Delay pyopencl warning until used

When I try to open a folder that is not openable by napari-ndtiffs (it contains only zips, no tiffs), I nevertheless get the following warning:
WARNING:napari_ndtiffs.affine:Could not import pyopencl. Falling back to scipy for CPU affine transforms
At this particular juncture I did not really care about this and it was just annoying noise. 😄 Perhaps the warning can be postponed until an affine transform actually has to be performed?

finally got it done 😂

(it contains only zips, no tiffs)

oh actually... by the way, this package does read zips! :)

Awesome! I looooove way-old issues getting closed. 😂


[JSX] if else case in JSX

const View = ({number}) => {
  return (

    	{number > 1 &&

amazing

        || number > 2 &&

awesome

        ||

prettier

        }

  )
}

repo case: https://jlongster.github.io/prettier/#{"content"%3A"const View %3D ({number}) %3D> {\n  return (\n
\n    \t{number > 1 %26%26\n
amazing<%2Fdiv>\n        || number > 2 %26%26\n
awesome<%2Fdiv>\n        ||\n
prettier<%2Fdiv>\n        }\n    <%2Fdiv>\n  )\n}"%2C"options"%3A{"printWidth"%3A80%2C"tabWidth"%3A2%2C"singleQuote"%3Afalse%2C"trailingComma"%3Afalse%2C"bracketSpacing"%3Atrue}}

Related to #89

This now outputs
const View = ({ number }) => {
  return (

      {
        number > 1 &&
amazing
 ||
          number > 2 &&
awesome
 ||

prettier

      }

  );
};

which is what is intended. We may want to tweak the result but the bug is no longer there so closing :)


Add support for SGE batch systems

I've no idea how much work this would involve, but to bring alphatwirl out to more sites, support beyond HTCondor would be nice to be able to run components in parallel.  In particular, sun grid engine batch systems, although somewhat old-fashioned, are still common such as lxplus or on the Imperial College batch system.

This is straightforward to implement.
What needs to be done is to develop a dispatcher  for each batch system. Two dispatchers have been implemented so far: HTCondorJobSubmitter and SubprocessRunner. Both are in concurrently. A dispatcher needs to be given to TaskPackageDropbox at the initialization.

See #23

this is realized as a separate package atsge.


Playlist: Upcoming videos

Upcoming videos per player device required.

WIP. Some bugs remaln.

Bugs fixed, looks good.


Generate codecov reports by domain

What should we add?
We should have 4 separate codecov reports instead of 1. 1 report each for SDK unit tests, dispatcher unit tests, UI unit tests, and functional tests. This task should also include cleaning up the tests folder structure, like for example electron_return_value_test.py should not be in the root of tests. The tests workflow will have to be enhanced to upload different reports for the different domains. Consider using the paths-filter action to check for paths to test as is done elsewhere in our CI.
Describe alternatives you've considered.
No response

We may want to report "core" coverage vs "beta" coverage. Feature flags are probably the way to do that.

We may want to report "core" coverage vs "beta" coverage. Feature flags are probably the way to do that.

@scottwn  please could you provide a bit more context on what components of Covalent be flagged as core and beta when generating the coverage reports.

I think the "core" vs "beta" is out of scope for now until we implement feature flags. The breakdown should follow the original issue description.

I think the "core" vs "beta" is out of scope for now until we implement feature flags. The breakdown should follow the original issue description.

Okay, thanks!


migrate to typescript/work in windows env/add missing translations

If you are interested in this I'm happy to make any required changes

I don't have a react admin setup, are you guys sure about these changes? @MohammedFaragallah  @ahmadi-akbar

positive @developerium I'm using these changes in production

Could you resolve this conflict on index.js file? @MohammedFaragallah

index.js should not be edited any more typescript build it automatically from index.ts

index.js should not be edited any more typescript build it automatically from index.ts

hello, you add new translation to  "index.ts" file but  we have warning again,
i think we must edit
main file in package.json to "main": "src/index.js"
or add translations to "lib/index.js"
PS
warnings :

ra-language-arabic package.json:

@ahmadi-akbar sorry about that I'll submit a fix soon

Hey guys, this PR indicates that there is a conflict on index.js if you could resolve this (as I don't have a working react-admin setup and I trust you guys 😄 ), I'm happy to merge this PR
@MohammedFaragallah @ahmadi-akbar

@developerium all should be good now

Thanks @MohammedFaragallah @ahmadi-akbar


How to create a new components as marker in BillboardCollection

the marker — Billboard component is only can display by passing image props for now.
I want to create my style's React component as marker and nest in BillboardCollection to load datas. How to do that ?

I recommend using Entity and BillboardGraphics component. Billboard and BillboardCollection is not for general use but for low layer.


Trying to enable TypeScript strict null checks

I fixed all our code to work with strict null checks
(might have caught one or two unproblematic bugs),
but I don't know how to configure it such that only
our code, and not imported modules, are compiled
with strict null checks.  At least one module doesn't
compile.

@dvdsgl If you know how to enable strict null checks just for our code, that would be really nice.

I enabled strictNullChecks in cli/tsconfig.json and was able to build without error. How did you build with errors?

I don't know, I'll try again ;-)

Yeah, weird, works for me, too.

@dvdsgl Shall we merge this?


Send D2C Message Errors

Version: 2.17.1
VSCode Version: 1.95.3
Description:
Using 'Send D2C Messages' screen to a device. When click send everything in the 'Send D2C Message' is non-functional. Clicking 'Cancel' does nothing'

Extension Host Stacktrace:
2024-11-20 11:29:21.900 [error] TypeError: Cannot read properties of undefined (reading 'length')
	at Simulator.<anonymous> (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4598380)
	at Generator.next (<anonymous>)
	at c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4595735
	at new Promise (<anonymous>)
	at __awaiter (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4595283)
	at Simulator.telemetry (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4597851)
	at LocalServer.<anonymous> (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4609898)
	at Generator.next (<anonymous>)
	at c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4606335
	at new Promise (<anonymous>)
	at __awaiter (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4605883)
	at LocalServer.telemetry (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4609783)
	at LocalServer.<anonymous> (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4608558)
	at Generator.next (<anonymous>)
	at c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4606335
	at new Promise (<anonymous>)
	at __awaiter (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4605883)
	at c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4608498
	at Layer.handle [as handle_request] (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3062871)
	at next (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3064753)
	at Route.dispatch (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3064782)
	at Layer.handle [as handle_request] (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3062871)
	at c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3058432
	at Function.process_params (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3059888)
	at next (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3058331)
	at Function.handle (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3059736)
	at router (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3055032)
	at Layer.handle [as handle_request] (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3062871)
	at trim_prefix (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3059122)
	at c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3059151
	at Function.process_params (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3059888)
	at next (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3058331)
	at urlencodedParser (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2833396)
	at Layer.handle [as handle_request] (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3062871)
	at trim_prefix (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3059122)
	at c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3059151
	at Function.process_params (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3059888)
	at next (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3058331)
	at c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2826067
	at AsyncResource.runInAsyncScope (node:async_hooks:206:9)
	at invokeCallback (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4035139)
	at done (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4035168)
	at IncomingMessage.onEnd (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4035796)
	at IncomingMessage.emit (node:events:519:28)
	at endReadableNT (node:internal/streams/readable:1696:12)
	at process.processTicksAndRejections (node:internal/process/task_queues:82:21)
2024-11-20 11:29:21.915 [error] ReferenceError: Invalid transport configuration
        at MqttBase.connect (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2535580)
	at c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2407579
	at c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2421764
	at c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2494747
	at getAgentPlatformString (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2393001)
	at c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2494728
	at noErrorCallbackToPromise (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2383115)
	at getUserAgentString (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2494669)
	at Mqtt._ensureAgentString (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2421715)
	at c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2407486
	at c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2495304
	at callbackToPromise (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2382006)
	at X509AuthenticationProvider.getDeviceCredentials (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2495290)
	at constructor._onEnter (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2407339)
	at constructor.transition (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3783954)
	at _.each.Fsm.<computed> [as transition] (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3779292)
	at constructor.connect (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2405692)
	at constructor.handle (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3782662)
	at _.each.Fsm.<computed> [as handle] (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3779292)
	at constructor.sendEvent (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2405789)
	at constructor.handle (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3782662)
	at _.each.Fsm.<computed> [as handle] (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:3779292)
	at Mqtt.sendEvent (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2411713)
	at c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2466663
	at retryOperation (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2387473)
	at RetryOperation.retry (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2388511)
	at c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2466627
	at callbackToPromise (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2382006)
	at Client.sendEvent (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:2466518)
	at Simulator.<anonymous> (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4603099)
	at Generator.next (<anonymous>)
	at c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4595735
	at new Promise (<anonymous>)
	at __awaiter (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4595283)
	at Simulator.sendD2CMessageCore (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4602807)
	at c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4604453
	at Array.map (<anonymous>)
	at Simulator.<anonymous> (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4604359)
	at Generator.next (<anonymous>)
	at fulfilled (c:\Users\foo\.vscode\extensions\vsciot-vscode.azure-iot-toolkit-2.17.1\dist\extension.js:2:4595374)
	at process.processTicksAndRejections (node:internal/process/task_queues:95:5)

Send D2C Messages Ouput:
[11:29:20 AM] Start sending messages from 1 device(s) to IoT Hub.
[11:29:29 AM] All device(s) finished sending in 9.095 second(s).
[11:35:45 AM] 0 succeeded, and 0 failed.

Closing as raised in wrong place. See microsoft/vscode-azure-iot-toolkit#577


Update upgrade-cockroach-version.md

the space in the two paths breaks this tutorial

This change is

http://cockroach-docs-review.s3-website-us-east-1.amazonaws.com/d7f5898b0c0ea9f15f69a1e5816302d11db85d1e/

http://cockroach-docs-review.s3-website-us-east-1.amazonaws.com/d7f5898b0c0ea9f15f69a1e5816302d11db85d1e/

 will merge when green

Review status: 0 of 1 files reviewed at latest revision, all discussions resolved, some commit checks pending.

Comments from Reviewable

Also, thank you!

Review status: 0 of 1 files reviewed at latest revision, all discussions resolved, some commit checks pending.

Comments from Reviewable


Typo correction in setRequestConfiguration of Docs

Hello! I'm using your library well. I'm sending you a full request because I found a typo while using it.
maxAdContetRating -> maxAdContentRating

Hi, many things in docs have changed so we can not merge this commit. But thank you for your work. 감사합니다


Vorkath flash notifier

As with the combat notifiers, the client would flash red when Vorkath is about to do his special attacks (Zombie spawn, acid pool and fire ball), to increase AFK time for people using Vorkath accounts as alt accounts. Currently the best way of doing this is to turn on volume to listen to the attacks, which can be inconvenient at times, so a flash notifier would definitely be ideal.

Basically duplicate of #2447


fix linting warnings

fix react-hooks/exhaustive-deps warnings

/retest

/retest

/retest

/retest

Is it just me or does the page not render with the changes? Trying on stage-beta and all I'm getting is a spinner.

Is it just me or does the page not render with the changes? Trying on stage-beta and all I'm getting is a spinner.

I haven't tried on my local machine, I was trusting the tests, but if that's broken they should even not pass right?
If it's broken it might be because of the first useEffect that got removed. And it might cause a forever loop.

Is it just me or does the page not render with the changes? Trying on stage-beta and all I'm getting is a spinner.

Is it just me or does the page not render with the changes? Trying on stage-beta and all I'm getting is a spinner.

I haven't tried on my local machine, I was trusting the tests, but if that's broken they should even not pass right? If it's broken it might be because of the first useEffect that got removed. And it might cause a forever loop.

its very strange that all tests pass :(
I fixed that and return the useEffect to app.js

Agree, that the tests shouldn't pass in this case, although not super sure why it happened. Some of the re-rendering got the tests stuck in the past. Not sure if this looked like a clean run in the tests are the new run rewrote the logs.
@mgold1234 Another bug I've noticed - when you add some packages on the RH packages step and continue to the custom packages step, the added packages will disappear from the added. Can you check if it works the same for you?

