text:
Unit k3s.service has failed -- Defined-By: systemd  for a k3s with external DB

Version:

K3s arguments:
export K3S_DATASTORE_ENDPOINT="mysql://rajie:Scorpion@tcp(mysql.rajie.wiki:3306)/rancher"
curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--write-kubeconfig-mode 644 -t agent-secret --tls-san k3s.rajie.wiki --node-taint k3s-controlplane=true:NoExecute" sh -s - server
Describe the bug
[INFO]  Finding release for channel stable
[INFO]  Using v1.18.2+k3s1 as release
[INFO]  Downloading hash https://github.com/rancher/k3s/releases/download/v1.18.2+k3s1/sha256sum-amd64.txt
[INFO]  Skipping binary downloaded, installed k3s matches hash
[INFO]  Skipping /usr/local/bin/kubectl symlink to k3s, already exists
[INFO]  Skipping /usr/local/bin/crictl symlink to k3s, already exists
[INFO]  Skipping /usr/local/bin/ctr symlink to k3s, already exists
[INFO]  Creating killall script /usr/local/bin/k3s-killall.sh
[INFO]  Creating uninstall script /usr/local/bin/k3s-uninstall.sh
[INFO]  env: Creating environment file /etc/systemd/system/k3s.service.env
[INFO]  systemd: Creating service file /etc/systemd/system/k3s.service
[INFO]  systemd: Enabling k3s unit
Created symlink /etc/systemd/system/multi-user.target.wants/k3s.service → /etc/systemd/system/k3s.service.
[INFO]  systemd: Starting k3s
Job for k3s.service failed because the control process exited with error code.
See "systemctl status k3s.service" and "journalctl -xe" for details.

rajie@master:~$ sudo journalctl -xe
May 18 10:45:40 master systemd[1]: k3s.service: Service hold-off time over, scheduling restart.
May 18 10:45:40 master systemd[1]: k3s.service: Scheduled restart job, restart counter is at 4.
-- Subject: Automatic restarting of a unit has been scheduled
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Automatic restarting of the unit k3s.service has been scheduled, as the result for
-- the configured Restart= setting for the unit.
May 18 10:45:40 master systemd[1]: Stopped Lightweight Kubernetes.
-- Subject: Unit k3s.service has finished shutting down
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit k3s.service has finished shutting down.
May 18 10:45:40 master systemd[1]: Starting Lightweight Kubernetes...
-- Subject: Unit k3s.service has begun start-up
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit k3s.service has begun starting up.
May 18 10:45:40 master k3s[6003]: time="2020-05-18T10:45:40.836759299+05:30" level=info msg="Starting k3s v1.18.2+k3s1
May 18 10:45:40 master k3s[6003]: time="2020-05-18T10:45:40.844976831+05:30" level=fatal msg="starting kubernetes: prep
May 18 10:45:40 master systemd[1]: k3s.service: Main process exited, code=exited, status=1/FAILURE
May 18 10:45:40 master systemd[1]: k3s.service: Failed with result 'exit-code'.
May 18 10:45:40 master systemd[1]: Failed to start Lightweight Kubernetes.
-- Subject: Unit k3s.service has failed
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit k3s.service has failed.
--
-- The result is RESULT.
May 18 10:45:41 master sudo[6031]:    rajie : TTY=pts/5 ; PWD=/home/rajie ; USER=root ; COMMAND=/bin/journalctl -xe
May 18 10:45:41 master sudo[6031]: pam_unix(sudo:session): session opened for user root by rajie(uid=0)

To Reproduce
Step 1: https://rancher.com/docs/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/
Step 2: https://rancher.com/docs/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/
Expected behavior
k3s service should start
Actual behavior
Unit k3s.service has failed.
Additional Info
Configured a TCP load balancer as documented in https://rancher.com/docs/rancher/v2.x/en/installation/options/nginx/

Can you provide full k3s log output from the journal? There's not really enough provided to figure out why it's crashing.

Here's the output:
rajie@master:~$ sudo tail -f /var/log/syslog
May 18 07:17:00 master k3s[23546]: time="2020-05-18T12:47:00.033463480+05:30" level=info msg="Starting k3s v1.18.2+k3s1 (698e444a)"
May 18 07:17:00 master k3s[23546]: time="2020-05-18T12:47:00.044250493+05:30" level=fatal msg="starting kubernetes: preparing server: creating storage endpoint: building kine: dial tcp 45.79.122.91:3306: connect: connection refused"
May 18 07:17:00 master systemd[1]: k3s.service: Main process exited, code=exited, status=1/FAILURE
May 18 07:17:00 master systemd[1]: k3s.service: Failed with result 'exit-code'.
May 18 07:17:00 master systemd[1]: Failed to start Lightweight Kubernetes.
May 18 07:17:01 master CRON[23574]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
May 18 07:17:05 master systemd[1]: k3s.service: Service hold-off time over, scheduling restart.
May 18 07:17:05 master systemd[1]: k3s.service: Scheduled restart job, restart counter is at 1320.
May 18 07:17:05 master systemd[1]: Stopped Lightweight Kubernetes.
May 18 07:17:05 master systemd[1]: Starting Lightweight Kubernetes...
May 18 07:17:05 master k3s[23578]: time="2020-05-18T12:47:05.550195214+05:30" level=info msg="Starting k3s v1.18.2+k3s1 (698e444a)"
May 18 07:17:05 master k3s[23578]: time="2020-05-18T12:47:05.555762461+05:30" level=fatal msg="starting kubernetes: preparing server: creating storage endpoint: building kine: dial tcp 45.79.122.91:3306: connect: connection refused"
May 18 07:17:05 master systemd[1]: k3s.service: Main process exited, code=exited, status=1/FAILURE
May 18 07:17:05 master systemd[1]: k3s.service: Failed with result 'exit-code'.
May 18 07:17:05 master systemd[1]: Failed to start Lightweight Kubernetes.
May 18 07:17:10 master systemd[1]: k3s.service: Service hold-off time over, scheduling restart.
May 18 07:17:10 master systemd[1]: k3s.service: Scheduled restart job, restart counter is at 1321.
May 18 07:17:10 master systemd[1]: Stopped Lightweight Kubernetes.
May 18 07:17:10 master systemd[1]: Starting Lightweight Kubernetes...
May 18 07:17:11 master k3s[23618]: time="2020-05-18T12:47:11.078974549+05:30" level=info msg="Starting k3s v1.18.2+k3s1 (698e444a)"
May 18 07:17:11 master k3s[23618]: time="2020-05-18T12:47:11.091168596+05:30" level=fatal msg="starting kubernetes: preparing server: creating storage endpoint: building kine: dial tcp 45.79.122.91:3306: connect: connection refused"
May 18 07:17:11 master systemd[1]: k3s.service: Main process exited, code=exited, status=1/FAILURE
May 18 07:17:11 master systemd[1]: k3s.service: Failed with result 'exit-code'.
May 18 07:17:11 master systemd[1]: Failed to start Lightweight Kubernetes.
May 18 07:17:16 master systemd[1]: k3s.service: Service hold-off time over, scheduling restart.
May 18 07:17:16 master systemd[1]: k3s.service: Scheduled restart job, restart counter is at 1322.
May 18 07:17:16 master systemd[1]: Stopped Lightweight Kubernetes.
May 18 07:17:16 master systemd[1]: Starting Lightweight Kubernetes...
May 18 07:17:16 master k3s[23665]: time="2020-05-18T12:47:16.580108618+05:30" level=info msg="Starting k3s v1.18.2+k3s1 (698e444a)"
May 18 07:17:16 master k3s[23665]: time="2020-05-18T12:47:16.588431802+05:30" level=fatal msg="starting kubernetes: preparing server: creating storage endpoint: building kine: dial tcp 45.79.122.91:3306: connect: connection refused"
May 18 07:17:16 master systemd[1]: k3s.service: Main process exited, code=exited, status=1/FAILURE
May 18 07:17:16 master systemd[1]: k3s.service: Failed with result 'exit-code'.
May 18 07:17:16 master systemd[1]: Failed to start Lightweight Kubernetes.
May 18 07:17:21 master systemd[1]: k3s.service: Service hold-off time over, scheduling restart.
May 18 07:17:21 master systemd[1]: k3s.service: Scheduled restart job, restart counter is at 1323.
May 18 07:17:21 master systemd[1]: Stopped Lightweight Kubernetes.
May 18 07:17:21 master systemd[1]: Starting Lightweight Kubernetes...
May 18 07:17:22 master k3s[23703]: time="2020-05-18T12:47:22.073338279+05:30" level=info msg="Starting k3s v1.18.2+k3s1 (698e444a)"

Can you provide full k3s log output from the systemd journal? There's not really enough provided to figure out why it's crashing.

thanks for the response @brandond  I am new to k3s...could you please let me know how to get the full k3s log?

May 18 07:17:16 master k3s[23665]: time="2020-05-18T12:47:16.588431802+05:30" level=fatal msg="starting kubernetes: preparing server: creating storage endpoint: building kine: dial tcp 45.79.122.91:3306: connect: connection refused"

May 18 07:17:16 master k3s[23665]: time="2020-05-18T12:47:16.588431802+05:30" level=fatal msg="starting kubernetes: preparing server: creating storage endpoint: building kine: dial tcp 45.79.122.91:3306: connect: connection refused"

Is MySQL running or blocked via firewall?
Is this the one you are referring to:
May 18 09:18:21 master k3s[13034]: time="2020-05-18T14:48:21.118757122+05:30" level=fatal msg="starting kubernetes: preparing server: creating storage endpoint: building kine: driver: bad connection"

May 18 07:17:16 master k3s[23665]: time="2020-05-18T12:47:16.588431802+05:30" level=fatal msg="starting kubernetes: preparing server: creating storage endpoint: building kine: dial tcp 45.79.122.91:3306: connect: connection refused"

Is MySQL running or blocked via firewall?
Is this the one you are referring to:
May 18 09:18:21 master k3s[13034]: time="2020-05-18T14:48:21.118757122+05:30" level=fatal msg="starting kubernetes: preparing server: creating storage endpoint: building kine: driver: bad connection"

@dweomer Thanks for the response.
Here's what my mysql machine reads:
rajie@mysql:~$ sudo ufw status
Status: active
To                         Action      From

22/tcp                     ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
443/tcp                    ALLOW       Anywhere
6443/tcp                   ALLOW       Anywhere
3306/tcp                   ALLOW       Anywhere
Anywhere                   ALLOW       45.79.123.93
22/tcp (v6)                ALLOW       Anywhere (v6)
80/tcp (v6)                ALLOW       Anywhere (v6)
443/tcp (v6)               ALLOW       Anywhere (v6)
6443/tcp (v6)              ALLOW       Anywhere (v6)
3306/tcp (v6)              ALLOW       Anywhere (v6)
3306/tcp                   ALLOW OUT   Anywhere
3306/tcp (v6)              ALLOW OUT   Anywhere (v6)

Here's the output from the log:
rajie@master:~$ sudo tail -f /var/log/syslog
May 18 10:49:50 master systemd[1]: k3s.service: Failed to schedule restart job: Unit k3s.service not found.
May 18 10:49:50 master systemd[1]: k3s.service: Failed with result 'exit-code'.
May 18 10:49:50 master systemd[1]: Reloading.
May 18 10:49:51 master systemd[1]: Reloading.
May 18 10:55:01 master CRON[17533]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
May 18 11:01:46 master systemd[1]: Started Session 915 of user rajie.
May 18 11:02:18 master systemd[1]: Reloading.
May 18 11:02:19 master systemd[1]: Reloading.
May 18 11:02:19 master systemd[1]: Reloading.
May 18 11:05:01 master CRON[17825]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)

@Rajakavitha1 The command you're looking for is: journalctl -u k3s --no-pager --no-hostname. Tailing syslog still just gives small chunks of logs, insufficient to do any real troubleshooting.
I agree with  @dweomer though - it sure looks like an error connecting to your datastore. Have you confirmed that your k3s host can connect to the mysql server atmysql.rajie.wiki:3306?

