Test mutal-auth demo from GSG on EKS

### Tasks
- [x] Install Cilium 1.14.0-rc.1
- [x] Test [mtls guide](https://docs.cilium.io/en/v1.14/network/servicemesh/mutual-authentication/mutual-authentication/#gs-mutual-authentication)

@SandeshAmin can you test this guide? If you need a hand @meyskens or @sayboras should be able to help.

Sure @mathpl

I will perform tests on 2 enviroments. One on kind and other on an EKS cluster.
Was unable to install using helm as the image is not prod.
     helm install cilium cilium/cilium --version 1.14.0-rc.1 \
    --namespace kube-system \
    --reuse-values \
    --set authentication.mutual.spire.enabled=true \
    --set authentication.mutual.spire.install.enabled=true

I could only list the rc builds using —devel flags:
─sandesh at
Sandesh's MacBook Pro in ~
╰─○ helm search repo -l cilium --devel | grep '1.14'
cilium/cilium                 	1.14.0-snapshot.4              	1.14.0-snapshot.4              	eBPF-based Networking, Security, and Observability
cilium/cilium                 	1.14.0-snapshot.3              	1.14.0-snapshot.3              	eBPF-based Networking, Security, and Observability
cilium/cilium                 	1.14.0-snapshot.2              	1.14.0-snapshot.2              	eBPF-based Networking, Security, and Observability
cilium/cilium                 	1.14.0-snapshot.1              	1.14.0-snapshot.1              	eBPF-based Networking, Security, and Observability
cilium/cilium                 	1.14.0-snapshot.0              	1.14.0-snapshot.0              	eBPF-based Networking, Security, and Observability
cilium/cilium                 	1.14.0-rc.1                    	1.14.0-rc.1                    	eBPF-based Networking, Security, and Observability
cilium/cilium                 	1.14.0-rc.0                    	1.14.0-rc.0                    	eBPF-based Networking, Security, and Observability
cilium/cilium                 	1.11.14                        	1.11.14                        	eBPF-based Networking, Security, and Observability
isovalent/cilium              	1.14.9999-dev                  	1.14.9999-dev                  	eBPF-based Networking, Security, and Observability
isovalent/cilium              	1.11.14-cee.1                  	1.11.14-cee.1                  	eBPF-based Networking, Security, and Observability
isovalent/cilium-enterprise   	1.11.14                        	1.11.14                        	Helm chart for Cilium Enterprise
╭─sandesh at Sandesh's MacBook Pro in ~
╰─○

Went ahead with cilium-cli :
cilium install --version 1.14.0-rc.1 --helm-set authentication.mutual.spire.enabled=true  --helm-set authentication.mutual.spire.install.enabled=true
Testing on KindCluster:
Cilium and cli version:
root@k8sss:~# cilium version
cilium-cli: v0.15.3 compiled with go1.20.4 on linux/amd64
cilium image (default): v1.13.4
cilium image (stable): v1.13.4
cilium image (running): 1.14.0-rc.1
root@k8sss:~#

root@k8sss:~# cilium config view | grep auth
mesh-auth-enabled                                 true
mesh-auth-gc-interval                             5m0s
mesh-auth-mutual-enabled                          true
mesh-auth-mutual-listener-port                    4250
mesh-auth-queue-size                              1024
mesh-auth-rotated-identities-queue-size           1024
mesh-auth-spiffe-trust-domain                     spiffe.cilium
mesh-auth-spire-admin-socket                      /run/spire/sockets/admin.sock
mesh-auth-spire-agent-socket                      /run/spire/sockets/agent/agent.sock
mesh-auth-spire-server-address                    spire-server.cilium-spire.svc:8081
mesh-auth-spire-server-connection-timeout         30s
root@k8sss:~#

Verify that the Pods have been successfully deployed:
root@k8sss:~# kubectl get all
NAME                        READY   STATUS    RESTARTS   AGE
pod/echo-68cc97587c-59lhb   1/1     Running   0          55s
pod/pod-worker              1/1     Running   0          55s

NAME                 TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)    AGE
service/echo         ClusterIP   <IP_ADDRESS>   <none>        8080/TCP   56s
service/kubernetes   ClusterIP   <IP_ADDRESS>      <none>        443/TCP    8m4s

NAME                   READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/echo   1/1     1            1           55s

NAME                              DESIRED   CURRENT   READY   AGE
replicaset.apps/echo-68cc97587c   1         1         1       55s
root@k8sss:~#

Verify that the network policy has been deployed successfully and filters the traffic as expected.
root@k8sss:~# kubectl exec -it pod-worker -- curl -s -o /dev/null -w "%{http_code}\n" http://echo:8080/headers
200
root@k8sss:~#

root@k8sss:~# kubectl exec -it pod-worker -- curl http://echo:8080/headers-1
Access denied
root@k8sss:~#

Verify SPIRE Health:
root@k8sss:~# kubectl get all -n cilium-spire
NAME                    READY   STATUS    RESTARTS   AGE
pod/spire-agent-f4s9j   1/1     Running   0          5m
pod/spire-agent-wvr99   1/1     Running   0          4m49s
pod/spire-agent-xjcw8   1/1     Running   0          4m51s
pod/spire-server-0      2/2     Running   0          5m28s

NAME                   TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)    AGE
service/spire-server   ClusterIP   <IP_ADDRESS>   <none>        8081/TCP   5m28s

NAME                         DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
daemonset.apps/spire-agent   3         3         3       3            3           <none>          5m28s

NAME                            READY   AGE
statefulset.apps/spire-server   1/1     5m28s
root@k8sss:~#