I tried the scenario and see the same beavior at stage.
or maybe I didnt understand the exact problem @regexowl
Uploading Screen Recording 2024-01-08 at 13.06.05.mov…

I tried the scenario and see the same beavior at stage. or maybe I didnt understand the exact problem @regexowl

Ha, it seems the reproduction is a bit more complicated.
So the steps to reproduce the bug would be:

get to the OSCAP step
choose an OSCAP profile
get to the packages step
add any package
go to the Repositories step
add any custom Repository
go to the custom packages step
compare the list of selected packages with the list on packages step

What I see is that the packages I've added in the first packages step disappeared in the second packages step. I've tried on stage-beta main and the list of packages persisted.

@regexowl , I think its not related to that pr ,
I see the same problem if I do that:
get to the OSCAP step
choose an OSCAP profile
get to the packages step
add any package
go to the Repositories step
press Next
press back
press back
press Next
-> the added packages disappear

@lavocatt Hey hey, is it okay if I dismiss your "change requested" review?  Alternatively can you approve? :)

Yeah sure. Sorry I wasn't meaning to block the PR I thought your approval would suffice for the merge. I'm approving rn.

Yeah sure. Sorry I wasn't meaning to block the PR I thought your approval would suffice for the merge. I'm approving rn.

No worries, I also though one approval should be enough :sweat_smile:


no such an option in gmail set up

[Enter feedback here]
On this step there is not "alternative set up " as an option.
On the Google page on your computer, go to the Set up alternative second step section, choose Set up from the Authenticator app section.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 49de26c3-95f4-2004-8e63-0076c41ddfb3
Version Independent ID: c304f504-3e8a-591d-6d34-8f2a3277094f
Content: Add non-Microsoft accounts to the Microsoft Authenticator app - Azure AD
Content Source: articles/active-directory/user-help/user-help-auth-app-add-non-ms-account.md
Service: active-directory
Sub-service: user-help
GitHub Login: @curtand
Microsoft Alias: curtand

@szcc
Thanks for your feedback! We will investigate and update as appropriate.

@szcc You are correct.  It looks like the steps have updated slightly:

Go to your Google account security settings: https://myaccount.google.com/security
Under Signing in to Google, click on 2-Step Verification (which should be set to on at this point)
Under Authenticator app, click on Set Up
Continue on Step 2 from the documentation (Get codes from the Authenticator app, then scan the QR code, etc.)

Thank you for bringing this to our attention!  We'll get this updated shortly.
Additional Information:
Google - Protect your account with 2-Step Verification: https://support.google.com/accounts/answer/185839?hl=en

@szcc I've updated the documentation and the change should be live soon.  Thank you again for helping to improve our documentation!
We are going to close this thread as resolved but if there are any further questions regarding the documentation, please tag me in your reply and we will be happy to continue the conversation.


onImageLoaded interface: Clarify return-behavior

This increases the discoverability of the special return behavior by onImageLoaded when following the Type definitions in eg. VSCode.
Other places that document this behavior are

The docs https://github.com/DominicTobias/react-image-crop#onimageloadedimage-optional
A code comment at https://github.com/DominicTobias/react-image-crop/blob/e9bb673a27be89daf150dc03d7cf970d8837b4dd/src/ReactCrop.tsx#L649-L650

Thanks 👍


Make XmlCursor AutoCloseable

This changes contain multiple commits, maybe some of them could be discarded.
Only the first one is important, the other ones are to remove the usage of the new deprecated method and use try-with resources where appropriate.
The other two WIP titled commits are to ask for advice, it have comments about how the API isn't good for an AutoCloseable XmlCursor and noticing that XmlError embedded cursors are never disposed. I avoided closing the cursors that are being added to a XmlError, but I think maybe the best solution is for XmlError to do defensive copies of the cursor and then the code that creates errors must close its cursors.
Thanks to this interface changes, some of the runtime code (the tests contains the majority of the changes) now properly closes some cursors that were being leaked.
The last patch includes simple formatting changes made by the editor while changing these files, only removing end on line spaces because the editor always do it and a unused method removal.  A separate commit just in case they aren't wanted.
Closes XMLBEANS-582

@robmv thanks - this is now merged


Chrome database size continually increases

If you go to chrome://settings/cookies, you can find the file size of the Indexed databases.
I'm developing an app using localForage, and noticed that the size had gone up to nearly 20mb, though localForage was only holding a json object of about 25k.
I set up a simple test app that runs localforage.clear(), and then runs localforage.setItem() 1000 times.  (you can see the script here: http://www.codeshare.io/bvyng)
Every time I refresh the page, the file size of the database increases by approximately 95k.
I think this may actually be a problem with Chrome, because even when I clear the database through the resources tab of developer tools, the size of the database remains the same, but I thought I would report it here to see if anyone had any insights.

I'm seeing this too.

I have the exact same problem, I am saving data on IndexedDB through Redux Persist and localforage, after all data is saved I have a storage size of ~1.4Mb. If I trigger the redux actions again the storage size will keep on increasing even though the values inside indexedDB don't change (triple checked with a JSON diff). Every few MBs or so Chrome will clear some of that space but I never get back to that initial 1.4Mb of storage.
Any idea what might be causing this and how to fix?
Thanks

Chromium's implementation of IndexedDB will compact storage after a write of ~4Mb.
https://stackoverflow.com/questions/15841828/why-does-empty-indexeddb-still-take-up-space
I found this Chromium commit that says a compaction can be forced by deleting a database.
https://codereview.chromium.org/100013003
I wrote a small hack with Dexie.js to create and delete a database to force a compaction, but it doesn't work consistently.
async function forceDbCompaction () {
    const db = new Dexie('tempDb')
    db.version(1).stores({ test: 'id' })
    await db.test.add({ id: 'temp' })
    return db.delete()
}

Looking through this it doesn't seem like localForage is at fault here, and given this isn't reproducible on other browsers it seems like a Chrome bug. Has anyone submitted this/searched for it in the Chromium bug tracker? It would be awesome if someone with a test case to present to them could file it 😄


[master] Upgrade to latest dependencies

Produced via:
./hack/update-deps.sh --upgrade
./hack/update-codegen.sh

/cc knative-automation/channel-wg-leads
/assign knative-automation/channel-wg-leads

/assign @vaikas @n3wscott
Apparently I cannot approve...


Increasing memory usage when trying to reindex an index

I have an index with 26mio rows which I try to reindex. However memory usage of the reindex-script grows constantly, it is already at 4g when reporting 19% reindexing done. Is this expected, it seems a lot of memory for a simple copy-operation which should be done in a streaming fashion, right?
Also there are no documents arriving in index-2 yet, would it only start writing data at th end?
$ elasticsearch-reindex -f http://localhost:9200/index-1/type -t http://localhost:9200/index-2/type -c 3 -b 10000 -q 1000 -s 10m -o 600000
Starting reindex in 1 shards.
 reindexing [======------------------------] 5016000/26000000(19%) 4028.4 16852.6s - 1/1 working

 1119 ec2-user  20   0 4833m 4.1g 9904 R 99.8 13.8  68:04.02 /usr/bin/node /usr/bin/elasticsearch-reindex
2

No, I think this is a bug. It seems the target index cannot be wrote, you can checkout ./reindex.log, It should tell you what's wrong with that.


[Enhancement]: use official kafka image

Module
Kafka
Proposal
From 3.7.0 version of kafka official image is being released which can be found at https://hub.docker.com/r/apache/kafka , Can we start supporting instead of using confluent.
I tried to use official image using .asCompitableSubstitue of confluent image but it is will not working.

Thanks for raising the issue! I would like to know if Kraft mode would be enough for you or are you expecting zookeeper support?

Hi @eddumelendez , as they started official image only from 3.7.0 where zookeeper is deprecated. I think only kraft mode is enough.

Any updates on this? Our team would benefit from it. Thanks!

Hi @eddumelendez , from which version this is available to use ?

Hi, Testcontainers 1.19.8 contains org.testcontainers.kafka.KafkaContainer

It's a new implementation and spring boot doesn't support it yet. There is a open PR https://github.com/spring-projects/spring-boot/issues/40695

Thank you for the swift response @eddumelendez


List of figures/tables: number+figure+figure_name overcrowding

Hello,
I have perfectly looking TOC for chapters and roman pages. But the List of figures plus List of Tables are mangled: I got figure_number followed by word : figure (or rather figura, since the thesis main language is Spanish). The later one is being obscured by the figure_name. It makes these two parts unreadable.
Best solution: no figura/figure or table in the list
Acceptable: fig 1.2 Title of fig 1.2
All three (Table of contents, List of figures and List of Tables) are Lyx commands with TOC being the first.
Thanks a lot for your help
Darek Kedra

Could you upload a snapshot? Are you using packages like babel?

Thank you for such a prompt answer. Yes, I got Babel.
My feeling was that this may be something external (like updated version of texlive 2015 packages: the error producing box has the latest updates). No real emergency, but if it something obvious it will be good to fix it. I will test more older versions of my Lyx doc (+PhDThesisLyX.cls). And get some minimal trouble making examples.
Best,
Darek Kedra

Well, it did fix "itself" after today's upgrade of texlive packages.


change weights during training

Hi,
I train a model and save it to ckpt file.
The next think i want do to is to load the model and change some of his weights. I read the TF API and didn't find any way to do that. Am i missing something? Is there a way to change the weights during training?
thank a lot!

How do you want to change the weights?

Every weight < threshold
Assign weight = const

http://stackoverflow.com/questions/34220532/how-to-assign-value-to-a-tensorflow-variable

You can do something like:
v = tf.Variable(1.0)
c = tf.constant(2.0)
c2 =  tf.cond(v < c, lambda: tf.constant(3.0), lambda: tf.constant(4.0))
v2 = tf.assign(v, c2)
with tf.Session() as sess:
sess.run(tf.initialize_all_variables())
print sess.run(v2)

thanks

Is there a way to change some variable into "untrainable" while training?


Don't set log4j.configurationFile if it is a param

For maven jmeter-graph-plugin, the log4j2.xml is not find, so use log4j.configurationFile parameter and don't set it.

Can you fix the source version in maven at once?

Also, make the #8 change in this PR, for simplicity

sorry i'm not a pull request "master" and i just put 2 files in the pull request #7 not the #8

Hi,
Could you publish version 2.3 for this library cmdrunner in the maven central repository ?
Now in the repo : https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/
Because i need this version for the new maven plugin : jmeter-graph-tool-maven-plugin (not yet release because i need the version 2.3 cmdrunner)
io.github.vdaburon
jmeter-graph-tool-maven-plugin
1.0
maven-plugin
JMeter Graph and Tool Maven Plugin
A maven plugin to include features from jmeter-plugins.org for JMeterPluginsCMD Command Line Tool to create graphs, export csv files from jmeter result files and Filter Result tool.

Hi,
I have released cmdrunner to Maven.


Samn/add rbac

First cut of the RBAC pages
Should be ready for merging after this review
Feedback on all things welcome

Quick loom: https://www.loom.com/share/d28228d0321c41549a6381668e1bcb1e?from_recorder=1&focus_title=1

https://app.shortcut.com/larder/story/20418/write-marketing-copy-for-the-website-to-advertise-rbac


Input action references are ill-defined

Input actions are created by adding an entry to the table of input actions in the input actions profile. On creation, they get their ID set to their index in the table. When a user sets an input action in a script property, e.g. the pose action in a pointer, the ID gets serialized with it. This is problematic because:

Removing and adding entries in the actions table may yield actions with the same ID
Assuming that IDs are unique within an input actions profile, they don't uniquely identify actions across profiles. As we don't serialize a reference to the profile with the ID, when loading it you don't really know which action it originally referred to.

My preferred solution for this is to make actions assets (scriptable objects), so they can referred to from any scene in a well defined manner.

I'd say this is a proposal not a bug.
We ended up with ids for performance, but I agree the scriptable object workflow sounds much more favorable.

My intent here was to describe why the current ID based system is broken. In a nutshell, action IDs don't uniquely identify actions.

