text:
[BUG] Connection insecure on Operate with Keycloak enabled

Describe the bug:
Operate and Keycloak is exposed via a secure https endpoint.
When I authenticate to Operate in the Keycloak UI, I have a "Connection insecure" warning.
Tested via Google Chrome and Mozilla Firefox.

Environment:

Platform: IBM Cloud Kubernetes Service
Chart version: 8.0.14
Values file:

# Default values for Camunda Platform helm.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

# The values file follows helm best practices https://helm.sh/docs/chart_best_practices/values/
#
# This means:
#   * Variable names should begin with a lowercase letter, and words should be separated with camelcase.
#   * Every defined property in values.yaml should be documented. The documentation string should begin with the name of the property that it describes, and then give at least a one-sentence description
#
# Furthermore, we try to apply the following pattern: # [VarName] [conjunction] [definition]
#
# VarName:
#
#  * In the documentation the variable name is started with a big letter, similar to kubernetes resource documentation.
#  * If the variable is part of a subsection/object we use a json path expression (to make it more clear where the variable belongs to).
#    The root (chart name) is omitted (e.g. zeebe). This is useful for using --set in helm.
#
# Conjunction:
#   * [defines] for mandatory configuration
#   * [can be used] for optional configuration
#   * [if true] for toggles
#   * [configuration] for section/group of variables

# Global configuration for variables which can be accessed by all sub charts
global:

  # Annotations can be used to define common annotations, which should be applied to all deployments
  annotations: {}
  # Labels can be used to define common labels, which should be applied to all deployments
  labels:
    app: camunda-platform

  # Image configuration to be used in each sub chart
  image:
    # Image.tag defines the tag / version which should be used in the chart
    tag: 8.0.0
    # Image.pullPolicy defines the image pull policy which should be used https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
    pullPolicy: IfNotPresent
    # Image.pullSecrets can be used to configure image pull secrets https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
    pullSecrets: []

  # Ingress configuration to configure the ingress resource
  ingress:
    # Ingress.enabled if true, an ingress resource is deployed. Only useful if an ingress controller is available, like Ingress-NGINX.
    enabled: true
    # Ingress.className defines the class or configuration of ingress which should be used by the controller
    className: public-iks-k8s-nginx
    # Ingress.annotations defines the ingress related annotations, consumed mostly by the ingress controller
    annotations:
      ingress.kubernetes.io/rewrite-target: "/"
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
    # Ingress.host can be used to define the host of the ingress rule. https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
    # If not specified the rules applies to all inbound http traffic, if specified the rule applies to that host.
    host: cwa.xxxxxxxxxxxxxx.com
    # Ingress.tls configuration for tls on the ingress resource https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
    tls:
      # Ingress.tls.enabled if true, then tls is configured on the ingress resource. If enabled the Ingress.host need to be defined.
      enabled: true
      # Ingress.tls.secretName defines the secret name which contains the TLS private key and certificate
      secretName: xxxxxxxxxxxxxx.com

  # Elasticsearch configuration which is shared between the sub charts
  elasticsearch:
    # Elasticsearch.disableExporter if true, disables the elastic exporter in zeebe
    disableExporter: false
    # Elasticsearch.url can be used to configure the URL to access elasticsearch, if not set services fallback to host and port configuration
    url:
    # Elasticsearch.host defines the elasticsearch host, ideally the service name inside the namespace
    host: "elasticsearch-master"
    # Elasticsearch.port defines the elasticsearch port, under which elasticsearch can be accessed
    port: 9200
    # Elasticsearch.clusterName defines the cluster name which is used by Elasticsearch
    clusterName: "elasticsearch"
    # Elasticsearch.prefix defines the prefix which is used by the Zeebe Elasticsearch Exporter to create Elasticsearch indexes
    prefix: zeebe-record
  # ZeebeClusterName defines the cluster name for the Zeebe cluster. All Zeebe pods get this prefix in their name and the brokers uses that as cluster name.
  zeebeClusterName: "{{ .Release.Name }}-zeebe"
  # ZeebePort defines the port which is used for the Zeebe Gateway. This port accepts the GRPC Client messages and forwards them to the Zeebe Brokers.
  zeebePort: 26500

  # Identity configuration to configure identity specifics on global level, which can be accessed by other sub-charts
  identity:
    keycloak:
      # Identity.keycloak.fullname can be used to change the referenced Keycloak service name inside the sub-charts, like operate, optimize, etc.
      # Subcharts can't access values from other sub-charts or the parent, global only.
      # This is useful if the identity.keycloak.fullnameOverride is set, and specifies a different name for the Keycloak service.
      fullname: ""
    # Identity.auth configuration, to configure Identity authentication setup
    auth:
      # Identity.auth.enabled if true, enables the Identity authentication otherwise basic-auth will be used on all services.
      enabled: true

      # Identity.auth.publicIssuerUrl defines the token issuer (Keycloak) URL, where the services can request JWT tokens.
      # Should be public accessible, per default we assume a port-forward to Keycloak (18080) is created before login.
      # Can be overwritten if, ingress is in use and an external IP is available.
      publicIssuerUrl: "https://keycloak.xxxxxxxxxxxxxx.com/auth/realms/camunda-platform"

      # Identity.auth.operate configuration to configure Operate authentication specifics on global level, which can be accessed by other sub-charts
      operate:
        # Identity.auth.operate.existingSecret can be used to reference an existing secret. If not set, a random secret is generated.
        # The existing secret should contain an `operate-secret` field, which will be used as secret for the Identity-Operate communication.
        existingSecret:
        # Identity.auth.operate.redirectUrl defines the redirect URL, which is used by Keycloak to access Operate.
        # Should be public accessible, the default value works if port-forward to Operate is created to 8081.
        # Can be overwritten if, ingress is in use and an external IP is available.
        redirectUrl: "https://operate.xxxxxxxxxxxxxx.com"

      # Identity.auth.tasklist configuration to configure Tasklist authentication specifics on global level, which can be accessed by other sub-charts
      tasklist:
        # Identity.auth.tasklist.existingSecret can be used to use an own existing secret. If not set a random secret is generated.
        # The existing secret should contain an `tasklist-secret` field, which will be used as secret for the Identity-Tasklist communication.
        existingSecret:
        # Identity.auth.tasklist.redirectUrl defines the root (or redirect) URL, which is used by Keycloak to access Tasklist.
        # Should be public accessible, the default value works if port-forward to Tasklist is created to 8082.
        # Can be overwritten if, ingress is in use and an external IP is available.
        redirectUrl: "https://tasklist.xxxxxxxxxxxxxx.com"

      # Identity.auth.optimize configuration to configure Optimize authentication specifics on global level, which can be accessed by other sub-charts
      optimize:
        # Identity.auth.optimize.existingSecret can be used to use an own existing secret. If not set a random secret is generated.
        # The existing secret should contain an `optimize-secret` field, which will be used as secret for the Identity-Optimize communication.
        existingSecret:
        # Identity.auth.optimize.redirectUrl defines the root (or redirect) URL, which is used by Keycloak to access Optimize.
        # Should be public accessible, the default value works if port-forward to Optimize is created to 8082.
        # Can be overwritten if, ingress is in use and an external IP is available.
        redirectUrl: "https://optimize.xxxxxxxxxxxxxx.com"

# Zeebe configuration for the Zeebe sub chart. Contains configuration for the Zeebe broker and related resources.
zeebe:
  # Enabled if true, all zeebe related resources are deployed via the helm release
  enabled: true

  # Image configuration to configure the zeebe image specifics
  image:
    # Image.repository defines which image repository to use
    repository: camunda/zeebe
    # Image.tag can be set to overwrite the global tag, which should be used in that chart
    tag:
    # Image.pullSecrets can be used to configure image pull secrets https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
    pullSecrets: []

  # ClusterSize defines the amount of brokers (=replicas), which are deployed via helm
  clusterSize: "1"
  # PartitionCount defines how many zeebe partitions are set up in the cluster
  partitionCount: "1"
  # ReplicationFactor defines how each partition is replicated, the value defines the number of nodes
  replicationFactor: "1"
  # Env can be used to set extra environment variables in each zeebe broker container
  env:
    - name: ZEEBE_BROKER_DATA_SNAPSHOTPERIOD
      value: "5m"
    - name: ZEEBE_BROKER_DATA_DISKUSAGECOMMANDWATERMARK
      value: "0.85"
    - name: ZEEBE_BROKER_DATA_DISKUSAGEREPLICATIONWATERMARK
      value: "0.87"
  # ConfigMap configuration which will be applied to the mounted config map.
  configMap:
    # ConfigMap.defaultMode can be used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
    # See https://github.com/kubernetes/api/blob/master/core/v1/types.go#L1615-L1623
    defaultMode: 0754
  # Command can be used to override the default command provided by the container image. See https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/
  command: []

  # LogLevel defines the log level which is used by the zeebe brokers
  logLevel: info
  # Log4j2 can be used to overwrite the log4j2 configuration of the zeebe brokers
  log4j2: ''
  # JavaOpts can be used to set java options for the zeebe brokers
  javaOpts: >-
    -XX:+HeapDumpOnOutOfMemoryError
    -XX:HeapDumpPath=/usr/local/zeebe/data
    -XX:ErrorFile=/usr/local/zeebe/data/zeebe_error%p.log
    -XX:+ExitOnOutOfMemoryError

 # Service configuration for the broker service
  service:
    # Service.type defines the type of the service https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
    type: ClusterIP
    # Service.httpPort defines the port of the http endpoint, where for example metrics are provided
    httpPort: 9600
    # Service.httpName defines the name of the http endpoint, where for example metrics are provided
    httpName: "http"
    # Service.commandPort defines the port of the command api endpoint, where the broker commands are sent to
    commandPort: 26501
    # Service.commandName defines the name of the command api endpoint, where the broker commands are sent to
    commandName: "command"
    # Service.internalPort defines the port of the internal api endpoint, which is used for internal communication
    internalPort: 26502
    # Service.internalName defines the name of the internal api endpoint, which is used for internal communication
    internalName: "internal"
    # extraPorts can be used to expose any other ports which are required. Can be useful for exporters
    extraPorts: []
      # - name: hazelcast
      #   protocol: TCP
      #   port: 5701
      #   targetPort: 5701

