text:
Low resolution mesh

Hi, I am using this code (and the UE plugin) with the example BakedSDF 'bicycle' dataset.
The mesh in UE is low resolution (eg, the bicycle is missing all the spokes) and the bounding sphere is very small, cutting off all the trees.
Questions:

Can I adjust the resolution somehow to keep all the fine detail?
Can I adjust the bounding sphere?

Thanks!

You cannot, as it does not seem like any detail was cut from the original file. If you check the original BakedSDF, the spokes are missing there too.
The sphere you see also originates in the original model file. The original paper implements the baked representation so that parts that are close to the center of the scene are represented with more Gaussian lobes than further away parts: "we use three spherical Gaussian lobes in the central regions (∥x∥ ≤ 1) and one lobe in the periphery". The author of this conversion script decided to cut away the parts of the baked model outside of the central region by checking how many lobes each vertex has. You can take out that part of the code and it will export the whole scene.

The parts of the scene that have three lobes vs one render differently which is also apparent in the official WebGL demo. I think the specular lighting of BakedSDF may generally be a little flawed.

Thanks for clarifying!

authors: antithing thegenerativegeneration


text:
Minimalistic  Project : Qr code Generator  On the Given String

I hope you will assign this issue to me , As I will push this mini web project to this repo and look further contribution to this repo.

i take this projects

Hi,let me work on this one.

i will solve it

source: gharchive/issue

authors: PranikaBaby raj-mistry-01 sanjevraj-J vishnuvardhancoder

repo: Ayushparikh-code/Web-dev-mini-projects

license: MIT

license_type: permissive

license_source: github-api


text:
[Suggestion] Config option to disable only the Bright warp effect for Photophobic people + Wrenchable Wood

Love all the Warp effects implemented, they all seem a little annoying but not too much, reaching the perfect balance in my opinion as something that accumulated warp should cause. Congrats, Azanor!!
My only complain is with the one that makes the screen extremely bright and white due to literally making me feel pain because of a severe case of photophobia caused by my medical condition.
Could you, please, add a config to disable only that effect?
Btw, why are your logs not wrenchable? lol I just want to rotate my ender io facades (painted with greatwood log) but I can't :(
The ender io devs said that was because you just can't rotate your logs with a wrench

Just so there is more people on this, My wife is the same way. Back in Tc4 and lower she would have to stop playing for the x mins while this effect would happen. We love thaumcraft but if just this effect could be turned down or off that would be amazing!

repo: Azanor/thaumcraft-beta


text:
e2e test failures not exiting properly

e2e tests are being observed to run for multiple hours in some failure cases where lots of output is presented.  A specific instance for reference can be found here.
The core problem is error handling in the acvm.js component, but this is a problem in general if we print continuous output.
Key Points:

The e2e container doesn't seem to exit upon encountering an error in the test. The error seen might be getting swallowed instead of being propagated
The continuous noise from Anvil in the output prevents the 10-minute kill switch from terminating the test.

Actions to do or break-out into new issues:

Silence Anvil output.
Add --forceExit to all jest test runs.
Ensure proper error propagation, especially concerning the wasm simulator error. Can change line 710 of acvm_js.js to throw an error and observe the behavior above, potentially running with --detectOpenHandles.
Consider a workflow kill switch in case we get spammed into taking hours again by some future bug

Also, just a quick bit of envelope math, if all our e2e tests wait for the full 3hr timeout:
60m*3hr*20credits*34tests / 25000 * 15 = $73 for a single run on the workflow.
Ouch.

authors: charlielye ludamad

repo: AztecProtocol/aztec-packages


text:
abstract away serialize and deserialize on user defined structs

Blocked by https://github.com/noir-lang/noir/issues/3379

Waiting on derived macros from Noir

Related to #5078

authors: LHerskind rahul-kothari


text:
feat!: constant inputs for blackbox

This PR allows to use constant values for blackbox inputs.
This is a draft PR:
Only MultiScalarMul is currently handling constant input, so it will fail if constant inputs are used for any other blackboxes.

I've pushed a commit which removes the trait bounds being applied to the various struct definitions as it's generally good practice to avoid these unless absolutely necessary and apply the bounds to impls instead.

Benchmark results
Metrics with a significant change:

avm_simulation_time_ms (Token:transfer_public): 31.8 (-37%)
protocol_circuit_witness_generation_time_in_ms (private-kernel-init): 461 (-16%)

Detailed results
All benchmarks are run on txs on the Benchmarking contract on the repository. Each tx consists of a batch call  to create_note and increment_balance, which guarantees that each tx has a private call, a nested private call, a public call, and a nested public call, as well as an emitted private note, an unencrypted log, and public storage read and write.
This benchmark source data is available in JSON format on S3 here.
Proof generation
Each column represents the number of threads used in proof generation.

Metric
1 threads
4 threads
16 threads
32 threads
64 threads

proof_construction_time_sha256_30_ms
11,370
3,073 (+1%)
1,663 (+13%)
1,475 (-9%)
1,581 (+3%)

proof_construction_time_sha256_100_ms
43,840
11,804 (+1%)
5,490
5,492 (+1%)
5,374 (+1%)

proof_construction_time_poseidon_hash_ms
78.0 (+1%)
34.0
34.0
58.0
87.0 (-1%)

proof_construction_time_poseidon_hash_30_ms
1,518
418 (+1%)
203 (+1%)
229 (+1%)
268

proof_construction_time_poseidon_hash_100_ms
5,603 (-3%)
1,518 (-3%)
679 (-5%)
726 (-5%)
751 (-6%)

L2 block published to L1
Each column represents the number of txs on an L2 block published to L1.

Metric
4 txs
8 txs
16 txs

l1_rollup_calldata_size_in_bytes
1,412
1,412
1,412

l1_rollup_calldata_gas
9,476
9,468
9,476

l1_rollup_execution_gas
610,297
610,289
610,297

l2_block_processing_time_in_ms
756 (-1%)
1,406 (-1%)
2,698 (-1%)

l2_block_building_time_in_ms
25,655
51,208
100,352

l2_block_rollup_simulation_time_in_ms
25,655
51,208
100,351

l2_block_public_tx_process_time_in_ms
22,056
47,397
96,581

L2 chain processing
Each column represents the number of blocks on the L2 chain where each block has 8 txs.

Metric
3 blocks
5 blocks

node_history_sync_time_in_ms
6,961 (-2%)
9,829

node_database_size_in_bytes
12,177,488
16,113,744

pxe_database_size_in_bytes
16,254
26,813

Circuits stats
Stats on running time and I/O sizes collected for every kernel circuit run across all benchmarks.

Circuit
simulation_time_in_ms
witness_generation_time_in_ms
proving_time_in_ms
input_size_in_bytes
output_size_in_bytes
proof_size_in_bytes
num_public_inputs
size_in_gates

private-kernel-init
120 (-1%)
:warning: 461 (-16%)
12,921 (+3%)
20,634
67,190
92,352
2,819
524,288

private-kernel-inner
382 (+1%)
992 (-1%)
48,708 (-2%)
94,902
67,190
92,352
2,819
2,097,152

private-kernel-tail
310
1,760 (-2%)
56,053 (+6%)
99,121
71,733
14,912
399
2,097,152

base-parity
6.24 (-5%)
1,981 (+1%)
2,790 (+1%)
128
64.0
2,208
2.00
131,072

root-parity
48.9 (-2%)
77.3 (+9%)
41,857 (-2%)
27,100
64.0
2,720
18.0
2,097,152

base-rollup
7,969
4,941 (-2%)
89,557 (+3%)
170,330
756
3,648
47.0
4,194,304

root-rollup
111 (+1%)
91.2 (+5%)
23,350 (+5%)
25,309
620
3,456
41.0
1,048,576

public-kernel-setup
720
3,744
46,915 (+3%)
116,905
93,334
125,344
3,850
2,097,152

public-kernel-app-logic
635
4,772 (+1%)
47,437 (-1%)
116,905
93,334
125,344
3,850
2,097,152

public-kernel-tail
1,400
35,607 (+3%)
202,008 (+2%)
511,910
10,014
14,912
399
8,388,608

private-kernel-reset-small
555
1,968 (-8%)
46,809
123,313
67,190
92,352
2,819
2,097,152

public-kernel-teardown
632
4,713 (-2%)
48,355 (+3%)
116,905
93,334
125,344
3,850
2,097,152

merge-rollup
28.8 (-2%)
N/A
N/A
16,542
756
N/A
N/A
N/A

private-kernel-tail-to-public
N/A
7,012 (-15%)
105,294 (+7%)
N/A
N/A
125,344
3,850
4,194,304

Stats on running time collected for app circuits

Function
input_size_in_bytes
output_size_in_bytes
witness_generation_time_in_ms
proof_size_in_bytes
proving_time_in_ms
size_in_gates
num_public_inputs

ContractClassRegisterer:register
1,344
9,944
425
N/A
N/A
N/A
N/A

ContractInstanceDeployer:deploy
1,408
9,944
40.8 (+2%)
N/A
N/A
N/A
N/A

MultiCallEntrypoint:entrypoint
1,920
9,944
1,807
N/A
N/A
N/A
N/A

GasToken:deploy
1,376
9,944
1,002 (+1%)
N/A
N/A
N/A
N/A

SchnorrAccount:constructor
1,312
9,944
1,429 (+2%)
N/A
N/A
N/A
N/A

SchnorrAccount:entrypoint
2,304
9,944
2,868 (+2%)
16,768
54,986 (-4%)
2,097,152
457

Token:privately_mint_private_note
1,280
9,944
1,658 (+2%)
N/A
N/A
N/A
N/A

FPC:fee_entrypoint_public
1,344
9,944
367 (+3%)
16,768
11,250 (-2%)
524,288
457

Token:transfer
1,312
9,944
4,533 (+1%)
16,768
47,983 (+5%)
2,097,152
457

AuthRegistry:set_authorized (avm)
21,043
N/A
N/A
87,200
1,370 (-1%)
N/A
N/A

FPC:prepare_fee (avm)
28,495
N/A
N/A
88,032
5,791 (-1%)
N/A
N/A

Token:transfer_public (avm)
44,885
N/A
N/A
87,754
4,015 (+1%)
N/A
N/A

AuthRegistry:consume (avm)
34,973
N/A
N/A
87,616
3,030 (+1%)
N/A
N/A

FPC:pay_refund (avm)
41,394
N/A
N/A
88,864
24,553 (+3%)
N/A
N/A

Benchmarking:create_note
1,344
9,944
1,409 (+1%)
N/A
N/A
N/A
N/A

SchnorrAccount:verify_private_authwit
1,280
9,944
74.6 (+2%)
N/A
N/A
N/A
N/A

Token:unshield
1,376
9,944
3,745 (+2%)
N/A
N/A
N/A
N/A

FPC:fee_entrypoint_private
1,376
9,944
4,684 (+1%)
N/A
N/A
N/A
N/A

AVM Simulation
Time to simulate various public functions in the AVM.