Hi @brandond  Here's the output of journalctl -u k3s --no-pager --no-hostname:
May 18 16:19:49 systemd[1]: k3s.service: Service hold-off time over, scheduling restart.
May 18 16:19:49 systemd[1]: k3s.service: Scheduled restart job, restart counter is at 997.
May 18 16:19:49 systemd[1]: Stopped Lightweight Kubernetes.
May 18 16:19:49 systemd[1]: Starting Lightweight Kubernetes...
May 18 16:19:50 k3s[17397]: time="2020-05-18T16:19:50.029404362+05:30" level=info msg="Starting k3s v1.18.2+k3s1 (698e444a)"
May 18 16:19:50 k3s[17397]: time="2020-05-18T16:19:50.036498014+05:30" level=info msg="Cluster bootstrap already complete"
May 18 16:19:50 k3s[17397]: [mysql] 2020/05/18 16:19:50 packets.go:36: unexpected EOF
May 18 16:19:50 k3s[17397]: [mysql] 2020/05/18 16:19:50 packets.go:36: unexpected EOF
May 18 16:19:50 k3s[17397]: http: TLS handshake error from 45.79.124.109:36354: remote error: tls: bad certificate
May 18 16:19:50 k3s[17397]: [mysql] 2020/05/18 16:19:50 packets.go:36: unexpected EOF
May 18 16:19:50 k3s[17397]: time="2020-05-18T16:19:50.076362083+05:30" level=fatal msg="starting kubernetes: preparing server: creating storage endpoint: building kine: driver: bad connection"
May 18 16:19:50 systemd[1]: k3s.service: Main process exited, code=exited, status=1/FAILURE
May 18 16:19:50 systemd[1]: k3s.service: Failed with result 'exit-code'.
May 18 16:19:50 systemd[1]: Failed to start Lightweight Kubernetes.
May 18 16:19:50 systemd[1]: k3s.service: Service hold-off time over, scheduling restart.
May 18 16:19:50 systemd[1]: k3s.service: Failed to schedule restart job: Unit k3s.service not found.
May 18 16:19:50 systemd[1]: k3s.service: Failed with result 'exit-code'.

Did you check to see if you can actually get to the MySQL server?

Did you check to see if you can actually get to the MySQL server?

Yes, I am able to connect
rajie@master:~$ sudo mysql -urajie -pScorpion -h 45.79.125.20
[sudo] password for rajie:
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 30
Server version: 10.1.44-MariaDB-0ubuntu0.18.04.1 Ubuntu 18.04
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> exit
Bye
rajie@master:~$ export K3S_DATASTORE_ENDPOINT="mysql://rajie:password@tcp(mysql.rajie.wiki:3306)/rancher"
rajie@master:~$ curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--write-kubeconfig-mode 644 -t agent-secret --tls-san k3s.rajie.wiki --node-taint k3s-controlplane=true:NoExecute" sh -s - server
[INFO]  Finding release for channel stable
[INFO]  Using v1.18.2+k3s1 as release
[INFO]  Downloading hash https://github.com/rancher/k3s/releases/download/v1.18.2+k3s1/sha256sum-amd64.txt
[INFO]  Skipping binary downloaded, installed k3s matches hash
[INFO]  Skipping /usr/local/bin/kubectl symlink to k3s, already exists
[INFO]  Skipping /usr/local/bin/crictl symlink to k3s, already exists
[INFO]  Skipping /usr/local/bin/ctr symlink to k3s, already exists
[INFO]  Creating killall script /usr/local/bin/k3s-killall.sh
[INFO]  Creating uninstall script /usr/local/bin/k3s-uninstall.sh
[INFO]  env: Creating environment file /etc/systemd/system/k3s.service.env
[INFO]  systemd: Creating service file /etc/systemd/system/k3s.service
[INFO]  systemd: Enabling k3s unit
Created symlink /etc/systemd/system/multi-user.target.wants/k3s.service → /etc/systemd/system/k3s.service.
[INFO]  systemd: Starting k3s
Job for k3s.service failed because the control process exited with error code.
See "systemctl status k3s.service" and "journalctl -xe" for details.

Here's the log:
19 09:06:42 systemd[1]: k3s.service: Service hold-off time over, scheduling restart.
May 19 09:06:42 systemd[1]: k3s.service: Scheduled restart job, restart counter is at 22.
May 19 09:06:42 systemd[1]: Stopped Lightweight Kubernetes.
May 19 09:06:42 systemd[1]: Starting Lightweight Kubernetes...
May 19 09:06:43 k3s[22408]: time="2020-05-19T09:06:43.344622856+05:30" level=info msg="Starting k3s v1.18.2+k3s1 (698e444a)"
May 19 09:06:43 k3s[22408]: time="2020-05-19T09:06:43.348752556+05:30" level=info msg="Cluster bootstrap already complete"
May 19 09:06:43 k3s[22408]: time="2020-05-19T09:06:43.377182469+05:30" level=fatal msg="starting kubernetes: preparing server: creating storage endpoint: building kine: Error 1045: Access denied for user 'rajie'@'li2120-91.members.linode.com' (using password: YES)"
May 19 09:06:43 systemd[1]: k3s.service: Main process exited, code=exited, status=1/FAILURE
May 19 09:06:43 systemd[1]: k3s.service: Failed with result 'exit-code'.
May 19 09:06:43 systemd[1]: Failed to start Lightweight Kubernetes.
May 19 09:06:48 systemd[1]: k3s.service: Service hold-off time over, scheduling restart.
May 19 09:06:48 systemd[1]: k3s.service: Scheduled restart job, restart counter is at 23.
May 19 09:06:48 systemd[1]: Stopped Lightweight Kubernetes.
May 19 09:06:48 systemd[1]: Starting Lightweight Kubernetes...
May 19 09:06:48 k3s[22450]: time="2020-05-19T09:06:48.820053847+05:30" level=info msg="Starting k3s v1.18.2+k3s1 (698e444a)"
May 19 09:06:48 k3s[22450]: time="2020-05-19T09:06:48.824879737+05:30" level=info msg="Cluster bootstrap already complete"
May 19 09:06:48 k3s[22450]: time="2020-05-19T09:06:48.855055805+05:30" level=fatal msg="starting kubernetes: preparing server: creating storage endpoint: building kine: Error 1045: Access denied for user 'rajie'@'li2120-91.members.linode.com' (using password: YES)"
May 19 09:06:48 systemd[1]: k3s.service: Main process exited, code=exited, status=1/FAILURE
May 19 09:06:48 systemd[1]: k3s.service: Failed with result 'exit-code'.

@brandond and @dweomer Please help me with
msg="starting kubernetes: preparing server: creating storage endpoint: building kine: Error 1071: Specified key was too long; max key length is 767 bytes"

upgrading mariadb to 10.4 resolved the issue. However, i facing a new issue now:
rajie@master:~$ sudo kubectl get nodes
[sudo] password for rajie:
Unable to connect to the server: x509: certificate signed by unknown authority
rajie@master:~$ kubectl version --short
Client Version: v1.18.2+k3s1
Unable to connect to the server: x509: certificate signed by unknown authority
rajie@master:~$ sudo systemctl status k3s
● k3s.service - Lightweight Kubernetes
Loaded: loaded (/etc/systemd/system/k3s.service; enabled; vendor preset: enabled)
Active: active (running) since Tue 2020-05-19 10:13:26 IST; 13min ago
Docs: https://k3s.io
Process: 14219 ExecStartPre=/sbin/modprobe overlay (code=exited, status=0/SUCCESS)
Process: 14215 ExecStartPre=/sbin/modprobe br_netfilter (code=exited, status=0/SUCCESS)
Main PID: 14224 (k3s-server)
Tasks: 9
CGroup: /system.slice/k3s.service
├─14224 /usr/local/bin/k3s server --write-kubeconfig-mode 644 -t agent-secret --tls-san k3s.rajie.wiki --node-taint
└─14252 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock -

Are all of your nodes on the same LAN? If not, did you configure their public IPs with the --node-external-ip option?

Are all of your nodes on the same LAN? If not, did you configure their public IPs with the --node-external-ip option?

let me check that...

Are all of your nodes on the same LAN? If not, did you configure their public IPs with the --node-external-ip option?

let me check that...

Thank you @brandond I was able to resolve the issue I now have:
rajie@master2:~$ kubectl get nodes
NAME      STATUS   ROLES    AGE    VERSION
master    Ready    master   168m   v1.18.2+k3s1
master2   Ready    master   61m    v1.18.2+k3s1

Closing this issue. However, it might be worth documenting about mariadb 10.4 as a requirement.

authors: Rajakavitha1 brandond dweomer


text:
WIP: Use strato as os-base base image

small update to  #1478 (after rebase)

ok
--- QemuSuite.TestAutoResize: qemu stopped
170s
1800
----------------------------------------------------------------------
170s
1801
FAIL: installer_test.go:122: QemuSuite.TestAutoResize
170s
1803
installer_test.go:157:
170s
1804
    s.CheckOutput(c, disk, Equals, "blkid | cut -f 1 -d ' ' | sed 's/://'")
170s
1805
common_test.go:162:
170s
1806
    c.Assert(out, check, result)
170s
1807
... obtained string = ""
170s
1808
... expected string = "/dev/vda1\n"

cloud-init-execute_1 | > time="2017-06-06T02:25:22Z" level=info msg="Running cloud-init-execute: pre-console=true, console=false"
cloud-init-execute_1 | FAILED: sfdisk not found
cloud-init-execute_1 | resize2fs 1.43.3 (04-Sep-2016)
cloud-init-execute_1 | The filesystem is already 2620928 (4k) blocks long.  Nothing to do!
cloud-init-execute_1 |

this is waiting on https://github.com/rancher/strato/pull/21, and then I'll push an 0.3.0 set of packages and update this PR to use that.

source: gharchive/pull-request

repo: rancher/os

license_type: permissive

license_source: github-api


text:
Shouldn't allow spaces in username

Rancher versions: 2.0 master 2/28
Steps to Reproduce:

Create a user and have their username be "A B"

Results:  Allows spaces in username

@vincent99 can you give your two cents on this?
I believe you mentioned previously that we should not restrict this field to the typical basic ascii because of internationalization.
There is no technical reason on the backend to restrict " ", but I'll do it if you want.

I don't see any reason to restrict the charset of the username, unless they're indexed somewhere (which would mean a-z lowercase 0-9 and hyphen only)...

ok, will go with that. Assigning back over to @tfiduccia for QA consideration

source: gharchive/issue

authors: cjellick tfiduccia vincent99

repo: rancher/rancher


text:
Support Graylog as logging target

Please add support for @lennartkoopmann's Graylog (and it's GELF format) https://github.com/graylog2 to the logging settings of clusters and projects.
gz#12973

Hopefully we can add it into v2.2
Maybe we can use https://github.com/bodhi-space/fluent-plugin-gelf-hs as the Fluentd plugin

+1
I would also be interested in GELF support in the Rancher logging settings.