It's not broken 😆 That's an opinion, and while I agree with you, is very rude and has negative connotations.
A better way to have opened this issue:
The Input Actions are currently setup as a struct with all the associated data.
To enable easier swap-ability, editing, and customization, it might be more beneficial to update these to be ScriptableObjects as well.
Requirements

[ ] Minimal changes to profile creation workflow
[ ] No noticeable performance differences between struct vs scriptable object
[ ] InputActions can be assigned by object reference, or guid.
[ ] Minimal code changes
[ ] Provide a way to convert already established /created InputAction profiles with structs to updated scriptable object references

Acceptance Criteria

[ ] Users can create new Input Actions via profile inspector
[ ] Users can assign Input Actions in Input Handler components
[ ] Devs can utilize Input Actions in code to validate input actions from event data


Kong 2.3.2 enabling and disabling of the cert generations for various Kong components?

Summary
Seems there is notes and impl that will allow turning kong logic on/off for generating client tls cert and key if wanted for proxy server block, but seems the admin block isn't fully implemented?
https://github.com/Kong/kong/blob/2.3.2/kong.conf.default#L559
And https://docs.konghq.com/gateway-oss/2.3.x/configuration/#client_ssl
Yet In the template we have:
https://github.com/Kong/kong/blob/2.3.2/kong/templates/nginx_kong.lua#L343
admin_ssl_enabled which doesn't take effect as KONG_ADMIN_SSL_ENABLED off to try and prevent admin cert generation.
I want to do so because I don't want Kong trying to make admin server block certs in my filesystem. Causes my migrations/startup to fail due to permissions issues.

2021/03/02 18:33:21 [warn] unable to pre-create '
--
  | Error:
  | ...luarocks/share/lua/5.1/kong/cmd/utils/prefix_handler.lua:156: /usr/local/kong/ssl/admin-kong-default.key: Read-only file system
  | stack traceback:
  | [C]: in function 'assert'
  | ...luarocks/share/lua/5.1/kong/cmd/utils/prefix_handler.lua:156: in function 'gen_default_ssl_cert'
  | ...luarocks/share/lua/5.1/kong/cmd/utils/prefix_handler.lua:389: in function 'prepare_prefix'
  | ...ocal/kong/luarocks/share/lua/5.1/kong/cmd/migrations.lua:96: in function 'cmd_exec'
  | /usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88: in function </usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88>
  | [C]: in function 'xpcall'
  | /usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88: in function </usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:45>
  | /usr/bin/kong:9: in function 'file_gen'
  | init_worker_by_lua:48: in function <init_worker_by_lua:46>
  | [C]: in function 'xpcall'
  | init_worker_by_lua:55: in function <init_worker_by_lua:53>
  | 2021/03/02 18:33:21 [debug] upstream_keepalive_max_requests = 100
  | 2021/03/02 18:33:21 [debug] upstream_keepalive_pool_size = 60
  | 2021/03/02 18:33:21 [debug] waf = "off"
  | 2021/03/02 18:33:21 [debug] waf_audit = "RelevantOnly"
  | 2021/03/02 18:33:21 [debug] waf_debug_level = "0"
  | 2021/03/02 18:33:21 [debug] waf_mode = "On"
  | 2021/03/02 18:33:21 [debug] waf_paranoia_level = "1"
  | 2021/03/02 18:33:21 [debug] waf_pcre_match_limit = "10000"
  | 2021/03/02 18:33:21 [debug] waf_pcre_match_limit_recursion = "10000"
  | 2021/03/02 18:33:21 [debug] waf_request_file_size_limit = "50000000"
  | 2021/03/02 18:33:21 [debug] waf_request_no_file_size_limit = "50000000"
  | 2021/03/02 18:33:21 [debug] worker_consistency = "strict"
  | 2021/03/02 18:33:21 [debug] worker_state_update_frequency = 5
  | 2021/03/02 18:33:21 [verbose] prefix in use: /usr/local/kong
  | 2021/03/02 18:33:21 [verbose] preparing nginx prefix directory at /usr/local/kong
  | 2021/03/02 18:33:21 [verbose] SSL enabled on
  | 2021/03/02 18:33:21 [verbose] generating /usr/local/kong/ssl/admin-kong-default.crt SSL certificate (

Tried adding a
admin_ssl_enabled = off

to kong/templates/kong_defaults.lua file
But that didn't seem to help either to get it to stop the cert generation(although log output did start recognizing my KONG_ADMIN_SSL_ENABLED env variable set to off in output once I added the variable to the kong_defaults.lua file). Whereas setting KONG_CLIENT_SSL to off will stop the proxy server block side of things from generating those client certs.
The admin ssl enabling/disabling feature should probably also show up in the conf here too:
https://github.com/Kong/kong/blob/2.3.2/kong.conf.default#L576 and in the konghq docs.
Additional Details & Logs

Kong version 2.3.2

Also had the idea of setting the admin listener in this container I am testing it in to not have SSL as another workaround:
- name: KONG_ADMIN_LISTEN
value: '<IP_ADDRESS>:8001 deferred reuseport'

Ooo... making a little progress by doing the above ^ , now getting stuck on it making some random pem file:
Error:
--
  | ...luarocks/share/lua/5.1/kong/cmd/utils/prefix_handler.lua:74: /usr/local/kong/ssl/ffdhe2048.pem: Read-only file system
  | stack traceback:
  | [C]: in function 'assert'
  | ...luarocks/share/lua/5.1/kong/cmd/utils/prefix_handler.lua:74: in function 'gen_default_dhparams'
  | ...luarocks/share/lua/5.1/kong/cmd/utils/prefix_handler.lua:431: in function 'prepare_prefix'
  | ...ocal/kong/luarocks/share/lua/5.1/kong/cmd/migrations.lua:96: in function 'cmd_exec'
  | /usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88: in function </usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88>
  | [C]: in function 'xpcall'
  | /usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88: in function </usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:45>
  | /usr/bin/kong:9: in function 'file_gen'
  | init_worker_by_lua:48: in function <init_worker_by_lua:46>
  | [C]: in function 'xpcall'
  | init_worker_by_lua:55: in function <init_worker_by_lua:53>
  | 2021/03/03 07:55:43 [debug] waf_request_file_size_limit = "50000000"
  | 2021/03/03 07:55:43 [debug] waf_request_no_file_size_limit = "50000000"
  | 2021/03/03 07:55:43 [debug] worker_consistency = "strict"
  | 2021/03/03 07:55:43 [debug] worker_state_update_frequency = 5
  | 2021/03/03 07:55:43 [verbose] prefix in use: /usr/local/kong
  | 2021/03/03 07:55:43 [verbose] preparing nginx prefix directory at /usr/local/kong
  | 2021/03/03 07:55:43 [verbose] generating trusted certs combined file in
  | 2021/03/03 07:55:43 [verbose] generating ffdhe2048 DH parameters

Kong stahp making random certs I don't need em and mount my own via openshift secrets and volume mounts 😆 ...

Hi @jeremyjpj0916, thanks for the detailed report!
Some notes after a quick first look.

If you specify at least one listener with the ssl flag and do not specify a cert / key, Kong will try to generate a default for you. One option (but not ideal, depending on your setup) is to disable SSL. A better option is to pre-generate the cert/key pair and specify the path to them with admin_ssl_cert and admin_ssl_cert_key.

As for the dhparams file, what do you have in ssl_cipher_suite? modern  chipher suites do not need it. See details here: https://github.com/Kong/kong/pull/6470.

admin_ssl_enabled is our internal variable that is calculated from listen flags. The dhparams with intermediate are forced to ffdhe2048, so it will be generated. Switch to either modern or custom or old. Old in general needs 1024 bits params, and there are no predefined ones in any RFCs for that that's why user needs to generate it on their own. Generating one takes too much time, and that is the reason why we don't do it on startup. On modern we explicitly set it to nil even when user tries to configure it, because that is not needed.

@gszr Howdy!
Yeah to fix 1 simply not including ssl was fine, I only use a localhost admin API loopback exposed through a Kong proxy thats already TLS protected, no need to duplicate it w the ADMIN API as well. So that worked for me.
As for 2. Yeah we run KONG_SSL_CIPHER_SUITE = intermediate for better coverage but not totally going modern to risk breaking some of the more legacy apps internally here.
@bungle yeah I was thinking I could just include it in my volume mount going forward to stop Kong trying to auto gen it. Its just this guy right? https://github.com/internetstandards/dhe_groups/blob/master/ffdhe2048.pem ? Will try dropping that in my volume mount now to see how it goes. So if the file is present in my ssl directory then Kong can ignore making/rewriting it.
I just don't remember running into any cert file writing permissions(admin/client proxy/dhparams cert) issues before on 2.1.4 vs these newer kong versions and didn't see too much in the change logs towards it so was wondering what changed or has Kong always had this cert gen behavior... Seems newer.
Regardless will give that a go and keep trying to get my dev upgraded from 2.1.4 to 2.3.2!

