think I know what the issue is, let me fix it and get back to you as soon as there's a new build.

Ok I pulled the latest image of init-cert which was built minutes ago and that issue is resolved...Thanks @ldx
Back to my original issue when I give different alt names which are used by current existing nodes in the cluster and got the same error.. @ldx @myechuri
E0716 18:42:33.445178       1 server.go:423] Could not create new Cell Controller: Error ensuring k8s cell CRD exists in controller: Get https://<IP_ADDRESS>:443/apis/apiextensions.k8s.io/v1beta1/customresourcedefinitions/cells.kip.elotl.co?timeout=30s: x509: cannot validate certificate for <IP_ADDRESS> because it doesn't contain any IP SANs
and this <IP_ADDRESS> is the default kubernetes service IP..While trying the combinations of alt names I came across the alt names in this message which are ok with this cert..which out of one is default service but that seems to be throwing error for default as well
x509: certificate is valid for kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local, test.icp, not icp-test

Ok I pulled the latest image of init-cert which was built minutes ago and that issue is resolved...Thanks @ldx

Great, happy to hear!

Back to my original issue when I give different alt names which are used by current existing nodes in the cluster and got the same error.. @ldx @myechuri
E0716 18:42:33.445178 1 server.go:423] Could not create new Cell Controller: Error ensuring k8s cell CRD exists in controller: Get https://<IP_ADDRESS>:443/apis/apiextensions.k8s.io/v1beta1/customresourcedefinitions/cells.kip.elotl.co?timeout=30s: x509: cannot validate certificate for <IP_ADDRESS> because it doesn't contain any IP SANs
and this <IP_ADDRESS> is the default kubernetes service IP..While trying the combinations of alt names I came across the alt names in this message which are ok with this cert..which out of one is default service but that seems to be throwing error for default as well
x509: certificate is valid for kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local, test.icp, not icp-test

When your cluster got created, the API server IP address should have been added to its certificate as a SAN - wondering why it's not in there. As a workaround for now, you can try overriding the following environment variable for the kip container:
    - name: KUBERNETES_SERVICE_HOST
      value: kubernetes.default.svc.cluster.local

Should i still be giving master uri along with the above parameter?

Should i still be giving master uri along with the above parameter?

Are you setting MASTER_URI for the kip container? If yes, what is it set to?

@ldx we have custom Console URL which we use to access API with port 8001..I was giving that and got errors of SAN

Also there is something wrong with the api server authentication itself..I guess this isnt happening the way its expected and we are seeing errors from there on..  @ldx  @myechuri @justnoise  Could someone help me on how the pod communicates to api server and get these details..(pods,servicesetc..) I know you said it uses secrets using service token..I see that generated but still pod is failing to communicate to my api server..
Also @ldx  mentioned we are not using the certs which are generated by int-cert for any sort of auth but why do we ave them in these variables?
    - name: APISERVER_CERT_LOCATION
      value: /opt/kip/data/kubelet-pki/$(VKUBELET_NODE_NAME).crt
    - name: APISERVER_KEY_LOCATION
      value: /opt/kip/data/kubelet-pki/$(VKUBELET_NODE_NAME).key

Also do we have a list of variables which I can go through to use for kip and kubernetes communication..might be I can get a closer look on if there are any other custom paramters which needs to be set for my env...(variables like KUBERNETES_SERVICE_HOST..etc)
E0717 08:50:45.682646       1 reflector.go:156] k8s.io/client-go/informers/factory.go:135: Failed to list *v1.Service: Unauthorized
E0717 08:50:45.683329       1 reflector.go:156] k8s.io/client-go/informers/factory.go:135: Failed to list *v1.ConfigMap: Unauthorized
E0717 08:50:45.684625       1 reflector.go:156] k8s.io/client-go/informers/factory.go:135: Failed to list *v1.Pod: Unauthorized
E0717 08:50:45.685396       1 reflector.go:156] k8s.io/client-go/informers/factory.go:135: Failed to list *v1.Secret: Unauthorized
I0717 08:50:45.862161       1 aws.go:172] cells will run in a private subnet (no route to internet gateway)
I0717 08:50:45.862185       1 config.go:444] controller will connect to nodes via private IPs
I0717 08:50:46.047316       1 security_groups.go:73] security group name kip-stvmugsmfvgwpmnxzdq2lge23m-cellsecuritygroup [sg-0f416f2248be24ac3]
I0717 08:50:46.047344       1 server.go:152] ensuring region has not changed
Error: error initializing provider kip: creating DNS configurer: missing or misconfigured kube-dns service
Usage:

I tried giving KUBERNETES_SERVICE_HOST as kubernetes.default.svc and no kube config and no master URI..
I see these errors..I want to try giving parameters like below ..Its just that I dunno the keys which KIP can understand..
  api_server: https://kubernetes.default.svc.cluster.local
scheme: https
tls_config:
  ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
  insecure_skip_verify: true

W0717 09:27:35.327513       1 serverurl.go:72] building config from kubeconfig: stat /root/.kube/config: no such file or directory, continuing with alternative config methods
E0717 09:27:35.549506       1 reflector.go:156] k8s.io/client-go/informers/factory.go:135: Failed to list *v1.Secret: Get https://kubernetes.default.svc:443/api/v1/secrets?limit=500&resourceVersion=0: x509: certificate signed by unknown authority
E0717 09:27:35.550768       1 reflector.go:156] k8s.io/client-go/informers/factory.go:135: Failed to list *v1.Service: Get https://kubernetes.default.svc:443/api/v1/services?limit=500&resourceVersion=0: x509: certificate signed by unknown authority
E0717 09:27:35.550769       1 reflector.go:156] k8s.io/client-go/informers/factory.go:135: Failed to list *v1.Pod: Get https://kubernetes.default.svc:443/api/v1/pods?fieldSelector=spec.nodeName%3Dkip-provider-0&limit=500&resourceVersion=0: x509: certificate signed by unknown authority
E0717 09:27:35.564054       1 serverurl.go:44] trying to determine API server URL: Get https://kubernetes.default.svc:443/api/v1/namespaces/default/endpoints/kubernetes: x509: certificate signed by unknown authority
F0717 09:27:35.564081       1 main.go:100] can't determine API server URL, please set --kubeconfig or MASTER_URI

I tried giving KUBERNETES_SERVICE_HOST as kubernetes.default.svc and no kube config and no master URI..
I see these errors..I want to try giving parameters like below ..Its just that I dunno the keys which KIP can understand..
  api_server: https://kubernetes.default.svc.cluster.local
scheme: https
tls_config:
  ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
  insecure_skip_verify: true

By default, Kip uses the pod serviceaccount for authenticating to the API server. Is the above config snippet from a kubeconfig file? If yes, how do you provide the kubeconfig file to pods in the cluster?
We do have some code that allows Kip to use a kubeconfig file, but I'll have to test it to see if it works everywhere when Kip needs to talk to the API server.

@ldx I see an option in kip with flag --kubeconfig to provide the file..
And the above isnt the snippet from kube-config(just  trying to get a picture of what I wanted to pass)
When I give the api server details in config and pass the file in --kube-config I dont see the api calls going to the server which I gave they by default are going to kubernetes service IP like its somwhere hard coded..
apiVersion: v1
clusters:

cluster:
certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
server: https://apiserver:port
name: default-cluster
users:
name: default-auth
user:
client-certificate: kip-provider-0.crt
client-key: kip-provider-0.key

I gave a different server in the config file but I see this in logs..If this works I can think I can pass the ca cert along with authentication for api calls..and from there kip could pick up the dns and other configurations..this is wat I could understand till now..
2020-07-17 15:24:54.982537 I | etcdserver/api: enabled capabilities for version 3.3
E0717 15:24:55.180447       1 reflector.go:156] k8s.io/client-go/informers/factory.go:135: Failed to list *v1.ConfigMap: Get **https://<IP_ADDRESS>:443/**api/v1/configmaps?limit=500&resourceVersion=0: x509: cannot validate certificate for <IP_ADDRESS> because it doesn't contain any IP SANs

@ldx I see an option in kip with flag --kubeconfig to provide the file..
And the above isnt the snippet from kube-config(just trying to get a picture of what I wanted to pass)
When I give the api server details in config and pass the file in --kube-config I dont see the api calls going to the server which I gave they by default are going to kubernetes service IP like its somwhere hard coded..
apiVersion: v1
clusters:
* cluster:
  certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
  server: https://apiserver:port
  name: default-cluster
  users:

* name: default-auth
  user:
  client-certificate: kip-provider-0.crt
  client-key: kip-provider-0.key

That certificate and key (kip-provider0.crt and kip-provider-0.key) are used by Kip for its listener port, it's not a client certificate.
Do you have a kubeconfig file and either a token or a client certificate you can use for authenticating to the API server?

I gave a different server in the config file but I see this in logs..If this works I can think I can pass the ca cert along with authentication for api calls..and from there kip could pick up the dns and other configurations..this is wat I could understand till now..
2020-07-17 15:24:54.982537 I | etcdserver/api: enabled capabilities for version 3.3
E0717 15:24:55.180447 1 reflector.go:156] k8s.io/client-go/informers/factory.go:135: Failed to list *v1.ConfigMap: Get **https://<IP_ADDRESS>:443/**api/v1/configmaps?limit=500&resourceVersion=0: x509: cannot validate certificate for <IP_ADDRESS> because it doesn't contain any IP SANs

Yes, there's a direct call to InClusterConfig() when the cell controller is set up. I can look into it if you need a kubeconfig file to authenticate against the API server.

Yes i do have a kube config file which i can use for authenticating to api server and when i pass it to kip..it doesnt take the api server which i give which somehow makes me think the config from the flag isnt picking up

Im thinking kube config way is a better way here because i have all these specific ca crt and stuff to paas while authenticating in my env

Im thinking kube config way is a better way here because i have all these specific ca crt and stuff to paas while authenticating in my env

Let me look into this. As I mentioned, we have some support for using a kubeconfig file, but it's incomplete.