Run a healthcheck on the SPIRE server.
root@k8sss:~# kubectl exec -n cilium-spire spire-server-0 -c spire-server -- /opt/spire/bin/spire-server healthcheck
Server is healthy.
root@k8sss:~#

Verify the list of attested agents:
root@k8sss:~# kubectl exec -n cilium-spire spire-server-0 -c spire-server -- /opt/spire/bin/spire-server agent list
Found 3 attested agents:

SPIFFE ID         : spiffe://spiffe.cilium/spire/agent/k8s_psat/kind-test/c8e0f21e-510d-49fe-89be-df837547d1c1
Attestation type  : k8s_psat
Expiration time   : 2023-07-21 11:39:44 +0000 UTC
Serial number     :<PHONE_NUMBER>3946993016653210824163383459

SPIFFE ID         : spiffe://spiffe.cilium/spire/agent/k8s_psat/kind-test/a5b22395-be0a-4d0b-ab93-24052ad99fd6
Attestation type  : k8s_psat
Expiration time   : 2023-07-21 11:39:44 +0000 UTC
Serial number     :<PHONE_NUMBER>60213221892668355203947434921

SPIFFE ID         : spiffe://spiffe.cilium/spire/agent/k8s_psat/kind-test/7578afdc-9626-4b4d-8997-6243c80ec410
Attestation type  : k8s_psat
Expiration time   : 2023-07-21 11:39:44 +0000 UTC
Serial number     :<PHONE_NUMBER>58349481404149884245743218059

root@k8sss:~#

Verify that the Cilium agent and operator have Identities on the SPIRE server:
root@k8sss:~# kubectl exec -n cilium-spire spire-server-0 -c spire-server -- /opt/spire/bin/spire-server entry show -parentID spiffe://spiffe.cilium/ns/cilium-spire/sa/spire-agent
Found 2 entries
Entry ID         : 73fcfab4-d1b5-4c42-9b43-b006d800adf7
SPIFFE ID        : spiffe://spiffe.cilium/cilium-agent
Parent ID        : spiffe://spiffe.cilium/ns/cilium-spire/sa/spire-agent
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : k8s:ns:kube-system
Selector         : k8s:sa:cilium

Entry ID         : 4fe44bd7-092b-4cd1-b568-0c6bfccd77f6
SPIFFE ID        : spiffe://spiffe.cilium/cilium-operator
Parent ID        : spiffe://spiffe.cilium/ns/cilium-spire/sa/spire-agent
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : k8s:ns:kube-system
Selector         : k8s:sa:cilium-operator

root@k8sss:~#

Verifying that the echo Pod has an Identity registered with the SPIRE server:

root@k8sss:~# IDENTITY_ID=$(kubectl get cep -l app=echo -o=jsonpath='{.items[0].status.identity.id}')
root@k8sss:~# echo $IDENTITY_ID
26022
root@k8sss:~#

root@k8sss:~# kubectl exec -n cilium-spire spire-server-0 -c spire-server -- /opt/spire/bin/spire-server entry show -spiffeID spiffe://spiffe.cilium/identity/$IDENTITY_ID
Found 1 entry
Entry ID         : dc3e81ff-8313-4e3e-bf63-901d05225300
SPIFFE ID        : spiffe://spiffe.cilium/identity/26022
Parent ID        : spiffe://spiffe.cilium/cilium-operator
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : cilium:mutual-auth

root@k8sss:~#

Checking all registered entries:
root@k8sss:~# kubectl exec -n cilium-spire spire-server-0 -c spire-server -- /opt/spire/bin/spire-server entry show -selector cilium:mutual-auth
Found 6 entries
Entry ID         : 52479fd4-6ab6-4451-af17-ad2bdc4f1124
SPIFFE ID        : spiffe://spiffe.cilium/identity/14585
Parent ID        : spiffe://spiffe.cilium/cilium-operator
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : cilium:mutual-auth

Entry ID         : 5b1a048d-d88a-4d3a-90f2-e5a7a4fbce3a
SPIFFE ID        : spiffe://spiffe.cilium/identity/21386
Parent ID        : spiffe://spiffe.cilium/cilium-operator
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : cilium:mutual-auth

Entry ID         : dc3e81ff-8313-4e3e-bf63-901d05225300
SPIFFE ID        : spiffe://spiffe.cilium/identity/26022
Parent ID        : spiffe://spiffe.cilium/cilium-operator
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : cilium:mutual-auth

Entry ID         : e3da9030-95ac-43ab-8536-db7817171280
SPIFFE ID        : spiffe://spiffe.cilium/identity/32223
Parent ID        : spiffe://spiffe.cilium/cilium-operator
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : cilium:mutual-auth

Entry ID         : d97d3ea7-c0c3-4d74-b3c7-e1770bc643b2
SPIFFE ID        : spiffe://spiffe.cilium/identity/35135
Parent ID        : spiffe://spiffe.cilium/cilium-operator
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : cilium:mutual-auth

Entry ID         : dbd0cec2-398f-446c-a23d-32c98c6fd21a
SPIFFE ID        : spiffe://spiffe.cilium/identity/4879
Parent ID        : spiffe://spiffe.cilium/cilium-operator
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : cilium:mutual-auth

root@k8sss:~#

Checking all cilium identities:
root@k8sss:~# kubectl get ciliumidentities
NAME    NAMESPACE            AGE
14585   local-path-storage   11m
21386   default              8m31s
26022   default              8m31s
32223   kube-system          11m
35135   local-path-storage   11m
4879    cilium-spire         11m
root@k8sss:~#