Function
time_ms
bytecode_size_in_bytes

GasToken:_increase_public_balance
66.8
13,873

GasToken:set_portal
16.7 (-2%)
3,495

Token:constructor
93.6 (+1%)
24,207

FPC:constructor
63.2 (-1%)
13,893

GasToken:mint_public
51.8 (-1%)
10,241

Token:mint_public
633 (+4%)
19,216

Token:assert_minter_and_mint
60.3
13,034

AuthRegistry:set_authorized
32.5 (+2%)
7,869

FPC:prepare_fee
187 (+22%)
15,129

Token:transfer_public
:warning: 31.8 (-37%)
31,425

FPC:pay_refund
193 (-7%)
28,061

Benchmarking:increment_balance
2,711
15,407

Token:_increase_public_balance
56.2
15,089

FPC:pay_refund_with_shielded_rebate
199 (-1%)
29,148

Public DB Access
Time to access various public DBs.

Function
time_ms

get-nullifier-index
0.150 (-4%)

Tree insertion stats
The duration to insert a fixed batch of leaves into each tree type.

Metric
1 leaves
16 leaves
64 leaves
128 leaves
256 leaves
512 leaves
1024 leaves

batch_insert_into_append_only_tree_16_depth_ms
10.3
16.6
N/A
N/A
N/A
N/A
N/A

batch_insert_into_append_only_tree_16_depth_hash_count
16.8
31.7
N/A
N/A
N/A
N/A
N/A

batch_insert_into_append_only_tree_16_depth_hash_ms
0.599
0.512
N/A
N/A
N/A
N/A
N/A

batch_insert_into_append_only_tree_32_depth_ms
N/A
N/A
48.2
75.7
131
244 (-1%)
470

batch_insert_into_append_only_tree_32_depth_hash_count
N/A
N/A
95.9
159
287
543
1,055

batch_insert_into_append_only_tree_32_depth_hash_ms
N/A
N/A
0.492
0.465
0.451
0.442 (-1%)
0.439

batch_insert_into_indexed_tree_20_depth_ms
N/A
N/A
59.6 (-1%)
112 (+1%)
183 (+1%)
351 (-1%)
694

batch_insert_into_indexed_tree_20_depth_hash_count
N/A
N/A
109
207
355
691
1,363

batch_insert_into_indexed_tree_20_depth_hash_ms
N/A
N/A
0.504 (-1%)
0.501
0.485 (+1%)
0.476 (-1%)
0.476

batch_insert_into_indexed_tree_40_depth_ms
N/A
N/A
72.7
N/A
N/A
N/A
N/A

batch_insert_into_indexed_tree_40_depth_hash_count
N/A
N/A
133
N/A
N/A
N/A
N/A

batch_insert_into_indexed_tree_40_depth_hash_ms
N/A
N/A
0.518
N/A
N/A
N/A
N/A

Miscellaneous
Transaction sizes based on how many contract classes are registered in the tx.

Metric
0 registered classes
1 registered classes

tx_size_in_bytes
85,672
670,983

Transaction size based on fee payment method
| Metric |  |
| - |  |

Looks good, shall we merge this on monday so it can be included in the Tuesday release? We'll be able to immediately sync out to Noir then.

We've got a release tomorrow so merging this now.

source: gharchive/pull-request

authors: AztecBot TomAFrench guipublic


text:
ZM: Optimized computation of multilinear quotients

The ZeroMorph paper now includes an optimal algorithm for computing the multilinear quotients $q_k$. Implement this in place of the less-than-optimal version. (Tohru has expressed interest in trying to do this).

Closed with 3061

repo: AztecProtocol/barretenberg


text:
Valheim - Not working with 0.217.24

After the 0.217.24 release, I cant load into any world, even if i create a new one. I also now randomly have a character named Ragnar which i never created. I have troubleshooted all my mods and can confirm this is the game breaking one.

I am having the same issue. The game launches with no character model in the load screen and when I click "Start Game", there's a character named Ragnar (I also never created this) and there's no model.  I am getting two errors:

[Error  : Unity Log] MissingMethodException: void Terminal/ConsoleCommand..ctor(string,string,Terminal/ConsoleEvent,bool,bool,bool,bool,bool,Terminal/ConsoleOptionsFetcher,bool)
Stack trace:
(wrapper dynamic-method) Console.DMDConsole::Awake(Console)
UnityEngine.Object:Instantiate(GameObject)
FejdStartup:DMDFejdStartup::Awake(FejdStartup)

and

[Error  : Unity Log] MissingFieldException: Field 'FejdStartup.m_connectionFailedError' not found.
Stack trace:
(wrapper dynamic-method) FejdStartup.DMDFejdStartup::ShowConnectError(FejdStartup,ZNet/ConnectionStatus)
(wrapper dynamic-method) FejdStartup.DMDFejdStartup::Start(FejdStartup)

EDIT: After several hours of troubleshooting, the issue was due to a specific mod. Once disabled, game launched as expected.

Which mod was it?

Missing methods and errors are caused by outdated mods. Make sure you are only using mods for the current game patch.

I am certain it is bepinex because I've tried running the game ONLY with bepinex enabled and the error is still there. I have also tried reinstalling the game, even deleting the whole folder altogether, without luck. Is there perhaps another link I can try?
Sent from Outlook for Androidhttps://aka.ms/AAb9ysg

From: AzumattDev @.>
Sent: Monday, October 9, 2023 7:05:24 AM
To: AzumattDev/BepInEx @.>
Cc: Siggennn @.>; Author @.>
Subject: Re: [AzumattDev/BepInEx] Valheim - Not working with 0.217.24 (Issue #7)
Missing methods and errors are caused by outdated mods. Make sure you are only using mods for the current game patch.
—
Reply to this email directly, view it on GitHubhttps://github.com/AzumattDev/BepInEx/issues/7#issuecomment-1752352025, or unsubscribehttps://github.com/notifications/unsubscribe-auth/BDC2FNHOP2FWYZUYA755ULDX6OAZJAVCNFSM6AAAAAA5XTWDDWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTONJSGM2TEMBSGU.
You are receiving this because you authored the thread.Message ID: @.***>

I initially also did a new profile and launched with BepInEx, that worked fine.
The mod that gave me the trouble was AutoMapPins by FixitFelix - don't think that one's been updated yet; when I disabled it, the game launched fine. Per the Discord, there seems to be hit or miss with some working, others not. There's definitely some weirdness going on after the second patch on 6 Oct.

Yeah, seems the update broke my modded game. Is there anything that can be done to fix this? As said previously, i can confirm it is only BepInEx causing these troubles as I've ran the game with only this enabled and the issues persist.

I can confirm that here as well. Completely reinstalled the dedicated server, using only BepInEx and no mods and it crashes, complaining about corrupted files on the _Data directory.
I've removed and installed everything. Twice. Restarted the computer. I haven't burned any incense or made any other offerings at this point, however.
I'm launching with, from dedicated server folder, via the (edited) start_headless_server.bat file:
valheim_server -nographics -batchmode -name "Test Server" -port 2456 -public 0 -world "Test World" -password "********" -crossplay --doorstop-enable true --doorstop-target "C:\Users\games\AppData\Roaming\r2modmanPlus-local\Valheim\profiles\Default\BepInEx\core\BepInEx.Preloader.dll"

Attached the log file.
bepinex-plode.txt

I can confirm that here as well. Completely reinstalled the dedicated server, using only BepInEx and no mods and it crashes, complaining about corrupted files on the _Data directory.
I've removed and installed everything. Twice. Restarted the computer. I haven't burned any incense or made any other offerings at this point, however.
I'm launching with, from dedicated server folder, via the (edited) start_headless_server.bat file:
valheim_server -nographics -batchmode -name "Test Server" -port 2456 -public 0 -world "Test World" -password "********" -crossplay --doorstop-enable true --doorstop-target "C:\Users\games\AppData\Roaming\r2modmanPlus-local\Valheim\profiles\Default\BepInEx\core\BepInEx.Preloader.dll"

Attached the log file.
bepinex-plode.txt

I tested using this configuration with r2modman like you have. My server was able to boot locally just fine. There aren't any issues with the BepInEx pack for this version. Your installations must be corrupt or not clean like you think they are. For the other people above, I would assume the same thing or they are using outdated mods.
Here is the content of my start_headless_server.bat
@echo off
set SteamAppId=892970

echo "Starting server PRESS CTRL-C to exit"

REM Tip: Make a local copy of this script to avoid it being overwritten by steam.
REM NOTE: Minimum password length is 5 characters & Password cant be in the server name.
REM NOTE: You need to make sure the ports 2456-2458 is being forwarded to your server through your local router & firewall.
REM valheim_server -nographics -batchmode -name "My server" -port 2456 -world "Dedicated" -password "secret" -crossplay
valheim_server -nographics -batchmode -name "Test Server" -port 2456 -public 0 -world "Test World" -password "********" -crossplay --doorstop-enable true --doorstop-target "C:\Users\crypt\AppData\Roaming\r2modmanPlus-local\Valheim\profiles\ValheimServerTest\BepInEx\core\BepInEx.Preloader.dll" %*

For others who come here about the above error, I think I figured it out on our server: McAfee was mucking with the files for some reason.
I had again nuked everything (Valheim server and r2modman, all folders and files, re-installed, and tried just a bare bones BepInEx modded server, got the same issue as above. This is on a new Win11 HP machine, less than a month old, so it still had the McAfee free trial on there, and it happened to pop up to annoy/nag about purchasing a full version, so I uninstalled it, and rebooted. Curiosity got me thinking, so after it rebooted, I tried the BepInEx bare modded server and it worked just fine. I moved to our modded server profile in r2modman and tried again, no problems... So, yeah, I am about 98% sure it was McAfee messing with things, but it could just have been the reboot itself, maybe?

Thanks for taking your time to troubleshoot. The mod is almost working fine now. The only new problem I have encountered, is that the standard developer console is gone and replaced by the bepinex F5 displaying all sorts of weird messages. None of the normal devcommands are working, and when trying to type the suggested commands, pressing enter does nothing - the menu with the text written is just standing still as if imma write more. Any suggestions to how i can solve this? Vanilla works perfectly fine with F5 and devcommands

Thank you for taking your time to troubleshoot. Everythings working as it should now :)

authors: AzumattDev LadyWolfheart Siggennn dp63split syntruth

repo: AzumattDev/BepInEx


text:
مشکل

سلام وقت بخیر خسته نباشید متاسفانه رو بعضی از سرور ها کار نمیکنه بنظرتون مشکل از کجاس ؟

سلام ممکنه از خود محدودیت سرور باشد . توسط آی‌پی ۶ یا لوکال هم تست نمایید تا اسکریپت بعدا به نسخه آخر هم آپدیت شود


text:
Web access toggle

Please provide us with the following information:

This issue is for a: (mark with an x)
- [ ] bug report -> please search issues before submitting
- [x] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

it would be sick if there was a button where you could switch on and off for web access. for example, toggled off would be answers based only off the knowledge base provided, and toggled on would allow it to function similar to GPT, where it can refer to both the docs and to all of the rest of its knowledge, with the security of this setup and the data not being used for training models. That to me would be the ultimate enterprise level custom internal chatbot. I don't know how difficult this would be to set up but that would be dope. thanks

Any log messages given by the failure

n/a

Expected/desired behavior

described earlier

OS and Version?

