Add array setter/getter to vtki.Common

This implements __getitem__/__setitem__ on vtki.Common
A lot of new users are getting confused by the .point_arrays and .cell_arrays dictionaries and having trouble keeping track of where their data resides. Particularly, this can get confusing if one uses the .cell_data_to_point_data or .point_data_to_cell_data filters.
I propose we implement a __getitem__ method on the vtki.Common class that will search the arrays in both .point_arrays and .cell_arrays for what the user asks for (note that this is already implemented in .get_scalar). This also comes with a __setitem__ method that uses the length of the array to decide on where it belongs.
Overall, this makes usage of scalars in vtki simpler and more intuitive for new users.
from vtki import examples
import numpy as np

data = examples.load_uniform()

# Assign arrays
data['foo'] = np.random.random(data.n_cells)
data['foo'] = np.random.random(data.n_points)

>>> # Fetch arrays
>>> len(data['foo']) # defaults to cell preference
729
>>> len(data['foo', 'points'])
1000
>>> len(data['foo', 'cells'])
729

Codecov Report

Merging #161 into master will decrease coverage by 0.11%.
The diff coverage is 41.66%.

@@            Coverage Diff            @@
##           master    #161      +/-   ##
=========================================
- Coverage   88.02%   87.9%   -0.12%
=========================================
  Files          21      21
  Lines        5235    5244       +9
=========================================
+ Hits         4608    4610       +2
- Misses        627     634       +7

Impacted Files
Coverage Δ

vtki/utilities.py
88.02% <100%> (+0.14%)
:arrow_up:

vtki/plotting.py
79.82% <100%> (-0.04%)
:arrow_down:

vtki/common.py
91.84% <22.22%> (-1.21%)
:arrow_down:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 6a8e3a6...b1fe6cd. Read the comment docs.

Thought about implementing this at some point.  I think it's a great idea, the only limitation would be if there's an identical number of points and cells.  It's a rare case, and we can just raise an exception and tell the user to use point_arrays or cell_arrays instead.
Or did you want to remove point_arrays and cell_arrays as well?  It would solve the issue with object collection.

Thought about implementing this at some point.  I think it's a great idea, the only limitation would be if there's an identical number of points and cells.  It's a rare case, and we can just raise an exception and tell the user to use point_arrays or cell_arrays instead.
Or did you want to remove point_arrays and cell_arrays as well?  It would solve the issue with object collection.

Or did you want to remove point_arrays and cell_arrays as well? It would solve the issue with object collection.

I definitely do not want to remove the point and cell arrays dictionaries. I think those are incredibly valuable/useful to have as properties directly on the datasets.
I want these __getitem__/__setitem__ changes to be simply for convenience. If a user is limited or needs more functionality by/from these features, then I think they should move towards using the point_arrays and cell_arrays dictionaries as VTK explicitly distinguishes the two and vtki should adhere to that.


Ignore unplayable songs when fetching playlists from spotify

Problem: When unplayable songs are in the queue, the Spotify remote app and the Spotify web API don't seem to agree on song indexing
Fix: Ignore unplayable songs when fetching from the Spotify web API
Details:

We need to provide the user's Market locale. When we do, Spotify will let us know whether the song is playable or not

As a side effect I had to add a new scope to the Spotify Authorization to allow us to pass "FROM_TOKEN" as the Market. AFAIK we don't actually fetch new data from the user, this string gets passed through to the Spotify web api and the API is smart enough to fetch the Market for the current user. We do require this scope though for the API to provide that functionality.
Now that we have provided the Market field, we can filter out songs that are unplayable by inspecting the field from the Spotify web api response.

Associated issue: https://github.com/BimmerGestalt/AAIdrive/issues/291

Codecov Report

Merging #579 (f0f146e) into main (5d5d9f9) will decrease coverage by 8.13%.
The diff coverage is 0.00%.

@@             Coverage Diff              @@
##               main     #579      +/-   ##
============================================
- Coverage     49.42%   41.28%   -8.14%
+ Complexity     1789     1384     -405
============================================
  Files           249      236      -13
  Lines         11792    11048     -744
  Branches       2331     2216     -115
============================================
- Hits           5828     4561    -1267
- Misses         4826     5533     +707
+ Partials       1138      954     -184

Impacted Files
Coverage Δ

...n/androidautoidrive/music/spotify/SpotifyWebApi.kt
32.46% <0.00%> (+1.73%)
:arrow_up:

...autoidrive/phoneui/SpotifyAuthorizationActivity.kt
0.00% <0.00%> (ø)

...droidautoidrive/phoneui/viewmodels/MapPageModel.kt
0.00% <0.00%> (-100.00%)
:arrow_down:

...idautoidrive/phoneui/fragments/MapsPageFragment.kt
0.00% <0.00%> (-100.00%)
:arrow_down:

...dautoidrive/phoneui/fragments/MusicPageFragment.kt
0.00% <0.00%> (-100.00%)
:arrow_down:

...dautoidrive/phoneui/viewmodels/SupportPageModel.kt
0.00% <0.00%> (-100.00%)
:arrow_down:

...autoidrive/phoneui/fragments/CarSummaryFragment.kt
0.00% <0.00%> (-100.00%)
:arrow_down:

...utoidrive/phoneui/fragments/SupportPageFragment.kt
0.00% <0.00%> (-100.00%)
:arrow_down:

...toidrive/phoneui/fragments/CalendarPageFragment.kt
0.00% <0.00%> (-100.00%)
:arrow_down:

...toidrive/phoneui/fragments/OverviewPageFragment.kt
0.00% <0.00%> (-100.00%)
:arrow_down:

... and 98 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 5d5d9f9...f0f146e. Read the comment docs.

This is wonderful, it looks so elegant! I'll have to try it out when I get back to my development system :) Thank you so much!

Thank you so much!

thank you for building this in the first place! It's really upgraded the experience of using my car on a daily basis. looking forward to help out where I can.

@hufman just wondering what the nightly builds process is like, will the build that is hyperlinked in the readme be updated tonight off of main ?

That "nightly build" is technically updated as soon as this build step finishes. It takes about 30 minutes so I call it nightly, but this fix is already included in the current build :)

Also, I pushed this fix to the beta channel in the Play Store!


Coverity fix

From coverty check http://dronecode01.sh.intel.com/gazebo/coverity/bc1e6f1/
--
Solve with this patch:
1	CHECKED_RETURN	/home/drone/Dronecode/Upstream/gazebo-sitl/gzsitl/gzsitl_plugin.cc	MavServer::handle_send()	Unclassified
69	UNINIT	/home/drone/Dronecode/Upstream/gazebo-sitl/gzsitl/gzsitl_plugin.cc	gazebo::GZSitlPlugin::home_pos_to_global(__mavlink_home_position_t)	Unclassified
70	UNINIT_CTOR	/home/drone/Dronecode/Upstream/gazebo-sitl/gzsitl/gzsitl_plugin.cc	MavServer::MavServer(short)	Unclassified
71	UNINIT_CTOR	/usr/include/gazebo-7/gazebo/common/Plugin.hh	gazebo::PluginTgazebo::ModelPlugin::PluginT()	Unclassified
72	UNINIT_CTOR	/home/drone/Dronecode/Upstream/gazebo-sitl/gzsitl/gzsitl_plugin.cc	gazebo::GZSitlPlugin::GZSitlPlugin()	Unclassified
--
Probably solved on general-fixes pull request:
67	MISSING_ASSIGN	/home/drone/Dronecode/Upstream/gazebo-sitl/gzsitl/gzsitl_plugin.hh	unknown	Unclassified
68	MISSING_COPY	/home/drone/Dronecode/Upstream/gazebo-sitl/gzsitl/gzsitl_plugin.hh	unknown	Unclassified
--
The other errors are not directly related with the gzsitl code.

LGTM


[Search] Ambiguous columns in 1-2 relations

Let's say a Match has 2 Teams. (Two BelongsTo relations to the same table)
I want to search on firstTeam.name and secondTeam.name
protected $searchableColumns = ['firstTeam.name', 'secondTeam.name'];

The resulting sql is :
SELECT *
FROM matchs
LEFT JOIN teams ON matchs.firstTeam_id = teams.id
LEFT JOIN teams ON matchs.secondTeam_id = teams.id

The search logic will be applied twice, both times on "teams.name", which is ambiguous.
The resulting sql should be :
SELECT *
FROM matchs
LEFT JOIN teams AS firstTeam ON matchs.firstTeam_id = firstTeam.id
LEFT JOIN teams AS secondTeam ON matchs.secondTeam_id = secondTeam.id

Simply set an alias to every duplicated table, using it's Laravel relation name, firstTeam and secondTeam in this case.
What do you think?

Sounds good, a PR maybe?

I had some time to start working on it. There are many use cases, but your tests pretty much cover them all, which will make things easier (thanks!). Here's a quick draft I made if you want to take a look :
lykegenes@139d378933c73d7f205aa126e5ec3496d3801b1c
I'll make the PR when all tests pass!


npm package missing version

Hello I installed jsPdf in my React-Widget and when its deployed these errors are generated in browsers console:
Missing dependency ':ERROR:Missing version constraints for pdfproyectoprueba$fs in package.json of<EMAIL_ADDRESS>of<EMAIL_ADDRESS>· Missing dependency ':ERROR:Missing version constraints for pdfproyectoprueba$path in package.json of<EMAIL_ADDRESS>of<EMAIL_ADDRESS>I generate my project with "yo liferay-js".
I have the next dependencies:
"devDependencies": {
"liferay-npm-bundler": "^2.18.8",
"liferay-npm-build-support": "^2.18.8",
"copy-webpack-plugin": "4.6.0",
"webpack": "4.29.6",
"webpack-cli": "3.3.0",
"webpack-dev-server": "3.2.1",
"babel-cli": "6.26.0",
"babel-preset-env": "1.7.0",
"babel-preset-react": "6.24.1",
"babel-loader": "7.1.5"
},
"dependencies": {
	"jspdf": "^2.1.1",

	"react": "16.8.6",
	"react-dom": "16.8.6"
},

Thank you for your help.

Wrong repo: this is the Themes Toolkit, not the JS Toolkit :-)
Please file your issue in https://github.com/liferay/liferay-frontend-projects/ and also provide more information like, for example, a github repo or ZIP file where the issue can be reproduced.
Thx.


it auto delete command after you click execute then click into query texteditor

like this:
1:create table Test(
2:id int,
3:joke char(20)
4:)
after click execute,and click into texteditor,click the 2th line.it will auto delete the last letter.
1:create table Test(
2:id int
3:joke char(20)
4:)
if you have choose the whole line,it will delete all.
and i found it lock the tab5 that is create after add new query windows
underfine#1 | underfine#2 | underfine#3 |  underfine#4 | underfine#5 | underfine#6
it just lock the underfine#5,i can't click into it.and it actually lock the underfine#6
i have to add new tab,and clock it ,so it will turn into last tab.