AWW YEEE, that worked! Back in business. still saw some oddities with C* migration as per tradition...
2021/03/05 06:19:21 [verbose] Kong: 2.3.2
--
  | 2021/03/05 06:19:21 [debug] ngx_lua: 10017
  | 2021/03/05 06:19:21 [debug] nginx: 1017008
  | 2021/03/05 06:19:21 [debug] Lua: LuaJIT 2.1.0-beta3
  | 2021/03/05 06:19:21 [verbose] no config file found at /etc/kong/kong.conf
  | 2021/03/05 06:19:21 [verbose] no config file found at /etc/kong.conf
  | 2021/03/05 06:19:21 [verbose] no config file, skip loading
  | 2021/03/05 06:19:21 [debug] reading environment variables
  | 2021/03/05 06:19:21 [debug] KONG_ADMIN_LISTEN ENV found with "<IP_ADDRESS>:8001 deferred reuseport"
  | 2021/03/05 06:19:21 [debug] KONG_CASSANDRA_USERNAME ENV found with "*****"
  | 2021/03/05 06:19:21 [debug] KONG_CASSANDRA_PASSWORD ENV found with "******"
  | 2021/03/05 06:19:21 [debug] KONG_PROXY_LISTEN ENV found with "<IP_ADDRESS>:8000, <IP_ADDRESS>:8443 ssl http2 deferred reuseport"
  | 2021/03/05 06:19:21 [debug] KONG_WAF_PARANOIA_LEVEL ENV found with "1"
  | 2021/03/05 06:19:21 [debug] KONG_CASSANDRA_CONTACT_POINTS ENV found with "apsrs8171"
  | 2021/03/05 06:19:21 [debug] KONG_CASSANDRA_LOCAL_DATACENTER ENV found with "CTC"
  | 2021/03/05 06:19:21 [debug] KONG_WAF_REQUEST_NO_FILE_SIZE_LIMIT ENV found with "50000000"
  | 2021/03/05 06:19:21 [debug] KONG_WAF_PCRE_MATCH_LIMIT_RECURSION ENV found with "10000"
  | 2021/03/05 06:19:21 [debug] KONG_CASSANDRA_SCHEMA_CONSENSUS_TIMEOUT ENV found with "120000"
  | 2021/03/05 06:19:21 [debug] KONG_CASSANDRA_TIMEOUT ENV found with "20000"
  | 2021/03/05 06:19:21 [debug] KONG_CASSANDRA_REPL_FACTOR ENV found with "3"
  | 2021/03/05 06:19:21 [debug] KONG_CASSANDRA_KEYSPACE ENV found with "kong_dev"
  | 2021/03/05 06:19:21 [debug] KONG_WAF_REQUEST_FILE_SIZE_LIMIT ENV found with "50000000"
  | 2021/03/05 06:19:21 [debug] KONG_CLIENT_SSL ENV found with "off"
  | 2021/03/05 06:19:21 [debug] KONG_WAF_AUDIT ENV found with "RelevantOnly"
  | 2021/03/05 06:19:21 [debug] KONG_CASSANDRA_DATA_CENTERS ENV found with "ELR:3,CTC:3"
  | 2021/03/05 06:19:21 [debug] KONG_DATABASE ENV found with "cassandra"
  | 2021/03/05 06:19:21 [debug] KONG_CASSANDRA_PORT ENV found with "9042"
  | 2021/03/05 06:19:21 [debug] KONG_CASSANDRA_LB_POLICY ENV found with "RequestDCAwareRoundRobin"
  | 2021/03/05 06:19:21 [debug] KONG_NGINX_DAEMON ENV found with "off"
  | 2021/03/05 06:19:21 [debug] KONG_PLUGINS ENV found with "kong-siteminder-auth,kong-kafka-log,stargate-waf-error-log,mtls,stargate-oidc-token-revoke,kong-tx-debugger,kong-plugin-oauth,zipkin,kong-error-log,kong-oidc-implicit-token,kong-response-size-limiting,request-transformer,kong-service-virtualization,kong-cluster-drain,kong-upstream-jwt,kong-splunk-log,kong-spec-expose,kong-path-based-routing,kong-oidc-multi-idp,correlation-id,oauth2,statsd,jwt,rate-limiting,acl,request-size-limiting,request-termination,cors"
  | 2021/03/05 06:19:21 [debug] KONG_CASSANDRA_SSL_VERIFY ENV found with "on"
  | 2021/03/05 06:19:21 [debug] KONG_CASSANDRA_CONSISTENCY ENV found with "LOCAL_QUORUM"
  | 2021/03/05 06:19:21 [debug] KONG_CASSANDRA_REPL_STRATEGY ENV found with "NetworkTopologyStrategy"
  | 2021/03/05 06:19:21 [debug] KONG_WAF_PCRE_MATCH_LIMIT ENV found with "10000"
  | 2021/03/05 06:19:21 [debug] KONG_SSL_CERT ENV found with "/usr/local/kong/ssl/kongcert.crt"
  | 2021/03/05 06:19:21 [debug] KONG_SSL_CERT_KEY ENV found with "/usr/local/kong/ssl/kongprivatekey.key"
  | 2021/03/05 06:19:21 [debug] KONG_ANONYMOUS_REPORTS ENV found with "off"
  | 2021/03/05 06:19:21 [debug] KONG_CASSANDRA_SSL ENV found with "on"
  | 2021/03/05 06:19:21 [debug] KONG_WAF_DEBUG_LEVEL ENV found with "0"
  | 2021/03/05 06:19:21 [debug] KONG_WAF_MODE ENV found with "On"
  | 2021/03/05 06:19:21 [debug] KONG_WAF ENV found with "off"
  | 2021/03/05 06:19:21 [debug] KONG_LUA_SSL_VERIFY_DEPTH ENV found with "3"
  | 2021/03/05 06:19:21 [debug] KONG_LUA_SSL_TRUSTED_CERTIFICATE ENV found with "/usr/local/kong/ssl/kongcert.pem"
  | 2021/03/05 06:19:21 [debug] admin_access_log = "logs/admin_access.log"
  | 2021/03/05 06:19:21 [debug] admin_error_log = "logs/error.log"
  | 2021/03/05 06:19:21 [debug] admin_listen = {"<IP_ADDRESS>:8001 deferred reuseport"}
  | 2021/03/05 06:19:21 [debug] admin_ssl_cert = {}
  | 2021/03/05 06:19:21 [debug] admin_ssl_cert_key = {}
  | 2021/03/05 06:19:21 [debug] anonymous_reports = false
  | 2021/03/05 06:19:21 [debug] cassandra_consistency = "LOCAL_QUORUM"
  | 2021/03/05 06:19:21 [debug] cassandra_contact_points = {"server8171"}
  | 2021/03/05 06:19:21 [debug] cassandra_data_centers = {"DC1:3","DC2:3"}
  | 2021/03/05 06:19:21 [debug] cassandra_keyspace = "kong_dev"
  | 2021/03/05 06:19:21 [debug] cassandra_lb_policy = "RequestDCAwareRoundRobin"
  | 2021/03/05 06:19:21 [debug] cassandra_local_datacenter = "DC2"
  | 2021/03/05 06:19:21 [debug] cassandra_password = "******"
  | 2021/03/05 06:19:21 [debug] cassandra_port = 9042
  | 2021/03/05 06:19:21 [debug] cassandra_read_consistency = "LOCAL_QUORUM"
  | 2021/03/05 06:19:21 [debug] cassandra_refresh_frequency = 60
  | 2021/03/05 06:19:21 [debug] cassandra_repl_factor = 3
  | 2021/03/05 06:19:21 [debug] cassandra_repl_strategy = "NetworkTopologyStrategy"
  | 2021/03/05 06:19:21 [debug] cassandra_schema_consensus_timeout = 120000
  | 2021/03/05 06:19:21 [debug] cassandra_ssl = true
  | 2021/03/05 06:19:21 [debug] cassandra_ssl_verify = true
  | 2021/03/05 06:19:21 [debug] cassandra_timeout = 20000
  | 2021/03/05 06:19:21 [debug] cassandra_username = "kongdba"
  | 2021/03/05 06:19:21 [debug] cassandra_write_consistency = "LOCAL_QUORUM"
  | 2021/03/05 06:19:21 [debug] client_body_buffer_size = "8k"
  | 2021/03/05 06:19:21 [debug] client_max_body_size = "0"
  | 2021/03/05 06:19:21 [debug] client_ssl = false
  | 2021/03/05 06:19:21 [debug] cluster_control_plane = "<IP_ADDRESS>:8005"
  | 2021/03/05 06:19:21 [debug] cluster_data_plane_purge_delay = 1209600
  | 2021/03/05 06:19:21 [debug] cluster_listen = {"<IP_ADDRESS>:8005"}
  | 2021/03/05 06:19:21 [debug] cluster_mtls = "shared"
  | 2021/03/05 06:19:21 [debug] database = "cassandra"
  | 2021/03/05 06:19:21 [debug] db_cache_ttl = 0
  | 2021/03/05 06:19:21 [debug] db_cache_warmup_entities = {"services","plugins"}
  | 2021/03/05 06:19:21 [debug] db_resurrect_ttl = 30
  | 2021/03/05 06:19:21 [debug] db_update_frequency = 5
  | 2021/03/05 06:19:21 [debug] db_update_propagation = 0
  | 2021/03/05 06:19:21 [debug] dns_error_ttl = 1
  | 2021/03/05 06:19:21 [debug] dns_hostsfile = "/etc/hosts"
  | 2021/03/05 06:19:21 [debug] dns_no_sync = false
  | 2021/03/05 06:19:21 [debug] dns_not_found_ttl = 30
  | 2021/03/05 06:19:21 [debug] dns_order = {"LAST","SRV","A","CNAME"}
  | 2021/03/05 06:19:21 [debug] dns_resolver = {}
  | 2021/03/05 06:19:21 [debug] dns_stale_ttl = 4
  | 2021/03/05 06:19:21 [debug] error_default_type = "text/plain"
  | 2021/03/05 06:19:21 [debug] go_plugins_dir = "off"
  | 2021/03/05 06:19:21 [debug] go_pluginserver_exe = "/usr/local/bin/go-pluginserver"
  | 2021/03/05 06:19:21 [debug] headers = {"server_tokens","latency_tokens"}
  | 2021/03/05 06:19:21 [debug] host_ports = {}
  | 2021/03/05 06:19:21 [debug] kic = false
  | 2021/03/05 06:19:21 [debug] log_level = "notice"
  | 2021/03/05 06:19:21 [debug] lua_package_cpath = ""
  | 2021/03/05 06:19:21 [debug] lua_package_path = "./?.lua;./?/init.lua;"
  | 2021/03/05 06:19:21 [debug] lua_socket_pool_size = 30
  | 2021/03/05 06:19:21 [debug] lua_ssl_trusted_certificate = {"/usr/local/kong/ssl/kongcert.pem"}
  | 2021/03/05 06:19:21 [debug] lua_ssl_verify_depth = 3
  | 2021/03/05 06:19:21 [debug] mem_cache_size = "128m"
  | 2021/03/05 06:19:21 [debug] nginx_admin_client_body_buffer_size = "10m"
  | 2021/03/05 06:19:21 [debug] nginx_admin_client_max_body_size = "10m"
  | 2021/03/05 06:19:21 [debug] nginx_admin_directives = {{name="client_body_buffer_size",value="10m"},{name="client_max_body_size",value="10m"}}
  | 2021/03/05 06:19:21 [debug] nginx_daemon = "off"
  | 2021/03/05 06:19:21 [debug] nginx_events_directives = {{name="multi_accept",value="on"},{name="worker_connections",value="auto"}}
  | 2021/03/05 06:19:21 [debug] nginx_events_multi_accept = "on"
  | 2021/03/05 06:19:21 [debug] nginx_events_worker_connections = "auto"
  | 2021/03/05 06:19:21 [debug] nginx_http_client_body_buffer_size = "8k"
  | 2021/03/05 06:19:21 [debug] nginx_http_client_max_body_size = "0"
  | 2021/03/05 06:19:21 [debug] nginx_http_directives = {{name="ssl_dhparam",value="ffdhe2048"},{name="client_max_body_size",value="0"},{name="ssl_prefer_server_ciphers",value="off"},{name="client_body_buffer_size",value="8k"},{name="ssl_protocols",value="TLSv1.2 TLSv1.3"},{name="ssl_session_tickets",value="on"},{name="ssl_session_timeout",value="1d"}}
  | 2021/03/05 06:19:21 [debug] nginx_http_ssl_dhparam = "ffdhe2048"
  | 2021/03/05 06:19:21 [debug] nginx_http_ssl_prefer_server_ciphers = "off"
  | 2021/03/05 06:19:21 [debug] nginx_http_ssl_protocols = "TLSv1.2 TLSv1.3"
  | 2021/03/05 06:19:21 [debug] nginx_http_ssl_session_tickets = "on"
  | 2021/03/05 06:19:21 [debug] nginx_http_ssl_session_timeout = "1d"
  | 2021/03/05 06:19:21 [debug] nginx_http_status_directives = {}
  | 2021/03/05 06:19:21 [debug] nginx_http_upstream_directives = {{name="keepalive_requests",value="100"},{name="keepalive_timeout",value="60s"},{name="keepalive",value="60"}}
  | 2021/03/05 06:19:21 [debug] nginx_http_upstream_keepalive = "60"
  | 2021/03/05 06:19:21 [debug] nginx_http_upstream_keepalive_requests = "100"
  | 2021/03/05 06:19:21 [debug] nginx_http_upstream_keepalive_timeout = "60s"
  | 2021/03/05 06:19:21 [debug] nginx_main_daemon = "off"
  | 2021/03/05 06:19:21 [debug] nginx_main_directives = {{name="daemon",value="off"},{name="worker_rlimit_nofile",value="auto"},{name="worker_processes",value="auto"}}
  | 2021/03/05 06:19:21 [debug] nginx_main_worker_processes = "auto"