Windows 11

azd version?

n/a enhancement

Versions

n/a

Mention any other details that might be useful

Thanks! We'll be in touch soon.

To implement this sort of feature in our codebase, I'd take this approach:

Add an additional function to the query rewriting tools definition like "search_web" so that the LLM had to choose between "search_web" and "search_sources".
If "search_web" was suggested as the right function to use, then it'd use the Bing Search API to search the web for the suggested query.
It would send the concatenated results to the LLM.

Alternatively, you could use the OpenAI Assistants API, which I believe already has a web searching tool. This repository does not use that API, as we are lower level.
It could be a neat enhancement. As usual, I can't make guarantees about whether any of the maintainers will have time to implement it. If you implement it yourself, please share in a branch/PR. Thanks for filing!

repo: Azure-Samples/azure-search-openai-demo


text:
Recognized text is not correct and irrelevant

Hi,
I have a wav file and when I try to recognize speech using node.js sdk it shows a different result. Sometimes it recognizes precisely but other times shows very odd words and irrelevant text.
as an example, when the real text should be:

section two you'll hear a tour guide giving a talk about a museum center called riverside industrial village first you have some time to look at questions eleven to thirteen now listen carefully and answer questions eleven to thirteen

it shows:

Shop Hun.Hello hello as I'm not true dat. Boi have my shine shine goosefish can phone.Fish hello how long **** **** **** ****Call from London Luges Hongs Awesome ****

Here is my code

 recognizer.startContinuousRecognitionAsync(function () {}, function (err) {
                    console.trace("err - " + err);
                    cstat = 100;
                    removefile(url);
                    res.json({
                        status: "OK",
                        message: tempText
                    });
                });

                recognizer.canceled = function (s, e) {
                    var str = "(cancel) Reason: " + sdk.CancellationReason[e.reason];
                    if (e.reason === sdk.CancellationReason.Error) {
                        str += ": " + e.errorDetails;
                    }

                    cstat = 100;
                    removefile(url);
                    res.json({
                        status: "OK",
                        message: tempText
                    });
                }

                recognizer.recognized = function (s, e) {
                    // Indicates that recognizable speech was not detected, and that recognition is done.
                    if (e.result.reason === sdk.ResultReason.NoMatch) {
                        var noMatchDetail = sdk.NoMatchDetails.fromResult(e.result);
                        console.log("\r\n(recognized)  Reason: " + sdk.ResultReason[e.result.reason] + " NoMatchReason: " + sdk.NoMatchReason[noMatchDetail.reason]);
                        // tempText += e.result.text;
                    } else {
                        console.log("\r\n(recognized)  Reason: " + sdk.ResultReason[e.result.reason] + " Text: " + e.result.text);
                        tempText += e.result.text;
                    }
                };

                recognizer.recognizing = function (s, e) {
                    //var str = "(recognizing) Reason: " + e.result + "---"+e.privResult;
                    console.log(e);
                };
                recognizer.sessionStopped = function (s, e) {
                    recognizer.stopContinuousRecognitionAsync()
                    var str = "(sessionStopped) SessionId: " + e.sessionId;
                    cstat = 100;
                    removefile(url);
                    res.json({
                        status: "OK",
                        message: tempText
                    });
                    console.log(str);
                };

is it possible to share the wave file so we can reproduces and analyze the problem in house?
thx
Wolfgang

Thanks for your reply.
Here are 2 files.
https://www.dropbox.com/sh/cp71s91com4ggaw/AAAle_OXK5trY_Ed1BAbc7XRa?dl=0

@therowf
we are looking into this ... the preferred bitrate is 256kbps, but unfortunately we still see some issues with one of your files.
...looking into it...

@wolfma61 Thanks

@therowf - these are a couple of interesting issues you discovered ;)
some more investigation is needed - but so far:
there is a problem in the JS SDK with 44khz audio files, that makes your m*81.wav audio file fail using the javascript.sdk (it is really a special file). It works with the native SDK (C#, Python etc). We will fix this in the JS sdk in an upcoming version. Converting to 16khz the file transcribes fine (as expected)
Your m*76.wav file converted to 16khz creates wrong results when converted with Audacity. The desired transcription is generated, but not as the best result. This seems to be a model issue, which is being investigated by the service team.
Wolfgang

this should create good results now


text:
Update the Windows "Find UART" instructions everywhere

Get-WMIObject Win32_SerialPort | Select-Object Name,DeviceID,Description,PNPDeviceID

Linux can be simplified as well: ls -l /dev/serial/by-id/

authors: CIPop danewalton


text:
Add etcd-fix operator to detect and correct master node IP change breaking etcd - ARO-1534

This operator is needed to resolve a crash loop failure of etcd pod due to hardcoded etcd endpoints in pod spec. oc observe is used to detect this condition and start a bash script.
Information from the Updated event is passed to the script that performs recover steps detailed here: https://docs.openshift.com/container-platform/4.4/backup_and_restore/replacing-unhealthy-etcd-member.html#restore-replace-crashlooping-etcd-member_replacing-unhealthy-etcd-member
Which issue this PR addresses:

Fixes
https://issues.redhat.com/browse/ARO-1534
What this PR does / why we need it:
When the master node IP changes etcd pod spec has a hard coded ETCD_ENDPOINTS variable. If a member changes IP addresses the endpoints var isn't updated, causing a crashlooping etcd container on that node.
This PR provides an automated way to detect and correct this condition on the problem master node.
The script only performs actions when the problem node is the same as the host node. This prevents peers from taking actions they shouldn't.

Test plan for issue:
Adding unit tests.
Tested against development cluster.

Execute script below to reproduce the IP change.

./change_vm_nic.sh steven-cluster-hrkhk-master-2

#!/bin/bash

main() {
    if [[ -z $1 ]]; then
        abort "node name must be provided"
    fi

    node="$1"
    nic2="${node}-nic-$((1 + $RANDOM % 10))"

    subnetID="$(az network vnet subnet show -n $CLUSTER-master --vnet-name dev-vnet --query id)" || abort "failed to get subnet ID"
    aro="aro-${CLUSTER}"
    az network nic create --name "$nic2" --subnet "$( tr -d \" <<< "$subnetID")" -g "$aro" || abort "failed to create nic $nic2"

    az vm deallocate -g "$aro" -n "$node" || abort "failed to deallocate $node"

    az vm nic add --nics "$nic2" --vm-name "$node" --primary-nic "$nic2" -g "$aro" || abort "failed to add $nic2 to $node"

    az vm start -n "$node" -g "$aro" || abort "failed to start $node"
}

abort() {
    echo "$1"
    echo "Exiting"
    exit 1
}

main "$1"

Create operator

go run -tags aro ./cmd/aro/ operator master

Monitored operator logs

oc logs -n openshift-etcd pod/etcd-fix-nrsd2

Example logs output

openshift-etcd etcd-steven-cluster-hrkhk-master-2 ''\''{"name":"ETCDCTL_ENDPOINTS","value":"https://10.125.80.6:2379,https://10.125.80.8:2379,https://10.125.80.9:2379"} {"name":"NODE_steven_cluster_hrkhk_master_0_IP","value":"10.125.80.6"} {"name":"NODE_steven_cluster_hrkhk_master_1_IP","value":"10.125.80.9"} {"name":"NODE_steven_cluster_hrkhk_master_2_IP","value":"10.125.80.7"} False'\'''
Event is: Updated
Container status: False
10.125.80.7 not found in https://10.125.80.6:2379,https://10.125.80.8:2379,https://10.125.80.9:2379
bad node name is: steven-cluster-hrkhk-master-2
bad pod name is: etcd-steven-cluster-hrkhk-master-2
All good node IPs: 10.125.80.6 10.125.80.9
Creating /host/var/lib/etcd-backup
Moving /host/etc/kubernetes/manifests/etcd-pod.yaml to /host/var/lib/etcd-backup
Moving /host/var/lib/etcd/ to /host/tmp
found peer pod: etcd-steven-cluster-hrkhk-master-0
found peer pod: etcd-steven-cluster-hrkhk-master-1
rshing into pod/etcd-steven-cluster-hrkhk-master-0 now to remove member id 9e10a4626851f482
Member 9e10a4626851f482 removed from cluster bab5f47cf9607d11
id not found in etcd member list for pod etcd-steven-cluster-hrkhk-master-1
secret "etcd-peer-steven-cluster-hrkhk-master-2" deleted
secret "etcd-serving-steven-cluster-hrkhk-master-2" deleted
secret "etcd-serving-metrics-steven-cluster-hrkhk-master-2" deleted
etcd.operator.openshift.io/cluster patched

Is there any documentation that needs to be updated for this PR?
Toil work, I'm unsure if this needs to be documented?

Hi @s-fairchild that's good that we have this being taken.
I think that the operator aproach and more generally automatic detect/recovery is probably a better aproach than waiting for a PUCM to repair the problem.
to @darthhexx 's point, I think that indeed, etcd reconciliation, ssh fixing and NIC reconciliation could be part of a greater feature. But rather than putting that in a PUCM, I would rather go for the aproach taken with the operator.
(without looking at the code itself, I have not reviewed it, just talking about the approach here)

@darthhexx No there isn't a design document for this feature that I'm aware of.
The goal of this PR was to automate a fix for this issue about the problem described here.
Will the automated master node replacement monitor the cluster from an operator live, or be triggered another way? I'm curious mostly to see if this PR can fit (or modified to fit) into the larger feature design.
Also Would this particular issue be better handled by an automated full node replacement, rather than just etcd?

Will the automated master node replacement monitor the cluster from an operator live, or be triggered another way?

It would be triggered as a new SRE triggered RP process that runs as a set of predefined actions and condition steps, just like we have here for a cluster update. This gives us specific control over the actions and remediation processes, much like your steps are doing in the bash script, but in the RP itself.

Also Would this particular issue be better handled by an automated full node replacement, rather than just etcd?