Sure..thank you..i wanna try giving that configurations in a file as it has lot more features on how we can connect and authenticate to a cluster..
So once authentication is done all the dns stuff and configurations should work by themseleves?the other errors which i gave above?

So once authentication is done all the dns stuff and configurations should work by themseleves?the other errors which i gave above?

Once Kip is able to access the API server, it should be able to figure everything else out, if it has the right permissions.

Great please let me know once kube config flag is complete

Great please let me know once kube config flag is complete

I just merged this, documentation is here: https://github.com/elotl/kip/blob/master/docs/kubeconfig.md

@ldx @myechuri  @justnoise  First step of testing this might have been a success..I was able to succesfully spin the agent and when I do get nodes I could see the kip agent in the nodes..Thanks for all the help..kube config stuff did work :)
kip-provider-0    Ready    agent                    4m48s
So I guess I can start putting the load on server which will create a default instance node in aws for me..

OK I did try putting pods on the server..but some reason no new AWS insatnces are spinnign up and neither i see that in logs..
It jus keeps checking availbility zones and subnets stuff but never spun an instance in aws vpc..
Events:
Type     Reason                 Age                 From                           Message

Warning  FailedScheduling       10m (x81 over 71m)  default-scheduler              0/16 nodes are available: 1 Insufficient pods, 15 node(s) didn't match node selector, 3 Insufficient cpu.
Normal   ProviderCreateSuccess  10m                 kip-provider-0/pod-controller  Create pod in provider successfully
cdldvcldvkb0001:/home/chavas/kip # kubectl get pods | grep -i pending
audit-logging-fluentd-ds-gmcmf                        0/1     Pending   0          71m
calico-node-kslvd                                     0/1     Pending   0          71m
image-manager-init-certs-g2kf6                        0/1     Pending   0          71m
k8s-proxy-ngrwz                                       0/1     Pending   0          71m
cdldvcldvkb0001:/home/chavas/kip #
my provider.yaml
apiVersion: v1
cloud:
aws:
region: "us-east-1"
vpcID: "myvpcid"
subnetID: "my subnet id"
etcd:
internal:
dataDir: /opt/kip/data
cells:
bootImageSpec:
owners: owner id
imageIDs: ami-name
defaultInstanceType: "t3.nano"
defaultVolumeSize: "2G"
nametag: kip
itzo:
url: https://itzo-kip-download.s3.amazonaws.com
version: latest
kubelet:
cpu: "20"
memory: "20Gi"
pods: "10"
I0718 08:09:32.249489       1 server.go:141] configuring k8s client from kubeconfig
I0718 08:09:32.762595       1 controller_manager.go:111] Starting controllers
I0718 08:09:32.762615       1 controller_manager.go:116] Starting NodeController
I0718 08:09:32.762624       1 controller_manager.go:116] Starting GarbageController
I0718 08:09:32.762628       1 controller_manager.go:116] Starting MetricsController
I0718 08:09:32.762632       1 controller_manager.go:116] Starting CellController
I0718 08:09:32.762637       1 controller_manager.go:116] Starting NodeStatusController
I0718 08:09:32.762641       1 controller_manager.go:116] Starting PodController
I0718 08:09:32.762646       1 controller_manager.go:119] Finished starting controllers
I0718 08:09:32.763378       1 node_controller.go:445] Resume waiting on healty from 0 instances
I0718 08:09:32.765586       1 pod_controller.go:168] starting pod controller
I0718 08:09:32.919391       1 root.go:232] Initialized watchedNamespace= provider=kip operatingSystem=Linux node=kip-provider-0
I0718 08:09:32.919568       1 podcontroller.go:257] Pod cache in-sync watchedNamespace= provider=kip operatingSystem=Linux node=kip-provider-0
I0718 08:09:32.920860       1 podcontroller.go:299] starting workers watchedNamespace= provider=kip operatingSystem=Linux node=kip-provider-0
I0718 08:09:32.920948       1 podcontroller.go:332] started workers watchedNamespace= provider=kip operatingSystem=Linux node=kip-provider-0
I0718 08:09:32.939747       1 instanceselector.go:400] chose instance t3.nano
I0718 08:09:32.940426       1 instanceselector.go:400] chose instance t3.nano
I0718 08:09:32.942510       1 opencensus.go:154] Updated pod in provider pod=image-manager-init-certs-g2kf6 namespace=kube-system
I0718 08:09:32.942805       1 event.go:281] Event(v1.ObjectReference{Kind:"Pod", Namespace:"kube-system", Name:"image-manager-init-certs-g2kf6", UID:"836107ac-c8c5-11ea-9f5e-005056ab3b00", APIVersion:"v1", ResourceVersion:"79823815", FieldPath:""}): type: 'Normal' reason: 'ProviderUpdateSuccess' Update pod in provider successfully watchedNamespace= provider=kip operatingSystem=Linux node=kip-provider-0
I0718 08:09:32.946451       1 opencensus.go:154] Updated pod in provider pod=calico-node-kslvd namespace=kube-system
I0718 08:09:32.946555       1 event.go:281] Event(v1.ObjectReference{Kind:"Pod", Namespace:"kube-system", Name:"calico-node-kslvd", UID:"83610716-c8c5-11ea-9f5e-005056ab3b00", APIVersion:"v1", ResourceVersion:"79823817", FieldPath:""}): type: 'Normal' reason: 'ProviderUpdateSuccess' Update pod in provider successfully watchedNamespace= provider=kip operatingSystem=Linux node=kip-provider-0
I0718 08:09:32.953923       1 opencensus.go:154] Created pod in provider pod=k8s-proxy-ngrwz namespace=kube-system
I0718 08:09:32.954011       1 event.go:281] Event(v1.ObjectReference{Kind:"Pod", Namespace:"kube-system", Name:"k8s-proxy-ngrwz", UID:"83669be6-c8c5-11ea-9f5e-005056ab3b00", APIVersion:"v1", ResourceVersion:"79844708", FieldPath:""}): type: 'Normal' reason: 'ProviderCreateSuccess' Create pod in provider successfully watchedNamespace= provider=kip operatingSystem=Linux node=kip-provider-0
I0718 08:09:33.049163       1 controller.go:106] node status changed ready: true network unavailabe: false
I0718 08:09:33.136888       1 instanceselector.go:400] chose instance t3.nano
I0718 08:09:33.138037       1 opencensus.go:154] Created pod in provider pod=audit-logging-fluentd-ds-gmcmf namespace=kube-system
I0718 08:09:33.138204       1 event.go:281] Event(v1.ObjectReference{Kind:"Pod", Namespace:"kube-system", Name:"audit-logging-fluentd-ds-gmcmf", UID:"83803e18-c8c5-11ea-9f5e-005056ab3b00", APIVersion:"v1", ResourceVersion:"79844731", FieldPath:""}): type: 'Normal' reason: 'ProviderCreateSuccess' Create pod in provider successfully watchedNamespace= provider=kip operatingSystem=Linux node=kip-provider-0
I0718 08:09:39.918665       1 node_controller.go:735] latest image for spec map[imageIDs:ami-name owners:owner id]: {ami details /dev/sda1 2019-06-27 18:56:56 +0000 UTC}
I0718 08:12:01.924366       1 network.go:154] Getting subnets and availability zones for VPC vpc-name

or do I need to follow this steps for using my own custom ami?
https://github.com/elotl/kip/blob/master/docs/cells.md#bring-your-own-image

do I need to follow this steps for using my own custom ami?

@saiharshitachava : you do not need to specify custom ami unless you want to override the default ami.

I0718 08:12:01.924366 1 network.go:154] Getting subnets and availability zones for VPC vpc-name

Can you please share log lines after this line?
CC @justnoise @ldx

@myechuri i want to use custom ami hence mentioned it in provider yaml
There is no log after that line it continuosly tries to get zones and thats the last line i see in logs till the auth token expires

i want to use custom ami hence mentioned it in provider yaml

@saiharshitachava : ah ok, thanks for clarifying.

There is no log after that line it continuosly tries to get zones and thats the last line i see in logs till the auth token expires

Thanks for sharing. Let me look into it and get back once @ldx and @justnoise are back online on monday. Sorry for the delay!

or do I need to follow this steps for using my own custom ami?
https://github.com/elotl/kip/blob/master/docs/cells.md#bring-your-own-image

You need an AMI that has the cell agent on it, or have the instance download and start it at boot time via cloud-init.
Another thing you could try is increasing log verbosity, via adding --v=2 or even --v=5 to the argument list of Kip.

@ldx so I essentially add my custom ami as below and upadate the init.yaml with the configuration mentioned so that it fetches at boot time..
Would that change or effect the base ami Im using in anyway?like modyfying the ami and stuff?
bootImageSpec:
cloudInitFile: /etc/kip/cloudinit.yaml
owners: "my id"
imageID: "ami-name"
cloudinit.yaml: |
runcmd:
- apt-get update && apt-get install -y ipset iproute2 iptables
- wget -O /usr/local/bin/itzo https://itzo-kip-download.s3.amazonaws.com/itzo-latest
- wget -O /usr/local/bin/kube-router https://milpa-builds.s3.amazonaws.com/kube-router
- wget -O /usr/local/bin/tosi https://tosi.s3.amazonaws.com/tosi
- chmod 755 /usr/local/bin/*
- mount --make-rprivate /
- /usr/local/bin/itzo -v=2 > /var/log/itzo.log 2>&1 &

@ldx so I essentially add my custom ami as below and upadate the init.yaml with the configuration mentioned so that it fetches at boot time..
Would that change or effect the base ami Im using in anyway?like modyfying the ami and stuff?
bootImageSpec:
cloudInitFile: /etc/kip/cloudinit.yaml
owners: "my id"
imageID: "ami-name"
cloudinit.yaml: |
runcmd:

apt-get update && apt-get install -y ipset iproute2 iptables
wget -O /usr/local/bin/itzo https://itzo-kip-download.s3.amazonaws.com/itzo-latest
wget -O /usr/local/bin/kube-router https://milpa-builds.s3.amazonaws.com/kube-router
wget -O /usr/local/bin/tosi https://tosi.s3.amazonaws.com/tosi
chmod 755 /usr/local/bin/*
mount --make-rprivate /
/usr/local/bin/itzo -v=2 > /var/log/itzo.log 2>&1 &

That should work for a Debian or Ubuntu based image.
Did you try increasing Kip log verbosity?