As a workaround it's possible to use https://github.com/fluent/fluentd-kubernetes-daemonset. Based on this tutorial: https://supergiant.io/blog/cluster-level-logging-in-kubernetes-with-fluentd/
Steps to install:

Disable rancher logging
Create a GELF UDP input in Graylog
Create a kubernetes ServiceAccount and give the correct permissions

$ cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
  name: fluentd
  namespace: kube-system

---

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: fluentd
  namespace: kube-system
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - namespaces
  verbs:
  - get
  - list
  - watch

---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: fluentd
roleRef:
  kind: ClusterRole
  name: fluentd
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: fluentd
  namespace: kube-system
EOF

Deploy the DaemonSet

$ cat <<EOF | kubectl apply -f -
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: fluentd
  namespace: kube-system
  labels:
    k8s-app: fluentd-logging
    version: v1
    kubernetes.io/cluster-service: "true"
spec:
  template:
    metadata:
      labels:
        k8s-app: fluentd-logging
        version: v1
        kubernetes.io/cluster-service: "true"
    spec:
      serviceAccount: fluentd
      serviceAccountName: fluentd
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
      containers:
      - name: fluentd
        image: fluent/fluentd-kubernetes-daemonset:v1.3.3-debian-graylog-1.4
        env:
          - name:  FLUENT_GRAYLOG_HOST
            value: "10.100.183.52"
          - name:  FLUENT_GRAYLOG_PORT
            value: "12222"
          - name: FLUENT_UID
            value: "0"
        resources:
          limits:
            memory: 200Mi
          requests:
            cpu: 100m
            memory: 200Mi
        volumeMounts:
        - name: varlog
          mountPath: /var/log
        - name: varlibdockercontainers
          mountPath: /var/lib/docker/containers
          readOnly: true
      terminationGracePeriodSeconds: 30
      volumes:
      - name: varlog
        hostPath:
          path: /var/log
      - name: varlibdockercontainers
        hostPath:
          path: /var/lib/docker/containers
EOF

Replace FLUENT_GRAYLOG_HOST and FLUENT_GRAYLOG_PORT with your values.
Works exactly like the rancher implementation. I'm not sure they use this DaemonSet under the hood. If not, probably they should.

+1 (GELF). Thanks

Related PRs
https://github.com/rancher/fluentd/pull/28
https://github.com/rancher/types/pull/1067
https://github.com/rancher/system-charts/pull/142
https://github.com/rancher/rancher/pull/24911
https://github.com/rancher/ui/pull/3741

+1

It's worth noting that you can log to Graylog as a Syslog endpoint but there are known issues with this.  There may be solutions but since this is not a supported solution, I've not yet invested the time to delve into them.  Please post here if you find configurationns or workarounds that will resolve these or others you find:

Log metadata is not consumed by Graylog and instead becomes part of the message
Long messges are split into multiple log entries
Some messages are truncated.  Initially we thought this may be a UDP limitation but saw the same issues when using TCP

Right now I would recommend using Elasticsearch until this feature can be prioritized, as it's an easy substitution for most users.

+1 for GELF support, this should have been in Rancher years ago.

Since 2.5 Rancher is using the banzai logging operator. So this is now dependent on https://github.com/banzaicloud/logging-operator/issues/24. As soon as this is implemented and released, it an also be used in Rancher.

I wrote a pull request to support this in the upstream project: banzaicloud/logging-operator#705

it seems there was https://github.com/rancher/charts/tree/dev-v2.6/charts/rancher-logging/rancher-logging/100.0.1%2Bup3.15.0 pushed. Someone knows when this dev-v2.6 branch gets merged so the chart is available at charts.rancher.io?

Please backport to 2.5.x as well!

Closing as stale.

authors: MKlimuszka SoarinFerret Tejeev akkie aleksandrmetik bananflugan bashofmann dmlabs dnauck junkiebev loganhz uluzox wagnst


text:
Improve error when no projects are found

Message can be more descriptive and instruct to run rancher login again as in other errors.

This is in CLI v2.0.5


text:
backport fix for not able to launch kubectl shell

backport https://github.com/rancher/rancher/issues/16681

Tested with v2.1.2-rc15.
Able to launch kubectl shell from UI for provisioned clusters.

authors: cjellick sangeethah


text:
Connection to  Exposed ports on containers fails intermittently.

Server version - Build from master on Aug 4
Create service1 which is linked to service2. Service 1 has exposed port - public port - 309 -> private port - 22.
Waited for both the services to be activated.
After 5 sec delay , tried to access -service1 by trying to ssh to port 309 on the host the container of service1 is running.
We get "Connection refused" error.
After few minutes , when i try to access the same ports , i get access to the containers.
Why is there a delay in accessing the exposed ports? This issue is not always reproducible. I have been able to access the exposed ports after 5 secs of creation most of the time.

Validation tests run on V1.0.0-rc3 does not encounter this problem anymore.


text:
Service with global deployment strategy: add max_count and odd_count

Global deployment strategy for the service means that service will end up having one instance deployed per host in the system. We should add a cap to number of instances deployed. So say you define a service with strategy=global and max_count=2. It means that when there are 3 hosts in the system, only 2 of them will get service instances deployed.
Also need to add odd_count parameter. If specified along with global flag, odd number of instances will get deployed. For example, if there are 10 hosts in the system, only 9 instances will get deployed.
@ibuildthecloud ^^

Unless you're worried about the case where there's only one host, isn't this just scale=2 and anti affinity to self?

@vincent99 unfortunately scale=n and antiaffinity solution won't work when number of hosts in the system is < n: the service will fail to deploy in this case. While in case where global=true, max_count=n, hosts<n service will get deployed regardless as n in this case is the optimum.

Yeah that's what I meant by "the case where there's only one host", specialized to the example from n hosts :smile: ..
I just think it's weird that this is called "global" at all.  It seems to me like it should be a "soft scale" modifier to say "...but allow less than that if there are no more eligible hosts right now" on the regular scale value.  Same for "always odd", though that could be used with global or a scale.
Maybe "soft scale" could even be on by default, and then as long as at least one container is running services can go to active.  This would help the issue where people say scale=42 but there are only 41 eligible hosts not spin on updating forever, and the UI could show 'desired scale is 42, but only 41 can currently be created".

@vincent99 I like the soft scale idea, but I think we should still keep our original "hard" scale behavior in case user has a requirement for the particular number of service instances.
I agree that max/soft scale shouldn't be tight to global flag only.

@ibuildthecloud do we still need this feature?

This one is resolved with the scale policy. You can setup a maxCount and the interval to workaround the oddCount

@alena1108 , is this scale policy feature we have from v1.1.0? This has min/max/increment. We dont have any interval here. Wanted confirmation, that we are not planning to address anything with respect to odd_count parameter.


text:
[UI] When attempt to create cloudCredential with name that is not of type dnsLabel UI shows no errors/warnings to user

Version: master-head (7/12/19)
Version: v2.2.4 (pre-existing issue)
What kind of request is this (question/bug/enhancement/feature request):
Bug, pre-existing
Steps to reproduce (least amount of steps as possible):
Attempt to create any cloud credential with a name like "testing_things" (the underscore is not valid)
Result:
UI shows the user no errors or warnings and there is nothing in the browser dev console. Clicking the "Create" button essentially doesn't do anything.
Pictured below -- clicked Create button and nothing happens:

We expected the UI to show us a message explaining the issue. Presumably we don't see an error from the API because I think we are doing something in JS to validate credentials before we attempt to actually create cloudCredentials entry.

Closing. Is a duplicate of https://github.com/rancher/rancher/issues/19758

Also reference:  https://github.com/rancher/rancher/issues/21888


text:
Ingress doesn't work due to missing related svc when using custom domain instead of xip.io

What kind of request is this

BUG

Steps to reproduce

1、Modify Global --> Settings --> ingress-ip-domain. Change it to another domain such as abc.com instead of xip.io
2、Create ingress and point it to a workload
3、Try to access it

Results

It will always return 503 due to the automatically svc ingress-xxxxxx is missing. It is created when we create the ingress. But it was removed once the ingress state changed to Active

Rancher Version

v2.2.8 +

link PR to https://github.com/rancher/rancher/pull/24138

@guangbochen please if possibile keep this inside the 2.3 roadmap.
2.4 is too much distant in time. Thanks

@dewos  we will backport this PR to 2.3 and this can be tracked with https://github.com/rancher/rancher/pull/24181, thanks

@guangbochen thanks. Could you tell me the ETA for the next 2.3.* release?

@guangbochen hold off on fixing this until user controllers are moved down to the agent level. This will allow us to fix this in a cleaner fashion and not impact performance in rancher.

authors: MrYuanZhen dewos dramich guangbochen


text:
Differentiate the "docker run" cluster driver type in telemetry

Currently we have no way of knowing how many "docker run" clusters are running as the driver type is k3s.
We can't purely change the driver type in the cluster object, because we use the k3s type to display cluster metrics and options. We could do what RancherD did and add your own type (ClusterDriverRancherD) and include that as a "K3SBased" type.
An easier alternative is find an easier way to identify that its a docker install, and then add logic in telemetry to increment that type, which wouldn't actually exist outside of telemetry.
If we can get this in 2.5.5 that'd be great, if it slips to 2.6 its not a huge problem.

Submitted PR https://github.com/rancher/telemetry/pull/46  to address the issue.
Added logic to telemetry client to differentiate when Rancher is deployed with docker run, incrementing k3sBased label on telemetry

Submitted PR https://github.com/rancher/telemetry/pull/46  to address the issue.
Added logic to telemetry client to differentiate when Rancher is deployed with docker run, incrementing k3sBased label on telemetry

PR https://github.com/rancher/telemetry/pull/46 merged and cut a new telemetry version, v0.5.13
How to test it:

Deploy Rancher v2.5.5 using single-node-docker installation
Get telemetry client cmd from the Rancher docker, docker exec -i <RANCHER_DOCKER> ps -ef | grep telemetry
Download new telemetry binary from https://github.com/rancher/telemetry/releases/tag/v0.5.13
Check new telemetry client cluster.driver output (should be k3sBased instead of k3s):
telemetry client --url https://<RANCHER_URL>/v3 --token-key <TELEMETRY_TOKEN> --once

...
  "cluster": {
    "driver": {
      "k3sBased": 1
    },
...

PR https://github.com/rancher/telemetry/pull/46 merged and cut a new telemetry version, v0.5.13
How to test it:

Deploy Rancher v2.5.5 using single-node-docker installation
Get telemetry client cmd from the Rancher docker, docker exec -i <RANCHER_DOCKER> ps -ef | grep telemetry
Download new telemetry binary from https://github.com/rancher/telemetry/releases/tag/v0.5.13
Check new telemetry client cluster.driver output (should be k3sBased instead of k3s):
telemetry client --url https://<RANCHER_URL>/v3 --token-key <TELEMETRY_TOKEN> --once

...
  "cluster": {
    "driver": {
      "k3sBased": 1
    },
...

This feature is verified with Rancher server rancher\rancher:v2.5.5
Steps:

Deploy Rancher using single-node-docker installation
Get telemetry client cmd from the Rancher docker, docker exec -i <RANCHER_DOCKER> ps -ef | grep telemetry
Download new telemetry binary from https://github.com/rancher/telemetry/releases/tag/v0.5.13
Check new telemetry client cluster.driver output (should be k3sBased instead of k3s): telemetry client --url https://<RANCHER_URL>/v3 --token-key <TELEMETRY_TOKEN> --once

Result:
Telemetry client cluster.driver output. is k3sBased
  "cluster": {
    "active": 1,
    "total": 1,
    ...
    "driver": {
      "k3sBased": 1
    },
   ...
  },

This feature is verified with Rancher server rancher\rancher:v2.5.5
Steps:

Deploy Rancher using single-node-docker installation
Get telemetry client cmd from the Rancher docker, docker exec -i <RANCHER_DOCKER> ps -ef | grep telemetry
Download new telemetry binary from https://github.com/rancher/telemetry/releases/tag/v0.5.13
Check new telemetry client cluster.driver output (should be k3sBased instead of k3s): telemetry client --url https://<RANCHER_URL>/v3 --token-key <TELEMETRY_TOKEN> --once

Result:
Telemetry client cluster.driver output. is k3sBased
  "cluster": {
    "active": 1,
    "total": 1,
    ...
    "driver": {
      "k3sBased": 1
    },
   ...
  },

authors: aaronRancher cbron rawmind0


text:
rke2 cluster provisioning - Access to configure audit logging from the API is missing

What kind of request is this (question/bug/enhancement/feature request):
Enhancement
Steps to reproduce (least amount of steps as possible):
Audit logging cannot be configured via rancher UI/API on the rke2 clusters.
As an enhancement,  provision to configure audit logging on the API for easier access is needed.
Environment information

Rancher version (rancher/rancher/rancher/server image tag or shown bottom left in the UI): master-head commit 55f0bb2
Installation option (single install/HA): Single

Cluster information

Cluster type (Hosted/Infrastructure Provider/Custom/Imported): Infrastructure Provider

In theory, if you set the audit policy file, there is a way:
https://github.com/rancher/kontainer-driver-metadata/blob/dev-v2.6/channels-rke2.yaml#L38

Need to add support for specifying contents of audit-policy-file to "machineGlobalConfig" and push contents of this file to RKE2 via plan and set audit-policy-file option to point to this file.

This is likely to miss 2.6.4 release, so adding release-note label on it (at least for now) to make sure we include call out that this is not supported yet.

Need functionality similar to https://rancher.com/docs/rancher/v2.5/en/security/rancher-2.5/1.6-hardening-2.5/#reference-hardened-rke-cluster-yml-configuration (search for audit_log).

The following PR (https://github.com/rancher/rancher/pull/40353/) adds support for delivering files to downstream nodes which is needed for this enhancement.

[SURE-5352] recently another customer also requested this.

Since Rancher v2.7.2, we can configure the audit logging for RKE2 clusters in Rancher's Dashboard.
Step 1: Prepare a Secret or ConfigMap containing the audit policy
Below is an example of such a Secret, and it needs to meet the following two requirements:

The namespace needs to be fleet-default where the Cluster object exists
It must have the annotation  rke.cattle.io/object-authorized-for-clusters: <Cluster-Name> to allow Rancher to use the secret for the target cluster

Rancher Dashboard has an easy-to-use UI for creating the secret.
apiVersion: v1
data:
  audit-policy: >-
    IyBMb2cgYWxsIHJlcXVlc3RzIGF0IHRoZSBNZXRhZGF0YSBsZXZlbC4KYXBpVmVyc2lvbjogYXVkaXQuazhzLmlvL3YxCmtpbmQ6IFBvbGljeQpydWxlczoKLSBsZXZlbDogTWV0YWRhdGE=
kind: Secret
metadata:
  annotations:
    rke.cattle.io/object-authorized-for-clusters: jiaqi-c1
  name: jiaqi-audit-policy
  namespace: fleet-default

Step 2: Edit the cluster as YAML
First, we need to instruct Rancher to send the file to the control plane node. The field is under .spec.rkeCofig.machineSelectorFiles.
    machineSelectorFiles:
      - fileSources:
          - configMap:
              name: ''
            secret:
              items:
                - key: audit-policy
                  path: /etc/rancher/rke2/jiaqi-audit-policy.yaml
              name: jiaqi-audit-policy
        machineLabelSelector:
          matchLabels:
            rke.cattle.io/control-plane-role: 'true'

Second,  we need to instruct kube-apiserver to use the above audit  policy. The field is under .spec.rkeCofig.machineGlobalConfig.kube-apiserver-arg:
      kube-apiserver-arg:
        - audit-policy-file=/etc/rancher/rke2/jiaqi-audit-policy.yaml
        - audit-log-path=/etc/rancher/rke2/jiaqi-audit.logs

Finally, we need to save the change and allow the cluster to finish the upgrading.

waiting for the updated Rancher docs to be live.

QA TEST PLAN
Scenarios

Scenario
Test Case

1
As a standard user, provision a downstream RKE2 cluster with audit logging enabled, validate in the control plane node that auditing is enabled

2
As a standard user, provision a downstream RKE2 cluster, edit the cluster to enable audit logging, validate in the control plane node that auditing is enabled

3
As a standard user, provision a downstream RKE2 cluster, edit the cluster to enable audit logging, validate in the control plane node that auditing is enabled, remove audit logging from the cluster and validate the audit logs remain

Tested this against v2.8-head https://github.com/rancher/rancher/commit/efc48ac09ab8307cc949f13aa5e57cc2568c4ab6. See results below:
ENVIRONMENT DETAILS

Rancher install: Docker
Rancher version: v2.8-head https://github.com/rancher/rancher/commit/efc48ac09ab8307cc949f13aa5e57cc2568c4ab6

TEST RESULT

Scenario
Test Case
Result

1
As a standard user, provision a downstream RKE2 cluster with audit logging enabled, validate in the control plane node that auditing is enabled
:x:

2
As a standard user, provision a downstream RKE2 cluster, edit the cluster to enable audit logging, validate in the control plane node that auditing is enabled
:white_check_mark:

3
As a standard user, provision a downstream RKE2 cluster, edit the cluster to enable audit logging, validate in the control plane node that auditing is enabled, remove audit logging from the cluster and validate the audit logs remain
:white_check_mark:

VALIDATION STEPS
Scenario 1

As the local admin user, created a secret in the fleet-default namespace with the sample YAML:

apiVersion: v1
kind: Secret
metadata:
  name: test
  annotations:
    rke.cattle.io/object-authorized-for-clusters: <downstream cluster to later be provisioned>
    #  key: string
  labels:
    {}
    #  key: string
  namespace: default
type: Opaque
data:
  test: <retracted>
  audit-policy: >-
    IyBMb2cgYWxsIHJlcXVlc3RzIGF0IHRoZSBNZXRhZGF0YSBsZXZlbC4KYXBpVmVyc2lvbjogYXVkaXQuazhzLmlvL3YxCmtpbmQ6IFBvbGljeQpydWxlczoKLSBsZXZlbDogTWV0YWRhdGE=
  #  key: string
__clone: true
#immutable: boolean

Logged out and logged back in as a standard user.
Provisioned a downstream RKE2 v1.27.5+rke2r1 node driver cluster.

When provisioning, the node driver is being recognized as a custom cluster. This is unexpected behavior, therefore, this test failed.

Scenario 2

Repeated scenario 1, steps 1-3, but ensured I created a new secret for this separate downstream RKE2 v1.27.5+rke2r1 node driver cluster.
Edited the downstream cluster to include the following snippets of YAML under rkeConfig:

machineSelectorFiles:
      - fileSources:
          - secret:
              name: '<secret name>'
              items:
                - key: audit-policy
                  path: /etc/rancher/rke2/mew-audit-policy.yaml
        machineLabelSelector:
          matchLabels:
            rke.cattle.io/control-plane-role: 'true'
    machineGlobalConfig:
      cni: canal
      disable-kube-proxy: false
      etcd-expose-metrics: false
      profile: null
      kube-apiserver-arg:
        - audit-policy-file=/etc/rancher/rke2/mew-audit-policy.yaml
        - audit-log-path=/etc/rancher/rke2/mew-audit.logs

Validated that the cluster and nodes came back as Active after the changes were applied.
SSH'ed into the control plane node and validated that the logging is now present:

# pwd
/etc/rancher/rke2
# ll
total 22880
drwxr-xr-x 3 root root     4096 Sep 20 18:45 ./
drwxr-xr-x 5 root root     4096 Sep 20 18:01 ../
drwxr-xr-x 2 root root     4096 Sep 20 18:01 config.yaml.d/
-rw------- 1 root root 23398661 Sep 20 18:47 mew-audit.logs
-rw------- 1 root root      107 Sep 20 18:42 mew-audit-policy.yaml
-rw------- 1 root root       29 Sep 20 18:42 registries.yaml
-rw------- 1 root root      365 Sep 20 18:46 rke2-pss.yaml
-rw------- 1 root root     2969 Sep 20 18:47 rke2.yaml

Scenario 3

Repeated scenario 2, steps 1-4, but ensured I created a new secret for this separate downstream RKE2 v1.27.5+rke2r1 node driver cluster.
Edited the downstream cluster and removed the snippets of YAML added under the rkeConfig block.
Validated that the cluster and nodes came back as Active after the changes were applied.
SSH'ed into the control plane and validated that the logging files still remain despite updating the cluster.

The failure of Scenario 1 is caused by a regression in the Dashboard UI, which is tracked here https://github.com/rancher/dashboard/issues/9724
We will be able to re-validate Scenario 1 after the UI bug is fixed.

Tested this against v2.8-head https://github.com/rancher/rancher/commit/4c55a12f9c27873b31cd42bb60917c68df857e5b.
ENVIRONMENT DETAILS

Rancher install: Docker
Rancher version: v2.8-head https://github.com/rancher/rancher/commit/4c55a12f9c27873b31cd42bb60917c68df857e5b

TEST RESULT

Scenario
Test Case
Result

1
As a standard user, provision a downstream RKE2 cluster with audit logging enabled, validate in the control plane node that auditing is enabled
:x:

2
As a standard user, provision a downstream RKE2 cluster, edit the cluster to enable audit logging, validate in the control plane node that auditing is enabled
:white_check_mark:

3
As a standard user, provision a downstream K3S cluster, edit the cluster to enable audit logging, validate in the control plane node that auditing is enabled
:x:

4
As a standard user, provision a downstream RKE2 cluster, edit the cluster to enable audit logging, validate in the control plane node that auditing is enabled, remove audit logging from the cluster and validate the audit logs remain
:white_check_mark:

VALIDATION STEPS
Scenario 1

As the local admin user, created a secret in the fleet-default namespace with the sample YAML:

apiVersion: v1
kind: Secret
metadata:
  name: test
  annotations:
    rke.cattle.io/object-authorized-for-clusters: <downstream cluster to later be provisioned>
    #  key: string
  labels:
    {}
    #  key: string
  namespace: default
type: Opaque
data:
  test: <retracted>
  audit-policy: >-
    IyBMb2cgYWxsIHJlcXVlc3RzIGF0IHRoZSBNZXRhZGF0YSBsZXZlbC4KYXBpVmVyc2lvbjogYXVkaXQuazhzLmlvL3YxCmtpbmQ6IFBvbGljeQpydWxlczoKLSBsZXZlbDogTWV0YWRhdGE=
  #  key: string
__clone: true
#immutable: boolean

Logged out and logged back in as a standard user.
Provisioned a downstream RKE2 v1.27.6+rke2r1 node driver cluster - ensured I specified the following YAML snippet:

machineSelectorFiles:
      - fileSources:
          - secret:
              name: '<secret name>'
              items:
                - key: audit-policy
                  path: /etc/rancher/rke2/mew-testing-cluster.yaml
        machineLabelSelector:
          matchLabels:
            rke.cattle.io/control-plane-role: 'true'
    machineGlobalConfig:
      cni: canal
      disable-kube-proxy: false
      etcd-expose-metrics: false
      profile: null
      kube-apiserver-arg:
        - audit-policy-file=/etc/rancher/rke2/mew-testing-cluster.yaml
        - audit-log-path=/etc/rancher/rke2/mew-testing-cluster.logs

Validated that the cluster and nodes came back as Active after the changes were applied.
SSH'ed into the control plane node and validated that the logging is now present:

# pwd
/etc/rancher/rke2
# ll
total 16592
drwxr-xr-x 3 root root     4096 Oct  3 17:29 ./
drwxr-xr-x 5 root root     4096 Oct  3 17:29 ../
drwxr-xr-x 2 root root     4096 Oct  3 17:29 config.yaml.d/
-rw------- 1 root root 16958471 Oct  3 17:33 mew-testing-cluster.logs
-rw------- 1 root root      107 Oct  3 17:29 mew-testing-cluster.yaml
-rw------- 1 root root       29 Oct  3 17:29 registries.yaml
-rw------- 1 root root      365 Oct  3 17:29 rke2-pss.yaml
-rw------- 1 root root     2969 Oct  3 17:29 rke2.yaml

Scenario 2

Provisioned a downstream RKE2 v1.27.6+rke2r1 node dirver cluster - ensured that I have a separate secret for auditing.
Validated that the cluster and nodes came back as Active after the changes were applied.
Edited the cluster YAML to have the audit snippet seen in scenario 1.
Validated that the cluster and nodes came back as Active after the changes were applied.
SSH'ed into the control plane and validated that the logging is present.