Enforcing Mutual Authentication:
root@k8sss:~# kubectl exec -it pod-worker -- curl -s -o /dev/null -w "%{http_code}\n" http://echo:8080/headers
200
root@k8sss:~# kubectl exec -it pod-worker -- curl http://echo:8080/headers-1
Access denied
root@k8sss:~#

Verifying if authentication worked by checking agent logs:
root@k8sss:~# kubectl get pods -A -o wide | grep -e 'echo\|cilium'
cilium-spire         spire-agent-f4s9j                            1/1     Running   0          26m     <IP_ADDRESS>   test-worker3         <none>           <none>
cilium-spire         spire-agent-wvr99                            1/1     Running   0          26m     <IP_ADDRESS>   test-worker2         <none>           <none>
cilium-spire         spire-agent-xjcw8                            1/1     Running   0          26m     <IP_ADDRESS>   test-worker          <none>           <none>
cilium-spire         spire-server-0                               2/2     Running   0          26m     <IP_ADDRESS>   test-worker3         <none>           <none>
default              echo-68cc97587c-59lhb                        1/1     Running   0          23m     <IP_ADDRESS>   test-worker          <none>           <none>
kube-system          cilium-5tvgc                                 1/1     Running   0          4m23s   <IP_ADDRESS>   test-worker3         <none>           <none>
kube-system          cilium-745f6                                 1/1     Running   0          4m24s   <IP_ADDRESS>   test-control-plane   <none>           <none>
kube-system          cilium-74jnz                                 1/1     Running   0          4m24s   <IP_ADDRESS>   test-worker2         <none>           <none>
kube-system          cilium-crwvf                                 1/1     Running   0          4m25s   <IP_ADDRESS>   test-worker          <none>           <none>
kube-system          cilium-operator-b89b85456-zxp4v              1/1     Running   0          26m     <IP_ADDRESS>   test-worker3         <none>           <none>
root@k8sss:~#

root@k8sss:~# kubectl -n kube-system -c cilium-agent logs cilium-crwvf --timestamps=true | grep "Policy is requiring authentication\|Validating Server SNI\|Validated certificate\|Successfully authenticated"
root@k8sss:~#

Not able to locate any logs. Does not look like authentication worked for our echo app and svc.
However, I tried using the deathstar app and policy. The only difference I could fine is just the port numbers. The one in documentation uses port 8080 and the below example uses 80 and also documentation uses L7 policy .
kubectl apply -f https://raw.githubusercontent.com/cilium/cilium/HEAD/examples/minikube/http-sw-app.yaml
kubectl apply -f https://raw.githubusercontent.com/cilium/cilium/HEAD/examples/minikube/sw_l3_l4_policy.yaml
root@k8sss:~# cat sw_l3_l4_l7_mutual_authentication_policy.yaml
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "rule1"
spec:
  description: "Mutual authentication enabled L7 policy"
  endpointSelector:
    matchLabels:
      org: empire
      class: deathstar
  ingress:
  - fromEndpoints:
    - matchLabels:
        org: empire
    authentication:
      mode: "required"
    toPorts:
    - ports:
      - port: "80"
        protocol: TCP
      rules:
        http:
        - method: "POST"
          path: "/v1/request-landing"
root@k8sss:~#

Testing:
root@k8sss:~# kubectl exec tiefighter -- \
  curl -s -XPOST deathstar.default.svc.cluster.local/v1/request-landing
Ship landed
root@k8sss:~# kubectl exec tiefighter -- \
  curl -s -XPUT deathstar.default.svc.cluster.local/v1/exhaust-port
Access denied
root@k8sss:~# kubectl exec xwing -- \
  curl -s --connect-timeout 1 -XPOST deathstar.default.svc.cluster.local/v1/request-landing
command terminated with exit code 28

Verifying through agent logs that mAuth worked:
CILIUM_KIND_WORKER=$(kubectl -n kube-system get pods -l k8s-app=cilium -o jsonpath='{.items[?(@.spec.nodeName=="test-worker")].metadata.name}')
CILIUM_KIND_WORKER2=$(kubectl -n kube-system get pods -l k8s-app=cilium -o jsonpath='{.items[?(@.spec.nodeName=="test-worker2")].metadata.name}')
root@k8sss:~# kubectl -n kube-system -c cilium-agent logs $CILIUM_KIND_WORKER --timestamps=true | grep "Policy is requiring authentication\|Validating Server SNI\|Validated certificate\|Successfully authenticated"
2023-07-21T11:11:45.425086187Z level=debug msg="Policy is requiring authentication" key="localIdentity=26022, remoteIdentity=21386, remoteNodeID=52451, authType=spire" subsys=auth
2023-07-21T11:11:45.429764728Z level=debug msg="Validating Server SNI" SNI ID=21386 subsys=auth
2023-07-21T11:11:45.429794809Z level=debug msg="Validated certificate" subsys=auth uri-san="[spiffe://spiffe.cilium/identity/21386]"
2023-07-21T11:11:45.429806365Z level=debug msg="Successfully authenticated" key="localIdentity=26022, remoteIdentity=21386, remoteNodeID=52451, authType=spire" remote_node_ip=<IP_ADDRESS> subsys=auth
2023-07-21T11:27:38.255976531Z level=debug msg="Policy is requiring authentication" key="localIdentity=9882, remoteIdentity=11107, remoteNodeID=52451, authType=spire" subsys=auth
2023-07-21T11:27:38.259158817Z level=debug msg="Validating Server SNI" SNI ID=11107 subsys=auth
2023-07-21T11:27:38.259187225Z level=debug msg="Validated certificate" subsys=auth uri-san="[spiffe://spiffe.cilium/identity/11107]"
2023-07-21T11:27:38.259719795Z level=debug msg="Successfully authenticated" key="localIdentity=9882, remoteIdentity=11107, remoteNodeID=52451, authType=spire" remote_node_ip=<IP_ADDRESS> subsys=auth
root@k8sss:~#