Personally, I am not comfortable having ectd replacement code running on all clusters all of the time waiting to perform an etcd pod replacement as soon as it detects an ectd member not available. From that I can see from a quick glance, there are also no locks to prevent multiple replacements and adding that alone will raise the detection and remediation complexity substantially.
Having the process automated is a must, but I do think it is better suited as an SRE initiated process on a confirmed failed etcd pod, due to the ramifications of "getting it wrong", rather than a permanent process running on all clusters.
With regards to using this process in the automated master node replacement, it would be ideal if the process was converted to Golang functions in a steps-based approach, which could be tested, instead of a daemonset and a bash script. However, the removing of the etcd member would still need to be performed in a pod, but that could be an Action to deploy followed by a Condition to verify and a subsequent Action to remove the pod.
Of course there are always many ways to design a system, so my suggestions are just my viewpoint and I'm happy to hash this out further in a meeting, design doc, or this PR.

@darthhexx Thanks for your input. I agree a tested Go step based remediation process, SRE triggered sounds like the safest approach. I'd like to meet to discuss this design and incorporating it into the larger master node replacement feature when you have time. I'll reach out to set something up.

Use this operator to detect a (breaking) master node IP change, and use it to write an operator status, and potentially alert SRE so that remediation steps can be taken

@cadenmarchese Are we using operators to write statuses for other events?
Maybe I can update this PR shifting this operator from taking action to alerting, then an SRE triggering an automated fix from there.

Closing this and opening https://github.com/Azure/ARO-RP/pull/2725

authors: darthhexx gvanderpotte s-fairchild

repo: Azure/ARO-RP


text:
cleanup(clean) remove unnecessary mcr.microsoft.com/oss/kubernetes-csi/zurefile-csi:1.26.2.1

What type of PR is this?
/kind cleanup
What this PR does / why we need it:
feat(clean) remove unnecessary mcr.microsoft.com/oss/kubernetes-csi/zurefile-csi:1.26.2.1
Which issue(s) this PR fixes:
N/A
Fixes #
Requirements:

[x] uses conventional commit messages

[x] includes documentation
[ ] adds unit tests
[ ] tested upgrade from previous version

Special notes for your reviewer:
Release note:
remove mcr.microsoft.com/oss/kubernetes-csi/zurefile-csi:1.26.2.1 from preload that is no longer necessary as it has been bumped to 1.26.2

Pull Request Test Coverage Report for Build 5098169518

0 of 0   changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 61.643%

Totals

Change from base Build 5095909596:
0%

Covered Lines:
2544

Relevant Lines:
4127

💛  - Coveralls

could you fix the git commit msg by git commit --amend, and then set commit msg as chore: xxx, thanks.

could you fix the git commit msg by git commit --amend, and then set commit msg as chore: xxx, thanks.

updated, thanks @andyzhangx

authors: HDYA andyzhangx coveralls

repo: Azure/AgentBaker


text:
feat. add check to enable disabling secure boot for windows nodes

For testing drivers w/ windows secure boot must be disabled

What type of PR is this?
/kind feature
What this PR does / why we need it:
Adds an env var check in windows/e2e-scenario.sh in order to disable secure boot. In order to test unsigned Windows Drivers secure boot must be disabled.

Windows Org locks down being able to create signed drivers, meaning to evaluate and test windows drivers secure boot must be disabled so that installing unsigned drivers can be setup.

Which issue(s) this PR fixes:

Fixes #3677
Requirements:

[ ] uses conventional commit messages

[ ] includes documentation
[ ] adds unit tests
[ ] tested upgrade from previous version

Special notes for your reviewer:
Release note:
none

Pull Request Test Coverage Report for Build 6425594421

0 of 0   changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 79.164%

Totals

Change from base Build 6412561039:
0.0%

Covered Lines:
2234

Relevant Lines:
2822

💛  - Coveralls

@juliusl Thanks for the PR. Do you only want to disable secure boot for Windows nodes in AgentBaker e2e tests? If so, your PR looks good.

One required test failed because the PR/commit message does not follow the commit message lint. You need to update feat. to feat:
E2E tests only can be run when you create the PR from a branch in Azure/AgentBaker but not a forked repo. You can ping me in teams so I can guide you how to request the permission.

@juliusl Thanks for the PR. Do you only want to disable secure boot for Windows nodes in AgentBaker e2e tests? If so, your PR looks good.

@AbelHu Finally getting back around to this, yes I only want to be able to do this in e2e tests

authors: AbelHu coveralls juliusl


text:
🪲 Bug Report - Login experience

Describe the bug
File: tool/1_wara_collector.ps1
Bug: Consider skip login if a session is already authenticated.

@Azure/aprl-wara-tools please review

authors: ejhenry nekdima


text:
Sarah issue test

Describe the bug
A clear and concise description of what the bug is.
To Reproduce
Steps to reproduce the behavior:

Go to '...'
Click on '....'
Scroll down to '....'
See error

Expected behavior
A clear and concise description of what you expected to happen.
Screenshots
If applicable, add screenshots to help explain your problem.
Desktop (please complete the following information):

OS: [e.g. iOS]
Browser [e.g. chrome, safari]
Version [e.g. 22]

Smartphone (please complete the following information):

Device: [e.g. iPhone6]
OS: [e.g. iOS8.1]
Browser [e.g. stock browser, safari]
Version [e.g. 22]

Additional context
Add any other context about the problem here.

testing

Test issue, closing

repo: Azure/Azure-Sentinel


text:
AWS CloudTrail - Azure Native

Fixes #
Proposed Changes

Azure native Sentinel Data connector to ingest AWS CloudTrail Logs from centralized AWS S3 bucket - Receiving CloudTrail Log Files from Multiple Accounts

How about that.


text:
CyberArkEPM: first commit

Change(s):

Add new Dataconnector for CyberArk EPM.

Hey @oshezaf , will you please review parser, thanks.

Hey @averbn , the checks are failing "JsonFileValidation" and "sampleDataValidator", this may be because of some typos for """e":"-Embedding", "source""e":"", will you please check and update, thanks.

Hey @averbn , Tested the data connector by deploying the functions. Can see unexpected error for "CyberArkEPMSentinelConnector" function. Please check and update. Thanks.

Hey @averbn , will you please resolve the requested changes, thanks.

Hey @averbn , will you please resolve the requested changes, thanks.

It seems I have no permission for doing that.

Hey @averbn, you need to change "processCommandLine":"f67fa0d1-30a-45c0-b199-1efd2" to correct GUID, the Guid has 32 digits.

as it was before ,in sample data, please check and update, thanks.

Hey @averbn, everything else looks good, just change "WEBSITE_RUN_FROM_PACKAGE" link to https://aka.ms/sentinel-CyberArkEPMAPI-functionapp, thanks.

authors: averbn v-sabiraj


text:
Adding PS function New-AzureSentinelAlertRuleDeployment

Required items, please complete
Change(s):

Added New-AzureSentinelAlertRuleDeployment.ps1

Reason for Change(s):

Deploying JSON Detection rules to Azure by looping is time consuming

Testing Completed:

yes

Checked that the validations are passing and have addressed any issues that are present:

yes

References:

@aprakash13  Please review and provide your feedback. thanks!!!

@sreedharande Is this something that you can help review. Thanks.

Do you need more support with merging this PR?

@sreedharande Is this something that you can help review. Thanks.

Do you need more support with merging this PR?

Hey @sreedharande,can you please check and approve , thanks.

Hey @sreedharande,can you please check and approve , thanks.

@sreedharande : can you please check and approve , thanks.

@sreedharande : can you please check and approve , thanks.

@sreedharande : can you please check and approve , thanks.

Hi @sreedharande
Can you please review the PR or assign it to the right person who can review it.
Thanks

@sreedharande Please look into this.

Hi @sreedharande
Can you please review the PR or assign it to the right person who can review it.
Thanks

Hi @sreedharande
It would be great if you could review the PR and provide your feedback
Thanks

Hi @sreedharande
Can you please review or assign it to someone who can work on this.
Thanks

authors: NikTripathi aprakash13 pkhabazi v-marimanda v-mchatla v-sabiraj v-spadarthi vmanojreddy


text:
Deploy from Custom Template not possible

When using the option to deploy from the custom template provided, I am not able to ever select a subscription.
Here are a few of the scenarios I have tried:

Not selecting a Management Group within the Basics tab
Selecting the following Management Groups (in the end, I want the solution deployed to the management subscription)

Confirmed I should have the proper permissions needed to deploy the solution.  I tried as the owner of the tenant root group as well as global administrator.  I still cannot select a subscription to deploy to.

I had the wrong branch selected when trying to deploy.  Needs to be the main branch
https://portal.azure.com/#view/Microsoft_Azure_CreateUIDef/CustomDeploymentBlade/uri/https%3A%2F%2Fraw.githubusercontent.com%2FFehseCorp%2FAzureMonitorStarterPacks%2FAVDMerge%2Fsetup%2FCustomSetup%2Fmonstar.json/uiFormDefinitionUri/https%3A%2F%2Fraw.githubusercontent.com%2FFehseCorp%2FAzureMonitorStarterPacks%2FAVDMerge%2Fsetup%2FCustomSetup%2Fsetup.json  ❌
vs
https://portal.azure.com/#view/Microsoft_Azure_CreateUIDef/CustomDeploymentBlade/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzureMonitorStarterPacks%2Fmain%2Fsetup%2FCustomSetup%2Fmonstar.json/uiFormDefinitionUri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzureMonitorStarterPacks%2Fmain%2Fsetup%2FCustomSetup%2Fsetup.json  ✅

repo: Azure/AzureMonitorStarterPacks


text:
Carriage returns in line endings prevent execution on linux

When attempting to run azurite on linux I get this error /usr/bin/env: ‘node\r’: No such file or directory. A quick dos2unix on the file fixes it.
It looks like the line endings are ok in the repo. So maybe this is an issue introduced by the build/publish pipeline?
This is an issue for azurite 2.7.0 installed via npm and doesn't affect version 2.6.5

Same issue for me .
Im running azurite on ubuntu 18.04.Any known solution ?

@clk1984
Run which azurite in a terminal to check the file path. It should be /usr/local/bin/azurite.
Then run sudo dos2unix /usr/local/bin/azurite to fix the line endings.
The other option is to specify version 2.6.5 when you install it. Use azurite@2.6.5 instead of just azurite as the package name.

@edwin-huber Can you take a look? Is this a regression?