Scenario 3

Provisioned a downstream K3S v1.27.6+k31 node driver cluster with the following snippet:

machineSelectorFiles:
      - fileSources:
          - secret:
              name: '<secret name>'
              items:
                - key: audit-policy
                  path: /etc/rancher/k3s/mew-audit-policy.yaml
        machineLabelSelector:
          matchLabels:
            rke.cattle.io/control-plane-role: 'true'
    machineGlobalConfig:
     disable-apiserver: false
      disable-cloud-controller: false
      disable-controller-manager: false
      disable-etcd: false
      disable-kube-proxy: false
      disable-network-policy: false
      disable-scheduler: false
      etcd-expose-metrics: false
      kube-apiserver-arg:
        - audit-policy-file=/etc/rancher/k3s/mew-k3s-test.yaml
        - audit-log-path=/etc/rancher/k3s/mew-k3s-test.logs

Cluster never provisions and I am left with the following:

Scenario 4

Repeated scenario 2, steps 1-5, but ensured I created a new secret for this separate downstream RKE2 v1.27.6+rke2r1 node driver cluster.
Edited the downstream cluster and removed the snippets of YAML added under the rkeConfig block.
Validated that the cluster and nodes came back as Active after the changes were applied.
SSH'ed into the control plane and validated that the logging files still remain despite updating the cluster.

Updated the above test result after retesting scenario 3. There was user error in how I configured the auditing. When fixed, the scenario worked as expected. As such, closing this issue as this has been addressed.

@markusewalker , reopening this issue to validate another (simpler!) approach for configuring audit policy outlined in https://github.com/rancher/rancher-docs/pull/900
FYI @daviswill2

QA has validated this additional scenario (scenario 5) in the test results. Leaving this issue as open until the doc PR is merged. Once it is merged, @jiaqiluo will go ahead and close the issue.
In the meantime, moving this out of to test since QA has validated this.

Closing this issue as the doc PR has been merged.

authors: anupama2501 deniseschannon jiaqiluo markusewalker sadhugit snasovich


text:
[rke2 templates] unable to create cluster from an rke2 template as non-admin user

Rancher Server Setup

Rancher version: v2.6-head (45dfeb4)
Installation option (Docker install/Helm Chart): docker

If Helm Chart, Kubernetes Cluster and version (RKE1, RKE2, k3s, EKS, etc):

Proxy/Cert Details:n/a

Information about the Cluster

Kubernetes version:1.21.4+rke2r1
Cluster Type (Local/Downstream):

If downstream, what type of cluster? (Custom/Imported or specify provider for Hosted/Infrastructure Provider): digital ocean, from rke2 template

Describe the bug

non-admin users are not able to create a cluster from rke2 cluster templates. Initial chart install fails
To Reproduce

log in as non-admin user (restricted admin)
add an rke2 cluster template repo
using a template, create a cluster using valid parameters

Result

currently, restricted admin gets this error when provisioning a cluster that the restricted admin has added:

the regular admin can use the same parameters to create a cluster from the template.  Reopening for this issue, thought this might be a separate issue.

Expected Result

any user should be able to install from an rke2 cluster template
Screenshots

Additional context
found when testing https://github.com/rancher/dashboard/issues/3995

Related: https://github.com/rancher/rancher/issues/35177

Root cause
The create-clusters role did not have access to get/list/watch cluster repos, so non-admin users were not able to provision clusters with them.
What was fixed, or what changes have occurred
The create-clusters role was updated to allow the user to view these resources.
Areas or cases that should be tested
Creating a cluster using an rke2 template.
What areas could experience regressions?
N/A
Are the repro steps accurate/minimal?
As an admin user, add the cluster template examples repo. Create a user with the create-clusters role, and try to provision an rke2 cluster using the template.

tested as part of: https://github.com/rancher/rancher/issues/35177
tested on v2.6-head (c682e30):

provision cluster from rke2 template as admin user  -- pass
provision cluster from rke2 template as standard user  -- pass
provision cluster from rke2 template as base user with create cluster role -- pass
verify user only has access to their cloud credentials in rke2 template -- pass
verify user can access rke2 template(s) added by admin -- pass

authors: jakefhyde janeczku slickwarren


text:
[release/v2.7] Forwardport of Add 1.23 for EKS

Forwardport of https://github.com/rancher/rancher/issues/38837

EKSv2 1.23 was added with https://github.com/rancher/ui/pull/4890

QA TEST PLAN

Setup Rancher, create a standard user and login as that user.
Navigate to Cluster Management > Amazon EKS.
Fill out the requested prompts and in the Managed Node Groups, fill out a custom AMI ID that has been updated for EKS.

Ensure that the version is 1.23.

Provision the cluster and validate that it is in a state of Active in Cluster Management and Cluster Explorer
Repeat steps 3-4 for all supported EKS versions.

Ready to test on v2.7-head.

Validated that this is addressed in v2.7-head https://github.com/rancher/rancher/commit/c567ef3f2bd13c2f2a5819242ab88cd334b1ae79.
ENVIRONMENT DETAILS

Rancher install: Docker
Rancher version: v2.7-head https://github.com/rancher/rancher/commit/c567ef3f2bd13c2f2a5819242ab88cd334b1ae79
Browser: Chrome

TEST RESULT
PASS
VERIFICATION STEPS

Setup Rancher, created a standard user and logged in as that user.
Navigated to Cluster Management > Amazon EKS.
Filled in all the prompts, ensured that the K8s version is 1.23 and created the cluster.
Validated that the cluster is provisioned and that the cluster and nodes are in a state of Active in Cluster Management and Cluster Explorer:

Navigated to the AWS Management Console > EC2 > Instances.
Validated that the associated instances created use the updated AMI ID that the PR uses.

authors: Oats87 markusewalker snasovich


text:
[BUG] Local cluster fleet-agent bootstrap missing apiServerCA that allows registration with Fleet

Rancher Server Setup
Rancher installed to kubernetes cluster (RKE2 1.25.9+rke2r1) with helm chart:
helm upgrade -i --version 2.7.5  rancher rancher-stable/rancher -n cattle-system -f values.yaml

values.yaml has a couple changed variables compared to default:
hostname: "rancherserver.our.domain"
ingres.ingressClassName: "nginx"
proxy: "our-proxy"
tls: external

rancherserver.our.domain is reached via nginx-proxy, proxy resides outside Kubernetes cluster.
Information about the Cluster

Kubernetes version:
RKE2 1.25.9+rke2r1
Cluster Type (Local/Downstream):
Local cluster

User Information

What is the role of the user logged in? (Admin/Cluster Owner/Cluster Member/Project Owner/Project Member/Custom)
Admin (on UI side)

Describe the bug
We're interesred in setting up Fleet.. and it seems that the
helm-command above also installed Fleet (so no need to install helm
separately using helm as describe here
https://fleet.rancher.io/installation.. or is there?)
We only got one cluster, hence operating on 'fleet-local'. After
setting up git repo, the cluster (under Continuous Delivery) stays in
'Wait Check-In' state.
After cheking few logs, this one pops out:
kubectl logs pod/fleet-agent-855f8b5c9c-8pq8j -n cattle-fleet-local-system

time="2023-07-04T09:45:06Z" level=error msg="Failed to register agent: looking up secret cattle-fleet-local-system/fleet-agent-bootstrap: Post \"https://rancherserver.our.domain/apis/fleet.cattle.io/v1alpha1/namespaces/fleet-local/clusterregistrations\": tls: failed to verify certificate: x509: certificate signed by unknown authority"

When checking how fleet-agent-bootstrap looks like, apiServerURL was set
to base64 encoded string of https://rancherserver.our.domain but
apiServerCA was empty. After taking CA from the  proxy server and adding
it as base64-encoded into fleet-agent-bootstrap:
kubectl edit secret fleet-agent-bootstrap -n cattle-fleet-local-system

apiServerCA: "LS...."

the error 'failed to verify certificate' went away and soon Rancher UI
showed everything to be in 'Active' state and Fleet was noticing changes
in git repo
Then, after a while, fleet-agent apparently restarted and we were facing
the same situation again and again editing the fleet-agent-bootstrap -secret on the fly
and adding apiSeverCA fixed everything.
To Reproduce
In our environmennt happens every time after installing  Rancher with helm the way show above.
Guessing that as Fleet's apiServerURL gets set to hostname which is actually alias for nginx-proxy-server  (which has self-signed certificates), to produce, one has to have proxy with self-signed certs and connect to Rancher via that proxy.
Result
In short, not having proper apiServerCA set, Fleet keeps giving 'failed to verify certificate' errors and not working properly.
Expected Result
There would be a possibility to set apiServerCA (or any other Fleet configuration value) for Fleet during Rancher installation via Helm.
Question
However, it is truly unpractical to keep editing the fleet-agent-bootstrap -secret every so
often, so the question is

how to set the apiServerCA (or agentCheckInterval or any other Fleet chart configuration variable) for Fleet
during Rancher installation.

Could not see anything Fleet-related  in Rancher Helm chart documentation or values.yaml -file (apparently Fleet
somehow gets the apiServerURL from hostname set in  Rancher chart's values.yaml).

@manno perhaps you have some insight here.

Actually, rereading the issue this seems like it may just be a misconfiguration of the installation.
Rancher installs Fleet for you so it can manage its own resources. This is expected, so you should not need to manually install Fleet on any cluster managed by Rancher (including the local).
If your Rancher URL is secured using a private CA, you will need to provide a copy of your CA certificate chain to Rancher using the steps in the documentation: https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/helm-chart-options#external-tls-termination  See the note linked about privateCA

Just to confirm I've understood the docs correctly:

privateCa should be set to to true for Rancher installation
Secret named tls-ca  should be created  in cattle-system namespace having proper CA
(Guessing from the comment above) Fleet chart apiServerCA would then be properly populated with whatever tls-ca has?

Addind privateCA and tls-casecret did the trick and apiServeCA was properly populated.

I'm still getting this issue even I had set ```privateCA: true

authors: Oats87 RenneNiku petkozma


text:
[Port v2.8] cluster deploy running excessively and taking a long time to execute

This is a port of https://github.com/rancher/rancher/issues/39597
Rancher Server Setup

Rancher version: 2.8.x
Installation option: any
Proxy/Cert Details: irrelevant

Information about the Cluster

Kubernetes version: irrelevant
Cluster Type (Local/Downstream): issue is seen in local cluster with at least one disconnected cluster

User Information

What is the role of the user logged in? irrelevant

Describe the bug
With a disconnected downstream cluster, the clusterdeploy handler takes several seconds to time out. This is fine with only a few downstream clusters disconnected, but when the number of disconnected clusters goes over 50 or so, the worker queues will get saturated.
Reason for the slow time out is that the handler may execute code that reaches out to the disconnected downstream cluster - typically clusterDeploy.getNodeAgentImage which tries to list DaemonSets. That alone can take up to ~30 seconds due to how TunnelServer's remotedialer mechanism works.
To Reproduce
See https://github.com/rancher/rancher/issues/39597#issuecomment-1816099261
Result
Expected Result
Little to no executions of cluster deploy handler while creating users. Cluster deploy handler should not probably not exceed an execution time of 1 second.
Screenshots
N/A
Additional context
N/A

@moio v2.8-next1 is at bug complete now. I see a PR has been merged so if that's the case, is this ready for QA?

@gaktive yes it is, same instructions as the original

closing per conversation with @git-ival

authors: gaktive moio


text:
[BUG] Exoscale driver doesn't work probably because of deprecated API

Rancher Server Setup

Rancher version:  v2.8.5
Installation option (Docker install/Helm Chart):

Helm Chart
Kubernetes Cluster:  v1.28.11+rke2r1

Describe the bug
The Exoscale driver no longer works, as it appears to still be using API v1 instead of API v2:
https://changelog.exoscale.com/en/deprecation-api-v1-as-of-may-1st-2024-uVYHUVZ3
To Reproduce
Activate the Exoscale driver in the node drivers, then attempt to set up a new cluster with default settings
Result
When trying to create a new cluster, the process gets stuck on the first step.
Expected Result
The driver should work, or if it cannot be fixed, it should be removed from Rancher.
Additional context
When you click "View API" for the Exoscale driver, you can find the following:
"whitelistDomains": [
"api.exoscale.ch"
]

We are facing exactly the same issue. Would it be possible to update Exoscale driver to use new api endpoints?

authors: abyss-ms rafalr-ntropy


text:
Config propagation on LB creation takes longer than 30 secs.

Rancher Version:Build from master
There are many LB related validation test scenarios that report failure because of  timing out after waiting for 30 secs config propagation.
Log snippet from one such LB failure use case:
Error Message

Exception: Timed out waiting for config propagation
Stacktrace

admin_client = <cattle.Client object at 0x7f040dfd7050>
client = <cattle.Client object at 0x7f040cd3be50>, socat_containers = None

    def test_lb_services_scale_down_lb_service(
            admin_client, client, socat_containers):

        port = "9004"

        service_scale = 2
        lb_scale = 2

        final_lb_scale = 1

        env, service, lb_service = create_environment_with_lb_services(
>           admin_client, client, service_scale, lb_scale, port)

tests/v2_validation/cattlevalidationtest/core/test_services_lb.py:278:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
tests/v2_validation/cattlevalidationtest/core/test_services_lb.py:26: in create_environment_with_lb_services
    [service], lb_service)
tests/v2_validation/cattlevalidationtest/core/common_fixtures.py:877: in wait_for_lb_service_to_become_active
    wait_for_config_propagation(admin_client, lb_service)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

admin_client = <cattle.Client object at 0x7f040dfd7050>
lb_service = {'loadBalancerConfig': None, 'createdTS': 1474356375000, 'launchConfig': {'tty': False, 'networkMode': u'managed', 'vc... 'name': u'LB-test923004', 'created': u'2016-09-20T07:26:15Z', 'scalePolicy': None, 'fqdn': None, 'selectorLink': None}
timeout = 30

    def wait_for_config_propagation(admin_client, lb_service, timeout=30):
        lb_instances = get_service_container_list(admin_client, lb_service)
        assert len(lb_instances) == lb_service.scale
        for lb_instance in lb_instances:
            agentId = lb_instance.agentId
            agent = admin_client.by_id('agent', agentId)
            assert agent is not None
            item = get_config_item(agent, "haproxy")
            start = time.time()
            print "requested_version " + str(item.requestedVersion)
            print "applied_version " + str(item.appliedVersion)
            while item.requestedVersion != item.appliedVersion:
                print "requested_version " + str(item.requestedVersion)
                print "applied_version " + str(item.appliedVersion)
                time.sleep(.1)
                agent = admin_client.reload(agent)
                item = get_config_item(agent, "haproxy")
                if time.time() - start > timeout:
>                   raise Exception('Timed out waiting for config propagation')
E                   Exception: Timed out waiting for config propagation

tests/v2_validation/cattlevalidationtest/core/common_fixtures.py:2118: Exception

This issue is still happening on master builds with this fix.

In the Validation runs with latest build from Oct 3 , there are no lb related tests that fail with this error.


text:
We should add rio pods to CLI to list all the pods

This is a duplicated of https://github.com/rancher/rio/issues/691

repo: rancher/rio


text:
Fix: Do not use the non-public parse_requirements

pip.req.parse_requirements is not considered part of the public
pip API by the pip developers and hence should never be used
as such. Its signature can change at any given moment, making
installations depending on it just break.
This patch moves the actual requirement specification over into
setup.py and modifies requirements.txt to only contain a reference
to the local package, in compliance with the suggested usage
pattern for setup.py vs requirements.txt.
See also:

http://stackoverflow.com/a/22649833/2028598
https://caremad.io/2013/07/setup-vs-requirement/

Solves #36

+1

+1

+1

+1

authors: Booli Salandora foosel imrahil pauly7300

license: mit

license_source: bigquery


text:
Implement focused examples

Resolves #14
Added filtering via tags when running examples.
config.filter.include(tag1, tag2) // run only examples with tag1 or tag2
config.filter.exclude(tag1, tag2) // exclude examples with either tag1 or tag2

config.filter.matching(tag1, ...tagn) // same as filter.include but will only apply if
                                      // any example matches the given tags

focus() tag is provided and is the default value for config.filter.matching. To focus an example
tag it with focus() or use fit(...) instead of it(...).

Current coverage is 88.26%

Merging #17 into master will increase coverage by +1.35% as of 975aafc

@@            master     #17   diff @@
======================================
  Files           18      21     +3
  Stmts          321     375    +54
  Branches        49      57     +8
  Methods          0       0
======================================
+ Hit            279     331    +52
- Partial         17      19     +2
  Missed          25      25

Review entire Coverage Diff as of 975aafc

Powered by Codecov. Updated on successful CI builds.

authors: codecov-io raniejade

repo: raniejade/kspec


text:
Invalid conversion of "Expansion valve (pls)" value

It seems that the converter for the Expansion valve value is incorrect.
I was checking the values for the past hour and the value was slowly decreasing like this:
1280 -> 1024 -> 768 -> 512 -> 256 -> 0
Then it jumped to 65280 and continued to decrease from there:
65280 -> 65024 -> 64768 -> ...
It's clear that the endianness is wrong. The convId is set to 151, but it should be 152. This would yield a value around 240-260 for the same time period.
But the question is whether this value then needs to be converted to get the actual Expansion valve value. The service manual for the heat pump states the following:

The expansion valve Y1E has a hermetically sealed body with a slide-on stepping motor drive coil (480 pulses from fully closed to fully open position).

So, perhaps the value indicates the number of pulses (0 = valve closed, 480 = fully open). I'll continue following the value to see how it changes during different conditions.

Well, duh, I've only now realized that (pls) stands for pulses.
So, we just need to fix the convId. I'll submit a PR later today.

Nevermind. The include/def/ALTHERMA(LT_CA_CB_04-08KW).h file has the wrong register numbers for a bunch of values. I managed to fix it by updating the numbers from the def file for the larger unit.

repo: raomin/ESPAltherma

license: MIT


text:
Full RS storage system cause item and stack(s) overflow

Issue description:
This seems like a bug, and yet it doesn't (see the screenshots).
What happens:
Well my storage drives and other storage have been full for a while now, but I can kep inserting and extracting stuff to and from the system. It seems the SAG Mill push the processed materials out, but the RS system rejects it, and puts it back into the SAG Mill's output slot, which tricks the setup to keep pushing more materials to process.
What you expected to happen:
The system to hold, since the output slot is full, when the RS storage have no where to store the items.
Steps to reproduce:
I am using Ender IO's SAG Mill's that is pushing their output to a RS Interface.
Version (Make sure you are on the latest version before reporting):

Minecraft: 1.10.2
Forge: 12.18.3.2234
Refined Storage: 1.2.22
Sky Factory 3: 3.0.7

Does this issue occur on a server? [yes/no]
No.
Screenshots:
Interface:
imgur.com

The SAG Mill output slots was similar, but the screenshot is gone and now it have cleared up, so cant take a new one.

Just noticed this as well when I look in the Disk Drive.
imgur.com

Tried to empty the drives. The result of that is that after a bit of time, my FPS drops to below 0, and the game is almost unplayable.  Tried to break the RS Controller as you suggested on another issue. That only made it worse and now it is completely unplayable, I cannot open GUI or interact at all, properly because of the delay :'(

That crash is a JourneyMap crash. I will look into the interface issue

But this is a duplicate of #1012

authors: raoulvdberge soerenkk

repo: raoulvdberge/refinedstorage


text:
Item duplicating and voiding

Playing in Sky factory 3.0.8
Steps to reproduce:

Create a simple storage/crafting grid/transmitter
travel far enough for the original system to unload
build a second system using the receiver and crafting grid
link the systems
Items that you put into the secondary system get voided
Items that you take out of the secondary system get duplicated
...

Version (Make sure you are on the latest version before reporting):

Minecraft: 1.10.2
Forge: 12.18.3.2254
Refined Storage: 1.2.22

Does this issue occur on a server? [yes/no]
Yes, have not tested in smp.

Should be fixed in RS for latest MC versions.

authors: UberAffe raoulvdberge


text:
Highly irregular behaviour involving whitelists/blacklists and item variants when "Use Damage" is disabled

Issue description: When importing or exporting items, if "Use Damage" is disabled, the whitelist/blacklist does not work as it should, and imports/exports all variants of a given item.
What happens:
When "Use Damage" is disabled, all variants of an item are considered the same item. This leads to several items unintentionally going through. For example:

I placed a one stone (0001/0), granite (0001/1), and andesite (0001/5) block in a chest which was attached to a disabled importer

I then accessed the importer, set it to blacklist only granite, disabled the "Use Damage" filtering option, and enabled said importer

Upon checking the grid, neither of the three blocks passed through the importer

However, if I re-enable the "Use Damage" option, the stone and andesite blocks will be pulled from the chest, and the granite block will remain, as intended. This issue will happen with any blocks that share the same variant, like stone bricks and cracked stone bricks, for instance.
What you expected to happen:
That regardless of the "Use Damage" setting, the granite block would remain in the chest, while the stone and andesite blocks would be imported into the grid
Steps to reproduce:

Put down a chest, attach importer or exporter to it
Access the importer/exporter, blacklist any item that shares an ID with variants, and turn off the "Use Damage" option
Place said item along with several of its variants in the chest/grid
No items will have gone through the importer/exporter

Version (make sure you are on the latest version before reporting):

Minecraft: 1.12.2
Forge: 1.12.2 - 14.23.5.2847
Refined Storage: 1.6.15

Does this issue occur on a server? Yes
If a (crash)log is relevant for this issue, link it here: N/A

In 1.12 and below the "Use Damage" option refers to whether or not a filter should comparing items metadata value or if it should ignore their metadata value.
The name "Use Damage" comes from the fact that damaged items use the metadata value to indicate how damaged they are.
Unfortunately, other things like stone, wool, wood,  concrete, etc. also use the metadata value for differentiating between different variants of the same block.
The behavior you are seeing is completely correct and intended. With damage disabled, the filter will match all variants of stone while enabled will only blacklist granite.
In 1.13+ metadata is gone and these things should no longer be quite as unintuitive.

I see. I understand how metadata works, and that a proper durability filter would be bothersome to implement, but in that case, shouldn't the option at least be relabeled in 1.12.2 to "match metadata" or something along those lines? This behaviour might be correct and intended, but the description is inaccurate to say the least

True. But this won't be changed anymore.

that's fair. this does make sense when you look at the whole picture, it was a misconception on my part

authors: Darkere KirikaAetheria raoulvdberge


text:
Logo Design Proposal

Good day Sir @rap2hpoutre , I am Tobaloidee (graphics designer) and I have contributed to your other project. I just want to offer you again a logo design proposal as a gift for free. If you will permit me Sir i will do it asap. Thanks and my best regards!