  | 2021/03/05 06:19:21 [debug] nginx_main_worker_rlimit_nofile = "auto"
  | 2021/03/05 06:19:21 [debug] nginx_optimizations = true
  | 2021/03/05 06:19:21 [debug] nginx_proxy_directives = {{name="real_ip_recursive",value="off"},{name="real_ip_header",value="X-Real-IP"}}
  | 2021/03/05 06:19:21 [debug] nginx_proxy_real_ip_header = "X-Real-IP"
  | 2021/03/05 06:19:21 [debug] nginx_proxy_real_ip_recursive = "off"
  | 2021/03/05 06:19:21 [debug] nginx_sproxy_directives = {}
  | 2021/03/05 06:19:21 [debug] nginx_status_directives = {}
  | 2021/03/05 06:19:21 [debug] nginx_stream_directives = {{name="ssl_session_tickets",value="on"},{name="ssl_dhparam",value="ffdhe2048"},{name="ssl_protocols",value="TLSv1.2 TLSv1.3"},{name="ssl_session_timeout",value="1d"},{name="ssl_prefer_server_ciphers",value="off"}}
  | 2021/03/05 06:19:21 [debug] nginx_stream_ssl_dhparam = "ffdhe2048"
  | 2021/03/05 06:19:21 [debug] nginx_stream_ssl_prefer_server_ciphers = "off"
  | 2021/03/05 06:19:21 [debug] nginx_stream_ssl_protocols = "TLSv1.2 TLSv1.3"
  | 2021/03/05 06:19:21 [debug] nginx_stream_ssl_session_tickets = "on"
  | 2021/03/05 06:19:21 [debug] nginx_stream_ssl_session_timeout = "1d"
  | 2021/03/05 06:19:21 [debug] nginx_supstream_directives = {}
  | 2021/03/05 06:19:21 [debug] nginx_upstream_directives = {{name="keepalive_requests",value="100"},{name="keepalive_timeout",value="60s"},{name="keepalive",value="60"}}
  | 2021/03/05 06:19:21 [debug] nginx_upstream_keepalive = "60"
  | 2021/03/05 06:19:21 [debug] nginx_upstream_keepalive_requests = "100"
  | 2021/03/05 06:19:21 [debug] nginx_upstream_keepalive_timeout = "60s"
  | 2021/03/05 06:19:21 [debug] nginx_worker_processes = "auto"
  | 2021/03/05 06:19:21 [debug] pg_database = "kong"
  | 2021/03/05 06:19:21 [debug] pg_host = "<IP_ADDRESS>"
  | 2021/03/05 06:19:21 [debug] pg_max_concurrent_queries = 0
  | 2021/03/05 06:19:21 [debug] pg_port = 5432
  | 2021/03/05 06:19:21 [debug] pg_ro_ssl = false
  | 2021/03/05 06:19:21 [debug] pg_ro_ssl_verify = false
  | 2021/03/05 06:19:21 [debug] pg_semaphore_timeout = 60000
  | 2021/03/05 06:19:21 [debug] pg_ssl = false
  | 2021/03/05 06:19:21 [debug] pg_ssl_verify = false
  | 2021/03/05 06:19:21 [debug] pg_timeout = 5000
  | 2021/03/05 06:19:21 [debug] pg_user = "kong"
  | 2021/03/05 06:19:21 [debug] plugins = {"kong-siteminder-auth","kong-kafka-log","stargate-waf-error-log","mtls","stargate-oidc-token-revoke","kong-tx-debugger","kong-plugin-oauth","zipkin","kong-error-log","kong-oidc-implicit-token","kong-response-size-limiting","request-transformer","kong-service-virtualization","kong-cluster-drain","kong-upstream-jwt","kong-splunk-log","kong-spec-expose","kong-path-based-routing","kong-oidc-multi-idp","correlation-id","oauth2","statsd","jwt","rate-limiting","acl","request-size-limiting","request-termination","cors"}
  | 2021/03/05 06:19:21 [debug] pluginserver_names = {}
  | 2021/03/05 06:19:21 [debug] port_maps = {}
  | 2021/03/05 06:19:21 [debug] prefix = "/usr/local/kong/"
  | 2021/03/05 06:19:21 [debug] proxy_access_log = "logs/access.log"
  | 2021/03/05 06:19:21 [debug] proxy_error_log = "logs/error.log"
  | 2021/03/05 06:19:21 [debug] proxy_listen = {"<IP_ADDRESS>:8000","<IP_ADDRESS>:8443 ssl http2 deferred reuseport"}
  | 2021/03/05 06:19:21 [debug] real_ip_header = "X-Real-IP"
  | 2021/03/05 06:19:21 [debug] real_ip_recursive = "off"
  | 2021/03/05 06:19:21 [debug] role = "traditional"
  | 2021/03/05 06:19:21 [debug] ssl_cert = {"/usr/local/kong/ssl/kongcert.crt"}
  | 2021/03/05 06:19:21 [debug] ssl_cert_key = {"/usr/local/kong/ssl/kongprivatekey.key"}
  | 2021/03/05 06:19:21 [debug] ssl_cipher_suite = "intermediate"
  | 2021/03/05 06:19:21 [debug] ssl_ciphers = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"
  | 2021/03/05 06:19:21 [debug] ssl_dhparam = "ffdhe2048"
  | 2021/03/05 06:19:21 [debug] ssl_prefer_server_ciphers = "on"
  | 2021/03/05 06:19:21 [debug] ssl_protocols = "TLSv1.1 TLSv1.2 TLSv1.3"
  | 2021/03/05 06:19:21 [debug] ssl_session_tickets = "on"
  | 2021/03/05 06:19:21 [debug] ssl_session_timeout = "1d"
  | 2021/03/05 06:19:21 [debug] status_access_log = "off"
  | 2021/03/05 06:19:21 [debug] status_error_log = "logs/status_error.log"
  | 2021/03/05 06:19:21 [debug] status_listen = {"off"}
  | 2021/03/05 06:19:21 [debug] status_ssl_cert = {}
  | 2021/03/05 06:19:21 [debug] status_ssl_cert_key = {}
  | 2021/03/05 06:19:21 [debug] stream_listen = {"off"}
  | 2021/03/05 06:19:21 [debug] trusted_ips = {}
  | 2021/03/05 06:19:21 [debug] untrusted_lua = "sandbox"
  | 2021/03/05 06:19:21 [debug] untrusted_lua_sandbox_environment = {}
  | 2021/03/05 06:19:21 [debug] untrusted_lua_sandbox_requires = {}
  | 2021/03/05 06:19:21 [debug] upstream_keepalive = 60
  | 2021/03/05 06:19:21 [debug] upstream_keepalive_idle_timeout = 60
  | 2021/03/05 06:19:21 [debug] upstream_keepalive_max_requests = 100
  | 2021/03/05 06:19:21 [debug] upstream_keepalive_pool_size = 60
  | 2021/03/05 06:19:21 [debug] waf = "off"
  | 2021/03/05 06:19:21 [debug] waf_audit = "RelevantOnly"
  | 2021/03/05 06:19:21 [debug] waf_debug_level = "0"
  | 2021/03/05 06:19:21 [debug] waf_mode = "On"
  | 2021/03/05 06:19:21 [debug] waf_paranoia_level = "1"
  | 2021/03/05 06:19:21 [debug] waf_pcre_match_limit = "10000"
  | 2021/03/05 06:19:21 [debug] waf_pcre_match_limit_recursion = "10000"
  | 2021/03/05 06:19:21 [debug] waf_request_file_size_limit = "50000000"
  | 2021/03/05 06:19:21 [debug] waf_request_no_file_size_limit = "50000000"
  | 2021/03/05 06:19:21 [debug] worker_consistency = "strict"
  | 2021/03/05 06:19:21 [debug] worker_state_update_frequency = 5
  | 2021/03/05 06:19:21 [verbose] prefix in use: /usr/local/kong
  | 2021/03/05 06:19:21 [verbose] preparing nginx prefix directory at /usr/local/kong
  | 2021/03/05 06:19:21 [verbose] generating trusted certs combined file in
  | 2021/03/05 06:19:21 [debug] searching for OpenResty 'nginx' executable
  | 2021/03/05 06:19:21 [debug] /usr/local/openresty/nginx/sbin/nginx -v: 'sh: /usr/local/openresty/nginx/sbin/nginx: not found'
  | 2021/03/05 06:19:21 [debug] OpenResty 'nginx' executable not found at /usr/local/openresty/nginx/sbin/nginx
  | 2021/03/05 06:19:21 [debug] /opt/openresty/nginx/sbin/nginx -v: 'sh: /opt/openresty/nginx/sbin/nginx: not found'
  | 2021/03/05 06:19:21 [debug] OpenResty 'nginx' executable not found at /opt/openresty/nginx/sbin/nginx
  | 2021/03/05 06:19:21 [debug] nginx -v: 'nginx version: openresty/<IP_ADDRESS>'
  | Error:
  | ...ong/luarocks/share/lua/5.1/kong/cmd/utils/migrations.lua:115: [Cassandra error] cluster_mutex callback threw an error: ...ong/luarocks/share/lua/5.1/kong/cmd/utils/migrations.lua:104: [Cassandra error] failed to run migration '013_220_to_230' up: [Write timeout] Operation timed out - received only 1 responses.
  | stack traceback:
  | [C]: in function 'assert'
  | ...ong/luarocks/share/lua/5.1/kong/cmd/utils/migrations.lua:104: in function <...ong/luarocks/share/lua/5.1/kong/cmd/utils/migrations.lua:70>
  | [C]: in function 'xpcall'
  | /usr/local/kong/luarocks/share/lua/5.1/kong/db/init.lua:402: in function </usr/local/kong/luarocks/share/lua/5.1/kong/db/init.lua:352>
  | [C]: in function 'pcall'
  | /usr/local/kong/luarocks/share/lua/5.1/kong/concurrency.lua:45: in function 'cluster_mutex'
  | ...ong/luarocks/share/lua/5.1/kong/cmd/utils/migrations.lua:70: in function 'up'
  | ...ocal/kong/luarocks/share/lua/5.1/kong/cmd/migrations.lua:184: in function 'cmd_exec'
  | /usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88: in function </usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88>
  | [C]: in function 'xpcall'
  | /usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88: in function </usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:45>
  | /usr/bin/kong:9: in function 'file_gen'
  | init_worker_by_lua:48: in function <init_worker_by_lua:46>
  | [C]: in function 'xpcall'
  | init_worker_by_lua:55: in function <init_worker_by_lua:53>
  | stack traceback:
  | [C]: in function 'error'
  | ...ong/luarocks/share/lua/5.1/kong/cmd/utils/migrations.lua:115: in function 'up'
  | ...ocal/kong/luarocks/share/lua/5.1/kong/cmd/migrations.lua:184: in function 'cmd_exec'
  | /usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88: in function </usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88>
  | [C]: in function 'xpcall'
  | /usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88: in function </usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:45>
  | /usr/bin/kong:9: in function 'file_gen'
  | init_worker_by_lua:48: in function <init_worker_by_lua:46>
  | [C]: in function 'xpcall'
  | init_worker_by_lua:55: in function <init_worker_by_lua:53>
  | 2021/03/05 06:19:21 [debug] finding executable absolute path from $PATH...
  | 2021/03/05 06:19:21 [debug] found OpenResty 'nginx' executable at /usr/bin/nginx
  | 2021/03/05 06:19:21 [debug] testing nginx configuration: KONG_NGINX_CONF_CHECK=true /usr/bin/nginx -t -p /usr/local/kong -c nginx.conf
  | 2021/03/05 06:19:21 [debug] resolved Cassandra contact point 'server8171' to: 10.86.xx.xx
  | 2021/03/05 06:19:21 [debug] loading subsystems migrations...
  | 2021/03/05 06:19:22 [verbose] retrieving keyspace schema state...
  | 2021/03/05 06:19:22 [verbose] schema state retrieved
  | 2021/03/05 06:19:22 [debug] loading subsystems migrations...
  | 2021/03/05 06:19:22 [verbose] retrieving keyspace schema state...
  | 2021/03/05 06:19:22 [verbose] schema state retrieved
  | 2021/03/05 06:19:22 [debug] migrations to run:
  | core: 012_213_to_220, 013_220_to_230
  | 2021/03/05 06:19:22 [info] migrating core on keyspace 'kong_dev'...
  | 2021/03/05 06:19:22 [debug] running migration: 012_213_to_220
  | 2021/03/05 06:19:23 [info] core migrated up to: 012_213_to_220 (pending)
  | 2021/03/05 06:19:23 [debug] running migration: 013_220_to_230