I cannot replicate this on the latest version (1.32.0). Not sure if I'm just failing to replicate, or if it's been fixed in the meantime.


Typo pagina 144

Op pagina 144 staat twee keer:
[[p ∨ q]]v = max([[p]]v, [[p]]v)
I.p.v.
[[p ∨ q]]v = max([[p]]v, [[q]]v)

Thanks @rubenvdz ! Next time, could you tell me the item number (this one is in 6.2.5.d) or line number in the .tex file? This makes it easier for me to spot the typo. Thanks :)


Fix hardcoded path in encrypted.asc

Thanks for the amazing guides!

Thanks for the PR @farwel. Great catch!
Updated guide is live at https://sunknudsen.com/privacy-guides/how-to-encrypt-sign-and-decrypt-messages-using-pgp-on-macos.

Thanks for the PR @farwel. Great catch!
Updated guide is live at https://sunknudsen.com/privacy-guides/how-to-encrypt-sign-and-decrypt-messages-using-pgp-on-macos.


Allow embedding resources into the HTML file using base64

Ideally, JResume should serve a single HTML file with all the pictures/css/fonts embedded in it using base64, like so:
http://www.htmlgoodies.com/beyond/webmaster/serving-up-base64-encoded-custom-fonts.html

This issue is no longer necessary due to the fact that JResume now uses the inliner npm package for inlining resources.


Expose ports for easier debugging

I'm happy to change the ports if it collides with anyone's docker containers, but this just makes it so much easier to open a postgresql shell etc. I keep making this change and then not committing it, so I figured it'd poll opinions on a PR.

happy for this to go in...i think default ports make sense

Cool. It might collide with linux-folk since you can use docker straight on your machine, and you might have PG running locally too?

Maybe don't use the default ports to avoid it colliding?

@astopy do you know what IP exposed ports bind to by default? If not <IP_ADDRESS>, can we make that so, would help accidentally exposing a database dump?

You can add the IP in the port specification (as IP:host_port:container_port). It’ll bind to <IP_ADDRESS> by default I think, but if you change it to <IP_ADDRESS> that’ll probably break for docker-machine.

On 2 Sep 2015, at 15:09, Marten Veldthuis<EMAIL_ADDRESS>wrote:
@astopy https://github.com/astopy do you know what IP exposed ports bind to by default? If not <IP_ADDRESS>, can we make that so, would help accidentally exposing a database dump?
—
Reply to this email directly or view it on GitHub https://github.com/zooniverse/Panoptes/pull/1324#issuecomment-137094358.

Just merging this then. Feel free to change the ports if it bugs anyone.


module 'tensorflow' has no attribute 'GraphDef'

I got the error from tensorflow: module 'tensorflow' has no attribute 'GraphDef'. My tensorflow version is 2.0.0, is it any quick way to fix it?

I have solved the problem by modifying to tf.compat.v1.GraphDef.

I have this error. It seems benepar can not be used with tensorflow 2.0.0

I also had this problem and based on this thread I created a pull request.
If the author takes a while to merge the request, you can install it manually with:
pip uninstall -y benepar
git clone https://github.com/plandes/self-attentive-parser
cd self-attentive-parser
python setup.py install

I also had this problem and based on this thread I created a pull request.
If the author takes a while to merge the request, you can install it manually with:
pip uninstall -y benepar
git clone https://github.com/plandes/self-attentive-parser
cd self-attentive-parser
python setup.py install


new client is now gracefully closed on error so that it releases its …

…end of the named osquery pipe/socket
Signed-off-by: Saurabh Singh<EMAIL_ADDRESS>

 Thank you for your submission, we really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.You have signed the CLA already but the status is still pending? Let us recheck it.


[9.x] WFLY-4757

Jira
https://issues.jboss.org/browse/WFLY-4757
https://issues.jboss.org/browse/WFLY-4779 (modcluster part here only)
Upstream
https://github.com/wildfly/wildfly/pull/7602

Windows Build 119 is now running using a merge of 42383b0e7d06597c01f17c37d5994b6cf1f7d1ab

Linux Build 117 is now running using a merge of 42383b0e7d06597c01f17c37d5994b6cf1f7d1ab

Linux with security manager Build 112 is now running using a merge of 42383b0e7d06597c01f17c37d5994b6cf1f7d1ab

Linux with security manager Build 112 outcome was SUCCESS using a merge of 42383b0e7d06597c01f17c37d5994b6cf1f7d1ab
Summary: Tests passed: 828, ignored: 319 Build time: 0:05:49

Windows Build 119 outcome was SUCCESS using a merge of 42383b0e7d06597c01f17c37d5994b6cf1f7d1ab
Summary: Tests passed: 2870, ignored: 374 Build time: 0:48:07

Linux Build 117 outcome was FAILURE using a merge of 42383b0e7d06597c01f17c37d5994b6cf1f7d1ab
Summary: Tests failed: 1 (1 new), passed: 2868, ignored: 374, muted: 1 Build time: 0:49:22
Build problems:
Failed tests detected
Failed tests
org.jboss.as.test.integration.ejb.client.descriptor.EJBClientDescriptorTestCase.testEJBClientContextConfiguration: <no details avaliable>

Linux with security manager Build 119 is now running using a merge of e7a7fadabc92f83f1eb4d0a704698115cd336ebf

Windows Build 126 is now running using a merge of e7a7fadabc92f83f1eb4d0a704698115cd336ebf

Linux Build 124 is now running using a merge of e7a7fadabc92f83f1eb4d0a704698115cd336ebf

Linux with security manager Build 119 outcome was SUCCESS using a merge of e7a7fadabc92f83f1eb4d0a704698115cd336ebf
Summary: Tests passed: 828, ignored: 319 Build time: 0:07:06

Linux Build 124 outcome was FAILURE using a merge of e7a7fadabc92f83f1eb4d0a704698115cd336ebf
Summary: Tests failed: 1 (1 new), passed: 2869, ignored: 374 Build time: 0:50:24
Build problems:
Failed tests detected
Failed tests
org.jboss.as.test.integration.ejb.stateful.passivation.PassivationTestCase.testPassivationMaxSize: <no details avaliable>

Windows Build 126 outcome was SUCCESS using a merge of e7a7fadabc92f83f1eb4d0a704698115cd336ebf
Summary: Tests passed: 2870, ignored: 374 Build time: 0:53:38

Unrelated failure.


Add org->feature mapping table

Overview
This PR adds a table for organization->feature mappings.
Checklist
- [ ] Styleguide updated, if necessary
- [ ] Swagger specification updated, if necessary

[x] Symlinks from new migrations present or corrected for any new migrations

Notes
The migration itself isn't terribly interesting, but rather the point of review should probably be whether this DB revision makes sense for the purposes of persisting feature flags per organization.
Testing Instructions

ensure that the migrations apply correctly
ensure that the DB change is reasonable and complete with respect to the goal outlined in #1408

Closes #1408

I pushed a revision after clarifying the use of the flags; the table keys off both the org and flag IDs and imposes a reference constraint on the respective tables.

This looks a lot better to me


ign -> gz Header Migration : ign-msgs

See https://github.com/ignition-tooling/release-tools/issues/711
Notes:

proto message definitions for gz and ignition will be installed alongside each other, but ONLY THE gz proto messages will result in code generation for sources and headers.
The entirety of the ignition headers are instantiated as redirection headers pointing to the gz version
The gz headers use the ignition namespace, pending namespace migration

All green!

Going with the deferred hard-tock option (B) with gz headers directing to ignition for now, and ignition being the "canonical" message definitions at the moment.

Gazebo builds.
Once we're ready, and namespaces have been migrated, we will then move forward with hard-tocking every message (and message header) to gz.


Renaming client because autorest in js isn't respecting the @client tag

Packages impacted by this PR
Issues associated with this PR
Describe the problem that is addressed by this PR
What are the possible designs available to address the problem? If there are more than one possible design, why was the one in this PR chosen?
Are there test cases added in this PR? (If not, why?)
Provide a list of related PRs (if any)
Command used to generate this PR:**(Applicable only to SDK release request PRs)
Checklists

[ ] Added impacted package name to the issue description
[ ] Does this PR needs any fixes in the SDK Generator?** (If so, create an Issue in the Autorest/typescript repository and link it here)
[ ] Added a changelog (if necessary)

/azp run js - healthdataaiservices

API change check
APIView has identified API level changes in this PR and created following API reviews.
@azure-rest/health-deidentification


Add support for RSA signing keys

To be rebased when either https://github.com/tarent/loginsrv/pull/145 or https://github.com/tarent/loginsrv/pull/144 is merged.

Coverage decreased (-0.05%) to 91.48% when pulling a850e5d2298aaaa01274b698ea68ac0e132789eb on kernle32dll:support-for-rsa-keys into f9eb4885ae5dd7e8e9a29da08efe163041ff5280 on tarent:master.

Coverage decreased (-0.05%) to 91.48% when pulling a850e5d2298aaaa01274b698ea68ac0e132789eb on kernle32dll:support-for-rsa-keys into f9eb4885ae5dd7e8e9a29da08efe163041ff5280 on tarent:master.


Failed to add IF conditions to kernel

Hello,
It fails when I try adding an IF condition in the kernel, such  as  grid(t+1, x, y, z) IS_EQUIV_TO v IF (v == constNum(1.0)). However, it works about grid(t+1, x, y, z) IS_EQUIV_TO v IF (z == last_index(z)). I think both IF conditions return the same type. Do you have any ideas about this problem? Thank you so much.

Variables in IF conditions can only be indices. They cannot be grid values.

Thanks for your help. Is there any way to emit "grid(t+1, x, y, z) IS_EQUIV_TO v " when the condition "v == constNum(1.0)" is true? I try another method like following code
if(v == constNum(1.0))
    grid(t+1, x, y, z) IS_EQUIV_TO v;

Even though it can be compiled and running, I do not think the method works. Thank you.

No, there is no way to make a grid update conditional on a value at this time.

BTW, it may be helpful to think of the code you write in the define() method as building up an expression as opposed to immediately evaluating it. This might help to explain why you can't expect a 'normal' if-statement to do what you want. You can see what expression you've created by running the stencil compiler (./foldBuilder) with the -ph  option (-ph '-' will print to stdout). This option will print out the expression in a human-readable text. It actually prints two versions--the first as one large expression, and the second with intermediate variables.

Thanks for your kind help. I check the code again and follow your instruction to see human-readable text. If-statement cannot be added to the kernel. Is it possible to add if-statement to other location where to get the output of the kernel in each time step ?

Sorry about the delayed response. Unfortunately, I don't understand what you need. Do you want to output the data, or are you trying to do something pro grammatically with it?

