text:
overviewmap style interaction

Expected behavior
I want to have a different behavior between the map and overviewmap. When i selected feature on map, this one highlighting into green on map whereas in overviewmap, into yellow.
	 							var overviewMapControl = new ol.control.OverviewMap({ 							  // see in overviewmap-custom.html to see the custom CSS used 							  className: 'ol-overviewmap', 							  layers: [ 								ctxt 								], 								  collapseLabel: '\u00BB', 								  label: '\u00AB', 								  collapsed: false, 								}); 							var highlightStyle = new ol.style.Style({ 								  fill: new ol.style.Fill({ 									color: 'rgba(255,255,255,0.7)', 								  }), 								  stroke: new ol.style.Stroke({ 									color: '#fa7a3e', 									width: 4, 								  }), 								}); 							var map = new ol.Map({ 								target: 'map', 								layers: [ 									stamen, orthophoto, ign, ctxt, cdppx, cdaff,ouvr,clc,geo 								], 								view: view, 								});  						                                                          var click_ctxt = new ol.interaction.Select({ 							  condition: ol.events.condition.click, 							  layers: [ctxt], 							  style: highlightStyle 							}); 							map.addInteraction(click_ctxt);

Which version are you using?  It can be done with a style function in OpenLayer 6 https://codesandbox.io/s/select-features-forked-hun8r

repo: openlayers/openlayers


text:
openlayer 6.x version is causing error

hello
I got an error when I upgraded my code from v5.3.0 to 6.x
When adding a custom map using TileImage, everything works fine with v5.3.0 version of openlayer, but when I update to the latest version 6.x and above everything is different. When zooming the map, the layer keeps shifting in the vertical direction. I found that the value of the first parameter tileCoord of the tileUrlFunction function is not the same as that of v5.3.0, but when I change this value it is the same as that of v5.3.0. The map is not striving to be correct.
Do you have any good suggestions?
Here is a screenshot of v5.3.0

Below is the code
百度地图2.zip

Please see the v6.0.0 release notes. The section "New internal tile coordinates" explains the changes you need to make in your code.

source: gharchive/issue

license_type: permissive

license_source: github-api


text:
Raster Reprojection causes black lines in latest build

Just noticed after upgraded our application to latest build that the reprojected layers are causing black lines.
It can also be seen in the official example: https://openlayers.org/en/master/examples/reprojection.html
Our users has not reported it before we upgraded, but I do not know at what release it was added. We upgraded from 3.16 to latest.
btw, what happened with ol3 group on google groups?

It can also be seen in the official example: https://openlayers.org/en/master/examples/reprojection.html

Are you observing this in Chrome only? What you are seeing is probably related to #4123 and the fact that the issue mentioned there was "fixed" in Chrome. So this is not because of an OpenLayers update, but because of a Chrome update.

btw, what happened with ol3 group on google groups?

It has been renamed to openlayers-dev@googlegroups.com. See https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!msg/openlayers-dev/CS1RZnIBLnE/EALCP5DPDwAJ. However, note that group is not for usage questions anyway.

Thanks for finding the other issue, didnt find it by googling.
Yes, i see it in chrome. I will close and continue my questions in the other issue.

Pull request created: #6344.

Awesome stuff :) I will buy you a beer if you visit copenhagen.

It seems that this is not completely resoved. I use Zoomify as a source and I still see the gray lines for the non-square tiles the layer (For normal, i.e. square tiles it's no longer an issue)
You can see it here http://jsfiddle.net/sk5cLj4n/42/
And also the screenshot: https://screenpresso.com/=z5ANc

authors: ahocevar hajjimurad pksorensen


text:
Layer constructor options missing zIndex

[x] I have searched GitHub to see if a similar bug or feature request has already been reported.
[x] If reporting a bug, I have tried with the latest version of OpenLayers (see 'LATEST' on https://openlayers.org/)

Layer classes that inherit from ol.layer.Layer don't have zIndex documented even though it seems like they all inherit from olx.layer.LayerOptions.

The following typedefs are missing the zIndex documentation:

olx.layer.HeatmapOptions
olx.layer.ImageOptions
olx.layer.TileOptions
olx.layer.VectorOptions
olx.layer.VectorTileOptions

Looks like map is missing in olx.layer.HeatmapOptions

authors: fredj icholy


text:
Polygon vertices with count label

Is your feature request related to a problem? Please describe.
I want to make a style that takes the geometry vertices (edges) and put a counter label on each vertice like 1, 2, 3 ... (like in the photo). I tried looking for a solution but i can't find any. Can someone help me to find a solution

Describe the solution you'd like
Somewhere in the geometry function in the style be able to set a label or iterate over the features and add a text base on the lenght

https://codesandbox.io/s/polygonstyles-ow5sy

Thanks, the solution its perfect. I almost got to a solution similar, but didn't workout like expected. Thanks again! @mike-000


text:
Upgrade dependencies

Except rollup because I think that requires some changes.

Hi, @bjornharrtell.  I'm curious on the motivation for this change (not that it is unreasonable, just wanted to understand the motivation).
We use dependabot to update dependencies.  Where we use "caret" dependency ranges, this generally means that dependabot updates our lockfile but doesn't bump the version in the package.json file for minor and patch releases (example #14633, counter-example #14632).  We aren't entirely consistent about where we use caret vs pegged dependencies.
The potential benefit of having our package.json reflect the minimum version that we depend on is that it provides more potential for deduplication (in cases where packages that depend on us also depend on a version of a dependency that is lower than the version in our package.json).

@tschaub not much more than scratching an itch. I agree with your arguments, especially for a library. I was worried openlayers was lagging behind dependencies but then it's really only rollup that might be worth spending some time upgrading to? I also had a look at geotiff.js which does seem in more need of getting a fair amount of dependencies upgraded.

source: gharchive/pull-request

authors: bjornharrtell tschaub


text:
Add coalesce operator to expressions

This adds a new operator to expressions - "coalesce", which takes 2 or more arguments, and returns the value of the first argument that is not null or undefined.
This is intended to be a solution which resolves #15490 , effectively providing a way of giving a default value for the event that a property value requested with the "get" operator does not exist for a feature.

Thanks for the proposed contribution, @slippyr4.  You may have seen this already, but there are string and number assertion operators that return the first argument that evaluates to one of those types.  These are not yet implemented for WebGL and look to be lacking in the documentation.
It still probably makes sense to add coalesce, but if you know the type of the expected value, then a more specific assertion operator is likely a better choice.

It still probably makes sense to add coalesce, but if you know the type of the expected value, then a more specific assertion operator is likely a better choice.

Actually i'd not appreciated that the number and string operators worked like that, it's helpful. However for my usage the coalesce operator i've authored is more useful.

Thank you for this nice contribution, @slippyr4.  I hope the comments above sound ok.  We can keep making changes if not.

thanks for merging.


text:
Map index documentation

Brief explanation of the name:value and the has_key:name
entries which are now possible in 5.1.

--no-rebase

Looks fine to me!

But for this to be really true, the LuceneQueryBuilder has to be modified to not remove the ':' in the search expressions. I'm just about to open a PR for that.

authors: dominikl hflynn joshmoore

repo: openmicroscopy/ome-documentation


text:
OME Data model: development process

See https://trello.com/c/0zNp8HvU/167-enumerations-addition
In preparation of the amendment of these instructions for minor schema release, this PR migrates the existing internal documentation to the public contributing documentation. A few edits have been added on top of the initial commit to better fit the documentation set and match the existing release process.
/cc @mtbc @hflynn

Staging building now

Staged at http://www.openmicroscopy.org/site/support/contributing-staging/data-model-schema.html
Probably worth adding a link to the Model docs - http://www.openmicroscopy.org/site/support/ome-model/developers/index.html#ome-model-development-process seems an obvious place (there's already a general link there but we could be more specific now)

Looks fine to me, I leave @mtbc to comment on the technicalities.

Looks like the content is preserved excellently, thank you for this work. I don't mind if updating happens in later PRs.

Thank you, good to merge.

Document reads well and steps all look correct, links all appear to be working and cant find any further references to internal details. Looks good to merge from me too.

I'll merge and release and then open a quick PR to add the link to the Model docs as mentioned above - thanks all

authors: dgault hflynn mtbc sbesson


text:
ValidationError and str()

Right now there are several functions which call parse_hostgroup_management_error and parse_group_management_error to raise a ValidationError when a (host)group can't be modified for some reason.
These parsing functions set up an exception but they make the message a dict instead of a str.
So the exception that gets shown is rather unhelpful: python_freeipa.exceptions.ValidationError: <unprintable ValidationError object>
and when the exception gets printed (or converted to str for displaying elsewhere), another exception gets raised: TypeError: __str__ returned non-string (type dict).
I'm happy to send a PR to fix this, but I'm not sure of the best way forward, there are a few options:

We can just have FreeIPAError#__str__ call str before it returns. Then when a ValidationError gets thrown, the message that gets shown is the raw dict which is ugly but probably better than what happens right now. It also affords backwards compatibility and shouldn't break people who have worked around this issue already.
We can have the parsing functions parse out the string(s) that contain(s) the actual error(s), which I think might have been the original intent here, but this gets gnarly when dealing with the case where multiple errors are returned at the same time:

# omitted: some hacks to dump out the dict
>>> client.group_add_member('cool-people', ['relrod', 'asdfasdf'])
python_freeipa.exceptions.ValidationError: {'member': {'user': [['relrod', 'This entry is already a member'], ['asdfasdf', 'no matching entry found']], 'group': [], 'service': []}}

We can keep things as-is and tell users to just catch the exception and accept that #message is a dict and that the stack trace itself will never show a meaningful error from IPA until the user calls #message and processes the dict themselves.

... other ideas here ...

Thoughts?

What about making https://github.com/opennode/python-freeipa/blob/6587b076f00e192408d97ce5843de4e32d92879c/src/python_freeipa/exceptions.py#L16 a bit smarter and let it handle dicts as well?
I don't have strong opinions about the fix, apart from it being backward compatible.

@relrod This is a valid point. Here's a commit to fix this issue: https://github.com/opennode/python-freeipa/commit/0fc1dacb7dcd10d3df8df9e0a25d415ce7c96e46

It is interesting to note, however, that FreeIPA server supports partial execution of a request. For example, in this particular case it tries to add users to the group, even if there are no such users or if they are already added to the group. Therefore it does not consider this request as an invalid and does not return error message in standard format.

See also another commit to address this issue: https://github.com/opennode/python-freeipa/commit/e150933954705bde4f4d6640287af73859fa8349

As a conclusion, message can be either string or dict. Therefore, users are expected to parse it to get more details.