I havent yet my ami image doesnt have cell agent so I m trying to follow the steps above..
I just wanted to confirm if there would be any change to my base image if I add a cloud-init.yaml ..Im assuming it would just download the binaries and required configs on to the guests at the time of spinjning an instance and would nt change anything in base ami..Please confirm..
I will be increasing the verbosity now..
Also please confirm if this is the way to do this by providing below in provider.yaml..Also mine base image is of SLES so I added zypper
cells:
bootImageSpec:
cloudInitFile: /etc/kip/cloudinit.yaml
owners: owner id
imageIDs: ami-name
defaultInstanceType: "t3.nano"
defaultVolumeSize: "2G"
nametag: kip
kubelet:
cpu: "4"
memory: "6Gi"
pods: "6"
cloud-init:
cloudinit.yaml: |
runcmd:
- zypper update && zypper install -y ipset iproute2 iptables
- wget -O /usr/local/bin/itzo https://itzo-kip-download.s3.amazonaws.com/itzo-latest
- wget -O /usr/local/bin/kube-router https://milpa-builds.s3.amazonaws.com/kube-router
- wget -O /usr/local/bin/tosi https://tosi.s3.amazonaws.com/tosi
- chmod 755 /usr/local/bin/*
- mount --make-rprivate /
- /usr/local/bin/itzo -v=2 > /var/log/itzo.log 2>&1 &

Ok I created a seperate config map for cloudinit.yaml and attached it to the pod as a volume by mentioning it in statefulset..
Giving the log below..I still dont see an instance created and pods are in pending state
kubectl exec -it kip-provider-0 -c kip cat /etc/kip/cloud/cloudinit.yaml
runcmd:

zypper update && zypper install -y ipset iproute2 iptables
wget -O /usr/local/bin/itzo https://itzo-kip-download.s3.amazonaws.com/itzo-latest
wget -O /usr/local/bin/kube-router https://milpa-builds.s3.amazonaws.com/kube-router
wget -O /usr/local/bin/tosi https://tosi.s3.amazonaws.com/tosi
chmod 755 /usr/local/bin/*
mount --make-rprivate /
/usr/local/bin/itzo -v=2 > /var/log/itzo.log 2>&1 &

My provider.yaml
apiVersion: v1
cloud:
aws:
region: "us-east-1"
vpcID: "vpc-name"
subnetID: "subnet-id"
etcd:
internal:
dataDir: /opt/kip/data
cells:
cloudInitFile: /etc/kip/cloud/cloudinit.yaml
bootImageSpec:
owners: id
imageIDs: ami-name
defaultInstanceType: "t3.nano"
defaultVolumeSize: "2G"
nametag: kip
kubelet:
cpu: "4"
memory: "6Gi"
pods: "6"
I0718 18:17:55.970817       1 opencensus.go:138] updated node status in api server node.Status.Conditions=[{Ready True 2020-07-18 18:17:55 +0000 UTC 2020-07-18 18:17:25 +0000 UTC KubeletReady kubelet is ready} {NetworkUnavailable False 2020-07-18 18:17:55 +0000 UTC 2020-07-18 18:17:25 +0000 UTC RouteCreated RouteController created a route} {OutOfDisk False 2020-07-18 18:17:55 +0000 UTC 2020-07-18 18:17:25 +0000 UTC KubeletHasSufficientDisk kubelet has sufficient disk space available} {MemoryPressure False 2020-07-18 18:17:55 +0000 UTC 2020-07-18 18:17:25 +0000 UTC KubeletHasSufficientMemory kubelet has sufficient memory available} {DiskPressure False 2020-07-18 18:17:55 +0000 UTC 2020-07-18 18:17:25 +0000 UTC KubeletHasNoDiskPressure kubelet has no disk pressure}]
I0718 18:17:55.970849       1 node.go:294] Successful node ping provider=kip operatingSystem=Linux node=kip-provider-0 watchedNamespace=
I0718 18:18:05.004507       1 server.go:142] 404 request not found uri=/stats/summary/ vars=map[]
I0718 18:18:05.017972       1 server.go:142] 404 request not found uri=/stats/summary/ vars=map[]
I0718 18:18:05.099419       1 server.go:142] 404 request not found uri=/stats/summary/ vars=map[]
I0718 18:18:05.971030       1 server.go:794] received node ping
I0718 18:18:05.971052       1 controller.go:160] node ping
I0718 18:18:05.971063       1 controller.go:168] node pong
I0718 18:18:05.975603       1 opencensus.go:138] got node from api server method=UpdateNodeStatus
Thats the last log getting status of nodes from api server

I even tried with the elotl ami image..I still see nothing ..When I enable debug loag with level 5..It just shows me the node status updates I posted above..
I0718 18:43:55.805344       1 event.go:281] Event(v1.ObjectReference{Kind:"Pod", Namespace:"kube-system", Name:"image-manager-init-certs-hxjgx", UID:"0cb2aa1d-c926-11ea-9f5e-005056ab3b00", APIVersion:"v1", ResourceVersion:"80054014", FieldPath:""}): type: 'Normal' reason: 'ProviderUpdateSuccess' Update pod in provider successfully provider=kip operatingSystem=Linux node=kip-provider-0 watchedNamespace=
I0718 18:43:55.806856       1 opencensus.go:154] Updated pod in provider pod=calico-node-n4ff8 namespace=kube-system
I0718 18:43:55.807025       1 event.go:281] Event(v1.ObjectReference{Kind:"Pod", Namespace:"kube-system", Name:"calico-node-n4ff8", UID:"0cabb71c-c926-11ea-9f5e-005056ab3b00", APIVersion:"v1", ResourceVersion:"80054005", FieldPath:""}): type: 'Normal' reason: 'ProviderUpdateSuccess' Update pod in provider successfully provider=kip operatingSystem=Linux node=kip-provider-0 watchedNamespace=
I0718 18:44:00.786536       1 controller.go:106] node status changed ready: true network unavailabe: false
I0718 18:44:02.683744       1 node_controller.go:735] latest image for spec map[filters:name=elotl-kip-* owners:689494258501]: {ami-0264146701c835631 elotl-kip-556-20200317-233835 xvda 2020-03-18 00:35:46 +0000 UTC}
I0718 18:46:24.863829       1 network.go:154] Getting subnets and availability zones for VPC vpc-0077d8af04b1e78ff
I0718 18:46:25.211581       1 network.go:154] Getting subnets and availability zones for VPC vpc-0077d8af04b1e78ff

Two more things to check:

Try increasing verbosity for kip temporarily to --v=5. Try to create a new pod after you restart it with --v=5, and see if there's anything in the logs on Kip starting a new instance for the pod, etc.
Check the status of Kip cells via kubectl get cells.

I see something like this
I0718 19:58:25.399636       1 podcontroller.go:299] starting workers provider=kip operatingSystem=Linux node=kip-provider-0 watchedNamespace=
kubectl get cells --all-namespaces
No resources found.

Do you have any pods assigned to kip-provider-0? What does kubectl get pods --field-selector=spec.nodeName=kip-provider-0 -A show?

yes there are..All the pods are ds except the one which says test..Anything I can check in AWS console before the node spins up.?
NAME                                                 READY   STATUS    RESTARTS   AGE
audit-logging-fluentd-ds-zl7cv                       0/1     Pending   0          9m31s
calico-node-8txlk                                    0/1     Pending   0          9m31s
test-577948b979-tzzhr   0/1     Pending   0          50s
image-manager-init-certs-jj2hv                       0/1     Pending   0          9m31s
k8s-proxy-69sw2                                      0/1     Pending   0          9m31s
Also the node shows as agent in get nodes..Is that expected and It says starting kube-proxy but I guess its never satrted?
kip-provider-0    Ready    agent                    11m
Namespace                  Name                                                  CPU Requests  CPU Limits  Memory Requests  Memory Limits  AGE

kube-system                audit-logging-fluentd-ds-zl7cv                        300m (7%)     300m (7%)   512Mi (8%)       512Mi (8%)     11m
kube-system                calico-node-8txlk                                     250m (6%)     0 (0%)      100Mi (1%)       0 (0%)         11m
kube-system                ecm-pdfextract-connector-dit-cdl4-577948b979-tzzhr    100m (2%)     400m (10%)  128Mi (2%)       500Mi (8%)     3m14s
kube-system                image-manager-init-certs-jj2hv                        10m (0%)      0 (0%)      64Mi (1%)        0 (0%)         11m
kube-system                k8s-proxy-69sw2                                       0 (0%)        0 (0%)      0 (0%)           0 (0%)         11m
Allocated resources:
(Total limits may be over 100 percent, i.e., overcommitted.)
Resource           Requests     Limits

cpu                660m (16%)   700m (17%)
memory             804Mi (13%)  1012Mi (16%)
ephemeral-storage  0 (0%)       0 (0%)
Events:
Type    Reason    Age   From                        Message

Normal  Starting  11m   kube-proxy, kip-provider-0  Starting kube-proxy.

This is log of kip..The thing which is concerning to me is the subnet ID its not pocking the subnet ID I gave in provider.yaml but implicitly using a different one..Is that expected?mostly posted the log rest all is node status ping and pong
I0720 13:02:10.222657       1 reflector.go:153] Starting reflector *v1.Pod (1m0s) from k8s.io/client-go/informers/fact
ory.go:135
I0720 13:02:10.222800       1 reflector.go:188] Listing and watching *v1.Pod from k8s.io/client-go/informers/factory.g
o:135
I0720 13:02:10.223229       1 reflector.go:153] Starting reflector *v1.Service (1m0s) from k8s.io/client-go/informers/
factory.go:135
I0720 13:02:10.223243       1 reflector.go:188] Listing and watching *v1.Service from k8s.io/client-go/informers/facto
ry.go:135
I0720 13:02:10.223399       1 reflector.go:153] Starting reflector *v1.Secret (1m0s) from k8s.io/client-go/informers/f
actory.go:135
I0720 13:02:10.223417       1 reflector.go:188] Listing and watching *v1.Secret from k8s.io/client-go/informers/factor
y.go:135
I0720 13:02:10.223519       1 reflector.go:153] Starting reflector *v1.ConfigMap (1m0s) from k8s.io/client-go/informer
s/factory.go:135
I0720 13:02:10.223531       1 reflector.go:188] Listing and watching *v1.ConfigMap from k8s.io/client-go/informers/fac
tory.go:135
I0720 13:02:10.231274       1 decoder.go:225] decoding stream as YAML
I0720 13:02:10.231837       1 server.go:119] starting internal etcd
I0720 13:02:10.231896       1 etcd.go:105] Setting etcd compaction mode to periodic
I0720 13:02:10.231904       1 etcd.go:111] Setting etcd compaction interval to 1 hour
2020-07-20 13:02:10.287604 I | etcdserver: name = default
2020-07-20 13:02:10.287627 I | etcdserver: data dir = /opt/kip/data
2020-07-20 13:02:10.287633 I | etcdserver: member dir = /opt/kip/data/member
2020-07-20 13:02:10.287636 I | etcdserver: heartbeat = 100ms
2020-07-20 13:02:10.287639 I | etcdserver: election = 1000ms
2020-07-20 13:02:10.287643 I | etcdserver: snapshot count = 100000
2020-07-20 13:02:10.287656 I | etcdserver: advertise client URLs = http://localhost:2379
2020-07-20 13:02:10.318468 I | etcdserver: restarting member 8e9e05c52164694d in cluster cdf818194e3a8c32 at commit in
dex 6976
2020-07-20 13:02:10.318904 I | raft: 8e9e05c52164694d became follower at term 864
2020-07-20 13:02:10.318931 I | raft: newRaft 8e9e05c52164694d [peers: [], term: 864, commit: 6976, applied: 0, lastindex: 6976, lastterm: 864]
2020-07-20 13:02:10.329177 W | auth: simple token is not cryptographically signed
2020-07-20 13:02:10.330434 I | etcdserver: starting server... [version: 3.3.18, cluster version: to_be_decided]
2020-07-20 13:02:10.330991 I | etcdserver/membership: added member 8e9e05c52164694d [http://localhost:2380] to cluster cdf818194e3a8c32
2020-07-20 13:02:10.331099 N | etcdserver/membership: set the initial cluster version to 3.3
2020-07-20 13:02:10.331146 I | etcdserver/api: enabled capabilities for version 3.3
2020-07-20 13:02:11.520966 I | raft: 8e9e05c52164694d is starting a new election at term 864
2020-07-20 13:02:11.521024 I | raft: 8e9e05c52164694d became candidate at term 865
2020-07-20 13:02:11.521044 I | raft: 8e9e05c52164694d received MsgVoteResp from 8e9e05c52164694d at term 865
2020-07-20 13:02:11.521060 I | raft: 8e9e05c52164694d became leader at term 865
2020-07-20 13:02:11.521314 I | raft: raft.node: 8e9e05c52164694d elected leader 8e9e05c52164694d at term 865
2020-07-20 13:02:11.522250 I | etcdserver: published {Name:default ClientURLs:[http://localhost:2379]} to cluster cdf818194e3a8c32
I0720 13:02:11.522282       1 etcd.go:129] Etcd server is ready to serve requests
I0720 13:02:11.522326       1 server.go:100] validating write access to etcd (will block until we can connect)
I0720 13:02:11.523290       1 server.go:110] write to etcd successful
I0720 13:02:11.523347       1 server.go:221] ControllerID: stvmugsmfvgwpmnxzdq2lge23m
I0720 13:02:11.523355       1 server.go:223] creating cert factory
I0720 13:02:11.532904       1 server.go:229] configuring cloud client
I0720 13:02:11.533004       1 config.go:228] using AWS region "us-east-1"
I0720 13:02:11.533226       1 config.go:248] Validating connection to AWS
I0720 13:02:11.533566       1 aws.go:123] Checking for credential errors
I0720 13:02:11.533592       1 aws.go:128] Using credentials from EnvConfigCredentials
I0720 13:02:11.533606       1 aws.go:134] Validating read access
I0720 13:02:12.478214       1 config.go:252] Validated access to AWS
I0720 13:02:12.634746       1 network.go:147] Current vpc:  vpc-name 1st CIDR block
I0720 13:02:12.634775       1 network.go:154] Getting subnets and availability zones for VPC vpc-name
I0720 13:02:13.118498       1 network.go:274] Assuming implicit use of main routing table rtb-name for subnet-name
I0720 13:02:13.399280       1 aws.go:202] cells will run in a private subnet (no route to internet gateway)
I0720 13:02:13.399291       1 config.go:453] controller will connect to nodes via private IPs
I0720 13:02:13.716683       1 security_groups.go:73] security group name kip-name-cellsecuritygroup [sg-name]
I0720 13:02:13.716731       1 server.go:235] ensuring cloud region is unchanged
I0720 13:02:13.716739       1 server.go:161] ensuring region has not changed
I0720 13:02:13.716835       1 server.go:242] creating internal client certificate
I0720 13:02:13.717250       1 server.go:247] starting cloud status keeper
I0720 13:02:13.717307       1 server.go:256] setting up instance selector
I0720 13:02:13.723858       1 server.go:268] validating default instance type
I0720 13:02:13.723874       1 server.go:274] setting up events
I0720 13:02:13.723966       1 server.go:277] setting up registry
I0720 13:02:13.727220       1 server.go:295] creating DNS configurer
I0720 13:02:14.031290       1 helpers.go:47] host nameservers [IP  IP] searches [domain_name]
I0720 13:02:14.031558       1 server.go:302] determining connectivity to cells
I0720 13:02:14.031596       1 server.go:308] setting up health checks
I0720 13:02:14.031610       1 server.go:327] creating pod controller
I0720 13:02:14.031648       1 server.go:348] creating image ID cache
I0720 13:02:14.031659       1 server.go:351] checking cloud-init file
I0720 13:02:14.031674       1 server.go:358] creating node controller
I0720 13:02:14.031684       1 server.go:389] creating garbage controller
I0720 13:02:14.031699       1 server.go:401] creating metrics controller
I0720 13:02:14.031712       1 server.go:141] configuring k8s client from kubeconfig
I0720 13:02:14.031944       1 server.go:415] creating cell controller
I0720 13:02:14.031971       1 decoder.go:225] decoding stream as YAML
I0720 13:02:14.546491       1 server.go:430] creating node status controller
I0720 13:02:14.546536       1 server.go:470] registering internal event handlers
I0720 13:02:14.546551       1 server.go:476] starting controller manager
I0720 13:02:14.546590       1 controller_manager.go:111] Starting controllers
I0720 13:02:14.546611       1 controller_manager.go:116] Starting NodeStatusController
I0720 13:02:14.546621       1 controller_manager.go:116] Starting PodController
I0720 13:02:14.546626       1 controller_manager.go:116] Starting NodeController
I0720 13:02:14.546636       1 controller_manager.go:116] Starting GarbageController
I0720 13:02:14.546642       1 controller_manager.go:116] Starting MetricsController
I0720 13:02:14.546650       1 controller_manager.go:116] Starting CellController
I0720 13:02:14.546667       1 controller_manager.go:119] Finished starting controllers
I0720 13:02:14.546911       1 server.go:496] validating boot image spec
I0720 13:02:14.547054       1 node_controller.go:445] Resume waiting on healty from 0 instances
I0720 13:02:14.551335       1 pod_controller.go:168] starting pod controller
W0720 13:02:14.672182       1 controller.go:113] UpdateNode() has not been called
I0720 13:02:14.827489       1 server.go:503] done creating instance provider
I0720 13:02:14.827569       1 server.go:781] ConfigureNode
I0720 13:02:14.827578       1 controller.go:180] setting pod CIDRs to [VPC CIDR]
I0720 13:02:14.830020       1 root.go:232] Initialized provider=kip operatingSystem=Linux node=kip-provider-0 watchedNamespace=
I0720 13:02:14.830052       1 server.go:800] registering node status callback
I0720 13:02:14.830059       1 controller.go:174] registered node status callback
I0720 13:02:14.830127       1 shared_informer.go:227] caches populated
I0720 13:02:14.830148       1 podcontroller.go:257] Pod cache in-sync provider=kip operatingSystem=Linux node=kip-provider-0 watchedNamespace=
I0720 13:02:14.830199       1 server.go:753] GetPods
I0720 13:02:14.831936       1 convert.go:508] skipping PackagePath "/etc/resolv.conf"
I0720 13:02:14.831956       1 convert.go:508] skipping PackagePath "/etc/hosts"
I0720 13:02:14.832014       1 convert.go:508] skipping PackagePath "/etc/resolv.conf"
I0720 13:02:14.832020       1 convert.go:508] skipping PackagePath "/etc/hosts"
I0720 13:02:14.832041       1 convert.go:508] skipping PackagePath "/etc/resolv.conf"
I0720 13:02:14.832050       1 convert.go:508] skipping PackagePath "/etc/hosts"
I0720 13:02:14.832069       1 convert.go:508] skipping PackagePath "/etc/resolv.conf"
I0720 13:02:14.832076       1 convert.go:508] skipping PackagePath "/etc/hosts"
I0720 13:10:55.854751       1 opencensus.go:138] sync handled key=kube-system/ecm-pdfextract-connector-dit-cdl4-577948b979-tzzhr
I0720 13:10:55.855428       1 server.go:713] GetPod "ecm-pdfextract-connector-dit-cdl4-577948b979-tzzhr"
I0720 13:10:55.855497       1 server.go:648] CreatePod "ecm-pdfextract-connector-dit-cdl4-577948b979-tzzhr"
I0720 13:10:55.856169       1 instanceselector.go:400] chose instance t3.nano
I0720 13:10:55.858024       1 opencensus.go:154] Created pod in provider namespace=kube-system pod=ecm-pdfextract-connector-dit-cdl4-577948b979-tzzhr
I0720 13:10:55.858102       1 opencensus.go:138] Processed queue item method=handleQueueItem
I0720 13:10:55.859024       1 event.go:281] Event(v1.ObjectReference{Kind:"Pod", Namespace:"kube-system", Name:"ecm-pdfextract-connector-dit-cdl4-577948b979-tzzhr", UID:"72310049-ca8a-11ea-9f5e-005056ab3b00", APIVersion:"v1", ResourceVersion:"80897177", FieldPath:""}): type: 'Normal' reason: 'ProviderCreateSuccess' Create pod in provider successfully provider=kip operatingSystem=Linux node=kip-provider-0 watchedNamespace=

@ldx @myechuri @justnoise Any ebug mode or manual check which I could do inside kip container to check if kip can bring up the aws instance?
At this point I dont see much in logs of kip like why there is no instance coming up..if we can manually trigger teh call from within the container to aws might be we see an error?
Please let me know if this is possible..
Also I do have a IAM role which I could use to bring up instances..how do I provide that variable or name?Does the kip-provider pod essentially need to run on aws instance to use an IAM role?

Hi @saiharshitachava, thanks for your patience with this process.
I've read through the logs you posted (those were helpful!), traced through the code to double check some assumptions and I'm very curious why instances are not being created for your pods.  I see that the pods are being created in K8s, and then in the kip-provider.  At that point, kip should see that there are pending pods and create VMs for those pods.  The log line I would expect to see is Starting instance for node: {<bunch of node info>}. Unfortunately I don't see that message in any of the logs. This is an interesting situation where some information isn't bubbling up to the logs or kubernetes.

Any debug mode or manual check which I could do inside kip container to check if kip can bring up the aws instance?

There is and it could be very helpful!  If you start the kip container with the additional argument --debug-server kip starts a listener that can be used to interact and query kip's internal state using kipctl which installed at the root of the kip image. To use that:

Add --debug-server to the list of arguments passed to kip:
kubectl -nkube-system edit statefulset kip-provider

Exec into the newly launched kip pod:
kubectl -nkube-system exec -it kip-provider-0 -c kip -- /bin/bash

Query for the state of pods in kip:
/kipctl get pods

This query is to see if there a difference between the state of pods in kip and the state of pods in k8s. The pending pods in k8s should be shown as "Waiting" in kip. I'm curious if kipctl shows (a) no pods (b) pods in a state that isn't "Waiting".

Query for a list of events in kip (we should really send these back to k8s but haven't had the chance to implement this).
/kipctl get events

This query helps show if there something happening to the pods after they are created in kip. Are they immediately terminated/deleted for some reason and we're not logging that? The list of kip events should show if a pod is getting created and then terminated. If we are seeing pods being terminated immediately after creation then we're onto something.  If the pods are sitting in kip in the "Waiting" state then... well... I'm going to have to think about that one a bit more.

@saiharshitachava : would you be open to joining our Slack channel to shorten response time while we triage this issue? If so, can you please send me your email address? i am at<EMAIL_ADDRESS>.  Thanks!


Create a footer white-18

One need to make this component using HTML and Tailwind CSS. I would suggest to use Tailwind Playgrounds to make things faster and quicker.
Here is a reference to the component.

After building the component please raise a PR with a screenshot of the component and add the component in Footer/footer-white18.html.
If you need to use any icon please use it from Hero Icons
Good luck.

hi could you assign this to me?

Hi! I would like to work on this issue. Can you please assign it to me? @rupsha014

Hello sir, can you assign this issue to me?

Are you still working on this issue? @rakicodes

Okay no problem. @rakicodes


Feature: RichCommands Paste

Resolved / Related Issues
Copy the pr #11670, approved but the checks fail for an unknown reason.
I split the pr, this part is only Cut/Copy. This is the second and final part, the Paste command.

[x] Were these changes approved in an issue or discussion with the project maintainers? In order to prevent extra work, feature requests and changes to the codebase must be approved before the pull request will be reviewed. This prevents extra work for the contributors and maintainers.

Validation
How did you test these changes?

[x] Did you build the app and test your changes?
[x] Did you check for accessibility? You can use Accessibility Insights for this.
[ ] Did you remove any strings from the en-us resource file?

[ ] Did you search the solution to see if the string is still being used?

[ ] Did you implement any design changes to an existing feature?

[ ] Was this change approved?

[ ] Are there any other steps that were used to validate these changes?

@cinqmilleans can you fix the conflicts?

/azp run

@cinqmilleans do the tests past if you run them locally?

I figured out why the test fails.
If you select an item and press the copy button and then the paste button, a conflict dialog appears instead of automatically renaming and copying the item. The test doesn't assume that a dialog will appear.
Also, the paste button cannot be pressed when any file is selected.

Regarding the 2nd difference, it is voluntary. The toolbar buttons should always have the same behavior as in the context menu. If a folder is selected, I can paste into it with the toolbar. Currently, you have to go through its contextual menu or open the folder.
Regarding the dialog box, I corrected that.

The collision issue already exists in the current application.

Open a folder containing a folder and a file.
Copy the file
Open the context menu of the sub-folder (same parent as the copied file).
Paste into folder.
A collision popup appears. However, there is no real collision.

In this pr, copying in the same folder (deselecting everything), does not display a popup but automatically renames the file.
The problem seems to come from FilesystemHelpers.GetCollision(). That's another issue for another pr, if the issue is confirmed.

Sorry, I misunderstood a bit. The test fails because it expects the folder to be pasted in the same location as the original folder.
In File Explorer, the paste button in the toolbar copies the folder in the opened folder, not in the selected folder. It is also available while a file is selected. I think it should work the same as Explorer i.e. current Files.
The behavior of the conflict dialog was certainly not changed.

Maybe two commands are needed: paste to current folder and paste to selected folder.

It's done.

Thank you. It is much better, but there is still one point where the behavior is different.
When I open a context menu without item selection, the paste button is disabled. It should be enabled and work the same way as the paste button on the toolbar.

You are right. I added this. Thank you.

Nice. Everything seems to be working as expected.


libjulius as dll/so library

A libjulius in a form of dll/so with exported functions, is it planned ? I'm currently a CMU Sphinx user on Windows. Sphinx/Pocketsphinx is built to DLLs that I can easily use from Delphi and Lazarus. I want to switch to Julius because more language models are available for it. But Delphi and Lazarus can not import libjulius.lib.

I created my own version of Julius as a DLL. I might consider publishing it as a open source in near future. There is a DLL version of Julius available which you can use by looking as source code at skrybotdomowy.sf.net There is a subproject there called Skrybot.Decoder.Core.Wrapper.Tests which shows you how to use it in your own applications. Unfortunately I only developed Polish speech models at the moment. It will be updated very soon - over the next few days.

Thanks, but sadly this is a .NET wrapper. I'm in need of native wrapper that will be platform independent. In other words it must export methods from jfunc.c and probably even more (to retain basic functionality of Julius).

From what you are saying everything is already available there for you. Julius exposes static libraries which are really small (libsent, libjulius). You can incorporate them into your solutions very easily. There are examples how to do that just withing Julius itself.

Lazarus and Delphi can't import C/C++ .lib files that were created by Visual Studio (COFF?). That is the output format of libjulius and it leads to the case of no usability from my IDEs.

You can host Julius as a separate process and talk to it via sockets. Julius has an XML based sockets protocol to communicate with it. That is how Julius and Adintool are talking to each other. Adintool records data from microphone and sends it via sockets to Julius. Julius then responds with XML message. It is a TCP/IP sockets based communication, relatively easy to implement.


Documentation improvement

I am running Oragono on my server and like it a lot! On the other hand I am a bit frustrated from the lack of documentation on how to both administer and use the server. I am finding a bits and pieces of information here and there, but everything is very scattered and incomplete.
Small example:
Trying to identify on a nick I have registered

/msg NickServ IDENTIFY foo password

NickServ is not yet implemented, sorry! To register an account, check /HELPOP REG

/HELPOP REG

Help not found

Some of the key topics are:

Server installation and configuration
Implemented commands
Implemented services

Is it possible to improve the documentation at least on those topics a bit?
I believe that it will make Oragono more approachable for people who are not core developers of the system...

Hey @klokocka, thanks for using Oragono! And I'm really sorry about the lack of docs!
I really should come up with a better solution to this. There's a few options I could go with... My main thought is to write something along the lines of a 'manual' file that is included in the docs/ folder that goes through all of the above in a nice, easily-readable way. Once it's written up I can also add it as a page to the website, "Latest Manual (v0.10.0)" or something similar. How's something like that sound?
That HELPOP REG thing is irritating, I definitely agree. I'll improve that error message with the next release. I'm also planning to rewrite a lot of the HELP entries wholesale so just suck less (right now, a lot of them aren't that well-written, and as you mention are mostly for developers of the system).

Hello @DanielOaks for quick reply! I really appreciate your responsiveness!
I have no problem reading documentation in files, e.g. oragano.yaml config file is quite well documented. Even tho for some of the entries I had to test them before I fully understood how exactly they work, overall it helped a lot. So keeping the documentation in the docs/ folder written in MarkDown is absolutely fine for me.
My limitation is that I have basically no prior experience with IRC and IRCD so I am missing a number of basic concepts + not everything working the same as on other IRCD so not easy to to work with it. Will be really good to have some at least basic guideline not to need study source code of the server...
Maybe every time you add/fix a functionality, just writing a brief comments, something similar to the config file, into the docs/ should be enough for the start. Anybody who is really interested in making the server working will have a guideline + can serve as a back bone for someone to write proper documentation later on...
Maybe I can try to help by writing down few things that I already understood about it...

No problem, thanks for putting in the issue in the first place! Definitely, I totally agree with the concepts and this server working a little differently than others.
I've got a basic manual done up so I'll keep working on that, then put it into docs/. In addition, as you say I can extend it every time a new feature's added.
I'd be glad for help! Even just letting me know exactly what you've run into trouble with (like the NickServ IDENTIFY stuff above) helps me know what to focus on, so feel free to put any sorta information you think would be useful in here, I appreciate it :)

Hey @klokocka, do you have any thoughts on something along these lines as an initial manual?
https://github.com/oragono/oragono/blob/master/docs/MANUAL.md
Still lots to go of course, and lots of information to fill out, but that shows how I'm thinking it could work. Thanks again for suggesting this, something we should've started working on a while ago :)

Hello Daniel,
I read your manual very carefully and I like it very much! It contains exactly the information about channels and their management I was looking for!
My few cents to the manual:

If you want to grow the manual even further, it might be useful to make it a bit more structure. One thing I see is breaking this one long page into smaller parts/separate pages. maybe by sections?
Something like:

Installation and server management

Configuration

Channel management
etc.

Probably in the page about "installation and configuration" will be good to include information from the "INFO.md" file. This like "Rehashing" are very useful for somebody who is administrating the server.

The configuration file "oragono.yaml" has some minimal comments, but they doesn't explain everything. It might be useful to explain functionality of each parameter in more details on a separate manual page/section.

I was using Slack in the past and even tho I prefer IRC for its simplicity, power and separation of contexts, I still see few things we can learn from it. Just few basic ideas/questions:

The fact that "account names are completely unrelated to nicknames" is maybe good for an open platform as IRC historically is, but not for all possible use cases. E.g. in my case we use Oragono as a
platform for communication in our company. Will be much easier and less confusing if the "nickname ownership" functionality is implemented. I will definitely use it, even if it is just a configuration option.

When we use the Oragono only as a company communication tool, we basically don't want anybody from outside to be able to connect to it. This can be partially prevented by configuring a "password to login
to the server". Unfortunately this is just a partial solution, because for example if somebody leaves the company, then the only possibility to block his access to the server is changing the server password,
which has the negative effect that everyone else must also start using the new password. Also if I have a password on the server and a different on my user account, I am not sure how to configure my IRC
client to login into both (server + SASL) on connecting. Isn't it possible to apply something like "Channel modes" on access to the server itself?

Is it possible to record a channel timestamped history on the server and then "replay/load" it a users that were not present/logged in at the moment of conversation? I saw somebody configuring it on some other
ircd with some more/bot and find it quite useful. Or maybe implementing /history command??

As I said I like the separation of contexts, i.e. "programs that do one thing and do it well" and also "programs to handle text streams, because that is a universal interface", but also "programs to work together". Maybe an "interface" to cooperate with other tools, e.g. web GUI, photo/text sharing, webcall service, etc. might be useful feature to have.

Ah, lotsacomments and suggestions!
With the manual:

I definitely agree with extending and building it out in that way, will split it up into more meaningful sections like you suggest.
Yeah, INFO.md was sorta a rough ground for just documenting random bits of info. I'll be transferring everything from there into the manual proper.
That makes sense! Can go through it from top to bottom and explain it more in-depth.

With the ideas and questions:

Nicknames being unrelated to accounts is just because that's the easiest way for me to implement it.  We are planning to let you choose whether to link account names and nicknames with #169, but no news about when exactly that'll land unfortunately (it's a bit of a difficult feature to implement, we'll get there though).
Hmm... it's a tough question. What I could implement is a way to say "Only let users access the server if they login via SASL beforehand", how would something like that sound? Then when you have someone new you can simply disable it, let the new person register and then re-enable the protection or something similar... Honestly, I need to build out NickServ to let opers have more control. Let them create accounts for other users, as well as drop existing accounts. I'll make a new issue to look at this and any more suggestions/etc around it would be appreciated, thanks for bringing it up!
Not possible to replay channel history at the moment. For what it's worth, ZNC lets you do so, but it'd be useful to build it into the server itself. I'll look at this more, it's a feature that's useful for company stuff like your network. I'm thinking that it'd be easiest to store+replay things based on accounts and registered channels. I'll come up with some ideas, and we'll see what works for this.
We used to have a very rough web API but I ended up ripping it out because web frontends are hard to build. I wouldn't mind looking at re-adding it at some point, but it's not on my radar for now (mostly since maintaining it is difficult). File sharing and calling are useful, and we've been discussing it in the IRCv3 Working Group here https://github.com/ircv3/ircv3-ideas/issues/4 and https://gist.github.com/clokep/f7a07fa9e0bdcfe8cf6a , but no implementations yet. In particular, the WebRTC stuff hasn't been implemented because of message size limits, but the new extended sizes that the draft/message-tags-0.2 allows helps out a lot with that, so it'd probably be possible to implement something like that with TAGMSG (but the channels are still an irritating thing to deal with... we'll work it out though).

Heh, lots of tough-to-implement things. But definitely great ideas, and stuff I'm looking to implement at some point in the future. What can help especially is things like this comment where the actual commands and method for interacting with the system is defined clearly, helps make it really easy to implement. Thanks again for the suggestions and comments, hopefully this is useful!

Thanks a lot for quick reply and taking my suggestions into account. I am really happy that you plan to implement them!
With the manual:
1), 2), 3) Perfect!
With the ideas and questions:

Oh, I didn't know it is a difficult thing. Then no problem, I can live without it, it is just a bit inconvenient...

Yes, this will be very nice workaround! :-)

Good, looking forward to it. It is quite convenient and common thing nowadays. You have it on every web forum, Facebook, Slack, etc. Even most of the IRC web clients implement it...

I agree and think that keeping things KISS is the way to go. Anyway web API are not really necessary. If somebody wants to, then he connects to Oragano as any other IRC client. For example in my case as we find the web access often very useful, I plan to run next to Oragono a IRC web client. I am looking at Mauirc (https://github.com/tulir/mauirc) and I like about it that it is also written in Go so I would be able keep my app stack homogeneous...

For the other services (File, Image, Code, Video, WebRTC. etc.): I like that you already thought about those ideas, but my opinion is that the way to go is the KISS, i.e. do one thing and do it well. Rest of the things leave for other services. Why not to just integrate with other services/projects like Dropbox, Pastebin, WebRTC Experiment, etc.? The IRCD (Oragono) will provide only a simple text link and the rest will be handled by a 3rd party service. Might be very simple to implement and transparent for the end user. Some irc web clients already implement something like this (e.g. Mibbit with Pastebin), but having it supported in the server/standard will spread it to everybody...

I would like to help with things like comments with actual commands, but as I am new to IRC world, I don't know commands or how things work on other IRCD too much. I will try to study about it, but cannot promise too much...

A lot of this is getting addressed in v0.13.0, in particular:

Strict nickname reservation
A SASL-only mode, providing exact control of which users can log into the server
A /history command

I'm going to close this and then make sure the manual reflects the changes.


Error running resample_to_csv

Using Python 3.6.2
When following the Bitcoin Charts example
http://gbeced.github.io/pyalgotrade/docs/v0.18/html/bitcoincharts_example.html
Got an error message:-

TypeError: 'dict_keys' object does not support indexing

My fix was to modify pyalgotrade/feed/init.py
Update line 112 from:
    def getKeys(self):
        return self.__ds.keys()

To:
    def getKeys(self):
        return list(self.__ds.keys())

thanks, chownc, I will update with this.


python39Packages.aiohttp build failure on x86_64-linux as of 37a2c634

Issue description
Build of python39Packages.aiohttp failed on x86_64-linux as of 37a2c634953a00e028f3190d36e8260b1ceabbbd. This is currently breaking python39Packages.tensorflow-bin.
error: builder for '/nix/store/i9sjf6v6qr4d16yd9d5incns5y8bzj4d-python3.9-aiohttp-3.8.4.drv' failed with exit code 1;
       last 10 log lines:
       > XFAIL test_web_functional.py::test_http10_keep_alive_default[pyloop]
       > XFAIL test_web_server.py::test_unsupported_upgrade[pyloop] - The behavior of C-extensions differs from pure-Python: https://github.com/aio-libs/aiohttp/issues/6446
       > XFAIL test_web_urldispatcher.py::test_decoded_url_match[pyloop-urldecoded_route] - Regression in v3.7: https://github.com/aio-libs/aiohttp/issues/5621
       > XFAIL test_web_urldispatcher.py::test_decoded_url_match[pyloop-urldecoded_route_with_regex] - Regression in v3.7: https://github.com/aio-libs/aiohttp/issues/5621
       > XFAIL test_web_urldispatcher.py::test_decoded_url_match[pyloop-urlencoded_route] - Regression in v3.7: https://github.com/aio-libs/aiohttp/issues/5621
       > ERROR test_web_sendfile_functional.py::test_static_file_if_modified_since_past_date[sendfile-pyloop] - pytest.PytestUnraisableExceptionWarning: Exception ignored in: <coroutine o...
       > ERROR test_web_sendfile_functional.py::test_static_file_if_none_match[no_sendfile-pyloop-additional_etags0-] - pytest.PytestUnraisableExceptionWarning: Exception ignored in: <coroutine o...
       > ERROR test_web_sendfile_functional.py::test_static_file_if_none_match[no_sendfile-pyloop-additional_etags1-Fri, 31 Dec 9999 23:59:59 GMT] - pytest.PytestUnraisableExceptionWarning: Exception ignored in: <coroutine o...
       > = 2556 passed, 17 skipped, 6 deselected, 7 xfailed, 3 errors in 171.29s (0:02:51) =
       > /nix/store/j0xzghjmynydvw37zihdbw598j0iwly9-stdenv-linux/setup: line 1596: pop_var_context: head of shell_variables not a function context
       For full logs, run 'nix log /nix/store/i9sjf6v6qr4d16yd9d5incns5y8bzj4d-python3.9-aiohttp-3.8.4.drv'.
error: 1 dependencies of derivation '/nix/store/86ir9c7ddmchg49b47gjlymhyc3ci29y-python3.9-google-auth-2.19.1.drv' failed to build
error: 1 dependencies of derivation '/nix/store/7rvylrwby89367qfi8rlsf8yhwb9spns-python3.9-google-auth-oauthlib-1.0.0.drv' failed to build
building '/nix/store/7p0qwbd5jq937vbb7nz9h4l0p5f23pkd-python3.9-opt-einsum-3.3.0.drv'...
error: 1 dependencies of derivation '/nix/store/l6y8z3d0rn3fqmgdsymql3xjcirpsr5f-python3.9-tensorboard-2.11.0.drv' failed to build
error: 1 dependencies of derivation '/nix/store/8a19pw9y349pggz6dnvin3dwznqv9lxq-python3.9-tensorflow-gpu-2.12.0.drv' failed to build

full build log
python39Packages.tensorflow-bin maintainers cc: @jyp @abbradar
python39Packages.aiohttp maintainers cc: @dotlambda
Other cc: n/a
Steps to reproduce

Checkout nixpkgs at commit 37a2c634953a00e028f3190d36e8260b1ceabbbd
Run nix-build -A python39Packages.aiohttp

Technical details
 - system: `"x86_64-linux"`
 - host os: `Linux 5.15.0-1039-azure, Ubuntu, 22.04.2 LTS (Jammy Jellyfish), nobuild`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.16.1`
 - nixpkgs: `/nix/store/gkr8wg3dvxxvn0c4qpydklckc1rni5jk-source`

Contents of ~/.config/nixpkgs/config.nix:
{ allowUnfree = true; cudaSupport = true; cudaCapabilities = ["8.0"]; }

Misc.
This issue was automatically generated by nixpkgs-upkeep.

CI workflow that created this issue.
Internal tags: -8014702454629596905 -6369820603653348464

IIRC aiohttp tests are commonly flaky, at least in the past couple of months.

@samuela Please don't have your bot assign people to issues.

duplicate of https://github.com/NixOS/nixpkgs/issues/236552


Allow specifying StrictSSL in the NPM config file

The standard way of specifying whether you want strict-ssl or not
is to add an entry into your npm config file for strict-ssl. Use
that entry (which is passed to the install.js as an environment
variable) to set the option for strictSSL in electron-download.

Will be released with the next electron release


Typo in setup documentation

Thanks.
This PR should be done on this file https://github.com/cssnext/cssnext/blob/master/docs/content/setup.md


Add basic robrix rust CI config,no conflict with current project.

Now, we have basic ci config, it include two jobs check and clippy.
The current configuration will not conflict with what we already have in our current project.
We should gradually liberalize the corresponding code styles and some CI/CD rules, while submitting separate PRs for minor changes.
If large-scale code style changes are made, this can lead to increased project volume and some potential dangers.
So @kevinaboos @ZhangHanDong  , what are your opinions??

lgtm

@tyreseluo in #281 I fixed all of the standard clippy lints, so you should be able to enable all lints in the CI pass and deny any that fail.
Same for cargo check, we should deny warnings.

oh, god, so quicky! You are right. We don't need too much deps ci config, just check and clippy.

ok, dtolnay/rust-toolchain@master action will automatically read the configuration from rust-toolchain.toml.
And since the previous typos have been merged, I've added the typos job as well.


init: docker-systemctl-replacement at 1.5.7417

Description of changes
I packaged the python app script docker-systemctl-replacement. It's my first python lib packaging, so not sure if I have done it right.
Also I'm not sure about the binary name, as the app has the bin systemctl.py but the usage is described as (& makes more sense) to symlink it as bin name systemctl :thinking:
Things done

Built on platform(s)

[x] x86_64-linux
[ ] aarch64-linux
[ ] x86_64-darwin
[ ] aarch64-darwin

For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)

[ ] sandbox = relaxed
[ ] sandbox = true

[ ] Tested, as applicable:

NixOS test(s) (look inside nixos/tests)
and/or package tests
or, for functions and "core" functionality, tests in lib/tests or pkgs/test
made sure NixOS tests are linked to the relevant packages

[ ] Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
[x] Tested basic functionality of all binary files (usually in ./result/bin/)
24.05 Release Notes (or backporting 23.05 and 23.11 Release notes)

[ ] (Package updates) Added a release notes entry if the change is major or breaking
[ ] (Module updates) Added a release notes entry if the change is significant
[ ] (Module addition) Added a release notes entry if adding a new NixOS module

[x] Fits CONTRIBUTING.md.

Add a :+1: reaction to pull requests you find important.

@ofborg eval

Sorry for closing, CI not passing and without proper fix for a long time. If you want to work on this again, you can reopen it.


browser object for webpack in package.json

Hello, I was trying to use clappr-stats with webpack and npm and I kept getting Clappr cannot be resolved Error. this minor change fixed the issue for me.
Thanks for the cool plugin and of course the awesome player 👍 😄

Thank you very much @ya7ya  👏
I rely strongly on @thiagopnts and @towerz and @tjenkinson to review this PR! (since I don't know what are the implications/trade-offs)


TypeError: path must be a string or Buffer

$ node -v
v8.11.1
$ yarn -v
1.12.3
$ yarn setup
yarn run v1.12.3
$ node ./scripts/setup
[1/5] 🔍  Validating package.json...
[2/5] 🔍  Resolving packages...
[3/5] 🚚  Fetching packages...
[4/5] 🔗  Linking dependencies...
warning " ><EMAIL_ADDRESS>has incorrect peer dependency<EMAIL_ADDRESS>|| ^0.11.0 || ^0.12.0 || ^0.13.0".
warning "firebase-admin ><EMAIL_ADDRESS>has unmet peer dependency "<EMAIL_ADDRESS>warning "firebase-admin > @firebase/database ><EMAIL_ADDRESS>has unmet peer dependency "<EMAIL_ADDRESS>warning " ><EMAIL_ADDRESS>has incorrect peer dependency<EMAIL_ADDRESS>|| ^0.6.0 || ^0.7.0 || ^0.8.0-b || ^0.9.0 || ^0.10.0 || ^0.11.0 || ^0.12.0 || ^0.13.0".
warning " ><EMAIL_ADDRESS>has incorrect peer dependency<EMAIL_ADDRESS>warning " ><EMAIL_ADDRESS>has unmet peer dependency<EMAIL_ADDRESS>warning " ><EMAIL_ADDRESS>has unmet peer dependency<EMAIL_ADDRESS>warning "react-app-tools > babel-plugin-transform-dynamic-import ><EMAIL_ADDRESS>has incorrect peer dependency "<EMAIL_ADDRESS>warning " ><EMAIL_ADDRESS>has incorrect peer dependency<EMAIL_ADDRESS>warning "relay-compiler ><EMAIL_ADDRESS>has incorrect peer dependency<EMAIL_ADDRESS>[5/5] 📃  Building fresh packages...
TypeError: path must be a string or Buffer
at Object.fs.openSync (fs.js:646:18)
at Object.fs.readFileSync (fs.js:551:33)
at Object. (/Users/dank/dev/react-firebase-starter/knexfile.js:26:12)
at Module._compile (module.js:652:30)
at Object.Module._extensions..js (module.js:663:10)
at Module.load (module.js:565:32)
at tryModuleLoad (module.js:505:12)
at Function.Module._load (module.js:497:3)
at Module.require (module.js:596:17)
at require (internal/module.js:11:18)
at /Users/dank/dev/react-firebase-starter/scripts/setup.js:18:18
at Object. (/Users/dank/dev/react-firebase-starter/scripts/setup.js:56:3)
at Module._compile (module.js:652:30)
at Object.Module._extensions..js (module.js:663:10)
at Module.load (module.js:565:32)
at tryModuleLoad (module.js:505:12)
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

It's often convenient to use a remote SQL database during local development, this way you and your team members can start working on the project right away without any setup steps (other than installing NPM modules via yarn install). For this to work, you would need to download SSL certificates:

Put them into ssl folder of your project:

And uncomment the following lines in the .env file:
https://github.com/kriasoft/react-firebase-starter/blob/b0429987356459c270dbf43ce7976873c2145f16/.env#L35-L38
I hope this helps!


后端启动失败

pip3 install -r requirements.txt
python version: Python 3.10.12
Collecting mysqlclient==2.2.0
  Using cached http://mirrors.cloud.aliyuncs.com/pypi/packages/de/9c/b176826e8994551ce826404dab97e305a4bb76c8b0a4e016fabda2901c71/mysqlclient-2.2.0.tar.gz (89 kB)
  Installing build dependencies ... done
  Getting requirements to build wheel ... error
  error: subprocess-exited-with-error

  × Getting requirements to build wheel did not run successfully.
  │ exit code: 1
  ╰─> [25 lines of output]
      Trying pkg-config --exists mysqlclient
      Command 'pkg-config --exists mysqlclient' returned non-zero exit status 1.
      Trying pkg-config --exists mariadb
      Command 'pkg-config --exists mariadb' returned non-zero exit status 1.
      Traceback (most recent call last):
        File "/usr/lib/python3/dist-packages/pip/_vendor/pep517/in_process/_in_process.py", line 363, in <module>
          main()
        File "/usr/lib/python3/dist-packages/pip/_vendor/pep517/in_process/_in_process.py", line 345, in main
          json_out['return_val'] = hook(**hook_input['kwargs'])
        File "/usr/lib/python3/dist-packages/pip/_vendor/pep517/in_process/_in_process.py", line 130, in get_requires_for_build_wheel
          return hook(config_settings)
        File "/usr/lib/python3/dist-packages/setuptools/build_meta.py", line 162, in get_requires_for_build_wheel
          return self._get_build_requires(
        File "/usr/lib/python3/dist-packages/setuptools/build_meta.py", line 143, in _get_build_requires
          self.run_setup()
        File "/usr/lib/python3/dist-packages/setuptools/build_meta.py", line 158, in run_setup
          exec(compile(code, __file__, 'exec'), locals())
        File "setup.py", line 154, in <module>
          ext_options = get_config_posix(get_options())
        File "setup.py", line 48, in get_config_posix
          pkg_name = find_package_name()
        File "setup.py", line 27, in find_package_name
          raise Exception(
      Exception: Can not find valid pkg-config name.
      Specify MYSQLCLIENT_CFLAGS and MYSQLCLIENT_LDFLAGS env vars manually
      [end of output]

  note: This error originates from a subprocess, and is likely not a problem with pip.
error: subprocess-exited-with-error

× Getting requirements to build wheel did not run successfully.
│ exit code: 1
╰─> See above for output.

note: This error originates from a subprocess, and is likely not a problem with pip.

The error "mysqlclientpypy install" usually indicates that you are trying to install the mysqlclient library for Python but are missing necessary dependencies.
To install mysqlclient on Debian/Ubuntu systems, use the following command:
sudo apt-get install python3-dev default-libmysqlclient-dev build-essential pkg-config
For other distributions like CentOS/RedHat, use:
sudo yum install python3-devel mysql-devel
Then, use pip to install mysqlclient:
pip3 install mysqlclient
Double-check the specific dependencies needed for your system and Python version.
another way you can delete mysqliclient in requirements.txt and put the mysqlclient==2.2.4

安装mysqlclient失败，以下是centos7的安装方法
1、检查mariadb
rpm -qa | grep mariadb
如果有rpm包则删除
rpm -e mariadb-devel-5.5.68-1.el7.x86_64
rpm -e mariadb-libs-5.5.68-1.el7.x86_64 --nodeps
2、检查mysql
rpm -aq | grep mysql
如果没有rpm从官网下载https://dev.mysql.com/downloads/mysql/，安装以下rpm，必须顺序执行
rpm -ivh mysql-community-common-8.0.39-1.el7.x86_64.rpm
rpm -ivh mysql-community-libs-8.0.39-1.el7.x86_64.rpm
rpm -ivh mysql-community-client-plugins-8.0.39-1.el7.x86_64.rpm
rpm -ivh mysql-community-libs-8.0.39-1.el7.x86_64.rpm
rpm -ivh mysql-community-devel-8.0.39-1.el7.x86_64.rpm

The error "mysqlclientpypy install" usually indicates that you are trying to install the mysqlclient library for Python but are missing necessary dependencies.
To install mysqlclient on Debian/Ubuntu systems, use the following command:
sudo apt-get install python3-dev default-libmysqlclient-dev build-essential pkg-config For other distributions like CentOS/RedHat, use:
sudo yum install python3-devel mysql-devel Then, use pip to install mysqlclient:
pip3 install mysqlclient Double-check the specific dependencies needed for your system and Python version.
another way you can delete mysqliclient in requirements.txt and put the mysqlclient==2.2.4

Cool I got it, by installing package with apt. Appreciate it~!


Test leveraging paas-billing viability

In order to support the work on #1692, We want to test deploying paas-billing. This endpoint may also support business operations in a standalone capacity as well.
Acceptance Criteria

[ ] Created a deployment pipeline
[ ] Deployed into our dev and staging environments
[ ] Updated the business logic to reflect our pricing model
[ ] Accessed via new cloud.gov subdomains

Security considerations

This will add another http endpoint to be maintained

@rcgottlieb can you drop an update here on how this is going when you're back?


Clarify step 4 of connector and application server in the same domain

The screenshot shows "Use any authentication protocol" but the text doesn't mention this option. Can you specify if "Use Kerberos Only" also works, and if that is more secure?

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: e139327a-53e0-d539-dc04-29bf07ad0333
Version Independent ID: a862ebf9-161e-30ef-aa7c-5b3302ec1399
Content: Single sign-on with Application Proxy
Content Source: articles/active-directory/manage-apps/application-proxy-configure-single-sign-on-with-kcd.md
Service: active-directory
GitHub Login: @CelesteDG
Microsoft Alias: celested

@cmcapellan Thanks for your feedback! We will investigate and update as appropriate.

@cmcapellan Thanks for the feedback !  I have assigned this issue to content author to investigate and update the document as appropriate.

@cmcapellan Thank you for pointing this out. Per the product team the Use Kerberos only option doesn't work in this scenario because there is a transition in auth type that occurs during the process. So, you must choose Use any authentication protocol. I'm updating the article to include this selection, which will publish shortly.


add public GPG key that can be used for signing

What this PR does / why we need it
add GPG key to verify signed and uploaded releases

I am not completely happy to put the key into the root-directory of the repository, because it look cluttered.
Can there be any other location? Would it make sense to place it somewhere else?

I am not completely happy to put the key into the root-directory of the repository, because it looks cluttered. Can there be any other location? Would it make sense to place it somewhere else?

sure, we can even think of putting it into the

I am not completely happy to put the key into the root-directory of the repository, because it looks cluttered. Can there be any other location? Would it make sense to place it somewhere else?

We have some 20+ files in the root dir, like Dockerfile, Makefile, central Markdown files, etc. So, does this one really lead to clutter? But for sure, technically we can place it anywhere and reference it.

Would it make sense to publish the public.key on the web-site?


tusb_config.h

Might be my build environment,
but I needed to make a copy of tusb_config.h into the  80col-mono directory before I could successfully build.
No problems, but it might help someone else.

Hi,
If you look here
https://github.com/RC2014Z80/picoterm/tree/main/80col-mono
the repository shows a link to tusb_config.h .
This as probably not be applied/restored on your target system.
Copying the file from ../common/tusb_config.h
Regards,
Dominique


[GOV-131]

This PR updates FAQ content introducing:

new clusters (cittadini, EC, PSP);
new content approved by legal, account and communication teams.

Questions part of the former "Sezione B" have been integrated either in PSP or EC sections.

@mccalv can you approve this when you'll be back from holidays? 🌴


Multiple entries for packaged applications

Microsoft PowerToys version
0.62.1
Running as admin

[X] Yes

Area(s) with issue?
PowerToys Run
Steps to reproduce
I am 100% certain I think it might be the packaged application update process creating the duplicates.
I currently have 5 entries for "phone link"

open Power Toys Run
type "Phone link"

In my case all the links are pointing to "Program Files\WindowsApps\Microsoft.YourPhone_1.22072.207.0_x64__8wekyb3d8bbwe"
✔ Expected Behavior
Only one Phone Link entry is found
❌ Actual Behavior
multiple Phone link apps are listed

Other Software
Phone Link 1.22072.207.0

Hi @shaneknysh
Can you open a PowerShell as administrator and run the following command?
Get-AppxPackage -AllUsers -Name Microsoft.YourPhone
How many packages do you have in the output list?
/needinfo

Only One
PS C:\Users\shane> Get-AppxPackage -AllUsers -Name Microsoft.YourPhone

RunspaceId             : 2f150866-c87b-4daa-90db-d4f2798b4424
Name                   : Microsoft.YourPhone
Publisher              : CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
PublisherId            : 8wekyb3d8bbwe
Architecture           : X64
ResourceId             :
Version                : 1.22072.207.0
PackageFamilyName      : Microsoft.YourPhone_8wekyb3d8bbwe
PackageFullName        : Microsoft.YourPhone_1.22072.207.0_x64__8wekyb3d8bbwe
InstallLocation        : C:\Program Files\WindowsApps\Microsoft.YourPhone_1.22072.207.0_x64__8wekyb3d8bbwe
IsFramework            : False
PackageUserInformation : {S-1-5-21-4027262021-1445668102-3236797468-500 [Administrator]: Staged,
                         S-1-5-21-4027262021-1445668102-3236797468-1006 [test26]: Staged,
                         S-1-5-21-4027262021-1445668102-3236797468-1001 [shane]: Installed}
IsResourcePackage      : False
IsBundle               : False
IsDevelopmentMode      : False
NonRemovable           : False
Dependencies           : {Microsoft.VCLibs.140.00_14.0.30704.0_x64__8wekyb3d8bbwe,
                         Microsoft.VCLibs.140.00.UWPDesktop_14.0.30704.0_x64__8wekyb3d8bbwe,
                         Microsoft.YourPhone_1.22072.207.0_neutral_split.scale-100_8wekyb3d8bbwe}
IsPartiallyStaged      : False
SignatureKind          : Store
Status                 : Ok

Interesting.. Are you able to reproduce it or was just a one time issue?

I can reproduce the error with Phone link all day long but I can't reproduce the conditions with any other app.
I had a similar issue with uninstalled apps showing up (lord of the rings online) quite some time ago and I could install an app, uninstall the app and have it appear in the list after uninstall. In this case I can't "fix" the problem then reproduce it at will.
After uninstalling phone link via geek uninstaller and deleting all leftover traces,  manually purging all entries from the registry, and reinstalling phone link - I am down to two entries in the list.

Are you still experiencing this issue? /needinfo