Thanks for your reply. I know I cannot add a 'normal' if-statement on the kernel but someimes we have to. So I try adding it into the other part instead of the kernel.

Closing due to lack of actionable tasks.


[Feature] 有考虑把vless子协议增加xtls-rprx-vision-udp443选项嘛

Verify steps

[X]  我已经在 Issue Tracker 中找过我要提出的请求 I have searched on the issue tracker for a related feature request.
[X]  我已经仔细看过 Documentation 并无法找到这个功能 I have read the documentation and was unable to solve the issue.

Description
希望为vless子协议添加xtls-rprx-vision-udp443。目前仅支持xtls-rprx-vision。
Possible Solution
No response

[X]  我已经仔细看过 Documentation 并无法找到这个功能 I have read the documentation and was unable to solve the issue.

呃呃

不好意思，眼瞎


Guidance for network latency between nodes

For remote AO node location prioritize based on lowest network latency.
If business reasons require location will high latency – consider using asynchronous  AO mode. (But see other limitations regarding async replicas.)
From internal bug 3906100

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 53d1da83-d988-fb2b-82c5-fd9cf117cd42
Version Independent ID: 2b1a3bd2-5116-1f21-c196-e3e5698a83c9
Content: SQL Server Always On - Configuration Manager
Content Source: sccm/core/servers/deploy/configure/sql-server-alwayson-for-a-highly-available-site-database.md
Product: configuration-manager
Technology: configmgr-other
GitHub Login: @aczechowski
Microsoft Alias: aaroncz

I'm closing this issue as it's addressed in the 1906 content that will publish soon.


Upgrade all "hack" tools to the latest version

What this PR does / why we need it:
continuation of #4094
chores:

remove kustomize (is now part of kubectl)
upgrade etcd
upgrade kube-apiserver
upgrade kubectl
upgrade staticcheck
upgrade jq
upgrade buildozer
upgrade helm
upgrade kind
upgrade to go 1.16.5
upgrade kube v1.21.2

/kind cleanup

/release-note-none

/ok-to-test

The kubernetes api-server in test/acme/dns/fixture.go stopped working after doing the upgrades.
Instead of fixing the custom implementation in that file, I merged that api-server with the server used for integration testing.
That implementation is based on controller-runtime/pkg/envtest.
Now this shared code lives in test/internal/....


what it's the better way to test an app using travis

I wrote a simple test from the example in README.md and pass in my computer but travis doesn't pass it beacuse the bin files doesn't exist on the github repo. I think the fast solution it's upload the binaries but there are so big files and doesn't look very elegant. Any oher idea about how to do this correctly?

I don't understand what you mean by bin files ? Like your application ?  Like what this has to do with Spectron...
And the test requires should be in the app.json and you should run npm install before running your tests.

I think you can do something like:
var electronPath = "./node_modules/.bin/electron";
var appPath = __dirname + "/main.js";
var app = new Application({
            path: electronPath,
            args: [appPath]
});

with the proper paths to you entry script and the electron binary.


NETOBSERV-926: Added key to kafka message for connection tracking consistency

Add keys to each kafka message. Kafka then ensure that all messages with the same key will be consumed by the same client.
We use src and destination IP as key so all messages from a connection will be consumed by the same transformer so connection tracking metrics will be accurate.

pls add to the PR the description to the issue and how this PR fix it too Thanks!!

Done, thanks.

/lgtm

/approve


FR: Allow for Auth Provider Configs to be set

At the moment it appears that only OIDC and SAML providers can be set via the Go client. Would be incredibly useful to add Firebase auth providers such as phone and email/password so that we can programmatically manage this with something like Terraform.
API
https://cloud.google.com/identity-platform/docs/reference/rest/v2/projects/updateConfig
Note
It appears that the Node SDK has this functionality available already.

I think this was already implemented in #344
https://pkg.go.dev/firebase.google.com/go/v4/auth#UserToUpdate.ProviderToLink
@ToeFungi can you check if this meets your needs?

@hiranya911 if I'm understanding the documentation correctly, that enables the provider against a specific user?
We're looking to enable Phone and Email/Password auth providers at the project level. I'm not sure if that implementation handles project level enabling of the providers?

Ah, that's more of a project management operation.
@bojeil-google wdyt?

I think this is part of bigger project to configure built-in providers (email/password, email link, phone, social providers, etc) at project level as well as tenant level. We have been wanting to do this for a while but this needs product approval.

We created a custom client and Terraform provider to accomplish this in the mean time. Would be ideal if this was added officially though.

Customer here. Not sure why the API isn't comprehensive of the REST API.


Update dependency: deps/k (manual)

Subsumed by: https://github.com/runtimeverification/evm-semantics/pull/1221


Design Clarification / documentation Issue

I have been trying to get the GPS function to work but always get “Waiting for GPS”. I have checked the GPS and Wiring  as per your Diagram for GPS connections  GPIO 0 and GPIO 1 for Tx and Rx ( on Pico) respectfully. The GPS is outputting NEMA sequencies correctly.
Looking in the code for GPStime.c you have:
// Set up our UART with the required speed & assign pins.
uart_init(uart_id ? uart1 : uart0, uart_baud);
gpio_set_function(uart_id ? 8 : 12, GPIO_FUNC_UART);
gpio_set_function(uart_id ? 9 : 13, GPIO_FUNC_UART);
Is this correct ? as it would indicate different pins for UART0 being used compared to diagram.
Best Regards Simon G8HAM

GPS is connected to GPIO 12,13.
Regards, Ondra

Hello, everyone!
You've found a bug in documentation, thank you very much!
That's weird, but I have the board soldered in accordance with the schematic and it's been working. That might be owing to UART0 internal mapping (TX to GPIO0 & GPIO12, RX to GPIO1 & GPIO13).
I'll close this issue when it's fixed.
Many thanks,
Roman
73, 72s!


Fix cat state function array type without doing casting

Solves issue https://github.com/XanaduAI/strawberryfields/issues/554

Hi @tguillaume : I have fixed the bug you found by multiplying a bu 1.0 to automatically convert things to floats. I'd prefer this strategy to casting the "photon numbers" into floats.

Hey @nquesada, I think this does the trick nicely. Cheers!


Mnemonic: Exposing word lists and adding checksum validation.

Requirements

Filling out the template is required. Any pull request that does not include enough information to be reviewed in a timely manner may be closed at the maintainers' discretion.

Description of the Change
I've expose the Mnemonic word lists, so that wallets can present them. Imagine a Restore Account with Mneemonic-flow inside a wallet, where user needs to manually input the mnemonic, if we know the language, we can now present suggestions based on input and the word list. i.e. with user types "ca" we can display all words starting with "cat" (["cat", "catalog", "catch", "category", "cattle"]) to the user.
In accordance to BIP39 guidelines, I've added support for mnemonic checksum:

Although using a mnemonic not generated by the algorithm described in "Generating the mnemonic" section is possible, this is not advised and software must compute a checksum for the mnemonic sentence using a wordlist and issue a warning if it is invalid.

Checksum validation is by default turned on, so this initializer:
// "try" needed, since we are passing a throwing closure (default argument), performing validation
try Mnemonic.seed(mnemonic: words)

is performing checksum validation, and throws an error if the mnemonic is not checksummed. I made this initializer rethrowing, which is neat because then we can get a non-throwing version of the same init by using this
// no "try" needed, since non throwing closure passed, thus initialiser is not (re-)throwing.
Mnemonic.seed(mnemonic: words) { _ in }

The checksum validation implementation is inspired by this python code, which I refer to in the function.
Alternate Designs
We could all together remove the validation closure for the function Mnemonic.seed....
Benefits
We can now present user with the warning about non checksummed mnemonics! Which the BIP39 suggests.
Possible Drawbacks
In order to make the code for the checksum validation as clean as possible I introduced two types, UInt11 and BitArray, resulting in more code, but shorter and more clear implementation of the validation method.
Applicable Issues
Mainly good for wallets, using mnemonic. Validation might also be good for (backend)services.

@usatie let me know if you want me to change file headers (probably right?)

@Sajjon
Thanks for your PR!
Yes, I want you to change the file header, and also please pass all the test both on apple platforms and Linux.
CI should be green 👍
https://travis-ci.org/yenom/BitcoinKit/jobs/586104674

I recommend you to re-create your branch from the current yenom/master branch.
And then, add your files and changes.
In other words, I prefer rebase master over merge master.
Commit history with a lot of merge commits and unrelated commits like 9331179 and 83e9ab0 is not  recommended.

@usatie Fixed!
However CI is failed, that is because Travis CI-pipeline is using Xcode 10.3, it needs to be using XCode 11 (GM seed 2 is available).

Thank you for your change!
Oh, you want to use Self, right?
Actually, I ran into the same error just a minute ago in my branch and fixed :D
I think forcing all users to Xcode11 is too early, can you fix the part to pass the test with Xcode10.3?

You can debug the test on Linux by swift test command :D

@usatie So! I think I've fixed everything, also, thanks to the two new types UInt11 and BitArray, I've managed to do a major cleanup of Mnemonic Generation, from this (IMO) not-so-readable code:
Earlier
internal static func generate(entropy: Data, language: Language = .english) -> [String] {
    let list = wordList(for: language)
    var bin = String(entropy.flatMap { ("00000000" + String($0, radix: 2)).suffix(8) })

    let hash = Crypto.sha256(entropy)
    let bits = entropy.count * 8
    let cs = bits / 32

    let hashbits = String(hash.flatMap { ("00000000" + String($0, radix: 2)).suffix(8) })
    let checksum = String(hashbits.prefix(cs))
    bin += checksum

    var mnemonic = [String]()
    for i in 0..<(bin.count / 11) {
        let wi = Int(bin[bin.index(bin.startIndex, offsetBy: i * 11)..<bin.index(bin.startIndex, offsetBy: (i + 1) * 11)], radix: 2)!
        mnemonic.append(String(list[wi]))
    }
    return mnemonic
}

Now
    static func generate(
        entropy: Data,
        language: Language = .english
    ) throws -> [String] {

        guard let strength = Mnemonic.Strength(byteCount: entropy.count) else {
            throw Error.unsupportedByteCountOfEntropy(got: entropy.count)
        }

        let words = wordList(for: language)
        let hash = Crypto.sha256(entropy)

        let checkSumBits = BitArray(data: hash).prefix(strength.checksumLengthInBits)

        let bits = BitArray(data: entropy) + checkSumBits

	let wordIndices = bits.splitIntoChunks(ofSize: Mnemonic.WordList.sizeLog2)
            .map { UInt11(bitArray: $0)! }
            .map { $0.asInt }

        let mnemonic = wordIndices.map { words[$0] }

        try validateChecksumOf(mnemonic: mnemonic, language: language)
        return mnemonic
    }

Which gives a much more clear intent of what is going on, and also avoids this long and actually completely unreadable oneliner: let wi = Int(bin[bin.index(bin.startIndex, offsetBy: i * 11)..<bin.index(bin.startIndex, offsetBy: (i + 1) * 11)], radix: 2)!
Apart from that we also perform checksum assertion and length of entropy assertion, with clear errors thrown.
Feedback is most welcome!