Cross platform support now in v3 being tested by Azure pipelines

authors: XiaoningLiu clk1984 coderpatros edwin-huber patros

repo: Azure/Azurite


text:
Improve Table Service Performance

I am actively looking at options to improve performance.
The best option I have found until we check in a change for this is to change the the constructor for LokiTableMetadataStore in  src\table\persistence\LokiTableMetadataStore.ts
You have 2 options.
Turn off persistence:
  public constructor(public readonly lokiDBPath: string) {
       this.db = new Loki(lokiDBPath, {
    });
  }

Enable the lfsa adapter, which creates files per partition:
  public constructor(public readonly lokiDBPath: string) {
    const lfsa = require("../../../node_modules/lokijs/src/loki-fs-structured-adapter.js");
    const lfsaAdapter = new lfsa();
    this.db = new Loki(lokiDBPath, {
      autosave: true,
      adapter: lfsaAdapter
      autosaveInterval: 5000
    });
  }

Addresses #1198

Dependency on #1061

@edwin-huber, from my testing Table didn't get faster in-memory. The slow path for blob and queue was writing extents which is not done at all in tables. LokiJS does not persist immediately upon write so Loki + Table doesn't have disk in the request context, just in a background persist every 5 seconds. Perhaps I am misunderstanding the original issue however.

I wrote a blog about my change which describes the perf change: https://www.joelverhagen.com/blog/2023/11/azurite-in-memory

a background persist every 5 seconds.

It was exactly this IO causing systems to hang, writing large amounts of table data to disk...

Makes sense, thanks for clarifying this for me !

authors: edwin-huber joelverhagen


text:
Trigger access option display incorrect value when enable AAD policy

Describe the Bug with repro steps

Enable "Azure Active Directory Authorization Policies" in Logic App Consumption with any simple policy

Go to "Workflow settings" and we will find the "trigger access option" change to "Only other logic apps", but the Logic App still can be triggered from Postman

What type of Logic App Is this happening in?
Consumption (Portal)
Are you using new designer or old designer
New Designer
Did you refer to the TSG before filing this issue? https://aka.ms/lauxtsg
Yes
Workflow JSON
No response
Screenshots or Videos
No response
Browser
Edge
Additional context
No response

I've found and fixed the issue, it will be a part of our next release cycle which should be deployed to all regions by EoD March 1st.
Setting the trigger access should still function properly, the only issue should be with the value that is displayed upon page load.

repo: Azure/LogicAppsUX


text:
[Visual requirement - Logic Apps - Storage]: Luminosity ratio of instruction under "Storage account" edit present on storage tab is less than minimum required ratio 4.5:1.

Describe the issue
User Experience:
If the color contrast ratio of text is less than the minimum required ratio of 4.5:1, then people with low vision will find it difficult to read the text properly and not able to understand the information which that text conveys and get disoriented.
Note: User credentials should NOT be included in the bug.
Repro Steps:

Open https://ms.portal.azure.com/ and login via valid credentials.
Navigate to the Left Nav bar and select '+New', search 'Logic App' and select it. Press Create button .
'Create Logic App' blade appears, enter the details and select "Storage" tab. Navigate all the controls of the selected tab.
Verify whether luminosity ratio of instruction under "Storage account" edit present on storage tab is less than minimum required ratio 4.5:1 or not.

Actual Result:
Luminosity ratio of instruction under "Storage account" edit present on storage tab is 1.7:1 which is less than minimum required ratio 4.5:1.
Expected Result:
Luminosity ratio of instruction under "Storage account" edit present on storage tab should be equal to or more than minimum required ratio 4.5:1.
Issue:
Ensures the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds (color-contrast - https://accessibilityinsights.io/info-examples/web/color-contrast)
Target application:
Create Logic App (Workflow Service Plan) - Microsoft Azure - https://ms.portal.azure.com/#view/WebsitesExtension/WorkflowAppCreateV3Blade/_provisioningContext~/%7B%22initialValues%22%3A%7B%22subscriptionIds%22%3A%5B%2246841c0e-69c8-4b17-af46-6626ecb15fc2%22%2C%22204898ee-cd13-4332-b9d4-55ca5c25496d%22%2C%223c66da21-607e-49b4-8bdf-f25fbb8f705f%22%5D%2C%22resourceGroupNames%22%3A%5B%5D%2C%22locationNames%22%3A%5B%22eastus%22%2C%22canadacentral%22%2C%22eastus2%22%5D%7D%2C%22telemetryId%22%3A%229059630d-0dcd-42d7-92ba-b98b6ea5b0ba%22%2C%22marketplaceItem%22%3A%7B%22categoryIds%22%3A%5B%5D%2C%22id%22%3A%22Microsoft.Portal%22%2C%22itemDisplayName%22%3A%22NoMarketplace%22%2C%22products%22%3A%5B%5D%2C%22version%22%3A%22%22%2C%22productsWithNoPricing%22%3A%5B%5D%2C%22publisherDisplayName%22%3A%22Microsoft.Portal%22%2C%22deploymentName%22%3A%22NoMarketplace%22%2C%22launchingContext%22%3A%7B%22telemetryId%22%3A%229059630d-0dcd-42d7-92ba-b98b6ea5b0ba%22%2C%22source%22%3A%5B%22LogicAppPlanTypeSelector.ReactView%22%2C%22%7B%20Name%3A%20Part%2C%20Type%3A%20%5B0%5DWebsitesExtension-%5B1%5DLogicAppPlanTypeSelector.ReactView-%5B2%5DAzBladeVirtualLens-%5B5%5DLogicAppPlanTypeSelector.ReactView%2C%20Id%3A%20Part-LogicAppPlanTypeSelector.ReactView-5%20%7D%22%2C%22Part-LogicAppPlanTypeSelector.ReactView-5%22%5D%2C%22galleryItemId%22%3A%22%22%7D%2C%22deploymentTemplateFileUris%22%3A%7B%7D%2C%22uiMetadata%22%3Anull%7D%7D/planType/workflowStandard
Element path:
.msportalfx-text-warning
Snippet:
Select a resource group to enable create new storage account option.
How to fix:
Fix any of the following:
Element has insufficient color contrast of 1.71 (foreground color: #ffba01, background color: #ffffff, font size: 9.8pt (13px), font weight: normal). Expected contrast ratio of 4.5:1
Environment:
Chrome version 128.0.0.0
Are you using new designer or old designer
New Designer (With action panels)
Screenshots or Videos
No response
Browser
Chrome version 128.0.0.0
Additional context
No response

Assigned this one to Shibani to take a look at on ADO


text:
Better documentation for inputs/outputs

Some inputs and outputs have a vague description, making it hard for the user to understand, what they are used for. E.g. the description of workspaceId does not explain, that it is used for diagnostic settings.
All descriptions for inputs and outputs should be scanned and if necessary adapted. Also the name of the parameter should be questioned and if necessary adapted to a more intuitive name.

@rahalan needs more refinement

Moving back to triage and added 'needs further discussion' tag as @rahalan stated that the issue needs further refinement

no open parameters/outputs at the moment

no open parameters/outputs at the moment

authors: MrMCake rahalan

repo: Azure/ResourceModules


text:
[Request for help] Pods can't reach hosts outside cluster

Is this a request for help?:
Request for help
Is this an ISSUE or FEATURE REQUEST? (choose one):

What version of acs-engine?:

Orchestrator and version (e.g. Kubernetes, DC/OS, Swarm)
Kubernetes 1.10.3
What happened:
I am trying to replicate the environment built via acs-engine using  ansible. I use CoreOS as a host OS with updated containerd (1.1), the latest version of the azure-cni plugin and conntrack. Kubernetes cluster works fine, pods get the correct ips from azure-vnet range and are able to communicate within cluster. But when I try to connect to resources outside of the cluster, the pod can't get a response. I've duplicated the kubernetes and azure-cni configuration using acs-engine cluster as an example. Iptables look the same. Can anybody help?
What you expected to happen:
Pods can connect to the world-wide
How to reproduce it (as minimally and precisely as possible):
Anything else we need to know:

@ivanovoleg Can you please check if you have the masquerade rule to snat traffic that is destined for outside Vnet?

@sharmasushant
Here is the iptables and routes configuration:

ACS cluster (Ubuntu)
1.1 . ACS cluster (master):

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:0d:3a:2c:7f:69 brd ff:ff:ff:ff:ff:ff
    inet 10.255.255.5/12 brd 10.255.255.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::20d:3aff:fe2c:7f69/64 scope link
       valid_lft forever preferred_lft forever
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
    link/ether 02:42:89:42:c1:38 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:89ff:fe42:c138/64 scope link
       valid_lft forever preferred_lft forever

default via 10.240.0.1 dev eth0
10.240.0.0/12 dev eth0  proto kernel  scope link  src 10.255.255.5
168.63.129.16 via 10.240.0.1 dev eth0
169.254.169.254 via 10.240.0.1 dev eth0
172.17.0.0/16 dev docker0  proto kernel  scope link  src 172.17.0.1 linkdown

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
KUBE-EXTERNAL-SERVICES  all  --  anywhere             anywhere             ctstate NEW /* kubernetes externally-visible service portals */
KUBE-FIREWALL  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
KUBE-FORWARD  all  --  anywhere             anywhere             /* kubernetes forwarding rules */
DOCKER-ISOLATION  all  --  anywhere             anywhere
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
KUBE-SERVICES  all  --  anywhere             anywhere             ctstate NEW /* kubernetes service portals */
KUBE-FIREWALL  all  --  anywhere             anywhere

Chain DOCKER (1 references)
target     prot opt source               destination

Chain DOCKER-ISOLATION (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Chain KUBE-EXTERNAL-SERVICES (1 references)
target     prot opt source               destination

Chain KUBE-FIREWALL (2 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere             /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000

Chain KUBE-FORWARD (1 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             /* kubernetes forwarding rules */ mark match 0x4000/0x4000
ACCEPT     all  --  10.240.0.0/12        anywhere             /* kubernetes forwarding conntrack pod source rule */ ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             10.240.0.0/12        /* kubernetes forwarding conntrack pod destination rule */ ctstate RELATED,ESTABLISHED

Chain KUBE-SERVICES (1 references)
target     prot opt source               destination

1.2 ACS cluster (agent)
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc mq master azure0 state UP group default qlen 1000
    link/ether 00:0d:3a:2c:7b:f1 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::20d:3aff:fe2c:7bf1/64 scope link
       valid_lft forever preferred_lft forever
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
    link/ether 02:42:1e:7d:ac:c3 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:1eff:fe7d:acc3/64 scope link
       valid_lft forever preferred_lft forever
6: azure0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 00:0d:3a:2c:7b:f1 brd ff:ff:ff:ff:ff:ff
    inet 10.240.0.4/12 scope global azure0
       valid_lft forever preferred_lft forever
    inet6 fe80::20d:3aff:fe2c:7bf1/64 scope link
       valid_lft forever preferred_lft forever
7: azveth78072a3@if8: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master azure0 state UP group default qlen 1000
    link/ether fa:1b:a1:7d:43:07 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::f81b:a1ff:fe7d:4307/64 scope link
       valid_lft forever preferred_lft forever
9: azvethc1b1f0b@if10: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master azure0 state UP group default qlen 1000
    link/ether 22:20:8a:4d:e6:ef brd ff:ff:ff:ff:ff:ff link-netnsid 1
    inet6 fe80::2020:8aff:fe4d:e6ef/64 scope link
       valid_lft forever preferred_lft forever
11: azveth446cf7f@if12: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master azure0 state UP group default qlen 1000
    link/ether 56:fb:a1:97:ef:b2 brd ff:ff:ff:ff:ff:ff link-netnsid 2
    inet6 fe80::54fb:a1ff:fe97:efb2/64 scope link
       valid_lft forever preferred_lft forever
13: azvethf562385@if14: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master azure0 state UP group default qlen 1000
    link/ether 6e:f1:54:db:3b:ce brd ff:ff:ff:ff:ff:ff link-netnsid 3
    inet6 fe80::6cf1:54ff:fedb:3bce/64 scope link
       valid_lft forever preferred_lft forever
15: azveth9e9e1eb@if16: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master azure0 state UP group default qlen 1000
    link/ether fa:2b:d2:75:56:82 brd ff:ff:ff:ff:ff:ff link-netnsid 4
    inet6 fe80::f82b:d2ff:fe75:5682/64 scope link
       valid_lft forever preferred_lft forever
17: azveth0ad1cc1@if18: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master azure0 state UP group default qlen 1000
    link/ether d6:31:a6:ba:16:bd brd ff:ff:ff:ff:ff:ff link-netnsid 5
    inet6 fe80::d431:a6ff:feba:16bd/64 scope link
       valid_lft forever preferred_lft forever

default via 10.240.0.1 dev azure0
10.240.0.0/12 dev azure0  proto kernel  scope link  src 10.240.0.4
172.17.0.0/16 dev docker0  proto kernel  scope link  src 172.17.0.1 linkdown

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
KUBE-EXTERNAL-SERVICES  all  --  anywhere             anywhere             ctstate NEW /* kubernetes externally-visible service portals */
KUBE-FIREWALL  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
KUBE-FORWARD  all  --  anywhere             anywhere             /* kubernetes forwarding rules */
DOCKER-ISOLATION  all  --  anywhere             anywhere
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
KUBE-SERVICES  all  --  anywhere             anywhere             ctstate NEW /* kubernetes service portals */
KUBE-FIREWALL  all  --  anywhere             anywhere

Chain DOCKER (1 references)
target     prot opt source               destination

Chain DOCKER-ISOLATION (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Chain KUBE-EXTERNAL-SERVICES (1 references)
target     prot opt source               destination

Chain KUBE-FIREWALL (2 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere             /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000

Chain KUBE-FORWARD (1 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             /* kubernetes forwarding rules */ mark match 0x4000/0x4000
ACCEPT     all  --  10.240.0.0/12        anywhere             /* kubernetes forwarding conntrack pod source rule */ ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             10.240.0.0/12        /* kubernetes forwarding conntrack pod destination rule */ ctstate RELATED,ESTABLISHED

Chain KUBE-SERVICES (1 references)
target     prot opt source               destination

1.3. ACS cluster (DNS pod)
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
12: eth0@if11: <BROADCAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether 86:cf:1c:e0:df:54 brd ff:ff:ff:ff:ff:ff
    inet 10.240.0.19/12 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::84cf:1cff:fee0:df54/64 scope link
       valid_lft forever preferred_lft forever

default via 10.240.0.1 dev eth0
10.240.0.0/12 dev eth0 scope link  src 10.240.0.19

Kubernetes cluster (CoreOS)
2.1 Kubernetes cluster (master)

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:0d:3a:39:5a:11 brd ff:ff:ff:ff:ff:ff
    inet 10.255.255.5/12 brd 10.255.255.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::20d:3aff:fe39:5a11/64 scope link
       valid_lft forever preferred_lft forever
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:e4:cf:0e:82 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:e4ff:fecf:e82/64 scope link
       valid_lft forever preferred_lft forever
5: veth47697d9@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default
    link/ether 3e:9b:4c:87:cf:8b brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::3c9b:4cff:fe87:cf8b/64 scope link
       valid_lft forever preferred_lft forever

default via 10.240.0.1 dev eth0 proto dhcp metric 1024
10.240.0.0/12 dev eth0 proto kernel scope link src 10.255.255.5
168.63.129.16 via 10.240.0.1 dev eth0 proto dhcp metric 1024
169.254.169.254 via 10.240.0.1 dev eth0 proto dhcp metric 1024
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
KUBE-EXTERNAL-SERVICES  all  --  anywhere             anywhere             ctstate NEW /* kubernetes externally-visible service portals */
KUBE-FIREWALL  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
KUBE-FORWARD  all  --  anywhere             anywhere             /* kubernetes forwarding rules */
DOCKER-USER  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
KUBE-SERVICES  all  --  anywhere             anywhere             ctstate NEW /* kubernetes service portals */
KUBE-FIREWALL  all  --  anywhere             anywhere

Chain DOCKER (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             172.17.0.2           tcp dpt:http

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-USER (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Chain KUBE-EXTERNAL-SERVICES (1 references)
target     prot opt source               destination

Chain KUBE-FIREWALL (2 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere             /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000

Chain KUBE-FORWARD (1 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             /* kubernetes forwarding rules */ mark match 0x4000/0x4000
ACCEPT     all  --  10.240.0.0/12        anywhere             /* kubernetes forwarding conntrack pod source rule */ ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             10.240.0.0/12        /* kubernetes forwarding conntrack pod destination rule */ ctstate RELATED,ESTABLISHED

Chain KUBE-SERVICES (1 references)
target     prot opt source               destination

2.2 Kubenetes cluster (agent)
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc mq master azure0 state UP group default qlen 1000
    link/ether 00:0d:3a:39:54:78 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::20d:3aff:fe39:5478/64 scope link
       valid_lft forever preferred_lft forever
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
    link/ether 02:42:57:09:ca:aa brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
4: azure0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 00:0d:3a:39:54:78 brd ff:ff:ff:ff:ff:ff
    inet 10.240.0.34/12 scope global azure0
       valid_lft forever preferred_lft forever
    inet6 fe80::d006:1dff:fe80:9920/64 scope link
       valid_lft forever preferred_lft forever
5: azv2010ddf0ba5@if6: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master azure0 state UP group default qlen 1000
    link/ether 4e:e4:3b:81:bf:0c brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::4ce4:3bff:fe81:bf0c/64 scope link
       valid_lft forever preferred_lft forever
7: azvb693453cda4@if8: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master azure0 state UP group default qlen 1000
    link/ether da:73:f6:24:e2:5b brd ff:ff:ff:ff:ff:ff link-netnsid 1
    inet6 fe80::d873:f6ff:fe24:e25b/64 scope link
       valid_lft forever preferred_lft forever
9: azve6844c3d520@if10: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master azure0 state UP group default qlen 1000
    link/ether 76:bb:dc:75:55:c7 brd ff:ff:ff:ff:ff:ff link-netnsid 2
    inet6 fe80::74bb:dcff:fe75:55c7/64 scope link
       valid_lft forever preferred_lft forever
11: azvfee51350d48@if12: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master azure0 state UP group default qlen 1000
    link/ether 5e:45:a9:2e:1e:25 brd ff:ff:ff:ff:ff:ff link-netnsid 3
    inet6 fe80::5c45:a9ff:fe2e:1e25/64 scope link
       valid_lft forever preferred_lft forever
13: azv561f374d784@if14: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master azure0 state UP group default qlen 1000
    link/ether aa:e6:cb:78:c9:e5 brd ff:ff:ff:ff:ff:ff link-netnsid 4
    inet6 fe80::a8e6:cbff:fe78:c9e5/64 scope link
       valid_lft forever preferred_lft forever
17: azva09e9d53bff@if18: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master azure0 state UP group default qlen 1000
    link/ether 1a:bc:00:38:25:42 brd ff:ff:ff:ff:ff:ff link-netnsid 6
    inet6 fe80::18bc:ff:fe38:2542/64 scope link
       valid_lft forever preferred_lft forever
19: azv77902ee09aa@if20: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master azure0 state UP group default qlen 1000
    link/ether 36:40:4a:e9:74:21 brd ff:ff:ff:ff:ff:ff link-netnsid 5
    inet6 fe80::3440:4aff:fee9:7421/64 scope link
       valid_lft forever preferred_lft forever

default via 10.240.0.1 dev azure0 proto dhcp metric 1024
10.240.0.0/12 dev azure0 proto kernel scope link src 10.240.0.34
168.63.129.16 via 10.240.0.1 dev azure0 proto dhcp metric 1024
169.254.169.254 via 10.240.0.1 dev azure0 proto dhcp metric 1024
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
KUBE-EXTERNAL-SERVICES  all  --  anywhere             anywhere             ctstate NEW /* kubernetes externally-visible service portals */
KUBE-FIREWALL  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
KUBE-FORWARD  all  --  anywhere             anywhere             /* kubernetes forwarding rules */
DOCKER-USER  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
KUBE-SERVICES  all  --  anywhere             anywhere             ctstate NEW /* kubernetes service portals */
KUBE-FIREWALL  all  --  anywhere             anywhere

Chain DOCKER (1 references)
target     prot opt source               destination

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-USER (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Chain KUBE-EXTERNAL-SERVICES (1 references)
target     prot opt source               destination

Chain KUBE-FIREWALL (2 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere             /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000

Chain KUBE-FORWARD (1 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             /* kubernetes forwarding rules */ mark match 0x4000/0x4000
ACCEPT     all  --  10.240.0.0/12        anywhere             /* kubernetes forwarding conntrack pod source rule */ ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             10.240.0.0/12        /* kubernetes forwarding conntrack pod destination rule */ ctstate RELATED,ESTABLISHED

Chain KUBE-SERVICES (1 references)
target     prot opt source               destination

2.3 Kubernetes cluster (DNS pod)
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
6: eth0@if5: <BROADCAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether 6a:b0:ea:c1:fc:e8 brd ff:ff:ff:ff:ff:ff
    inet 10.240.0.49/12 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::68b0:eaff:fec1:fce8/64 scope link
       valid_lft forever preferred_lft forever

default via 10.240.0.1 dev eth0
10.240.0.0/12 dev eth0 scope link  src 10.240.0.49

@IvanovOleg This is because not every ip-address in the Vnet get a default snat IP for internet bound traffic. Only the primary ip of the VM interface gets it.

@sharmasushant I don't see this kind of rule in the acs-engine cluster I use as an example. Or maybe I look in the wrong place...

@IvanovOleg I am not sure why your cluster does not have the rule. Are you using Azure CNI when you deployed via acs-engine?
The rule appears in the POSTROUTING chain of nat table on the cluster that I created
MASQUERADE  all  --  anywhere            !10.0.0.0/8           destination IP range ! 168.63.129.16-168.63.129.16 ADDRTYPE match dst-type !LOCAL
10.0.0.0/8 is my Vnet address space
Here is the command to add the rule
iptables -t nat -A POSTROUTING -m iprange ! --dst-range 168.63.129.16 -m addrtype ! --dst-type local ! -d '<vnet-address-space>' -j MASQUERADE

@sharmasushant Yes, I've deployed that cluster using acs-engine 0.17.1 with the next config:
{
  "apiVersion": "vlabs",
  "properties": {
    "orchestratorProfile": {
      "orchestratorType": "Kubernetes",
      "orchestratorVersion": "1.10.3",
      "kubernetesConfig": {
        "networkPolicy": "azure",
        "enableRbac": true,
        "apiServerConfig": {
          "--admission-control": "NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,DenyEscalatingExec,AlwaysPullImages"
        }
      }
    },
    "masterProfile": {
      "count": 1,
      "dnsPrefix": "xxxxxxx",
      "vmSize": "Standard_D2_v2",
      "storageProfile" : "ManagedDisks"
    },
    "agentPoolProfiles": [
      {
        "name": "agentpool1",
        "count": 1,
        "vmSize": "Standard_DS2_v2",
        "availabilityProfile": "AvailabilitySet",
        "storageProfile" : "ManagedDisks"
      }
    ],
    "linuxProfile": {
      "adminUsername": "xxxxx",
      "ssh": {
        "publicKeys": [
          {
            "keyData": ""
          }
        ]
      }
    },
    "servicePrincipalProfile": {
      "clientId": "",
      "secret": ""
    }
  }
}

@sharmasushant Yes, this rule helps. Thanks!

authors: IvanovOleg sharmasushant

repo: Azure/acs-engine

license: mit

license_source: bigquery


text:
Rob bagby extension support

What this PR does / why we need it:
This enables custom extensions that can be shared with other devs.
Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #
#599
This is just a restart on this pr
#687

This change is

So there has been a change in kubernetes provision script that isn't compatiable with this design. I'm going to be closing this until I can adjust the design for the new changes.


text:
How to support multiple AppGws with a single AKS cluster and single AGIC?

I'm in the process of transitioning our application from ASE to AKS on Azure. In the current setup, we have two application gateways with mirrored configuration, running in active-active mode and we load balance between them at DNS. We've found that this redundant setup has helped to keep our application available numerous times over the last few months and therefore it is required that we keep this once we transition to AKS.
I've been trying to find out whether a setup with a single ingress controller and backend pool could work with multiple application gateways. From what I can see, this is not currently possible. https://github.com/Azure/application-gateway-kubernetes-ingress/issues/732 and https://docs.microsoft.com/en-us/azure/application-gateway/ingress-controller-overview#helm-deployed-agic-single-aks-cluster suggest that if I wanted to run with multiple app gateways, that would require setting up a dedicated AGIC for each of them and furthermore, each AGIC would only be able to watch resources in a specified namespace. Therefore, the setup would have to look like this:
AppGw1 --> AGIC1 --> Namespace1 --> [App1-1, App1-2, ...]
AppGw2 --> AGIC2 --> Namespace2 --> [App2-1, App2-2, ...]
As a result, in case of a failure of one of the app gateways we also lose all the associated backend resources.
What would work better, would be either:
AppGw1 --> AGIC1 --> [App1-1, App1-2, App2-1, App2-2, ...]
AppGw2 --> AGIC2 --> [App1-1, App1-2, App2-1, App2-2, ...]
or even better:
AppGw1 --> AGIC --> [App1-1, App1-2, App2-1, App2-2, ...]
AppGw2 --> AGIC --> [App1-1, App1-2, App2-1, App2-2, ...]
in which the entire backend pool is shared across app gateways.
Can you please clarify whether such setup is currently possible or not? If not ready yet, do you know when it may be coming - https://docs.microsoft.com/en-us/azure/application-gateway/ingress-controller-overview#helm-deployed-agic-single-aks-cluster suggests that this feature is in the backlog.

Hi @michaelsiuda , currently, one AGIC can be mapped to only one AppGw.
However, there is a feature(which is Beta, feel free to report any defect) to support to run different AGICs for resources within same namespace, check the feature out.
The feature allows you to configure ingress to be used by a specific ingress controller. which I guess it's the 2nd use case you pointed out.

Hi @3quanfeng,
Thank you for your reply. Apologies, I think I didn't clearly describe the use case I have in mind and the feature you've linked doesn't meet my requirements.
What I'm thinking about is more like mirroring of configuration by one AGIC instance across multiple application gateways, rather running multiple AGIC instances, each of them with their own set of backend pods.
The main reason behind it is handling application gateway failures:

with mirrored configuration, backend pool is shared across app gateways, and therefore failure of an app gateway does not affect the capability of the backend to handle user load
with separate AGIC instances, the backend pool is split between gateways and therefore app gateway's failure effectively removes x% of backend capability to handle user load

I hope I've made the use case clearer. Please let me know your thoughts.

If i create additional agic in the different name space it throws an error
Error: rendered manifests contain a resource that already exists. Unable to continue with install: IngressClass "azure-application-gateway" in namespace "" exists and cannot be imported into the current release.

Hello @isaacdan, you need to override the default values using the following:
kubernetes:
    ingressClassResource:
        name: application-gateway-foobar
        controllerValue: "azure/application-gateway-foobar"

Took me a while to figure this out until I downloaded the chart using helm pull ingress-agic/ingress-azure and browsed the values.yaml file.
Note: you may want to set a value for kubernetes.watchNamespace for both AGICs.


text:
Can't assign port fp-443 to Private IP Listener already assigned to Public IP Listener

Describe the bug
A clear and concise description of what the bug is.
I have Ingress resources on a AKS cluster which needs using PrivateIp or PublicIp as their front end IP. I have configured one Ingress using public IP, which was fine, however, when using private IP annotation (appgw.ingress.kubernetes.io/use-private-ip: "true") in another Ingress resource, I am getting the bellow error on AGIC:
E0715 15:13:23.665442       1 frontend_listeners.go:46] Can't assign port fp-443 to Private IP Listener fl-d84d98ab259764775ce8700847d97b66; already assigned to Public IP Listener fl-4db314dd864524bfe3bbc9786686cce0; Will not create listener {FrontendPort:443 HostNames:[ myapp-private.mydomain.com   ] UsePrivateIP:true} E0715 15:13:23.665476       1 frontend_listeners.go:46] Can't assign port port_80 to Private IP Listener fl-7ad98dd3ce13c2997644bffc6708100d; already assigned to Public IP Listener fl-658b918ffa5ca2a4cab5e0d72e383d46; Will not create listener {FrontendPort:80 HostNames:[ myapp-private.mydomain.com  ] UsePrivateIP:true}
And it did not assign any Listeners on Private IP.
Please advise is this possible using Public and Private frontend IP at the same time for same ports on one AppGW?
Ingress1
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: aspnetapp
namespace: ns1
annotations:
kubernetes.io/ingress.class: azure/application-gateway
appgw.ingress.kubernetes.io/appgw-ssl-certificate: rbccert
appgw.ingress.kubernetes.io/ssl-redirect: "true"
appgw.ingress.kubernetes.io/use-private-ip: "true"
spec:
rules:

host: myapp-private.mydomain.com
http:
paths:

path: /
backend:
serviceName: aspnetapp
servicePort: 80

Ingress2
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: kyvos-network-utility
namespace: kyvos-network-utility
annotations:
kubernetes.io/ingress.class: azure/application-gateway
appgw.ingress.kubernetes.io/appgw-ssl-certificate: rbccert
appgw.ingress.kubernetes.io/ssl-redirect: "true"
spec:
rules:

host: myapp.mydomain.com
http:
paths:

backend:
serviceName: myapp
servicePort: 80
path: /

AGIC version: 1.2.0-rc2
AppGW: WAF V2
To Reproduce
Steps to reproduce the behavior:
Ingress Controller details

Output of kubectl describe pod <ingress controller> . The  pod name can be obtained by running helm list.
Output of `kubectl logs .
Any Azure support tickets associated with this issue.

Hi @mhsh64 , correct, right now AGIC doesn't support multiple IPs on the same port.

@3quanfeng
Thanks
So at the moment if we want to configure this, we will need two AppGw and two AGIC on the cluster with enabling watch separate namespaces?

@3quanfeng
Sorry again, it will be very hard and maybe not beneficial to deploy two appGw ( and two AGIC) , one for internal and one for public ingress.
However, if this is the only solution for now, is there any document you can please refer me to deploy two AGIC on a same AKS cluster?
I wish we were able to have one appGw for using both public and private frontend IPs.
Thanks

Hi @mhsh64 , AGIC support for the feature is definitely on our roadmap, but we don't have ETA for it given appgw itself doesn't support it now.
To deploy two AGICs within one AKS cluster but watching on different namespaces, you will need two appgws, and to map one AGIC to one AppGw, you will need to configure in the AGIC helm values.yaml to have the right match. make sure you have
kubernetes:
Namespace(s) AGIC watches; Leaving this blank watches all namespaces;
Accepts one or many comma-separated values
watchNamespace:
appgw:
environment: AZUREPUBLICCLOUD
subscriptionId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
resourceGroup: myResourceGroup
name: myApplicationGateway
# Whether to force private IP for all the listeners on Application Gateway
usePrivateIP: false

@3quanfeng
Thanks
I deployed two appGws with two AGIC, however it will be really hard to manage, since for each new namespace we have to add them in watched list in AGIC cm.
Isn’t there anyway to make this more usable?

Hi @mhsh64 ,
In the next release version(including rc), AGIC will support to delegate two ingress resources in the same namespace to two different controllers.

@3quanfeng Thank you
Looking forward to it ☺

This would be great!

Are there some timelines available when we can expect this feature ?  Thanks.

@catay the merge request has been already included to support his. however I'm also waiting the release that includes this merge...

Hi @mhsh64 , AGIC support for the feature is definitely on our roadmap, but we don't have ETA for it given appgw itself doesn't support it now.
To deploy two AGICs within one AKS cluster but watching on different namespaces, you will need two appgws, and to map one AGIC to one AppGw, you will need to configure in the AGIC helm values.yaml to have the right match. make sure you have
`kubernetes:
watchNamespace:
appgw:
environment: AZUREPUBLICCLOUD
subscriptionId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
resourceGroup: myResourceGroup
name: myApplicationGateway
usePrivateIP: false`

@3quanfeng I'd like to ask you about the Azure support for creating two AGIC in the same namespace now?
I want to deploy two AGICs within one AKS cluster but watching on same namespaces, not the different namespaces, to resolve this problem of "Can't assign port fp-443 to Private IP Listener already assigned to Public IP Listener".
Looking forward to your answer, thanks!

@3quanfeng do you know when the merge will be released (cfr. @schlickspringer's message)

@3quanfeng @mscatyao
the AppGW doc states :
Can I use the same port for both public-facing and private-facing listeners?
No.
The AGIC doc explains how to use a Private IP, but not how to manage the “public+private” use case and to how to configures different ports for public+private IP  , could you please add in the docs if this scenario is supported or not ?

Hi @ezYakaEagle442 , there is a note  indicating that "App Gateway doesn't support multiple IPs on the same port"

@3quanfeng thanks foryou reply, but this does not answer the question :  how to manage the “public+private” use case with AGIC and to how to configures different ports for public+private IP with AGIC.
This is not explained in the docs and the ARM template does not manage that neither

Is there any place where we can track the status of this roadmap item?

Is there any place where we can track the status of this roadmap item?

Hi, I'm also interested in either the general availability of "multiple ips on same port in app gateway" or anything that makes configuring two app gateways as a workaround easier.
Does anyone know when any of this is going to be available? @3quanfeng maybe?
Thank you in advance!

I am also very keen on a resolution or instructions on a workaround. I would like to avoid moving to another ingress controller.

@picardsrcd, @Phrow you can check the latest release. I was able to get it working with public/private IP (different ports).

@picardsrcd, @Phrow you can check the latest release. I was able to get it working with public/private IP (different ports).
Do you have a sample configuration? I am using the AGIC AKS addon on a AKS 1.19.7 cluster.

Private Example:
apiVersion: v1
kind: Pod
metadata:
  name: aspnetapp-priv
  labels:
    app: aspnetapp-priv
spec:
  containers:
  - image: "mcr.microsoft.com/dotnet/core/samples:aspnetapp"
    name: aspnetapp-image
    ports:
    - containerPort: 80
      protocol: TCP

---

apiVersion: v1
kind: Service
metadata:
  name: aspnetapp-priv
  labels:
    app: aspnetapp-priv
  # annotations:
  #   service.beta.kubernetes.io/azure-load-balancer-internal: "true"
spec:
  selector:
    app: aspnetapp-priv
  # type: LoadBalancer
  ports:
  - protocol: TCP
    port: 8080
    targetPort: 80

---

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: aspnetapp-priv
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
    # appgw.ingress.kubernetes.io/backend-protocol: http
    appgw.ingress.kubernetes.io/use-private-ip: "true"
    appgw.ingress.kubernetes.io/backend-path-prefix: "/"
    appgw.ingress.kubernetes.io/override-frontend-port: "8080"
spec:
  rules:
  - http:
      paths:
      - path: "/private/asp/*"
        backend:
          serviceName: aspnetapp-priv
          servicePort: 8080

Public Example:
apiVersion: v1
kind: Pod
metadata:
  name: aspnetapp-auth
  labels:
    app: aspnetapp-auth
spec:
  containers:
  - image: "mcr.microsoft.com/dotnet/core/samples:aspnetapp"
    name: aspnetapp-image
    ports:
    - containerPort: 80
      protocol: TCP

---

apiVersion: v1
kind: Service
metadata:
  name: aspnetapp-auth
spec:
  selector:
    app: aspnetapp-auth
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80

---

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: aspnetapp-auth
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
    appgw.ingress.kubernetes.io/backend-protocol: http
    appgw.ingress.kubernetes.io/backend-path-prefix: "/"
spec:
  rules:
  - http:
      paths:
      - path: /auth/* # The asterix is required to have rewriting work
        backend:
          serviceName: aspnetapp-auth
          servicePort: 80

@picardsrcd, @Phrow you can check the latest release. I was able to get it working with public/private IP (different ports).

But this whole thread is about using the same port on public and private IP at the same time, no? Different ports should've always worked.

Is there no support for public and private IP using the same port at the same time yet?

We're actively working on allowing the same port to be used with the public and private IP. We'll update the thread as we continue to make progress on this capability.

Any update on this functionality?

Bump - Curious if there are any updates on this?

This limitation is quite strange, seems there should be no technical reason for it not to work, but thanks for looking into it @mscatyao

This is a limitation on AppGW that we're still working on. I've added this feature request to the roadmap as "In Progress".

Do you ETA on preview @mscatyao?

Thanks @JackStromberg. Just wanted to add a +1 to this feature request.

Is there any progress on this one other than the item beeing on the roadmap (it took ~15 months after reporting this issue to land there). Now ~7 months later the only information is that we get future updates anytime this year. Will it be done this year? Will we be able to use AGIC for private and public listeners on the same port? It is just a huge amount of work to work around this problem and deploy a second ingress (and then if it is solved at some point migrate everything). Any kind of ETA would be incredibly helpful in our planning of the production cluster.
Don't understand me wrong. I am very thankful for your hard work and I am sure that this issue is not the only thing you are working on. I am just asking for a bit more transparency if possible. Thank you.

Hey @kamekazemaster, appreciate you reaching out.
We hear the community loud and agree with the value on bringing this feature to light. I know it has been a long journey and while I cannot bring an exact ETA yet, there has been movement on this internally.  I won't have an update for another 1-2months, but we will provide more details on the status of this thereafter.
I apologize I cannot provide more details at this time, but we really do appreciate the patience and are looking forward to making the feature available to all customers.
Thank you,
Jack

+1 for having the possibility to use the same port on private and public listeners.
We are in the middle of a huge deployment and we stumbled on this.
For the time being we will use AppGateway only for public endpoints, but this limitation is quite strong for us and we'd really need to solve this quickly... otherwise we'll have to fall back to competitor services

i am in the process of migrating to AGIC, this is a showstopper any updates or time estimates.

i am in the process of migrating to AGIC, this is a real blocker.

update i installed nginx ingress controller using it for the internal traffic, continuing testing agic for external traffic.

@JackStromberg, have there been any developments on this since May?

Hey Team,
Apologies for the delay an a much overdue update.  We have made some more progress internally, but unfortunately don't have a release announcement to make quite yet.  I can absolutely confirm this is on our radar and are actively working to unblock this.  I will update this once we have more news to share -- please continue to hold us accountable and feel free to keep on "@ing" me.
Thank you for your patience,
Jack

@JackStromberg, have there been any developments on this since Sep?

Hey @emibcn,
Yes, we are invested in bringing this feature forward and have made progress internally.  We will be able to share a more detailed update near end of next month.
Appreciate the patience; we understand the importance of getting this unblocked.
Happy new year!
Jack

@JackStromberg, Have there been any developments on the availability of this feature?

I think the product team just enabled this feature as I was able to enable port 443 on both private and public IPs today.... really a great step forward product team!!! way to go!

@reza8iucs in which region?  I am unable to do so in Central US.

Hey Folks,
We will provide an official update in the next two weeks to explain the behavior you are seeing :)
Appreciate your patience on this.
Jack

@kengibous  I am in Canada Central and they must have enabled this in the past few days because I tried it last week and it didn't work.Right now, I'm successfully listening to traffic on port 443 on my private and public IP. All tested and works like a chime!

@reza8i - thanks for providing that, still no luck in Central US.  @JackStromberg is this not available in all regions as of yet?  Looking forward to the official update.

This feature is not officially released yet. Please do not assume it should be available in all regions.  We will provide another update this month.
Jack

@JackStromberg, do you have an update?

@JackStromberg, do you have an update?

Previous statement still stands. We will provide an update later this month.
Jack

Hey folks,
We appreciate your patience on this.  As you can tell, this feature is in the process of its release, targeting completion early March.  There are some changes that are still rolling out, so we do recommend holding off from attempting configuration prior to official release.  We will post a service announcement once this functionality is ready here: https://azure.microsoft.com/updates/
I will update this issue with a link to the announcement once available and we can close this one out.
Thank you,
Jack

any updates on this?

Hey Team,
We are introducing an additional improvement related to the feature configuration and so the broader Azure Updates communication has been delayed this month. The documentation for the feature is out and you can begin to use this directly on Application Gateway via Portal, CLI, PS, Terraform, etc today. Please take note of the NSG rule requirements (if the subnet uses NSG) as creating same port for public and private listeners changes the incoming flow for all the listeners.
https://learn.microsoft.com/azure/application-gateway/configuration-listeners#frontend-port
Feel free to try this out, looking forward to hearing how it goes!
Thank you,
Jack

@JackStromberg I am still getting the same issue as others in this post. However, this is erratic.
I have had Public and Private HTTPS working during development.
However, this morning all Private services have failed when I tried to deploy a new API Service.
frontend_listeners.go:46] Can't assign port fp-443 to Private IP Listener fl-19f2f2235084a56da17a1948bc9c0801; already assigned to Public IP Listener fl-4894b96811cb1cfa9b7a55e34cc4e3ce;
Will not create listener {FrontendPort:443 HostNames:[fmg-tester.fluent-uat-services.private    ] UsePrivateIP:true}

Do I need to update the Cluster/Ingress?
managed-by-k8s-ingress": "1.5.3/94b2b229/2023-02-03-21:42T+0000
Aks Version: 1.24.6

Hey Team,
Yes, there is a check in AGIC today on the same port.  I apologize I was not clear; the changes have been made available for Application Gateway and can begin to be used as-is today.  In parallel, we have been working on publishing v1.7 stable for both helm and add-on (helm already available); the changes for same port public/private listener in AGIC will be made available in the next release.
Thank you for your patience,
Jack

Hey folks!
Appreciated all the patience on this.  We are pleased to announce this is now available in AGIC v1.7.1, which can be deployed via helm today.  https://github.com/Azure/application-gateway-kubernetes-ingress/releases/tag/1.7.1
Cheers!
Jack

authors: 3quanfeng JackStromberg Phrow TrotmanRalph aelmanaa angelbulas antoineozenne ashwinpagarkhed beetel catay emibcn ezYakaEagle442 gpltaylor guerillamos guyta-essence hieumoscow kamekazemaster kengibous matt961 mhsh64 montyplattner mscatyao n3wt0n picardsrcd qinshuang1998 reza8i reza8iucs sbkg0002 schlickspringer


text:
DeploymentTemplate-schema-is-correct test does not check schema property of nested templates

e.g.
{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "resources": [
      {
        "apiVersion": "2020-06-01",
        "name": "nested",
        "type": "Microsoft.Resources/deployments",
        "properties": {
          "mode": "Incremental",
          "template": {
            "$schema": "https://schema.management.azure.com/schemas/2010-01-01/deploymentTemplate.json#",
            "contentVersion": "1.0.0.0",
            "resources": [
            ]
          }
        }
      }
    ]
  }

Another case where a recursive approach would catch the instance "for free" - but is independent of expressionEvaluationOptions

@StartAutomating  We may have this, but we need unit tests for inner/outer nested deployments

👍

authors: StartAutomating bmoore-msft

repo: Azure/arm-ttk