Hi, thank you! I remember you and your awesome work on Laravel Fast Excel 👍 !
I feel that this package does not require a logo right now: I think the relevant part of the readme is the small GIF that shows the lib running. So this lib already has its identity, thanks to this GIF with dog and mountain. And it has only 700+ downloads right now, so I think it's a tiny lib with almost no audience: it does not require a logo.
Anyway, I remember you and your work: be sure I will ask you to draw a logo if this lib become more popular! If it has, let's say, 10K downloads, maybe I will reconsider your proposal! (Still, if you consider it as an exercise for you, you are free to draw one).
Best regards!


text:
pycache

pycache ne doit pas être sur votre dépôt.

Corrigé sur la branche afficher-la-page-accueil

Corrigé sur la branche afficher-la-page-accueil

authors: nrichardqc raphaelgrougnet

repo: raphaelgrougnet/Cinerama


text:
Support for input radios

When serialize radio by checked attribute, it was getting always the
first option

See Issues #2


text:
Add an argument to the config task to allow one top-level key to be…

… printed instead of the whole hash

Cool :+1:


text:
Fixes startup of test cluster

This commit fixes moves the assignment of the ES_VERSION environment variable so that it is in scope durring the command.

:+1:


text:
Additional cleanup

PR cleans up a few remaining items before release:

Metdata in pyproject.toml
Remove skips and update tests

Does this close https://github.com/rapidsai/pynvjitlink/issues/4 ?

authors: brandon-b-miller quasiben

repo: rapidsai/pynvjitlink


text:
Remove unneeded inclusions of the old setup_cpm_cache.cmake

As part of https://github.com/rapidsai/rapids-cmake/pull/81 the setup_cpm_cache.cmake file was moved and refactored.
In that PR all callers of setup_cpm_cache() had been updated, but I missed a couple of tests that just included the file. This removes those unneeded inclusions.

@gpucibot merge

repo: rapidsai/rapids-cmake


text:
Use cargo strip option for cross-platform stripping

cargo strip has been stabilized. We should enable it after the release is out.

Fixed in 46825810383798daf01000572e9e64a626191ea4


text:
Belongs to One has an incorrect URL in show page

Belongs to One has an incorrect URL in show page http://localhost:8000/wire//show/1?route=profile

This bug was resolved in 1.2.7

repo: rapkit/wire


text:
DMA heap allocator

Add a DMA heap allocator, to allow the output buffers to be cached. This can give a large performance improvement when the MappedArray is then used by the application, and also elsewhere whenever the buffers are used.

@will-v-pi Thanks. I've updated the libcamera installation so the tests should stand a slightly higher chance of working next time. Do you want to have a look at the flake8 complaints? I did try to tidy them all up recently (though it does look like there might be a few still lurking). Thanks!

All looks great to me! One small thing, should we include a small test of using the libcamera allocator as well? I don't think there's any reason a user would ever do this, but maybe adding a small test case into picamera2/tests would ensure we don't accidentally break it in some way?

authors: davidplowman will-v-pi


text:
🛑 NJU Mirror (mirrors.nju.edu.cn) is down

In e46b611, NJU Mirror (mirrors.nju.edu.cn) (https://mirrors.nju.edu.cn) was down:

HTTP code: 502
Response time: 1718 ms

Resolved: NJU Mirror (mirrors.nju.edu.cn) is back up in 3a91506.

repo: raspbian-addons/status


text:
[NEW BONUS GUIDE] Install & enable I2P daemon + configuration + uninstall

What
New bonus guide to enable I2P network adding network private redundancy
Sections added:

Description of the service & illustration
Install & enable the I2P daemon
Configuration to enable only in BTC Core for the moment
Uninstall section

Why
This can lead to a significant improvement in reducing potential network failures in the Raspibolt nodes.
How
New guide document to include the new feature
Scope

[ ] significant change to core configuration
[x] independent bonus guide
[ ] simple bug fix

Open issue: #953
Test & maintenance
I tested all and is working fine for me:
bitcoin-cli -netinfo
Bitcoin Core client v23.0.0 - server 70016/Satoshi:23.0.0/

         ipv4    ipv6   onion     i2p   total   block
in          0       0      25       2      27
out         7       0       2       1      10       2
total       7       0      27       3      37

Animated GIF

Apart from nits above, tACK from me, except for uninstall part.

Fixed, re-review

Thanks for yours reviews guys!
When you say tACK or tACK, do it mean that I have to take action somehow?
What mean tACK and untACK?
Sorry for my question, I'm noob in Github yet 🙏
Thanks again

Thanks for yours reviews guys!
When you say tACK or tACK, do it mean that I have to take action somehow?
What mean tACK and untACK?
Sorry for my question, I'm noob in Github yet 🙏
Thanks again
Thanks for the explanations,
Let me arrive to my desk and I change this

Fixed duplicate command & standardized format. Ready for the merge! Let's go! 🚀

authors: kristapsk twofaktor

repo: raspibolt/raspibolt


text:
Add Rows and Columns iterators to Rect

Problem
Often we write code in rendering functions that does something for each row or each column.
These tend to use some sort of index to iterate over the bounds of the area.  E.g:
https://github.com/ratatui-org/ratatui/blob/f13fd73d9ec108af723a9cd11f4262f2b09c9d25/src/widgets/clear.rs#L27-L35
Many of these sorts of things would benefit from iterating over a Rect as the Rows or Columns instead.
for row in area.rows() {
    for cell in row.columns() {
        buf.get_mut(cell.x, cell.y).reset();
    }
}

Additionally, by returning iterators, these can be composed using th iterator operations (like zip, merge, chain etc.)
E.g.:
self.lines.iter()
    .zip(area.rows())
    .foreach(|(line, row)| line.render(row, &mut buf));

Solution

Implement rows() and columns() method on Rect. These should each return a custom iterator. I think these might be called Rects, though there is probably a benefit to calling these Rows and Columns instead as I suspect it will be easier to keep state smaller with two separate iterator types.
Add Unit tests
Add Docs
Update widget code to use these methods to prove them out.
Update any examples where these might be useful.

Alternatives
Additional context
Marked as a good first issue. Happy to provide any guidance necessary on this one.

Hello! I would like to work on this issue. Do I have to create a struct called Iterator and add some logic to iterate over Columns and Rows structs, and then add rows() and columns() method to the impl of Rect?

Hello! I would like to work on this issue.

Welcome. I've assigned this to you.

Do I have to implement an custom Iterator and add next() to iterate over Columns and Rows structs, and then add rows() and columns() method to the impl of Rect?

Yes

Should I make a separate file? Or work in the rect.rs

I expect that each iterator is probably not more than about 15 LoC + tests and docs, so adding these to rect.rs is probably the right place to put the code.

Hi! I am encountering a problem when I try to push.
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.

repo: ratatui-org/ratatui


text:
Back button not changing views

Once in the classes or professors view, clicking the back button changes the url but not the actual page itself. Probably a bug somewhere within all the switch statements in dashboard.tsx and router.tsx.

Ah, the routing is super messed up. This is because I rushed through it and therefore did a particularly poor job setting it up correctly. In an ideal situation, we'd have the Home, Class and Professor views rendered directly from the router instead of passing props through the Dashboard.

Yeah ok that's what I was thinking

repo: ratemyclass/RateMyClass


text:
fix bugs by using float instead of int

modify the expressions like "1/3" to be "1/3.0", otherwise it will always be ZERO.

Merging, but again note this repo is deprecated and everyone should be using FastLED instead.

authors: randysuen ratkins

repo: ratkins/RGBConverter

license: WTFPL


text:
When in Minimized mode you can't access settings.

Either i'm missing something or how do i exit this.

It happens by design if you have minimal mode as well as the hide channels settings enabled. When that happens you should use the keyboard shortcut ctrl+,

authors: MatthewClaythone rauenzi

repo: rauenzi/BetterDiscordApp


text:
Bot stops retweeting after a while

If you let it run for a while, it eventually just completely stops retweeting and just scrapes for new tweets forever without doing anything with them.

Same issue here. it's just stops retweeting at some point, finding new tweets from search and spam these results over and over. After some time it goes into 10min timeout and after that it continue showing the search results again till infinity :(

How is the status here? Any finds why the bot stopping his 'work' after some time and only run from timeout to timeout without showing any tweeted content?

authors: Trophonix sebflex

repo: raulrene/twitter-contest-js-bot


text:
Multiple packages out of 1 repository

I'm trying to use hyperbole using the following straight recipe:
  (straight-use-package
   '(hyperbole
     :files ("*.el" "kotl/*.el" "man/*.info" "man/*.texi")
     :host github :repo "rswgnu/hyperbole"))

But I get the following error: eval-buffer: Cannot open load file: No such file or directory, kotl/kotl-autoloads
I'm assuming it's because my use :files to load 2 packages out of 1 repository isn't correct. How should this be done properly?

The code for hyperbole expects all the kotl files to be placed in a kotl subdirectory. Just use this instead:
(straight-use-package
 '(hyperbole
   :files ("*.el" ("kotl" "kotl/*.el") "man/*.info" "man/*.texi")
   :host github :repo "rswgnu/hyperbole"))

On another note, apparently byte-compiling hyperbole causes global keybindings to registered in the current session. What the actual ~swearword~?

Radon Rosborough notifications@github.com writes:

On another note, apparently byte-compiling hyperbole causes global keybindings to registered in the current session. What the actual ~swearword~?

Yeah, that's quite gross. Do you recall which keybinding or function
this was happening to? I'll report it as an issue.
Thanks for the help!

It appears to bind M-RET to hkey-either, C-h A to hkey-help, M-o to hkey-operate, C-c C-r to hui:ebut-rename, and the list goes on and on... goodness me.
The full list can be found here, and the problematic part is where everything is initialized when the file is loaded, see here.
If the recipe is working for you, I'll close this issue. Thanks!


text:
Add kubectl ray cluster log command

Why are these changes needed?
This PR adds the kubectl ray cluster logs command to retrieve the head node logs for a ray cluster.

Related issue number

Checks

[ ] I've made sure the tests are passing.
Testing Strategy

[x] Unit tests
[ ] Manual tests
[ ] This PR is not tested :(

@chiayi can you share the output of running the kubectl ray cluster logs command?

This is what it looks like when it downloads the file. Please let me know if I should add more logs.
Result:

@chiayi in your last screenshot, why is there two directories named <pod-name> and <pod-name>-logs?

One of the them is the pod logs, and another one is the directory that contains all the files from /tmp/ray/session_latest/logs/.

I'm going to rename the pod log one to include pod-logs. Let me know if there is something else I should as well.

I suggest having just one directory per pod named after the pod name and just add a stdout.log file in there

New output directory format:

Current flow:

Out-dir is no longer required and will download to current dir if not specified.

Instead of defaulting to current-dir, can we default to ./<cluster-name> ?

FYI, the lint failure is fixed in https://github.com/ray-project/kuberay/pull/2366

@chiayi would you mind fixing the linter issue? Thanks!