@usatie also added IDETemplateMacros.plist, to enforce same file header for all collaborators.

Finally found all compilation errors caused by Swift 5.1 (Xcode 11) syntax. So now Travis passes all tests :D


xExtents does not work in some cases

Hey @rrag, we would love to have your opinion on a bug we are having.
I reproduced it on this branch https://github.com/rrag/react-stockcharts/tree/bugDomain, run npm run watch and open http://localhost:8080/documentation.html#/line_scatter
You will see that:

note that the first point is 9.11am. the xExtents however start at 9am.
const minDate = new Date(1480579255864); // Thu Dec 01 2016 09:00:55 GMT+0100
const maxDate = new Date(1480580777028); // Thu Dec 01 2016 09:26:17 GMT+0100
xExtents={[minDate, maxDate]}

The points before 9.11am are displayed as you can see if you drag the chart:

We found it that using plotFull props on ChartCanvas will work but is not performant when zooming.
Thanks for your help, it means a lot to us :)
CC @dbrugne

Maybe number of points from xExtents interval is more than a maximum amount of points that can be displayed? Take a look at these lines

thanks @iNikNik it is possible
if it is due to that, the logs would tell, enable logs like
localStorage.debug = "react-stockcharts:*"

We are indeed in the case where there are too many points to display:

Trying to show 1523 in 467px, I can show up to 840 in that width. Also FYI the entire chart width is 468px

We are going to think about a way to customize that number instead harcoding it.

what value pointsPerPxThreshold did you end up with for you app?

@rrag I'm using this PR too. On chart below pointsPerPxThreshold = 6:

...and about 7k points. It's pretty extreme amount, but looks very nice.
I believe we should use lower values with candles, but, anyway - @shprink big big thanks for this :+1:

wow that is a lot. but looks good.
pan actions fast?
I have been thinking a default of 3 is better

@rrag yep, pan is ok. Also - my chart is real-time with 1s update rate - and there is some lags during rerender. But I think it is ok. Usually, you never need this amount of points on a real-time chart)

For us the requirement is pointsPerPxThreshold = 4 maximum.
@iNikNik we also need live charts here and it works great too!
I was wondering how you created the following:

I have the same thing to do :P

@shprink It's not a part of the chart.. just html + css. For my purposes it is easier to customize for different chart types:


Adding Hover effect on Card buttons

Hey @aswathcm29 In your website, there is no hover effect on the cards, we can improve the user experience by adding a smooth hover effect on buttons

Hey @aswathcm29 i can help you to add hover effect on card buttons, could you please assign me this issue


Use advanced-issue-labeler action for issue labeling

Similarly to https://github.com/blueedgetechno/win11React/pull/617

Update Issue-text.yml to be more secure and use more suitable action.
Instead of actions-ecosystem/action-add-labels action I added redhat-plumbers-in-action/advanced-issue-labeler action that is more suitable for use with issue forms. It provides so useful helpers to label issues based input provided via issue form.
Note: I added the Other Browser option to the block list, so if the user chooses this option no label will be set. Do you prefer original behavior?

⌛ Deploy Preview - Build in Progress


Dual SIM info

Expected behaviour
There are a lot of devices that support more than one SIM. The plugin my return an object or array with info for all the SIMs
Actual behaviour
Currently the SIM info is for one sim only.

[ #] Android device

I am using

[ #] cordova
[ #] ionic 2

Hardware models
YU YUREKA
OS versions
Android 5.1.1
I've checked these

[ #] It happens on a fresh Cordova CLI project as well.
[ ] I'm waiting for deviceready to fire.
[ ] My JavaScript has no errors (window.onerror catches nothing).
[ ] I'm using the latest cordova library, Android SDK, Xcode, etc.

So how can we reproduce this?
Provide the used components versions (cordova, ionic, etc).
I used Ionic 2 along with Ionic native extensions.

Hi pointdeveloper,
please check latest version 1.3.0
I would be happy to see here the sim plugin response of your device. It helps me to test and develop this plugin.
thanks

I have an Android 4.4.2 dual sim ( NGM Forward Xtreme ).
I get all data of first sim and when I switch off first sim I get cached data of first sim or nothing.
In all the case I can't get info about second sim.
First sim switched off ret values
{
"carrierName": "",
"countryCode": "",
"mcc": "",
"mnc": "",
"deviceId": "1234567890123456",
"callState": 0,
"dataActivity": 0,
"networkType": 0,
"phoneType": 1,
"simState": 0,
"isNetworkRoaming": false,
"deviceSoftwareVersion" : "78"
}

Check https://github.com/pbakondy/cordova-plugin-sim#under-the-hood
Multiple sim handling requires Android API 22

Hi @pbakondy,
My latest version of the plugin cordova-plugin-sim is 1.3.2
and
my API Level 22, Lollipop 5.1.
I am not able to get multiple sims info. How can i get it?
Please help

you have to request permission first

Oh..ok k
I am getting upto the cards label but not cards info...I thought i already have request permission

See the below response of mine...

See below pic for more info about my issue

Could u please assist me @pbakondy ?
Is it clear? or do u need more info?
Please...

Try latest release: v1.3.3
I adjusted the API level requirements.

Thank you so much.... @pbakondy

@pbakondy phone Numbers are not written on the SIM Cards, You need to set it using an iphone (easiest method) or via stock android or a SIM writer utility.


403 Forbidden

I'm using Android variant of the library. Following link doesn't work
https://www.masterclass.com
I tried setting up the user agent by System.getProperty("http.agent"). But, no luck.
Any help is appreciated.

Fixed with the new version.


Bug: MaxStrLen not usable in runtime 2.0

Describe the bug
I have updated ALC.exe to version 2.0.52543. Now the compiler tells me that MaxStrLen is only supported on runtimes 3.0 or greater. I need to have runtime set to 2.0 in order to be able to deploy my extension to BC OnPremise.
To Reproduce
... just try to use MaxStrlen somewhere in the code. It happens on variables (fixed and variable length) as well as on fields.
Expected behavior
It should work, I guess? It's been there since ... forever.
Versions:

AL Langauge: 2.0.52543
Business Central: IT Dynamics NAV 13.0 (24630)

Hi @hemisphera ! This has been fixed in master.

CodeCop AA0139 doesn't detect the use of MAXSTRLEN. Instead you need to revert to a fixed value for the length instead.


Black screen when anti-aliasing is enabled when deploying to Oculus Quest

Godot version
4.1.1.stable
System information
Godot v4.1.1.stable - Windows 10.0.19045 - Vulkan (Mobile) - dedicated NVIDIA GeForce GTX 1060 (NVIDIA; <IP_ADDRESS>37) - Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz (8 Threads)
Issue description
When deploying a scene using remote debug, the scene shows up as as black on the Quest 2. This happens when any value above MSAA3D Disabled (Fastest) is set. I.e if  MSAA3D is Disabled, the scene runs with jaggies. If value is 2x, 4x, 8x, the scene renders all black
Steps to reproduce
Here is a minimal project that will demonstrate the problem
https://github.com/skooter500/Test-Godot-XR
Remote debug will deploy the scene to the quest, which is just a grey plane. However if you go to project settings and set anti-aliasing to any of the settings and do a remote depoly, you get a black screen on the quest
Minimal reproduction project
https://github.com/skooter500/Test-Godot-XR

Thanks for the report! Consolidating in https://github.com/godotengine/godot/issues/73384.


(GH-128) Add the ability to comment on issues during publish

Description

This PR adds the ability to add a comment on closed issues (for a milestone/tag name) during the release publishing process.
Related Issue

fixes #128
Motivation and Context

The motivation is to allow users of GRM to update users posting fixed issues that the changes is now part of the new release.
How Has This Been Tested?

Tested by running GRM Locally, see the last comments on the following issues in a test repository: https://github.com/AdmiringWorm/FakeTestRepository/issues
Screenshots (if appropriate):
Checklist:

[x] My code follows the code style of this project.
[x] My change requires a change to the documentation. (Not completely sure if changes are needed)
[ ] I have updated the documentation accordingly.
[x] I have read the CONTRIBUTING document.
[x] I have added tests to cover my changes. (Partially, not sure how to add changes for the github client specific changes)
[x] All new and existing tests passed.

Additional Notes
I was a little unsure if the place to add this code should be during publishing, or during the closing of the milestone.
For now, I have added it during publishing but can change it to closing if that is more appropriate.

Changed to WIP until decided if this addition should be during publish, or during milestone closing.

@AdmiringWorm other than a couple minor things, this looks good to me!

@gep13 I started thinking after I opened the PR on whether commenting on issues actually should happen during the publish process, or if it perhaps should happen during the closing of the milestone instead. Thoughts?

Hmm, that is an interesting question...
From a purely selfish point of view, having it on the Publish command wouldn't actually be useful, since we (Cake.Recipe) never call the publish command, but rather only the create, and then we manually publish the release through GitHub, and then call the close milestone task.
This is actually a larger discussion having looked at how GitLab works, since there isn't a concept of a draft release over there.  When you create the release, it straight away creates the tag, so I am wondering if we also need to handle the commenting of the issues on the create command as well.
I will have to mull this one over a little bit...
Doing it on the close milestone would work in both scenarios...

From a purely selfish point of view, having it on the Publish command wouldn't actually be useful, since we (Cake.Recipe) never call the publish command, but rather only the create, and then we manually publish the release through GitHub, and then call the close milestone task.

That is actually why I started thinking about it 😄

This is actually a larger discussion having looked at how GitLab works, since there isn't a concept of a draft release over there. When you create the release, it straight away creates the tag, so I am wondering if we also need to handle the commenting of the issues on the create command as well.

While there aren't a concept of a draft release like there is on github, they have something remotely similar.
You can create an upcoming release by setting the released date to somewhere in the future.
It isn't the same, but is maybe something that can be used.
Commenting on the create command sounds wrong IMO as nothing is really released yet, however this can be implementation specific depending on the workflow in the different providers perhaps.

@AdmiringWorm said...
Commenting on the create command sounds wrong IMO as nothing is really released yet

I tend to agree with this.

@AdmiringWorm said...
You can create an upcoming release by setting the released date to somewhere in the future.

Yip, I saw this as well.  Will have to think about how the "flow" would work with this.
Having thought about this, I think the correct way forward would be one of two things...

Create a new command for closing issues
Close the issues when closing a milestone

Having thought about this, I think the correct way forward would be one of two things...