@AmbientLighter Fair enough! Thanks for the quick fixes! I'll very likely be sending some PRs to add group-member-manager functions. This is a new feature in IPA that lets select members ("managers") of a group have permissions to add/remove people from groups they manage -- this is something I need in a project I'm working on, but for now I'm calling _request and manually setting up the calls.

authors: AmbientLighter livenson relrod

repo: opennode/python-freeipa

license: MIT


text:
user：显示问题

1：应用信息
2：交付方式，没有显示出来
3：部署的是5.6，显示的是0.3，进去以后，也没有版本号信息，会让用户认为部署错了

Cluster相关的页面今天已经个性了，第一张截图中的版本信息先前取的是app中的信息，今天加了查询对应version信息了。代码请参见PR

最后一张截图是因为查询cluster详情，没加with_detail = true, 这个后来后端叫加上了。现在有数据了。

authors: wangxhsoft whDongRui

repo: openpitrix/dashboard


text:
error: 服务器不允许请求未公开的对象 60209eb1ccc34d5deefb002d1b7f37545204f7f2 获取了子模组路径 'third_party/bloaty'，但是它没有包含 60209eb1ccc34d5deefb002d1b7f37545204f7f2。直接获取该提交失败。

Please follow issue template.  It looks like git network or git version problem. We require git version >= 2.7.0

authors: Vincent-syr williamZQ


text:
GQ signature support

Currently, an OpenPubkey token contains the original signature from the OIDC provider. This arguably means that it isn't safe to share the OpenPubkey token, as the token could be used to impersonate the subject to a service that doesn't check the audience claim, or to trick an OpenPubkey client to issue a token for the subject.
We can create a GQ signature to prove that we have the original OIDC provider's signature. This can be verified using the original OIDC signing payload (header || '.' || payload) and the OIDC provider's public key. This works because GQ signature private keys are equivalent to RSA signatures.
The GQ signature can be published in place of the OIDC provider's signature in an OpenPubkey token.

[x] #8
[x] #10
[x] #9

@jonnystoten considering using OpenPubKey in a project and want to make sure I understand the security implications here. Providing the original ID token to potentially untrusted parties is only dangerous if there exists a vulnerability in some other system, right?
For example, if there's an app out there where the frontend does a Google OIDC flow, then hands the ID token to the backend in order to create a session, a leaked OpenPubKey ID token could be used to log in to that app?
So assuming apps properly check aud, this shouldn't be an issue?

@anderspitman that's right, and that wouldn't be without precedent (e.g. https://github.com/dgrijalva/jwt-go/issues/422). Even if they're just bugs in the app though, this protects against them.

Awesome, thanks!

Yep, what @kipz said. For completeness, also note that this issue is resolved with the support for GQ signatures, see

#3
#14

Yeah I hadn't heard of GQ signatures but they look very interesting. Unfortunately I don't think OpenPubKey will work for my use case. I was hoping to build a generic authn system where you could sign in to an app once with any OIDC provider, using OPK, then send that ID token (maybe with a GQ sig) along with requests to other servers, with the requests signed with DPoP. The other servers know that you have a key pair certified to be controlled by the OIDC user.
The problem is that you're essentially giving such an app permissions to be you on any backend that supports the protocol. With a generic OIDC provider, there's not really any way to explain to users what they're consenting too. I don't think many devs would or should build backends to respect such a system.
Basically it boils down to I think I need to design an OIDC profile special built for this purpose. Something along the lines of Solid-OIDC I think.

authors: anderspitman jonnystoten kipz

repo: openpubkey/openpubkey


text:
Cloud Manager Design

Adds Cloud Manager Design Document.

@berggren PTAL


text:
sock:receive问题

1 看文档sock:receive('*a')需要the socket until the connection is closed，请求如果客户端不shutdownOutput，不进行关闭流，如何拿到tcp，sock:receive是否支持自定义正则表达式
2 比如有一个不定长的流，以8个5结尾作为结束，如何正确的读取每个请求

Please use  receiveuntil

repo: openresty/stream-lua-nginx-module


text:
Support for changing Gradle dependency versions in TOML files

What problem are you trying to solve?
We specify all of our dependencies and their versions inside toml files for our gradle projects. We would like a away to automate the upgrading of these versions via open rewrite.
Describe the solution you'd like
Recipe available for changing the version of a dependency specified in a toml file
Have you considered any alternatives or workarounds?
Consider using the find and replace recipe but it leads to several work arounds having to be in place for it to work.
Additional context
https://rewriteoss.slack.com/archives/C01A843MWG5/p1723123348552829

@steplica thanks a lot for the offer to help!

I think in the early stages of getting the parser to work @KnutWannheden might be best to guide you, as he's been most active with recent parser developments. I'd expect rewrite-toml should still be part of openrewrite/rewrite, with an eye towards integration with Gradle
once the parser works we'd need to hook it into the rewrite-maven-plugin and rewrite-gradle-plugin, and rewrite-polyglot
then once files are parsed as Toml, we'd need to integrate with our Gradle support; at that point we can tag Shannon Pamperl (also here) for guidance, likely looking towards our Trait support to minimize recipe changes

will this also support gradle version catalogs defined in settings.gradle (no toml files involved) ?

👍 sounds good. keep an eye on this issue.

authors: jizhangattw michaelmcfadyensky timtebeek tompson

repo: openrewrite/rewrite


text:
ReplaceAnnotation replaces with wrong annotation in method with annotated argument and local variable

How are you running OpenRewrite?
Unit test based on https://github.com/openrewrite/rewrite/releases/tag/v8.33.7
What is the smallest, simplest way to reproduce the problem?
@Test
void methodWithAnnotatedParameter() {
    rewriteRun(
      spec -> spec.recipe(new ReplaceAnnotation("@org.jetbrains.annotations.NotNull", "@lombok.NonNull", null)),
      java(
        """
          import org.jetbrains.annotations.NotNull;
          import org.jetbrains.annotations.Nullable;
          class ValueAnnotationDuplication {
              void methodName(
                  @Nullable final boolean valueVar) {
                  @NotNull final String nullableVar = "test";
              }
          }
          """,
        """
          import lombok.NonNull;
          import org.jetbrains.annotations.Nullable;
          class ValueAnnotationDuplication {
              void methodName(
                  @Nullable final boolean valueVar) {
                  @NonNull final String nullableVar = "test";
              }
          }
          """
      )
    );
}

What did you expect to see?
Above unit test to pass
What did you see instead?
Incorrect replacement
diff --git a/ValueAnnotationDuplication.java b/ValueAnnotationDuplication.java
index 3b9317e..a586033 100644
--- a/ValueAnnotationDuplication.java
+++ b/ValueAnnotationDuplication.java
@@ -1,8 +1,7 @@
-import lombok.NonNull;
 import org.jetbrains.annotations.Nullable;
 class ValueAnnotationDuplication {
     void methodName(
         @Nullable final boolean valueVar) {
-        @NonNull final String nullableVar = "test";
+        @Nullable final String nullableVar = "test";
     }
 }
\ No newline at end of file

Looks to go wrong here because we have no parameters
https://github.com/openrewrite/rewrite/blob/a98d83d698dda9971c93a0767b7f85d5866f306d/rewrite-java/src/main/java/org/openrewrite/java/internal/template/Substitutions.java#L238-L241
Both annotations from the parent scope are then returned; after which we replace the first.
https://github.com/openrewrite/rewrite/blob/54f8209d24b4f2405e2c575501aef9aa97120443/rewrite-java/src/main/java/org/openrewrite/java/internal/template/JavaTemplateJavaExtension.java#L61-L67


text:
feat: Added functionality to Gradle ChangeDependency to avoid duplica…

Refs: #4521

This likely got some conflicts as a result of https://github.com/openrewrite/rewrite/commit/9936a7a70a4792aa73e7f2d1f1378c05b3507123 ; is there anything left to fix after that change? Or perhaps a different direction you'd now recommend @shanman190 ?

@timtebeek, this PR still needs some rework based upon my last comment here:
https://github.com/openrewrite/rewrite/pull/4523#discussion_r1779500203
This also applies probably to more of the recipes than just ChangeDependency, but that one is a good starting place.

authors: ashakirin shanman190 timtebeek


text:
Move GSE and SMV between ConnectedAP

Is your feature request related to a problem? Please describe.
As a user of OpenSCD I want to move a GSE or SMV element between different ConnectedAP element of the same IED.
The communication related settings of a GOOSE control block are saved within the GSE element in the Communication section and here in the parent ConnectedAP. As such, a GOOSE is linked to an access point of an IED. This is used by some vendors to scross check if a link - GOOSE data to input - does make sense.
At the moment when creating a GOOSE we add the GSE we add it the ConnectedAP that is linked with the server, which works for most of the users, but some need to move the GSE and SMV elements between different ConnectedAP of the same IED.
Describe the solution you'd like
I want to navigate to the communication plugin and click on a GSE or SMV element and move it to another ConnectedAP element of the same IED.
Requirements

add a button to the GSE/SVM element representation in the communication plugin
on button click give the user the choice of all other ConnectedAP element of the same IED
disable the new button in case of:

an IED has only one AccessPoint and therefore only one ConnectedAP
an IED has multiple AccessPoints but only on ConnectedAP (only one access point it linkt to a subnetwork)

Additional information

there is nothing IEC 61850 related to check. As elements of the GSE should be unique a move should not have any side effects. Simple remove from one ConnectedAP copy and insert in another ConnectedAP.

Maybe you can add an example UI? Wireframe?

repo: openscd/open-scd


text:
Merge replication branch into development.

What this PR does / why we need it:
Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #
Special notes for your reviewer:
Release note:

Coverage decreased (-7.5%) to 42.226% when pulling a517bcba0947cbbe4f8240f940542ce7db1348ad on xxwjj:replication into 421e57de86f506c468e3b7aba2cc4c0a518f07de on opensds:development.

@xxwjj Can you pull another request to update the openapi file?

authors: coveralls leonwanghui xxwjj

repo: opensds/opensds


text:
Fix for #729 - Removed Pre-defined profile properties

What this PR does / why we need it:
This is to fix https://github.com/opensds/opensds/issues/729
Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #
Profile for file share has some pre-defined properties
Special notes for your reviewer:
Sample commands to execute and verify the fix
root@shruthi-VirtualBox:~/go/src/github.com/opensds/opensds# curl --header "Content-Type: application/json" --data '{"name":"f12", "description":"file share test", "storageType":"file"}' http://127.0.0.1:50040/v1beta/e93b4c0934da416eb9c8d120c5d04d96/profiles
{"id":"e372f004-b2a9-4ffe-8903-a0f6a11563ee","createdAt":"2019-06-13T12:04:25","updatedAt":"","name":"f12","description":"file share test","storageType":"file","provisioningProperties":{"dataStorage":{"isSpaceEfficient":false},"ioConnectivity":{}},"replicationProperties":{"dataProtection":{"isIsolated":false},"replicaInfos":{}},"snapshotProperties":{"schedule":{},"retention":{},"topology":{}},"dataProtectionProperties":{"dataProtection":{"isIsolated":false}}}
root@shruthi-VirtualBox:~/go/src/github.com/opensds/opensds# osdsctl profile list
WARNING: OPENSDS_ENDPOINT is not specified, use default(http://localhost:50040)
WARNING: Not found Env OPENSDS_AUTH_STRATEGY, use default(noauth)
+--------------------------------------+---------+-----------------+-------------+
| Id                                   | Name    | Description     | StorageType |
+--------------------------------------+---------+-----------------+-------------+
| ecd0fe58-4a1d-445d-924c-deb9a991c646 | default | default policy  | file        |
| e372f004-b2a9-4ffe-8903-a0f6a11563ee | f12     | file share test | file        |
| 999977f2-5a52-4f64-9cc5-7d6df6685993 | default | default policy  | block       |
+--------------------------------------+---------+-----------------+-------------+

Release note:

I'm wondering why do you remove the code? Please elaborate.

I'm wondering why do you remove the code? Please elaborate.

It is optional parameter now, initially we decided to use as default fileshare storage access capability with some default values, but later decided to add these capability in later releases.


text:
CLI update for token, configuration support and api changes

What this PR does / why we need it:
This PR update the orchestration CLI with support for token generation, configurations from commandline, current apis, bug fixes etc.

Codecov Report

Merging #87 into development will not change coverage.
The diff coverage is n/a.

@@             Coverage Diff              @@
##           development      #87   +/-   ##
============================================
  Coverage        38.15%   38.15%
============================================
  Files               13       13
  Lines              912      912
  Branches            94       94
============================================
  Hits               348      348
  Misses             541      541
  Partials            23       23

authors: codecov-io joseph-v

repo: opensds/orchestration


text:
Why the examples on codepen.io no loger work?

Why the examples on codepen.io no loger work?
Giving the message: "Unable to open [object Object]: Unable to load TileSource".
Like this ones:
https://codepen.io/iangilman/pen/oXNMeQ
https://codepen.io/iangilman/pen/EZqazZ

Very strange! I'll have to take a look into it... thank you for alerting me!

The problem is that Codepen went through and changed all http to https, but changing the DZI xmlns to https breaks our DZI detection. The fix is to change the xmlns back to http://schemas.microsoft.com/deepzoom/2008. I've done so for all of my pens in the OSD Collection:
https://codepen.io/collection/APoyjJ/
...and I've notified @IllyaMoskvin (who's done three of those pens).
If anyone else has OSD-based Codepens, you should check yours as well! Also let me know about them so I can add them to the collection :)
Meanwhile, another fix we can make in the code is to not worry about http vs https in our xmlns detection... I'll leave this issue open for that fix.

Fixed my pens! Now with more cats.

@IllyaMoskvin Beautiful :)

authors: IllyaMoskvin Medwar iangilman

repo: openseadragon/openseadragon

license_source: bigquery


text:
[BUG] Performance test fail for OpenSearch core

Describe the bug
Performance test for OpenSearch core are failing with the exception
SyntaxError: Unexpected token ?\n'
b'    at Module._compile (internal/modules/cjs/loader.js:723:23)\n'
b'    at Object.Module._extensions..js (internal/modules/cjs/loader.js:789:10)\n'
b'    at Module.load (internal/modules/cjs/loader.js:653:32)\n'
b'    at tryModuleLoad (internal/modules/cjs/loader.js:593:12)\n'
b'    at Function.Module._load (internal/modules/cjs/loader.js:585:3)\n'
b'    at Function.Module.runMain (internal/modules/cjs/loader.js:831:12)\n'
b'    at startup (internal/bootstrap/node.js:283:19)\n'
b'    at bootstrapNodeJSCore (internal/bootstrap/node.js:623:3)\n'

To Reproduce
Steps to reproduce the behavior: Start the execution of any performance test
Expected behavior
Performance test completes successfully and returns the results
Plugins
Please list all plugins currently enabled.
Screenshots
If applicable, add screenshots to help explain your problem.
Host/Environment (please complete the following information):

OS: [e.g. iOS]
Version [e.g. 22]

Additional context
Add any other context about the problem here.

The root cause for the failure seems to be a combination of the environment and dependencies.
Infrastructure setup is done using the latest aws-cdk which is running on a node 10 environment. This configuration is causing failures similar to the ones mentioned here and here.
One of the solutions is to upgrade to node 16. With the current setup of the existing agent image we are restricted with an older node version.
Upgrading to a newer node version will help resolve this issue

Submitted a request for an image with node 16 support - https://github.com/opensearch-project/opensearch-build/issues/2211

repo: opensearch-project/OpenSearch


text:
WIP: Fix es checkout for versions <= 7.10

Description
Attempting a fix for part of https://github.com/opensearch-project/OpenSearch/issues/786, the checkout failure. We're trying to fetch opensearch-project/OpenSearch, but we need the old ElasticSearch versions.
I need to double check that we are only using the result of this checkout for the backward compatible version and not to build the current state to compare against. If that were true we would need to check out into two different places.
Issues Resolved
part of #786
Check List

[x] Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

As @adnapibar mentioned the git fetch is used only for unreleased versions, so this code shouldn't be hit for old(er) versions of ES at all, and moving forward is correctly fetching code from opensearch-project/OpenSearch.


text:
Support alerta.io

 Issue by praveensameneni
Sunday Sep 06, 2020 at 06:47 GMT
Originally opened as https://github.com/opendistro-for-elasticsearch/alerting/issues/249

Is your feature request related to a problem? Please describe.
Alerta is very simple monitoring management system, at least it appears such to the user. It allows to manage alerts from many other monitoring tools on a single screen. Alerta combines an API server for receiving, processing and rendering alerts with effective Web UI and command-line tool.
Describe the solution you'd like
Alerta accepts alerts from the standard sources like Syslog, SNMP, Prometheus, Nagios, Zabbix, Sensu and netdata. Any monitoring tool that can trigger a URL request can be integrated easily. Alerts are submitted in JSON-format to an HTTP API. Alerts can be queried from the command-line or viewed in a slick web console
Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.
Additional context
One of the common alerting management tools that is gaining lot of traction.
https://alerta.io/

Need to move this to the Notification repo

authors: aditjind lezzago

repo: opensearch-project/alerting


text:
Move the CCR performance tests to the new ci.amazon.com

We have a periodic performance run for CCR to benchmark the replication performance. We need to move the workflow to the new setup i.e. buld.ci.amazon.com

Mohit is working on it.

Have started working on it, performance testing on single node cluster and multi node cluster is completed.

authors: ankitkala mohitamg


text:
Created release notes for 2.10 release

Description
Created release notes for 2.10 release
Issues Resolved
#443
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@navneet1v Could you help add https://github.com/opensearch-project/dashboards-maps/pull/462 to the release notes? Thanks

@navneet1v Could you help add #462 to the release notes? Thanks

sure

@junqiu-lei please review it one more time.

repo: opensearch-project/dashboards-maps


text:
Remove zips and download from remote at build time

Description
closes #263
Issues Resolved
[List any issues this PR will resolve]
Check List

[ ] New functionality includes testing.

[ ] All tests pass, including unit test, integration test and doctest

[ ] New functionality has been documented.

[ ] New functionality has javadoc added
[ ] New functionality has user manual doc added

[x] Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Codecov Report

Merging #337 (2839843) into main (c736995) will increase coverage by 2.51%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##               main     #337      +/-   ##
============================================
+ Coverage     74.18%   76.69%   +2.51%
============================================
  Files            94       30      -64
  Lines          3966     1905    -2061
  Branches        639      410     -229
============================================
- Hits           2942     1461    -1481
+ Misses          890      441     -449
+ Partials        134        3     -131

Flag
Coverage Δ

dashboards-reports
76.69% <ø> (ø)

reports-scheduler
?

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files
Coverage Δ

...tsscheduler/model/CreateReportDefinitionRequest.kt

...reportsscheduler/model/GetReportInstanceRequest.kt

...portsscheduler/model/GetReportDefinitionRequest.kt

...sscheduler/model/UpdateReportDefinitionResponse.kt

...tsscheduler/scheduler/ReportDefinitionJobRunner.kt

...nsearch/reportsscheduler/metrics/BasicCounter.java

...sscheduler/model/CreateReportDefinitionResponse.kt

...rch/reportsscheduler/index/ReportInstancesIndex.kt

...uler/resthandler/RestResponseToXContentListener.kt

...sscheduler/model/GetAllReportDefinitionsRequest.kt

... and 54 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c736995...2839843. Read the comment docs.

repo: opensearch-project/dashboards-reports


text:
update put mapping API requirements

…te/issues/565
Signed-off-by: alicejw alicejw@amazon.com
Description
Specify index is a required path parameter for the mapping operation.
Issues Resolved
565
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

confirmed in the dashboard that {index} is a required path parameter, and updated docs accordingly.
see image:


text:
Add imagePullPolicy to init container

Signed-off-by: John Adams <>
Description
Add imagePullPolicy to fsgroup-volume init container (also remove trailing whitespace in this file)
Issues Resolved
Issue not filed, but breaks startup of Opensearch when no internet connection is available but container is cached
Check List

[x] Commits are signed per the DCO using --signoff

For any changes to files within Helm chart directories:

[x] Helm chart version bumped
[x] Helm chart CHANGELOG.md updated to reflect change

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Need this merged as well, thank you

Hi @gentoo9ball
Thanks a lot for your contribution. Welcome to OpenSearch community. For this PR can you please create and issue and attach a link to the PR. I can take a look at this PR post that.

Hi @gentoo9ball
Thanks a lot for your contribution. Welcome to OpenSearch community. For this PR can you please create and issue and attach a link to the PR. I can take a look at this PR post that.

Done, #420 Thanks!

Hey @jadams can you please check the tests, I see they are failing.
@TheAlgo can you please review this?
Thank you

@TheAlgo version bumped to match current main

@prudhvigodithi @peterzhuamazon Can you guys please take a look?

Thanks @jadams LGTM? Can you please backport this PR to 1.x?

authors: TheAlgo gentoo9ball jadams prudhvigodithi

repo: opensearch-project/helm-charts


text:
Updated MAINTAINERS and CODEOWNERS.

Description
Updated MAINTAINERS and CODEOWNERS.
Issues Resolved
https://github.com/opensearch-project/index-management-dashboards-plugin/issues/610
Check List

[x] Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Could someone add the backport 2.x label? I don't seem to have permissions at the moment.

Could someone add the backport 2.x label? I don't seem to have permissions at the moment.

done

The unit tests are flaky when run in a windows environment, but I don't have permissions to re-run them.

Permissions are updated:

Thanks!

authors: AWSHurneyt SuZhou-Joe gaiksaya


text:
[FEATURE] Support searches across raw data indices and rollup indices together

Is your feature request related to a problem?
Currently, we do not support searches if the same request has both raw indices and the indices with associated rollup job. We return the exception upon validation if both types of indices are present in the request.
What solution would you like?
Support searches across both all indices in order to query / aggregate results irrespective of whether the rollup job is assigned or not to a particular index.

Is there any historical reason around why we are not supporting this? Is this just because of query rewrite we trigger via rollup interceptor?
Also, we would need to test this flow and verify that the aggregations across indices (raw, rolled up) yield correct results.

Catch All Triage - 1, 2, 3

In the absence of this feature, users of opensearch have to evaluate the option of issuing two separate queries i.e. one query to the raw index, and one query to the rollup-indices.
Some customers/users of OpenSearch are reporting this double querying (once to raw, and additional query to rollup indices) as a major hurdle, as this workaround of separately querying raw and rollup indices requires significant code change to their product/app.

authors: dblock manojfaria mgodwan sarthakaggarwal97

repo: opensearch-project/index-management


text:
[BUG] Upgrade from ES 7.x to OS 1.x leads to query failure

Overview
In OpenSearch 1.0 release, we introduced KNNEngine, which contains metadata about the underlying library used for the particular field: https://github.com/opensearch-project/k-NN/pull/20.
For a given field, we store the name of the engine in Lucene's fieldType as an attribute. This gets stored on a per segment basis.
The problem is that when a customer upgrades from ES 7.x to OS 1.x, the fieldAttribute is not set in the segments created in ES 7.x. When a node running OpenSearch attempts to run a query on such a segment, the engine name is null leading to an exception.
Impact
Indices created in ES 7.x clusters may not be searchable in OS 1.x.
Upgrade tests were run for ES 7.x to OS 1.0, but it is unclear at the moment why this issue was not caught then. One potential reason is that forcemerging created new segments.
Mitigation(s)
Reindex data from the indices created  in ES 7.x to new indices created in OpenSearch 1.x. This will build the segments with nmslib as the default engine. The same settings/mapping from the old index can be used for the new index:
PUT /new_index
{
  "settings": {
same as old_index
  },
  "mappings": {
same as old_index
    }
}
'

POST /_reindex
{
  "source": {
    "index": "old_index"
  },
  "dest": {
    "index": "new_index"
  }
}

Patch
The fix is simple. If the fieldAttribute isnt found in KNNWeight, we should default to nmslib as the engine. We actually already do this in KNN80DocValuesConsumer. We will need to backport to 1.2, 1.1 and 1.0.

Repro: I created an index in ODFE, took a snapshot of the index, restored it on an OpenSearch cluster, and ran search:
# Clone ODFE
mkdir odfe && cd odfe && git clone https://github.com/opendistro-for-elasticsearch/k-NN.git
cd k-NN
git checkout v1.13.0.0

# In tmux, create ODFE test cluster
./gradlew run

# Setup the snapshot repo
curl -X PUT "localhost:9200/_snapshot/backup?pretty" -H 'Content-Type: application/json' -d'
{
  "type": "fs",
  "settings": {
    "location": "snapshots"
  }
}
'

# Add some k-NN documents
curl -X PUT "localhost:9200/odfe_index" -H 'Content-Type: application/json' -d'
{
  "settings": {
    "index": {
      "knn": true,
      "number_of_shards": 1,
      "number_of_replicas": 0
    }
  },
  "mappings": {
    "properties": {
      "target_field": {
        "type": "knn_vector",
        "dimension": 2
        }
      }
    }
}
'

curl -X POST "localhost:9200/_bulk" -H 'Content-Type: application/json' -d'
{ "create" : { "_index" : "odfe_index" } } } }
{ "target_field" : [18.5, 19.5] }
{ "create" : { "_index" : "odfe_index" } } } }
{ "target_field" : [19.5, 20.5] }
{ "create" : { "_index" : "odfe_index" } } } }
{ "target_field" : [20.5, 21.5] }
{ "create" : { "_index" : "odfe_index" } } } }
{ "target_field" : [21.5, 22.5] }
'

# Take snapshot
curl -X PUT "localhost:9200/_snapshot/backup/odfe_snapshot?wait_for_completion=true&pretty" -H 'Content-Type: application/json' -d'
{
  "indices": "odfe_index"
}
'

# In tmux, shutdown ODFE process, go to OpenSearch k-NN and start a test cluster
./gradlew run

# Copy snapshot from ODFE to OpenSearch
curl -X PUT "localhost:9200/_snapshot/backup?pretty" -H 'Content-Type: application/json' -d'
{
  "type": "fs",
  "settings": {
    "location": "snapshots"
  }
}
'

cp -r odfe/k-NN/build/testclusters/integTest-0/repo/snapshots/* k-NN-1/build/testclusters/integTest-0/repo/snapshots/

# Restore from snapshot
curl -XPOST "localhost:9200/_snapshot/backup/odfe_snapshot/_restore"

# Search
curl -X POST "localhost:9200/odfe_index/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "size" : 2,
  "query": {
    "knn": {
      "target_field": {
        "vector": [3, 4],
        "k": 2
      }
    }
  }
}
'
{
  "error" : {
    "root_cause" : [
      {
        "type" : "illegal_argument_exception",
        "reason" : "Invalid engine type: null"
      }
    ],
    "type" : "search_phase_execution_exception",
    "reason" : "all shards failed",
    "phase" : "query",
    "grouped" : true,
    "failed_shards" : [
      {
        "shard" : 0,
        "index" : "odfe_index",
        "node" : "_ZrClrwpRJmWZjxOtC-lQA",
        "reason" : {
          "type" : "illegal_argument_exception",
          "reason" : "Invalid engine type: null"
        }
      }
    ],
    "caused_by" : {
      "type" : "illegal_argument_exception",
      "reason" : "Invalid engine type: null",
      "caused_by" : {
        "type" : "illegal_argument_exception",
        "reason" : "Invalid engine type: null"
      }
    }
  },
  "status" : 400
}

repo: opensearch-project/k-NN


text:
Fixed few param descriptions

Description
Fixed few param descriptions
Issues Resolved
#243
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@nhtruong Please take a look


text:
DevOps Surge!

One of the lessons I learned from the OpenSearch 1.0 release is that the current development automation is not where we want it to be.  There are, for example, too many manual processes that happen behind closed doors.  Setting up good infrastructure is hard, but every hour spent automating tasks is rapidly paid back in full when everyone is able to build faster and release with greater confidence.
To get us caught up project where it needs to be, I’m going to shift some folks over (surge) on to working on developer operations (DevOps) == a  DevOps Surge!
Principles

Security is the top priority.
Continuous Integration (CI) makes development faster, not slower.
Outputs can be trusted, as all CI is automated and easily reproducible by anyone, and produces signed artifacts.
Logs and outputs of all CI is accessible and visible to anyone.
Anyone can contribute to CI and preview results before changes are merged.
CI infrastructure is not provider locked, and can be quickly rebuilt on another provider if needed.
CI scripts run the same commands that developers use to build on their desktops.
CI infrastructure scales horizontally to accommodate parallel execution of builds and tests without being reworked.
OpenSearch plugins commit to project-wide infrastructure decisions.

High Level Goals:
You don’t have to work at AWS to produce a full distribution of OpenSearch!

Too many parts of the build and bundle process are not reproducible outside of AWS.  The goal is to make it so that anyone in the community can create a fresh build at any time.

The OpenSearch project team can produce a release without relying on any AWS-internal collaboration tools (for document sharing, conducting meetings, etc)!

We have tests and tests frameworks that give us confidence our code is being exercised. The output of those tests need to be easily inspect visible and regularly produced so we don’t have to chase people to find out the state of the build.  Today we have to poke each plug in to create a build, verify it and then manually assemble it.

The OpenSearch project team has a repeatable process to create the bits we ship!

There are no manual steps in the creation or assembly of the distribution.

The OpenSearch project team has a path to objectively demonstrate that the bits we ship work the way we expect them to!

We may not have all plugins at 100% test coverage for all types of testing initially, but we have hooks in place to do all the types of testing we are doing manually today (unit, integration, performance, backwards compatibility, upgrade)

To accomplish this work, we’ll be tracking two different projects:

OpenSearch Continuous Build Deployment and Publishing
OpenSearch Testing Automation

and the key meta issues to follow are:

GA release process
Bundle build
Components build

Since a huge part of this effort is moving things out into the public, it’ll be harder for folks outside of AWS to contribute until  the first round of work is done.  But I’d love to hear your thoughts on our approach and I look forward to being able to collaborate more fully.
Thanks,
/C

Let me know if I should open a separate issue/proposal for this. It would be really interested to see if longer-term we can work towards having build logic for distributions (deb, arch, etc...) live in independent repos and have those build processes incorporated into the overall build/publishing process.

@elfisher build logic to create a distribution is already present in a dedicated release folder. Is there a rationale to move them to separate repos?

@elfisher build logic to create a distribution is already present in a dedicated release folder. Is there a rationale to move them to separate repos?

My thinking is more modularity to allow for independent development iteration outside of the main repo where we assemble all the build steps.

As we've been working through issues in the repos, we've settled in on this heuristic that I wanted to capture here:
If we're taking actions on a single repo, we'll use github actions.
If we're taking actions across multiple repos (building, running tests) we'll use Jenkins.
We're also trying to make sure  we're making sure we're keeping separation of concerns for the different workflows.

[Triage] @bbarani can you track this completion of the surge and update this issue?

Closing.

authors: CEHENKLE bbarani dblock elfisher peternied

repo: opensearch-project/opensearch-build


text:
[FEATURE] Support for upsert in BulkIndexer Update action

Is your feature request related to a problem?
In openserch Go client, 'update' action on BulkIndexerItem is not supporting 'upsert' flag currently. 'upsert' flag is used.
Upsert is used to insert a new document into a database if it does not exist, or updates an existing document if it does exist.
May be support for the flag can be provided in BulkIndexerItem type
https://github.com/opensearch-project/opensearch-go/blob/v1.1.0/opensearchutil/bulk_indexer.go#L111
What solution would you like?
Support for 'upsert' flag in BulkIndexerItem type in opensearch go client library.
What alternatives have you considered?
As of now, we use index operation for update as well so if document doesn't exist it will create a new document.
Do you have any additional context?
No

It would be a needed addition to the API.

AFAIK, all bulk requests in either are combined into one interface where requests will be sent. That is, a create, delete, update request is sent in the same format. I would like to discuss with the community in which version should be refactor?

If add some tag, will it not turn out to be an overweight for the rest of the operations?
If add a new abstract parameter where you can pass additional parameters? (this option suits me better)

@SaiSatwik, I decided to dig deeper into this issue and started digging into the source code. So, my previous post was wrong, as the source code already supports this functionality. However, it would seem non-obvious, on the other hand it gives a lot of flexibility in terms of use. In order to show how to use it, I decided to slightly tweak the integration test cases #269 . Please review and provide feedback. If this solves your problem, please close the issue.

I merged #269, thanks!

authors: SaiSatwik arunx2 dblock zethuman

repo: opensearch-project/opensearch-go


text:
[FEATURE] Incremental refresh index on Hive source table

Is your feature request related to a problem?
Currently Spark structured streaming only supports Spark Data Source table. For Hive table, it throws exception when starting streaming job.
What solution would you like?
Opt-1: Support streaming on Hive table either enhance stream source operator or convert Hive table internally (not sure if possible)
Opt-2: Give user clear message simply or how to create Spark DS table guide upon error. Related to https://github.com/opensearch-project/opensearch-spark/issues/65

A new option is this may be supported by Lazy Build idea in https://github.com/opensearch-project/opensearch-spark/issues/118 if the proposal feasible.

Need to double check if all or only certain Hive table cannot be supported by Spark structured streaming.

no plan to support hive table as streaming source in short term. more context of hive table issue with spark structured streaming query in https://github.com/opensearch-project/opensearch-spark/issues/65#issuecomment-1908974123.

authors: dai-chen penghuo

repo: opensearch-project/opensearch-spark


text:
Investigate searching and filtering a list of items by metadata not displayed in the list

Is it feasible, using our search, filter, and table components, to search and filter a list of items by metadata that is not displayed in the list?
Let me describe my use case:
The model registry has many models. Each model can have many versions. I want to be able to search and filter the model registry, which contains a list of models, for metadata that is related to a model version.
For example, I want to search the model registry for models that contain versions that have the tag “Task: Image Classification”, or the metric “Accuracy > 0.99”.
Figure 1: A video of some of the desired behavior, showing a model registry where the list view is filtered by metadata not displayed on each list item.
https://user-images.githubusercontent.com/16546056/212114018-23eee5eb-3e2d-477b-99d4-31431a1a58a7.mov
Figure 2: Early mockup of model registry table view, showing a list of models, each containing multiple versions.

Figure 3: Model registry object relationships and metadata.

Currently no action item required from OUI, I believe that the engineering partners @lauralexis  was working with have proven out that the metadata was searchable.

authors: KrooshalUX lauralexis

repo: opensearch-project/oui


text:
[Docsite] Implement dropdown to choose different OUI Docsite Versions

Description
Allow user to choose OUI Doc Site from different versions
Issues Resolved
Issue-73
SC

Check List

[ ] New functionality includes testing.
[ ] New functionality has been documented.
[x] All tests pass

[X] yarn lint
[X] yarn test-unit

[ ] Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Let's get reviewed by @KrooshalUX from UX perspective before merging to main.

yes

@kaddy645  LGTM

The commits are not signed so i will work with Karthik to sign them and update the commit

authors: AMoo-Miki KrooshalUX kaddy645


text:
[Blog] Internal functioning of sorting in hybrid query

Description
This PR contains the content for publishing the blog on internal functioning of hybrid query.
Issues Resolved
3354
Check List

[x] Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the BSD-3-Clause License.

@pajuric Editorial comments addressed. This blog is ready to publish.

@nateynateynate @kolchfa-aws - Can I get your help pushing this blog live?

authors: kolchfa-aws pajuric vibrantvarun

repo: opensearch-project/project-website


text:
[FEATURE] Detector must have at least one alert set #288

Description
Sets the detector to have at least one alert set.
Issues Resolved
Closes #288
Check List

[ ] Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Failed test was unrelated to the changes in this PR and under investigation

authors: amsiglan jovancacvetkovic


text:
[BUG] "Log in with single sign-on" button redirects to incorrect URL

What is the bug?
I use a custom server.basePath and server.rewriteBasePath: true, enable the multiple auth types opensearch_security.auth.type: ["basicauth", "openid"]. If I click openid sign-on button I will be redirected to http://<hostname>:5601/auth/openid/login, not http://<hostname>:5601/<basePath>/auth/openid/login. The same situation happens whether I use a reverse proxy (nginx). By the way, if I leave only one auth type openid It works fine because at this case there is no button.

I attach opensearch-dashboards configuration

# Please do not change this file directly since it is managed by Ansible and will be overwritten
server.host: 0.0.0.0
server.port: 5601
opensearch.hosts: ['https://192.168.*.*:9200']

logging.dest: /var/log/opensearch-dashboards/opensearch-dashboards.log
logging.rotate:
  enabled: true
  everyBytes: 10485760
  keepFiles: 10
opensearch.password: ****
opensearch.requestHeadersAllowlist:
- Authorization
- security_tenant
opensearch.ssl.verificationMode: none
opensearch.username: kibanaserver
opensearch_security.auth.multiple_auth_enabled: true
opensearch_security.auth.type:
- basicauth
- openid
opensearch_security.cookie.secure: false
opensearch_security.multitenancy.enabled: true
opensearch_security.multitenancy.tenants.preferred:
- Private
- Global
opensearch_security.openid.base_redirect_url: https://opensearch-dashboards.example.com/opensearch-logging-dev
opensearch_security.openid.client_id: oidc
opensearch_security.openid.client_secret: ****
opensearch_security.openid.connect_url: https://auth.example.com/realms/example/.well-known/openid-configuration
opensearch_security.openid.trust_dynamic_headers: true
opensearch_security.readonly_mode.roles:
- kibana_read_only
opensearch_security.ui.openid.login.buttonname: Log in with single sign-on (OIDC)
server.basePath: /opensearch-logging-dev
server.rewriteBasePath: true

opensearch-security/config.yml

---
# Please do not change this file directly since it is managed by Ansible and will be overwritten
_meta:
  type: "config"
  config_version: 2

config:
  dynamic:
    authc:
      basic_internal_auth_domain:
        authentication_backend:
          type: internal
        http_authenticator:
          challenge: false
          type: basic
        http_enabled: true
        order: 0
        transport_enabled: true
      openid_auth_domain:
        authentication_backend:
          type: noop
        http_authenticator:
          challenge: false
          config:
            openid_connect_idp:
              enable_ssl: true
              pemtrustedcas_filepath: /etc/opensearch/openid-ca.pem
              verify_hostnames: false
            openid_connect_url: https://auth.example.com/realms/example/.well-known/openid-configuration
            roles_key: roles
            subject_key: preferred_username
          type: openid
        http_enabled: true
        order: 1
        transport_enabled: true
    http:
      anonymous_auth_enabled: false
      xff:
        enabled: false

NGINX config

upstream opensearch_logging_dev {
  server 192.168.*.*:5601;
}

server {
  listen [::]:80 ipv6only=off;
  server_name openseaerch-dashboards.example.com;
  return 301 https://$host$request_uri;
}
server {
  listen [::]:443 ssl ipv6only=off;

  server_name openseaerch-dashboards.example.com;

  ssl_certificate ssl/openseaerch-dashboards.example.com.crt;
  ssl_certificate_key ssl/openseaerch-dashboards.example.com.key;

  access_log  /var/log/nginx/openseaerch-dashboards.example.com.access.log main;
  error_log   /var/log/nginx/openseaerch-dashboards.example.com.error.log;

  location /opensearch-logging-dev {
    proxy_pass http://opensearch_logging_dev;
  }

  location / {
    return 404;
  }
}

How can one reproduce the bug?
Steps to reproduce the behavior:

Define server.basePath, server.rewriteBasePath to true, and opensearch_security.auth.type to ["basicauth", "openid"] as I have yet defined above.
Click on the button "Log in with single sign-on" and you will get 404 error

What is the expected behavior?
I expect the redirect url has to be http://<hostname>/<basePath>/auth/openid/login.
What is your host/environment?

Ubuntu 20.04
OpenSearch 2.5.0 (checked 2.6.0 as well and the behaviour is the same)

this is the same as #1349

Thanks for pointing out the duplicate  @mattieserver - and thank you for the PR that addresses this.
@m-shalenko I am closing this issue to use the existing one.

authors: m-shalenko mattieserver peternied


text:
Allow environment variables in yml files

My expectation would be opendistro yml files would be treated the same as elasticsearch yml files.
Currently you cannot include an environment variable in opendistro_security/securityconfig/internal_users.yml. Other ES config files allow this https://www.elastic.co/guide/en/logstash/current/environment-variables.html
The benefit of doing this is that Docker based opendistro deployments could be secured on launch via using env variables injected from a secrets store. The alternative to this is that I've written a descendant docker image that also includes a template generator to dynamically render the internal_users.yml file based on the contents of the secrets store.

Could you share such an image (or Dockerfile)? this is not difficult to do but very useful.

Could you share such an image (or Dockerfile)? this is not difficult to do but very useful.

Here's a workaround in case you're working with docker-compose and .env:
(set -a; source .env; envsubst < opendistro_security/securityconfig/internal_users.yml > /tmp/internal_users.yml; mv /tmp/internal_users.yml opendistro_security/securityconfig/internal_users.yml)

# Workaround for https://github.com/opendistro-for-elasticsearch/security/issues/24
awk 'FNR==NR {n=index($1,"=");if(n){vars[substr($i, 1, n - 1)]=substr($i, n + 1)}; next } { for (i in vars) gsub("\\$\\{"i"\\}", vars[i]) }1' \
  .env opendistro_security/securityconfig/internal_users.yml > ~/internal_users.yml
mv -f ~/internal_users.yml opendistro_security/securityconfig/internal_users.yml

Hey @untoldone ,
for some of the yml files that is possible out of the box as described here: https://docs.search-guard.com/latest/configuration-password-handling but not possible i.e. to set opendistro_security.nodes_dn via environment variable.
Any idea how that can be done without running a script that overrides these values (as @micheljung workaround suggested, b.t.w that a lot for your workaround).

[Triage 2/6/2023] There are numerous initiatives to improve the user experience of our admin tools. Currently, we are looking at other ways of improving this experience. Closing this issue as part of project maintenance.

authors: GezimSejdiu desaintmartin micheljung scrawfor99 untoldone

repo: opensearch-project/security


text:
[Backport] XContent Refactor to 2.x

XContent namespace refactor from common -> core is going to be merged to opensearch/2.x which will break the 2.x build.  This issue is for backporting #2457 to 2.x after the core namespace change is merged.
Depends on https://github.com/opensearch-project/OpenSearch/pull/6470

https://github.com/opensearch-project/OpenSearch/pull/6470 merged


text:
Version bump to 1.3.0.0

Signed-off-by: Dave Lago davelago@amazon.com
opensearch-security pull request intake form
Version bump to 1.3.0.0

Category: (Enhancement, New feature, Bug fix, Test fix, Refactoring, Maintenance, Documentation)
Maintenance

Codecov Report

Merging #1536 (bdbbae6) into main (3e01690) will increase coverage by 0.00%.
The diff coverage is n/a.

@@            Coverage Diff            @@
##               main    #1536   +/-   ##
=========================================
  Coverage     64.88%   64.88%
- Complexity     3228     3230    +2
=========================================
  Files           247      247
  Lines         17335    17335
  Branches       3072     3072
=========================================
+ Hits          11247    11248    +1
+ Misses         4532     4531    -1
  Partials       1556     1556

Impacted Files
Coverage Δ

...security/configuration/DlsFlsFilterLeafReader.java
59.76% <0.00%> (-0.71%)
:arrow_down:

...ecurity/configuration/ConfigurationRepository.java
75.27% <0.00%> (+2.19%)
:arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3e01690...bdbbae6. Read the comment docs.

authors: codecov-commenter davidlago


text:
[FEATURE] Configure Cluster Search Request Slow Logs

Is your feature request related to a problem?
As of 2.12, we can configure cluster level search request slow logs. There is no support for this in the provider right now.
What solution would you like?
Add a block to opensearch_cluster_settings for search request slow logs:
resource "opensearch_cluster_settings" "example" {
search_request_slow_logs {
    slowlog_level = "TRACE"
    slowlog_threshold_warn = "10s"
    slowlog_threshold_info = "5s"
    slowlog_threshold_debug = "2s"
    slowlog_threshold_trace = "10ms"
}

What alternatives have you considered?
I do not see an alternative method using this provider. The only other way to achieve this via Terraform is via a script and the external provider, the local-exec provider running a PUT to the cluster, or via the http provider.
Do you have any additional context?
This is a relatively new feature that is by default disabled in the cluster, set to -1.

Hey @ironf1st something like the following should be even easier for the user.
resource "opensearch_cluster_settings" "slowlog" {
  cluster_max_shards_per_node = 10
  cluster_search_request_slowlog_level            = "WARN"
  cluster_search_request_slowlog_threshold_warn   = "10s"
  cluster_search_request_slowlog_threshold_info   = "5s"
  cluster_search_request_slowlog_threshold_debug  = "2s"
  cluster_search_request_slowlog_threshold_trace  = "100ms"
}

I have a PR open https://github.com/opensearch-project/terraform-provider-opensearch/pull/211 to support the Cluster Search Request Slow Logs.
Thanks
@getsaurabh02 @peterzhuamazon @rblcoder

The terraform provider 2.3.1 is released supporting Search Request Slow Logs, @ironf1st please take a look.
Thanks

Closing this issue since the terraform provider 2.3.1 is released with Cluster Search Request Slow Logs support, please feel free to add a comment or re-open if required.
Thank you
@getsaurabh02


text:
tests/e2e: fix SMI resource deployment namespace

SMI expects to be formally deployed at destination namespace.
Our testing was just deploying into a monitored namespace, which
could potentially miss some correctness assumptions in the long run.

Tests                  [X]

CI System              [X]

Does this change contain code from or inspired by another project? If so, did you notify the maintainers and provide attribution?
No

Codecov Report

Merging #2027 (972de88) into main (4adc3df) will decrease coverage by 0.28%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##             main    #2027      +/-   ##
==========================================
- Coverage   56.60%   56.32%   -0.29%
==========================================
  Files         142      142
  Lines        5768     5767       -1
==========================================
- Hits         3265     3248      -17
- Misses       2500     2516      +16
  Partials        3        3

Impacted Files
Coverage Δ

pkg/catalog/repeater.go
34.78% <0.00%> (-34.79%)
:arrow_down:

pkg/kubernetes/event_handlers.go
68.75% <0.00%> (-15.47%)
:arrow_down:

cmd/osm-controller/osm-controller.go
27.69% <0.00%> (-0.95%)
:arrow_down:

cmd/cli/osm.go
0.00% <0.00%> (ø)

pkg/smi/fake.go
0.00% <0.00%> (ø)

pkg/smi/client.go
77.20% <0.00%> (ø)

pkg/envoy/proxy.go
26.47% <0.00%> (ø)

pkg/strings/all.go
100.00% <0.00%> (ø)

pkg/catalog/fake.go
88.63% <0.00%> (ø)

pkg/strings/which.go
100.00% <0.00%> (ø)

... and 22 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4adc3df...972de88. Read the comment docs.

repo: openservicemesh/osm


text:
docs: add release notes doc

Description:
Adds a release notes doc to track breaking
changes and deprecated functionality. Going
forward, this doc must be updated in the same
PR that introduces such changes.
This is required to correctly track such changes
and document an upgrade path to users based on
the changes that are not backward compatible.

Affected area:

Functional Area

Documentation
[X]

Please answer the following questions with yes/no.

Does this change contain code from or inspired by another project? no

Did you notify the maintainers and provide attribution?

Is this a breaking change? no

LGTM. Could we also use this to communicate new features and other changes that we normally put in the "Notable Changes" in the body of the GitHub release?

Sure, will add a section for notable changes.


text:
[RELEASE-1.9] wait for config-map changes to be propagated for builds to work on golang 1.19

Changes

Wait for config-map changes to be propagated for builds to work on golang 1.19
Re-introduces the reverted https://github.com/openshift-knative/serving/commit/63387986d659730d363383af6bcb409c55fc66a6 and https://github.com/openshift-knative/serving/commit/83dce1c6c3544cc929c57450200b3a2771abb25b
Context: https://redhat-internal.slack.com/archives/CF5ANN61F/p1680614138940309

/unhold

authors: ReToCode skonto

repo: openshift-knative/serving


text:
CNF-13952: Enable additional golangci-lint linters

The following golangci-lint linters are enabled:

errcheck
gosimple
importas
nilnil
predeclared
promlinter
sloglint
usestdlibvars

/lgtm
/approve

authors: alegacy donpenney


text:
Move pipeline-service-tests logic to shell scripts

This change aims to make the pipeline yaml more readable by abstracting the logic in scripts, as well as being able to apply the CI to the content of those scripts.
Signed-off-by: Romain Arnaud rarnaud@redhat.com

/lgtm

repo: openshift-pipelines/pipeline-service


text:
Add pagination to the gitlab merge request diff list calls.

Changes
Add pagination to the gitlab merge request diff list calls.
In https://github.com/openshift-pipelines/pipelines-as-code/pull/1800, two other places in the code were identified that performed list requests to gitlab.
One is fixed here (the MR diff list call).
The other place (acl.go) already had pagination introduced a while ago in commit 12ba5c532391deb341556001737d2bcdd7dd664b.
Submitter Checklist

[x] 📝 Please ensure your commit message is clear and informative. For guidance on crafting effective commit messages, refer to the How to write a git commit message guide. We prefer the commit message to be included in the PR body itself rather than a link to an external website (ie: Jira ticket).

[x] ♽ Before submitting a PR, run make test lint to avoid unnecessary CI processing. For an even more efficient workflow, consider installing pre-commit and running pre-commit install in the root of this repository.

[x] ✨ We use linters to maintain clean and consistent code. Please ensure you've run make lint before submitting a PR. Some linters offer a --fix mode, which can be executed with the command make fix-linters (ensure markdownlint and golangci-lint tools are installed first).

[x] ~📖 If you're introducing a user-facing feature or changing existing behavior, please ensure it's properly documented.~

[ ] 🧪 While 100% coverage isn't a requirement, we encourage unit tests for any code changes where possible.

[x] 🎁 ~If feasible, please check if an end-to-end test can be added. See README for more details.~

[x] 🔎 ~If there's any flakiness in the CI tests, don't necessarily ignore it. It's better to address the issue before merging, or provide a valid reason to bypass it if fixing isn't possible (e.g., token rate limitations).~

/ok-to-test

authors: chmouel ralphbean

repo: openshift-pipelines/pipelines-as-code


text:
[ART-3528] no need to push images

seems last etcd image left also can be deprecated since it didn't update for a long time

I don't know, would be safe to keep it for some time

repo: openshift/aos-cd-jobs


text:
Get rid of obsolete "compose" term in custom job definition

"Compose" was also a way of creating a repo; we stopped using that method, and that name is now wrong. This PR attempts to use a more consistent naming instead.

/lgtm

authors: locriandev thegreyd


text:
MGMT-7716: Add a template to deploy to console.redhat.com

Description

This will be used to deploy the image service to the console.redhat.com
SaaS service. IMAGE_TAG is dynamically filled based on deployment
configuration.
How was this code tested?

Deployed this template along with assisted-service on a crc cluster and successfully configured assisted-service to set infra-env download urls to the deployed image service.
Created an infra-env and successfully downloaded the image through a route I created pointing to image service service.
Assignees

/cc @osherdp
/cc @filanov
/cc @rporres
Links

https://issues.redhat.com/browse/MGMT-7716
Checklist

[x] Title and description added to both, commit and PR
[x] Relevant issues have been associated
[x] Reviewers have been listed
[x] This change does not require a documentation update (docstring, docs, README, etc)
[ ] Does this change include unit tests (note that code changes require unit tests)

/lgtm
consider adding PodDisruptionBudget as well. It made a great difference when we started incorporating it into assisted-service

/hold
I'll add it here, forgot

/unhold

/lgtm

authors: carbonin osherdp

repo: openshift/assisted-image-service


text:
Validates vCPU quota for region on account initialization

Adds vCPU quota validation for new accounts
Some AWS accounts have been created below the standard vCPU quota request limit, causing failures when installing OpenShift clusters.
This change:

Retrieves the desired configuration (vCPU quota included) from the operator configmap ("vcpu.quota")
Checks the desired quota against the existing quota for each region
If the existing quota is too low, checks to see if a request to increase quota has already been submitted
If a request has not yet been submitted, requests an increase in quota

Note: A new value will need to be added to the configMap for the operator - vcpu.quota - with the desired quota value. This change will have no effect if it is not added, defaulting to 0 and believing that no quota increase is required.
This should also be included in the configMap created by #467, though it is only necessary for testing locally.
REF: https://issues.redhat.com/browse/OSD-4821
Signed-off-by: Christopher Collins collins.christopher@gmail.com

/hold
Requires/Incorporates #460

@fahlmant: Rebased!

@rogbas to test and comment

/hold cancel

Overall this looks good, we can merge next Monday Oct 5th.
/hold

/retest

Rebased off master (Go Modules support)

/lgtm

/lgtm
/approve

/hold cancel

authors: clcollins iamkirkbater rogbas

repo: openshift/aws-account-operator


text:
Initialize only the Regions available in the cluster account

During the region initialization phase, initialize only the regions enabled for the account, instead of using a hardcoded array of covered regions.
Card: https://issues.redhat.com/browse/OSD-6825

/hold

Given that we're moving away from this static list, maybe moving the ami IDs into a configmap would help here? In case the ami IDs change. Then a configmap update would be required, rather than a full new deploy of the operator.

Still missing a few region AMIs since the regions are taking a while to initialize

Given that we're moving away from this static list, maybe moving the ami IDs into a configmap would help here? In case the ami IDs change. Then a configmap update would be required, rather than a full new deploy of the operator.

I think this would be a good change

/hold

/hold cancel

Codecov Report

Merging #561 (324da7b) into master (50eb9ff) will decrease coverage by 0.21%.
The diff coverage is 0.00%.

@@            Coverage Diff             @@
##           master     #561      +/-   ##
==========================================
- Coverage   13.46%   13.24%   -0.22%
==========================================
  Files          44       44
  Lines        3774     3835      +61
==========================================
  Hits          508      508
- Misses       3243     3304      +61
  Partials       23       23

Impacted Files
Coverage Δ

pkg/awsclient/client.go
0.00% <0.00%> (ø)

pkg/controller/account/account_controller.go
0.36% <0.00%> (-0.03%)
:arrow_down:

pkg/controller/account/ec2.go
0.00% <0.00%> (ø)

/label tide/merge-method-squash

/lgtm

authors: ArielLima cblecker codecov-commenter fahlmant iamkirkbater


text:
Better config merge and validation

When merging config files, check for duplicates and warn (during runtime) or error out (in CI) when a dupes are there.
Add some primitive config validation -- check that all the file/dir entries are absolute and cleaned paths, also checks for duplicates.
Add some test cases.
Please review commit-by-commit, and check individual commit messages for details.
Fixes: #94
Fixes: #93

nice
/lgtm

authors: kolyshkin rphillips

repo: openshift/check-payload


text:
Update docs

Update developer documentation with relevant information.

I think, it would be nice to have a links to CAPI documentation, where Cluster, ClusterInfrastructure and another objects are described.  It might go to smth like "see also" sections within controller's related pages.

/lgtm

This is just a docs update, we don't need to rerun CI constantly
/override ci/prow/e2e-azure-techpreview

authors: JoelSpeed alexander-demichev lobziik

repo: openshift/cluster-capi-operator


text:
controllers: ensure all status update of clusterdeployment have valid clusterversion

The clusterdeployment controller makes an early attempt to fixup the clusterversion field so that it passes validation. However, there are some other controllers that race with the clusterdeployment controller to write to the status of a clusterdeployment. When one of the other controllers wins the race, that update fails and emits an error log entry. To avoid the race, the logic for fixing up the clusterversion field has been moved to a wrapper around the status client. Consequently, every update of a clusterdeployment by every controller will fixup the clusterversion prior to making the update.

This fixes error like the following.
time="2019-10-01T09:44:38Z" level=error msg="cannot update cluster deployment secrets not found condition" clusterDeployment=ci-cluster-v4-1 controller=controlPlaneCerts error="ClusterDeployment.hive.openshift.io "ci-cluster-v4-1" is invalid: []: Invalid value: map[string]interface {}{"apiVersion":"hive.openshift.io/v1alpha1", "kind":"ClusterDeployment", "metadata":map[string]interface {}{"clusterName":"", "name":"ci-cluster-v4-1", "namespace":"uhc-production-18gd40ssuh68cnvf2drv78fcnev41kl9", "uid":"15d0172e-e430-11e9-b882-0e1fca4ea924", "generation":1, "creationTimestamp":"2019-10-01T09:44:38Z", "labels":map[string]interface {}{"api.openshift.com/environment":"production", "api.openshift.com/id":"18gd40ssuh68cnvf2drv78fcnev41kl9", "api.openshift.com/managed":"true", "api.openshift.com/name":"ci-cluster-v4-1", "hive.openshift.io/cluster-type":"managed"}, "resourceVersion":"66662535"}, "spec":map[string]interface {}{"baseDomain":"s2l7.p1.openshiftapps.com", "networking":map[string]interface {}{"clusterNetworks":[]interface {}{map[string]interface {}{"cidr":"10.128.0.0/14", "hostSubnetLength":23}}, "machineCIDR":"10.0.0.0/16", "serviceCIDR":"172.30.0.0/16", "type":"OpenShiftSDN"}, "controlPlaneConfig":map[string]interface {}{"servingCertificates":map[string]interface {}{"default":"primary-cert-bundle"}}, "platform":map[string]interface {}{"aws":map[string]interface {}{"region":"us-east-1"}}, "compute":[]interface {}{map[string]interface {}{"platform":map[string]interface {}{"aws":map[string]interface {}{"type":"m5.xlarge", "zones":[]interface {}{"us-east-1a"}, "rootVolume":map[string]interface {}{"iops":100, "size":300, "type":"gp2"}}}, "replicas":4, "name":"worker"}}, "sshKey":map[string]interface {}{"name":"ssh"}, "imageSet":map[string]interface {}{"name":"openshift-v4.1.18"}, "manageDNS":true, "clusterName":"ci-cluster-v4-1", "controlPlane":map[string]interface {}{"platform":map[string]interface {}{"aws":map[string]interface {}{"rootVolume":map[string]interface {}
{"type":"gp2", "iops":100, "size":32}
, "type":"m5.xlarge", "zones":[]interface {}{"us-east-1a"}}}, "replicas":3, "name":"master"}, "certificateBundles":[]interface {}{map[string]interface {}{"generate":true, "name":"primary-cert-bundle", "secretRef":map[string]interface {}{"name":"primary-cert-bundle-secret"}}}, "pullSecret":map[string]interface {}{"name":"pull"}, "images":map[string]interface {}{}, "ingress":[]interface {}{map[string]interface {}{"name":"default", "servingCertificate":"primary-cert-bundle", "domain":"apps.ci-cluster-v4-1.s2l7.p1.openshiftapps.com"}}, "platformSecrets":map[string]interface {}{"aws":map[string]interface {}{"credentials":map[string]interface {}{"name":"aws"}}}, "installed":false}, "status":map[string]interface {}{"clusterVersionStatus":map[string]interface {}{"desired":map[string]interface {}{"version":"", "image":"", "force":false}, "observedGeneration":0, "versionHash":"", "availableUpdates":interface {}(nil)}, "conditions":[]interface {}{map[string]interface {}{"reason":"ControlPlaneCertificatesNotFound", "message":"One or more serving certificates for the cluster control plane are missing", "type":"ControlPlaneCertificateNotFound", "status":"True", "lastProbeTime":"2019-10-01T09:44:38Z", "lastTransitionTime":"2019-10-01T09:44:38Z"}}, "installed":false, "adminKubeconfigSecret":map[string]interface {}{}, "adminPasswordSecret":map[string]interface {}{}}}: validation failure list:\nstatus.clusterVersionStatus.availableUpdates in body must be of type array: "null"" namespace=uhc-production-18gd40ssuh68cnvf2drv78fcnev41kl9

Neat.
/lgtm

/lgtm cancel
Conflicts need to be resolved

/lgtm

/retest

/lgtm

authors: LalatenduMohanty abutcher dgoodwin joelddiaz staebler

repo: openshift/hive


text:
cli: Improve destroy retry handling

Make destroy commands retry until they either succeed or are cancelled.

/test e2e-aws

/test e2e-aws

/lgtm

authors: ironcladlou sjenning

repo: openshift/hypershift


text:
OCPBUGS-42434: Authenticate CAPZ with cert authentication on ARO HCP

What this PR does / why we need it:
This PR authenticates CAPZ with certificate authentication in order to communicate with Azure Cloud API. The certificate is stored in an Azure key vault and mounted into the capi-provider pod through a Secrets Store CSI driver SecretProviderClass.
Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #
Checklist

[ ] Subject and description added to both, commit and PR.
[ ] Relevant issues have been referenced.
[ ] This change includes docs.
[ ] This change includes unit tests.

/close
in favor of https://github.com/openshift/hypershift/pull/5160


text:
Vanilla Kube Capability: Non-root Security Context

Set Non-root Security Context for Vanilla Kubernetes cluster

This PR leverages Management Cluster Capability to determine SCC feature and adds securityContext

@alvaroaleman I will just close this and create a new PR with the needed changes.
Agreed! too many unnecessary commits.


text:
Create OpenShift Resource(s) task tries to create resource in wrong project

Using the "Create OpenShift Resource(s)" task it tries to create the resource in the same project as the Jenkins service run in even when specifying another project in the task configuration.

job execution log

Yep, we don't currently parse the json/yaml for namespace specifications and adjust the REST call accordingly.  Same goes for the resource deletion steps.
We minimally need to document the behavior, if not change the implementation to handle this.
@bparees - any initial opinions on what we want to do here (I'm leaning toward code change, but with the background around create/delete, I don't think it is a given)

not certain i understand the behavior.
if the resource being created does NOT itself define a namespace in the metadata, does it get created in the namespace defined by the build step (and defaults to the current jenkins namespace)?
and if the resource does define a namespace in the metadata, does it get created in that namespace?

On Fri, Jul 1, 2016 at 11:32 AM, Ben Parees notifications@github.com
wrote:

not certain i understand the behavior.
if the resource being created does NOT itself define a namespace in the
metadata, does it get created in the namespace defined by the build step
(and defaults to the current jenkins namespace)?
and if the resource does define a namespace in the metadata, does it get
created in that namespace?

Right now the create build step always creates all resources in the
namespace specified  in the create build step config (or if none is
specified there, it uses the namespace of the jenkins service mounted into
the pod
for all objects it creates), using the auth token specified (where if if
none is specified, it using the one for the service account mounted into
the pod).
It ignores any specification of resource in the JSON/YAML.   Aside from
doing basic JSON/YAML format verification, we stop parsing the JSON at the
'kind' (we need to know the 'kind'
to know which REST endpoint to hit).
Manipulating resources in other namespaces of course gets into either
giving the jenkins serivce account  edit access to those namespaces, or
providing auth tokens for any namespace
noted in the JSON/YAML.
If we want to go down this path, the timing of any changes is also a
consideration (at some point we'll want to move to a newer version of the
openshift-restclient-java component, where they
have improved the API around generic resource creation, which we might want
to switch to).