Seems a little sketchy @bungle  ? Maybe I try the migrations up one more time before the finish(hopefully it doesn't make it worse xD).

Schema meta for that db looking a bit like:
DBUSER@cqlsh:kong_dev> select * from schema_meta;

 key         | subsystem             | executed                                                                                | last_executed  | pending
-------------+-----------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------------+--------------------
 schema_meta |                   acl |                                                                                {'000_base_acl', '001_14_to_15', '002_130_to_140', '003_200_to_210', '004_212_to_213'} | 004_212_to_213 |               null
 schema_meta |            basic-auth |                                                                                {'000_base_basic_auth', '001_14_to_15'} |   001_14_to_15 |               null
 schema_meta |                  core | {'000_base', '001_14_to_15', '002_15_to_1', '003_100_to_110', '004_110_to_120', '005_120_to_130', '006_130_to_140', '007_140_to_150', '008_150_to_200', '009_200_to_210', '010_210_to_211', '011_212_to_213'} | 011_212_to_213 | {'012_213_to_220'}
 schema_meta |             hmac-auth |                                                                                {'000_base_hmac_auth', '001_14_to_15'} |   001_14_to_15 |               null
 schema_meta |                   jwt |                                                                                {'000_base_jwt', '001_14_to_15', '002_130_to_140', '003_200_to_210'} | 003_200_to_210 |               null
 schema_meta |              key-auth |                                                                                {'000_base_key_auth', '001_14_to_15', '002_130_to_140', '003_200_to_210'} | 003_200_to_210 |               null
 schema_meta |                oauth2 |                                                                                {'000_base_oauth2', '001_14_to_15', '002_15_to_10', '003_130_to_140', '004_200_to_210', '005_210_to_211'} | 005_210_to_211 |               null
 schema_meta |         rate-limiting |                                                                                {'000_base_rate_limiting', '001_14_to_15', '002_15_to_10', '003_10_to_112', '004_200_to_210'} | 004_200_to_210 |               null
 schema_meta | response-ratelimiting |                                                                                {'000_base_response_rate_limiting', '001_14_to_15', '002_15_to_10'} |   002_15_to_10 |               null

Run number 2 of the up:
2021/03/05 06:45:02 [debug] nginx -v: 'nginx version: openresty/<IP_ADDRESS>'
--
  | Error:
  | ...ong/luarocks/share/lua/5.1/kong/cmd/utils/migrations.lua:67: Database has pending migrations; run 'kong migrations finish'
  | stack traceback:
  | [C]: in function 'error'
  | ...ong/luarocks/share/lua/5.1/kong/cmd/utils/migrations.lua:67: in function 'up'
  | ...ocal/kong/luarocks/share/lua/5.1/kong/cmd/migrations.lua:184: in function 'cmd_exec'
  | /usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88: in function </usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88>
  | [C]: in function 'xpcall'
  | /usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88: in function </usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:45>
  | /usr/bin/kong:9: in function 'file_gen'
  | init_worker_by_lua:48: in function <init_worker_by_lua:46>
  | [C]: in function 'xpcall'
  | init_worker_by_lua:55: in function <init_worker_by_lua:53>
  | 2021/03/05 06:45:02 [debug] finding executable absolute path from $PATH...
  | 2021/03/05 06:45:02 [debug] found OpenResty 'nginx' executable at /usr/bin/nginx
  | 2021/03/05 06:45:02 [debug] testing nginx configuration: KONG_NGINX_CONF_CHECK=true /usr/bin/nginx -t -p /usr/local/kong -c nginx.conf
  | 2021/03/05 06:45:02 [debug] resolved Cassandra contact point 'server8171' to: 10.86.xx.xx
  | 2021/03/05 06:45:02 [debug] loading subsystems migrations...
  | 2021/03/05 06:45:03 [verbose] retrieving keyspace schema state...
  | 2021/03/05 06:45:03 [verbose] schema state retrieved

Seems okay.

@jeremyjpj0916,

@bungle yeah I was thinking I could just include it in my volume mount going forward to stop Kong trying to auto gen it. Its just this guy right? https://github.com/internetstandards/dhe_groups/blob/master/ffdhe2048.pem?

Yes, also found here:
https://ssl-config.mozilla.org/ffdhe2048.txt
and standardized here:
https://tools.ietf.org/html/rfc7919#appendix-A.1

Will try dropping that in my volume mount now to see how it goes. So if the file is present in my ssl directory then Kong can ignore making/rewriting it.

That's right: https://github.com/Kong/kong/blob/master/kong/cmd/utils/prefix_handler.lua#L72

Seems in new Kong there is like an array expectation for the Kong cert variable:
Our ENV Var:

Your new code:
> if proxy_ssl_enabled then
> for i = 1, #ssl_cert do
    ssl_certificate     $(ssl_cert[i]);
    ssl_certificate_key $(ssl_cert_key[i]);
> end
    ssl_session_cache   shared:SSL:10m;
    ssl_certificate_by_lua_block {
        Kong.ssl_certificate()
    }
> end

So the env variable can now be like a comma separated list?
KONG_SSL_CERT = kong-cert1.crt,kong-cert2.crt,kong-cert3.crt ?
KONG_SSL_CERT_KEY = kongprivatekey1.key,kongprivatekey2.key,kongprivatekey3.key?
It just pairs them in the order of the respective lists for pub/private matching it seems.
I tried leaving the template without the array parse stuff like:
> if proxy_ssl_enabled then
    ssl_certificate ${{SSL_CERT}};
    ssl_certificate_key ${{SSL_CERT_KEY}};
    ssl_session_cache shared:SSL:10m;
    ssl_certificate_by_lua_block {
        Kong.ssl_certificate()
    }
> end

In my template but I got a:
Error: invalid replacement value (a table)

  Run with --v (verbose) or --vv (debug) for more details

So will try with the list format to see if it works.

@jeremyjpj0916,
Previously you could just have single cert and key, but we changed those to arrays so that you can have multiple. That is mostly because you will need both RSA and DSA keys to get all the algorithms (e.g. in  intermediate)  to work. You should not need to make any changes to configs though.  I am not sure why you tried leaving the template non-array. What is the benefit? You can still use KONG_SSL_CERT=single.crt.

Ran on debug mode...
Error:
...luarocks/share/lua/5.1/kong/cmd/utils/prefix_handler.lua:435: invalid replacement value (a table)
stack traceback:
	[C]: in function 'compile_nginx_conf'
	...luarocks/share/lua/5.1/kong/cmd/utils/prefix_handler.lua:435: in function 'prepare_prefix'
	/usr/local/kong/luarocks/share/lua/5.1/kong/cmd/prepare.lua:10: in function 'cmd_exec'
	/usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88: in function </usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88>
	[C]: in function 'xpcall'
	/usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88: in function </usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:45>
	/usr/bin/kong:9: in function 'file_gen'
	init_worker_by_lua:51: in function <init_worker_by_lua:49>
	[C]: in function 'xpcall'
	init_worker_by_lua:58: in function <init_worker_by_lua:56>
2021/03/05 19:09:28 [debug] worker_state_update_frequency = 5
2021/03/05 19:09:28 [verbose] prefix in use: /usr/local/kong
2021/03/05 19:09:28 [verbose] preparing nginx prefix directory at /usr/local/kong
2021/03/05 19:09:28 [verbose] generating trusted certs combined file in

Guessing this indicates a value that parsed as a table that should not be? Wish I had some insight into what field/config may be causing greif here. Guess thats what comes with running custom templates and LUA files.

Ahhh, running my Kong prepare statement in a debug terminal I can see this error in execution:
/usr/local $ kong prepare -p "/usr/local/kong" --nginx-conf "/usr/local/kong/optum_nginx.template" --vv

2021/03/05 19:29:45 [verbose] prefix in use: /usr/local/kong
2021/03/05 19:29:45 [verbose] preparing nginx prefix directory at /usr/local/kong
2021/03/05 19:29:45 [verbose] generating trusted certs combined file in
Error:
...luarocks/share/lua/5.1/kong/cmd/utils/prefix_handler.lua:435: invalid replacement value (a table)
stack traceback:
        [C]: in function 'compile_nginx_conf'
        ...luarocks/share/lua/5.1/kong/cmd/utils/prefix_handler.lua:435: in function 'prepare_prefix'
        /usr/local/kong/luarocks/share/lua/5.1/kong/cmd/prepare.lua:10: in function 'cmd_exec'
        /usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88: in function </usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88>
        [C]: in function 'xpcall'
        /usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:88: in function </usr/local/kong/luarocks/share/lua/5.1/kong/cmd/init.lua:45>
        /usr/bin/kong:9: in function 'file_gen'
        init_worker_by_lua:51: in function <init_worker_by_lua:49>
        [C]: in function 'xpcall'
        init_worker_by_lua:58: in function <init_worker_by_lua:56>
/usr/local $

@jeremyjpj0916 what I have seen sometime with doing mostly downgrades is that /usr/local/kong/.kong_env   could cause issues (that can usually be deleted as it is most useful with doing kong restart / kong reload after kong is configured).

Will definitely take a look and see if that file is lurking around, throwing my custom conf here for now as I dig into what could be wrong with it, I already see a few other differences between it and newer Kong versions(like the lua ssl trusted cert field). We likely just missed a few extra spots that need refactor is my guess here:
> if nginx_user then
user ${{NGINX_USER}};
> end
#worker_processes ${{NGINX_WORKER_PROCESSES}};
#worker_processes 6;

env SPLUNK_HOST;
env KONG_SSL_CERT_KEY;
env KONG_SSL_CERT_DER;
pid pids/nginx.pid;
error_log ${{PROXY_ERROR_LOG}} ${{LOG_LEVEL}};

# injected nginx_main_* directives
> for _, el in ipairs(nginx_main_directives) do
$(el.name) $(el.value);
> end

events {
    # injected nginx_events_* directives
> for _, el in ipairs(nginx_events_directives) do
    $(el.name) $(el.value);
> end
}
http {
  charset UTF-8;
  server_tokens off;

  error_log ${{PROXY_ERROR_LOG}} ${{LOG_LEVEL}};

#Jeremy and Ross Nginx Performance Tweaks
tcp_nodelay on;			#  Enables or disables the use of the TCP_NODELAY option. The option is enabled only when a connection is transitioned into the keep-alive state
tcp_nopush on; 			#  Enables or disables the use of the TCP_NOPUSH socket option on FreeBSD or the TCP_CORK socket option on Linux.
proxy_buffer_size 32k; 	# Sets the size of the buffer used for reading the first part of the response received from the proxied server. This part usually contains a small response header. By default, the buffer size is equal to one memory page. This is either 4K or 8K, depending on a platform. It can be made smaller, however.
proxy_buffers 10 2m; 		# Sets the number and size of the buffers used for reading a response from the proxied server, for a single connection. By default, the buffer size is equal to one memory page. This is either 4K or 8K, depending on a platform.
proxy_busy_buffers_size 4m;	# When buffering of responses from the proxied server is enabled, limits the total size of buffers that can be busy sending a response to the client while the response is not yet fully read. In the meantime, the rest of the buffers can be used for reading the response and, if needed, buffering part of the response to a temporary file. By default, size is limited by the size of two buffers set by the proxy_buffer_size and proxy_buffers directives.
reset_timedout_connection on;	# Enables or disables resetting timed out connections. The reset is performed as follows. Before closing a socket, the SO_LINGER option is set on it with a timeout value of 0. When the socket is closed, TCP RST is sent to the client, and all memory occupied by this socket is released. This helps avoid keeping an already closed socket with filled buffers in a FIN_WAIT1 state for a long time. It should be noted that timed out keep-alive connections are closed normally.
keepalive_timeout 120s;		# The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The optional second parameter sets a value in the “Keep-Alive: timeout=time” response header field. Two parameters may differ. The “Keep-Alive: timeout=time” header field is recognized by Mozilla and Konqueror. MSIE closes keep-alive connections by itself in about 60 seconds.
keepalive_requests 10000;   # The number of subsequent keepalive requests the client can make
http2_idle_timeout 75s;          #Comparible to the keepalive_timeout above.
http2_recv_buffer_size 20m;       #Sets the size of the per worker input buffer.
http2_body_preread_size 2m;    #Sets the size of the buffer per each request in which the request body may be saved before it is started to be processed. This

# enable capturing error logs
lua_capture_error_log 100k;

# exclusive oauth shm caches
lua_shared_dict kong_oauth_cache       5m;
lua_shared_dict kong_oauth_cache_miss  2m;
lua_shared_dict kong_oauth_cache_locks 1m;

# exclusive oidc shm caches
lua_shared_dict kong_oidc_cache      10m;
lua_shared_dict kong_oidc_cache_miss  6m;
lua_shared_dict kong_oidc_cache_locks 3m;