Create a new command for closing issues
Close the issues when closing a milestone

Option 2 would kind of be in conflict with the issue #55 (Which I planned to look into next.
Option 1 could perhaps be useful, but I still think the comment code should also be when closing milestones (instead of during publish as I have done here).

@AdmiringWorm apologies... when I said:

Close the issues when closing a milestone

I meant...

Comment on the issues when closing a milestone

@AdmiringWorm I have updated the comment with what I actually meant.

Yeah, I agree with that. I will change the existing code to work on the close command instead.

I have rebased the PR with changes to add comments during milestone closing (and the typos you mentioned yesterday).
I haven't yet added changes to the detection of already added comments as I need to think a little about how to best detect this. (I am thinking of checking for a hidden inline comment for this, but not yet decided).

I went ahead with having some hidden text in the release comment,
The result can be seen here:

Issue already containing the hidden text: https://github.com/AdmiringWorm/FakeTestRepository/issues/3
Issue without hidden text: https://github.com/AdmiringWorm/FakeTestRepository/issues/1

Here is also the output from GRM with these changes:

@AdmiringWorm your changes have been merged, thanks for your contribution 👍


Timezones / DST handling

Per recent e-mail on STC-social:

possibly as a result of DST), all the shifts seem to be shifted up by an hour. ... I should clarify that this is just the times under "my upcoming shifts". They're all one hour earlier than they're supposed to be scheduled.

@dgoerger says:

I'm guessing it's because My Upcoming Shifts (claims to) use UTC, without any obvious time zone correction. It might also be wrong because today's technically 25 hours long---not sure. Hopefully it'll right itself after midnight tonight?

We should investigate.

Hi guys, we recently dealt with similar stuff in Reservations, take a look and see if any of this is helpful!


Mechanism for reading current build filenames/CDN strings

Library Affected:
all
We should come up with some methods, perhaps part of a utility package separate from any of the modules, that could be called to return some strings related to our build/release process:

Return the current list of supported NODE_ENV values ('dev', 'production')
Given a NODE_ENV value and a module name, return a URL string corresponding to the expected CDN URL.
Given a NODE_ENV value and a module name, return a URL string corresponding to the expected module filename.

I'll work on this after the initial PR lands.

This should be all good with changes to workbox-build to get the CDN urls for a module.


GRSciColl - searching for country field text does not return expected results

On the search page (https://www.gbif.org/grscicoll/institution/search?) querying for the string displayed for UK collections "United Kingdom of Great Britain and Northern Ireland" returns no results.

The problem is that the API do not have an option to take translation of enumerations into account. For example the french site will show the french names. But searching by the french names will give no results as the API is english and further work with country codes.
https://www.gbif.org/fr/grscicoll/institution/search?q=United Kingdom&offset=0
The only reason there are any results for "united kingdom" is because the description field includes those words.
We have these options as far as I can see:

The API will be multilingual and use the translation files to enrich the records so searching for Royaume-Uni will give results when on the french site.
We extend search to use more structured fields (like a dedicated country filter just like in occurrence search).

I suspect we will opt for the latter when we rewrite this page at some point. When we adopted GrSciColl we only had free text search. Since then more options have been added to the API, but not the UI.
I'm going to leave this open as a feature request for structured search on specific fields (e.g. country, city etc)


How do you manage translations life cycle management when the model is modified ?

Hello,
Thank you for this interesting tool. It looks great for the first time we run the translations. How do you manage translations life cycle management when the model is modified ? Do we need to translate the whole model each time and perform a control over each translation even the ones we already corrected ?
Do you plan to translate also visuals strings ?
Regards
Didier Terrien

Hi Didier, the command-line tool (MTCmd) is probably the best choice for ALM. Whenever you modify the model, export all the locales using a small script, perhaps using the same export folder. Existing files will be overwritten. The changes should then be caught by your ALM system. At this point, you have the old translations for objects that still exist in the model plus empty translation fields for new objects in the csv file(s). Using your favorite translation tool, you would then add any missing translations to your csvs, and then re-import. You can choose to keep the old translations or overwrite everything on import. The latter is a good choice if you modified existing translations along with new ones.
Note that the tool can also take an arbitrary list of translations, as long as the CSV format is OK. If the order of the original strings does not match what's in the model, the tool will just look up the string in the csv file and if it finds a perfect match, it will apply the translation. So you could maintain a global list of strings for all your models, and import that whenever a model was modified and new translations were added. Then you'd implement perhaps a separate ALM repo for just the CSVs separate from your models. Maybe you end up with 10,000 or so translated terms. It wouldn't hurt to import those into any new model you create. The tool adds the locales and takes whatever translations it finds. Then export the locales, and check what strings still don't have a translation, add those, and re-import. Done. I think that's the most effective way to go about this.
Hope this helps.
Cheers,
Kay

Thank you Kay. That's clear !
Regards


Add sprig library in FuncMap for traefik templates

Currently traefik define some default functions for templates:
https://github.com/containous/traefik/blob/a7ec7859944a712e875c3db5e9b4bf5dd370bc23/provider/provider.go#L63-L67
Those functions limits the "logic" that can be implemented when defining custom templates. It would be super useful to include sprig template library into traefik to have more powerfull templating system.
(https://github.com/Masterminds/sprig).
This would mean that, for the current functions:

"replace" function could be removed from provider.go and use the one provided in sprig library
"tolower" could be renamed to "lower" and use the function provided in sprig library
"contains"  function could be removed from provider.go and use the one provided in sprig library

I would be happy to open a PR with those changes if you think it's a good idea

Every time someone does not respect the issue's template, a little bunny dies.

Please edit your issue description to respect the issue template as more as possible.


[Doc]--Update BookKeeper config

Fixes #7481
Motivation
Default bookkeeper conf that ships with apache pulsar indicates that the unit of openLedgerRereplicationGracePeriod is in seconds, but official bookkeeper doc(and code) mentions that the unit is in milliseconds.
Pulsar should configure default as 30000 instead of 30 and bookkeeper.conf should mention that the unit of this period is milliseconds instead of seconds.
Modifications

Update the bookkeep.config file
Update the following Pulsar docs for releases 2.5.2, 2.6.0, 2.6.1, and master

Reference > Pulsar Config > BookKeeper

@jiazhai , please help review the PR.


Issues/70

added version check to startup scripts

Last run was done during URS maintenance window. lots of failures and will re-run


Add _checkfork() in S3.open as a foolproof (fix #174)

This PR adds _checkfork() in S3.open to prevent function call under a multiprocessing situation. Fixes #174.

/test

/test


Request: Pulsefire Caitlyn

In Caitlyn's Pulsefire skin, there could be a method of changing the shapes of her weapon.

#1


Falco crash after few minutes on GKE 1.27 on COS

Describe the bug
Hi
We are instaling Falco on one of cluster in 1.27.11-gke.1062004 with container optimized OS for GKE kernel 5.15.146+ and we face regular CrashLoopBackOff of each falco-no-driver:0.38.1 to install driver ebpf.
--
How to reproduce it
It is deployed using the Helm chart latest (falco 0.38.1) as deamonset, on a GKE cluster running Kubernetes 1.27..
The falco config is
        initContainers:
        - name: falco-driver-loader
          image: docker.io/falcosecurity/falco-driver-loader:0.38.1
          imagePullPolicy: IfNotPresent
          args:
            - ebpf
          securityContext:
            privileged: true
          volumeMounts:
            - mountPath: /root/.falco
              name: root-falco-fs
            - mountPath: /host/proc
              name: proc-fs
              readOnly: true
            - mountPath: /host/boot
              name: boot-fs
              readOnly: true
            - mountPath: /host/lib/modules
              name: lib-modules
            - mountPath: /host/usr
              name: usr-fs
              readOnly: true
            - mountPath: /host/etc
              name: etc-fs
              readOnly: true
          env:
            - name: HOST_ROOT
              value: /host
            - name: FALCOCTL_DRIVER_CONFIG_UPDATE_FALCO
              value: "false"

After few minutes, the container crash (exitCode: 1), here is a container log:
2024-07-10 02:23:08 ERROR no supported driver found for distro: cos, kernelrelease , kernelversion #1 SMP Sat Feb 17 13:12:02 UTC 2024, arch x86_64
2024-07-10 02:23:08 INFO  Running falcoctl driver install
├ driver version: 7.2.0+driver
├ driver type: modern_ebpf
├ driver name: falco
├ compile: true
├ download: true
├ target: cos
├ arch: x86_64
├ kernel release:
└ kernel version: #1 SMP Sat Feb 17 13:12:02 UTC 2024`
Expected behaviour
No crash :)
Screenshots

Environment
Helm chart latest (falco 0.38.1 ) as deamonset, on a GKE cluster running Kubernetes 1.27.
Wed Jul 10 09:33:17 2024: Falco version: 0.38.1 (x86_64)
Wed Jul 10 09:33:17 2024: Falco initialized with configuration files:
Wed Jul 10 09:33:17 2024:    /etc/falco/falco.yaml
Wed Jul 10 09:33:17 2024: System info: Linux version 5.15.0-113-generic (buildd@lcy02-amd64-017) (gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #123~20.04.1-Ubuntu SMP Wed Jun 12 17:33:13 UTC 2024
Falco version: 0.38.1
Libs version:  0.17.2
Plugin API:    3.6.0
Engine:        0.40.0
Driver:
API version:    8.0.0
Schema version: 2.0.0
Default driver: 7.2.0+driver
Cloud provider or hardware configuration: GKE cluster running Kubernetes 1.27.
OS: cos_containerd
Kernel: Linux 5.15.146+

Hi! Thanks for opening this issue! Can you share the logs from the falco container, if any?

Tue Jul 16 06:40:20 2024: Using deprecated config key 'rules_file' (singular form). Please use new 'rules_files' config key (plural form). Tue Jul 16 06:40:20 2024: Falco version: 0.38.1 (x86_64) Tue Jul 16 06:40:20 2024: Falco initialized with configuration files: Tue Jul 16 06:40:20 2024:    /etc/falco/falco.yaml Tue Jul 16 06:40:20 2024: System info: Linux version 5.15.154+ (builder@98a8fd0ef88f) (Chromium OS 15.0_pre458507_p20220602-r18 clang version 15.0.0 (/var/tmp/portage/sys-devel/llvm-15.0_pre458507_p20220602-r18/work/llvm-15.0_pre458507_p20220602/clang a58d0af058038595c93de961b725f86997cf8d4a), LLD 15.0.0) #1 SMP Thu Jun 27 20:43:36 UTC 2024 Tue Jul 16 06:40:20 2024: Loading rules from file /etc/falco/falco_rules.yaml Tue Jul 16 06:40:21 2024: Loading rules from file /etc/falco/falco_rules.local.yaml Tue Jul 16 06:40:21 2024: Hostname value has been overridden via environment variable to: gke-falco-cluster-default-pool-ca977e8c-qrcf Tue Jul 16 06:40:21 2024: The chosen syscall buffer dimension is: 8388608 bytes (8 MBs) Tue Jul 16 06:40:21 2024: Starting health webserver with threadiness 2, listening on <IP_ADDRESS>:8765 Tue Jul 16 06:40:21 2024: Loaded event sources: syscall Tue Jul 16 06:40:21 2024: Enabled event sources: syscall Tue Jul 16 06:40:21 2024: Opening 'syscall' source with BPF probe. BPF probe path: /root/.falco/falco-probe-bpf.o Tue Jul 16 06:40:21 2024: An error occurred in an event source, forcing termination... Error: can't open BPF probe '/root/.falco/falco-probe-bpf.o' Events detected: 0 Rule counts by severity: Triggered rules by rule name:
this error because pods falco-driver-loader is't running to building driver. for log falco-driver-loader, this
2024-07-16 06:39:54 ERROR no supported driver found for distro: cos, kernelrelease , kernelversion #1 SMP Thu Jun 27 20:43:36 UTC 2024, arch x86_64 2024-07-16 06:39:55 INFO  Running falcoctl driver install                       ├ driver version: 7.2.0+driver                       ├ driver type: modern_ebpf                       ├ driver name: falco                       ├ compile: true                       ├ download: true                       ├ target: cos                       ├ arch: x86_64                       ├ kernel release:                       └ kernel version: #1 SMP Thu Jun 27 20:43:36 UTC 2024 2024-07-16 06:39:55 INFO  No artifacts needed for the selected driver.

Opening 'syscall' source with BPF probe. BPF probe path: /root/.falco/falco-probe-bpf.o

The weird thing is that falco container is using bpf driver, while falco-driver-loader is (correctly) using modern_ebpf driver.
You only need to deploy falco specifying either the default (automatic driver selection) or
initContainers:
        - name: falco-driver-loader
          image: docker.io/falcosecurity/falco-driver-loader:0.38.1
          imagePullPolicy: IfNotPresent
          args:
            - modern_ebpf

See https://github.com/falcosecurity/charts/tree/master/charts/falco#deploying-falco-in-kubernetes (the modern_ebpf part):
helm install falco falcosecurity/falco \
    --create-namespace \
    --namespace falco \
    --set driver.kind=modern_ebpf

I already to deploy at initcontainer falco-driver-loader choose ebpf, but i dont know this container showing modern_ebpf. This setup manifest on initContainers.
      initContainers:
        - name: falco-driver-loader
          image: docker.io/falcosecurity/falco-driver-loader:0.38.1
          imagePullPolicy: IfNotPresent
          args:
            - bpf
          securityContext:
            privileged: true

Having a similar issue with a Raspberry Pi cluster after upgrading both the Kernel and Falco.

I'm trying to downgrading version falco(v0.36.2) the pods falco-driver-loader:0.36.2 are running to building driver but falco container getting error(not running)
Wed Jul 17 04:20:48 2024: Opening 'syscall' source with BPF probe. BPF probe path: /root/.falco/falco-bpf.o
-- BEGIN PROG LOAD LOG --
processed 43798 insns (limit 1000000) max_states_per_insn 1 total_states 4061 peak_states 4061 mark_read 1921

-- END PROG LOAD LOG --
Wed Jul 17 04:20:51 2024: An error occurred in an event source, forcing termination...
Error: libscap: bpf_load_program() event=raw_tracepoint/filler/sys_procexit_e: Operation not permitted

@Anthares101

Looks like you may have a permissions issue? Some kind of admission control in place/restrictive seccomp config to limit what syscalls the pods are allowed to use perhaps?
At least looks like the driver not compiling is fixed, I dont know what changed in the updated Falco chart for this to happen

@judikag03 @judika03 could you share your helm values file? or at least the variables that you customized, if any.

@alacuku this container manifest falco
 - name: falco
          image: docker.io/falcosecurity/falco-no-driver:0.37.0
          imagePullPolicy: IfNotPresent
          resources:
            limits:
              cpu: 1000m
              memory: 1024Mi
            requests:
              cpu: 100m
              memory: 512Mi
          securityContext:
            privileged: true
          args:
            - /usr/bin/falco
            - --cri
            - /var/run/docker.sock
            - --cri
            - /run/containerd/containerd.sock
            - --cri
            - /run/crio/crio.sock
            - -pk
          env:
            - name: HOST_ROOT
              value: /host
            - name: FALCO_HOSTNAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: FALCO_K8S_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: FALCO_BPF_PROBE
              value: "/root/.falco/falco-probe-bpf.o"
            - name: SYSDIG_BPF_PROBE
              value: "/root/.falco/falco-bpf.o"
          tty: false
          livenessProbe:
            initialDelaySeconds: 60
            timeoutSeconds: 5
            periodSeconds: 15
            httpGet:
              path: /healthz
              port: 8765
          readinessProbe:
            initialDelaySeconds: 30
            timeoutSeconds: 5
            periodSeconds: 15
            httpGet:
              path: /healthz
              port: 8765

i use command to install falco,
    --create-namespace \
    --namespace falco \
    --set driver.kind=ebpf

I have been testing a bit in my cluster, I'm able to install the Falco chart up to the 4.3.1 version. Using any chart version higher than that results in the Falco pods crashing with the initial error reported in this issue while building the driver:
* Setting up /usr/src links from host
2024-07-17 18:19:43 ERROR no supported driver found for distro: debian, kernelrelease , kernelversion #1642 SMP PREEMPT Mon Apr  3 17:24:16 BST 2023, arch aarch64
2024-07-17 18:19:43 ERROR no supported driver found for distro: debian, kernelrelease , kernelversion #1642 SMP PREEMPT Mon Apr  3 17:24:16 BST 2023, arch aarch64

Are you able to replicate this @judika03?

yes. it similar issue if using version 0.38.1.
2024-07-16 06:39:54 ERROR no supported driver found for distro: cos, kernelrelease , kernelversion #1 SMP Thu Jun 27 20:43:36 UTC 2024, arch x86_64

i testing if using falco-driver-loader:0.36.2 to building driver is succes, not have issue like that.  but falco-no-driver:0.36.1 container getting error(not running). @Anthares101

The problem is that, as it can be seen from your outputs, kernelrelease is being discovered empty.
Fact is, falcoctl uses standard syscall uname to fetch the kernelrelease (https://github.com/falcosecurity/falcoctl/blob/main/pkg/driver/kernel/kernel_linux.go#L30) , unless someone is enforcing an empty kernelrelease (https://github.com/falcosecurity/falcoctl/blob/main/pkg/driver/kernel/kernel_linux.go#L44).
Can you share the kernelrelease from the nodes? uname -r will do the trick!
Thank you, perhaps we got a bug somewhere in that helper function!

 In this case, our aforementioned helper function is not able to properly decode it, thus kernelrelease will be mapped as empty. Will fix it asap :)

I hope this bug can be fixed, thank you

https://github.com/falcosecurity/driverkit/pull/355 fixes our kernelrelease matching regex to support COS kernels ;) I also added a test to avoid future failures.
Once that is merged i will port it to falcoctl and next Falco version will be released with a fixed falcoctl (it is expected by the end of the month!)

/milestone 0.39.0

Falcoctl PR with the driverkit update: https://github.com/falcosecurity/falcoctl/pull/632

Me and @alacuku just tested on cos version 1.30.3-gke.1639000 with kernel 6.1.90+ and the new falcoctl worked fine, we were able to build the ebpf probe.
Therefore this issue will be fixed by Falco 0.39.0!

I have tested it too, and have successfully built the driver. Thank you @FedeDP

You are welcome, thanks for spotting the bug in the first place :D

So, Falco 0.39.0-rc1 is out; this is the first Release Candidate for the new release that is expected to be released in a couple of weeks. Are you willing to test it? @judika03
You can just use the 0.39.0-rc1 image tag ;)

i already tested. it's running as well. thanks

Super Happy to hear it! Thanks for spotting the issue and patiently helping us debug it :)
I think we can safely close this one now!
/close

@FedeDP: Closing this issue.

In response to this:

Super Happy to hear it! Thanks for spotting the issue and patiently helping us debug it :)
I think we can safely close this one now!
/close

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.


DO NOT COMMIT: Add support for mTLS auth

Fixes #312

As written this depends on https://github.com/seanmonstar/warp/pull/942 being merged. Another possible approach would be to extract client cert with a Tower layer, though from a brief review that looks like significantly more work unless I am missing an existing crate.


Add files via upload

添加个人的整理笔记

Coverage decreased (-0.09%) to 91.622% when pulling 6069665c35c26f03b9f0f0a8d2c30c8509b59418 on bichonghai:bichonghai-patch-1 into 6a68423367bcd1acb970bfa25b36f94ca2d58980 on apache:master.

@bichonghai  Thanks for your note, could you provide a markdown version instead of docx
and this document could be better be posted as blog in our website.

I think this PR is out-of-date and should be closed.


Modify ResourceManager::loadStage to consume MM instead of arguments.

Motivation and Context
This small PR changes the argument list for loadStage to remove createSemanticMesh and forceSeparateSemanticSceneGraph, and instead query the MetadataMediator's copy of simConfig for these values, which is always synced with Simulator and always the most relevant/pertinent simConfig whenever a scene's assets are loaded.

How Has This Been Tested
Local C++ and python tests.

Types of changes

[x] Docs change / refactoring / dependency upgrade
[ ] Bug fix (non-breaking change which fixes an issue)
[ ] New feature (non-breaking change which adds functionality)
[ ] Breaking change (fix or feature that would cause existing functionality to change)

Checklist

[x] My code follows the code style of this project.
[ ] My change requires a change to the documentation.
[x] I have updated the documentation accordingly.
[x] I have read the CONTRIBUTING document.
[x] I have completed my CLA (see CONTRIBUTING)
[x] I have added tests to cover my changes.
[x] All new and existing tests passed.

habitat-sim/src/tests/ResourceManagerTest.cpp:122:73: error: no matching function for call to ‘esp::assets::ResourceManager::loadStage(std::shared_ptr<esp::metadata::attributes::StageAttributes>&, std::nullptr_t, esp::scene::SceneManager*, std::vector<int>&, bool)’
                                           &sceneManager_, tempIDs, false);

Need to change there as well. Make sure all tests build.

Ah, missed that one, is in a VHACD test


[iOS11] The app is killed while in background more often that in previous iOS versions

See https://matrix.to/#/!tDRGDwZwQnlkowsjsm:matrix.org/$15058724334045615KyxMS:matrix.org

Some rageshakes:
https://github.com/matrix-org/riot-ios-rageshakes/issues/345
https://github.com/matrix-org/riot-ios-rageshakes/issues/347

I have added logs on background tasks created in MXHTTPClient.
Some tasks are created and released on different threads. TBC

The issue is related to notifications received while the app is in foreground.
A way to reproduce it is:

open the app
receive a message that bings you (a message that would have generated a notif is the app was in background)
put the app in background shortly once the app receives it (the timing is not defined yet)
reopen the app 90s later

-> the app restarts because it was killed in bg.
It seems to be an iOS 11 issue already reported at https://forums.developer.apple.com/thread/85018 and https://openradar.appspot.com/34788843.
The app code calls the completion block of the didReceiveRemoteNotification delegate but the system seems to ignore it.

note that with pushKit the notification code will be completely different.

is it worth just shifting over to pushkit then? or can we ignore pushes received whilst fg’d?

or can we ignore pushes received whilst fg’d?
We ignore them and we tell it to the OS but this is where the OS bugs.

Pushing pushkit will hide this issue but it will probably come with some regressions at the beginning.

For the record, here is the analysis from the iOS system log at https://matrix.to/#/!tAMgPDeOawUJMkFXVZ:matrix.org/$15072869291653268SxcBx:matrix.org
The app is in foreground:
Oct  6 11:34:09 Matthews-iPhone Riot[3303] <Notice>: [AppDelegate] applicationDidBecomeActive
The OS receives a notification for Riot. It arms a kind of watchdog called  "will present notification":
Oct  6 11:34:15 Matthews-iPhone assertiond[66] <Notice>: Updating PowerAssertion on Riot:3303
Oct  6 11:34:15 Matthews-iPhone SpringBoard(UserNotificationsServer)[2501] <Notice>: [im.vector.app] willPresentNotification delivery succeeded for notification B8A7-7396
Oct  6 11:34:15 Matthews-iPhone assertiond[66] <Notice>: [SpringBoard:2501] Attempting to acquire assertion for Riot:3303: <BKProcessAssertion: 0x105025240; "will present notification" (notificationAction:30s); id:\M-b\M^@\M-&4F0574776700>
Oct  6 11:34:15 Matthews-iPhone assertiond[66] <Notice>: [Riot:3303] Add assertion: <BKProcessAssertion: 0x105025240; id: 2501-FA619D72-40F2-48C2-BE77-4F0574776700; name: "will present notification"; state: active; reason: notificationAction; duration: 30.0s> {
    owner = <BSProcessHandle: 0x105027840; SpringBoard:2501; valid: YES>;
    flags = preventSuspend, preventThrottleDownUI, preventIdleSleep, preventSuspendOnSleep;
}

The OS informs the app, which does nothing as it is foreground (it just calls completionHandler(UIBackgroundFetchResultNoData);):
Oct  6 11:34:15 Matthews-iPhone Riot[3303] <Notice>: [AppDelegate] didReceiveRemoteNotification

The app is used, then put in bg:
Oct  6 11:35:02 Matthews-iPhone Riot[3303] <Notice>: [AppDelegate] applicationDidEnterBackground
Oct  6 11:35:02 Matthews-iPhone Riot[3303] <Notice>: [MXKAccount] pauseInBackgroundTask : 00000109 starts
Oct  6 11:35:02 Matthews-iPhone Riot[3303] <Notice>: [MXSession] pause the event stream in state 5

All background tasks are closed. The last Riot log is:
Oct  6 11:35:02 Matthews-iPhone Riot[3303] <Notice>: [MXFileStore commit] Background task #271 is complete - lasted 41ms

The app is killed while in bg:
Oct  6 11:35:43 Matthews-iPhone assertiond[66] <Notice>: [Riot:3303] Forcing crash report with description: Riot:3303 has active assertions beyond permitted time:
<BKProcessAssertion: 0x105025240; "will present notification" (notificationAction:30s); id:\M-b\M^@\M-&4F0574776700> (owner: SpringBoard:2501)
Oct  6 11:35:43 Matthews-iPhone assertiond[66] <Notice>: [Riot:3303] Finished crash reporting.

The patch does not fix the issue, which is still here in iOS 11.0.2:
https://github.com/matrix-org/riot-ios-rageshakes/issues/425
https://github.com/matrix-org/riot-ios-rageshakes/issues/426


Update AI.yml

AI Pull Request Summary:
Pull Request Summary
File Modified: .github/workflows/AI.yml
Changes Made:

Workflow Name Update: Changed from "PR Summary and Issues Check" to "PR Summary and Inline Issues Check".

Inline Issues Detection:

Introduced functionality to analyze pull request code changes for critical issues using OpenAI’s GPT model.
Collects inline comments for identified issues (e.g., syntax errors, undefined variables) and posts them as a single review comment on the pull request.

Code Review Process:

Removed previous method of posting individual comments for each discovered issue.
Inline comments are now structured with file paths, line numbers, and detailed descriptions of the issues detected.

AI Summary Functionality:

Maintained the functionality that generates a concise technical summary of the pull request changes using OpenAI’s GPT model.
Ensured both inline issue comments and the summary are posted as part of the pull request review process.

Error Handling:

Added error handling for API responses to ensure robust execution and appropriate logging of results.

This update enhances automated code review capabilities by providing inline feedback alongside a summary for better developer insights.


Guided Remediation: Make VulnerabilityClient for OSV queries

Implementing https://github.com/google/osv-scanner/pull/766#discussion_r1465857965

Created VulnerabilityClient interface for OSV queries & to store cache
Renamed ResolutionClient to DependencyClient
Made new ResolutionClient struct, that's just both DependencyClient and VulnerabilityClient together

Codecov Report
All modified and coverable lines are covered by tests :white_check_mark:

Comparison is base (4528ca2) 79.95% compared to head (b159892) 79.56%.

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #773      +/-   ##
==========================================
- Coverage   79.95%   79.56%   -0.39%
==========================================
  Files          90       90
  Lines        6170     6170
==========================================
- Hits         4933     4909      -24
- Misses       1034     1055      +21
- Partials      203      206       +3

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.


⚠ Spryr has degraded performance

In 154eb4d, Spryr (https://spryr.com) experienced degraded performance:

HTTP code: 200
Response time: 5826 ms

Resolved: Spryr performance has improved in 7724ba5 after 10 minutes.


Rename dos locations

Migrates outcomes and recruitment locations to plain old locations.

Was run in production :+1:


Kubernetes client New() function has incorrect logic

What did you do?
Tried to use basic-auth with prometheus
What did you expect to see?
Prometheus up and running
What did you see instead? Under which circumstances?
An error from the k8s client code about specifying both bearer and basic auths
I believe the issue is a logical error in the k8s client config creation:
https://github.com/prometheus/prometheus/blob/d19d1bcad38c70bd801433da0be29ca5b2828334/discovery/kubernetes/kubernetes.go#L79
Bearer token can be set in the else clause (without any configuration in the yaml), and then basic-auth will be set, but the bearer never unset. This Config struct with two auth methods filled in is then passed to k8s client code, which returns an error.
Environment

System information:
quay.io docker image running in k8s 1.5.1

Prometheus version:
Starting prometheus (version=1.4.1, branch=master, revision=2a89e8733f240d3cd57a6520b52c36ac4744ce12)

Alertmanager version:
insert output of alertmanager -version here (if relevant to the issue)

Prometheus configuration file:

...
    - job_name: 'kubernetes-apiservers'
      scheme: https
      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
      basic_auth:
        username: ...
        password: ...
      kubernetes_sd_configs:
      - role: endpoints
        tls_config:
          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        basic_auth:
          username: ...
          password: ...
...

Alertmanager configuration file:

insert configuration here (if relevant to the issue)

Logs:

lost these, but... was the error coming from the k8s client library when both basic and bearer auth are specified

I think something like kcfg.BearerToken = "" on line 112 would fix this issue, though I don't have an easy way to test

Thanks for reporting this @verdverm.
I was able to reproduce your problem.
There error message I'm seeing in the logs is
 Cannot create Kubernetes discovery: username/password or bearer token may be set, but not both  source=discovery.go:84

Does this resemble your results?
Working on a fix now.

Yes, that looks the same

@verdverm
Could you please provide a little bit more context as to why are you trying to use basic HTTP authentication while running Prometheus inside a Kubernetes cluster?
The canonical approach to authenticating API clients running inside a cluster is to use a so-called service account and collect it's credentials via the Secret volume mounted into the pod. This is entirely managed by Kubernetes and described here: https://kubernetes.io/docs/admin/service-accounts-admin/
According to that documentation the current implementation of credentials configuration in Prometheus is slightly wrong. Patching it to remove the token when basic auth is configured, like you suggested, would push if further down that path since the token we'd be removing is the one configured through the correct Kubernetes service account mechanism.
I'm almost done with a PR to implement the correct service-account behaviour and I would like to know more about your use case so I can test against it.
Thanks a lot for helping out on this one.

@verdverm what requires you to set the ca_file and basic auth explicitly here? When not specifing an API server, the SD sets itself up with the in cluster configuration using service accounts. In the general case, you shouldn't have to specify anything but role.
Is your setup customized to that degree?

I was messing around with config scenarios trying to get authz working in Prometheus.
I've converted to the k8s supplied files and have the following error I've been trying to work out.
(ignore node-8, hardware failure)

deployment.yaml
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  labels:
    name: prometheus-deployment
  name: prometheus
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: prometheus
    spec:
      containers:
      - image: "{{ docker-registry }}/krobots/prometheus:v1.4.1"
        name: prometheus
        command:
        - "/bin/prometheus"
        args:
        - "-config.file=/etc/prometheus/prometheus.yml"
        - "-storage.local.path=/prometheus"
        - "-storage.local.retention=24h"
        - "-alertmanager.url=http://alertmanager:9093/api/v1"
        ports:
        - containerPort: 9090
          protocol: TCP
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
          limits:
            cpu: 500m
            memory: 2500Mi
        volumeMounts:
        - name: data-volume
          mountPath: "/prometheus"
        - name: config-volume
          mountPath: "/etc/prometheus"
        - name: rules-volume
          mountPath: "/etc/prometheus-rules"
      volumes:
      - name: data-volume
        hostPath:
          path: /data/prometheus
      - name: config-volume
        configMap:
          name: prometheus-config
      - name: rules-volume
        configMap:
          name: prometheus-rules

configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: prometheus-config
data:
  prometheus.yml: |

    global:
      scrape_interval: 30s
      scrape_timeout: 30s

    rule_files:
      - "/etc/prometheus-rules/*.rules"