@kevin85421 I merged in the pervious linter fix, the current linter issues are being fixed in #2368.

authors: andrewsykim chiayi kevin85421

repo: ray-project/kuberay


text:
disable grpc reuse port

Disable grpc port reuse, which can cause bizarre problem described here.
Close #124

What's the progress ?

authors: NKcqx jovany-wang

repo: ray-project/rayfed


text:
group parameter not being used in RayXGBRanker

Hi!
I have been trying to use RayXGBRanker, but it seems like the group parameter is not being considered for building the model.
Attaching the following code to reproduce the same:
Data preparation
from xgboost_ray import RayXGBRanker, RayParams
from sklearn.datasets import load_breast_cancer
from sklearn.model_selection import train_test_split
import numpy as np

seed = 42

X, y = load_breast_cancer(return_X_y=True)
X_train, X_test, y_train, y_test = train_test_split(
   X, y, train_size=0.1, random_state=42
)
# This is done just to get random relevant values for ranker
y_train = np.random.rand(len(y_train))

1st inference
group=np.array([[56]])
clf = RayXGBRanker(
   n_jobs=2,
   random_state=seed
)
clf.fit(X_train, y_train, group=group, ray_dmatrix_params={})
pred_ray = clf.predict(X_test[:10])
print(pred_ray)

1st inference result: [-1.4302582   0.80665004 -1.656052    2.8729537   0.23208997  2.1761725  -1.1084297  -2.1263309   5.631699   -4.417554  ]
2nd inference
group=np.array([[20, 10, 26]])
clf = RayXGBRanker(
   n_jobs=2,
   random_state=seed
)
clf.fit(X_train, y_train, group=group, ray_dmatrix_params={})
pred_ray = clf.predict(X_test[:10])
print(pred_ray)

2nd inference result: [-1.4302582   0.80665004 -1.656052    2.8729537   0.23208997  2.1761725  -1.1084297  -2.1263309   5.631699   -4.417554  ]
As we can see, both 1st and 2nd inference pieces are giving the same predictions even though we have changed the group parameter.
Could you guys please let me know any solution to this problem?
Versions
xgboost==1.5.2
xgboost-ray==0.1.6
ray==1.9.2

Thanks!
Rama

I can reproduce this error. Working on a fix. Thanks for the report!

Thanks!
On a side note, if we don't pass ray_dmatrix_params={} in the clf.fit line, we get the following error. Any idea why?
---------------------------------------------------------------------------
TypeError                                 Traceback (most recent call last)
<ipython-input-6-7afbfa443f04> in <module>
      5 )
      6 # clf.fit(X_train, y_train, group=group, ray_dmatrix_params={})
----> 7 clf.fit(X_train, y_train, group=group)
      8 pred_ray = clf.predict(X_test[:10])
      9 print(pred_ray)

/opt/conda/lib/python3.6/site-packages/xgboost/core.py in inner_f(*args, **kwargs)
    504         for k, arg in zip(sig.parameters, args):
    505             kwargs[k] = arg
--> 506         return f(**kwargs)
    507
    508     return inner_f

/opt/conda/lib/python3.6/site-packages/xgboost_ray/sklearn.py in fit(self, X, y, group, qid, sample_weight, base_margin, eval_set, eval_group, eval_qid, eval_metric, early_stopping_rounds, verbose, xgb_model, sample_weight_eval_set, base_margin_eval_set, feature_weights, callbacks, ray_params, _remote, ray_dmatrix_params)
    985                     **ray_dmatrix_params
    986                 }),
--> 987                 **self._ray_get_wrap_evaluation_matrices_compat_kwargs())
    988
    989         evals_result = {}

/opt/conda/lib/python3.6/site-packages/xgboost/sklearn.py in _wrap_evaluation_matrices(missing, X, y, group, qid, sample_weight, base_margin, feature_weights, eval_set, sample_weight_eval_set, base_margin_eval_set, eval_group, eval_qid, create_dmatrix, enable_categorical, label_transform)
    293         feature_weights=feature_weights,
    294         missing=missing,
--> 295         enable_categorical=enable_categorical,
    296     )
    297

/opt/conda/lib/python3.6/site-packages/xgboost_ray/sklearn.py in <lambda>(**kwargs)
    983                 create_dmatrix=lambda **kwargs: RayDMatrix(**{
    984                     **kwargs,
--> 985                     **ray_dmatrix_params
    986                 }),
    987                 **self._ray_get_wrap_evaluation_matrices_compat_kwargs())

TypeError: 'NoneType' object is not a mapping

Ah, that's an oversight for the ranker. Will be fixed as well. Thank you!

@ramab1988 This will be fixed in the next release. However, you won't be able to use the group parameter - you will have to use the qid parameter instead, which is a vector mapping each row to the group they belong to. This is also the case for XGBoost-Dask.

Great! Thanks a lot for the quick fix. When can we expect the next release?

@krfricke I think we can make a release before the end of week, what do you think?


text:
Feature Request: Option to Include Image Results in Search Queries

Description
A feature that would make searching easier is including image results in search queries of the "file search" extension, as seen in the "Search Screenshot" extension. Adding a checkbox in preferences would allow users to opt-in to this feature. This way, those who prefer not to use it won't be affected.
I just realized that there were a separate extension for this.

@mathieudutour I did send multiple times via Send Feedback this and last year. I'm giving up...

repo: raycast/extensions


text:
running on mac brings pain. or at least does not work in xcode with paths set

howdy,
rather than post an email to you, someone else may have got this as well on mac.
so...
ive done the set up, just translated the spanish wiki for doing it with mac, and whilst making things like glfw3 work and compile, and have also setup the location of raylib.h by clicking and dragging in the location to the Search paths > header search paths/library search paths it brings up an error. screenshot shows error.

now i have tried again and again. but no dice, same message
xcode version is 7.3.1, plus used cmake to do the generation, and all that worked. so dont know whats up.
raylib looks interesting, a break away from my more bigger things ;)

also my other settings, for the library settings & the search paths. screenshots given

Hi lewislepton, just for record, you have tried adding to Library Search Paths: "/Users/lepton/Developer/raylib/RAYLIBGLFW/../../../Downloads/raylib-master/release/osx"?

yeah, that also does not work

Just reviewed tutorial and translated to english: https://github.com/raysan5/raylib/wiki/Compile-for-OSX
Tomorrow I'll try to check it on a Mac...

Do you have a libraylib.a on the release/osx folder of the library source code?

Do you have a libraylib.a on the release/osx folder of the library source code?

this is the setup with the library, which is right, also did compile etc. though i will move raylib to my developer folder just so it doesnt get lost in my downloads ;)

ok. so i have tried the latest update to the tutorial to build with mac, plus have tried the develop version, just to see. but the same problem happens.
but did notice that a raylib.h has compiled when i compiled the release/osx. before that did not happen

ah ha. noticed the error message is actually now saying that GLFW3 can not be found. which is weird, since i went through the same process. very odd

but everything is set up right. followed everything well and to the point. very strange. even the master is not building, does come up with the cant find glfw3 the same as the develop version, but master does not generate a raylib.h inside the release/osx folder

here is the project im working, with xcode
RAYLIBGLFW.zip

its set up with raylib just above the project folder, which was pointed to it

Hi @lewislepton, not sure what's the problem, it seems related to paths, it should work ok; actually @paezao is developing on OSX with raylib and it works fine... Maybe he can give you some feedback on your issue...

ok. so after some folling, did do a new project. everything works now. dont know why it did. because everything was the same settings, even c was used
here is the new, working project
RAYRAY.zip

Nice! Im glad it worked!

authors: lewislepton paezao raysan5

license: Zlib


text:
[build] -fgnu89-inline

Go recently blacklisted all CFLAGS and now allows only flags that are whitelisted, see https://github.com/gen2brain/raylib-go/issues/32 . I did remove that flag and it does build without it, but I am not sure what are the consequences.
If this is a must I can probably open issue with them, to try to also whitelist -fgnu89-inline.

Right now I can not remember what was the use for that flag... actually, I think it came from a PR from someone...

Ok, if it is not that important and it builds fine, I will just leave it removed then.
Thanks.

I think we should remove it in raylib too. It might lead to build errors down the road, as MSVC doesn't use the gnu89 inline definition. If we got any extern inlines, they should be replaced by plain inlines and vice versa.

Flag removed in commit https://github.com/raysan5/raylib/commit/97bf2706c497f90ea4e3ead4e69819bc7a1f6083

About extern inline, it's just used in raymath.h. It should be reviewed just there...

The problem with static inline is possible duplication of out-of-line functions, so we want raymath.h to have inline definitions and one source file to have the only out of line definitions. With C99 inline semantics that means:

raymath.h has plain inline definitions of the functions
core.c or some other .c file has all prototypes with extern in front of them.

e.g.
raymath.h:
inline float Clamp(float value, float min, float max)
{
    const float res = value < min ? min : value;
    return res > max ? max : res;
}

core.c:
#include <raymath.h>
extern float Clamp(float value, float min, float max);

Closing this issue, just need to review raymath.h, already a PR waiting and a related issue (https://github.com/raysan5/raylib/issues/498)


text:
Permission denied

Brief Intro
Trying to send a pull request for a minor Swift 4.2 improvement to Kth Largest Element, but getting Permission denied error while pushing my branch to remote(before I can create a Pull Request). Is there a process for getting permission to send pull requests?
More Details
Tried via both Github Desktop and command line.
On Github Desktop tool - Authentication Failed, "You may not have permission to access swift-algorithm-club. Check Preferences to make sure you’re still logged in." And I am sure I am logged in.
On command line:

git push origin kth-largest-random-update
remote: Permission to raywenderlich/swift-algorithm-club.git denied to Priyanka-.
fatal: unable to access 'https://github.com/raywenderlich/swift-algorithm-club.git/': The requested URL returned error: 403

Hey @Priyanka-! Thanks trying to make a pull request 😃
Usually what works best for me is to fork the repo first. Then from there you can push your changes to your fork and make a pull request from there by clicking New Pull Request -> compare across forks.

Ah, thanks @richard-ash , will do!

authors: Priyanka- richard-ash

repo: raywenderlich/swift-algorithm-club


text:
Module will not load if due to unfortunate settings only unreachable departures are in the list.

In TableBuilder the decision where to put the dividing ruler will fail if only unreachable departures are in the list.

Prevented such unfortunate settings and refined the way how the ruler parting unreachable and reachable departures is inserted.
Done with PR #41.

repo: raywo/MMM-PublicTransportHafas


text:
verifyPaymentSignature didn't return true value at any instance.

It should be something like this
<?php

namespace Razorpay\Api;

class Utility
{
    const SHA256 = 'sha256';

    public function verifyPaymentSignature($attributes)
    {
        $actualSignature = $attributes['razorpay_signature'];

        $paymentId = $attributes['razorpay_payment_id'];

        if (isset($attributes['razorpay_order_id']) === true)
        {
            $orderId = $attributes['razorpay_order_id'];

            $payload = $orderId . '|' . $paymentId;
        }
        else if (isset($attributes['razorpay_subscription_id']) === true)
        {
            $subscriptionId = $attributes['razorpay_subscription_id'];

            $payload = $paymentId . '|' . $subscriptionId;
        }
        else
        {
            throw new Errors\SignatureVerificationError(
                'Either razorpay_order_id or razorpay_subscription_id must be present.');
        }

        $secret = Api::getSecret();

        return self::verifySignature($payload, $actualSignature, $secret);
    }

    public function verifyWebhookSignature($payload, $actualSignature, $secret)
    {
        self::verifySignature($payload, $actualSignature, $secret);
    }

    public function verifySignature($payload, $actualSignature, $secret)
    {
        $expectedSignature = hash_hmac(self::SHA256, $payload, $secret);

        // Use lang's built-in hash_equals if exists to mitigate timing attacks
        if (function_exists('hash_equals'))
        {
            $verified = hash_equals($expectedSignature, $actualSignature);
        }
        else
        {
            $verified = $this->hashEquals($expectedSignature, $actualSignature);
        }

        if ($verified === false)
        {
            throw new Errors\SignatureVerificationError(
                'Invalid signature passed');
        }
return true;
    }

    private function hashEquals($expectedSignature, $actualSignature)
    {
        if (strlen($expectedSignature) === strlen($actualSignature))
        {
            $res = $expectedSignature ^ $actualSignature;
            $return = 0;

            for ($i = strlen($res) - 1; $i >= 0; $i--)
            {
                $return |= ord($res[$i]);
            }

            return ($return === 0);
        }

        return false;
    }
}

@Itxshakiil  verifyPaymentSignature throws an exception when signature verification fails and returns null otherwise. This is expected behaviour. It hasn't been called out in the doc/README though, we should get that added. Thanks!

@harman28 , Okay actually I expected it should return true if signature verifies.

repo: razorpay/razorpay-php