  # ServiceAccount configuration for the service account where the broker pods are assigned to
  serviceAccount:
    # ServiceAccount.enabled if true, enables the broker service account
    enabled: true
    # ServiceAccount.name can be used to set the name of the broker service account
    name: ""
    # ServiceAccount.annotations can be used to set the annotations of the broker service account
    annotations: {}

  # CpuThreadCount defines how many threads can be used for the processing on each broker pod
  cpuThreadCount: "3"
  # IoThreadCount defines how many threads can be used for the exporting on each broker pod
  ioThreadCount: "3"
  # Resources configuration to set request and limit configuration for the container https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits
  resources:
    requests:
      cpu: 800m
      memory: 1200Mi
    limits:
      cpu: 960m
      memory: 1920Mi

  # PersistenceType defines the type of persistence which is used by Zeebe. Possible values are: disk, local and memory.
  #   disk  - means a persistence volume claim is configured and used
  #   local - means the data is stored into the container, no volumeMount nor volume nor claim is configured
  #   memory   - means zeebe uses a tmpfs for the data persistence, be aware that this takes the limits into account
  persistenceType: disk
  # PvcSize defines the persistent volume claim size, which is used by each broker pod https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims
  pvcSize: "16Gi"
  # PvcAccessModes can be used to configure the persistent volume claim access mode https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes
  pvcAccessModes: ["ReadWriteOnce"]
  # PvcStorageClassName can be used to set the storage class name which should be used by the persistent volume claim. It is recommended to use a storage class, which is backed with a SSD.
  pvcStorageClassName: ''

  # ExtraVolumes can be used to define extra volumes for the broker pods, useful for additional exporters
  extraVolumes: []
  # ExtraVolumeMounts can be used to mount extra volumes for the broker pods, useful for additional exporters
  extraVolumeMounts: []
  # ExtraInitContainers can be used to set up extra init containers for the broker pods, useful for additional exporters
  extraInitContainers: []

  # PodAnnotations can be used to define extra broker pod annotations
  podAnnotations: {}
  # PodLabels can be used to define extra broker pod labels
  podLabels: {}
  # PodDisruptionBudget configuration to configure a pod disruption budget for the broker pods https://kubernetes.io/docs/tasks/run-application/configure-pdb/
  podDisruptionBudget:
    # PodDisruptionBudget.enabled if true a pod disruption budget is defined for the brokers
    enabled: false
    # PodDisruptionBudget.minAvailable can be used to set how many pods should be available. Be aware that if minAvailable is set, maxUnavailable will not be set (they are mutually exclusive).
    minAvailable:
    # podDisruptionBudget.maxUnavailable can be used to set how many pods should be at max. unavailable
    maxUnavailable: 1

  # PodSecurityContext defines the security options the Zeebe broker pod should be run with
  podSecurityContext: {}

  # ContainerSecurityContext defines the security options the Zeebe broker container should be run with
  containerSecurityContext: {}

  # NodeSelector can be used to define on which nodes the broker pods should run
  nodeSelector: {}
  # Tolerations can be used to define pod toleration's https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
  tolerations: []
  # Affinity can be used to define pod affinity or anti-affinity https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity
  # The default defined PodAntiAffinity allows constraining on which nodes the Zeebe pods are scheduled on https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
  # It uses a hard requirement for scheduling and works based on the Zeebe pod labels
  affinity:
    podAntiAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        - labelSelector:
            matchExpressions:
              - key: "app.kubernetes.io/component"
                operator: In
                values:
                  - zeebe-broker
          topologyKey: "kubernetes.io/hostname"

  # PriorityClassName can be used to define the broker pods priority https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass
  priorityClassName: ""

  # ReadinessProbe configuration for the zeebe broker readiness probe
  readinessProbe:
    # ReadinessProbe.probePath defines the readiness probe route used on the zeebe brokers
    probePath: /ready
    # ReadinessProbe.periodSeconds defines how often the probe is executed
    periodSeconds: 10
    # ReadinessProbe.successThreshold defines how often it needs to be true to be marked as ready, after failure
    successThreshold: 1
    # ReadinessProbe.timeoutSeconds defines the seconds after the probe times out
    timeoutSeconds: 1

# Gateway configuration to define properties related to the standalone gateway
zeebe-gateway:
  # Replicas defines how many standalone gateways are deployed
  replicas: 1
  # Image configuration to configure the zeebe-gateway image specifics
  image:
    # Image.repository defines which image repository to use
    repository: camunda/zeebe
    # Image.tag can be set to overwrite the global tag, which should be used in that chart
    tag:
    # Image.pullSecrets can be used to configure image pull secrets https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
    pullSecrets: []
  # PodAnnotations can be used to define extra gateway pod annotations
  podAnnotations: {}
  # PodLabels can be used to define extra gateway pod labels
  podLabels: {}

  # LogLevel defines the log level which is used by the gateway
  logLevel: info
  # Log4j2 can be used to overwrite the log4j2 configuration of the gateway
  log4j2: ''
  # JavaOpts can be used to set java options for the zeebe gateways
  javaOpts: >-
    -XX:+ExitOnOutOfMemoryError

  # Env can be used to set extra environment variables in each gateway container
  env: []
  # ConfigMap configuration which will be applied to the mounted config map.
  configMap:
    # ConfigMap.defaultMode can be used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
    # See https://github.com/kubernetes/api/blob/master/core/v1/types.go#L1615-L1623
    defaultMode: 0744
  # Command can be used to override the default command provided by the container image. See https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/
  command: []

  # PodDisruptionBudget configuration to configure a pod disruption budget for the gateway pods https://kubernetes.io/docs/tasks/run-application/configure-pdb/
  podDisruptionBudget:
    # PodDisruptionBudget.enabled if true a pod disruption budget is defined for the gateways
    enabled: false
    # PodDisruptionBudget.minAvailable can be used to set how many pods should be available. Be aware that if minAvailable is set, maxUnavailable will not be set (they are mutually exclusive).
    minAvailable: 1
    # PodDisruptionBudget.maxUnavailable can be used to set how many pods should be at max. unavailable
    maxUnavailable:

  # Resources configuration to set request and limit configuration for the container https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits
  resources:
    requests:
      cpu: 400m
      memory: 450Mi
    limits:
      cpu: 400m
      memory: 450Mi

  # PriorityClassName can be used to define the gateway pods priority https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass
  priorityClassName: ""

  # PodSecurityContext defines the security options the gateway pod should be run with
  podSecurityContext: {}

  # ContainerSecurityContext defines the security options the gateway container should be run with
  containerSecurityContext: {}

  # NodeSelector can be used to define on which nodes the gateway pods should run
  nodeSelector: {}
  # Tolerations can be used to define pod toleration's https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
  tolerations: []
  # Affinity can be used to define pod affinity or anti-affinity https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity
  # The default defined PodAntiAffinity allows constraining on which nodes the Zeebe gateway pods are scheduled on https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
  # It uses a hard requirement for scheduling and works based on the Zeebe gateway pod labels
  affinity:
    podAntiAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        - labelSelector:
            matchExpressions:
              - key: "app.kubernetes.io/component"
                operator: In
                values:
                  - zeebe-gateway
          topologyKey: "kubernetes.io/hostname"

  # ExtraVolumeMounts can be used to mount extra volumes for the gateway pods, useful for enabling tls between gateway and broker
  extraVolumeMounts: []
  # ExtraVolumes can be used to define extra volumes for the gateway pods, useful for enabling tls between gateway and broker
  extraVolumes: []
  # ExtraInitContainers can be used to set up extra init containers for the gateway pods, useful for adding interceptors
  extraInitContainers: []

  # Service configuration for the gateway service
  service:
    # Service.type defines the type of the service https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
    type: ClusterIP
    # Service.loadBalancerIP defines public ip of the load balancer if the type is LoadBalancer
    loadBalancerIP: ""
    # Service.loadBalancerSourceRanges defines list of allowed source ip address ranges if the type is LoadBalancer
    loadBalancerSourceRanges: []
    # Service.httpPort defines the port of the http endpoint, where for example metrics are provided
    httpPort: 9600
    # Service.httpName defines the name of the http endpoint, where for example metrics are provided
    httpName: "http"
    # Service.gatewayPort defines the port of the gateway endpoint, where client commands (grpc) are sent to
    gatewayPort: 26500
    # Service.gatewayName defines the name of the gateway endpoint, where client commands (grpc) are sent to
    gatewayName: "gateway"
    # Service.internalPort defines the port of the internal api endpoint, which is used for internal communication
    internalPort: 26502
    # Service.internalName defines the name of the internal api endpoint, which is used for internal communication
    internalName: "internal"
    # Service.annotations can be used to define annotations, which will be applied to the zeebe-gateway service
    annotations: {}

  # ServiceAccount configuration for the service account where the gateway pods are assigned to
  serviceAccount:
    # ServiceAccount.enabled if true, enables the gateway service account
    enabled: true
    # ServiceAccount.name can be used to set the name of the gateway service account
    name: ""
    # ServiceAccount.annotations can be used to set the annotations of the gateway service account
    annotations: {}

  # Ingress configuration to configure the ingress resource
  ingress:
    # Ingress.enabled if true, an ingress resource is deployed with the Zeebe gateway deployment. Only useful if an ingress controller is available, like nginx.
    enabled: true
    # Ingress.className defines the class or configuration of ingress which should be used by the controller
    className: public-iks-k8s-nginx
    # Ingress.annotations defines the ingress related annotations, consumed mostly by the ingress controller
    annotations:
      ingress.kubernetes.io/rewrite-target: "/"
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
      nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
    # Ingress.path defines the path which is associated with the operate service and port https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
    path: /
    # Ingress.host can be used to define the host of the ingress rule. https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
    # If not specified the rules applies to all inbound http traffic, if specified the rule applies to that host.
    host: zeebe.xxxxxxxxxxxxxx.com
    # Ingress.tls configuration for tls on the ingress resource https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
    tls:
      # Ingress.tls.enabled if true, then tls is configured on the ingress resource. If enabled the Ingress.host need to be defined.
      enabled: true
      # Ingress.tls.secretName defines the secret name which contains the TLS private key and certificate
      secretName: xxxxxxxxxxxxxx.com

# Operate configuration for the Operate sub chart.
operate:
  # Enabled if true, the Operate deployment and its related resources are deployed via a helm release
  enabled: true

  # Image configuration to configure the Operate image specifics
  image:
    # Image.repository defines which image repository to use
    repository: camunda/operate
    # Image.tag can be set to overwrite the global tag, which should be used in that chart
    tag:
    # Image.pullSecrets can be used to configure image pull secrets https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
    pullSecrets: []

  # ContextPath can be used to make Operate web application works on a custom sub-path. This is mainly used to run Camunda Platform web applications under a single domain.
  # contextPath: "/operate"

  # PodAnnotations can be used to define extra Operate pod annotations
  podAnnotations: {}
  # PodLabels can be used to define extra Operate pod labels
  podLabels: {}

  # Logging configuration for the Operate logging. This template will be directly included in the Operate configuration yaml file
  logging:
    level:
      ROOT: INFO
      io.camunda.operate: DEBUG

  # Service configuration to configure the Operate service.
  service:
    # Service.type defines the type of the service https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
    type: ClusterIP
    # Service.port defines the port of the service, where the Operate web application will be available
    port: 80
    # Service.annotations can be used to define annotations, which will be applied to the Operate service
    annotations: {}

  # Resources configuration to set request and limit configuration for the container https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits
  resources:
    requests:
      cpu: 600m
      memory: 400Mi
    limits:
      cpu: 2000m
      memory: 2Gi

  # Env can be used to set extra environment variables in each Operate container
  env: []
  # ConfigMap configuration which will be applied to the mounted config map.
  configMap:
    # ConfigMap.defaultMode can be used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
    # See https://github.com/kubernetes/api/blob/master/core/v1/types.go#L1615-L1623
    defaultMode: 0744
  # Command can be used to override the default command provided by the container image. See https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/
  command: []
  # ExtraVolumes can be used to define extra volumes for the Operate pods, useful for tls and self-signed certificates
  extraVolumes: []
  # ExtraVolumeMounts can be used to mount extra volumes for the Operate pods, useful for tls and self-signed certificates
  extraVolumeMounts: []

  # ServiceAccount configuration for the service account where the Operate pods are assigned to
  serviceAccount:
    # ServiceAccount.enabled if true, enables the Operate service account
    enabled: true
    # ServiceAccount.name can be used to set the name of the Operate service account
    name: ""
    # ServiceAccount.annotations can be used to set the annotations of the Operate service account
    annotations: {}

  # Ingress configuration to configure the ingress resource
  ingress:
    # Ingress.enabled if true, an ingress resource is deployed with the Operate deployment. Only useful if an ingress controller is available, like nginx.
    enabled: true
    # Ingress.className defines the class or configuration of ingress which should be used by the controller
    className: public-iks-k8s-nginx
    # Ingress.annotations defines the ingress related annotations, consumed mostly by the ingress controller
    annotations:
      ingress.kubernetes.io/rewrite-target: "/"
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
    # Ingress.path defines the path which is associated with the Operate service and port https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
    path: /
    # Ingress.host can be used to define the host of the ingress rule. https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
    # If not specified the rules applies to all inbound http traffic, if specified the rule applies to that host.
    host: operate.xxxxxxxxxxxxxx.com
    # Ingress.tls configuration for tls on the ingress resource https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
    tls:
      # Ingress.tls.enabled if true, then tls is configured on the ingress resource. If enabled the Ingress.host need to be defined.
      enabled: true
      # Ingress.tls.secretName defines the secret name which contains the TLS private key and certificate
      secretName: xxxxxxxxxxxxxx.com

  # PodSecurityContext defines the security options the Operate pod should be run with
  podSecurityContext: {}

  # ContainerSecurityContext defines the security options the Operate container should be run with
  containerSecurityContext: {}

  # NodeSelector can be used to define on which nodes the Operate pods should run
  nodeSelector: {}
  # Tolerations can be used to define pod toleration's https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
  tolerations: []
  # Affinity can be used to define pod affinity or anti-affinity https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity
  affinity: {}

# Tasklist configuration for the tasklist sub chart.
tasklist:
  # Enabled if true, the tasklist deployment and its related resources are deployed via a helm release
  enabled: true

  # Image configuration to configure the tasklist image specifics
  image:
    # Image.repository defines which image repository to use
    repository: camunda/tasklist
    # Image.tag can be set to overwrite the global tag, which should be used in that chart
    tag:
    # Image.pullSecrets can be used to configure image pull secrets https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
    pullSecrets: []

  # ContextPath can be used to make Tasklist web application works on a custom sub-path. This is mainly used to run Camunda Platform web applications under a single domain.
  # contextPath: "/tasklist"

  # Env can be used to set extra environment variables on each Tasklist container
  env: []

  # PodAnnotations can be used to define extra Tasklist pod annotations
  podAnnotations: {}
  # PodLabels can be used to define extra tasklist pod labels
  podLabels: {}

  # ConfigMap configuration which will be applied to the mounted config map.
  configMap:
    # ConfigMap.defaultMode can be used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
    # See https://github.com/kubernetes/api/blob/master/core/v1/types.go#L1615-L1623
    defaultMode: 0744
  # Command can be used to override the default command provided by the container image. See https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/
  command: []
  # Service configuration to configure the tasklist service.
  service:
    # Service.type defines the type of the service https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
    type: ClusterIP
    # Service.port defines the port of the service, where the tasklist web application will be available
    port: 80

  # GraphqlPlaygroundEnabled if true, enables the graphql playground
  graphqlPlaygroundEnabled: ""
  # GraphqlPlaygroundEnabled can be set to include the credentials in each request, should be set to "include" if graphql playground is enabled
  graphqlPlaygroundRequestCredentials: ""

  # ExtraVolumes can be used to define extra volumes for the Tasklist pods, useful for tls and self-signed certificates
  extraVolumes: []
  # ExtraVolumeMounts can be used to mount extra volumes for the Tasklist pods, useful for tls and self-signed certificates
  extraVolumeMounts: []

  # PodSecurityContext defines the security options the Tasklist pod should be run with
  podSecurityContext: {}

  # ContainerSecurityContext defines the security options the Tasklist container should be run with
  containerSecurityContext: {}

  # NodeSelector can be used to define on which nodes the Tasklist pods should run
  nodeSelector: {}
  # Tolerations can be used to define pod toleration's https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
  tolerations: []
  # Affinity can be used to define pod affinity or anti-affinity https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity
  affinity: {}

  # Resources configuration to set request and limit configuration for the container https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits
  resources:
    requests:
      cpu: 400m
      memory: 1Gi
    limits:
      cpu: 1000m
      memory: 2Gi

  # Ingress configuration to configure the ingress resource
  ingress:
    # Ingress.enabled if true, an ingress resource is deployed with the tasklist deployment. Only useful if an ingress controller is available, like nginx.
    enabled: true
    # Ingress.className defines the class or configuration of ingress which should be used by the controller
    className: public-iks-k8s-nginx
    # Ingress.annotations defines the ingress related annotations, consumed mostly by the ingress controller
    annotations:
      ingress.kubernetes.io/rewrite-target: "/"
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
    # Ingress.path defines the path which is associated with the operate service and port https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
    path: /
    # Ingress.host can be used to define the host of the ingress rule. https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
    # If not specified the rules applies to all inbound http traffic, if specified the rule applies to that host.
    host: tasklist.xxxxxxxxxxxxxx.com
    tls:
      # Ingress.tls.enabled if true, then tls is configured on the ingress resource. If enabled the Ingress.host need to be defined.
      enabled: true
      # Ingress.tls.secretName defines the secret name which contains the TLS private key and certificate
      secretName: xxxxxxxxxxxxxx.com

# Optimize configuration for the Optimize sub chart.
optimize:
  # Enabled if true, the Optimize deployment and its related resources are deployed via a helm release
  enabled: true

  # Image configuration to configure the Optimize image specifics
  image:
    # Image.repository defines which image repository to use
    repository: camunda/optimize
    # Image.tag can be set to overwrite the global tag, which should be used in that chart
    tag: 3.9.0-preview-2
    # Image.pullSecrets can be used to configure image pull secrets https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
    pullSecrets: []

  # ContextPath can be used to make Optimize web application works on a custom sub-path. This is mainly used to run Camunda Platform web applications under a single domain.
  # contextPath: "/optimize"

  # PodAnnotations can be used to define extra Optimize pod annotations
  podAnnotations: {}
  # PodLabels can be used to define extra Optimize pod labels
  podLabels: {}

  # PartitionCount defines how many Zeebe partitions are set up in the cluster and which should be imported by Optimize
  partitionCount: "1"
  # Env can be used to set extra environment variables in each Optimize container
  env: []
  # Command can be used to override the default command provided by the container image. See https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/
  command: []
  # ExtraVolumes can be used to define extra volumes for the Optimize pods, useful for tls and self-signed certificates
  extraVolumes: []
  # ExtraVolumeMounts can be used to mount extra volumes for the Optimize pods, useful for tls and self-signed certificates
  extraVolumeMounts: []

  # ServiceAccount configuration for the service account where the Optimize pods are assigned to
  serviceAccount:
    # ServiceAccount.enabled if true, enables the Optimize service account
    enabled: true
    # ServiceAccount.name can be used to set the name of the Optimize service account
    name: ""
    # ServiceAccount.annotations can be used to set the annotations of the Optimize service account
    annotations: {}

  # Service configuration to configure the Optimize service.
  service:
    # Service.type defines the type of the service https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
    type: ClusterIP
    # Service.port defines the port of the service, where the Optimize web application will be available
    port: 80
    # Service.annotations can be used to define annotations, which will be applied to the Optimize service
    annotations: {}

  # PodSecurityContext defines the security options the Optimize pod should be run with
  podSecurityContext: {}

  # ContainerSecurityContext defines the security options the Optimize container should be run with
  containerSecurityContext: {}

  # NodeSelector can be used to define on which nodes the Optimize pods should run
  nodeSelector: {}
  # Tolerations can be used to define pod toleration's https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
  tolerations: []
  # Affinity can be used to define pod affinity or anti-affinity https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity
  affinity: {}

  # Resources configuration to set request and limit configuration for the container https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits
  resources:
    requests:
      cpu: 600m
      memory: 1Gi
    limits:
      cpu: 2000m
      memory: 2Gi

  # Ingress configuration to configure the ingress resource
  ingress:
    # Ingress.enabled if true, an ingress resource is deployed with the Optimize deployment. Only useful if an ingress controller is available, like nginx.
    enabled: true
    # Ingress.className defines the class or configuration of ingress which should be used by the controller
    className: public-iks-k8s-nginx
    # Ingress.annotations defines the ingress related annotations, consumed mostly by the ingress controller
    annotations:
      ingress.kubernetes.io/rewrite-target: "/"
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
    # Ingress.path defines the path which is associated with the operate service and port https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
    path: /
    # Ingress.host can be used to define the host of the ingress rule. https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
    # If not specified the rules applies to all inbound http traffic, if specified the rule applies to that host.
    host: optimize.xxxxxxxxxxxxxx.com
    # Ingress.tls configuration for tls on the ingress resource https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
    tls:
      # Ingress.tls.enabled if true, then tls is configured on the ingress resource. If enabled the Ingress.host need to be defined.
      enabled: true
      # Ingress.tls.secretName defines the secret name which contains the TLS private key and certificate
      secretName: xxxxxxxxxxxxxx.com

# RetentionPolicy configuration to configure the elasticsearch index retention policies
retentionPolicy:
  # RetentionPolicy.enabled if true, elasticsearch curator cronjob and configuration will be deployed.
  enabled: false
  # RetentionPolicy.schedule defines how often/when the curator should run
  schedule: "0 0 * * *"
  # RetentionPolicy.zeebeIndexTTL defines after how many days a zeebe index can be deleted
  zeebeIndexTTL: 1
  # RetentionPolicy.zeebeIndexMaxSize can be set to configure the maximum allowed zeebe index size in gigabytes.
  # After reaching that size, curator will delete that corresponding index on the next run.
  # To benefit from that configuration the schedule needs to be configured small enough, like every 15 minutes.
  zeebeIndexMaxSize:
  # RetentionPolicy.operateIndexTTL defines after how many days an operate index can be deleted
  operateIndexTTL: 30
  # RetentionPolicy.tasklistIndexTTL defines after how many days a tasklist index can be deleted
  tasklistIndexTTL: 30

  # Image configuration for the elasticsearch curator cronjob
  image:
    # Image.repository defines which image repository to use
    repository: bitnami/elasticsearch-curator
    # Image.tag defines the tag / version which should be used in the chart
    tag: 5.8.4

# PrometheusServiceMonitor configuration to configure a prometheus service monitor
prometheusServiceMonitor:
  # PrometheusServiceMonitor.enabled if true then a service monitor will be deployed, which allows an installed prometheus controller to scrape metrics from the deployed pods
  enabled: false
  # PromotheuServiceMonitor.labels can be set to configure extra labels, which will be added to the servicemonitor and can be used on the prometheus controller for selecting the servicemonitors
  labels:
    release: metrics
  # PromotheuServiceMonitor.scrapeInterval can be set to configure the interval at which metrics should be scraped
  # Should be *less* than 60s if the provided grafana dashboard is used, which can be found here https://github.com/camunda/zeebe/tree/main/monitor/grafana,
  # otherwise it isn't able to show any metrics which is aggregated over 1 min.
  scrapeInterval: 10s

# Identity configuration for the identity sub chart.
identity:
  # Enabled if true, the identity deployment and its related resources are deployed via a helm release
  #
  # Note: Identity is required by Optimize. If Identity is disabled, then Optimize will be unusable.
  #       If you don't need Optimize, then make sure to disable both: set global.identity.auth.enabled=false AND optimize.enabled=false.
  enabled: true

  # FirstUser configuration to configure properties of the first Identity user, which can be used to access all
  # web applications
  firstUser:
    # FirstUser.username defines the username of the first user, needed to log in into the web applications
    username: demo
    # FirstUser.password defines the password of the first user, needed to log in into the web applications
    password: demo

  # Image configuration to configure the identity image specifics
  image:
    # Image.repository defines which image repository to use
    repository: camunda/identity
    # Image.tag can be set to overwrite the global tag, which should be used in that chart
    tag:
    # Image.pullSecrets can be used to configure image pull secrets https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
    pullSecrets: []

  # FullURL can be used when Ingress is configured (for both multi and single domain setup).
  # Note: If the `ContextPath` is configured, then value of `ContextPath` should be included in the URL too.
  # fullURL: "https://camunda.example.com/identity"

  # ContextPath can be used to make Identity web application works on a custom sub-path. This is mainly used to run Camunda Platform web applications under a single domain.
  # contextPath: "/identity"

  # PodAnnotations can be used to define extra Identity pod annotations
  podAnnotations: {}

  # Service configuration to configure the identity service.
  service:
    # Service.type defines the type of the service https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
    type: ClusterIP
    # Service.port defines the port of the service, where the identity web application will be available
    port: 80
    # Service.annotations can be used to define annotations, which will be applied to the identity service
    annotations: {}

  # PodSecurityContext defines the security options the Identity pod should be run with
  podSecurityContext: {}

  # ContainerSecurityContext defines the security options the Identity container should be run with
  containerSecurityContext: {}

  # NodeSelector can be used to define on which nodes the Identity pods should run
  nodeSelector: {}
  # Tolerations can be used to define pod toleration's https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
  tolerations: []
  # Affinity can be used to define pod affinity or anti-affinity https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity
  affinity: {}

  # Resources configuration to set request and limit configuration for the container https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits
  resources:
    requests:
      cpu: 600m
      memory: 400Mi
    limits:
      cpu: 2000m
      memory: 2Gi

  # Env can be used to set extra environment variables in each identity container. See the documentation https://docs.camunda.io/docs/self-managed/identity/deployment/configuration-variables/ for more details.
  env: []
  # Command can be used to override the default command provided by the container image. See https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/
  command: []
  # ExtraVolumes can be used to define extra volumes for the identity pods, useful for tls and self-signed certificates
  extraVolumes: []
  # ExtraVolumeMounts can be used to mount extra volumes for the identity pods, useful for tls and self-signed certificates
  extraVolumeMounts: []

  # Keycloak configuration, for the keycloak dependency chart which is used by identity. See the chart documentation https://github.com/bitnami/charts/tree/master/bitnami/keycloak#parameters for more details.
  keycloak:
    # Keycloak.service configuration, to configure the service which is deployed along with keycloak
    service:
      # Keycloak.service.type can be set to change the service type.
      # We use clusterIP for keycloak service, since per default LoadBalancer is used, which is not supported on all cloud providers.
      # This might prevent scheduling of the service.
      type: ClusterIP
    ## Keycloak authentication parameters
    ## ref: https://github.com/bitnami/bitnami-docker-keycloak#admin-credentials
    ##
    ## Identity uses the secrets generated by keycloak, to access keycloak.
    auth:
      # Keycloak.auth.adminUser defines the keycloak administrator user
      adminUser: admin
      # Keycloak.auth.existingSecret can be used to reuse an existing secret containing authentication information.
      # See https://docs.bitnami.com/kubernetes/apps/keycloak/configuration/manage-passwords/ for more details.
      #
      # Example:
      #
      # Keycloak.auth.existingSecret:
      #   name: mySecret
      #   keyMapping:
      #     admin-password: myPasswordKey
      #     management-password: myManagementPasswordKey
      #     tls-keystore-password: myTlsKeystorePasswordKey
      #     tls-truestore-password: myTlsTruestorePasswordKey
      existingSecret: ""

  # ServiceAccount configuration for the service account where the identity pods are assigned to
  serviceAccount:
    # ServiceAccount.enabled if true, enables the identity service account
    enabled: true
    # ServiceAccount.name can be used to set the name of the identity service account
    name: ""
    # ServiceAccount.annotations can be used to set the annotations of the identity service account
    annotations: {}

  # Ingress configuration to configure the ingress resource
  ingress:
    # Ingress.enabled if true, an ingress resource is deployed with the identity deployment. Only useful if an ingress controller is available, like nginx.
    enabled: true
    # Ingress.className defines the class or configuration of ingress which should be used by the controller
    className: public-iks-k8s-nginx
    # Ingress.annotations defines the ingress related annotations, consumed mostly by the ingress controller
    annotations:
      ingress.kubernetes.io/rewrite-target: "/"
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
    # Ingress.path defines the path which is associated with the operate service and port https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
    path: /
    # Ingress.host can be used to define the host of the ingress rule. https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
    # If not specified the rules applies to all inbound http traffic, if specified the rule applies to that host.
    host: identity.xxxxxxxxxxxxxx.com
    # Ingress.tls configuration for tls on the ingress resource https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
    tls:
      # Ingress.tls.enabled if true, then tls is configured on the ingress resource. If enabled the Ingress.host need to be defined.
      enabled: true
      # Ingress.tls.secretName defines the secret name which contains the TLS private key and certificate
      secretName: xxxxxxxxxxxxxx.com

elasticsearch:
  enabled: true
  extraEnvs:
    - name: "xpack.security.enabled"
      value: "false"

  replicas: 1

  persistence:
    labels:
      enabled: true

  volumeClaimTemplate:
    accessModes: ["ReadWriteOnce"]
    resources:
      requests:
        storage: 16Gi

  esJavaOpts: "-Xmx1g -Xms1g"

  resources:
    requests:
      cpu: 1
      memory: 1Gi
    limits:
      cpu: 2
      memory: 2Gi

Hi @vctrmn
How did you setup the TLS in the ingress?
Also the values file doesn't show how the Ingress is setup for Keycloak.
It should be under the identity key like this:
identity:
  [...]
  keycloak:
    ingress:
      enabled: true
      ingressClassName: nginx
      hostname: "keycloak.camunda.example.com"
    extraEnvVars:
      - name: KEYCLOAK_PROXY_ADDRESS_FORWARDING
        value: "true"
      - name: KEYCLOAK_FRONTEND_URL
        value: "https://keycloak.camunda.example.com"

For more details on the setup, please take a look at the Ingress setup guide.

Hi @aabouzaid,
Thank you for your help ! Your configuration effectively fix the issue.
Would it be possible to add this configuration (at least as a comment) in the default values.yaml ?
https://github.com/camunda/camunda-platform-helm/blob/main/charts/camunda-platform/values.yaml
Also, would it be possible to add the tls configuration in the keycloak ingress ?
Below is the generated ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    meta.helm.sh/release-name: demo
    meta.helm.sh/release-namespace: default
  creationTimestamp: "2022-10-18T08:43:40Z"
  generation: 1
  labels:
    app.kubernetes.io/component: keycloak
    app.kubernetes.io/instance: demo
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: keycloak
    helm.sh/chart: keycloak-7.1.6
  name: demo-keycloak
  namespace: default
  resourceVersion: "356570"
  uid: 466259b4-065c-471f-8cf7-3598deb09845
spec:
  ingressClassName: public-iks-k8s-nginx
  rules:
  - host: keycloak.xxxxxxxxxxxxxxxxxxx.com
    http:
      paths:
      - backend:
          service:
            name: demo-keycloak
            port:
              name: http
        path: /
        pathType: ImplementationSpecific
status:
  loadBalancer:
    ingress:
    - hostname: xxxxxxxxxxxxxxxxxxxxxx

authors: aabouzaid vctrmn

repo: camunda/camunda-platform-helm


text:
Add GR 09: restrict public IPs for VMs and SQL instances via organization policy

IAM organization policy - restrict SQL public IPs - https://console.cloud.google.com/iam-admin/orgpolicies/sql-restrictPublicIp?organizationId=743091813895&supportedpurview=project
AM organization policy - allowd external IPs for VMs - https://console.cloud.google.com/iam-admin/orgpolicies/compute-vmExternalIpAccess?organizationId=743091813895&supportedpurview=project

https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/issues/155
https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/issues/184

source: gharchive/issue

license: MIT

license_type: permissive

license_source: github-api


text:
feat: initial charm

Applicable spec: ISD-143
Overview

A charm that periodically builds ubuntu image.
Supports relation to GitHub runner and provides the image ID on openstack for consumption.

Rationale

To support GitHub runner with ready-to-use images.

Juju Events Changes

On install: installs packages needed to build custom images.
On config changed: builds new image according to the config and resets cron if necessary.
On build-image action: juju action to manually trigger a new image build.
On cron-trigger: custom internal hook to enable rebuild with cron jobs, propagating new images to existing relations.
On image relation joined: provides any existing latest image to the relation if available.

Module Changes

builder: responsible for building images
charm: main charm event handlers
chroot: module for handling chroot environments
cron: module for handling cron hooks
image: observer module for handling image relation event handlers
openstack_manager: module responsible for communicating with openstack
state: the charm state
utils: provides retry

Library Changes

Uses operator libs linux.

Checklist

[x] The charm style guide was applied
[x] The contributing guide was applied
[x] The changes are compliant with ISD054 - Managing Charm Complexity
[x] The documentation is generated using src-docs
[ ] The documentation for charmhub is updated.
[x] The PR is tagged with appropriate label (urgent, trivial, complex)

@jdkandersson somehow the comments are left as comments not as conversation 😭, i just have cloud config modelling left!

source: gharchive/pull-request


text:
Charm is not in Blocked state when cannot access let's enrypt

Describe the bug

I have deployed the charm, but I did not provide auth configs. However, juju shows my charm as green. Also, firewall is not yet opened, so it cannot talk to the site
I think charm could not properly reconcile events after I started relating with nginx
To Reproduce

10  2024-04-15 10:39:23 juju deploy nginx-ingress-integrator
   11  2024-04-15 10:39:31 juju status
   12  2024-04-15 10:39:34 juju status
   13  2024-04-15 10:39:47 juju status
   14  2024-04-15 10:39:50 juju status
   15  2024-04-15 10:39:58 juju status
   16  2024-04-15 10:40:00 juju status
   17  2024-04-15 10:40:04 juju status
   18  2024-04-15 10:40:27 juju status
   19  2024-04-15 10:40:34 juju status
   20  2024-04-15 10:40:39 watch -c juju status
   21  2024-04-15 10:40:51 juju status
   22  2024-04-15 10:41:02 juju trust nginx-ingress-integrator --scope=cluster
   23  2024-04-15 10:41:04 juju status
   24  2024-04-15 10:41:16 juju relate charmed-cla-checker nginx-ingress-integrator
   25  2024-04-15 10:41:19 juju status
   26  2024-04-15 10:41:22 juju status
   27  2024-04-15 12:17:49 juju deploy httprequest-lego-k8s
   28  2024-04-15 12:19:12 juju status
   29  2024-04-15 12:19:30 juju relate httprequest-lego-k8s nginx-ingress-integrator
   30  2024-04-15 12:19:35 juju status
   31  2024-04-15 12:19:42 juju status
   32  2024-04-15 12:52:04 juju config httprequest-lego-k8s
   33  2024-04-15 12:52:26 juju config httprequest-lego-k8s | grep httpreq_endpoint -a 5
   34  2024-04-15 12:52:34 grep --help
   35  2024-04-15 12:52:40 juju config httprequest-lego-k8s | grep httpreq_endpoint -A 5
   36  2024-04-15 12:53:08 juju config httprequest-lego-k8s httpreq_endpoint='https://lego-certs.canonical.com'
   37  2024-04-15 12:53:31 juju config httprequest-lego-k8s email='is-admin@canonical.com'
   38  2024-04-15 12:53:44 juju config httprequest-lego-k8s | grep username -A 5
   39  2024-04-15 12:54:03 juju config httprequest-lego-k8s | grep timeout -A 5
   40  2024-04-15 12:54:40 juju status
   41  2024-04-15 12:55:17 juju config nginx-ingress-integrator | grep name  -A 5
   42  2024-04-15 12:57:40 juju config nginx-ingress-integrator service-hostname=cla-checker.canonical.com
   43  2024-04-15 12:58:49 juju model-config juju-http-proxy  = "http://squid.internal:3128"
   44  2024-04-15 12:58:49 juju model-config juju-https-proxy = "http://squid.internal:3128"
   45  2024-04-15 12:58:49 juju model-config juju-no-proxy    = "127.0.0.1,localhost,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.canonical.com,.launchpad.net,.internal,.jujucharms.com"
   46  2024-04-15 12:59:18 juju model-config juju-no-proxy="127.0.0.1,localhost,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.canonical.com,.launchpad.net,.internal,.jujucharms.com"
   47  2024-04-15 12:59:48 juju model-config juju-http-proxy="http://squid.internal:3128"
   48  2024-04-15 12:59:48 juju model-config juju-https-proxy="http://squid.internal:3128"
   49  2024-04-15 12:59:49 juju model-config juju-no-proxy="127.0.0.1,localhost,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.canonical.com,.launchpad.net,.internal,.jujucharms.com"
   50  2024-04-15 12:59:59 juju model-config juju-http-proxy
   51  2024-04-15 13:50:27 juju config httprequest-lego-k8s httpreq_endpoint
   52  2024-04-15 13:50:30 juju status

Expected behavior
charm should be blocked
Logs
prod-cla-checker@enterprise-engineering-bastion-ps6:~$ juju status
Model             Controller    Cloud/Region              Version  SLA          Timestamp
prod-cla-checker  prodstack-is  k8s-prod-general/default  3.1.7    unsupported  13:57:36Z

App                       Version  Status  Scale  Charm                     Channel  Rev  Address       Exposed  Message
charmed-cla-checker                active      1  charmed-cla-checker       edge       1  10.87.244.2   no
httprequest-lego-k8s               active      1  httprequest-lego-k8s      stable    40  10.87.26.217  no
nginx-ingress-integrator  24.2.0   active      1  nginx-ingress-integrator  stable    84  10.87.128.91  no       Ingress IP(s): 10.141.14.128

Unit                         Workload  Agent  Address          Ports  Message
charmed-cla-checker/0*       active    idle   192.168.100.243
httprequest-lego-k8s/0*      active    idle   192.168.100.245
nginx-ingress-integrator/0*  active    idle   192.168.102.11          Ingress IP(s): 10.141.14.128

2024-04-15T12:53:38.012Z [container-agent] 2024-04-15 12:53:38 INFO juju-log Received Certificate Creation Request for domain charmed-cla-checker
2024-04-15T12:54:08.108Z [container-agent] 2024-04-15 12:54:08 ERROR juju-log Exited with code 1. Stderr:
2024-04-15T12:54:08.112Z [container-agent] 2024-04-15 12:54:08 ERROR juju-log     2024/04/15 12:53:38 No key found for account is-admin@canonical.com. Generating a P256 key.
2024-04-15T12:54:08.116Z [container-agent] 2024-04-15 12:54:08 ERROR juju-log     2024/04/15 12:53:38 Saved key to /tmp/.lego/accounts/acme-v02.api.letsencrypt.org/is-admin@canonical.com/keys/is-admin@canonical.com.key
2024-04-15T12:54:08.120Z [container-agent] 2024-04-15 12:54:08 ERROR juju-log     2024/04/15 12:54:08 Could not create client: get directory at 'https://acme-v02.api.letsencrypt.org/directory': Get "https://acme-v02.api.letsencrypt.org/directory": dial t
cp 172.65.32.248:443: i/o timeout
2024-04-15T12:54:08.124Z [container-agent] 2024-04-15 12:54:08 ERROR juju-log Failed to execute lego command

Additional context

another example. Server returns 500, but charm is green
ot pass JSON Schema validation
unit-nginx-ingress-integrator-0: 16:26:19 INFO juju.worker.uniter.operation ran "certificates-relation-changed" hook (via hook dispatching script: dispatch)
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3: Exited with code 1. Stderr:
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:     2024/04/15 16:26:19 [INFO] acme: Registering account for is-admin@canonical.com
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:     2024/04/15 16:26:19 [INFO] [cla-checker.canonical.com] acme: Obtaining bundled SAN certificate given a CSR
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:     2024/04/15 16:26:19 [INFO] [cla-checker.canonical.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/338846294087
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:     2024/04/15 16:26:19 [INFO] [cla-checker.canonical.com] acme: Could not find solver for: tls-alpn-01
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:     2024/04/15 16:26:19 [INFO] [cla-checker.canonical.com] acme: Could not find solver for: http-01
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:     2024/04/15 16:26:19 [INFO] [cla-checker.canonical.com] acme: use dns-01 solver
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:     2024/04/15 16:26:19 [INFO] [cla-checker.canonical.com] acme: Preparing to solve DNS-01
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:     2024/04/15 16:26:49 [INFO] [cla-checker.canonical.com] acme: Cleaning DNS-01 challenge
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:     2024/04/15 16:27:15 [WARN] [cla-checker.canonical.com] acme: cleaning up failed: httpreq: unexpected status code: [status code: 500] body: <!doctype html>
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:       <title>Server Error (500)</title>
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:
Server Error (500)

unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:     2024/04/15 16:27:16 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/338846294087
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:     2024/04/15 16:27:16 Could not obtain certificates:
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:     	error: one or more domains had a problem:
unit-httprequest-lego-k8s-0: 16:27:16 ERROR unit.httprequest-lego-k8s/0.juju-log certificates:3:     [cla-checker.canonical.com] [cla-checker.canonical.com] acme: error presenting token: httpreq: unable to communicate with the API server: error: Post "https://lego-certs.canonical.com/present": context deadline exceeded (Client.Timeout exceeded while awaiting headers)

Hello @beliaev-maksim, indeed the charm status does not depend on the endpoint being available. We simply validate that it is valid. I will re-classify this issue as a "request for enhancement".

@gruyaume not sure how this should be treated. From my perspective I expect that if the charm is Active and green, then everything has worked out and I got my certs.
Since if everything is green, I should see TLS on my app. When I do not see it, I have to go and debug what is wrong. Charm status should be able to assist me in this.

Closing as this is the same concern as discussed in #154, the effort will be tracked there.

authors: beliaev-maksim gruyaume


text:
Flutter snaps with 3.24.1 shows inverted colors

Hey guys,
I know this is probably a flutter bug again, just like earlier reported https://github.com/canonical/iot-example-graphical-snap/issues/31, but I think it still should be listed here, as this seems the only place where people talk about snapping flutter applications.
Indeed on flutter versions >3.24.1 the vector shading issue reported in issue 31 is fixed. However, the colors displayed are not correct. It seems that the blue and red channel are swapped somehow.
I see this issue when I build the snap on branch 22/Flutter-demo, I see the issue when I build my own flutter application (both running in Ubuntu Core and with frame-it on a system running an X session), and someone else reported it here. The last reporter also reported that the issue is fixed with core24, which makes me believe that there could be an issue in how flutter and the mesa libraries interact?
Do you have any suggestions on how to move forward with this? Should I make a bug on the flutter project? Or on ubuntu-frame?
Kind regards, Charlee

Hey @CharleeSF,
there's no point in reporting it as an issue with Frame, as the problem clearly has nothing to do with Frame.
As the issue seems to be related to Flutter changes I would guess that's most likely where the problem lies. (But I don't know the Flutter linux embedder code well enough to give an informed opinion.)
The best way forward would be try reproducing the problem on a standard 22.04 system (without snaps). If that also has colour issues, that's an easier scenario to report to the Flutter project.
BW,
Alan

The normal Linux build on 22.04 on my intel machine has no color problems, only when running it as a snap.
So there is something different between Ubuntu Desktop 22.04 and the way the flutter application on core22 snaps are packaged.. Is there any way you can recommend to get my standard 22.04 system to be closer to the snaps to see if I can reproduce?

If I do this for the 22/Flutter-demo on a Ubuntu Desktop 22.04 amd64 system

snapcraft --verbose
sudo snap install iot-example-graphical-snap_0+git.dcf41bf_amd64.snap --dangerous
frame-it iot-example-graphical-snap

Then the application is pink, see image

2. Also runs without problems with correct colors, and the application is purple. (I know I have wayland by doing echo $WAYLAND_DISPLAY and it gives wayland-0)

If instead of
frame-it iot-example-graphical-snap

You run directly on your desktop:
iot-example-graphical-snap

That doesn't work for me..
I tried:
charlee@lpks0013-ubuntu:~/xs4$ iot-example-graphical-snap
(flutterdemo:352541): Gtk-WARNING **: 16:30:13.430: cannot open display:

this crashes, then I tried
charlee@lpks0013-ubuntu:~/xs4$ sudo iot-example-graphical-snap
Setting up watches.
Watches established.

This waits forever, then I tried setting WAYLAND_DISPLAY because I remember reading somewhere that that was necessary
charlee@lpks0013-ubuntu:~/xs4$ WAYLAND_DISPLAY=99 iot-example-graphical-snap
Setting up watches.
Watches established.

That waits forever as well.
I don't know why, from what I can see the display should be available:
charlee@lpks0013-ubuntu:~/xs4$ ls -l $XDG_RUNTIME_DIR/$WAYLAND_DISPLAY
srwxrwxr-x 1 charlee charlee 0 sep 10 15:35 /run/user/1000/wayland-0

I have the interfaces connected:
charlee@lpks0013-ubuntu:~/xs4/iot-example-graphical-snap$ snap connections iot-example-graphical-snap
Interface                 Plug                                        Slot                         Notes
content[graphics-core22]  iot-example-graphical-snap:graphics-core22  mesa-core22:graphics-core22  -
opengl                    iot-example-graphical-snap:opengl           :opengl                      -
wayland                   iot-example-graphical-snap:wayland          ubuntu-frame:wayland         manual

I also tried to use the systems wayland interface, by doing a disconnect on ubuntu-frame:wayland and sudo snap connect iot-example-graphical-snap:wayland :wayland, but this gives the same Watches established results.
I am probably missing something obvious here...

Sorry, missed

charlee@lpks0013-ubuntu:~/xs4$ iot-example-graphical-snap
(flutterdemo:352541): Gtk-WARNING **: 16:30:13.430: cannot open display:

That looks like it is failing to connect to X11. Try:
$ env -u DISPLAY iot-example-graphical-snap

Whoop that worked!!
AND the application is pink (with the wrong colors), like it is on Ubuntu Core..
I took the effort to update the iot-example-graphical-snap to core24, the snapcraft.yaml is here: https://github.com/CharleeSF/iot-example-graphical-snap/blob/24/Flutter-demo/snap/snapcraft.yaml
Indeed, on core24 the application is purple again.....
So summary: running on Ubuntu Desktop as snap without frame-it has wrong colors, but doing the same thing when building the snap on core24 has the correct colors.

Whoop that worked!!
AND the application is pink (with the wrong colors), like it is on Ubuntu Core..

Now try to eliminate snap: run the unsnapped version with env -u DISPLAY

That does not work...
charlee@lpks0013-ubuntu:~/xs4/iot-example-graphical-snap/flutterdemo$ env -u DISPLAY ./build/linux/x64/debug/bundle/flutterdemo

(flutterdemo:155030): Gtk-WARNING **: 09:47:23.814: cannot open display:

That does not work...

OK, so that build of flutter doesn't (or isn't configured to) support Wayland. Unfortunately, I don't know how to change that.
Anyway, we can eliminate Frame from the stack as you see the same behaviour on desktop.
I've hacked the demo (as follows) to run the core22 version on X11:
$ snap install --dangerous --devmode iot-example-graphical-snap_0+git.dcf41bf_amd64.snap
$ snap run --shell iot-example-graphical-snap
$ env -u WAYLAND_DISPLAY DISPLAY=:0 $SNAP/bin/flutterdemo

To summarise our current findings:

protocol
Unsnapped
Snapped/core22
Snapped/core24

X11
:white_check_mark:
:x:
n/a

Wayland
??
:x:
:white_check_mark:

That strongly suggests that there is something odd about the core22 snap builds.

Does the move to core24 unblock you? Or do you need to investigate further?
We'll be updating the tutorials to core24 in the coming weeks, so this might be a moot issue.

I have yet to figure out how to run our own snap on core24, but I will be working on this today/tomorrow and then I will know if it unblocks me :) but I will be trying this. It is not ideal as I think we want to wait with updating our whole system tot core24, but might at least be an MVP solution..
Where would be a good channel to get support on getting my flutter snap to work on core24? Just the snapcraft forum, or here?

It is not ideal as I think we want to wait with updating our whole system tot core24

For what it's worth, you can mix different base:s on Ubuntu Core, regardless of version. UC24 really just means that the kernel and root filesystem (core24) are 24.04-based, but you can run older base:d snaps, and the other way around. It does add to the memory and disk usage, though.

Where would be a good channel to get support on getting my flutter snap to work on core24? Just the snapcraft forum, or here?

https://github.com/canonical/iot-example-graphical-snap/
I'll get the Flutter example updated in a bit. Actually let me move this issue there.

Where would be a good channel to get support on getting my flutter snap to work on core24? Just the snapcraft forum, or here?

I guess that depends on the nature of your problems. It sounds like you've already got a Snap recipe for the Flutter side of the move. If your dependencies are available for 24.04, then the rest should be trivial. If not, then it depends on why the dependency isn't available and the options for resolving that.

@CharleeSF I just pushed the 24 version of the example:
https://github.com/canonical/iot-example-graphical-snap/compare/22/Flutter-demo...24/Flutter-demo

That said, whether I build 22 or 24, env -u WAYLAND_DISPLAY or env -u DISPLAY, snapped or not, it's always purple for me…?
You're probably on a GLES platform?

I honestly don't know :') I know very little about graphics.
It is happening on my laptop, but also on a NUC-based device for which we are trying to build the application.
If you have any commands you want me to run on either device (bear in mind that on the target device we have Ubuntu Core available, although I could boot a live linux USB to try some commands) to get more details, let me know :smile:

You're probably on a GLES platform?

I'm running on my laptop (so EGL, but 24.04).
A further datapoint is that running the the snap content directly shows the correct colours:
env -u DISPLAY /snap/iot-example-graphical-snap/current/bin/flutterdemo

env -u WAYLAND_DISPLAY /snap/iot-example-graphical-snap/current/bin/flutterdemo

Even trying to load the mesa-core22 userspace gives the right result...
env -u DISPLAY __EGL_EXTERNAL_PLATFORM_CONFIG_DIRS="/snap/mesa-core22/current/usr/share/egl/egl_external_platform.d" __EGL_VENDOR_LIBRARY_DIRS="/snap/mesa-core22/current/usr/share/glvnd/egl_vendor.d" LIBGL_DRIVERS_PATH="/snap/mesa-core22/current/usr/lib/x86_64-linux-gnu/dri/:/snap/mesa-core22/current/usr/lib/i386-linux-gnu/dri/" LD_LIBRARY_PATH="/var/lib/snapd/lib/gl:/var/lib/snapd/lib/gl32:/var/lib/snapd/void:/snap/iot-example-graphical-snap/x25/usr/lib:/snap/iot-example-graphical-snap/x25/usr/lib/x86_64-linux-gnu:/snap/mesa-core22/current/usr/lib/x86_64-linux-gnu:/snap/mesa-core22/current/usr/lib/x86_64-linux-gnu/vdpau:/snap/mesa-core22/current/usr/lib/i386-linux-gnu:/snap/mesa-core22/current/usr/lib/i386-linux-gnu/vdpau" /snap/iot-example-graphical-snap/current/bin/flutterdemo

Ah! the snap has GDK_GL: gles
And that is what causes the colour problem

I think that worked!!!
That's amazing. Do you have any docs I can read to understand what happened?
I will now test this on my own snap and I will let you know if it fixes it, but I am assuming it will

Yessssssss it fixed my application!
Thanks sooooo much!

Do you have any docs I can read to understand what happened?

I can't point to any docs that the details. But GLES is a somewhat dated graphics API but one that is simpler and better supported by some embedded devices (typically ARM with bespoke graphics stacks).
We have that line in the Snap recipe as it forcing use of the better supported API helps on a lot of embedded systems and should be harmless on more capable systems.

Another datapoint relevant to further progress: With the base: core22 example on RPi3/Ubuntu Core 22 GDK_GL=gles is needed to render at all...
# env -u GDK_GL $SNAP/bin/flutterdemo

(flutterdemo:5092): Gdk-CRITICAL **: 16:07:37.480: gdk_gl_context_make_current: assertion 'GDK_IS_GL_CONTEXT (context)' failed

** (flutterdemo:5092): WARNING **: 16:07:37.481: Failed to initialize GLArea: Unable to create a GL context

However, the colours are still wrong.

And a final datapoint: on the same setup, with the base: core24 example we no longer need GDK_GL=gles

Looking into the RGB/BGR logic (which I suspect a mismatch has caused the color switch shown above) in the Flutter Linux embedder shows some questionable code. I've made https://github.com/flutter/engine/pull/55121 to make this consistent with the Windows embedder.
I wasn't able to reproduce the issue here, but if anyone can reproduce and try with the change in the PR that would be very helpful!

Interesting @robert-ancell, I would like to try this for you, but not sure how I bump the flutter engine to that specific commit?
We get flutter like this:
parts:
  flutter-git:
    source: https://github.com/flutter/flutter.git
    source-tag: 3.24.1
    source-depth: 1
    plugin: nil
    override-build: |
      mkdir -p $CRAFT_PART_INSTALL/usr/bin
      mkdir -p $CRAFT_PART_INSTALL/usr/libexec
      cp -r $CRAFT_PART_SRC $CRAFT_PART_INSTALL/usr/libexec/flutter
      ln -s $CRAFT_PART_INSTALL/usr/libexec/flutter/bin/flutter $CRAFT_PART_INSTALL/usr/bin/flutter
      ln -s $SNAPCRAFT_PART_INSTALL/usr/libexec/flutter/bin/dart $SNAPCRAFT_PART_INSTALL/usr/bin/dart
      $CRAFT_PART_INSTALL/usr/bin/flutter doctor

I am assuming there is a step I can add in the override-build to get the flutter engine to follow your commit? (I am still new to flutter and learning how all the parts click together)

@CharleeSF it is largely a mystery to me too, but I can offer some guidance. The above snippet is building the app (not Flutter) and Robert's changes are in the Flutter engine. Unfortunately building the engine locally isn't something I know well enough to integrate into a snap recipe.
But you shouldn't need to snap to verify the fix: On your Ubuntu 22.04, you should be able to reproduce the colour problem by prefixing the launch with GDK_GL=gles:
$ GDK_GL=gles ./build/linux/x64/debug/bundle/flutterdemo

If you succeed with building Robert's branch, then using that will, hopefully, fix the colours.

authors: AlanGriffiths CharleeSF Saviq robert-ancell

repo: canonical/iot-example-graphical-snap


text:
[DPE-5612] Update shared workflows version

This PR updates the shared workflows we use in our CI.
In addition, I also upgraded the GH actions checkout and download-artifact. This will prevent a nodejs version warning in the logs, and we were at risk of our CI breaking soon.

I would have separated the project update (not the CI workflow update) to a different PR

Yes, I need to be mindful of keeping things in scope. In that case however, I did not have much choice since the charm-lib dependencies group is required for the workflows, and scenario 6 breaks with ops 2.17

Oh I see. That's fine. Again, it was more of a niptick but I'm happy to hear that we are on the same page :D

authors: Batalex deusebio


text:
Every time the constructor is called, an HTTP request is sent to Loki asking it for it's version

Bug Description
Every time the constructor is called, an HTTP request is sent to Loki asking it for its version. This information is then logged into the debug logs, spamming them with unneeded log lines.
To Reproduce

juju deploy loki-k8s --channel edge
look in the debug logs

Environment
charm version: latest/edge
Relevant log output
N/A

Additional context
No response

The _provide_loki() method  queries the Loki server version using a HTTP API call and raise different types of exceptions depending on the success or failure of this call. This method is only being used to set a status message by the Loki provider charm depending on if the Loki server is active and reachable or not. The docstring of the LokiPushApiProvider object also recommends the use of such a _provide_loki() method in this manner. However neither the docstring nor the Loki charm use the exceptions raised by the _provide_loki() to conditionally instantiate the LokiPushApiProvider object only if the Loki server is active and reachable. The LokiPushApiProvier object does use the Loki HTTP API in its _check_alert_rules method. This method is invoked in response to any changes in the relation with the consumer object and in response to a pebble ready method (see PR 132 ). Hence instantiating the LokiPushApiProvider object can lead to false negative result in _check_alert_rules just because the Loki HTTP API is not responsive. In view of these observations it is proposed that

The _provide_loki() method be renamed to something like _is_loki_active(). Instead of raising exceptions this method may return a boolean that asserts if the Loki server HTTP API is responsive or not.
Instantiation of the LokiPushApiProvider be guarded by check for _is_loki_active().

There may be a few concerns here. For example how should such a scenario be handled

The Loki charm receives a relation changed event but its workload container is not yet alive so this event is ignored (as per PR 132 ).
Subsequently on pebble ready the Loki charm fails to see an active loki server because of the time lag between the workload container becoming active and the time it takes a Loki HTTP API to become responsive. hence the Loki charm does not instantiate the LokiPushApiProvider . Hence the pending relation changed event is still not handled. In fact it will never be handled.

What is missing here is the functionality of a "Readyness Probe" and the Loki charm being informed through a suitable event when the status of such a readyness probe changes. In the absence of such functionality one approach to solving the problem is to use the periodic update-status event to check for active status of Loki server (i.e. responsiveness of its HTTP API) and update all related consumers.

I think renaming the method and guarding the instantiation of LokiPushApiProvider is a good idea.
Let's keep in mind that we will need to observe the on.loki_push_api_alert_rules_changed event inside the guard, for instance:
if self._is_loki_active():
    self.loki_provider = LokiPushApiProvider(
            self,
            address=external_url.hostname or "",
            port=external_url.port or self._port,
            scheme=external_url.scheme,
            path=f"{external_url.path}/loki/api/v1/push",
     )
    self.framework.observe(self.loki_provider.on.loki_push_api_alert_rules_changed, self._loki_push_api_alert_rules_changed)

I think renaming the method and guarding the instantiation of LokiPushApiProvider is a good idea. Let's keep in mind that we will need to observe the on.loki_push_api_alert_rules_changed event inside the guard, for instance:
if self._is_loki_active():
    self.loki_provider = LokiPushApiProvider(
            self,
            address=external_url.hostname or "",
            port=external_url.port or self._port,
            scheme=external_url.scheme,
            path=f"{external_url.path}/loki/api/v1/push",
     )
    self.framework.observe(self.loki_provider.on.loki_push_api_alert_rules_changed, self._loki_push_api_alert_rules_changed)

As mentioned earlier, we have to be very, very careful with this.
The actual Loki charm does not listen to relation_* events, but they will still be emitted as it is part of the relation. If there are no observers, they will simply disappear.
In the case of, say, a bundle deployment, where a relation-joined event may occur before Loki is actually ready, this means that relation-joined simply disappears into the ether, never to be seen again. Any data which is expected to be set in relation_joined will not be.
The alternative to this is quite literally the "common exit hook" which we have a number of issue about moving away from. If the charm/library looks at every relation data bag on every event to compare the state of the charm, we should probably try to hash absolutely everything.
In order to protect the validity of relation-* events in this case, I'd suggest waiting until after container operations are moved into the charm itself, so the provider can manage relation data only.

I honestly do not see why we need to have Loki active in order to create the rules in the container. For that, we need only Pebble.
I am also very conflicted about providing the URL via LokiPushApiProvider ONLY if Loki is active, as relation changes have a lag to propagate to the other side. Interestingly enough, if Loki is not active, we do NOT remove the URL from LokiPushApiProvider, which is at very least least inconsistent.

Interestingly enough, if Loki is not active, we do NOT remove the URL from LokiPushApiProvider, which is at very least least inconsistent.

How can a Provider charm let the Consumer know that its workload endpoint is temporarily not in service (due to say upgrade or maintenance etc) ? This is to prevent errors in the Consumer charm should it try to connect to the workload endpoints of the Provider charm during this process. There was previously an attempt to cater to this issue using ready() and unready() methods in the Operator Framework through an relation management object that was removed as it was not being used as intended.

Closed PR https://github.com/canonical/loki-k8s-operator/pull/135 since fix is moved to https://github.com/canonical/loki-k8s-operator/pull/151

authors: Abuelodelanada balbirthomas mmanciop rbarry82 simskij


text:
Feature/tls runtime set

Issue
Slow and fragile TLS setup.
DPE-1447
Solution
Port TLS hot reload with lib from merged PR#142

Should we delete the rolling ops lib since we are no longer using it?

what a miss, thanks!
Done db310a1


text:
support python 3.5 in libs

Note: @balbirthomas I converted JujuTopology from a dataclass to a regular class. Tests still pass but I wanted to bring that to your attention.

Bump LIBPATCH?

manually merging so leon can continue work

authors: dstathis sed-i

repo: canonical/prometheus-operator


text:
chore: Use the rustup snap to install latest stable rust

Description
This changes the way Rust and Cargo are installed for building the charm. Instead of using the deb packages available for the base, it uses the rustup snap to install the latest stable Rust and Cargo releases.
This will solve building issues for modules like pydantic that now depend on newer releases of Rust to build.
Checklist:

[x] My code follows the style guidelines of this project
[x] I have performed a self-review of my own code
[ ] I have made corresponding changes to the documentation
[ ] I have added tests that validate the behaviour of the software
[x] I validated that new and existing unit tests pass locally with my changes
[ ] Any dependent changes have been merged and published in downstream modules
[ ] I have bumped the version of the library

My feeling here was more or less "let's use what is in the latest Ubuntu". But I understand if we really want the latest pydantic we need this workaround.

authors: ghislainbourgeois gruyaume


text:
Controller tests for parent child

This change is

https://github.com/canoo/dolphin-platform/issues/603

Coverage increased (+0.07%) to 57.736% when pulling 007da71d8ea45d03de3c493564522a4ee974a19d on ControllerTestsForParentChild into 5483d3fbcbb5f61ca999e0cba6f932f6b844d4e8 on master.

Review Comments Fixed.

authors: coveralls kunsingh

repo: canoo/dolphin-platform

license_source: bigquery


text:
global refactoring and make possible to access longs

Hi! Sorry, there were long holidays in my country, that's why I kept silent all that time.
Thank you very much for the hints you gave me in #1. I successfully adapted your code to longs, and now I'm happy to share the results.
I made a minor refactoring, so now it's more like a library that, in theory, is ready for prod use.
I would be more that happy to hear any thoughts about this work.
Thank you once again.

It looks awesome! And, very neat indeed. I once again understand how primitive I am at software engineering particularly with respect to high-level design :) Thank you for your effort!

authors: canozbey izemlyanskiy

repo: canozbey/finite-state-rice-decoder


text:
When the WebsiteAgent receives Events, we do not need to require that they contain a url keyword

I think it’s unfortunate that we wrote this Agent to use the url value from an event.  The newer url_from_event is much better, and could just be set to {{ url }} to emulate the old behavior, but dropping this would be a breaking change.  I’m not sure how to handle this, but it sucks that if an incoming event just contains a url keyword, even when you just wanted merging behavior, it changes the behavior of the Agent.

@dsander, I've added a migration and removed usage of the Event's url payload value.  Can you or @knu think of any other way that this could break existing users who expect this behavior?

The migration looks good to me.

Thanks!

authors: cantino dsander

repo: cantino/huginn

license: mit


text:
Question: Extend the RestEaseGeneratedType ?

When using the RestEase.SourceGenerator, a internal class is generated: internal class Implementation_1_ITestApi : global::Test.Net.Client.ITestApi.
I want to extend this class like:
public class MyClient : RestEaseGeneratedTypes.Implementation_1_ITestApi, ITestClient
{
    public Task<Result> DoSomethingAsync(string request, CancellationToken cancellationToken = default)
    {
        throw new System.NotImplementedException();
    }
}

But I encounter several issues:

CS0060	Inconsistent accessibility: base class 'Implementation_1_ITestApi' is less accessible than class 'MyClient'
CS7036	There is no argument given that corresponds to the required formal parameter 'requester' of 'Implementation_1_ITestApi.Implementation_1_ITestApi(IRequester)'

Do you have a solution or plan to change this behavior in a next version?

No, that is explicitely not supported. Even if you declare your subclass internal and give it the right constructor, there's an [Obsolete] attribute which will cause a compiler error. If you manage to hack your way around that, RestClient.For doesn't know anything about your subclass and won't instantiate it.
The name of a generated type is not stable (it may change from build to build), and the constructor syntax may change from release to release.
The supported way to add extra methods is using extension methods, as documented here.

Thank you.


text:
🛑 Keycloak is down

In ce603eb, Keycloak (https://id.cantorgymnasium.de/) was down:

HTTP code: 502
Response time: 412 ms

Resolved: Keycloak is back up in 9a66f13 after 12 minutes.

repo: cantorgymnasium/status


text:
Validation changed in original source.

I think you need to update it again, please look original source here
https://github.com/caouecs/Laravel-lang/blob/827aa1240855862582573495aa67b50835792bc5/script/en/validation.php#L44

:'(

Headache?  😺

I open a issue for all languages ( #752 )

authors: caouecs idhamperdameian

repo: caouecs/Laravel-lang


text:
not_regex translated and province attribute added

this is my first pull request 😄
i'll work on fa language and help to make it perfect.

Thank you


text:
Source files for the web front end

Any idea where can we see the source for the front end (askbayou.com)? I can see that there is a flask server running. Ports 8080,8081 & 8084 are open. But 8084 seems to be accessible for API access only. Any documentation on how to call the same (http://localhost:8084/apisynthesis)?

Thanks a lot...

repo: capergroup/bayou


text:
Add MilkDrop title text animation

Text doesn't look great at the default size, not sure if there is something wrong or just its small so looks jaggy.

im working on fixing the blurriness of the text in butterchurn

the text should be less aliased now (we were rendering at a smaller resolution and scaling it up before)

repo: captbaritone/webamp


text:
menu item doesn't show active state in hamburg menu in masthead

talked with Anna Wen on this issue. She was able to reproduce it on current testing environment.
When setting the last menu item link in the masthead to be selected, the item does not have a selected state in the mobile nav, only desktop
DESKTOP:

MOBILE MENU: (You can see the selected menu item in desktop does not have selected state in mobile)

@annawen1 Issue is ready to finish the work.  Airtable updated, labels and release added.

@annawen1 Issue is ready to finish the work.  Airtable updated, labels and release added.

authors: RobertaJHahn yellowdragonfly


text:
[Content group] without expressive, update to use Carbon core

Detailed description

Describe in detail the issue you're having.

Removing the expressive theme, Link and list within Content group should be updated to use Link large and List large variants from Carbon core.
I am hoping that updating the Link and list within Content group will cascade to all instances of Content group simple, with image, etc.
Please let me know if we need additional issues to update the other stories individually
Assuming CTA will be updated through Link with icon in issue #6179

Is this a feature request (new component, new icon), a bug, or a general
issue?

Is this issue related to a specific component?

What did you expect to happen? What happened instead? What would you like to
see changed?

What browser are you working in?

What version of Carbon for IBM.com are you using?

What offering/product do you work on? Any pressing ship or release dates we
should be aware of?

Additional information
PR removing expressive
Web components
React

Closing in favor of #6185 should be able to update both instances within utility fix.


text:
feat(tutorial): complete step 1

Closes #
{{short description}}
Changelog
New

{{new thing}}

Changed

{{change thing}}

Removed

{{removed thing}}

Congratulations! 🥇 You have successfully completed part 1.

repo: carbon-design-system/carbon-tutorial


text:
Update usage.mdx

Removed screen reader info; usual editorial tweaks with Keyboard. Made "group label" the consistent name by removing "heading" (as discussed).
Most important change to scrutinize: the repositioning of the 2nd bullet of the label to the group label area. Took a guess at what was meant; may not be correct.
The other change to confirm: I moved the last bullet of Group labels to Checkbox labels and modified one word. It otherwise made no sense to me.

@mbgower Maybe this should be a discussion topic. Group labels should be concise and to the point. For other types of form inputs, after selecting something, you have the option to set it as a warning state in case you need to communicate more information based off of a current selection which could be something similar to what you are talking about? Checkbox does not currently have a warning state though.

@laurenmrice I've removed the 'instruction' text, and added it to the next agenda.
With that done, I think this is ready to go?

bump @aledavila or @dakahn when you get a sec!

authors: joshblack laurenmrice mbgower

repo: carbon-design-system/carbon-website


text:
Design kit: add icon cell variants

Carbon added additional icon cell variations to design kit

02 hover
03 selected
04 disabled

Acceptance criteria:

[ ] white theme
[ ] gray 10 theme
[ ] gray 90 theme
[ ] gray 100 theme

not stale


text:
Clean up Datagrid stories

Reorganize Datagrid stories so that base component features are exposed top level and “extensions” are included as extensions.
The base component of the Datagrid includes the following features
– Table headers
– Clickable row items
– Row action buttons
– Batch actions
– Empty state
– Frozen columns (scrolling)
– Responsiveness (scrolling)
– Column alignment
– Infinite scrolling
– Resizable columns
Some earlier proposals for reorganizing the stories although batch actions still may better suit the base section for now.

Moving to Later for now since some of the previous cleanup broke docs. May want to revisit this after we do some Storybook improvements.

Done

authors: elycheea ljcarot

repo: carbon-design-system/ibm-products


text:
Issue with building cardano-node: Fedora 37 official repos do not contain ncurses-compat-libs

I followed the procedure https://github.com/cardano-foundation/developer-portal/blob/staging/docs/get-started/installing-cardano-node.md on my Fedora 37 (newest version as of writing) and found out that the package ncurses-compat-libs that is needed to install the cardano-node is not contained anymore in official Fedora repositories. Tried to install the Fedora 36 version of this package on Fedora 37 and had dependency issues. Not sure whether the same problem also appears for the newest RHEL.

Can this be raised against cardano-node repo? ncurses-compat-libs was dropped in RHEL/Fedora from ncurses-6.3.1 as the newer ABI has been live since 7 years. There are hacks around (installing ncurses and creating symlink /usr/lib64/libncurses.so.5 pointing to /usr/lib64/libncurses.so.6), but should be easier to solve correctly

authors: LukaKurnjek rdlrt

repo: cardano-foundation/developer-portal


text:
BOX-227: Add actual edit-permissions check

CHANGELOG

Добавил фактическую проверку на редактирование карточки

https://user-images.githubusercontent.com/42924400/139557470-49e7bec9-5493-421a-951c-256e21f2b069.mp4

@sergeysova ping

repo: cardbox/frontend


text:
[Documentation] Fix Redundant Header in Compatibility Guide

See: https://cardinal-dev.github.io/Cardinal/pages/compatibility-guide/

Fixed in: https://github.com/cardinal-dev/Cardinal/pull/185

repo: cardinal-dev/Cardinal


text:
Only show finder filter scrollbar when hovered

This PR updates the cards grid such that the filter list scroll bar is only shown when hovered over.
Note that this update is hostile to touch devices like the iPad...

I tried it on a MacBook. It works when connected to an external mouse but does not show if I just use the trackpad from the MacBook.
If an external mouse is connected
scroll-showing-on-macbook-with-mouse-connected.mov
Using Macbook trackpad only

It only shows until you scroll

scroll-not-showing-on-macbook-mousepad-only.mov

Thanks for that. My computer is an Ubuntu. @lukemelia is this what you want to see in the case that user is on a MacBook and they use a trackpad?

I think this is OK. Let's live with it like this and see how it feels.

authors: habdelra lukemelia

repo: cardstack/boxel


text:
Loading new camera post-processing assets dynamically

Hello there.
How can I load a new camera postprocessing effect (uasset) without having to re-compile Carla? Is that possible at this stage?

This is now totally possible using CARLA API, so I am closing this issue.

repo: carla-simulator/carla