    scrape_configs:
    - job_name: 'kubernetes-apiservers'
      scheme: https
      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      kubernetes_sd_configs:
      - role: endpoints
        tls_config:
          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      relabel_configs:
      - source_labels: [__meta_kubernetes_namespace, __meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
        action: keep
        regex: default;kubernetes;https
    - job_name: 'kubernetes-nodes'
      scheme: https
      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      kubernetes_sd_configs:
      - role: node
        tls_config:
          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      relabel_configs:
      - action: labelmap
        regex: __meta_kubernetes_node_label_(.+)
    - job_name: 'kubernetes-service-endpoints'
      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      kubernetes_sd_configs:
      - role: endpoints
        tls_config:
          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      relabel_configs:
      - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scrape]
        action: keep
        regex: true
      - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scheme]
        action: replace
        target_label: __scheme__
        regex: (https?)
      - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_path]
        action: replace
        target_label: __metrics_path__
        regex: (.+)
      - source_labels: [__address__, __meta_kubernetes_service_annotation_prometheus_io_port]
        action: replace
        target_label: __address__
        regex: (.+)(?::\d+);(\d+)
        replacement: $1:$2
      - action: labelmap
        regex: __meta_kubernetes_service_label_(.+)
      - source_labels: [__meta_kubernetes_namespace]
        action: replace
        target_label: kubernetes_namespace
      - source_labels: [__meta_kubernetes_service_name]
        action: replace
        target_label: kubernetes_name
    - job_name: 'kubernetes-services'
      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      metrics_path: /probe
      params:
        module: [http_2xx]
      kubernetes_sd_configs:
      - role: service
        tls_config:
          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      relabel_configs:
      - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_probe]
        action: keep
        regex: true
      - source_labels: [__address__]
        target_label: __param_target
      - target_label: __address__
        replacement: blackbox
      - source_labels: [__param_target]
        target_label: instance
      - action: labelmap
        regex: __meta_kubernetes_service_label_(.+)
      - source_labels: [__meta_kubernetes_service_namespace]
        target_label: kubernetes_namespace
      - source_labels: [__meta_kubernetes_service_name]
        target_label: kubernetes_name
    - job_name: 'kubernetes-pods'
      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      kubernetes_sd_configs:
      - role: pod
        tls_config:
          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      relabel_configs:
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
        action: keep
        regex: true
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
        action: replace
        target_label: __metrics_path__
        regex: (.+)
      - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
        action: replace
        regex: (.+):(?:\d+);(\d+)
        replacement: ${1}:${2}
        target_label: __address__
      - action: labelmap
        regex: __meta_kubernetes_pod_label_(.+)
      - source_labels: [__meta_kubernetes_namespace]
        action: replace
        target_label: kubernetes_namespace
      - source_labels: [__meta_kubernetes_pod_name]
        action: replace
        target_label: kubernetes_pod_name

@alexsomesan Do I need to create a service account specifically for Prometheus / kube-state-metrics / alertmanager ?

You can start off with the default one, which is always there on every cluster that is version 1.4.x or newer.
You would create a specific one if, say you want to set more restrictive permissions for Prometheus when accessing the API.
From the looks of your targets status I'd say some of you API instances are configured inconsistently. I suspect that is the reason why you only see one of them 'UP'. Only one of them accepts your credentials. Check logs of the kube-apiserver process on the failed nodes for authentication errors. and start from there.

I've removed the tls/token fields from the kubernetes_sd_config, same results which is good and bad.
The reason for the x509 errors I believe is the CA's are self-signed, is there a way around that?
The systemd configuration, auth.jsonl, and token.csv are all the same on the three k8s-master nodes. Still getting the auth issues, the one up node is the elected leader. Also of interest, the TLS certs for the k8s masters are being accepted. These are from the same self-hosted CA. All machines have a unique TLS certificate.
Thoughts?

@alexsomesan x509 woes continue, adding insecure_skip_verify to the tls_config causes Prometheus to "Failed to list" everything...
changing anything in the auth sections seems to cause prometheus to be unable to talk to the API server. Yet it is not auth'n correctly

I have to walk back another statement...
removing the tls_config and bearer_token_file from the kubernetes_sd_config causes Prometheus to not be able to list anything. Putting the config back in resolves the unlistable issue
@alexsomesan It seems the kubernetes_sd_config tls and bearer fields are required after all

@alexsomesan If I have a unique TLS cert generated for each machine, does the CommonName need to be unique?

https://github.com/prometheus/prometheus/blob/master/util/httputil/client.go#L149
https://golang.org/src/crypto/tls/common.go?s=20954:20995#L603

ok, walk this back once again, both versions of the config map work.
Depending on the sequence of create/apply/delete ConfigMap, Deployment, and the Prometheus pod determines success or not

Is there anyway to output the actual config map prometheus is seeing?

It seems we may also be suffering from stale data in k8s.
After deleting and re-creating the ConfigMap, we kill the Prom pod to pick up the new config.
It seems as though the new pod picks up the old config, after deleting a second time, it goes back to working with a known "working" config (despite our other authz issues).

It seems that the secrets/default-token-XXXXX in the namespace becomes stale or bad as well?

oh, and the two apiservers which are reported down are having a TLS handshake error come out of the logs.
kube-apiserver[1176]: E0117 05:45:29.007801    1176 handlers.go:58] Unable to authenticate the request due to an error: crypto/rsa: verification error

@alexsomesan , I got everything working!!
post-mortem:

it seems the fundamental issue at play was the service account tokens
Verification was flowed because we used a different SA token pem on each master
Kubernetes has issues with syncing the tokens, thus we had many working configs which appeared at first to be broken.

solution:

Fix the divergent pem files for token verification
To get prometheus ( and any other container ) to pick up fresh tokens...
make changes to config (optional)
delete the default service account token
delete the kube-system service account token ( only if making changes to k8s config)
wait one minute
delete the Prom (or other) pod one or more times (average is 2 for me)
See Prom go, go Prom go

Most of the other auth setups worked, our final working configMap:
notes:

insecure_skip_verify works in the scrape config, not in the kubernetes_sd_config
(our original non-working issue was the SA token)
we can probably clean this up now that we know the SA tokens were an issue

apiVersion: v1
kind: ConfigMap
metadata:
  name: prometheus-config
data:
  prometheus.yml: |

    global:
      scrape_interval: 30s
      scrape_timeout: 30s

    rule_files:
      - "/etc/prometheus-rules/*.rules"

    scrape_configs:
    - job_name: 'kubernetes-apiservers'
      scheme: https
      tls_config:
        ca_file: /var/lib/kubernetes/ca.pem
        insecure_skip_verify: true
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      kubernetes_sd_configs:
      - role: endpoints
        tls_config:
          ca_file: /var/lib/kubernetes/ca.pem
        bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      relabel_configs:
      - source_labels: [__meta_kubernetes_namespace, __meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
        action: keep
        regex: default;kubernetes;https
    - job_name: 'kubernetes-nodes'
      scheme: https
      tls_config:
        ca_file: /var/lib/kubernetes/ca.pem
        insecure_skip_verify: true
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      kubernetes_sd_configs:
      - role: node
        tls_config:
          ca_file: /var/lib/kubernetes/ca.pem
        bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      relabel_configs:
      - action: labelmap
        regex: __meta_kubernetes_node_label_(.+)
    - job_name: 'kubernetes-service-endpoints'
      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      kubernetes_sd_configs:
      - role: endpoints
        tls_config:
          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      relabel_configs:
      - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scrape]
        action: keep
        regex: true
      - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scheme]
        action: replace
        target_label: __scheme__
        regex: (https?)
      - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_path]
        action: replace
        target_label: __metrics_path__
        regex: (.+)
      - source_labels: [__address__, __meta_kubernetes_service_annotation_prometheus_io_port]
        action: replace
        target_label: __address__
        regex: (.+)(?::\d+);(\d+)
        replacement: $1:$2
      - action: labelmap
        regex: __meta_kubernetes_service_label_(.+)
      - source_labels: [__meta_kubernetes_namespace]
        action: replace
        target_label: kubernetes_namespace
      - source_labels: [__meta_kubernetes_service_name]
        action: replace
        target_label: kubernetes_name
    - job_name: 'kubernetes-services'
      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      metrics_path: /probe
      params:
        module: [http_2xx]
      kubernetes_sd_configs:
      - role: service
        tls_config:
          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      relabel_configs:
      - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_probe]
        action: keep
        regex: true
      - source_labels: [__address__]
        target_label: __param_target
      - target_label: __address__
        replacement: blackbox
      - source_labels: [__param_target]
        target_label: instance
      - action: labelmap
        regex: __meta_kubernetes_service_label_(.+)
      - source_labels: [__meta_kubernetes_service_namespace]
        target_label: kubernetes_namespace
      - source_labels: [__meta_kubernetes_service_name]
        target_label: kubernetes_name
    - job_name: 'kubernetes-pods'
      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      kubernetes_sd_configs:
      - role: pod
        tls_config:
          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      relabel_configs:
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
        action: keep
        regex: true
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
        action: replace
        target_label: __metrics_path__
        regex: (.+)
      - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
        action: replace
        regex: (.+):(?:\d+);(\d+)
        replacement: ${1}:${2}
        target_label: __address__
      - action: labelmap
        regex: __meta_kubernetes_pod_label_(.+)
      - source_labels: [__meta_kubernetes_namespace]
        action: replace
        target_label: kubernetes_namespace
      - source_labels: [__meta_kubernetes_pod_name]
        action: replace
        target_label: kubernetes_pod_name

@fabxc @verdverm  Can this be closed?


snapshot files need versions

Part of #99.
Probably want a raw byte at the start of the snapshot file to determine the format:
u8: file format version = 1
serialized SnapshotMetadata::Header ProtoBuf
StateMachine-defined

Within the StateMachine, it currently dumps the sessions and then dumps the Tree. Probably want a 1-byte version number at the start of each of those:
u8: state machine format version = 1
sessions
Tree-defined

Then in Tree:
u8: tree format version = 1
serialized directories and files

On reading, PANIC if any of the versions is not 1.

On second thought, having the version for the Tree separate from the state machine is probably overkill.


[Installation] Keys_format.py instead of keys.py?

Hmm maybe add a bit of description about this on README?

#47


Add description to command nodes

See #40
For an eventual help command purpose, a description of a node may be useful.
In order to keep backward compatibility, I have duplicated some constructors.

 Thank you for your submission, we really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.:x: JesFot sign nowYou have signed the CLA already but the status is still pending? Let us recheck it.

Command or node description should not be interpreted as a command.
To use your example: /advancement should only display that something is wrong with the command, not a description message about the command itself, /help advancement should do this.


Create a "week showcase" for the week/theme view

This probably isn't even necessary. With very fast Redis updates, it should be trivially easy to show art by week. Content, when posted, is marked as unapproved until it is approved via the Discord bot (API call).
There just needs to be a link with a query string that includes a default ascending sort of posts. Additionally, any posts that come late will appear in Discord in real time.