# exclusive siteminder shm caches
lua_shared_dict kong_sm_cache      5m;
lua_shared_dict kong_sm_cache_miss  2m;
lua_shared_dict kong_sm_cache_locks 1m;

lua_package_path       '${{LUA_PACKAGE_PATH}};;';
lua_package_cpath      '${{LUA_PACKAGE_CPATH}};;';
lua_socket_pool_size   ${{LUA_SOCKET_POOL_SIZE}};
lua_socket_log_errors  off;
lua_max_running_timers 4096;
lua_max_pending_timers 16384;
lua_ssl_verify_depth   ${{LUA_SSL_VERIFY_DEPTH}};
> if lua_ssl_trusted_certificate then
lua_ssl_trusted_certificate '${{LUA_SSL_TRUSTED_CERTIFICATE}}';
> end
lua_shared_dict kong                        5m;
lua_shared_dict kong_locks                  8m;
lua_shared_dict kong_healthchecks           5m;
lua_shared_dict kong_process_events         5m;
lua_shared_dict kong_cluster_events         5m;
lua_shared_dict kong_rate_limiting_counters 12m;
lua_shared_dict kong_core_db_cache          ${{MEM_CACHE_SIZE}};
lua_shared_dict kong_core_db_cache_miss     12m;
lua_shared_dict kong_db_cache               ${{MEM_CACHE_SIZE}};
lua_shared_dict kong_db_cache_miss          12m;
> if database == "off" then
lua_shared_dict kong_core_db_cache_2        ${{MEM_CACHE_SIZE}};
lua_shared_dict kong_core_db_cache_miss_2   12m;
lua_shared_dict kong_db_cache_2             ${{MEM_CACHE_SIZE}};
lua_shared_dict kong_db_cache_miss_2        12m;
> end
> if database == "cassandra" then
lua_shared_dict kong_cassandra              5m;
> end
underscores_in_headers on;
> if ssl_ciphers then
ssl_ciphers ${{SSL_CIPHERS}};
> end
# injected nginx_http_* directives
> for _, el in ipairs(nginx_http_directives) do
$(el.name) $(el.value);
> end
init_by_lua_block {
    Kong = require 'kong'
    Kong.init()
}
init_worker_by_lua_block {
    Kong.init_worker()
}
> if (role == "traditional" or role == "data_plane") and #proxy_listeners > 0 then
upstream kong_upstream {
    server <IP_ADDRESS>;
    # injected nginx_upstream_* directives
> for _, el in ipairs(nginx_upstream_directives) do
    $(el.name) $(el.value);
> end
    balancer_by_lua_block {
        Kong.balancer()
    }
}
server {
    server_name kong;
> for _, entry in ipairs(proxy_listeners) do
    listen $(entry.listener);
> end
    error_page 400 404 408 411 412 413 414 417 494 /kong_error_handler;
    error_page 500 502 503 504                     /kong_error_handler;
    access_log ${{PROXY_ACCESS_LOG}};
    error_log  ${{PROXY_ERROR_LOG}} ${{LOG_LEVEL}};
> if proxy_ssl_enabled then
> for i = 1, #ssl_cert do
    ssl_certificate     $(ssl_cert[i]);
    ssl_certificate_key $(ssl_cert_key[i]);
> end
    ssl_session_cache   shared:SSL:10m;
    ssl_certificate_by_lua_block {
        Kong.ssl_certificate()
    }
> end
    # injected nginx_proxy_* directives
> for _, el in ipairs(nginx_proxy_directives) do
    $(el.name) $(el.value);
> end
> for _, ip in ipairs(trusted_ips) do
    set_real_ip_from $(ip);
> end
    rewrite_by_lua_block {
        Kong.rewrite()
    }
    access_by_lua_block {
        Kong.access()
    }
    header_filter_by_lua_block {
        Kong.header_filter()
        ngx.header["Server"] = nil
        ngx.header["Via"] = nil
    }
    body_filter_by_lua_block {
        Kong.body_filter()
    }
    log_by_lua_block {
        Kong.log()
    }
    location / {
        default_type                     '';
        set $ctx_ref                     '';
        set $upstream_te                 '';
        set $upstream_host               '';
        set $upstream_upgrade            '';
        set $upstream_connection         '';
        set $upstream_scheme             '';
        set $upstream_uri                '';
        set $upstream_x_forwarded_for    '';
        set $upstream_x_forwarded_proto  '';
        set $upstream_x_forwarded_host   '';
        set $upstream_x_forwarded_port   '';
        set $upstream_x_forwarded_path   '';
        set $upstream_x_forwarded_prefix '';
        set $kong_proxy_mode             'http';
        proxy_http_version      1.1;
        proxy_buffering          on;
        proxy_request_buffering  on;
        proxy_set_header      TE                 $upstream_te;
        proxy_set_header      Host               $upstream_host;
        proxy_set_header      Upgrade            $upstream_upgrade;
        proxy_set_header      Connection         $upstream_connection;
        proxy_set_header      X-Forwarded-For    $upstream_x_forwarded_for;
        proxy_set_header      X-Forwarded-Proto  $upstream_x_forwarded_proto;
        proxy_set_header      X-Forwarded-Host   $upstream_x_forwarded_host;
        proxy_set_header      X-Forwarded-Port   $upstream_x_forwarded_port;
        proxy_set_header      X-Forwarded-Path   $upstream_x_forwarded_path;
        proxy_set_header      X-Forwarded-Prefix $upstream_x_forwarded_prefix;
        proxy_set_header      X-Real-IP          $remote_addr;
        proxy_pass_header     Server;
        proxy_pass_header     Date;
        proxy_ssl_name        $upstream_host;
        proxy_ssl_server_name on;
> if client_ssl then
        proxy_ssl_certificate ${{CLIENT_SSL_CERT}};
        proxy_ssl_certificate_key ${{CLIENT_SSL_CERT_KEY}};
> end
        proxy_pass            $upstream_scheme://kong_upstream$upstream_uri;
    }
    location @unbuffered_response {
        internal;
        default_type         '';
        set $kong_proxy_mode 'unbuffered';
        proxy_http_version      1.1;
        proxy_buffering         off;
        proxy_request_buffering  on;
        proxy_set_header      TE                 $upstream_te;
        proxy_set_header      Host               $upstream_host;
        proxy_set_header      Upgrade            $upstream_upgrade;
        proxy_set_header      Connection         $upstream_connection;
        proxy_set_header      X-Forwarded-For    $upstream_x_forwarded_for;
        proxy_set_header      X-Forwarded-Proto  $upstream_x_forwarded_proto;
        proxy_set_header      X-Forwarded-Host   $upstream_x_forwarded_host;
        proxy_set_header      X-Forwarded-Port   $upstream_x_forwarded_port;
        proxy_set_header      X-Forwarded-Path   $upstream_x_forwarded_path;
        proxy_set_header      X-Forwarded-Prefix $upstream_x_forwarded_prefix;
        proxy_set_header      X-Real-IP          $remote_addr;
        proxy_pass_header     Server;
        proxy_pass_header     Date;
        proxy_ssl_name        $upstream_host;
        proxy_ssl_server_name on;
> if client_ssl then
        proxy_ssl_certificate ${{CLIENT_SSL_CERT}};
        proxy_ssl_certificate_key ${{CLIENT_SSL_CERT_KEY}};
> end
        proxy_pass            $upstream_scheme://kong_upstream$upstream_uri;
    }
    location @grpc {
        internal;
        default_type         '';
        set $kong_proxy_mode 'grpc';
        grpc_set_header      TE                 $upstream_te;
        grpc_set_header      X-Forwarded-For    $upstream_x_forwarded_for;
        grpc_set_header      X-Forwarded-Proto  $upstream_x_forwarded_proto;
        grpc_set_header      X-Forwarded-Host   $upstream_x_forwarded_host;
        grpc_set_header      X-Forwarded-Port   $upstream_x_forwarded_port;
        grpc_set_header      X-Forwarded-Path   $upstream_x_forwarded_path;
        grpc_set_header      X-Forwarded-Prefix $upstream_x_forwarded_prefix;
        grpc_set_header      X-Real-IP          $remote_addr;
        grpc_pass_header     Server;
        grpc_pass_header     Date;
        grpc_ssl_name        $upstream_host;
        grpc_ssl_server_name on;
> if client_ssl then
        grpc_ssl_certificate ${{CLIENT_SSL_CERT}};
        grpc_ssl_certificate_key ${{CLIENT_SSL_CERT_KEY}};
> end
        grpc_pass            $upstream_scheme://kong_upstream;
    }
    location = /kong_buffered_http {
        internal;
        default_type         '';
        set $kong_proxy_mode 'http';
        rewrite_by_lua_block       {;}
        access_by_lua_block        {;}
        header_filter_by_lua_block {;}
        body_filter_by_lua_block   {;}
        log_by_lua_block           {;}
        proxy_http_version 1.1;
        proxy_set_header      TE                 $upstream_te;
        proxy_set_header      Host               $upstream_host;
        proxy_set_header      Upgrade            $upstream_upgrade;
        proxy_set_header      Connection         $upstream_connection;
        proxy_set_header      X-Forwarded-For    $upstream_x_forwarded_for;
        proxy_set_header      X-Forwarded-Proto  $upstream_x_forwarded_proto;
        proxy_set_header      X-Forwarded-Host   $upstream_x_forwarded_host;
        proxy_set_header      X-Forwarded-Port   $upstream_x_forwarded_port;
        proxy_set_header      X-Forwarded-Path   $upstream_x_forwarded_path;
        proxy_set_header      X-Forwarded-Prefix $upstream_x_forwarded_prefix;
        proxy_set_header      X-Real-IP          $remote_addr;
        proxy_pass_header     Server;
        proxy_pass_header     Date;
        proxy_ssl_name        $upstream_host;
        proxy_ssl_server_name on;
> if client_ssl then
        proxy_ssl_certificate ${{CLIENT_SSL_CERT}};
        proxy_ssl_certificate_key ${{CLIENT_SSL_CERT_KEY}};
> end
        proxy_pass            $upstream_scheme://kong_upstream$upstream_uri;
    }
    location = /kong_error_handler {
        internal;
        default_type                 '';
        uninitialized_variable_warn  off;
        rewrite_by_lua_block {;}
        access_by_lua_block  {;}
        content_by_lua_block {
            Kong.handle_error()
        }
    }
}

server {
    server_name kong_mtls;
    listen <IP_ADDRESS>:9443 ssl http2 deferred reuseport;

    modsecurity ${{WAF}};
    modsecurity_rules_file /usr/local/modsec_includes.conf;

    #WAF_DEBUG_LEVEL level 0 = off 9 = on
    modsecurity_rules '
      SecRuleEngine ${{WAF_MODE}}
      SecRequestBodyLimit ${{WAF_REQUEST_FILE_SIZE_LIMIT}}
      SecRequestBodyNoFilesLimit ${{WAF_REQUEST_NO_FILE_SIZE_LIMIT}}
      SecPcreMatchLimit ${{WAF_PCRE_MATCH_LIMIT}}
      SecPcreMatchLimitRecursion ${{WAF_PCRE_MATCH_LIMIT_RECURSION}}
      SecDebugLogLevel ${{WAF_DEBUG_LEVEL}}
      SecAuditEngine ${{WAF_AUDIT}}
      SecAction "id:900000,phase:1,nolog,pass,t:none,setvar:tx.paranoia_level=${{WAF_PARANOIA_LEVEL}}"
    ';

    # Mutual TLS logic, check if server port is 9443
    ssl_verify_client on;
    ssl_client_certificate /usr/local/kong/stargate-mutual-trust.ca;
    ssl_crl /usr/local/kong/stargate-mutual-trust.crl.pem;
    ssl_verify_depth 3;

    error_page 400 404 408 411 412 413 414 417 494 /kong_error_handler;
    error_page 500 502 503 504 /kong_error_handler;

    access_log ${{PROXY_ACCESS_LOG}};
    error_log ${{PROXY_ERROR_LOG}} ${{LOG_LEVEL}};

    client_body_buffer_size ${{CLIENT_BODY_BUFFER_SIZE}};
    client_header_buffer_size 8k;
    large_client_header_buffers 2 20k;

> if proxy_ssl_enabled then
  ssl_certificate ${{SSL_CERT}};
  ssl_certificate_key ${{SSL_CERT_KEY}};
  ssl_session_cache shared:SSL:10m;
  ssl_certificate_by_lua_block {
      Kong.ssl_certificate()
  }
> end