—
You are receiving this because you were assigned.
Reply to this email directly, view it on GitHub
https://github.com/openshift/jenkins-plugin/issues/45#issuecomment-229977523,
or mute the thread
https://github.com/notifications/unsubscribe/ADbadP4XwcAx5-FO40lyrbJLnMmYJdIXks5qRTMTgaJpZM4JDF2B
.

what does "oc create -f foo.yaml -n somenamespace" do when foo.yaml specifies a namespace?  we should expect to align with that.

On Fri, Jul 1, 2016 at 2:34 PM, Ben Parees notifications@github.com wrote:

what does "oc create -f foo.yaml -n somenamespace" do when foo.yaml
specifies a namespace? we should expect to align with that.

Good point.  Unless someone beats me to it, I'll give it a go next chance I
get, report back, and we'll go from there.

—
You are receiving this because you were assigned.
Reply to this email directly, view it on GitHub
https://github.com/openshift/jenkins-plugin/issues/45#issuecomment-230018130,
or mute the thread
https://github.com/notifications/unsubscribe/ADbadKZiGr7jV73R12wudEyzGopf-miDks5qRV2rgaJpZM4JDF2B
.

Note that in this case I did NOT set a namespace in the yaml text field.
I did however put a namespace/projectname in the text filed that say "The name of the project to create the resource in". However this namespace/projectname is ignored.

FYI - I've reproduced this and am working on a fix.

So I believe the problem where the namespace specified in the build step field was not used was introduced with commit 373afaa904f1db7af62f967a11f82e81b857216e (from about 4 weeks ago).
This bug actually affects all the build steps, not just the create resources one.  So I'm bumping the priority to p2.
With the fix I will soon commit, if you specify a project that is different from the project jenkins is running in, as well as the associated default service account token for said project, and as well as providing the default service account token edit access for said project, you can create resources.
For honoring the namespace within the json/yaml, I'm going to look into a fix of the following form:

the token provided to the step has been given edit access to any project listed in the json/yaml (the doc will be updated with this requirement); I don't want to introduce a change where we specify multiple tokens for each project
i'll then fetch a rest client to the specific namespace as part of processing each resource

If this change proves straightforward, I'll include it in the fix as well.  Otherwise, I'll just incorporate the fix to honor the namespace, and document the restriction of not honoring the namespace in the json/yaml for now, and track lifting this restriction our trello card that is handling rebasing the plugin on the newer version of the rest client.

OK, I got the pulling of the namespace from the json/yaml working easily enough.  Will include this change, along with the doc updates mentioned previously around permissions for the service account.

Delivered fixes with https://github.com/openshift/jenkins-plugin/commit/895c47ba363b3524df70adba40f3b001daf46108
Built, pre-release version of the plugin with this change can be found here
When it comes out, V1.0.21 will be the official release with the fix.
Closing this out - please reopen if something does not seem right wrt the fix provided.

authors: bparees gabemontero ullgren

repo: openshift/jenkins-plugin


text:
Refactor: use class pattern in pattern matching

Description
Use class pattern in pattern matching
Type of change

[x] Refactor
[ ] New feature
[ ] Bug fix
[ ] CVE fix
[ ] Optimization
[ ] Documentation Update
[ ] Configuration Update
[ ] Bump-up dependent library
[ ] Bump-up library or tool used for development (does not change the final image)

Codecov Report
Attention: Patch coverage is 88.88889% with 1 line in your changes missing coverage. Please review.

Project coverage is 94.83%. Comparing base (d3076b3) to head (14e2903).
Report is 52 commits behind head on main.

Files with missing lines
Patch %
Lines

ols/utils/errors_parsing.py
88.88%
1 Missing :warning:

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1542      +/-   ##
==========================================
+ Coverage   94.75%   94.83%   +0.07%
==========================================
  Files          59       60       +1
  Lines        2631     2671      +40
==========================================
+ Hits         2493     2533      +40
  Misses        138      138

Files with missing lines
Coverage Δ

ols/utils/errors_parsing.py
72.97% <88.88%> (+1.54%)
:arrow_up:

/retest

/retest

/retest

/approve

/lgtm

/approve

/override "Red Hat Konflux / lightspeed-service-on-pull-request"

authors: codecov-commenter syedriko tisnik

repo: openshift/lightspeed-service


text:
Issues when deploying workflows in non-default namespaces

I'm using Openshift 4.14.8 with metallb operator version 4.14.0.
When I deploy an LB in the default namespace it works as expected however deploying into a non-default namespace the LB is created and assigned an IP address but no traffic makes it to the pod.  The LB service has an endpoint which is the correct IP of the target pod.
I've confirmed that APR responses are being sent and I have run tcpdump on the node and can see traffic however running tcpdump within the container I don't see any traffic.
Deploying the same workload in the default namespace works fine so it leads me to there is a policy blocking something but I can't find any useful information.

I think this might have something to do with deploying into a namespace that also has openshift service mesh (istio) deployed.
If I deploy into a namespace without "istio-injection: enabled" label I don't see the problem.
I see the issue whether the istio-proxy sidecar is injected or not.
Is there any known limitation of using LoadBalancer service in the same namespace that has service mesh installed?
It worth adding, that I don't see this issue in a vanilla install of kubernetes

I found this page which helped with the issue.
https://access.redhat.com/solutions/6958603

repo: openshift/metallb-operator


text:
WIP: Remove /usr/libexec/cni from CRI-O conf

containernetworking-plugins RPM which is a dependency of CRI-O installs
CNIs to /usr/libexec/cni but we don't want to use them because as part
of Multus integration we will get CNIs from container image shipped
with OpenShift.

/test ?

/test microshift-metal-tests ocp-conformance-rhel-eus-arm

/lgtm

authors: eggfoobar pmtk

repo: openshift/microshift


text:
Implement Telemetry metrics for OADP operator

This task requires understanding what our operator needs to expose in order to be integrated into OCP's telemetry system. For reference, see mig-controller's implementation.

/remove-lifecycle rotten

/remove-lifecycle stale

@shubham-pampattiwar can this close?

Related PRs:
https://github.com/openshift/oadp-operator/pull/410
https://github.com/openshift/oadp-operator/pull/537
https://github.com/openshift/oadp-operator/pull/579
https://github.com/openshift/cluster-monitoring-operator/pull/1536

authors: dymurray kaovilai shubham-pampattiwar

repo: openshift/oadp-operator


text:
Speed up file copies for odo push

Which functionality do you think we should update/improve?
Speed of file copies in odo push. Odo file copies are significantly slower than direct rsync or tar via ssh.
Why is this needed?
Reduce inner loop time for developers

PR #1880 doesn't improve the user experience, but does improve the internal structure and (hidden) performance of the code. Next step: reduce the overhead in creating the remote "tar" command. A possible solution is to start a single "bash" command at the beginning of an odo session and re-use that for all remote commands that need to occur in sequence.

#1886 will re-use a command connection. After that is implemented, this code should be re-tested to see if it has real benefit before it is comitted.

repo: openshift/odo


text:
General improvements and updates to odo link

This is alternative version of https://github.com/openshift/odo/pull/4535 that doesn't support custom names of the service bindings

/ok-to-test

/retest

/retest

I don't think that this will work without a larger change.
Odo made some assumptions about the SBO Secret name, and it looks like last SBO version is generating Secret name with hash.
I'm currently working on fixing this so odo no longer depends on the Secret name.

Please rebase and update your pr to be against new default branch, main

@mohammedzee1000 sbo 0.7.0 was released that has different capabilities. Feel free to close/reuse those if needed.

We can close this PR
I will open a PR to address this soon.

authors: kadel mohammedzee1000 wtrocki


text:
crio.repo: switch to cri-o 1.23

Use https://build.opensuse.org/project/show/devel:kubic:libcontainers:stable:cri-o:1.23 as source of cri-o packages
Alternative to #274, which we won't have to pass through Bodhi process

Thanks @haircommander for doing the build :)
/lgtm

/test e2e-aws-upgrade

/override ci/prow/e2e-aws-upgrade
API disruption, not related to CRI-O

authors: LorbusChris vrutkovs

repo: openshift/okd-machine-os


text:
Bootstrap VM doesn't come up in OpenShift 4.2 vSphere Installation

Hi guys
I want to install okd 4.2 on vsphere 6.7 with OpenShift 4.2 vSphere Install Quickstart documentation. But bootstrap VM doesn't come up.
What is the reason?
Is there full and step by step installation document?
Thank you for your help

There is no OKD 4.2, which release payload and installer are you using?

There is no OKD 4.2, which release payload and installer are you using?

Thank you for reply.
I used OpenShift 4.2 vSphere Install Quickstart and openshift client and installation files

That is OCP 4.2, not okd 4.2. See https://docs.openshift.com/container-platform/4.2/support/getting-support.html

repo: openshift/okd


text:
OKD4.7 offline installation(openstack)

Hi Team,
I'm trying to install OKD 4.7 (4.7.0-0.okd-2021-05-22-050008) using mirror registry for offline installation(no internet), I'm able to see bootstrap node is able to pull the images from the mirror registry and when I execute "openshift-install --dir=install_dir/ wait-for bootstrap-complete --log-level=debug" command I'm able to see API is up but the master nodes are not able to pull the images from the mirror registry and I'm not able to ssh to any of the master nodes. is it possible to install OKD4.7 on a cluster without internet?

Please attach log bundle

the master nodes are not able to pull the images from the mirror registry

On this screen master is unable to provision at all

Hi @vrutkovs
Please find the attached log bundle.
log-bundle-20210906113141.tar.gz

Hi @vrutkovs
Is this a bug/ known issue? is there any workaround for this?
can you please let me know any solution on this.

No data collected from masters and apparently these never requested their Ignition.
Check LB configuration and network settings for masters

authors: Mohammed-Idrees vrutkovs


text:
Add soft-teardown option, which helps to save some time during redeployment

What does this PR do?
Add soft-teardown option, which helps to save some time during redeployment
How should this be manually tested?
Is there a relevant Issue open for this?
Who would you like to review this?
cc: @e-minguez PTAL

Basically only network and certificates will stay with soft-teardown, so it shouldn't cost anything.

repo: openshift/openshift-ansible-contrib


text:
Merge "Handle MissingAttributeError when using OOB inspections to fet…

…ch MACs"
(cherry picked from commit 47b778977c7d0224d55a5416f57a0bb36fa188e8) (cherry picked from commit e162f625664b184708a65d92b00941caf11af270)

/jira cherrypick OCPBUGS-13334

/jira refresh

repo: openshift/openstack-ironic