root@k8sss:~# kubectl -n kube-system -c cilium-agent logs $CILIUM_KIND_WORKER2 --timestamps=true | grep "Policy is requiring authentication\|Validating Server SNI\|Validated certificate\|Successfully authenticated"
2023-07-21T11:34:17.215907345Z level=debug msg="Policy is requiring authentication" key="localIdentity=9882, remoteIdentity=11107, remoteNodeID=0, authType=spire" subsys=auth
2023-07-21T11:34:17.219661743Z level=debug msg="Validating Server SNI" SNI ID=11107 subsys=auth
2023-07-21T11:34:17.219691907Z level=debug msg="Validated certificate" subsys=auth uri-san="[spiffe://spiffe.cilium/identity/11107]"
2023-07-21T11:34:17.220218194Z level=debug msg="Successfully authenticated" key="localIdentity=9882, remoteIdentity=11107, remoteNodeID=0, authType=spire" remote_node_ip=<IP_ADDRESS> subsys=auth
root@k8sss:~#

I will continue testing on EKS. @sayboras , @aanm and @meyskens , please review this and let me know your feedback.

I will perform tests on 2 enviroments. One on kind and other on an EKS cluster.
Was unable to install using helm as the image is not prod.
     helm install cilium cilium/cilium --version 1.14.0-rc.1 \
    --namespace kube-system \
    --reuse-values \
    --set authentication.mutual.spire.enabled=true \
    --set authentication.mutual.spire.install.enabled=true

I could only list the rc builds using —devel flags:
─sandesh at
Sandesh's MacBook Pro in ~
╰─○ helm search repo -l cilium --devel | grep '1.14'
cilium/cilium                 	1.14.0-snapshot.4              	1.14.0-snapshot.4              	eBPF-based Networking, Security, and Observability
cilium/cilium                 	1.14.0-snapshot.3              	1.14.0-snapshot.3              	eBPF-based Networking, Security, and Observability
cilium/cilium                 	1.14.0-snapshot.2              	1.14.0-snapshot.2              	eBPF-based Networking, Security, and Observability
cilium/cilium                 	1.14.0-snapshot.1              	1.14.0-snapshot.1              	eBPF-based Networking, Security, and Observability
cilium/cilium                 	1.14.0-snapshot.0              	1.14.0-snapshot.0              	eBPF-based Networking, Security, and Observability
cilium/cilium                 	1.14.0-rc.1                    	1.14.0-rc.1                    	eBPF-based Networking, Security, and Observability
cilium/cilium                 	1.14.0-rc.0                    	1.14.0-rc.0                    	eBPF-based Networking, Security, and Observability
cilium/cilium                 	1.11.14                        	1.11.14                        	eBPF-based Networking, Security, and Observability
isovalent/cilium              	1.14.9999-dev                  	1.14.9999-dev                  	eBPF-based Networking, Security, and Observability
isovalent/cilium              	1.11.14-cee.1                  	1.11.14-cee.1                  	eBPF-based Networking, Security, and Observability
isovalent/cilium-enterprise   	1.11.14                        	1.11.14                        	Helm chart for Cilium Enterprise
╭─sandesh at Sandesh's MacBook Pro in ~
╰─○

Went ahead with cilium-cli :
cilium install --version 1.14.0-rc.1 --helm-set authentication.mutual.spire.enabled=true  --helm-set authentication.mutual.spire.install.enabled=true
Testing on KindCluster:
Cilium and cli version:
root@k8sss:~# cilium version
cilium-cli: v0.15.3 compiled with go1.20.4 on linux/amd64
cilium image (default): v1.13.4
cilium image (stable): v1.13.4
cilium image (running): 1.14.0-rc.1
root@k8sss:~#

root@k8sss:~# cilium config view | grep auth
mesh-auth-enabled                                 true
mesh-auth-gc-interval                             5m0s
mesh-auth-mutual-enabled                          true
mesh-auth-mutual-listener-port                    4250
mesh-auth-queue-size                              1024
mesh-auth-rotated-identities-queue-size           1024
mesh-auth-spiffe-trust-domain                     spiffe.cilium
mesh-auth-spire-admin-socket                      /run/spire/sockets/admin.sock
mesh-auth-spire-agent-socket                      /run/spire/sockets/agent/agent.sock
mesh-auth-spire-server-address                    spire-server.cilium-spire.svc:8081
mesh-auth-spire-server-connection-timeout         30s
root@k8sss:~#

Verify that the Pods have been successfully deployed:
root@k8sss:~# kubectl get all
NAME                        READY   STATUS    RESTARTS   AGE
pod/echo-68cc97587c-59lhb   1/1     Running   0          55s
pod/pod-worker              1/1     Running   0          55s

NAME                 TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)    AGE
service/echo         ClusterIP   <IP_ADDRESS>   <none>        8080/TCP   56s
service/kubernetes   ClusterIP   <IP_ADDRESS>      <none>        443/TCP    8m4s

NAME                   READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/echo   1/1     1            1           55s

NAME                              DESIRED   CURRENT   READY   AGE
replicaset.apps/echo-68cc97587c   1         1         1       55s
root@k8sss:~#

Verify that the network policy has been deployed successfully and filters the traffic as expected.
root@k8sss:~# kubectl exec -it pod-worker -- curl -s -o /dev/null -w "%{http_code}\n" http://echo:8080/headers
200
root@k8sss:~#

root@k8sss:~# kubectl exec -it pod-worker -- curl http://echo:8080/headers-1
Access denied
root@k8sss:~#

Verify SPIRE Health:
root@k8sss:~# kubectl get all -n cilium-spire
NAME                    READY   STATUS    RESTARTS   AGE
pod/spire-agent-f4s9j   1/1     Running   0          5m
pod/spire-agent-wvr99   1/1     Running   0          4m49s
pod/spire-agent-xjcw8   1/1     Running   0          4m51s
pod/spire-server-0      2/2     Running   0          5m28s

NAME                   TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)    AGE
service/spire-server   ClusterIP   <IP_ADDRESS>   <none>        8081/TCP   5m28s

NAME                         DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
daemonset.apps/spire-agent   3         3         3       3            3           <none>          5m28s

NAME                            READY   AGE
statefulset.apps/spire-server   1/1     5m28s
root@k8sss:~#

Run a healthcheck on the SPIRE server.
root@k8sss:~# kubectl exec -n cilium-spire spire-server-0 -c spire-server -- /opt/spire/bin/spire-server healthcheck
Server is healthy.
root@k8sss:~#

Verify the list of attested agents:
root@k8sss:~# kubectl exec -n cilium-spire spire-server-0 -c spire-server -- /opt/spire/bin/spire-server agent list
Found 3 attested agents:

SPIFFE ID         : spiffe://spiffe.cilium/spire/agent/k8s_psat/kind-test/c8e0f21e-510d-49fe-89be-df837547d1c1
Attestation type  : k8s_psat
Expiration time   : 2023-07-21 11:39:44 +0000 UTC
Serial number     :<PHONE_NUMBER>3946993016653210824163383459

SPIFFE ID         : spiffe://spiffe.cilium/spire/agent/k8s_psat/kind-test/a5b22395-be0a-4d0b-ab93-24052ad99fd6
Attestation type  : k8s_psat
Expiration time   : 2023-07-21 11:39:44 +0000 UTC
Serial number     :<PHONE_NUMBER>60213221892668355203947434921

SPIFFE ID         : spiffe://spiffe.cilium/spire/agent/k8s_psat/kind-test/7578afdc-9626-4b4d-8997-6243c80ec410
Attestation type  : k8s_psat
Expiration time   : 2023-07-21 11:39:44 +0000 UTC
Serial number     :<PHONE_NUMBER>58349481404149884245743218059

root@k8sss:~#

Verify that the Cilium agent and operator have Identities on the SPIRE server:
root@k8sss:~# kubectl exec -n cilium-spire spire-server-0 -c spire-server -- /opt/spire/bin/spire-server entry show -parentID spiffe://spiffe.cilium/ns/cilium-spire/sa/spire-agent
Found 2 entries
Entry ID         : 73fcfab4-d1b5-4c42-9b43-b006d800adf7
SPIFFE ID        : spiffe://spiffe.cilium/cilium-agent
Parent ID        : spiffe://spiffe.cilium/ns/cilium-spire/sa/spire-agent
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : k8s:ns:kube-system
Selector         : k8s:sa:cilium

Entry ID         : 4fe44bd7-092b-4cd1-b568-0c6bfccd77f6
SPIFFE ID        : spiffe://spiffe.cilium/cilium-operator
Parent ID        : spiffe://spiffe.cilium/ns/cilium-spire/sa/spire-agent
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : k8s:ns:kube-system
Selector         : k8s:sa:cilium-operator

root@k8sss:~#

Verifying that the echo Pod has an Identity registered with the SPIRE server:

root@k8sss:~# IDENTITY_ID=$(kubectl get cep -l app=echo -o=jsonpath='{.items[0].status.identity.id}')
root@k8sss:~# echo $IDENTITY_ID
26022
root@k8sss:~#

root@k8sss:~# kubectl exec -n cilium-spire spire-server-0 -c spire-server -- /opt/spire/bin/spire-server entry show -spiffeID spiffe://spiffe.cilium/identity/$IDENTITY_ID
Found 1 entry
Entry ID         : dc3e81ff-8313-4e3e-bf63-901d05225300
SPIFFE ID        : spiffe://spiffe.cilium/identity/26022
Parent ID        : spiffe://spiffe.cilium/cilium-operator
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : cilium:mutual-auth

root@k8sss:~#

Checking all registered entries:
root@k8sss:~# kubectl exec -n cilium-spire spire-server-0 -c spire-server -- /opt/spire/bin/spire-server entry show -selector cilium:mutual-auth
Found 6 entries
Entry ID         : 52479fd4-6ab6-4451-af17-ad2bdc4f1124
SPIFFE ID        : spiffe://spiffe.cilium/identity/14585
Parent ID        : spiffe://spiffe.cilium/cilium-operator
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : cilium:mutual-auth

Entry ID         : 5b1a048d-d88a-4d3a-90f2-e5a7a4fbce3a
SPIFFE ID        : spiffe://spiffe.cilium/identity/21386
Parent ID        : spiffe://spiffe.cilium/cilium-operator
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : cilium:mutual-auth

Entry ID         : dc3e81ff-8313-4e3e-bf63-901d05225300
SPIFFE ID        : spiffe://spiffe.cilium/identity/26022
Parent ID        : spiffe://spiffe.cilium/cilium-operator
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : cilium:mutual-auth

Entry ID         : e3da9030-95ac-43ab-8536-db7817171280
SPIFFE ID        : spiffe://spiffe.cilium/identity/32223
Parent ID        : spiffe://spiffe.cilium/cilium-operator
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : cilium:mutual-auth

Entry ID         : d97d3ea7-c0c3-4d74-b3c7-e1770bc643b2
SPIFFE ID        : spiffe://spiffe.cilium/identity/35135
Parent ID        : spiffe://spiffe.cilium/cilium-operator
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : cilium:mutual-auth

Entry ID         : dbd0cec2-398f-446c-a23d-32c98c6fd21a
SPIFFE ID        : spiffe://spiffe.cilium/identity/4879
Parent ID        : spiffe://spiffe.cilium/cilium-operator
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : cilium:mutual-auth

root@k8sss:~#

Checking all cilium identities:
root@k8sss:~# kubectl get ciliumidentities
NAME    NAMESPACE            AGE
14585   local-path-storage   11m
21386   default              8m31s
26022   default              8m31s
32223   kube-system          11m
35135   local-path-storage   11m
4879    cilium-spire         11m
root@k8sss:~#

Enforcing Mutual Authentication:
root@k8sss:~# kubectl exec -it pod-worker -- curl -s -o /dev/null -w "%{http_code}\n" http://echo:8080/headers
200
root@k8sss:~# kubectl exec -it pod-worker -- curl http://echo:8080/headers-1
Access denied
root@k8sss:~#

Verifying if authentication worked by checking agent logs:
root@k8sss:~# kubectl get pods -A -o wide | grep -e 'echo\|cilium'
cilium-spire         spire-agent-f4s9j                            1/1     Running   0          26m     <IP_ADDRESS>   test-worker3         <none>           <none>
cilium-spire         spire-agent-wvr99                            1/1     Running   0          26m     <IP_ADDRESS>   test-worker2         <none>           <none>
cilium-spire         spire-agent-xjcw8                            1/1     Running   0          26m     <IP_ADDRESS>   test-worker          <none>           <none>
cilium-spire         spire-server-0                               2/2     Running   0          26m     <IP_ADDRESS>   test-worker3         <none>           <none>
default              echo-68cc97587c-59lhb                        1/1     Running   0          23m     <IP_ADDRESS>   test-worker          <none>           <none>
kube-system          cilium-5tvgc                                 1/1     Running   0          4m23s   <IP_ADDRESS>   test-worker3         <none>           <none>
kube-system          cilium-745f6                                 1/1     Running   0          4m24s   <IP_ADDRESS>   test-control-plane   <none>           <none>
kube-system          cilium-74jnz                                 1/1     Running   0          4m24s   <IP_ADDRESS>   test-worker2         <none>           <none>
kube-system          cilium-crwvf                                 1/1     Running   0          4m25s   <IP_ADDRESS>   test-worker          <none>           <none>
kube-system          cilium-operator-b89b85456-zxp4v              1/1     Running   0          26m     <IP_ADDRESS>   test-worker3         <none>           <none>
root@k8sss:~#

Verifying through agent logs that mAuth worked:
CILIUM_KIND_WORKER=$(kubectl -n kube-system get pods -l k8s-app=cilium -o jsonpath='{.items[?(@.spec.nodeName=="test-worker")].metadata.name}')
root@k8sss:~# kubectl -n kube-system -c cilium-agent logs $CILIUM_KIND_WORKER --timestamps=true | grep "Policy is requiring authentication\|Validating Server SNI\|Validated certificate\|Successfully authenticated"
2023-07-21T11:11:45.425086187Z level=debug msg="Policy is requiring authentication" key="localIdentity=26022, remoteIdentity=21386, remoteNodeID=52451, authType=spire" subsys=auth
2023-07-21T11:11:45.429764728Z level=debug msg="Validating Server SNI" SNI ID=21386 subsys=auth
2023-07-21T11:11:45.429794809Z level=debug msg="Validated certificate" subsys=auth uri-san="[spiffe://spiffe.cilium/identity/21386]"
2023-07-21T11:11:45.429806365Z level=debug msg="Successfully authenticated" key="localIdentity=26022, remoteIdentity=21386, remoteNodeID=52451, authType=spire" remote_node_ip=<IP_ADDRESS> subsys=auth

As per the logs, we can see $IDENTITY_ID=26022 showing mAuth.
It would great if we could include the command to export the agent log where the pod is running as shown above.
I will continue testing on EKS. @sayboras , @aanm and @meyskens , please review this and let me know your feedback.

@SandeshAmin I tested out the helm install part, it works on my side with --devel. --devel is not necessary for installation if we specify the exact version.

Question: Is this supposed to work when running cilium CNI in chaining mode with VPC CNI on EKS?

Question: Is this supposed to work when running cilium CNI in chaining mode with VPC CNI on EKS?

Mutual auth should not have any dependency on the above. As long as there is connectivity between Cilium Operator and Spire Service, it should be fine. For EKS, we used to have an issue with DNS on host networking, but it should be fixed as part of https://github.com/cilium/cilium/pull/26031.

@SandeshAmin I've renamed this GH issue to Test mutal-auth demo from GSG on EKS to verify if we have any specific issues with EKS. If we don't have it, feel free to close this issue.

EKS mTLS:
Cluster Creation Step:

eksctl create cluster --name "${NAME}" --region "${REGION}" --tags "${TAGS}" --nodes 2 --instance-types "t3.medium,t3a.medium" --node-volume-type gp3 --node-volume-size 10 --managed --spot
Once cluster is created, you would need to make sure to have EBS policy to nodegroup otherwise the spire deployment will not come as it needs PVC . You may see the following error:
╭─sandesh at Sandesh’s MacBook Pro in ~/eks_clusters
╰─○ kubectl get pods -A
NAMESPACE      NAME                               READY   STATUS                  RESTARTS      AGE
cilium-spire   spire-agent-7mvk5                  0/1     Init:CrashLoopBackOff   2 (17s ago)   3m37s
cilium-spire   spire-agent-q7cbr                  0/1     Init:Error              2 (89s ago)   3m37s
cilium-spire   spire-server-0                     0/2     Pending                 0             3m36s
kube-system    cilium-ldfgq                       1/1     Running                 0             3m37s
kube-system    cilium-nx9h6                       1/1     Running                 0             3m37s
kube-system    cilium-operator-86f6c9c59b-gdh9t   1/1     Running                 0             3m37s
kube-system    coredns-5b7dc88f89-4f92t           1/1     Running                 0             3m4s
kube-system    coredns-5b7dc88f89-dbhk7           1/1     Running                 0             3m19s
kube-system    kube-proxy-fw9nk                   1/1     Running                 0             22m
kube-system    kube-proxy-lc2t4                   1/1     Running                 0             22m
╭─sandesh at Sandesh’s MacBook Pro in ~/eks_clusters

           status code: 403, request id: 6c9fcb7e-edf1-4eaf-898e-6ae733b9b8f5
  Normal   ExternalProvisioning  11s (x7 over 83s)  persistentvolume-controller  waiting for a volume to be created, either by external provisioner "ebs.csi.aws.com" or manually created by system administrator

You need to have an EKS cluster which has the ability to provision EBS .
Steps to enable EBS policy for your cluster nodegroup:

Go to console>> IAM >> Roles.
Search for node group name and select it.
Under permissions, click on Add permissions from the Dropdown.
Attach policies
Search for the term ‘EBS’
Click on ‘[AmazonEBSCSIDriverPolicy]
Add permission.

Install the drivers:
kubectl apply -k "github.com/kubernetes-sigs/aws-ebs-csi-driver/deploy/kubernetes/overlays/stable/?ref=master"
╭─sandesh at Sandesh’s MacBook Pro in ~/eks_clusters
╰─○ kubectl get pods -A
NAMESPACE      NAME                                  READY   STATUS    RESTARTS   AGE
cilium-spire   spire-agent-7mvk5                     1/1     Running   0          9m
cilium-spire   spire-agent-q7cbr                     1/1     Running   0          9m
cilium-spire   spire-server-0                        2/2     Running   0          8m59s
kube-system    cilium-ldfgq                          1/1     Running   0          9m
kube-system    cilium-nx9h6                          1/1     Running   0          9m
kube-system    cilium-operator-86f6c9c59b-gdh9t      1/1     Running   0          9m
kube-system    coredns-5b7dc88f89-4f92t              1/1     Running   0          8m27s
kube-system    coredns-5b7dc88f89-dbhk7              1/1     Running   0          8m42s
kube-system    ebs-csi-controller-7cb66647b9-4b84q   6/6     Running   0          2m14s
kube-system    ebs-csi-controller-7cb66647b9-sg8bk   6/6     Running   0          2m14s
kube-system    ebs-csi-node-7c64j                    3/3     Running   0          2m13s
kube-system    ebs-csi-node-gm6rv                    3/3     Running   0          2m13s
kube-system    kube-proxy-fw9nk                      1/1     Running   0          27m
kube-system    kube-proxy-lc2t4                      1/1     Running   0          27m
╭─sandesh at Sandesh’s MacBook Pro in ~/eks_clusters
╰─○

Connectivity test:
╭─sandesh at Sandesh’s MacBook Pro in ~/eks_clusters
╰─○ cilium connectivity test --test auth
ℹ  Monitor aggregation detected, will skip some flow validation steps
✨ [sandesh-test-27856.eu-west-2.eksctl.io] Creating namespace cilium-test for connectivity check...
✨ [sandesh-test-27856.eu-west-2.eksctl.io] Deploying echo-same-node service...
✨ [sandesh-test-27856.eu-west-2.eksctl.io] Deploying DNS test server configmap...
✨ [sandesh-test-27856.eu-west-2.eksctl.io] Deploying same-node deployment...
✨ [sandesh-test-27856.eu-west-2.eksctl.io] Deploying client deployment...
✨ [sandesh-test-27856.eu-west-2.eksctl.io] Deploying client2 deployment...
✨ [sandesh-test-27856.eu-west-2.eksctl.io] Deploying echo-other-node service...
✨ [sandesh-test-27856.eu-west-2.eksctl.io] Deploying other-node deployment...
✨ [host-netns] Deploying sandesh-test-27856.eu-west-2.eksctl.io daemonset...
✨ [host-netns-non-cilium] Deploying sandesh-test-27856.eu-west-2.eksctl.io daemonset...
✨ [sandesh-test-27856.eu-west-2.eksctl.io] Deploying echo-external-node deployment...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for deployment cilium-test/client to become ready...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for deployment cilium-test/client2 to become ready...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for deployment cilium-test/echo-same-node to become ready...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for deployment cilium-test/echo-other-node to become ready...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for CiliumEndpoint for pod cilium-test/client-78d8db4f9-chhr6 to appear...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for CiliumEndpoint for pod cilium-test/client2-6cd4885dbf-92pck to appear...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for pod cilium-test/client-78d8db4f9-chhr6 to reach DNS server on cilium-test/echo-same-node-5758d5db99-w998l pod...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for pod cilium-test/client2-6cd4885dbf-92pck to reach DNS server on cilium-test/echo-same-node-5758d5db99-w998l pod...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for pod cilium-test/client-78d8db4f9-chhr6 to reach DNS server on cilium-test/echo-other-node-84468544f9-bdrdr pod...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for pod cilium-test/client2-6cd4885dbf-92pck to reach DNS server on cilium-test/echo-other-node-84468544f9-bdrdr pod...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for pod cilium-test/client-78d8db4f9-chhr6 to reach default/kubernetes service...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for pod cilium-test/client2-6cd4885dbf-92pck to reach default/kubernetes service...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for CiliumEndpoint for pod cilium-test/echo-other-node-84468544f9-bdrdr to appear...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for CiliumEndpoint for pod cilium-test/echo-same-node-5758d5db99-w998l to appear...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for Service cilium-test/echo-same-node to become ready...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for Service cilium-test/echo-same-node to be synchronized by Cilium pod kube-system/cilium-ldfgq
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for Service cilium-test/echo-other-node to become ready...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for Service cilium-test/echo-other-node to be synchronized by Cilium pod kube-system/cilium-ldfgq
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for NodePort <IP_ADDRESS>:30082 (cilium-test/echo-other-node) to become ready...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for NodePort <IP_ADDRESS>:30716 (cilium-test/echo-same-node) to become ready...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for NodePort <IP_ADDRESS>:30082 (cilium-test/echo-other-node) to become ready...
⌛ [sandesh-test-27856.eu-west-2.eksctl.io] Waiting for NodePort <IP_ADDRESS>:30716 (cilium-test/echo-same-node) to become ready...
ℹ  Skipping IPCache check
🔭 Enabling Hubble telescope...
⚠  Unable to contact Hubble Relay, disabling Hubble telescope and flow validation: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp <IP_ADDRESS>:4245: connect: connection refused"
ℹ  Expose Relay locally with:
   cilium hubble enable
   cilium hubble port-forward&
ℹ  Cilium version: 1.14.0
🏃 Running tests...