  # injected nginx_proxy_* directives
> for _, el in ipairs(nginx_proxy_directives) do
  $(el.name) $(el.value);
> end
> for i = 1, #trusted_ips do
  set_real_ip_from  $(trusted_ips[i]);
> end

  rewrite_by_lua_block {
      Kong.rewrite()
  }

  access_by_lua_block {
      Kong.access()
  }

  header_filter_by_lua_block {
      Kong.header_filter()
      ngx.header["Server"] = nil
      ngx.header["Via"] = nil
  }

  body_filter_by_lua_block {
      Kong.body_filter()
  }

  log_by_lua_block {
      Kong.log()
  }

  location / {
      default_type                    '';

      set $ctx_ref                    '';
      set $upstream_te                '';
      set $upstream_host              '';
      set $upstream_upgrade           '';
      set $upstream_connection        '';
      set $upstream_scheme            '';
      set $upstream_uri               '';
      set $upstream_x_forwarded_for   '';
      set $upstream_x_forwarded_proto '';
      set $upstream_x_forwarded_host  '';
      set $upstream_x_forwarded_port  '';
      set $kong_proxy_mode            'http';

      proxy_http_version    1.1;
      proxy_set_header      TE                $upstream_te;
      proxy_set_header      Host              $upstream_host;
      proxy_set_header      Upgrade           $upstream_upgrade;
      proxy_set_header      Connection        $upstream_connection;
      proxy_set_header      X-Forwarded-For   $upstream_x_forwarded_for;
      proxy_set_header      X-Forwarded-Proto $upstream_x_forwarded_proto;
      proxy_set_header      X-Forwarded-Host  $upstream_x_forwarded_host;
      proxy_set_header      X-Forwarded-Port  $upstream_x_forwarded_port;
      proxy_set_header      X-Real-IP         $remote_addr;
      proxy_pass_header     Server;
      proxy_pass_header     Date;
      proxy_ssl_name        $upstream_host;
      proxy_ssl_server_name on;
> if client_ssl then
      proxy_ssl_certificate ${{CLIENT_SSL_CERT}};
      proxy_ssl_certificate_key ${{CLIENT_SSL_CERT_KEY}};
> end
      proxy_pass            $upstream_scheme://kong_upstream$upstream_uri;
  }

  location @grpc {
      internal;
      default_type         '';
      set $kong_proxy_mode 'grpc';

      grpc_set_header      TE                $upstream_te;
      grpc_set_header      Host              $upstream_host;
      grpc_set_header      X-Forwarded-For   $upstream_x_forwarded_for;
      grpc_set_header      X-Forwarded-Proto $upstream_x_forwarded_proto;
      grpc_set_header      X-Forwarded-Host  $upstream_x_forwarded_host;
      grpc_set_header      X-Forwarded-Port  $upstream_x_forwarded_port;
      grpc_set_header      X-Forwarded-Prefix $upstream_x_forwarded_prefix;
      grpc_set_header      X-Real-IP         $remote_addr;
      grpc_pass_header     Server;
      grpc_pass_header     Date;
      grpc_pass            grpc://kong_upstream;
  }

  location @grpcs {
      internal;
      default_type         '';
      set $kong_proxy_mode 'grpc';

      grpc_set_header      TE                $upstream_te;
      grpc_set_header      Host              $upstream_host;
      grpc_set_header      X-Forwarded-For   $upstream_x_forwarded_for;
      grpc_set_header      X-Forwarded-Proto $upstream_x_forwarded_proto;
      grpc_set_header      X-Forwarded-Host  $upstream_x_forwarded_host;
      grpc_set_header      X-Forwarded-Port  $upstream_x_forwarded_port;
        grpc_set_header      X-Forwarded-Prefix $upstream_x_forwarded_prefix;
      grpc_set_header      X-Real-IP         $remote_addr;
      grpc_pass_header     Server;
      grpc_pass_header     Date;
      grpc_ssl_name        $upstream_host;
      grpc_ssl_server_name on;
> if client_ssl then
      grpc_ssl_certificate ${{CLIENT_SSL_CERT}};
      grpc_ssl_certificate_key ${{CLIENT_SSL_CERT_KEY}};
> end
      grpc_pass            grpcs://kong_upstream;
  }

  location = /kong_buffered_http {
      internal;
      default_type         '';
      set $kong_proxy_mode 'http';

      rewrite_by_lua_block       {;}
      access_by_lua_block        {;}
      header_filter_by_lua_block {;}
      body_filter_by_lua_block   {;}
      log_by_lua_block           {;}

      proxy_http_version 1.1;
      proxy_set_header      TE                $upstream_te;
      proxy_set_header      Host              $upstream_host;
      proxy_set_header      Upgrade           $upstream_upgrade;
      proxy_set_header      Connection        $upstream_connection;
      proxy_set_header      X-Forwarded-For   $upstream_x_forwarded_for;
      proxy_set_header      X-Forwarded-Proto $upstream_x_forwarded_proto;
      proxy_set_header      X-Forwarded-Host  $upstream_x_forwarded_host;
      proxy_set_header      X-Forwarded-Port  $upstream_x_forwarded_port;
      proxy_set_header      X-Forwarded-Prefix $upstream_x_forwarded_prefix;
      proxy_set_header      X-Real-IP         $remote_addr;
      proxy_pass_header     Server;
      proxy_pass_header     Date;
      proxy_ssl_name        $upstream_host;
      proxy_ssl_server_name on;
> if client_ssl then
      proxy_ssl_certificate ${{CLIENT_SSL_CERT}};
      proxy_ssl_certificate_key ${{CLIENT_SSL_CERT_KEY}};
> end
      proxy_pass            $upstream_scheme://kong_upstream$upstream_uri;
  }

  location = /kong_error_handler {
      internal;
      default_type                 '';

      uninitialized_variable_warn  off;

      rewrite_by_lua_block {;}
      access_by_lua_block  {;}

      content_by_lua_block {
          Kong.handle_error()
      }
  }
}
> end -- (role == "traditional" or role == "data_plane") and #proxy_listeners > 0

> if (role == "control_plane" or role == "traditional") and #admin_listeners > 0 then
 server {
    server_name kong_admin;
> for _, entry in ipairs(admin_listeners) do
    listen $(entry.listener);
> end

      access_log ${{ADMIN_ACCESS_LOG}};
      error_log ${{ADMIN_ERROR_LOG}} ${{LOG_LEVEL}};
      client_header_buffer_size 8k;
      large_client_header_buffers 2 16k;

> if admin_ssl_enabled then
    ssl_certificate     ${{ADMIN_SSL_CERT}};
    ssl_certificate_key ${{ADMIN_SSL_CERT_KEY}};
    ssl_session_cache   shared:AdminSSL:10m;
> end
    # injected nginx_admin_* directives
> for _, el in ipairs(nginx_admin_directives) do
    $(el.name) $(el.value);
> end
    location / {
        default_type application/json;
        content_by_lua_block {
            Kong.admin_content()
        }
        header_filter_by_lua_block {
            Kong.admin_header_filter()
        }
      }

      location /nginx_status {
          access_log off;
          stub_status;
      }

      location /robots.txt {
          return 200 'User-agent: *\nDisallow: /';
      }
      location /gc {
        content_by_lua_block {
            ngx.say(string.format("Worker %d: GC size: %.3f KB", ngx.var.pid, collectgarbage("count")))
        }
      }
 }
> end -- (role == "control_plane" or role == "traditional") and #admin_listeners > 0
}

Okay @bungle I am getting closer but now Kong seems to not like my custom Kong kong_defaults.lua additions that worked in prior versions:
2021/03/09 07:34:15 [error] 45#0: init_by_lua error: /usr/local/kong/luarocks/share/lua/5.1/kong/init.lua:440: waf_paranoia_level is not a string: '1'
stack traceback:
	[C]: in function 'assert'
	/usr/local/kong/luarocks/share/lua/5.1/kong/init.lua:440: in function 'init'
	init_by_lua:3: in main chunk
nginx: [error] init_by_lua error: /usr/local/kong/luarocks/share/lua/5.1/kong/init.lua:440: waf_paranoia_level is not a string: '1'
stack traceback:
	[C]: in function 'assert'
	/usr/local/kong/luarocks/share/lua/5.1/kong/init.lua:440: in function 'init'
	init_by_lua:3: in main chunk

Contents of the file:
lua_socket_pool_size = 30
lua_ssl_trusted_certificate = NONE
lua_ssl_verify_depth = 1
lua_package_path = ./?.lua;./?/init.lua;
lua_package_cpath = NONE
role = traditional
kic = off
pluginserver_names = NONE
untrusted_lua = sandbox
untrusted_lua_sandbox_requires =
untrusted_lua_sandbox_environment =
waf = on
waf_mode = On
waf_request_file_size_limit = 25000000
waf_request_no_file_size_limit = 20000000
waf_pcre_match_limit = 10000
waf_pcre_match_limit_recursion = 10000
waf_debug_level = 0
waf_audit = Off
waf_paranoia_level = 1
]]

Not sure why it would complain here?
I use it in my custom conf and env variables as KONG_WAF_PARANOIA_LEVEL:
server {
    server_name kong_mtls;
    listen <IP_ADDRESS>:9443 ssl http2 deferred reuseport backlog=16384;

    modsecurity ${{WAF}};
    modsecurity_rules_file /usr/local/modsec_includes.conf;

    #WAF_DEBUG_LEVEL level 0 = off 9 = on
    modsecurity_rules '
      SecRuleEngine ${{WAF_MODE}}
      SecRequestBodyLimit ${{WAF_REQUEST_FILE_SIZE_LIMIT}}
      SecRequestBodyNoFilesLimit ${{WAF_REQUEST_NO_FILE_SIZE_LIMIT}}
      SecPcreMatchLimit ${{WAF_PCRE_MATCH_LIMIT}}
      SecPcreMatchLimitRecursion ${{WAF_PCRE_MATCH_LIMIT_RECURSION}}
      SecDebugLogLevel ${{WAF_DEBUG_LEVEL}}
      SecAuditEngine ${{WAF_AUDIT}}
      SecAction "id:900000,phase:1,nolog,pass,t:none,setvar:tx.paranoia_level=${{WAF_PARANOIA_LEVEL}}"
    ';


chore(test): release gitea-actions-template 1.0.3

:robot: I have created a release beep boop
1.0.3 (2024-03-27)
🐛 Bugfixes

bump up NodeJS to v16 (b8a5078)
fixes jest globals type error (922b4cb)
support unknown catch variable (#377) (40c0b26)

🧰 Maintenance

add release-please support (ea41ebd)
bump up the required Node.JS version (8178840)
codeql: run on GitHub only (703e46a)
dev-deps: bump up eslint family to resolve ERESOLVE during the installation phase (06795f3)
dev-deps: bump up typescript to resolve TS6046 during the compilation phase (21895be)
drop codeql workflow (d3ff55a)
fix formatting (3126511)
Fix the "main" in package.json to point to a file that actually exists. (296c2aa)
linter: skip markdownlint line length checks for tables (aaaec83)
main: release 1.0.1 (4ca33b6)
main: release 1.0.2 (c5ffa87)
main: release gitea-actions-template 1.0.0 (ee8c36d)
markdownlint: disable MD013,MD024 for CHANGELOG.md (1c227a8)
release-please: disable include-component-in-tag (f171d62)
release-please: specify config and manifest (f321a74)
release-please: specify token (76eb57a)
release-please: support push to npm as well (3b46a82)
release-please: update semver tags as well (bd093a5)
skip npm caching (35b2d02)
update contents in the dist dir (4984069)
update dependabot.yml (#262) (e9f4361)
update project urls (c8e310b)

🧰 Documentation

accommodate to Gitea Badge urls (cb934d9)
add a customizing section for input/output parameters (e761e8d)
add common README content (1ab69ff)
complete README usage section with inputs info (666c2c0)
fix rendering of warning in README.md (3cb2651)
remove warning alert syntax (d55e16c)
request developers to code with NodeJS 16 or later (c71c2a1)

This PR was generated with Release Please. See documentation.

:robot: Release is at https://github.com/vicamo/gitea-actions-template/releases/tag/gitea-actions-template-v1.0.3 :sunflower: