text:
luci-app-ddns: dnsomatic.com support is broken

dnsomatic.com is all-in-one ddns services updater.
To use it I need to specify all.dnsomatic.com as Hostname/Domain. It is not real domain and it has nothing common with ddns domains that redirect to my ip.
When I specify all.dnsomatic.com it tries to nslookup on it but, of course, fails and doesnt do anything else.
So it is wrong to check public IP by specified Hostname/Domain in case of dnsomatic.com usage.
Well, I can specify one of my ddns domains which direct to my IP and added to dns-o-matic.
Then nslookup will be correct but request to dnsomatic.com will be wrong cause it puts my specified domain instead of all.dnsomatic.com:
updates.dnsomatic.com/nic/update?hostname=******.duckdns.org

instead of:
updates.dnsomatic.com/nic/update?hostname=all.dnsomatic.com

@chris5560, please, have a look at it.

Should go to packages feed, cause it references to ddns-scripts package. Sorry.

repo: openwrt/luci


text:
19.07: mosquitto: support notifications_local_only flag

Supported since mosquitto 1.5 released in May 2018, and has long
been supported in the init scripts.
Signed-off-by: Karl Palsson karlp@etactica.com

Merged, thanks!

source: gharchive/pull-request

authors: jow- karlp

license_type: permissive

license_source: github-api


text:
Provide more demo brinefiles for common salt formula

I like to propose brine to provide more common used example brinefiles.
rabbitmq examples is not common enough.

I think we should have a different repo for such a project, but I can see how that might be useful.

source: gharchive/issue

authors: druonysus tjyang

repo: openx/brine

license: mit

license_source: bigquery


text:
Enabling TSAN fails the building of runtime on macOS for iPhone

What happened?
The following CMake configuration for building the IREE runtime for iPhone fails on macOS.
        cmake -S . \
              -B "$build_dir" \
	      -DCMAKE_C_COMPILER=clang \
	      -DCMAKE_CXX_COMPILER=clang++ \
	      -DCMAKE_RANLIB=/usr/bin/ranlib \
	      -DCMAKE_CXX_COMPILER_RANLIB=/usr/bin/ranlib \
	      -DCMAKE_BUILD_TYPE=RelWithDebInfo \
	      -DIREE_ENABLE_TSAN=ON -DIREE_BYTECODE_MODULE_ENABLE_TSAN=ON -DIREE_BYTECODE_MODULE_FORCE_LLVM_SYSTEM_LINKER=ON \
              -GNinja \
              -DCMAKE_SYSTEM_NAME=iOS \
              -DCMAKE_OSX_SYSROOT="$(xcodebuild -version -sdk iPhoneSimulator Path)" \
              -DCMAKE_OSX_ARCHITECTURES="arm64" \
              -DCMAKE_SYSTEM_PROCESSOR="arm64" \
              -DCMAKE_OSX_DEPLOYMENT_TARGET=11.0 \
              -DCMAKE_IOS_INSTALL_COMBINED=YES \
              -DIREE_HOST_BIN_DIR="$IREE_BUILD_COMPILER_INSTALL_DIR"/bin \
              -DCMAKE_INSTALL_PREFIX="$build_dir"/install \
              -DIREE_BUILD_COMPILER=OFF >"$build_dir"/build.log 2>&1

It seems the linking of iree_test fails
[422/422] Linking CXX executable bin/iree_test.app/iree_test
FAILED: bin/iree_test.app/iree_test
: && /usr/bin/clang++ -O2 -g -DNDEBUG -arch arm64 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator16.2.sdk -mios-simulator-version-min=11.0 -Wl,-headerpad_max_install_names -lm -lpthread CMakeFiles/iree_test.dir/test_api.c.o -o bin/iree_test.app/iree_test -F/Users/y/w/iree-ios/build/runtime/ios-sim-arm64/lib lib/iree.framework/iree  iree_core/build_tools/third_party/flatcc/libflatcc_parsing.a  iree_core/third_party/cpuinfo/libcpuinfo.a  iree_core/third_party/cpuinfo/deps/clog/libclog.a && :
Undefined symbols for architecture arm64:
  "___tsan_atomic32_compare_exchange_val", referenced from:
      _iree_thread_create in iree(threading_darwin.c.o)
      _iree_thread_start_routine in iree(threading_darwin.c.o)
      _iree_thread_release in iree(threading_darwin.c.o)
      _iree_thread_resume in iree(threading_darwin.c.o)
  "___tsan_atomic32_exchange", referenced from:
      _iree_task_poller_main in iree(poller.c.o)
      _iree_task_poller_request_exit in iree(poller.c.o)
      _iree_task_poller_await_exit in iree(poller.c.o)
      _iree_task_worker_main in iree(worker.c.o)
      _iree_task_worker_request_exit in iree(worker.c.o)
      _iree_task_worker_await_exit in iree(worker.c.o)
  "___tsan_atomic32_fetch_add", referenced from:
      _iree_hal_driver_retain in iree(driver.c.o)
      _iree_hal_allocator_retain in iree(allocator.c.o)
      _iree_hal_executable_loader_retain in iree(executable_loader.c.o)
      _iree_task_executor_retain in iree(executor.c.o)
      _iree_hal_subspan_buffer_initialize in iree(buffer.c.o)
      _iree_hal_buffer_initialize in iree(buffer.c.o)
      _iree_hal_subspan_buffer_create in iree(buffer.c.o)
      ...
  "___tsan_atomic32_fetch_sub", referenced from:
      _iree_hal_driver_release in iree(driver.c.o)
      _iree_hal_allocator_release in iree(allocator.c.o)
      _iree_hal_executable_loader_release in iree(executable_loader.c.o)
      _iree_task_executor_release in iree(executor.c.o)
      _iree_hal_subspan_buffer_deinitialize in iree(buffer.c.o)
      _iree_hal_buffer_release in iree(buffer.c.o)
      _iree_hal_buffer_map_fill in iree(buffer.c.o)
      ...
  "___tsan_atomic32_load", referenced from:
      _iree_task_executor_try_steal_task_from_affinity_set in iree(executor.c.o)
      _iree_task_is_ready in iree(task.c.o)
      _iree_task_call_execute in iree(task.c.o)
      _iree_task_poller_main in iree(poller.c.o)
      _iree_task_poller_is_zombie in iree(poller.c.o)
      _iree_task_scope_deinitialize in iree(scope.c.o)
      _iree_task_scope_is_idle in iree(scope.c.o)
      ...

Steps to reproduce your issue
No response
What component(s) does this issue relate to?
Runtime
Version information
No response
Additional context
No response

The above CMake configuration errors about
-- Performing Test HAVE_CXX_FLAG_WD654
-- Performing Test HAVE_CXX_FLAG_WD654 - Failed

I changed
https://github.com/openxla/iree/blob/5bc4afb6f74474818b75c07fd7da4d85d866af9e/build_tools/cmake/iree_setup_toolchain.cmake#L112-L115
into
if(IREE_ENABLE_TSAN)
  string(APPEND CMAKE_CXX_FLAGS " -fsanitize=thread")
  string(APPEND CMAKE_C_FLAGS " -fsanitize=thread")
  string(APPEND CMAKE_EXE_LINKER_FLAGS " -fsanitize=thread")
  string(APPEND CMAKE_MODULE_LINKER_FLAGS " -fsanitize=thread")
  string(APPEND CMAKE_SHARED_LINKER_FLAGS " -fsanitize=thread")
endif()

However, -fsanitize=thread does not in the link command-line
/usr/bin/clang++ -O2 -g -DNDEBUG -arch arm64 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator16.2.sdk -mios-simulator-version-min=11.0 -Wl,-headerpad_max_install_names -lm -lpthread CMakeFiles/iree_test.dir/test_api.c.o -o bin/iree_test.app/iree_test -F/Users/y/w/iree-ios/build/runtime/ios-sim-arm64/lib lib/iree.framework/iree  iree_core/build_tools/third_party/flatcc/libflatcc_parsing.a  iree_core/third_party/cpuinfo/libcpuinfo.a  iree_core/third_party/cpuinfo/deps/clog/libclog.a && :

If I go on to add string(APPEND CMAKE_STATIC_LINKER_FLAGS " -fsanitize=thread"), it will add -fsantize=thread to ar commands.

So, yes - CMAKE_STATIC_LINKER_FLAGS is the wrong thing to use. Trying to figure out why the earlier form isn't working.

CMAKE_EXE_LINKER_FLAGS should be working.

My change to CMAKE_EXE_LINKER_FLAGS and others works when building the IREE compiler and runtime for macOS. It does not working at linking when building only the runtime for iOS Simulator.

Quick Robin, to the stackoverflow cave.

This goes beyond my ios abilities and I don't know where to suggest looking more. One thing I would do would be to invoke cmake with --trace --trace-expand --trace-redirect=/tmp/cmake_trace.txt. That will dump a lot so I'd recommend only doing it on the runtime. Then see if any clues come out of grepping it for combinations of CMAKE_EXE_LINKER_FLAGS. Maybe something in the toolchain config is stomping on them (or ignoring?)?

iPhone devices does not support TSAN. Only iOS Simulator does. I added the control into a build bash script out of this repo.

authors: stellaraccident wangkuiyi

repo: openxla/iree


text:
JSON serialization/deserialization for the manifest in iree dispatch profiler

Currently IREE dispatch profiler uses pickle to serialize/deserialize, pickle has security concerns and we would like to use JSON for serialization/deserialization.
See comment from from @pzread here

@manishucsd Are you working on this?

authors: allieculp manishucsd


text:
Land a short-term fix for 128-bit stablehlo RNG

We can use a 128-bit counter for philox number generation. In these cases only load 64-bits of the key. This should work in the short term, and would only impact cases where we generate more than 2^64 random numbers.

Logged in https://github.com/openxla/iree/issues/14859

I updated to head and getting an RNG bug. Was this fix meant to resolve errors like this:
-:237:11: error: failed to legalize operation 'stablehlo.rng' that was explicitly marked illegal
-:237:11: note: see current operation: %184 = "stablehlo.rng"(%119, %117, %99) {rng_distribution = #stablehlo<rng_distribution UNIFORM>} : (tensor<i32>, tensor<i32>, tensor<1xi32>) -> tensor<2xi32>

No, this is for the stateless RNG op, that error is for the stateful one.

authors: jpienaar mariecwhite rsuderman


text:
Improve the accuracy of complex atanh and atan

As in the title.
The accuracy improvements are as follows (using ca 1000000 samples over the entire complex plane):

complex64 atanh:                         current main  -> this PR
ULP difference == 0 count is 257275    -> 868955
ULP difference == 1 count is 24034     -> 130206
ULP difference == 2 count is 1280      -> 2832
ULP difference == 3 count is 2903      -> 12
ULP difference >= 4 count is 716513    -> 0

complex64 atan:ULP difference == 0 count is 3326      -> 868953
ULP difference == 1 count is 6970      -> 130204
ULP difference == 2 count is 3384      -> 2832
ULP difference == 3 count is 3418      -> 12
ULP difference >= 4 count is 984903    -> 0

complex128 atanh:ULP difference == 0 count is 239712    -> 941283
ULP difference == 1 count is 2853      -> 60322
ULP difference == 2 count is 616       -> 400
ULP difference == 3 count is 8         -> 0
ULP difference >= 4 count is 758816    -> 0

This PR requires functional_algorithms 0.10.1 or newer.

@sdasgup3 @GleasonK please review.

Hi @pearu
I will review by today.

repo: openxla/stablehlo


text:
fix fuzz controller spell

What type of PR is this?

Uncomment only one /kind <> line, hit enter to put that in a new line, and remove leading whitespace from that line:
/kind bug
/kind documentation
/kind enhancement
/kind good-first-issue
/kind feature
/kind question
/kind design
/sig ai
/sig iot
/sig network
/sig storage

What this PR does / why we need it:
Which issue(s) this PR fixes:

Fixes #
Special notes for your reviewer:

Does this PR introduce a user-facing change?

other Note

/rerun

/lgtm

authors: Congrool huiwq1990 rambohe-ch

repo: openyurtio/openyurt


text:
Multiport service

When I have an application service that uses multiple ports, does Ziti support it? If supported, how would you like to configure it?

I assume here you are referring to "tunnelers" and not application embedded, right? Application embedded, you of course can do whatever you want and ports might (or might not) be relevant...
Assuming you're talking about tunnelers, when making the "intecept.v1" config you have the option to specify multiple ports. You can see an example on our doc page here: https://docs.openziti.io/docs/learn/core-concepts/config-store/config-type-intercept-v1/
It is using a low/high port of 5000, but you can make the low 4000 and the hight 6000 for example... Also notice it's an array. You can specify more than one range as well in the same intercept as shown below as an example. I'm gonna close this as answered. :)
{
    "protocols": [
        "tcp"
    ],
    "addresses": [
        "acme.example.ziti"
    ],
    "portRanges": [
        {
            "low": 500,
            "high": 5000
        },
        {
            "low": 15000,
            "high": 25000
        }
    ]
}

Thank you for your answer, my service is in the company intranet, I need to open port 80,443,5666,18002, many times I need to access this service at home

what i do now is to set intecept.v1 to specify multiple ports as above, and then set multiple terminating routers to edge_transport tcp:192.168.0.10:80,edge_transport tcp:192.168.0.10:443,edge_transport tcp :192.168.0.10:5666,edge_transport tcp:192.168.0.10:18002, after this setting, access to this service is failed, or there is another way to configure, Please tell me how to configure it. Please

Thank you very much. My problem has been resolved, and I hope your company is getting better and better

repo: openziti/ziti


text:
Rho 722 cleanup test

just test Travis before a real PR

tested, no missing script

repo: operator-framework/community-operators


text:
Updating Nuodb operator to v2.0.3

Signed-off-by: Ashutosh Shukla ashukla@nuodb.com
Thanks submitting your Operator. Please check below list before you create your Pull Request.

Flat operator directory structure is obsolete from 23-rd of October 2019, only nested directory structure will be accepted.

Updates to existing Operators

[x] Is your new CSV pointing to the previous version with the replaces property?
[x] Is your new CSV referenced in the appropriate channel defined in the package.yaml ?
[x] Have you tested an update to your Operator when deployed via OLM?
[x] Is your submission signed?

Your submission should not

[x] Modify more than one operator
[x] Modify an Operator you don't own
[x] Rename an operator - please remove and add with a different name instead
[x] Submit operators to both upstream-community-operators and community-operators at once
[x] Modify any files outside the above mentioned folders
[x] Contain more than one commit. Please squash your commits.

Operator Description must contain (in order)

[x] Description about the managed Application and where to find more information
[x] Features and capabilities of your Operator and how to use it
[x] Any manual steps about potential pre-requisites for using your Operator

Operator Metadata should contain

[x] Human readable name and 1-liner description about your Operator
[x] Valid category name1
[x] One of the pre-defined capability levels2
[x] Links to the maintainer, source code and documentation
[x] Example templates for all Custom Resource Definitions intended to be used
[x] A quadratic logo

Remember that you can preview your CSV here.
--
1 If you feel your Operator does not fit any of the pre-defined categories, file a PR against this repo and explain your need
2 For more information see here

@Ashutosh-Shukla, form, locally, it is failing on:
FAIL: Failed to pick up subscription "nuodb-operator-bundle-sub"
error: the server doesn't have a resource type "packagemanifests"

Thanks @J0zi, the bundle was not pushed correctly, i have updated the bundle and the subscription will be picked up correctly

@J0zi Could you trigger the build with the first .crd.yaml, the build seems to picking up a dependent crd for scorecard. See the first PR https://github.com/operator-framework/community-operators/pull/864.
Appreciate all the help.

build restarted


text:
draft of changes to simplify the recording mechanism

cc @csviri @metacosm It seems like we can simply some of the mechanics discussed on https://github.com/fabric8io/kubernetes-client/issues/4077 what are your thoughts on the following

Filtering your own creates / updates:

Add an annotation to the resource
https://github.com/operator-framework/java-operator-sdk/compare/main...shawkins:eventing?expand=1#diff-aa20588ab4b1ff4f171a897d4042d1b055c02737b067d09aaeb9cfd770adf3a0R132
This is checked later - if it matches, then we skip the event.  If another actor modifies the resource and leaves this annotation alone or removes it, then we'll know it's an event that this KubernetesDependentResource was not responsible for.
https://github.com/operator-framework/java-operator-sdk/compare/main...shawkins:eventing?expand=1#diff-5947c6b7b60c804e59df2f5cfe62719dc51d3cc50b5e6cb1ddd1bc41323d3b77R162
Pros: Removes complexity associated with event recording.
Cons: Could be seen as "polluting" managed resources.  Someone could also be "adversaral" and update this annotation for their own create / updates to make the operator ignore them.
Alternative: Don't worry about doing this - just allow the temporary cache check and the desired matcher minimize the api server calls.  If the event comes before you get a chance to update the temporary cache, then you'll just end up processing it.

Update the temporary cache based solely upon the resourceVersion

https://github.com/operator-framework/java-operator-sdk/compare/main...shawkins:eventing?expand=1#diff-5947c6b7b60c804e59df2f5cfe62719dc51d3cc50b5e6cb1ddd1bc41323d3b77R267
Pros: Again removes the complexity associated with event recording.
Cons: The logic may move further ahead by basing a change on what is in the temporary cache - without first receiving the event.  Once the original event is recieved, that will move the cache state backwards (although that same problem exists currently I believe).
Alternative: Parse the resourceVersion to determine the actual latest state - but this may break at any time if the api server either obfuscates or moves away from the etcd incrementing resourceVersions.

All operations are locked

https://github.com/operator-framework/java-operator-sdk/compare/main...shawkins:eventing?expand=1#diff-aa20588ab4b1ff4f171a897d4042d1b055c02737b067d09aaeb9cfd770adf3a0R131
I changed the non-SSA case to be locked, but I'm guessing it was probably unlocked for a reason.
Cons: If the Watch lags, or you mishandle the temporary cache, and some other actor makes change to the resource, you will not be able to reconcile that resource until the Watch is re-established.  Also for SSA and a reconstructive controller it mostly shouldn't matter if you know the current state, you just need to assert your desired state.

This is checked later - if it matches, then we skip the event. If another actor modifies the resource and leaves this annotation alone or removes it, then we'll know it's an event that this KubernetesDependentResource was not responsible for.

This makes sense, seems radically simplifies the solution. However there might be some edge cases when this might not work. For example if an event received from previous update later (this probably a extremely rare case) but resource was already used from the cache during the update. (Although this is probably an issue also now).
Regarding polluting of the resource tbh I would not worry to much, this is a higher level abstraction, such an inconvenience I think is acceptable, at least I don't see any issues why it would not be. But, yes the current solution is nicer in this regard.

Alternative: Don't worry about doing this - just allow the temporary cache check and the desired matcher minimize the api server calls. If the event comes before you get a chance to update the temporary cache, then you'll just end up processing it.

I think this is a valid approach too, although once I measured this, and roughly in 50% cases I actually received the event before the resource ended up in cache. What was very surprising for me. Might worth to just repeat the experiment and see if this is the case also for DR (I was doing it for primary resources). If this works in most of the cases, we could just do it this way.

Cons: The logic may move further ahead by basing a change on what is in the temporary cache - without first receiving the event. Once the original event is recieved, that will move the cache state backwards (although that same problem exists currently I believe).

This is not the case, there is now guaranteed "monotonity". But for that need the optimistic locking. Actually if case of event recording we might not need that, might be possible without (for updates), but something have to think about.

I changed the non-SSA case to be locked, but I'm guessing it was probably unlocked for a reason.

I don't get this, it is locked now.

Alternative: Parse the resourceVersion to determine the actual latest state - but this may break at any time if the api server either obfuscates or moves away from the etcd incrementing resourceVersions.

The first implementations were doing this, not sure about solution like k3s and others if still use  resourceVersion as a string, rather would keep to the contract.

But overall, I think we can simplify this, on the other hand it is working now. All the other solutions are simpler, but makes compromises that the event recording does not. And it's implemented already. Soo 🤷

But overall, I think we can simplify this, on the other hand it is working now. All the other solutions are simpler, but makes compromises that the event recording does not. And it's implemented already. Soo 🤷

While I agree on the general approach that if it's not broken, we shouldn't fix it, I also think there's value, moving forward, to simplify things if we can as this will make it easier for people to contribute and maintain the code.

This is not the case, there is now guaranteed "monotonity". But for that need the optimistic locking. Actually if case of event recording we might not need that, might be possible without (for updates), but something have to think about.

That's not what I'm saying.  If you have the sequence:

update temporary cache to v1

some other event triggers reconcilitation, you work off of v1 without yet seeing the v1 event and create version v2 - arguably this may be indicative of problem with the matching logic, but as we have seen this does now happen with server side apply

now you get the event for v1 - you will remove the temporary cache entry and the actual cache will be at v1.

until you get the event for v2, you are operating off of a stale version.

I don't get this, it is locked now.

It is not - https://github.com/operator-framework/java-operator-sdk/blob/b66ef938a9290a1dbf83b35e152f144cc01bcb8a/operator-framework-core/src/main/java/io/javaoperatorsdk/operator/processing/dependent/kubernetes/KubernetesDependentResource.java#L157 is calling replace, not update.  Is there an invocation of lockResourceVersion that I'm missing?

is calling replace, not update. Is there an invocation of lockResourceVersion that I'm missing?

will create a PR to replace this to update

But overall, I think we can simplify this, on the other hand it is working now. All the other solutions are simpler, but makes compromises that the event recording does not. And it's implemented already. Soo shrug

While I agree on the general approach that if it's not broken, we shouldn't fix it, I also think there's value, moving forward, to simplify things if we can as this will make it easier for people to contribute and maintain the code.

I actually don't like that proverb, I mean that we do some other compromises.

That's not what I'm saying. If you have the sequence:

update temporary cache to v1
some other event triggers reconcilitation, you work off of v1 without yet seeing the v1 event and create version v2 - arguably this may be indicative of problem with the matching logic, but as we have seen this does now happen with server side apply
now you get the event for v1 - you will remove the temporary cache entry and the actual cache will be at v1.

until you get the event for v2, you are operating off of a stale version.

yes, this is true, we could avoid this just by parsing the resource version.

Maybe we can discuss this on next community / fabric8 meeting? regarding what approach to take?

Made a couple of changes:

aligned with #2006 (it still makes sense to me though to just move up the call that is setting the resourceVersion for SSA - even if you change how the matcher works later that would still be correct)
because of where the tracking annotation is set, it needs filtered out of the SSA matching logic - that was causing the test failure as it would keep thinking the configmap needed updated, which had the side effect of deleting the pods.  There's probably a better way to do this.

The integration tests are failing due to the changes to CreateUpdateEventFilterTestReconciler - that was manually exercising the dependent logic.  With that removed there are 2 executions because we can't tell without the annotation that we're responsible for the create - but as expected the second execution does nothing.
As for the issue of putting the entry unconditionally into cache: https://github.com/operator-framework/java-operator-sdk/pull/2006#issuecomment-1669695457 that's done here conditionally - although with slightly different logic than what is in TemporaryResourceCache.putUpdatedResource  In fact I don't think the code in this pr requires explicit locking for correctness - you should see the same eventual correctness either way.

While I agree on the general approach that if it's not broken, we shouldn't fix it, I also think there's value, moving forward, to simplify things if we can as this will make it easier for people to contribute and maintain the code.

I wouldn't say that things are broken, but there are implications to locking, temporary cache, and the SSA matching that don't degrade nicely - if the temporary cache gets off it blocks reconciliation when locked, and if the SSA matching is off then we can get stuck in a reconciliation loop.  Ideally we want things to degrade as much as possible to simply an unomptimized state - I'm thinking that reducing some of the complexity may help with that.

Have to take a look on the test, but in general I like this idea very much. Simplifies the code, there is overhead with the annotation but that is negligible. Added some points to clarify, have to think through some cases, but I think we should go this way.

One additional though regarding optimistic locking (ssa version) , we saw sometimes that users use some data from the actual resource to create the desired for update. Without the optimistic locking, this might lead to some unexpected behavior, if some would need more strict consistency. So thinking about a feature flag for this (will create a separate issue). Just wanted to hear some opinions in case.

To move this out of draft there are a couple of things to cover:

should the feature of adding the annotation be enabled/disabled via flag?  If it's turned off, that just means we won't skip the event if it comes earlier than the update response.  As mentioned above that may not be a big deal - operators that are working off of caches and that have effective matchers will just use a few extra cpu cycles.
Is there a better way to do this: https://github.com/operator-framework/java-operator-sdk/pull/2005/files#diff-7568f2dc58ce3a6a5d7ce2d5227aeb49402136b091fb19a4d8cadb28351ce709R93 - and does it need to be accountted for in the non-SSA case as well?
what tests to include - integration? or will some unit tests suffice

@shawkins  one more note, it would be better to target the next branch with this PR, there is already a small feature there where will be probably conflicts but nothing too serious, in next we are developing the next minor/major version usually. Would like to have this rather as part of next minor version.

authors: csviri metacosm shawkins

repo: operator-framework/java-operator-sdk


text:
[Default Metrics Implementation] - kubemetrics default namespace

By @robbie-demuth,
No. I'm not talking about the creation of the actual Kubernetes Service and ServiceMonitor resources. I'm talking about the way in which the Go code that serves the custom resource metrics tracks which custom resources to report on. After filtering the GVKs, serveCRMetrics restricts which namespaces should be searched for custom resources:
	// Get the namespace the operator is currently deployed in.
	operatorNs, err := k8sutil.GetOperatorNamespace()
	if err != nil {
		return err
	}
	// To generate metrics in other namespaces, add the values below.
	ns := []string{operatorNs}
	// Generate and serve custom resource specific metrics.
	err = kubemetrics.GenerateAndServeCRMetrics(cfg, ns, filteredGVK, metricsHost, operatorMetricsPort)
	if err != nil {
		return err
	}

The call to k8sutil.GetOperatorNamespace(), returns the name of the namespace in which the operator is running, but cluster-scoped resources don't belong to a namespace. I think the call to k8sutil.GetOperatorNamespace() need to be replaced with a call to k8sutil. GetWatchNamespace(). Only then will the namespace against which to filter CRs be correctly set to "" when using cluster-scoped CRDs

By @robbie-demuth,
No. I'm not talking about the creation of the actual Kubernetes Service and ServiceMonitor resources. I'm talking about the way in which the Go code that serves the custom resource metrics tracks which custom resources to report on. After filtering the GVKs, serveCRMetrics restricts which namespaces should be searched for custom resources:
	// Get the namespace the operator is currently deployed in.
	operatorNs, err := k8sutil.GetOperatorNamespace()
	if err != nil {
		return err
	}
	// To generate metrics in other namespaces, add the values below.
	ns := []string{operatorNs}
	// Generate and serve custom resource specific metrics.
	err = kubemetrics.GenerateAndServeCRMetrics(cfg, ns, filteredGVK, metricsHost, operatorMetricsPort)
	if err != nil {
		return err
	}

The call to k8sutil.GetOperatorNamespace(), returns the name of the namespace in which the operator is running, but cluster-scoped resources don't belong to a namespace. I think the call to k8sutil.GetOperatorNamespace() need to be replaced with a call to k8sutil. GetWatchNamespace(). Only then will the namespace against which to filter CRs be correctly set to "" when using cluster-scoped CRDs

Hi @robbie-demuth,
Let's move our discussion and checks here. I am looking at what you are suggesting here.

However, note that this part of the code has a comment to clarifies that by default it will export the metrics of the OperatorNamespace (OPERATOR_NAMESPACE), however, users are able to customize it according to their needs as well.

Understood. If that's the case and you guys want to keep it the way that it is now, the documentation for cluster-scoped CRDs should probably be updated https://github.com/operator-framework/operator-sdk/blob/master/doc/operator-scope.md#crd-scope

If you check the current scaffold you will see:
         // The metrics will be generated from the namespaces which are returned here.
	// NOTE that passing nil or an empty list of namespaces in GenerateAndServeCRMetrics will result in an error.
	ns, err := kubemetrics.GetNamespacesForMetrics(operatorNs)
	if err != nil {
		return err
	}
	// Generate and serve custom resource specific metrics.
	err = kubemetrics.GenerateAndServeCRMetrics(cfg, ns, filteredGVK, metricsHost, operatorMetricsPort)
	if err != nil {
		return err
	}

Then, it has a clear msg over what is expected in this place. NOTE that passing nil or an empty list of namespaces in GenerateAndServeCRMetrics will result in an error. and then, because of this, we cannot use the WATCH_NAMESPACE at this point.
So, could you please clarify better what is the issue that you still facing if you upgrade your project to use 0.16 in your case? It may help us address better this case.

Then, it has a clear msg over what is expected in this place. NOTE that passing nil or an empty list of namespaces in GenerateAndServeCRMetrics will result in an error. and then, because of this, we cannot use the WATCH_NAMESPACE at this point.

I've updated one of my projects to call k8sutil.GetWatchNamespace() instead of k8sutil.GetOperatorNamespace() and it does work. It's important to note that if WATCH_NAMESPACE is set to "", the list of namespaces passed to GenerateAndServeCRMetrics won't be nil or empty. Instead it'll be equivalent to []string{""}

So, could you please clarify better what is the issue that you still facing if you upgrade your project to use 0.16 in your case? It may help us address better this case.

I haven't yet upgraded to v0.16.0. We're still running v0.15.2. I can upgrade and see if the issue goes away 👍

Hi @robbie-demuth,
If you pass []string{""} it will be an empty list of namespaces. See that the GenerateAndServeCRMetrics will use the ns here and then, it will not generate the data per ns here
So, I do not think that its a valid solution since the kube-metrics will not gen per namespace. Are you able to get the kube-metrics from the operator when you replace it by []string{""}?
PS.: Any change to get the ns that should be used to gen the metrics by default now would be in its method here but I am afraid that it is not the case.
Note that you may be facing the issue https://github.com/operator-framework/operator-sdk/issues/1858 as described there for other reasons. For example, are you using thid-party API"s ? If yes, then the solution is to customize the implementation. See the PR to address it: #2606
I am looking for your response.

I think a lot of the disconnect here is that I was digging through code generated by v0.15.2. That being said, I traced through some of the code you linked and it did seem to work when the namespace was set to the empty string. With respect to third-party APIs, we are also using those, but have setup the RBAC rules correctly. I suppose I could filter them out since I don't need them in the list of GVKs when serving metrics. I'll try that as well and report back

Hi @robbie-demuth,
It is because more than one scenario can cause the same issue. So, I understand that it was not clear for you at all by checking just 1 of the PR's linked.
Note that the issue will NOT just be faced because of RBCA.
See that you need to customize the
filteredGVK, err := k8sutil.GetGVKsFromAddToScheme(apis.AddToScheme)
This information was addressed in the PR #2606 and you can check in the docs here. Are you customizing this point as described? Did you remove the third-party API's from it?

We're not yet filtering out the third-party GVKs. The docs are a bit fuzzy though. They make it seem like filtering is unnecessary if proper RBAC rules are present. In our case, we have the required RBAC rules in place, so I didn't think we'd need to filter, but, as I said above, I'll give it a shot and see if that fixes the issue

Really thank you @robbie-demuth for your reply. I think that it is the root cause of your scenario. So, I'd recommend upgrade your project to use the SDK 0.16 and customize this part. See the migration doc it will help you to upgrade the project.

Upgrading to 0.16.0 didn't fix the issue. My addMetrics and serveCRMetrics functions now look as follows:
func addMetrics(cfg *rest.Config) {
	// Get the namespace the operator is currently deployed in.
	operatorNs, err := k8sutil.GetOperatorNamespace()
	if err != nil {
		if errors.Is(err, k8sutil.ErrRunLocal) {
			log.Info("Skipping CR metrics server creation; not running in a cluster.")
			return
		}
	}

	if err := serveCRMetrics(cfg, operatorNs); err != nil {
		log.Info("Could not generate and serve custom resource metrics", "error", err.Error())
	}
}

func serveCRMetrics(cfg *rest.Config, operatorNs string) error {
	// The function below returns a list of filtered operator/CR specific GVKs. For more control, override the GVK list below
	// with your own custom logic. Note that if you are adding third party API schemas, probably you will need to
	// customize this implementation to avoid permissions issues.
	filteredGVK, err := k8sutil.GetGVKsFromAddToScheme(apis.AddToScheme)
	if err != nil {
		return err
	}

	// The metrics will be generated from the namespaces which are returned here.
	// NOTE that passing nil or an empty list of namespaces in GenerateAndServeCRMetrics will result in an error.
	ns, err := kubemetrics.GetNamespacesForMetrics(operatorNs)
	if err != nil {
		return err
	}

	// Generate and serve custom resource specific metrics.
	err = kubemetrics.GenerateAndServeCRMetrics(cfg, ns, filteredGVK, metricsHost, operatorMetricsPort)
	if err != nil {
		return err
	}
	return nil
}

Given that we've got the RBAC rules in place and are still seeing Failed to list *unstructured.Unstructured: the server could not find the requested resource, I'll try the GVK filtering tomorrow AM

Hi @robbie-demuth,
One of the goals of the change in the scaffold as you check was trying to clarify this need. I mean that is required to customize the filter.  See that any new project now will be scaffold with the comment:
	// The function below returns a list of filtered operator/CR specific GVKs. For more control, override the GVK list below
	// with your own custom logic. Note that if you are adding third party API schemas, probably you will need to
	// customize this implementation to avoid permissions issues.
	filteredGVK, err := k8sutil.GetGVKsFromAddToScheme(apis.AddToScheme)
	if err != nil {
		return err
	}

Also, we address the info in the doc(#2606) in order to solve this scenario. It was verified for others as well. Let me know if it worked for you.
Really thank you for your collab.
c/c @estroz

I'm still the unstructured error after removing the third party GVKs. I'm going to try what we talked about earlier regarding updating the namespace passed to serveCRMetrics to be based on WATCH_NAMESPACE instead of k8sutil.GetOperatorNamespace() since that fixed the issue for me when I was using v0.15.2

Invoking kubemetrics.GenerateAndServeCRMetrics with ns set to []string{"<WATCH_NAMESPACE>"} fixes the permissions issue. It's also worthwhile to note that invoking it with the namespace set to the operator namespace actually prevents custom resource metrics from working correctly when using cluster-scoped CRDs because the CRs don't exist in a namespace

Hi robbie-demuth,
You need to remove ALL third-party GVK that will be added from the filter:
filteredGVK, err := k8sutil.GetGVKsFromAddToScheme(apis.AddToScheme)

Note that if you add A it usually has dependencies and will add automatically other schemas as well. So, you need to ensure that filteredGVK has just the specific operator GVKs.
If you after that still facing issues, can you please output the values of filteredGVK and share with us?

I have removed them all. Here's the output of kubectl logs:
k logs site-worker-group-operator-656bd4fdc-jcn4p
{"level":"info","ts":1585062696.322366,"logger":"cmd","msg":"Controller Version: REPLACE_VERSION"}
{"level":"info","ts":1585062696.322407,"logger":"cmd","msg":"Controller Revision: REPLACE_REVISION"}
{"level":"info","ts":1585062696.3224115,"logger":"cmd","msg":"SDK Version: v0.16.0"}
{"level":"info","ts":1585062696.3224142,"logger":"cmd","msg":"Go Version: go1.14"}
{"level":"info","ts":1585062696.3224192,"logger":"cmd","msg":"Go OS/Arch: linux/amd64"}
{"level":"info","ts":1585062696.322647,"logger":"leader","msg":"Trying to become the leader."}
{"level":"info","ts":1585062697.8442652,"logger":"leader","msg":"Found existing lock","LockOwner":"site-worker-group-operator-6dd5cbc87c-ncc6r"}
{"level":"info","ts":1585062697.8531113,"logger":"leader","msg":"Not the leader. Waiting."}
{"level":"info","ts":1585062698.9824655,"logger":"leader","msg":"Leader pod has been deleted, waiting for garbage collection do remove the lock."}
{"level":"info","ts":1585062701.3628852,"logger":"leader","msg":"Became the leader."}
{"level":"info","ts":1585062701.9162617,"logger":"controller-runtime.metrics","msg":"metrics server is starting to listen","addr":"0.0.0.0:8383"}
{"level":"info","ts":1585062701.9164634,"logger":"cmd","msg":"Registering Components."}
{"level":"info","ts":1585062701.9166946,"logger":"cmd","msg":"Filtered GVKs: [sites.eng.appianci.net/v1alpha1, Kind=SiteWorkerGroup]"}
{"level":"info","ts":1585062702.469213,"logger":"cmd","msg":"Starting the Cmd."}
{"level":"info","ts":1585062702.4694521,"logger":"controller-runtime.manager","msg":"starting metrics server","path":"/metrics"}
{"level":"info","ts":1585062702.4695256,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"siteworkergroup-controller","source":"kind source: /, Kind="}
{"level":"info","ts":1585062702.469708,"logger":"controller-runtime.controller","msg":"Starting Controller","controller":"siteworkergroup-controller"}
E0324 15:11:42.470589       1 reflector.go:123] pkg/mod/k8s.io/client-go@v0.0.0-20191016111102-bec269661e48/tools/cache/reflector.go:96: Failed to list *unstructured.Unstructured: the server could not find the requested resource
{"level":"info","ts":1585062702.5698452,"logger":"controller-runtime.controller","msg":"Starting workers","controller":"siteworkergroup-controller","worker count":30}
E0324 15:11:43.472022       1 reflector.go:123] pkg/mod/k8s.io/client-go@v0.0.0-20191016111102-bec269661e48/tools/cache/reflector.go:96: Failed to list *unstructured.Unstructured: the server could not find the requested resource
E0324 15:11:44.473972       1 reflector.go:123] pkg/mod/k8s.io/client-go@v0.0.0-20191016111102-bec269661e48/tools/cache/reflector.go:96: Failed to list *unstructured.Unstructured: the server could not find the requested resource
E0324 15:11:45.475473       1 reflector.go:123] pkg/mod/k8s.io/client-go@v0.0.0-20191016111102-bec269661e48/tools/cache/reflector.go:96: Failed to list *unstructured.Unstructured: the server could not find the requested resource

Note the following line:
{"level":"info","ts":1585062701.9166946,"logger":"cmd","msg":"Filtered GVKs: [sites.eng.appianci.net/v1alpha1, Kind=SiteWorkerGroup]"}

Note that the error faced is NOT related permissions Failed to list *unstructured.Unstructured: the server could not find the requested resource. Shows that the CRD is not applied. Could you please verify if you are applying all resources in the same namespace where the operator is deployed? Are you testing it by using the operator-sdk run command?

Okay, this makes more sense. If it's not a permissions issue, it's certainly related to the fact that the metrics server is searching for CRs in the namespace returned by k8sutil.GetOperatorNamespace(), but, as I've mentioned above, cluster-scoped CRDs result in CRs which aren't namespace-scoped. I've got all of the appropriate RBAC resources in place to support the cluster-scoped CRD - including the ServiceAccount, ClusterRole, ClusterRoleBinding, etc

HI @robbie-demuth,
Sorry, but your comment is not clear for me. Before deploying the operator it requires that the CRD be applied in the cluster as well. Could you share a link for your project with the filter changes for I am able to check it locally? Or are you able to describe the steps for I am able to reproduce your scenario with the Go Memcached sample?

Cluster-scoped CRDs don't belong to a namespace. In otherwords, .metadata.namespace is always empty for cluster-scoped CRDs. When the scaffolded code executes kubemetrics.GenerateAndServeCRMetrics(cfg, ns, filteredGVK, metricsHost, operatorMetricsPort), ns is set to []string{<NS>} where <NS> is the result of k8sutil.GetOperatorNamespace(). In my case, this is site-worker-group-operator. This causes the custom resource metrics server to search for cluster-scoped custom resources in the site-worker-group-operator namespace which obviously doesn't work because the custom resources don't belong to a namespace

Regarding your other comments, the CRD is applied to the cluster. Unfortunately, I can't share the project because it's not open-source. To reproduce, I'd recommend creating an operator where both the operator and the CRD are cluster-scoped. While it's possible to have a cluster-scoped operator, but a namespace-scoped CRD, a cluster-scoped CRD requires a cluster-scoped operator. Having both be cluster-scoped is causing the issue I'm hitting

I will create a POC as soon as possible and keep you updated.
Then, we can check this specific scenario further.

I've created a fork/branch of operator-sdk-sample's memcached-operator that illustrates the bug https://github.com/robbie-demuth/operator-sdk-samples/tree/cluster-scoped/go/memcached-operator

Hi @robbie-demuth,
Really thank you for sharing your example.
PS.: Note that it has no relation with the PR #2601 and/or the scenarios addressed motivated by issue #1858. I will hide the previous comments to make easier others follow up, but please, feel free to unhide them if you need.
Following the details and a summary.
Scenario:

An operator with cluster-scope and an CRD with scope: Cluster as well. The issue only occurs with cluster scoped CRD's.

NOTE To reproduce it can be the Memcached Sample with these changes above applied only. E.g sent
Issue:

E0324 23:02:27.199651       1 reflector.go:123] pkg/mod/k8s.io/client-go@v0.0.0-20191016111102-bec269661e48/tools/cache/reflector.go:96: Failed to list *unstructured.Unstructured: the server could not find the requested resource

Suggested solution
Pass ns := []string{""} for kubemetrics.GenerateAndServeCRMetrics as follows will solve the issue faced in the logs as described and suggested by @robbie-demuth.
         ns := []string{""}  // Or  use the k8sutil.GetWatchNamespace()
	// Generate and serve custom resource specific metrics.
	err = kubemetrics.GenerateAndServeCRMetrics(cfg, ns, filteredGVK, metricsHost, operatorMetricsPort)
	if err != nil {
		return err
	}

IHMO: Why we cannot address the suggested solution?
We checked that the GenerateAndServeCRMetrics will use the ns here and then, it will not generate the data per ns here.
So, I do not think that we should change the default implementation to address this scenario which is very specific with this suggested solution. Note that if we do this change as suggested, it would mean that we would NOT export the metrics from the namespaces that we know about by default in all other cases/scenarios where the CRD is NOT cluster scoped.
IHMO: How could we address it?

[ ] Check if the kubemetrics will generate the expected data just for the GKV with your suggested solution and/or if the kubemetrics can or not support GVKs from a cluster scope CRD.
[ ] Address its solution/information in the docs.

Is it make sense? WDYT?
@joelanford @estroz @hasbro17 @jmrodri @fabianvf would you like to share your thoughts here as well about this scenario? WDYT?

Thanks for being so responsive and helping hash this out, @camilamacedo86. With regards to your concerns about the suggested solution, why is it bad to serve custom resource metrics for the namespaces indicated by WATCH_NAMESPACE (or all namespaces if it is set to "")? For namespace-scoped operators and namespace-scoped CRDs, the deployment manifest sets watch namespace as follows:
- name: WATCH_NAMESPACE
  valueFrom:
    fieldRef:
      fieldPath: metadata.namespace

This means that the environment variable will be set to the namespace in which the operator is running, so k8sutil.GetOperatorNamespace() and k8sutil.GetWatchNamespace() would return the same thing
In the case of a cluster-scoped operator and namespace-scoped CRD, https://github.com/operator-framework/operator-sdk/blob/master/doc/operator-scope.md#cluster-scoped-operator-usage suggests setting WATCH_NAMESPACE to "". In this case, k8sutil.GetOperatorNamespace() and k8sutil.GetWatchNamespace() would return different results, but using the return value of k8sutil.GetOperatorNamespace() in GenerateAndServeCRMetrics(...) will cause the operator, which watches custom resources across all namespaces, to only serve custom resource metrics for custom resources in the namespace in which it is deployed. This seems like incorrect behavior to me
In the case of a cluster-scoped operator and cluster-scoped CRD (the issue I'm running into), the docs still suggest setting WATCH_NAMESPACE to "". As this issue shows, using the return value of k8sutil.GetOperatorNamespace() in GenerateAndServeCRMetrics(...) prevents custom resource metrics from appearing for any custom resources. Using k8sutil.GetWatchNamespace(), however, leads to the correct behavior
Based on this, I don't see a reason to not use k8sutil.GetWatchNamespace() for the input to GenerateAndServeCRMetrics(...) in all cases. Am I missing something?

HI @robbie-demuth,
IHMO: The best way for we address it is by adding in this doc section and in this code comment  that it should NOT have GKVs from cluster-scoped CRD's as well.
Also, see that this specific scenario just occurs if the filter has a GVK from a CRD that is cluster-scoped and we cannot ensure that  []string{""} would be appropriated yet. I do not think that the metrics will be exported with. Could you check and verify that? Are you able to get data exported with?
PS.: Note that the WatchNamespace can be 1 ns, a List of NS or "". And then, that the GetNamespacesForMetrics will return the List of ns which should be used in the default implementation of kubemetrics to export data from. So, it will return by default all ns that  we can know by default that is used by the Operator and users are able to customize the ns list as described in the comment in the code according to theirs needs. My POV is that we need to address the common scenarios and then, allow users to customize it if they need. I hope that it makes sense. Let's see the other inputs as well.

we cannot ensure that []string{""} would be appropriated yet

I'm not sure I understand what this means

Are you able to get data exported with? What data was exported in this case?

Yes. When invoking GenerateAndServeCRMetrics(...) with []string{""} from k8sutil.GetWatchNamespace(), I am able to see custom resource metrics for custom resources associated with cluster-scoped CRDs
I've seen the code you linked for GetNamespacesForMetrics. I'm confused by why the function defaults to returning namespaces associated with the operator namespace instead of the watch namespace(s). To me, if I'm running an operator in a namespace and tell it to watch certain namespaces, I want to see custom resource metrics for custom resources in the namespace(s) being watched, not the namespace in which the operator is running

We'll need to update the operator scope doc to discuss changes regarding metrics and potentially change our main.go scaffold to consider cluster-scoped CRDs.
/kind documentation

Not sure I'm fully following the discussion here because I don't know the internals of the serveCRmetrics implementation. Anyway I wanted to add that it should be possible to handle this case.
In fact given a gvk, it's possible to introspect it and discovered if it is namespaced or not using the discovery api ("k8s.io/client-go/discovery"). Then if it's namespaced construct the query using the passed namespace array, if it's not namespaced construct a cluster-level query.

authors: camilamacedo86 estroz raffaelespazzoli robbie-demuth

repo: operator-framework/operator-sdk


text:
Call helm init plugin to scaffold helm projects in the new cmd

Description
Call the init plugin in the new cmd command.

/hold
Until we reach the decision if we will or not call the plugins in the legacy commands.

we decide no longer call the plugin in the legacy command.


text:
set watches on owned resources

Description of changes:

Updated controllers/scopeinstance_controller.go to setup watches for (Cluster)RoleBinding resources by utilizing the Owns() function as part of setting up the manager.
Updated controllers/scopetemplate_controller.go to setup watches for ClusterRole resources by utilizing the Owns() function as part of setting up the manager.
Some additional minor updates to (I felt they were to small to warrant a separate PR):

Update the permissions for ClusterRole resources to include the bind verb. This allows us to create bindings for ClusterRoles even if the ServiceAccount itself doesn't have the permissions.
Update the Makefile to include a version that we can update when building our images so that we don't always use latest
Update the Makefile IMG env var to default to quay.io/operator-framework/oria-operator:v$(VERSION) instead of quay.io/agreene/oria-operator:latest or controller:latest

Motivation for the change:

fixes #6

Pull Request Test Coverage Report for Build 3197980564

3 of 3 (100.0%)  changed or added relevant lines in 2 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage increased (+3.8%) to 69.88%

Totals

Change from base Build 3174960596:
3.8%

Covered Lines:
348

Relevant Lines:
498

💛  - Coveralls

authors: coveralls everettraven

repo: operator-framework/oria-operator


text:
Versioneer: Adding basic version tracking with versioneer

Adds basic versioning infrastructure to improve pip installs.

isn't the versioneer pip-installable ?

It is, but it still installs its own script into the package on setup. I think that's for release/deployment workflows, since these need version info, but don't install dependencies.

As this looks like an instal/use PR, can we add a link to opesci.org to the README.

As this looks like an instal/use PR, can we add a link to opesci.org to the README.

Yes, done.

I wonder whether we should put all these third-party packages in a separate folder..
This can land for me

authors: FabioLuporini mlange05 mloubout

repo: opesci/devito


text:
Travis setup for YASK testing

Depends on #364.
This merge adds a dedicated YASK builder to our travis setup that pulls the current YASK development branch and executes a dedicated small test suite with it while skipping all other tests. This will allow us to gradually enable more of our regular test base on the YASK-backend as it develops.
One thing I note is that despite -j3 the YASK compile times are quite severe, making the test suite quite slow;  but that might need to be addressed upstream.

Yes, good to go

Ok, YASK is ready, merging...


text:
Virtualbox guest additions

Hey thanks for the awsome project guys. I have OPNsense running on a Vbox virtual machine.
I want to enable usb support to use a dualband wifi dongle to have my wireless devices connecting to OPNsense.
When I run pkg install virtualbox-ose-additions it says it cant be found,
unable to update OPNsense repository
Now i heard something about a different install manager? But I can't find anything about it?
Thanks

It looks like your DNS isn't working.. repos are there although VBOX additions are not. I will have to write a plugin for 16.7.2.

Are the repos reachable now?
# pkg update -f
# pkg rquery %n

Latter should list all available remote packages ;)
You can build virtualbox-ose-additions from our ports tree on the OPNsense box itself in the meantime...
# cd /etc
# fetch https://raw.githubusercontent.com/opnsense/tools/master/config/16.7/make.conf
# pkg install git
# cd /usr
# rm -fr ports
# git clone https://github.com/opnsense/ports
# cd ports/emulators/virtualbox-ose-additions
# make install

Reboot fixed the update part. But still the same error installing the virtualbox-ose-additions
Now following your steps leads to this at the end at make install
I'll do some googleing and hope I can fix this, any suggestions meanwhile?

Thanks so much for taking the time to help!

You need to install kernel headers or specify where the hearders are which are in /usr/src from doing a bit of googling.

Yeah I came across a topic on the FreeBSD forums with some instructions but no luck...

# cd /usr
# git clone https://github.com/opnsense/src

Then retry make install :)

Your my hero!
Now I get this shown below, I first executed the suggested commands then about 2 or 3 errors showed, tried to make install again but still fails.
Sorry for beeing such a pain in the a*s..

I'm not entirely sure what it's trying to do there. Let me check on my local box...

Uh so this fails...
cd /usr/src; make build32 install32; ldconfig -v -m -R /usr/lib32

Which means we're not going to get further today.

Ouch, no problem, you could leave me with a to do list if this is within my scope of doin...
Else I'll just wait, you've been such a great help so far, thank you so much!

For reference, our base system doesn't install these libraries. For some reason the port requires these
https://github.com/opnsense/tools/blob/master/config/16.7/src.conf#L22
Might be good to see how useful the additions really are. Any particular thing you're looking for?

Yeah its quite a hassle to set it up... Just experimenting right now setup is as this:
Router/modem 192.168.1.1/24
RaspberryPI as vpn gateway 192.168.1.154
Virtualbox Host 192.168.3.2
Virtualmachine OPNsense 192.168.3.1 (Wan gateway is the raspberry with the vpn tunnel)
Now I'd like all my wireless devices to connect to the OPNsense vm using a dualband wifi dongle. However that only succeeds using the guest additions.
Should seem like a pretty useless setup, don't really know but like I said i'm just figuring out OPNsense and it gives me a secure feeling and a lot of options.
(I'd like to keep my home router since its required for the speed I have now, its also a modem. Also its makes it easier and secure for visitors to connect to that network then to the network of all my other machines, right?)

Wouldnt there be an easy pull command to get these lib's from somewhere else, i've searched and searched but its totally not my area of operations... Sorry again to bug you with this.

set "no" to "yes" in /usr/local/etc/pkg/repos/FreeBSD.conf
try to install it like you normally would, but it may end up causing packages to be updated to wrong versions or uninstalling vital packages.
the general attitude is that multi-repo is not supported by FreeBSD's package manager authors,so "here be dragons"
remember to set the setting back to "no" when you're done
Cheers,
Franco

Awsome will try that out, been busy on some workaround but there not really workable...
Thanks again for your time and the great project!

Will close this, the additions package does not fit our requirements of a light dependency trail.

Hey,
First off all best wishes for the new year! Any update on the matter?
Kind regards,
Ezra

Maybe things are changed a bit after a couple of years, and now it looks like to me that the package virtualbox-ose-additions-nox11 has a not so complex dependency set at all. Here is what I get on OPNsense 19.7.2, after enabling the official FreeBSD pkg repository:
# pkg install -r FreeBSD -n virtualbox-ose-additions-nox11
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.
Checking integrity... done (0 conflicting)
The following 1 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
	virtualbox-ose-additions-nox11: 5.2.30 [FreeBSD]

Number of packages to be installed: 1

The process will require 2 MiB more space.

I think it would be a good thing to have this package, in addition to Xen and VMware ones, but unfortunately I have not the skills to make the plugin, sorry! :(

repo: opnsense/core


text:
Unbound DNSBL download unable to resolve DNS at boot, and previously downloaded BL file does not load. Removing 85-dnsbl helps.

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

[X ] I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
[X ] I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Describe the bug

Reboot of OPNSense at 2 locations I have running OPNsense 23.1.5_4-amd64 yields the following log entries each time, and as a result clients start seeing ads in their web browsers:

Notice unbound blocklist: https://adaway.org/hosts.txt (exclude: 0 block: 0)
Notice unbound blocklist download: 0 total lines downloaded for https://adaway.org/hosts.txt
Error unbound blocklist download : unable to download file from https://adaway.org/hosts.txt (error : HTTPSConnectionPool(host='adaway.org', port=443): Max retries exceeded with url: /hosts.txt (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x8027cf640>: Failed to establish a new connection: [Errno 8] Name does not resolve')))
NOTE: After startup of OPNsense, OPNsense diagnostic tools and client systems do not show any DNS problems. It appears only Unbound DNSBL has problems during boot time.
Manual restarting of Unbound service (e.g. restart service button on Blocklist page) does not appear to initiate download of list (based on not seeing messages such as those listed above).
If I disable Blocklist/Apply, then Enable Blocklist/Apply, it appears to trigger getting data:
Notice unbound blocklist parsing done in 0.58 seconds (7355 records)
Notice unbound blocklist: https://adaway.org/hosts.txt (exclude: 2 block: 7355)
Notice unbound blocklist download: 11782 total lines downloaded for https://adaway.org/hosts.txt
Notice unbound blocklist download : exclude domains matching ^(?![a-zA-Z_\d]).*|.*localhost$
NOTE: Even though the data seems to be retrieved, it appears it is not active until I then restart the service* (e.g. restart service button on Blocklist page).
*It also seems as though I need to go through the disable/enable steps then restart service an additional time to have everything fully work. I am not sure if it is always just one time, but I do know that doing the entire process once does not usually get everything working.
To Reproduce
Steps to reproduce the behavior:

Configure DNS-related items:
Services->Unbound DNS->Blocklist - "AdAway List" selected and all other fields empty.
Services->Unbound DNS->DNS over TLS - 2 IPv4 and 2 IPv6 servers defined. All 4 using port 853. (1.1.1.1 / 1.0.0.1 / 2606:4700:4700::1111 / 2606:4700:4700::1001)
Services->Unbound DNS->General - DNSSEC support enabled.
System->Settings->General - No DNS servers manually defined.
System->Settings->General - Allow DNS server list to be overridden by DHCP/PPP on WAN is enabled.
Reboot OPNsense
Check Unbound log to see if it was able to successfully download the BL file.

Expected behavior

DNSBL file should download at boot without name resolution issues.
Manual start/restart of DNSBL service should trigger download of DNSBL file.

Describe alternatives you considered

Per discussions with AdSchellevis on issue 6514, it would appear removing /usr/local/etc/rc.syshook.d/start/85-dnsbl prevents the failed log entries (but I suspect that would mean that a new DNSBL file will not get downloaded and processed until a cron job to update is executed).
Tried renaming file to 90-unbounddnsbl but that did not help.

Additional context
Thoughts:

For bootup item (DNS resolution error), perhaps a service dependency needs to be made if the DNSBL download process is launching before DNS resolution services are fully up and running (if that is what is actually happening).
For the manual DNSBL service startup item, perhaps there are additional processes that could be restarted behind the scenes as part of manual service start/restart to trigger getting the URL to process the data.

Environment
OPNsense 23.1.5_4-amd64 / FreeBSD 13.1-RELEASE-p7 / OpenSSL 1.1.1t 7 Feb 2023
VNOPN Micro Firewall Appliance with 4 Intel 2.5GbE Intel i225 NIC Ports
Intel N3700 Quad Core, Support AES-NI, 8GB DDR3

Hi
one more thought is that 'requests' library dont retry by default. adding retry plan (like https://github.com/kulikov-a/core/commit/c6697655b760ca831b1e0f09d5828ccaa4a35c21) (ref. https://forum.opnsense.org/index.php?topic=32327.0) may help if it's a matter of some small overlays. but.. it may produce a very long blocklist download task run if there is a real lack of connection

@kulikov-a I'm doubting the download should be in the boot flow to be honest, which is the main cause of this issue in my opinion. I'll need to discuss this internally, scheduling a download after a delay could also be an option.

The previous design intentionally kept the pre-reboot setting in the staging area, also because of volatile /var MFS which is no longer present. Not sure when it was lost.

@AdSchellevis Hi!)

I'm doubting the download should be in the boot flow

fair enough. but there is another thought: technically this situation (problems with name resolution or connection) can occur not only at boot. Is it generally correct to overwrite the cache file with empty data in such cases? or is it better to somehow track  _uri_reader exceptions\errors and leave the list untouched in some cases?

@kulikov-a well, it would likely be better to keep the previous situation when no files can be downloaded.

@AdSchellevis  got it, thanks! (so, the expired cache-files reuse can be useful on network problems. but not right after the reboot since the all cache is gone. no universal solution comes to my mind except movilng cache from /tmp)

The cache is restored unless the user doesn’t want it. 😉

not unbound cache - block-list content cache ;)
https://github.com/opnsense/core/blob/368e7ac15e660a4e427ac77b9aad70d99771aeee/src/opnsense/scripts/unbound/blocklists/default_bl.py#L101-L118

Ok, /tmp is obviously cleared on boot.

We discussed this internally, at the moment the best option seems to be to remove the syshook causing the download to be performed on boot as it is only relevant after a reinstall or configuration import.
The downside might be that after an import, the user will need to download manually, but that's the case for most components at the moment and we don't have a hook for that.
i'll remove the file and close this in the next commit.

Thank you for the update. In case the following idea is of use, it may help to mention on the DNSBL configuration page that a cron job will need to be manually created. While that reference is in the online documentation, when I originally configured the options (just using the GUI as my initial guide), it was not immediately clear to me that this step was needed. When researching the issue described in this Github issue, it seemed to me that it wasn't always clear to others as well.
I suspect this could apply to other items that may require a cron job, but thought I would mention it in case it helps.
Thank you again.

authors: AdSchellevis Chaskel fichtner kulikov-a


text:
In FreeRADIUS After Changing User Password, Apply Must Be Clicked Before Change Becomes Effective

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

[X] I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
[X] I have searched the existing issues and I am convinced that mine is new.

Describe the bug
After changing a user's password in FreeRADIUS and clicking save, Apply on the Users screen must be clicked else the password change will not take effect.
To Reproduce
Steps to reproduce the behavior:

Set up FreeRADIUS with a user.
Using System: Access: Tester confirm access.
In FreeRADIUS, under Users, edit the user to change their password and click Save to return to the list of users.
Test the new password with System: Access: Tester and observe access denied.
Test the old password with System: Access: Tester and observe access granted.
Click Save on the Users page.
Test the new password with System: Access: Tester and observe access granted.

Expected behavior
I would have expected the user's password change would take effect once I clicked save on the user's account page. As with other parts of OPNsense I would expect that if an additional Save is required for changes to take effect, a banner notification about applying settings (or something similar) would be displayed.
Additional context
Note: Stopping and starting FreeRADIUS does not make the password change take effect. If Save is clicked after stopping/starting the service the password change will take effect.
Environment
OPNsense 20.7.7_1-amd64
FreeBSD 12.1-RELEASE-p11-HBSD
OpenSSL 1.1.1i 8 Dec 2020
os-freeradius 1.9.9

I think that for most grid views you have to hit apply/save a second time, just like with Firewall Alias or similar

I think that for most grid views you have to hit apply/save a second time, just like with Firewall Alias or similar

I think that for most grid views you have to hit apply/save a second time, just like with Firewall Alias or similar

I can see that. If a firewall rule gets changed and apply needs to be clicked, the UI tells you. That's my issue here; it appears to be done and not need any more clicking, yet isn't actually applied.
This is what appears for a firewall rule; I'd think the same could happen here.

I think that for most grid views you have to hit apply/save a second time, just like with Firewall Alias or similar

I can see that. If a firewall rule gets changed and apply needs to be clicked, the UI tells you. That's my issue here; it appears to be done and not need any more clicking, yet isn't actually applied.
This is what appears for a firewall rule; I'd think the same could happen here.

This is from legacy code where you have to apply on the upper right, like with ntp or similar.
The new code usually needs a hit on apply after adding something to the grid, like FreeRadius, WireGuard, Postfix and so on.

This is from legacy code where you have to apply on the upper right, like with ntp or similar.
The new code usually needs a hit on apply after adding something to the grid, like FreeRadius, WireGuard, Postfix and so on.

repo: opnsense/plugins


text:
Consolidate i18n pages and simplify them to explain the key things a developer would need to know.

(Also, add footprints to tutorials in the sidebar.)

@Ash-2k3 @U8NWXD PTAL. Thanks.

repo: oppia/oppia-web-developer-docs


text:
fixed directory permissions when node['rsyslog']['priv_seperation'] is true

https://tickets.opscode.com/browse/COOK-4606

Can we get this in shape to merge?

The working_dir permissions are set in master with https://github.com/opscode-cookbooks/rsyslog/commit/386a413d117c078121784fd7c7ec4567d8fbfc0e so I think this pull can be closed.

authors: eheydrick skomma

repo: opscode-cookbooks/rsyslog


text:
chore: prepare for 3.6.0

Summary

prepare for 3.6.0

Coverage increased (+0.01%) to 99.597% when pulling fbbbb04fafc5671dc8f69281f74197943576d990 on prepare-3.6.0 into 84c4397b92e4a6b9fbf376f3bddfb02e461348e7 on master.

Coverage increased (+0.01%) to 99.597% when pulling fbbbb04fafc5671dc8f69281f74197943576d990 on prepare-3.6.0 into 84c4397b92e4a6b9fbf376f3bddfb02e461348e7 on master.

Coverage increased (+0.01%) to 99.597% when pulling fbbbb04fafc5671dc8f69281f74197943576d990 on prepare-3.6.0 into 84c4397b92e4a6b9fbf376f3bddfb02e461348e7 on master.

authors: coveralls jaeopt

repo: optimizely/ruby-sdk


text:
Fix format of inline code in the tutorial.

Contributor Agreements
Please read the contributor agreements and if you agree, please click the checkbox below.

[x] I agree to the contributor agreements.

Motivation
We usually use double-backquotes for inline code blocks.
But we can see single-backquoted code blocks in the tutorial.
Description of the changes
Fix format of inline code

I confirmed that the pages were rendered as expected.
Current:

This PR:

repo: optuna/optunahub-registry

license: MIT


text:
Update gb-create-compute-vm.md for Green Button

11101
Hello, just updating some images in Lab 3

@arthurviannaa - Looks like you are submitting a new green button version for the workshop.
Tip - If most of the green button lab instructions are similar to the freetier version with minor changes to instructions, you can use conditional formatting to edit and use just one markdown file for each lab instead of creating two files, one for free tier version and one for green button version. Click here for the instruction on using conditional formatting.
Next step: Please submit the filled-out Self QA document after the workshop development is completed to livelabs-help-db_us@oracle.com mailbox to review. If everything looks good we will approve the PR.

@arthurviannaa - Looks like you are submitting a new green button version for the workshop.
Tip - If most of the green button lab instructions are similar to the freetier version with minor changes to instructions, you can use conditional formatting to edit and use just one markdown file for each lab instead of creating two files, one for free tier version and one for green button version. Click here for the instruction on using conditional formatting.
Next steps:

There are a few conflicting files, please resolve those conflicts.
Please submit the filled-out Self QA document after the workshop development is completed to livelabs-help-db_us@oracle.com mailbox to review. If everything looks good we will approve the PR.

Hello. How can i resolve those conflicts? I never did this, a just wanted to update some images
Thank you

authors: anooshapilli arthurviannaa

repo: oracle-livelabs/oci


text:
feat!: Improve justification output for provenance_l3_check

Check now displays all provenance artefacts which passed, failed, or were skipped.
The check now fails when any artefact mentioned in the provenance fails to verify,
or must be skipped.

Is there any particular reason to use ! in the PR title? Are you expecting a breaking change?

I used ! in the commit since it changes the check result for an identical check where some assets verify and some don't

I used ! in the commit since it changes the check result for an identical analysis target where some assets verify and some don't

Yes, that makes sense. But because we haven't released Macaron yet, we don't need to add ! for now.

authors: ailrst behnazh-w

repo: oracle-samples/macaron


text:
Would like to have a private bastion

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description
I have a strict requirement in my tenancy to have no publicly accessible compute instances, even a bastion. So, I'd like to either be able to forget the bastion altogether and just have the operator or at the very least enable the bastion to have a private IP.
New or Affected Resource(s)
oracle-terraform-modules/terraform-oci-oke
oracle-terraform-modules/bastion/oci
Potential Terraform Configuration
oracle-terraform-modules > variables.tf
variable "bastion_public" {
  description = "true to use public IP for bastion, false to use private IP"
  default     = true
  type        = boolean
}

oracle-terraform-modules > locals.tf
oci_base_bastion = {
    availability_domain   = var.availability_domains["bastion"]
    bastion_access        = var.bastion_access
    bastion_enabled       = var.bastion_enabled
    bastion_image_id      = var.bastion_image_id
    bastion_shape         = var.bastion_shape
    ***bastion_public        = var.bastion_public***
    bastion_upgrade       = var.bastion_package_upgrade
    ...
  }

oracle-terraform-modules/bastion/oci > compute.tf
resource "oci_core_instance" "bastion" {
  availability_domain = element(local.ad_names, (var.availability_domain - 1))
  compartment_id      = var.compartment_id
  freeform_tags       = var.tags

  create_vnic_details {
    ***assign_public_ip = var.bastion_public***
    display_name     = var.label_prefix == "none" ? "bastion-vnic" : "${var.label_prefix}-bastion-vnic"
    hostname_label   = "bastion"
    subnet_id        = oci_core_subnet.bastion[0].id
  }
  ...

References
N/A

https://github.com/oracle-terraform-modules/terraform-oci-bastion/issues/23

closed in #332


text:
Add support for NSG for control plane

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description
It is now possible to specify a list of nsgs for the control plane.
Proposed enhancement:

Continue using security list if and only if worker nodes are public i.e. use security lists to control North-South traffic
Switch default to NSGs for private worker nodes i.e. use NSGs to control East-West traffic

New or Affected Resource(s)

Potential Terraform Configuration

# Copy-paste any Terraform configurations for how the requested feature may be used.

References

Closed in #346


text:
aarch64 Docker image for Oracle Database 19c

According to https://www.oracle.com/database/technologies/oracle19c-linux-arm64-downloads.html, we should be able to run 19c on aarch64 now, especially combined with Ampere A1 instances.

Hi I could successfully build a docker container on MacOS (M1) with an Oracle Linux 8.8 base image using my own Oracle Docker scripts. The times for building the container and starting/creating the database did look reasonable. I haven't looked at the performance yet. However, an Oracle 19c (aarch64) is now running on my MacBook Pro (M1) 😎.
I assume that it is not an issue to build an Oracle 19c (aarch64) for Ampere A1 instances.
Regards, Stefan

We'll raise a PR to support this soon.

@yunus-qureshi @oehrlis Much appreciated.

Just got merged as part of #2659 🥳

Hi I could successfully build a docker container on MacOS (M1) with an Oracle Linux 8.8 base image using my own Oracle Docker scripts. The times for building the container and starting/creating the database did look reasonable. I haven't looked at the performance yet. However, an Oracle 19c (aarch64) is now running on my MacBook Pro (M1) 😎.
I assume that it is not an issue to build an Oracle 19c (aarch64) for Ampere A1 instances.
Regards, Stefan

Hello Stefan,
Would you mind sharing the steps to your successful installation?
I pulled an image from GitHub but it fails to build.
Thanks

Hi I could successfully build a docker container on MacOS (M1) with an Oracle Linux 8.8 base image using my own Oracle Docker scripts. The times for building the container and starting/creating the database did look reasonable. I haven't looked at the performance yet. However, an Oracle 19c (aarch64) is now running on my MacBook Pro (M1) 😎.
I assume that it is not an issue to build an Oracle 19c (aarch64) for Ampere A1 instances.
Regards, Stefan

Hello Stefan, Would you mind sharing the steps to your successful installation? I pulled an image from GitHub but it fails to build.
Thanks

I don't have it. It was originally for my test pipeline. I think I manually installed the RPMs as a service in the end. But I do think we could just use docker pull and docker run for this now,

Hi
I’ll do as soon as I find time this week. Currently busy with project deadlines 🤪. I did not use the rpm. Just the plain software similar as I did for my x86 images.
Regards
Stefan

Stefan Oehrli
Bühlmattenweg 6
5630 Muri
Phone: +41 56 664 90 45
Mobile: +41 79 239 84 88
@.***

On 28 Nov 2023, at 16:19, Steve Fan @.***> wrote:
Hi I could successfully build a docker container on MacOS (M1) with an Oracle Linux 8.8 base image using my own Oracle Docker scripts. The times for building the container and starting/creating the database did look reasonable. I haven't looked at the performance yet. However, an Oracle 19c (aarch64) is now running on my MacBook Pro (M1) 😎.
I assume that it is not an issue to build an Oracle 19c (aarch64) for Ampere A1 instances.
Regards, Stefan
Hello Stefan, Would you mind sharing the steps to your successful installation? I pulled an image from GitHub but it fails to build.
Thanks
I don't have it. It was originally for my test pipeline. I think I manually installed the RPMs as a service in the end. But I do think we could just use docker pull and docker run for this now,
—
Reply to this email directly, view it on GitHub https://github.com/oracle/docker-images/issues/2658#issuecomment-1830058405, or unsubscribe https://github.com/notifications/unsubscribe-auth/AF7ARLRW3LL7BBCWIBXF5S3YGX6H7AVCNFSM6AAAAAA2D6HZSGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQMZQGA2TQNBQGU.
You are receiving this because you were mentioned.

I have a repo with options for building images on ARM/x86 here, plus documentation, if that helps: https://github.com/oraclesean/cloud-native-oracle

thank you Stefan. I will check it out.

Thanks but that's more to @oraclesean  credit 😊

authors: gvenzl oehrlis oraclesean osolindo stevefan1999-personal yunus-qureshi

repo: oracle/docker-images


text:
WebLogic Dockerfile Suggestion

Docker 17.09 introduced chown to the copy command.  By changing from:
COPY $FMW_PKG install.file oraInst.loc /u01/
RUN chown oracle:oracle -R /u01
to:
RUN chown oracle:oracle -R /u01
COPY  --chown oracle:oracle  $FMW_PKG install.file oraInst.loc /u01/
The size of the generated image will be reduced by 930MB or ~30%
In the original sequence chown command creates another layer equal in size to all the files in the /U01 directory when the command is run.  In this case ~ 930MB of install files.  The chown is still needed to set ownership on the /U01 directory itself.  That command could be stacked on the end of the oracle user create earlier in the Dockerfile.

Yes, the addition of the --chown parameter will make a lot of the Dockerfiles more efficient. I suspect our efforts will ramp up once we release a version of Oracle Container Runtime that includes this feature. :)

👍 Very, very useful suggestion, not sure if there is any difference between docker versions, but I needed to add a '=' after the chown to get it to work on my build which shaved 400M off the docker image size :
RUN chown oracle:oracle -R /u01 && chmod +xr $SCRIPT_FILE
COPY --chown=oracle:oracle $FMW_PKG install.file oraInst.loc /u01/

Will try the suggestion to reduce image size

We tried the suggestion but found no difference in image size and we encountered permission problems deleting the installer.

authors: Djelibeybi aquasheep20 futurisma mriccell


text:
Prometheus histogram (and timer) output omits tags from some elements

Environment Details

Helidon Version: 2.3.3
Helidon SE or Helidon MP
JDK version:
OS:
Docker version (if applicable):

Problem Description
The Prometheus histogram (and, therefore, timer) output incorrectly omits tag names and values from some elements.
From Slack (excerpted and sanitized):

I have 2 timers defined with tags (histograms also seem to behave similar)
and here is what I see as metrics reported (it looks like the count and quantiles are correctly tagged but the rest not) :

application_methods_timer_rate_per_second 0.19998339000048407
application_methods_timer_one_min_rate_per_second 0.002345382473717422
application_methods_timer_five_min_rate_per_second 0.48562106213971884
application_methods_timer_fifteen_min_rate_per_second 1.164707318352554
application_methods_timer_mean_ 1.9782008194700664E8
application_methods_timer_max_ 944891402
application_methods_timer_min_ 166921996
application_methods_timer_stddev_ 7.645134078765927E7
application_methods_timer_count{class="MyClass",method="myMethod"} 88
application_methods_timer{class="MyClass", method="myMethod",quantile="0.5"} 193634869

See the MP metrics spec on Prometheus (OpenMetrics) output format: https://download.eclipse.org/microprofile/microprofile-metrics-3.0/microprofile-metrics-spec-3.0.html#_handling_of_tags
Steps to reproduce
Create a timer or histogram with tags, then check the Prometheus output. Only some of the statistics output properly includes the tags.

The earlier fix did not fix the problem for the timer rates; the output for those still lacks the tags.

repo: oracle/helidon


text:
Blocking WebClient API

Related to #2341

Do not merge, i am not accepting this PR. It was missclick.

Do not merge, i am not accepting this PR. It was missclick.

Close for now. Will be reviewed later.

authors: Verdent dalexandrov


text:
Support setting CA Certificate bundle

Currently we only support setting the publicCertificate and privateKey when creating SSL certificates for load balancers. We should extend this to support setting caCertificate as well.
See API docs.

Fixed in Support for SSL BackendSet certificate #243

authors: MadalinaPatrichi prydie

repo: oracle/oci-cloud-controller-manager


text:
Configuring Request Routing With Path Route Sets

Oracle Cloud Infrastructure allows creating routing policy with a set of rules to route requests to different backend sets. The rules can be configured according to string matching of the request path (see https://docs.oracle.com/en-us/iaas/Content/Balance/Tasks/managingrequest.htm).
It is also possible to define URL Redirect Rules (see https://docs.oracle.com/en-us/iaas/Content/Balance/Tasks/managingrulesets.htm#redirect).
Is it possible to configure these capabilities with configuration files or annotations, or is it planned to add these feature in coming releases?
Thank you in advance

@algora please use an ingress controller for your requirement. Kubernetes service allows you to only redirect to a single service backend, ingress controller has to be used if you want to support different backends using a s single service.

authors: algora shyamradhakrishnan


text:
support for $resolution variable - similarly to $metric or $region

Support in such a variable will allow to get responses from OCI for big queries that would otherwise fail (or just will be slow), e.g get metrics for 100 servers for the last 7 days.
By controlling the resolution of all the panels in the dashboard I can make changes in one click, instead of going one panel after another.

The maintainer of this repository should at least share his thoughts about the feature

Introduced in v5.2.0.

authors: damikem mamorett

repo: oracle/oci-grafana-metrics


text:
Freeradius not built against OpenSSL 3.2.2

Freeradius fails after update to OpenSSL 3.2.2 (OL 9.5) - expects 3.0.7. Freeradius package in appstream needs to be rebuilt against OpenSSL 3.2.2
Error
[root@test ~]# RADIUS_MD5_FIPS_OVERRIDE=1 radiusd -X
libssl version mismatch.  built: 30000070 linked: 30200020
[root@test ~]#

Package Info
Name         : freeradius
Version      : 3.0.21
Release      : 42.el9
Repository   : ol9_appstream

Name         : openssl
Epoch        : 1
Version      : 3.2.2
Release      : 6.0.1.el9_5
Repository   : ol9_baseos

Current workaround requires downgrading OpenSSL back to 3.0.7.

Oracle Linux customers, please file your issue at https://support.oracle.com
Thanks for filing an issue with Oracle Linux.
GitHub Issues is not an official support channel and we don't offer
product support here. If you're not yet an Oracle Linux customer,
consider signing up at https://linux.oracle.com.
Even if you're not a customer, if we can confirm that an issue is a
bug we will do our best to fix it and to update this issue
once it has been fixed. We don't guarantee a fix or feedback and
for now, we will close this issue. If you have Oracle Linux support,
please use support.oracle.com to report issues.

freeradius-3.0.21-43.el9_5.x86_64 has been released.

authors: YoderExMachina archset

repo: oracle/oracle-linux


text:
Use Correct Parameters When Parsing; Closes #27

Problem
When the engine is reset it parses a collection of body like objects. It is currently using the wrong order when standing up parameters.
Solution
Use the correct order.
Tests
Expanded the unit tests to assert values align appropriately.
Howto Test

[ ] Tests Pass

/cc @aaroncameron21

Current coverage is 45.52%

Merging #28 into master will increase coverage by +2.56% as of 96b050e

@@            master     #28   diff @@
======================================
  Files            3       3
  Stmts          135     134     -1
  Branches        17      17
  Methods          0       0
======================================
+ Hit             58      61     +3
  Partial          0       0
+ Missed          77      73     -4

Review entire Coverage Diff as of 96b050e

Powered by Codecov. Updated on successful CI builds.

authors: benjic codecov-io

repo: orbitable/engine


text:
Failed to create machine NixOS

After adding a NixOS machine and waiting for a while, a prompt was displayed with the following message:

I use the M1 pro MacBook Pro with macOS Ventura 13.2.1 (22D68).

Can you share logs from OrbStack menu -> Show Logs? (preferably by email in case it has any sensitive info)
It looks like the machine itself was created, but the initial setup process timed out (longer than 10 minutes?).

Thanks for sharing logs. Unfortunately the relevant info is gone because you've restarted OrbStack since creating the machine, but it does look like the machine creation should've succeeded after it timed out. You can confirm this by checking if /etc/nixos/orbstack.nix exists.
I'll increase the timeout to fix the error in the UI. Thanks for reporting!

repo: orbstack/orbstack


text:
Unconventionional commits missing

Is there an existing issue for this?

[X] I have searched the existing issues

Description of the bug
https://github.com/joshka/tui-scrollview
git log --oneline
6766fe2 (HEAD -> main, origin/main, origin/HEAD) docs: update git cliff config
3e71623 docs: ensure that horizontal scrollbar is not shown for example
c1fd2a0 Add horizontal scrollbars and hide scrollbars if there is enough space (#30)
a4217ed (kxxt/main) chore(deps): bump ratatui in the all-dependencies group (#28)
ea12671 ci: group dependabot updates
b3783be chore(deps): bump eyre from 0.6.11 to 0.6.12 (#26)
b437732 (tag: v0.3.4) chore: release (#25)
b194736 fix: scroll_to_bottom scrolls the y offset not the x offset (#24)
1b2eb1e (tag: v0.3.3) chore: release (#19)

git cliff result

Changelog
All notable changes to this project will be documented in this file.
[unreleased]
📚 Documentation

Ensure that horizontal scrollbar is not shown for example
Update git cliff config

⚙ Miscellaneous Tasks

Group dependabot updates

[0.3.4] - 2024-04-01
🐛 Bug Fixes

Scroll_to_bottom scrolls the y offset not the x offset (#24)

⚙ Miscellaneous Tasks

Release (#25)

[0.3.3] - 2024-03-28
📚 Documentation

Improve docs and example code (#22)

⚙ Miscellaneous Tasks

Release (#19)

Note that c1fd2a0 Add horizontal scrollbars and hide scrollbars if there is enough space (#30) is missing
filter_unconventional = false in cliff.toml
Steps To Reproduce

gh repo clone joshka/tui-scrollview
git cliff | grep "Add horizontal scrollbars"

Expected behavior
Changelog should include the unconventional commit
Screenshots / Logs
No response
Software information

Operating system: macOS
Rust version: not relevant - git cliff installed via homebrew
Project version: git-cliff 2.2.1

Additional context
No response

(note: I've force pushed a rewritten commit so that git-cliff behaves nicely, so the repro instructions likely won't work now)

repo: orhun/git-cliff


text:
add random suffix mode

Unfortunately the current implementation does not retain multiple extensions. So if you upload foo.tar.gz, the resulting file will be eu7f92x1.gz.
This PR includes 2 changes:

multiple extensions are retained (e.g. eu7f92x1.tar.gz)
added an optional option suffix_mode (bool) to random_url (result: foo.eu7f92x1.tar.gz)

closes #41

Codecov Report
Patch coverage: 70.37% and project coverage change: -0.41 :warning:

Comparison is base (5b01c98) 68.94% compared to head (1ca1841) 68.53%.

:exclamation: Your organization is not using the GitHub App Integration. As a result you may experience degraded service beginning May 15th. Please install the Github App Integration for your organization. Read more.
Additional details and impacted files
@@            Coverage Diff             @@
##           master      #69      +/-   ##
==========================================
- Coverage   68.94%   68.53%   -0.41%
==========================================
  Files          11       11
  Lines         483      499      +16
==========================================
+ Hits          333      342       +9
- Misses        150      157       +7

Flag
Coverage Δ

unit-tests
68.53% <70.37%> (-0.41%)
:arrow_down:

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files
Coverage Δ

src/random.rs
83.33% <ø> (ø)

src/paste.rs
78.94% <70.37%> (-3.71%)
:arrow_down:

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.

Can you please add tests to cover these changes?

I have to look into it. I did of course my own testing: https://play.rust-lang.org/?version=stable&mode=debug&edition=2021&gist=fbd05ecc4a7979366febb168fafd43b5

Please let me know, whether I missed anything. Otherwise I'd hope for a 0.11.0 release soon. Haha. ;-)

I cleaned up the implementation a little bit for better readability and added fixture tests. Can you also confirm that it works as expected?

I'll test within the hour. What I could see from the code at a first glance, it should be the same behavior.
Although I chose suffix_mode for a reason. It is an option to random_url (and is only relevant when random_url is enabled), so naming the option random_ is superfluous. e.g. you don't call the other option random_type either. The term suffix alone is too less specific IMO, but would still be better than random_suffix.
But it's your choice of course.
I'll comment on the result of my tests in a bit.

Yeah, it makes sense to use suffix_mode in that context. Feel free to revert it!

Yep, the code works the same, but I found a bug in my code (I missed it in my earlier test cases), which of course propagated to the refactored one:
.foo           -> https://rptest.local/paste/.foo.wtNk.
.foo.bar       -> https://rptest.local/paste/.foo.SL2N.bar
.foo.bar.txt   -> https://rptest.local/paste/.foo.vTGL.bar.txt
foo            -> https://rptest.local/paste/foo.0OPe.txt
foo.bar        -> https://rptest.local/paste/foo.g7yj.bar
foo.bar.txt    -> https://rptest.local/paste/foo.kEaw.bar.txt

For the first file .foo, the resulting URL should be: https://rptest.local/paste/.foo.wtNk.txt
I can look into this later today. For now I just reverted the option name.

All fixed. Good to go, ;-)
Not sure why the test suite fails. If you run cargo test and the fixtures locally, averythig is fine. I guess gh is still recovering.

Looks good, thank you!

I'd hope for a 0.11.0 release soon.

I will work on it tomorrow 🐻

authors: codecov-commenter orhun tessus

repo: orhun/rustypaste


text:
unable to access results of custom functions when called from sql

It used to be (java 1.7) that functions like..
_1 = function() { return "hello" },
_2 = function() { return { greet: "hello" },
_3 = function() { return db.query("select from user limit 1");

Could be called from sql (or binary) using
select from _1()
select from _2()
select from _3()
etc..

and the response would be returned from sql as per the function.
Using 1.8 this is no longer the case, as although the functions are executed, the response values are not returned which effectively renders functions unusable unless invoked through the web api
This is possibly related to #3051

The problem seems the function name. If you call _1() as f1() works.

Fixed the problem with functions that starts with _

Agreed that this the '_' is part of the problem, but there is more...
test1 = function() { return db.query("select from ouser limit 1") }

sql> select from test1()

I would expect a user record to come back but in fact nothing does.

Testing it now...

any joy?

Hey Mat. I tried and works. There was a typo on it. You should rather execute:
select test1()

I did try this - but it does not return the document as expected - it just returns a temporary doc which must be expanded from a subselect
eg..
select expand(test1) from (select test1())
This is nasty.

This is how any function works, but distinct and expand.

authors: lvca mattaylor

repo: orientechnologies/orientdb


text:
Can't access db in console.sh and studio at the same time.

--> com.orientechnologies.orient.core.exception.OSerializationException: Cannot load database's configuration. The database seems to be corrupted.
--> com.orientechnologies.common.concur.lock.OLockException: File '/opt/orientdb/databases/bodyclub24_prod/database.ocf' is locked by another process, maybe the database is in use by another process. Use the remote mode with a OrientDB server to allow multiple access to the same database. [ONetworkProtocolHttpDb]♥```

and remote import/export is only available in the enterprice edition right?

In order to access from Studio & Console, start a OrientDB server and always use "remote:" protocol to open the database.

authors: StarpTech lvca