Egress gateway does not work on EKS with CNI Overlay

Is there an existing issue for this?

[X] I have searched the existing issues

What happened?
Hey! I am assessing feasibility to use cilium as an egress filter for all workloads hosted on kuberentes, however when using CNI overlay (on top of AWS VPC CNI), my pods cannot reach any resources when routed trough egress gateway.
I am installing cilium through helm chart:
helm install cilium cilium/cilium --version 1.14.3 \
   --namespace cilium \
   --set egressGateway.enabled=true \
   --set bpf.masquerade=true \
   --set kubeProxyReplacement=true \
   --set l7Proxy=false \
   --set cni.chainingMode=aws-cni

On EKS. o have two node pools - main for all microservices, and egress pool which should be used explicitly to allow egress traffic only. I have deployed CiliumEgressGatewayPolicy which should route all traffic where destination is <IP_ADDRESS> originating from pods labeled with egress: "yes" through worker node with eks.amazonaws.com/nodegroup: egress label:
apiVersion: cilium.io/v2
kind: CiliumEgressGatewayPolicy
metadata:
  name: egress
spec:
  destinationCIDRs:
  - <IP_ADDRESS>/32
  egressGateway:
    nodeSelector:
      matchLabels:
        eks.amazonaws.com/nodegroup: egress
  selectors:
  - podSelector:
      matchLabels:
        egress: "yes"

In cilium I can see that egress route is propagated:
root@ip-10-45-177-134:/home/cilium# cilium bpf egress list
Source IP      Destination CIDR   Egress IP   Gateway IP
<IP_ADDRESS>   <IP_ADDRESS>/32         <IP_ADDRESS>     <IP_ADDRESS>

When i initiate connection from the pod labeled with egress: "yes", i am getting timeout and cannot reach the external resource through egress gateway (it works if i delete egress policy):
netshoot1:~# nc -zvw3 <IP_ADDRESS> 53
nc: connect to <IP_ADDRESS> port 53 (tcp) timed out: Operation in progress

On egress gateway itself i can see that traffic it is being routed through it, but for some reason response is not sent back to the pod which initiates the connection:
oot@ip-10-45-171-51:/home/cilium# tcpdump -n | grep '<IP_ADDRESS>'
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
IP <IP_ADDRESS>.51078 > <IP_ADDRESS>.53: Flags [S], seq<PHONE_NUMBER>, win 62727, options [mss 8961,sackOK,TS val 466473320 ecr 0,nop,wscale 7], length 0
14:15:25.396968 IP <IP_ADDRESS>.50549 > <IP_ADDRESS>.53: Flags [S], seq<PHONE_NUMBER>, win 62727, options [mss 8961,sackOK,TS val 466473320 ecr 0,nop,wscale 7], length 0
14:15:25.399594 IP <IP_ADDRESS>.53 > <IP_ADDRESS>.50549: Flags [S.], seq<PHONE_NUMBER>, ack<PHONE_NUMBER>, win 65160, options [mss 1460,sackOK,TS val 568331799 ecr 466473320,nop,wscale 13], length 0
14:15:25.399660 IP <IP_ADDRESS>.53 > <IP_ADDRESS>.51078: Flags [S.], seq<PHONE_NUMBER>, ack<PHONE_NUMBER>, win 65160, options [mss 1460,sackOK,TS val 568331799 ecr 466473320,nop,wscale 13], length 0
14:15:26.405787 IP <IP_ADDRESS>.53 > <IP_ADDRESS>.50549: Flags [S.], seq<PHONE_NUMBER>, ack<PHONE_NUMBER>, win 65160, options [mss 1460,sackOK,TS val 568332806 ecr 466473320,nop,wscale 13], length 0
14:15:26.405848 IP <IP_ADDRESS>.53 > <IP_ADDRESS>.51078: Flags [S.], seq<PHONE_NUMBER>, ack<PHONE_NUMBER>, win 65160, options [mss 1460,sackOK,TS val 568332806 ecr 466473320,nop,wscale 13], length 0
IP <IP_ADDRESS>.51078 > <IP_ADDRESS>.53: Flags [S], seq<PHONE_NUMBER>, win 62727, options [mss 8961,sackOK,TS val 466474334 ecr 0,nop,wscale 7], length 0
14:15:26.410451 IP <IP_ADDRESS>.50549 > <IP_ADDRESS>.53: Flags [S], seq<PHONE_NUMBER>, win 62727, options [mss 8961,sackOK,TS val 466474334 ecr 0,nop,wscale 7], length 0
14:15:26.412921 IP <IP_ADDRESS>.53 > <IP_ADDRESS>.50549: Flags [S.], seq<PHONE_NUMBER>, ack<PHONE_NUMBER>, win 65160, options [mss 1460,sackOK,TS val 568332813 ecr 466473320,nop,wscale 13], length 0
14:15:26.412956 IP <IP_ADDRESS>.53 > <IP_ADDRESS>.51078: Flags [S.], seq<PHONE_NUMBER>, ack<PHONE_NUMBER>, win 65160, options [mss 1460,sackOK,TS val 568332813 ecr 466473320,nop,wscale 13], length 0

Cilium Version
root@ip-10-45-171-51:/home/cilium# cilium version
Client: 1.14.3 252a99ef 2023-10-18T18:21:56+03:00 go version go1.20.10 linux/amd64
Daemon: 1.14.3 252a99ef 2023-10-18T18:21:56+03:00 go version go1.20.10 linux/amd64

Same happens on v1.14.4
Kernel Version
root@ip-10-45-171-51:/home/cilium# uname -r
5.10.198-187.748.amzn2.x86_64

Kubernetes Version
v1.24.17-eks-4f4795d
Sysdump
cilium-sysdump-20231204-160322.zip
Relevant log output
No response
Anything else?
<IP_ADDRESS> - my test pod IP address
<IP_ADDRESS> - egress gateway's IP address
There is no ciliumnetworkpolicies nor ciliumclusterwidenetworkpolicies deployed.
I have v1.11.5 for AWS VPC CNI deployed:
❯ kubectl -n kube-system get ds/aws-node -o json | jq -r '.spec.template.spec.containers[0].image'
602401143452.dkr.ecr.eu-west-2.amazonaws.com/amazon-k8s-cni:v1.11.5-eksbuild.1

Code of Conduct

[X] I agree to follow this project's Code of Conduct

Nether below configuration works 👀 i am wondering if this is a misconfiguration on my side, or is it a bug?
helm upgrade cilium cilium/cilium --version 1.14.3 \
   --namespace cilium \
   --set egressGateway.enabled=true \
   --set bpf.masquerade=true \
   --set kubeProxyReplacement=true \
   --set l7Proxy=false \
   --set cni.chainingMode=aws-cni \
   --set cni.exclusive=false \
   --set enableIPv4Masquerade=true \
   --set ipv4NativeRoutingCIDR=<IP_ADDRESS>/16 \
   --set routingMode=native

I have found https://github.com/cilium/cilium/issues/29363 but i am not sure if this is related or not, as for me it does not work ether with v1.14.3

helm upgrade cilium cilium/cilium --version 1.14.3 \
   --namespace cilium \
   --set egressGateway.enabled=true \
   --set bpf.masquerade=true \
   --set kubeProxyReplacement=true \
   --set l7Proxy=false \
   --set cni.chainingMode=aws-cni \
   --set cni.exclusive=false \
   --set enableIPv4Masquerade=true \
   --set ipam.mode=eni \
   --set eni.awsReleaseExcessIPs=true\
   --set eni.enabled=true \
   --set egressGateway.installRoutes=true

I am playing with different configs, but nether of it works 🙄 with above configuration i am getting following output on connectivity test
❯ cilium connectivity test -n cilium
ℹ  Monitor aggregation detected, will skip some flow validation steps
ℹ  Skipping tests that require a node Without Cilium
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for deployment cilium-test/client to become ready...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for deployment cilium-test/client2 to become ready...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for deployment cilium-test/echo-same-node to become ready...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for deployment cilium-test/echo-other-node to become ready...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for CiliumEndpoint for pod cilium-test/client-996668d96-4spvn to appear...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for CiliumEndpoint for pod cilium-test/client2-84c66894fd-mt7jp to appear...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for pod cilium-test/client-996668d96-4spvn to reach DNS server on cilium-test/echo-same-node-778f495746-p5lhk pod...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for pod cilium-test/client2-84c66894fd-mt7jp to reach DNS server on cilium-test/echo-same-node-778f495746-p5lhk pod...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for pod cilium-test/client2-84c66894fd-mt7jp to reach DNS server on cilium-test/echo-other-node-666d8db686-5d4x8 pod...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for pod cilium-test/client-996668d96-4spvn to reach DNS server on cilium-test/echo-other-node-666d8db686-5d4x8 pod...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for pod cilium-test/client-996668d96-4spvn to reach default/kubernetes service...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for pod cilium-test/client2-84c66894fd-mt7jp to reach default/kubernetes service...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for CiliumEndpoint for pod cilium-test/echo-other-node-666d8db686-5d4x8 to appear...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for CiliumEndpoint for pod cilium-test/echo-same-node-778f495746-p5lhk to appear...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for Service cilium-test/echo-other-node to become ready...
connectivity test failed: timeout reached waiting for service cilium-test/echo-other-node (last error: error with exec request (pod=cilium-test/client-996668d96-4spvn, container=): context deadline exceeded)

If i run connectivity test using below helm values:
helm install cilium cilium/cilium --version 1.14.3 \
   --namespace cilium \
   --set egressGateway.enabled=true \
   --set bpf.masquerade=true \
   --set kubeProxyReplacement=true \
   --set l7Proxy=false \
   --set cni.chainingMode=aws-cni

Connectivity test looks like this:
cilium connectivity test -n cilium
ℹ  Monitor aggregation detected, will skip some flow validation steps
✨ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Creating namespace cilium-test for connectivity check...
✨ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Deploying echo-same-node service...
✨ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Deploying DNS test server configmap...
✨ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Deploying same-node deployment...
✨ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Deploying client deployment...
✨ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Deploying client2 deployment...
✨ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Deploying echo-other-node service...
✨ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Deploying other-node deployment...
✨ [host-netns] Deploying arn:aws:eks:us-east-1:123456789012:cluster/dev-eks daemonset...
✨ [host-netns-non-cilium] Deploying arn:aws:eks:us-east-1:123456789012:cluster/dev-eks daemonset...
ℹ  Skipping tests that require a node Without Cilium
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for deployment cilium-test/client to become ready...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for deployment cilium-test/client2 to become ready...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for deployment cilium-test/echo-same-node to become ready...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for deployment cilium-test/echo-other-node to become ready...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for CiliumEndpoint for pod cilium-test/client-996668d96-kw6fb to appear...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for CiliumEndpoint for pod cilium-test/client2-84c66894fd-nbxpw to appear...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for pod cilium-test/client2-84c66894fd-nbxpw to reach DNS server on cilium-test/echo-same-node-778f495746-m9ncg pod...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for pod cilium-test/client-996668d96-kw6fb to reach DNS server on cilium-test/echo-same-node-778f495746-m9ncg pod...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for pod cilium-test/client-996668d96-kw6fb to reach DNS server on cilium-test/echo-other-node-666d8db686-s4vwz pod...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for pod cilium-test/client2-84c66894fd-nbxpw to reach DNS server on cilium-test/echo-other-node-666d8db686-s4vwz pod...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for pod cilium-test/client-996668d96-kw6fb to reach default/kubernetes service...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for pod cilium-test/client2-84c66894fd-nbxpw to reach default/kubernetes service...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for CiliumEndpoint for pod cilium-test/echo-other-node-666d8db686-s4vwz to appear...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for CiliumEndpoint for pod cilium-test/echo-same-node-778f495746-m9ncg to appear...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for Service cilium-test/echo-other-node to become ready...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for Service cilium-test/echo-other-node to be synchronized by Cilium pod cilium/cilium-79l9k
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for Service cilium-test/echo-same-node to become ready...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for Service cilium-test/echo-same-node to be synchronized by Cilium pod cilium/cilium-79l9k
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for NodePort <IP_ADDRESS>:30359 (cilium-test/echo-other-node) to become ready...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for NodePort <IP_ADDRESS>:30916 (cilium-test/echo-same-node) to become ready...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for NodePort <IP_ADDRESS>:30359 (cilium-test/echo-other-node) to become ready...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for NodePort <IP_ADDRESS>:30916 (cilium-test/echo-same-node) to become ready...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for NodePort <IP_ADDRESS>:30359 (cilium-test/echo-other-node) to become ready...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for NodePort <IP_ADDRESS>:30916 (cilium-test/echo-same-node) to become ready...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for NodePort <IP_ADDRESS>:30359 (cilium-test/echo-other-node) to become ready...
⌛ [arn:aws:eks:us-east-1:123456789012:cluster/dev-eks] Waiting for NodePort <IP_ADDRESS>:30916 (cilium-test/echo-same-node) to become ready...
ℹ  Skipping IPCache check
🔭 Enabling Hubble telescope...
⚠  Unable to contact Hubble Relay, disabling Hubble telescope and flow validation: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp [::1]:4245: connect: connection refused"
ℹ  Expose Relay locally with:
   cilium hubble enable
   cilium hubble port-forward&
ℹ  Cilium version: 1.14.3
🏃 Running 58 tests ...
[=] Test [no-policies] [1/58]
.......
  [-] Scenario [no-policies/pod-to-pod]
  [.] Action [no-policies/pod-to-pod/curl-ipv4-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  [.] Action [no-policies/pod-to-pod/curl-ipv4-1: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  [.] Action [no-policies/pod-to-pod/curl-ipv4-2: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  [.] Action [no-policies/pod-to-pod/curl-ipv4-3: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  [-] Scenario [no-policies/client-to-client]
  [.] Action [no-policies/client-to-client/ping-ipv4-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>:0)]
  [.] Action [no-policies/client-to-client/ping-ipv4-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>:0)]
  [-] Scenario [no-policies/pod-to-service]
  [.] Action [no-policies/pod-to-service/curl-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node (echo-other-node.cilium-test:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://echo-other-node.cilium-test:8080" failed: error with exec request (pod=cilium-test/client-996668d96-kw6fb, container=client): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client-996668d96-kw6fb during action curl-0
  📄 No flows recorded for peer cilium-test/echo-other-node during action curl-0
  [.] Action [no-policies/pod-to-service/curl-1: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-same-node (echo-same-node.cilium-test:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://echo-same-node.cilium-test:8080" failed: error with exec request (pod=cilium-test/client-996668d96-kw6fb, container=client): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client-996668d96-kw6fb during action curl-1
  📄 No flows recorded for peer cilium-test/echo-same-node during action curl-1
  [.] Action [no-policies/pod-to-service/curl-2: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node (echo-other-node.cilium-test:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://echo-other-node.cilium-test:8080" failed: error with exec request (pod=cilium-test/client2-84c66894fd-nbxpw, container=client2): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client2-84c66894fd-nbxpw during action curl-2
  📄 No flows recorded for peer cilium-test/echo-other-node during action curl-2
  [.] Action [no-policies/pod-to-service/curl-3: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-same-node (echo-same-node.cilium-test:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://echo-same-node.cilium-test:8080" failed: error with exec request (pod=cilium-test/client2-84c66894fd-nbxpw, container=client2): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client2-84c66894fd-nbxpw during action curl-3
  📄 No flows recorded for peer cilium-test/echo-same-node during action curl-3
  [-] Scenario [no-policies/pod-to-hostport]
  [.] Action [no-policies/pod-to-hostport/curl-0: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:4000)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://<IP_ADDRESS>:4000" failed: error with exec request (pod=cilium-test/client2-84c66894fd-nbxpw, container=client2): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client2-84c66894fd-nbxpw during action curl-0
  📄 No flows recorded for peer cilium-test/echo-other-node-666d8db686-s4vwz during action curl-0
  [.] Action [no-policies/pod-to-hostport/curl-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:4000)]
  [.] Action [no-policies/pod-to-hostport/curl-2: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:4000)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://<IP_ADDRESS>:4000" failed: error with exec request (pod=cilium-test/client-996668d96-kw6fb, container=client): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client-996668d96-kw6fb during action curl-2
  📄 No flows recorded for peer cilium-test/echo-other-node-666d8db686-s4vwz during action curl-2
  [.] Action [no-policies/pod-to-hostport/curl-3: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:4000)]
  [-] Scenario [no-policies/pod-to-world]
  [.] Action [no-policies/pod-to-world/http-to-one.one.one.one-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> one.one.one.one-http (one.one.one.one:80)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 --retry 3 --retry-all-errors --retry-delay 3 http://one.one.one.one:80" failed: error with exec request (pod=cilium-test/client-996668d96-kw6fb, container=client): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client-996668d96-kw6fb during action http-to-one.one.one.one-0
  📄 No flows recorded for peer one.one.one.one-http during action http-to-one.one.one.one-0
  [.] Action [no-policies/pod-to-world/https-to-one.one.one.one-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> one.one.one.one-https (one.one.one.one:443)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 --retry 3 --retry-all-errors --retry-delay 3 https://one.one.one.one:443" failed: error with exec request (pod=cilium-test/client-996668d96-kw6fb, container=client): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client-996668d96-kw6fb during action https-to-one.one.one.one-0
  📄 No flows recorded for peer one.one.one.one-https during action https-to-one.one.one.one-0
  [.] Action [no-policies/pod-to-world/https-to-one.one.one.one-index-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> one.one.one.one-https-index (one.one.one.one:443)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 --retry 3 --retry-all-errors --retry-delay 3 https://one.one.one.one:443/index.html" failed: error with exec request (pod=cilium-test/client-996668d96-kw6fb, container=client): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client-996668d96-kw6fb during action https-to-one.one.one.one-index-0
  📄 No flows recorded for peer one.one.one.one-https-index during action https-to-one.one.one.one-index-0
  [.] Action [no-policies/pod-to-world/http-to-one.one.one.one-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> one.one.one.one-http (one.one.one.one:80)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 --retry 3 --retry-all-errors --retry-delay 3 http://one.one.one.one:80" failed: error with exec request (pod=cilium-test/client2-84c66894fd-nbxpw, container=client2): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client2-84c66894fd-nbxpw during action http-to-one.one.one.one-1
  📄 No flows recorded for peer one.one.one.one-http during action http-to-one.one.one.one-1
  [.] Action [no-policies/pod-to-world/https-to-one.one.one.one-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> one.one.one.one-https (one.one.one.one:443)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 --retry 3 --retry-all-errors --retry-delay 3 https://one.one.one.one:443" failed: error with exec request (pod=cilium-test/client2-84c66894fd-nbxpw, container=client2): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client2-84c66894fd-nbxpw during action https-to-one.one.one.one-1
  📄 No flows recorded for peer one.one.one.one-https during action https-to-one.one.one.one-1
  [.] Action [no-policies/pod-to-world/https-to-one.one.one.one-index-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> one.one.one.one-https-index (one.one.one.one:443)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 --retry 3 --retry-all-errors --retry-delay 3 https://one.one.one.one:443/index.html" failed: error with exec request (pod=cilium-test/client2-84c66894fd-nbxpw, container=client2): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client2-84c66894fd-nbxpw during action https-to-one.one.one.one-index-1
  📄 No flows recorded for peer one.one.one.one-https-index during action https-to-one.one.one.one-index-1
  [-] Scenario [no-policies/pod-to-host]
  [.] Action [no-policies/pod-to-host/ping-ipv4-internal-ip: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> <IP_ADDRESS> (<IP_ADDRESS>:0)]
  [.] Action [no-policies/pod-to-host/ping-ipv4-internal-ip: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> <IP_ADDRESS> (<IP_ADDRESS>:0)]
  [.] Action [no-policies/pod-to-host/ping-ipv4-internal-ip: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> <IP_ADDRESS> (<IP_ADDRESS>:0)]
  [.] Action [no-policies/pod-to-host/ping-ipv4-internal-ip: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> <IP_ADDRESS> (<IP_ADDRESS>:0)]
  [.] Action [no-policies/pod-to-host/ping-ipv4-internal-ip: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> <IP_ADDRESS> (<IP_ADDRESS>:0)]
  [.] Action [no-policies/pod-to-host/ping-ipv4-internal-ip: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> <IP_ADDRESS> (<IP_ADDRESS>:0)]
  [.] Action [no-policies/pod-to-host/ping-ipv4-internal-ip: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> <IP_ADDRESS> (<IP_ADDRESS>:0)]
  [.] Action [no-policies/pod-to-host/ping-ipv4-internal-ip: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> <IP_ADDRESS> (<IP_ADDRESS>:0)]
  [-] Scenario [no-policies/pod-to-external-workload]
  [-] Scenario [no-policies/pod-to-cidr]
  [.] Action [no-policies/pod-to-cidr/external-1111-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> external-1111 (<IP_ADDRESS>:443)]
  [.] Action [no-policies/pod-to-cidr/external-1111-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> external-1111 (<IP_ADDRESS>:443)]
  [.] Action [no-policies/pod-to-cidr/external-1001-0: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> external-1001 (<IP_ADDRESS>:443)]
  [.] Action [no-policies/pod-to-cidr/external-1001-1: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> external-1001 (<IP_ADDRESS>:443)]
[=] Test [no-policies-extra] [2/58]
................
[=] Test [allow-all-except-world] [3/58]
.........
  ℹ  📜 Applying CiliumNetworkPolicy 'allow-all-except-world' to namespace 'cilium-test'..
  [-] Scenario [allow-all-except-world/pod-to-host]
  [.] Action [allow-all-except-world/pod-to-host/ping-ipv4-internal-ip: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> <IP_ADDRESS> (<IP_ADDRESS>:0)]
  [.] Action [allow-all-except-world/pod-to-host/ping-ipv4-internal-ip: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> <IP_ADDRESS> (<IP_ADDRESS>:0)]
  [.] Action [allow-all-except-world/pod-to-host/ping-ipv4-internal-ip: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> <IP_ADDRESS> (<IP_ADDRESS>:0)]
  [.] Action [allow-all-except-world/pod-to-host/ping-ipv4-internal-ip: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> <IP_ADDRESS> (<IP_ADDRESS>:0)]
  [.] Action [allow-all-except-world/pod-to-host/ping-ipv4-internal-ip: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> <IP_ADDRESS> (<IP_ADDRESS>:0)]
  [.] Action [allow-all-except-world/pod-to-host/ping-ipv4-internal-ip: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> <IP_ADDRESS> (<IP_ADDRESS>:0)]
  [.] Action [allow-all-except-world/pod-to-host/ping-ipv4-internal-ip: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> <IP_ADDRESS> (<IP_ADDRESS>:0)]
  [.] Action [allow-all-except-world/pod-to-host/ping-ipv4-internal-ip: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> <IP_ADDRESS> (<IP_ADDRESS>:0)]
  [-] Scenario [allow-all-except-world/pod-to-external-workload]
  [-] Scenario [allow-all-except-world/pod-to-pod]
  [.] Action [allow-all-except-world/pod-to-pod/curl-ipv4-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://<IP_ADDRESS>:8080" failed: error with exec request (pod=cilium-test/client-996668d96-kw6fb, container=client): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client-996668d96-kw6fb during action curl-ipv4-0
  📄 No flows recorded for peer cilium-test/echo-other-node-666d8db686-s4vwz during action curl-ipv4-0
  [.] Action [allow-all-except-world/pod-to-pod/curl-ipv4-1: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  [.] Action [allow-all-except-world/pod-to-pod/curl-ipv4-2: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://<IP_ADDRESS>:8080" failed: error with exec request (pod=cilium-test/client2-84c66894fd-nbxpw, container=client2): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client2-84c66894fd-nbxpw during action curl-ipv4-2
  📄 No flows recorded for peer cilium-test/echo-other-node-666d8db686-s4vwz during action curl-ipv4-2
  [.] Action [allow-all-except-world/pod-to-pod/curl-ipv4-3: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  [-] Scenario [allow-all-except-world/client-to-client]
  [.] Action [allow-all-except-world/client-to-client/ping-ipv4-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>:0)]
  [.] Action [allow-all-except-world/client-to-client/ping-ipv4-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>:0)]
  [-] Scenario [allow-all-except-world/pod-to-service]
  [.] Action [allow-all-except-world/pod-to-service/curl-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node (echo-other-node.cilium-test:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://echo-other-node.cilium-test:8080" failed: error with exec request (pod=cilium-test/client-996668d96-kw6fb, container=client): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client-996668d96-kw6fb during action curl-0
  📄 No flows recorded for peer cilium-test/echo-other-node during action curl-0
  [.] Action [allow-all-except-world/pod-to-service/curl-1: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-same-node (echo-same-node.cilium-test:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://echo-same-node.cilium-test:8080" failed: error with exec request (pod=cilium-test/client-996668d96-kw6fb, container=client): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client-996668d96-kw6fb during action curl-1
  📄 No flows recorded for peer cilium-test/echo-same-node during action curl-1
  [.] Action [allow-all-except-world/pod-to-service/curl-2: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node (echo-other-node.cilium-test:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://echo-other-node.cilium-test:8080" failed: error with exec request (pod=cilium-test/client2-84c66894fd-nbxpw, container=client2): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client2-84c66894fd-nbxpw during action curl-2
  📄 No flows recorded for peer cilium-test/echo-other-node during action curl-2
  [.] Action [allow-all-except-world/pod-to-service/curl-3: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-same-node (echo-same-node.cilium-test:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://echo-same-node.cilium-test:8080" failed: error with exec request (pod=cilium-test/client2-84c66894fd-nbxpw, container=client2): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client2-84c66894fd-nbxpw during action curl-3
  📄 No flows recorded for peer cilium-test/echo-same-node during action curl-3
  ℹ  📜 Deleting CiliumNetworkPolicy 'allow-all-except-world' from namespace 'cilium-test'..
[=] Test [client-ingress] [4/58]
..
[=] Test [client-ingress-knp] [5/58]
..
[=] Test [allow-all-with-metrics-check] [6/58]
....
[=] Test [all-ingress-deny] [7/58]
........
[=] Test [all-ingress-deny-knp] [8/58]
........
[=] Test [all-egress-deny] [9/58]
................
[=] Test [all-egress-deny-knp] [10/58]
................
[=] Test [all-entities-deny] [11/58]
........
[=] Test [cluster-entity] [12/58]
..
[=] Test [host-entity] [13/58]
........
[=] Test [echo-ingress] [14/58]
...
  ℹ  📜 Applying CiliumNetworkPolicy 'echo-ingress-from-other-client' to namespace 'cilium-test'..
  [-] Scenario [echo-ingress/pod-to-pod]
  [.] Action [echo-ingress/pod-to-pod/curl-ipv4-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  [.] Action [echo-ingress/pod-to-pod/curl-ipv4-1: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  [.] Action [echo-ingress/pod-to-pod/curl-ipv4-2: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://<IP_ADDRESS>:8080" failed: error with exec request (pod=cilium-test/client2-84c66894fd-nbxpw, container=client2): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client2-84c66894fd-nbxpw during action curl-ipv4-2
  📄 No flows recorded for peer cilium-test/echo-other-node-666d8db686-s4vwz during action curl-ipv4-2
  [.] Action [echo-ingress/pod-to-pod/curl-ipv4-3: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  ℹ  📜 Deleting CiliumNetworkPolicy 'echo-ingress-from-other-client' from namespace 'cilium-test'..
[=] Test [echo-ingress-knp] [15/58]
...
  ℹ  📜 Applying KubernetesNetworkPolicy 'echo-ingress-from-other-client' to namespace 'cilium-test'..
  [-] Scenario [echo-ingress-knp/pod-to-pod]
  [.] Action [echo-ingress-knp/pod-to-pod/curl-ipv4-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  [.] Action [echo-ingress-knp/pod-to-pod/curl-ipv4-1: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  [.] Action [echo-ingress-knp/pod-to-pod/curl-ipv4-2: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://<IP_ADDRESS>:8080" failed: error with exec request (pod=cilium-test/client2-84c66894fd-nbxpw, container=client2): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client2-84c66894fd-nbxpw during action curl-ipv4-2
  📄 No flows recorded for peer cilium-test/echo-other-node-666d8db686-s4vwz during action curl-ipv4-2
  [.] Action [echo-ingress-knp/pod-to-pod/curl-ipv4-3: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  ℹ  📜 Deleting K8S NetworkPolicy 'echo-ingress-from-other-client' from namespace 'cilium-test'..
[=] Test [client-ingress-icmp] [16/58]
..
[=] Test [client-egress] [17/58]
....
[=] Test [client-egress-knp] [18/58]
....
[=] Test [client-egress-expression] [19/58]
....
[=] Test [client-egress-expression-knp] [20/58]
....
[=] Test [client-with-service-account-egress-to-echo] [21/58]
....
[=] Test [client-egress-to-echo-service-account] [22/58]
....
[=] Test [to-entities-world] [23/58]
.
  ℹ  📜 Applying CiliumNetworkPolicy 'client-egress-to-entities-world' to namespace 'cilium-test'..
  [-] Scenario [to-entities-world/pod-to-world]
  [.] Action [to-entities-world/pod-to-world/http-to-one.one.one.one-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> one.one.one.one-http (one.one.one.one:80)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 --retry 3 --retry-all-errors --retry-delay 3 http://one.one.one.one:80" failed: error with exec request (pod=cilium-test/client-996668d96-kw6fb, container=client): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client-996668d96-kw6fb during action http-to-one.one.one.one-0
  📄 No flows recorded for peer one.one.one.one-http during action http-to-one.one.one.one-0
  [.] Action [to-entities-world/pod-to-world/https-to-one.one.one.one-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> one.one.one.one-https (one.one.one.one:443)]
  [.] Action [to-entities-world/pod-to-world/https-to-one.one.one.one-index-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> one.one.one.one-https-index (one.one.one.one:443)]
  [.] Action [to-entities-world/pod-to-world/http-to-one.one.one.one-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> one.one.one.one-http (one.one.one.one:80)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 --retry 3 --retry-all-errors --retry-delay 3 http://one.one.one.one:80" failed: error with exec request (pod=cilium-test/client2-84c66894fd-nbxpw, container=client2): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client2-84c66894fd-nbxpw during action http-to-one.one.one.one-1
  📄 No flows recorded for peer one.one.one.one-http during action http-to-one.one.one.one-1
  [.] Action [to-entities-world/pod-to-world/https-to-one.one.one.one-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> one.one.one.one-https (one.one.one.one:443)]
  [.] Action [to-entities-world/pod-to-world/https-to-one.one.one.one-index-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> one.one.one.one-https-index (one.one.one.one:443)]
  ℹ  📜 Deleting CiliumNetworkPolicy 'client-egress-to-entities-world' from namespace 'cilium-test'..
[=] Test [to-cidr-external] [24/58]
....
[=] Test [to-cidr-external-knp] [25/58]
....
[=] Test [echo-ingress-from-other-client-deny] [26/58]
.
  ℹ  📜 Applying CiliumNetworkPolicy 'allow-all-egress' to namespace 'cilium-test'..
  ℹ  📜 Applying CiliumNetworkPolicy 'allow-all-ingress' to namespace 'cilium-test'..
  ℹ  📜 Applying CiliumNetworkPolicy 'echo-ingress-from-other-client-deny' to namespace 'cilium-test'..
  [-] Scenario [echo-ingress-from-other-client-deny/pod-to-pod]
  [.] Action [echo-ingress-from-other-client-deny/pod-to-pod/curl-ipv4-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://<IP_ADDRESS>:8080" failed: error with exec request (pod=cilium-test/client-996668d96-kw6fb, container=client): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client-996668d96-kw6fb during action curl-ipv4-0
  📄 No flows recorded for peer cilium-test/echo-other-node-666d8db686-s4vwz during action curl-ipv4-0
  [.] Action [echo-ingress-from-other-client-deny/pod-to-pod/curl-ipv4-1: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  [-] Scenario [echo-ingress-from-other-client-deny/pod-to-pod]
  [.] Action [echo-ingress-from-other-client-deny/pod-to-pod/curl-ipv4-0: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  [.] Action [echo-ingress-from-other-client-deny/pod-to-pod/curl-ipv4-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  [-] Scenario [echo-ingress-from-other-client-deny/client-to-client]
  [.] Action [echo-ingress-from-other-client-deny/client-to-client/ping-ipv4-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>:0)]
  [.] Action [echo-ingress-from-other-client-deny/client-to-client/ping-ipv4-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>:0)]
  ℹ  📜 Deleting CiliumNetworkPolicy 'allow-all-egress' from namespace 'cilium-test'..
  ℹ  📜 Deleting CiliumNetworkPolicy 'allow-all-ingress' from namespace 'cilium-test'..
  ℹ  📜 Deleting CiliumNetworkPolicy 'echo-ingress-from-other-client-deny' from namespace 'cilium-test'..
[=] Test [client-ingress-from-other-client-icmp-deny] [27/58]
...
  ℹ  📜 Applying CiliumNetworkPolicy 'allow-all-egress' to namespace 'cilium-test'..
  ℹ  📜 Applying CiliumNetworkPolicy 'allow-all-ingress' to namespace 'cilium-test'..
  ℹ  📜 Applying CiliumNetworkPolicy 'client-ingress-from-other-client-icmp-deny' to namespace 'cilium-test'..
  [-] Scenario [client-ingress-from-other-client-icmp-deny/client-to-client]
  [.] Action [client-ingress-from-other-client-icmp-deny/client-to-client/ping-ipv4-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>:0)]
  [.] Action [client-ingress-from-other-client-icmp-deny/client-to-client/ping-ipv4-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>:0)]
  [-] Scenario [client-ingress-from-other-client-icmp-deny/pod-to-pod]
  [.] Action [client-ingress-from-other-client-icmp-deny/pod-to-pod/curl-ipv4-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://<IP_ADDRESS>:8080" failed: error with exec request (pod=cilium-test/client-996668d96-kw6fb, container=client): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client-996668d96-kw6fb during action curl-ipv4-0
  📄 No flows recorded for peer cilium-test/echo-other-node-666d8db686-s4vwz during action curl-ipv4-0
  [.] Action [client-ingress-from-other-client-icmp-deny/pod-to-pod/curl-ipv4-1: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  [.] Action [client-ingress-from-other-client-icmp-deny/pod-to-pod/curl-ipv4-2: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://<IP_ADDRESS>:8080" failed: error with exec request (pod=cilium-test/client2-84c66894fd-nbxpw, container=client2): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client2-84c66894fd-nbxpw during action curl-ipv4-2
  📄 No flows recorded for peer cilium-test/echo-other-node-666d8db686-s4vwz during action curl-ipv4-2
  [.] Action [client-ingress-from-other-client-icmp-deny/pod-to-pod/curl-ipv4-3: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  ℹ  📜 Deleting CiliumNetworkPolicy 'allow-all-egress' from namespace 'cilium-test'..
  ℹ  📜 Deleting CiliumNetworkPolicy 'allow-all-ingress' from namespace 'cilium-test'..
  ℹ  📜 Deleting CiliumNetworkPolicy 'client-ingress-from-other-client-icmp-deny' from namespace 'cilium-test'..
[=] Test [client-egress-to-echo-deny] [28/58]
......
[=] Test [client-ingress-to-echo-named-port-deny] [29/58]
...
  ℹ  📜 Applying CiliumNetworkPolicy 'allow-all-egress' to namespace 'cilium-test'..
  ℹ  📜 Applying CiliumNetworkPolicy 'allow-all-ingress' to namespace 'cilium-test'..
  ℹ  📜 Applying CiliumNetworkPolicy 'client-ingress-to-echo-named-port-deny' to namespace 'cilium-test'..
  [-] Scenario [client-ingress-to-echo-named-port-deny/pod-to-pod]
  [.] Action [client-ingress-to-echo-named-port-deny/pod-to-pod/curl-ipv4-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  [.] Action [client-ingress-to-echo-named-port-deny/pod-to-pod/curl-ipv4-1: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  [-] Scenario [client-ingress-to-echo-named-port-deny/pod-to-pod]
  [.] Action [client-ingress-to-echo-named-port-deny/pod-to-pod/curl-ipv4-0: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://<IP_ADDRESS>:8080" failed: error with exec request (pod=cilium-test/client2-84c66894fd-nbxpw, container=client2): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client2-84c66894fd-nbxpw during action curl-ipv4-0
  📄 No flows recorded for peer cilium-test/echo-other-node-666d8db686-s4vwz during action curl-ipv4-0
  [.] Action [client-ingress-to-echo-named-port-deny/pod-to-pod/curl-ipv4-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  ℹ  📜 Deleting CiliumNetworkPolicy 'allow-all-egress' from namespace 'cilium-test'..
  ℹ  📜 Deleting CiliumNetworkPolicy 'allow-all-ingress' from namespace 'cilium-test'..
  ℹ  📜 Deleting CiliumNetworkPolicy 'client-ingress-to-echo-named-port-deny' from namespace 'cilium-test'..
[=] Test [client-egress-to-echo-expression-deny] [30/58]
.
  ℹ  📜 Applying CiliumNetworkPolicy 'allow-all-egress' to namespace 'cilium-test'..
  ℹ  📜 Applying CiliumNetworkPolicy 'allow-all-ingress' to namespace 'cilium-test'..
  ℹ  📜 Applying CiliumNetworkPolicy 'client-egress-to-echo-expression-deny' to namespace 'cilium-test'..
  [-] Scenario [client-egress-to-echo-expression-deny/pod-to-pod]
  [.] Action [client-egress-to-echo-expression-deny/pod-to-pod/curl-ipv4-0: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://<IP_ADDRESS>:8080" failed: error with exec request (pod=cilium-test/client2-84c66894fd-nbxpw, container=client2): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client2-84c66894fd-nbxpw during action curl-ipv4-0
  📄 No flows recorded for peer cilium-test/echo-other-node-666d8db686-s4vwz during action curl-ipv4-0
  [.] Action [client-egress-to-echo-expression-deny/pod-to-pod/curl-ipv4-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  [-] Scenario [client-egress-to-echo-expression-deny/pod-to-pod]
  [.] Action [client-egress-to-echo-expression-deny/pod-to-pod/curl-ipv4-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  [.] Action [client-egress-to-echo-expression-deny/pod-to-pod/curl-ipv4-1: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  ℹ  📜 Deleting CiliumNetworkPolicy 'allow-all-egress' from namespace 'cilium-test'..
  ℹ  📜 Deleting CiliumNetworkPolicy 'allow-all-ingress' from namespace 'cilium-test'..
  ℹ  📜 Deleting CiliumNetworkPolicy 'client-egress-to-echo-expression-deny' from namespace 'cilium-test'..
[=] Test [client-with-service-account-egress-to-echo-deny] [31/58]
...
  ℹ  📜 Applying CiliumNetworkPolicy 'allow-all-egress' to namespace 'cilium-test'..
  ℹ  📜 Applying CiliumNetworkPolicy 'allow-all-ingress' to namespace 'cilium-test'..
  ℹ  📜 Applying CiliumNetworkPolicy 'client-with-service-account-egress-to-echo-deny' to namespace 'cilium-test'..
  [-] Scenario [client-with-service-account-egress-to-echo-deny/pod-to-pod]
  [.] Action [client-with-service-account-egress-to-echo-deny/pod-to-pod/curl-ipv4-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  [.] Action [client-with-service-account-egress-to-echo-deny/pod-to-pod/curl-ipv4-1: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  [-] Scenario [client-with-service-account-egress-to-echo-deny/pod-to-pod]
  [.] Action [client-with-service-account-egress-to-echo-deny/pod-to-pod/curl-ipv4-0: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://<IP_ADDRESS>:8080" failed: error with exec request (pod=cilium-test/client2-84c66894fd-nbxpw, container=client2): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client2-84c66894fd-nbxpw during action curl-ipv4-0
  📄 No flows recorded for peer cilium-test/echo-other-node-666d8db686-s4vwz during action curl-ipv4-0
  [.] Action [client-with-service-account-egress-to-echo-deny/pod-to-pod/curl-ipv4-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  ℹ  📜 Deleting CiliumNetworkPolicy 'allow-all-egress' from namespace 'cilium-test'..
  ℹ  📜 Deleting CiliumNetworkPolicy 'allow-all-ingress' from namespace 'cilium-test'..
  ℹ  📜 Deleting CiliumNetworkPolicy 'client-with-service-account-egress-to-echo-deny' from namespace 'cilium-test'..
[=] Test [client-egress-to-echo-service-account-deny] [32/58]
.
  ℹ  📜 Applying CiliumNetworkPolicy 'allow-all-egress' to namespace 'cilium-test'..
  ℹ  📜 Applying CiliumNetworkPolicy 'allow-all-ingress' to namespace 'cilium-test'..
  ℹ  📜 Applying CiliumNetworkPolicy 'client-egress-to-echo-service-account-deny' to namespace 'cilium-test'..
  [-] Scenario [client-egress-to-echo-service-account-deny/pod-to-pod]
  [.] Action [client-egress-to-echo-service-account-deny/pod-to-pod/curl-ipv4-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  ❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --output /dev/null --connect-timeout 2 --max-time 10 http://<IP_ADDRESS>:8080" failed: error with exec request (pod=cilium-test/client-996668d96-kw6fb, container=client): command terminated with exit code 28
  ℹ  curl output:

  📄 No flows recorded for peer cilium-test/client-996668d96-kw6fb during action curl-ipv4-0
  📄 No flows recorded for peer cilium-test/echo-other-node-666d8db686-s4vwz during action curl-ipv4-0
  [.] Action [client-egress-to-echo-service-account-deny/pod-to-pod/curl-ipv4-1: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-same-node-778f495746-m9ncg (<IP_ADDRESS>:8080)]
  ℹ  📜 Deleting CiliumNetworkPolicy 'allow-all-egress' from namespace 'cilium-test'..
  ℹ  📜 Deleting CiliumNetworkPolicy 'allow-all-ingress' from namespace 'cilium-test'..
  ℹ  📜 Deleting CiliumNetworkPolicy 'client-egress-to-echo-service-account-deny' from namespace 'cilium-test'..
[=] Test [client-egress-to-cidr-deny] [33/58]
....
[=] Test [client-egress-to-cidr-deny-default] [34/58]
....
[=] Skipping Test [health] [35/58] (Feature health-checking is disabled)
[=] Skipping Test [north-south-loadbalancing] [36/58] (Feature node-without-cilium is disabled)
[=] Test [pod-to-pod-encryption] [37/58]
.
  [-] Scenario [pod-to-pod-encryption/pod-to-pod-encryption]
  [.] Action [pod-to-pod-encryption/pod-to-pod-encryption/curl-ipv4: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)]
  ❌ Expected to see unencrypted packets, but none found. This check might be broken
  ❌ Expected to see unencrypted packets, but none found. This check might be broken
  📄 No flows recorded for peer cilium-test/client-996668d96-kw6fb during action curl-ipv4
  📄 No flows recorded for peer cilium-test/echo-other-node-666d8db686-s4vwz during action curl-ipv4
[=] Test [node-to-node-encryption] [38/58]
...
[=] Skipping Test [egress-gateway-excluded-cidrs] [39/58] (Feature node-without-cilium is disabled)
[=] Skipping Test [pod-to-node-cidrpolicy] [40/58] (Feature cidr-match-nodes is disabled)
[=] Skipping Test [north-south-loadbalancing-with-l7-policy] [41/58] (Feature node-without-cilium is disabled)
[=] Skipping Test [echo-ingress-l7] [42/58] (Feature l7-proxy is disabled)
[=] Skipping Test [echo-ingress-l7-named-port] [43/58] (Feature l7-proxy is disabled)
[=] Skipping Test [client-egress-l7-method] [44/58] (Feature l7-proxy is disabled)
[=] Skipping Test [client-egress-l7] [45/58] (Feature l7-proxy is disabled)
[=] Skipping Test [client-egress-l7-named-port] [46/58] (Feature l7-proxy is disabled)
[=] Skipping Test [client-egress-l7-tls-deny-without-headers] [47/58] (Feature l7-proxy is disabled)
[=] Skipping Test [client-egress-l7-tls-headers] [48/58] (Feature l7-proxy is disabled)
[=] Skipping Test [client-egress-l7-set-header] [49/58] (Feature l7-proxy is disabled)
[=] Skipping Test [echo-ingress-auth-always-fail] [50/58] (Feature mutual-auth-spiffe is disabled)
[=] Skipping Test [echo-ingress-mutual-auth-spiffe] [51/58] (Feature mutual-auth-spiffe is disabled)
[=] Skipping Test [pod-to-ingress-service] [52/58] (Feature ingress-controller is disabled)
[=] Skipping Test [pod-to-ingress-service-deny-all] [53/58] (Feature ingress-controller is disabled)
[=] Skipping Test [pod-to-ingress-service-deny-ingress-identity] [54/58] (Feature ingress-controller is disabled)
[=] Skipping Test [pod-to-ingress-service-deny-backend-service] [55/58] (Feature ingress-controller is disabled)
[=] Skipping Test [pod-to-ingress-service-allow-ingress-identity] [56/58] (Feature ingress-controller is disabled)
[=] Skipping Test [dns-only] [57/58] (Feature l7-proxy is disabled)
[=] Skipping Test [to-fqdns] [58/58] (Feature l7-proxy is disabled)

📋 Test Report
❌ 12/36 tests failed (30/232 actions), 22 tests skipped, 0 scenarios skipped:
Test [no-policies]:
  ❌ no-policies/pod-to-hostport/curl-0: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:4000)
  ❌ no-policies/pod-to-hostport/curl-2: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:4000)
  ❌ no-policies/pod-to-world/http-to-one.one.one.one-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> one.one.one.one-http (one.one.one.one:80)
  ❌ no-policies/pod-to-world/https-to-one.one.one.one-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> one.one.one.one-https (one.one.one.one:443)
  ❌ no-policies/pod-to-world/https-to-one.one.one.one-index-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> one.one.one.one-https-index (one.one.one.one:443)
  ❌ no-policies/pod-to-world/http-to-one.one.one.one-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> one.one.one.one-http (one.one.one.one:80)
  ❌ no-policies/pod-to-world/https-to-one.one.one.one-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> one.one.one.one-https (one.one.one.one:443)
  ❌ no-policies/pod-to-world/https-to-one.one.one.one-index-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> one.one.one.one-https-index (one.one.one.one:443)
  ❌ no-policies/pod-to-service/curl-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node (echo-other-node.cilium-test:8080)
  ❌ no-policies/pod-to-service/curl-1: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-same-node (echo-same-node.cilium-test:8080)
  ❌ no-policies/pod-to-service/curl-2: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node (echo-other-node.cilium-test:8080)
  ❌ no-policies/pod-to-service/curl-3: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-same-node (echo-same-node.cilium-test:8080)
Test [allow-all-except-world]:
  ❌ allow-all-except-world/pod-to-pod/curl-ipv4-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)
  ❌ allow-all-except-world/pod-to-pod/curl-ipv4-2: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)
  ❌ allow-all-except-world/pod-to-service/curl-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node (echo-other-node.cilium-test:8080)
  ❌ allow-all-except-world/pod-to-service/curl-1: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-same-node (echo-same-node.cilium-test:8080)
  ❌ allow-all-except-world/pod-to-service/curl-2: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node (echo-other-node.cilium-test:8080)
  ❌ allow-all-except-world/pod-to-service/curl-3: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-same-node (echo-same-node.cilium-test:8080)
Test [echo-ingress]:
  ❌ echo-ingress/pod-to-pod/curl-ipv4-2: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)
Test [echo-ingress-knp]:
  ❌ echo-ingress-knp/pod-to-pod/curl-ipv4-2: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)
Test [to-entities-world]:
  ❌ to-entities-world/pod-to-world/http-to-one.one.one.one-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> one.one.one.one-http (one.one.one.one:80)
  ❌ to-entities-world/pod-to-world/http-to-one.one.one.one-1: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> one.one.one.one-http (one.one.one.one:80)
Test [echo-ingress-from-other-client-deny]:
  ❌ echo-ingress-from-other-client-deny/pod-to-pod/curl-ipv4-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)
Test [client-ingress-from-other-client-icmp-deny]:
  ❌ client-ingress-from-other-client-icmp-deny/pod-to-pod/curl-ipv4-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)
  ❌ client-ingress-from-other-client-icmp-deny/pod-to-pod/curl-ipv4-2: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)
Test [client-ingress-to-echo-named-port-deny]:
  ❌ client-ingress-to-echo-named-port-deny/pod-to-pod/curl-ipv4-0: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)
Test [client-egress-to-echo-expression-deny]:
  ❌ client-egress-to-echo-expression-deny/pod-to-pod/curl-ipv4-0: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)
Test [client-with-service-account-egress-to-echo-deny]:
  ❌ client-with-service-account-egress-to-echo-deny/pod-to-pod/curl-ipv4-0: cilium-test/client2-84c66894fd-nbxpw (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)
Test [client-egress-to-echo-service-account-deny]:
  ❌ client-egress-to-echo-service-account-deny/pod-to-pod/curl-ipv4-0: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)
Test [pod-to-pod-encryption]:
  ❌ pod-to-pod-encryption/pod-to-pod-encryption/curl-ipv4: cilium-test/client-996668d96-kw6fb (<IP_ADDRESS>) -> cilium-test/echo-other-node-666d8db686-s4vwz (<IP_ADDRESS>:8080)
connectivity test failed: 12 tests failed


Feature Request: Additional DSL

I really like the DSL Amber Feng form Stripe outlined in this blog post. Would love to see this project add support for something like that, ie. required, document, etc.
eg.
class ChargeCreateMethod < AbstractAPIMethod
  required :amount, :integer
  required :card_number, :string

  document :amount, "Amount, in cents."
  document :card_number, "The card number."

  resource ChargeAPIResource

  def execute
    create_charge(amount, card_number)
  end
end

class ChargeAPIResource < AbstractAPIResource
  required :id, :string
  required :amount, :integer
  required :card_number, :string
  required :success, :boolean

  def describe_card_number
    charge.redacted_card_number
  end
end

A good UX design principle is that you should make it really hard for your users to mess up or do the wrong thing. Why not apply this toward building the API as well?
One thing that we did that I thought was really cool was a system for documenting our API. To try to address "I forgot to update the docs!" syndrome, we made it really hard to forget by putting the documentation right under the code that adds a new property.

Our documentation then auto-generates itself from these specs—for changing most things, there's no need to go dig up static HTML files.

Source: Amber Feng - Move Fast, Don't Break Your API

You might be interested in my fork of this project: https://github.com/taylorthurlow/interaktor
It's not production-ready but at least you might have some opinions on how I'm doing things over there.


AnyJSON null support

Add support for null values in free-form JSON value.
{
    "decoded_body": {
        "query_id":<PHONE_NUMBER>,
        "amount": "1000000000",
        "destination": "0:25603f6d7d3a1c6f981f02237c917150a6f2af971e83dd9e19605fa57a5d5b00",
        "response_destination": "0:25603f6d7d3a1c6f981f02237c917150a6f2af971e83dd9e19605fa57a5d5b00",
        "custom_payload": null,
        "forward_ton_amount": "1",
        "forward_payload": {
        "is_right": false,
        "value": "b5ee9c7201010101000300000140"
        }
    }
}

did something change recently? i'm just getting this error now. i don't think it was a problem a couple weeks ago

Related: #173

+1 on this, i was trying to encode a new type and was getting a crash that i couldn't figure out for a while
i'm going to use the exclude: [Json] and import GenericJSON for myself, like @sjmueller described in #173, but doing any one of the 3 following seem like a good idea:

merging this to support null
having a special error message that fires, linking to this issue or #173, instead of crashing inside JSONEncoder with an EXC_BREAKPOINT
providing an official override for Json


Setup GitHub Actions

Description
This task is to implement the pipeline that executes the various tools defined in our testing strategy.
Acceptance Criteria

main & dev are configured to be protected branches.
PRs require at least 1 approval to be merged.
GitHub Actions is setup to run within PRs and execute the following commands:

npm run lint
npm run test
npm run test:e2e

To avoid blocking this task, I'm going to defer running npm run lint until it's in a state where all linting errors are addressed.


Rebase release 1.9

Description

Re-base to release-1.9 of upstream.
Steps followed
Note: upstream set to https://github.com/cert-manager/cert-manager

git fetch upstream
git checkout master
git checkout -b rebase-release-1.9
git rebase upstream/release-1.9
git push --set-upstream origin rebase-release-1.9

/close
rebase will be done directly on master from upstream, so that tags from upstream can be fetched as well.


MCS 3D and userData refactoring

Reference Issue

Discussion https://github.com/rdkit/rdkit/discussions/3675
Should I create an issue? From the dicussion it didn't seem necessary, but I'm happy to.
Also relates to https://github.com/rdkit/rdkit/pull/509 and fixes #508
What does this implement/fix? Explain your changes.
I've added two parameters to MCS:
MaxDistance
ConformerIdxs
Both are optional. MaxDistance < 0 will be ignored. If >0, then atoms will only match if their distance is within that cutoff.
ConformerIdxs allows you to specify a list of conformer ids in case your input molecules have multiple conformers.
Any other comments?
I have refactored a couple of things and changed the way userData is handled in the MCS code. It's still there, but it isn't actually used in the default code - previously we were using userData to cache data about rings.
Now, the Python wrapper handles the RingMatchTableSet data much more elegantly in my opinion.
Once the build passes I will update this PR with my rationale for the refactoring.
I also created a gist with an ipython notebook illustrating the mapping under different  settings: https://gist.github.com/robbason/42344018baf727855df1e4757ec18425

@robbason I think it's probably worth ignoring the two CI build failures connected to Java for the moment.
Let's discuss the rest of this and then, if/when we have something everyone's happy with we can figure out how to hammer SWIG into shape.

@robbason I think it's probably worth ignoring the two CI build failures connected to Java for the moment.
Let's discuss the rest of this and then, if/when we have something everyone's happy with we can figure out how to hammer SWIG into shape.

@robbason I think it's probably worth ignoring the two CI build failures connected to Java for the moment.
Let's discuss the rest of this and then, if/when we have something everyone's happy with we can figure out how to hammer SWIG into shape.

Thanks @greglandrum . I figured out the Java issue and pushed a fix along with a test for the conformer ID specification option.
I think the biggest changes are:
1: Using 'MCSCompareFunctionsData' instead of the userData pointer.

Pro: it enabled simplification of the Python wrapper code, and it enables us to maintain more state without so much convolution
Con: Call signatures have changed for the C++ code, so anyone with custom compare functors will have to tweak their code.
I understand if you feel like the con outweighs the pro here. It really seems that the way we were using userData was inelegant. I tried hard to avoid changing the signature, but it seems like the best way to do that would be to radically simplify this request and drop the optimization I made (suggested by @bp-kelley) to cache the results of the atom pairwise distance calculations, and drop the ability to specify conformer Ids that are not 0.

2: Refactoring of MaximumCommonSubgraph.cpp. I moved a bunch of code here into functions, which I thought clarified the code a lot.  But this change is not necessary for the specific feature, so I am happy to go back to the old way here. What do you think?
I saw that we cache the results of the functors for every loop through the molecule list with  a different query molecule, and I think it would be a relatively safe optimization to cache the results on a pairwise basis (like I did with the atom distance pairs). Not sure how sensitive we are to MCS performance. I didn't make this change but if you want I can.
Thanks!
Braxton

@robbason I think it's probably worth ignoring the two CI build failures connected to Java for the moment.
Let's discuss the rest of this and then, if/when we have something everyone's happy with we can figure out how to hammer SWIG into shape.

Thanks @greglandrum . I figured out the Java issue and pushed a fix along with a test for the conformer ID specification option.
I think the biggest changes are:
1: Using 'MCSCompareFunctionsData' instead of the userData pointer.

Pro: it enabled simplification of the Python wrapper code, and it enables us to maintain more state without so much convolution
Con: Call signatures have changed for the C++ code, so anyone with custom compare functors will have to tweak their code.
I understand if you feel like the con outweighs the pro here. It really seems that the way we were using userData was inelegant. I tried hard to avoid changing the signature, but it seems like the best way to do that would be to radically simplify this request and drop the optimization I made (suggested by @bp-kelley) to cache the results of the atom pairwise distance calculations, and drop the ability to specify conformer Ids that are not 0.

2: Refactoring of MaximumCommonSubgraph.cpp. I moved a bunch of code here into functions, which I thought clarified the code a lot.  But this change is not necessary for the specific feature, so I am happy to go back to the old way here. What do you think?
I saw that we cache the results of the functors for every loop through the molecule list with  a different query molecule, and I think it would be a relatively safe optimization to cache the results on a pairwise basis (like I did with the atom distance pairs). Not sure how sensitive we are to MCS performance. I didn't make this change but if you want I can.
Thanks!

However, as I said before, any attempt to improve the current situation (which is inelegant, but works well) will introduce a breaking change. We try to avoid them as much as we can.
As the new 3D MCS functionality does not require the userData refactoring, I would suggest to move all the refactoring to a separate PR, and leave in this one only the 3D MCS-relevant code. This will simplify and expedite the review.

However, as I said before, any attempt to improve the current situation (which is inelegant, but works well) will introduce a breaking change. We try to avoid them as much as we can.
As the new 3D MCS functionality does not require the userData refactoring, I would suggest to move all the refactoring to a separate PR, and leave in this one only the 3D MCS-relevant code. This will simplify and expedite the review.

@ptosco that's reasonable. I'll have to cut out the atom pairwise distance cache optimization and the ability to specify non-default conformer IDs too, which was why I did the refactoring in the first place. I agree that breaking changes are best avoided. Perhaps I should wait to put the refactoring in when there's a major version upgrade planned?

@ptosco that's reasonable. I'll have to cut out the atom pairwise distance cache optimization and the ability to specify non-default conformer IDs too, which was why I did the refactoring in the first place. I agree that breaking changes are best avoided. Perhaps I should wait to put the refactoring in when there's a major version upgrade planned?

I'm closing this PR in favor of a minimal implementation. I was thinking that a good way to refactor userData would be to:

Deprecate the AtomTyper and BondTyper parameters
Add new replacement parameters AtomFilters and BondFilters. These would be vectors of functions. So if you want to piggyback off of current filters as well as to add a custom filter, you would create a vector like [ElementMatchFilter, RingMatchesRingOnlyFilter, MaxDistanceFilter, CustomFilter]

Alternate: the parameters to the filters could be passed in when you create the custom filters, like so: [ElementMatchFilter(), MaxDistanceFilter(2.5, [0,1,0,0])]

Python wrapper and R-group decomposition code in the rdkit codebase would be modified to use the replacement parameters, not the deprecated parameters

If you used the deprecated parameters, we'd still pass around a CompareFunctionsData struct, but we'd pass its userData pointer to the typer you passed in. So, for example, if you overrode AtomTyper, but not BondTyper, the RingMatchTableSet would be maintained through CompareFunctionsData rather than in userData. But if you overrode BondTyper, the RingMatchTableSet would be updated in CompareFunctionsData, but it wouldn't be passed to your custom BondTyper.
That seems like a safe way to implement this without breaking existing client code. What do you think?

I'm closing this PR in favor of a minimal implementation. I was thinking that a good way to refactor userData would be to:

Deprecate the AtomTyper and BondTyper parameters
Add new replacement parameters AtomFilters and BondFilters. These would be vectors of functions. So if you want to piggyback off of current filters as well as to add a custom filter, you would create a vector like [ElementMatchFilter, RingMatchesRingOnlyFilter, MaxDistanceFilter, CustomFilter]

Alternate: the parameters to the filters could be passed in when you create the custom filters, like so: [ElementMatchFilter(), MaxDistanceFilter(2.5, [0,1,0,0])]

Python wrapper and R-group decomposition code in the rdkit codebase would be modified to use the replacement parameters, not the deprecated parameters

If you used the deprecated parameters, we'd still pass around a CompareFunctionsData struct, but we'd pass its userData pointer to the typer you passed in. So, for example, if you overrode AtomTyper, but not BondTyper, the RingMatchTableSet would be maintained through CompareFunctionsData rather than in userData. But if you overrode BondTyper, the RingMatchTableSet would be updated in CompareFunctionsData, but it wouldn't be passed to your custom BondTyper.
That seems like a safe way to implement this without breaking existing client code. What do you think?


Change in how input projections are implemented. seem to converge faster

@draguve Thanks for this!
I'm not seeing a significant change in training convergence.  Here are some brief training logs on the Project Gutenberg example:

red -> main with bias=False
green -> this branch

I wonder if the issue is specific to your application, and possibly just due to differences in initialization.


Removing account key from output in stress tests

Description
Key to the storage resource account that is used for stress tests is being exposed here - https://ms.portal.azure.com/#view/HubsExtension/DeploymentDetailsBlade/~/overview/id/%2Fsubscriptions%2Fba45b233-e2ef-4169-8808-49eb0d8eba0d%2FresourceGroups%2Frg-stress-cluster-storage%2Fproviders%2FMicrosoft.Resources%2Fdeployments%2Fstorage
The storage account key is being exposed in the deployment output - https://ms.portal.azure.com/#view/HubsExtension/DeploymentDetailsBlade/~/outputs/id/%2Fsubscriptions%2Fba45b233-e2ef-4169-8808-49eb0d8eba0d%2FresourceGroups%2Frg-stress-cluster-storage%2Fproviders%2FMicrosoft.Resources%2Fdeployments%2Fstorage
Removing the use of the connection string with the account key, since all tests have been moved over to use DefaultAzureCredential.

/check-enforcer override


fix: actual error won't be raised while force_download=True

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.


OAuthException

I get a error when trying to use slidetagram.  {"code": 400, "error_type": "OAuthException", "error_message": "Redirect URI does not match registered redirect URI"}.
Would you help with this?
What do I need to configure or change?

Did you cloned it in another server?
If you did this, you need to create a new ˜client˜.
https://www.instagram.com/developer/clients/register/
Then you will receive a new client id, that you will need to change
https://github.com/achvaicer/slidetagram/blob/gh-pages/index.html#L67
And register your domain as redirect URL on your client.
But it`s not easy to be approved anymore by Instagram as a client.

Thanks for the info.


Fix jcenter

Bumped to RN 66 and Android 31
Removed QR scanner to be able to build app at the moment.
Wont delete fix-jcenter branch

You will need to reinstall Android tools. To do so:
adb kill-server
rm -r ~/Android
vi ~/.bashrc # at end of file remove all lines associated with Java, Android or React
# clone the repo & cd there
./install
yarn cache clean && rm -r ./node_modules
yarn install
# dependencies now ready
yarn android
yarn start

TODO: Test iOS @lmaos-txt

@mptr iOS should be fine. Will test soon

Did not test Android
iOS works now!
@mptr integrate?

throws Frame Processor threw an error: Value is undefined, expected an Object if camera active.


Rubber gloves for janitors

About the PR

Once upon a time, a mere ideasguy mentioned the idea. Little did they know, it became a reality. Why do janitors have to clean with their bare hands? It's messy! Time to give them gloves...
It looks nearly exactly like yellow (insul) gloves but longer.
Media

[X] I have added screenshots/videos to this PR showcasing its changes ingame, or this PR does not require an ingame showcase

Changelog
:cl: Ubaser

add: Janitors now get rubber gloves for cleaning.

Merge this immediately

i formatted it like you asked


nvm_mirror npmmirror is not exist npm

How To Reproduce:

Install nvm-windows 1.1.9 on Window 10
setting mirror
node_mirror: https://npmmirror.com/mirrors/node/
npm_mirror: https://npmmirror.com/mirrors/npm/
Powershell Enter: nvm install 10.20.1
See error

Downloading node.js version
10.20.1 (64-bit)...
Complete
Downloading npm version 6.14.4... Download failed. Rolling Back.
Rollback failed. remove C:\Users\admin\AppData\Roaming\nvm\temp\npm-v6.14.4.zip: The process cannot access the file because it is being used by another process.
Could not download npm for node v10.20.1.
Please visit https://github.com/npm/cli/releases/tag/v6.14.4 to download npm.
It should be extracted to C:\Users\admin\AppData\Roaming\nvm\v10.20.1

Visit https://npmmirror.com/mirrors/npm/  ,bowers redirect  https://registry.npmmirror.com/binary.html?path=npm/

I found zhihu.com post , https://zhuanlan.zhihu.com/p/430580607

mirrors upload npm folder, problem is fixed.


http: connection: close header is not sent when HCM is in draining state

This probably regressed at some point years ago, and has been this way for a while, but we just realized that when the HCM is in the draining state (not closing) for HTTP/1, we don't set the "Connection: close" header on outgoing responses. To match the behavior of the double GOAWAY from HTTP/2, we should be setting this header and giving clients the time to not reuse the connection or pipeline.
mklein@localhost:~/Source/envoy$ git diff
diff --git a/source/common/http/conn_manager_impl.cc b/source/common/http/conn_manager_impl.cc
index 8c804ba1b..ee6d42761 100644
--- a/source/common/http/conn_manager_impl.cc
+++ b/source/common/http/conn_manager_impl.cc
@@ -1286,7 +1286,7 @@ void ConnectionManagerImpl::ActiveStream::encodeHeaders(ActiveStreamEncoderFilte
     connection_manager_.stats_.named_.downstream_rq_response_before_rq_complete_.inc();
   }

-  if (connection_manager_.drain_state_ == DrainState::Closing &&
+  if (connection_manager_.drain_state_ != DrainState::NotDraining &&
       connection_manager_.codec_->protocol() != Protocol::Http2) {
     // If the connection manager is draining send "Connection: Close" on HTTP/1.1 connections.
     // Do not do this for H2 (which drains via GOAWAY) or Upgrade (as the upgrade

cc @alyssawilk for any comment.

@alyssawilk FYI someone at Lyft is going to fix this as a learning bug. @lita can you tag them?

Oh, even better!
I think my only comment is pointing to my TODO by decodeHeaders about the connection: close code being pretty fragile.  So if your learning Lyfter has any interest in a follow-up bug they could look at that too ;-)

yup! @jyotimahapatra

Hi @alyssawilk , Nice to meet you here. I am new here and trying to fix this starter issue.
I am trying to write a test that repros the situation and then perform the mentioned fix. Matt mentioned in a different forum that this situation occurs in a race condition situation when using pipelining in a H1 connection.
All code paths today set the drain_state_ to DrainState::Closing and I am trying to figure out a code path that will cause it to stay in Draining state at the intended code line.

Looks like fixed in https://github.com/envoyproxy/envoy/pull/6848

Looking at the test, looks like keep-alive is what I was looking for to repro the situation. Good learning for me.

@jyotimahapatra this is the line that repros: https://github.com/envoyproxy/envoy/pull/6848/files#diff-ed63d9053f7d0b3777c96f2aaf8f2f2fR4178

Yes. I got that part right.
I couldn't get this part right. Without the keepalive the drainstate was getting set to Closing already.
HeaderMapPtr headers{new TestHeaderMapImpl{         {":authority", "host"}, {":path", "/"}, {":method", "GET"}, {"connection", "keep-alive"}}};

I haven't checked, but I don't think that should be required. Keep alive is assumed for HTTP/1.1. cc @kmyerson

I see. Ok. i will get the branch and debug through it. It will be a good exercise for me

@alyssawilk you mentioned a follow up bug. I could attempt that if you can put some problem statement for me. :)


Pls. add version of Alpine, Debian and Ubuntu on which it's working.

In README is written

Pls specify the versions of the mentioned OS where the script worx
Many THX for saving time trying

It's working on Alpine 3.16, at least on Nginx Proxy Manager v2.9.14, i didn't tested newer version
Download Alpine 3.16 (Download got removed from Proxmox Template Downloader): https://cdn1.craeckor.ch/data/alpine-3.16-default_20220622_amd64.tar.xz


Crossplane Provider AWS retry resource creation

What happened? and How can we reproduce it?
We faced a Critical issue.
Crossplane Provider AWS retry resource creation even if it's not possible to create this resource.
And it causes a DDOS attack on AWS API, as a result, all requests are gonna be throttled.
There is no way to control this behavior.
I found only https://github.com/crossplane-contrib/provider-aws/blob/master/cmd/provider/main.go#L48-L53
But those values are not enough and seems that there should be the ability to manage those values on a resource-level interface instead of general ControllerConfig.
Logically there should be values like "max-retry", and "request-timeout".
Also, if the problem with permissions the retry should be stopped.
We have this in 2 situations:

We use IAM Role with IAM Policy that allows only specific resources to be created.
When trying to create a resource that is not in the allowed list, AWS will return an access error, but crossplane will retry it constantly. And it causes a DDOS attack on AWS API, as a result, all requests are gonna be throttled.

We have several EKS clusters with ArgoCD and manage our AWS resources with crossplane.
Each cluster adds a unique cluster id to resource tags.

We want to create an SNS topic, but let's say we didn't change the SNS topic name.
As result, the first Topic will be created, but the second will not be and crossplane will retry many times.
And it causes a DDOS attack on AWS API, as a result, all requests are gonna be throttled.
Adding screenshot:

What environment did it happen in?
Crossplane version: v1.11.0 (https://charts.crossplane.io/stable)
Crossplane provider aws version: "crossplane/provider-aws: v0.32.0"
Cloud provider: AWS
Kubernetes version: 1.24

Please, prioritize this issue.

@haarchri please review

@MisterMX thank you for the information, but do you still use crossplane in production even with this bug?

Yes we do. We just try to avoid making mistakes ;)
Jokes aside, I believe this is actually critical. However, I believe it is already fixed with https://github.com/crossplane/crossplane-runtime/issues/40. I am not sure if the change made it into provider-aws already.

This sounds like the behavior discussed in https://github.com/crossplane/crossplane/issues/3455, which is getting active development effort in https://github.com/crossplane/crossplane-runtime/pull/372.


Support for decoding JWT

I wonder if the JWT middleware should have the option to decode the token and push it onto the context after verifying?

Hi @jeddeloh , thank you for the opinion. I'll consider it.
@metrue , how about this feature? I think we can do it with c.get/c.set functions.

@jeddeloh I've put together a quick example for decoding asymmetric JWT here - that puts the JWT payload into the context. You could maybe reuse that pattern for the existing (symmetric) JWT middleware?

Thank you, @cd-slash! I've already written a small middleware for my needs, so I'm good to go. This ticket was only intended to propose a possible change to current JWT middleware.


Use "root" as variable name (LET clause)

OrientDB Version, operating system, or hardware.
v2.2.10
Operating System
Mac OS X
The problem
SELECT expand($x) LET $x = (SELECT FROM Event)
=> OK
SELECT expand($root) LET $root = (SELECT FROM Event)
=> No result found, but no error message
Is "root" a reserved keyword?

hi @benjaminbillet
seems that $root is a reserved context variable like those one
http://orientdb.com/docs/2.1/SQL-Where.html#variables
I think it's not listed there because it is used internally

@maggiolo00 could you please update the docs?

Thanks for your response.
However, in addition of the documentation update, I think that an explicit error should be triggered when a reserved internal variables is used in a query. Currently, it fails silently with a "0 result(s) found" message, which makes it very difficult to understand.

+1 to raise an error.

Hi @benjaminbillet
I just added it to the docs:
https://github.com/orientechnologies/orientdb-docs/blob/2.2.x/SQL-Where.md
now I'm adding a check on the LET clause, to make sure that it throws a parsing exception if reserved words are used
Thanks
Luigi

That's perfect @luigidellaquila, thanks a lot.

Hi @benjaminbillet
I just pushed a fix that does parse-time validation.
I'm closing this, please reopen if you see any related problems
Thanks
Luigi


[Bug]: "Error Code 1314" when trying to download a model from the hub

Is there an existing issue for this?

[X] I have searched the existing issues

Current Behavior
I used the following pipeline to compute an image embedding (from the tutorial):
p = (
pipe.input('path')
.map('path', 'img', ops.image_decode())
.map('img', 'vec', ops.image_embedding.timm(model_name='resnet50'))
.output('img', 'vec')
)
On my windows machine, I get the following error when executing the pipeline:
"Error Code 1314 - A required privilege is not held by the client"
This seems to be caused when towhee is trying to set a symlink:
File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.10_3.10.3056.0_x64__qbz5n2kfra8p0\lib\pathlib.py", line 1255, in symlink_to
self._accessor.symlink(target, self, target_is_directory)
Expected Behavior
The pipeline should be executed without errors. It works on my Ubuntu machine.
Steps To Reproduce
1. In Windows 10
2. Execute tutorial for image embeddings

Environment
- Towhee version(e.g. v0.1.3 or 8b23a93): 1.1.1
- OS(Ubuntu or CentOS): Windows
- CPU/Memory: 32GB
- GPU:
- Others:

Anything else?
No response

Can the ~/.towhee directory write files normally?

Thanks for the fast reply. Yes, I can write to the towhee directory. The bug still happens if I choose a different TOWHEE_HOME

It may be that the Window has disabled the symlink: https://stackoverflow.com/questions/32877260/privlege-error-trying-to-create-symlink-using-python-on-windows-10


The format of value '.NET/BulkExecutorLibrary/1.0.1' is invalid.

Hello, I founded this problem when I created two instances of the library of BulkInsert, and the expecion throws in the bulkExecutor.InitializeAsync(). My code is the following:

               ConnectionPolicy connectionPolicy = new ConnectionPolicy
                {
                    ConnectionMode = ConnectionMode.Direct,
                    ConnectionProtocol = Protocol.Tcp
                };

                clienteBulk = new DocumentClient(new Uri(Endpoint), Key, connectionPolicy);
                // Set retry options high during initialization (default values).
                clienteBulk.ConnectionPolicy.RetryOptions.MaxRetryWaitTimeInSeconds = 30;
                clienteBulk.ConnectionPolicy.RetryOptions.MaxRetryAttemptsOnThrottledRequests = 9;
                var coleccion = ObtenerColeccionSiExiste();
                bulkExecutor = new BulkExecutor(clienteBulk, coleccion);
                Task.Run(() => bulkExecutor.InitializeAsync()).Wait();

I founded the solution only we need to call the method DocumentClient.OpenAsync before to call
BulkExecutor.InitializeAsync() like this
clienteBulk = new DocumentClient(new Uri(Endpoint), Key, connectionPolicy);
                // Set retry options high during initialization (default values).
                clienteBulk.ConnectionPolicy.RetryOptions.MaxRetryWaitTimeInSeconds = 30;
                clienteBulk.ConnectionPolicy.RetryOptions.MaxRetryAttemptsOnThrottledRequests = 9;
                var coleccion = ObtenerColeccionSiExiste();

> Task.Run(() => clienteBulk.OpenAsync()).Wait();

                bulkExecutor = new BulkExecutor(clienteBulk, coleccion);

>  Task.Run(() => bulkExecutor.InitializeAsync()).Wait();

This should be fixed in 1.3.0 version now.