[=] Skipping Test [no-policies]

[=] Skipping Test [no-policies-extra]

[=] Skipping Test [allow-all-except-world]

[=] Skipping Test [client-ingress]

[=] Skipping Test [client-ingress-knp]

[=] Skipping Test [allow-all-with-metrics-check]

[=] Skipping Test [all-ingress-deny]

[=] Skipping Test [all-ingress-deny-knp]

[=] Skipping Test [all-egress-deny]

[=] Skipping Test [all-egress-deny-knp]

[=] Skipping Test [all-entities-deny]

[=] Skipping Test [cluster-entity]

[=] Skipping Test [host-entity]

[=] Skipping Test [echo-ingress]

[=] Skipping Test [echo-ingress-knp]

[=] Skipping Test [client-ingress-icmp]

[=] Skipping Test [client-egress]

[=] Skipping Test [client-egress-knp]

[=] Skipping Test [client-egress-expression]

[=] Skipping Test [client-egress-expression-knp]

[=] Skipping Test [client-with-service-account-egress-to-echo]

[=] Skipping Test [client-egress-to-echo-service-account]

[=] Skipping Test [to-entities-world]

[=] Skipping Test [to-cidr-external]

[=] Skipping Test [to-cidr-external-knp]

[=] Skipping Test [echo-ingress-from-other-client-deny]

[=] Skipping Test [client-ingress-from-other-client-icmp-deny]

[=] Skipping Test [client-egress-to-echo-deny]

[=] Skipping Test [client-ingress-to-echo-named-port-deny]

[=] Skipping Test [client-egress-to-echo-expression-deny]

[=] Skipping Test [client-with-service-account-egress-to-echo-deny]

[=] Skipping Test [client-egress-to-echo-service-account-deny]

[=] Skipping Test [client-egress-to-cidr-deny]

[=] Skipping Test [client-egress-to-cidr-deny-default]

[=] Skipping Test [health]

[=] Skipping Test [north-south-loadbalancing]

[=] Skipping Test [pod-to-pod-encryption]

[=] Skipping Test [node-to-node-encryption]

[=] Skipping Test [egress-gateway-excluded-cidrs]

[=] Skipping Test [north-south-loadbalancing-with-l7-policy]

[=] Skipping Test [echo-ingress-l7]

[=] Skipping Test [echo-ingress-l7-named-port]

[=] Skipping Test [client-egress-l7-method]

[=] Skipping Test [client-egress-l7]

[=] Skipping Test [client-egress-l7-named-port]

[=] Skipping Test [client-egress-l7-tls-deny-without-headers]

[=] Skipping Test [client-egress-l7-tls-headers]

[=] Skipping Test [client-egress-l7-set-header]
[=] Test [echo-ingress-auth-always-fail]
....
[=] Test [echo-ingress-mutual-auth-spiffe]
....

[=] Skipping Test [pod-to-ingress-service]

[=] Skipping Test [pod-to-ingress-service-deny-all]

[=] Skipping Test [pod-to-ingress-service-allow-ingress-identity]

[=] Skipping Test [dns-only]

[=] Skipping Test [to-fqdns]

✅ All 2 tests (8 actions) successful, 53 tests skipped, 0 scenarios skipped.

agent logs:
╭─sandesh at Sandesh’s MacBook Pro in ~/eks_clusters
╰─○ kubectl -n kube-system -c cilium-agent logs $CILIUM_WORKER --timestamps=true | grep "Policy is requiring authentication\|Validating Server SNI\|Validated certificate\|Successfully authenticated"
2023-07-25T13:50:42.080048095Z level=debug msg="Policy is requiring authentication" key="localIdentity=15347, remoteIdentity=62284, remoteNodeID=0, authType=spire" subsys=auth
2023-07-25T13:50:42.083831317Z level=debug msg="Validating Server SNI" SNI ID=62284 subsys=auth
2023-07-25T13:50:42.083984395Z level=debug msg="Validated certificate" subsys=auth uri-san="[spiffe://spiffe.cilium/identity/62284]"
2023-07-25T13:50:42.087054500Z level=debug msg="Successfully authenticated" key="localIdentity=15347, remoteIdentity=62284, remoteNodeID=0, authType=spire" remote_node_ip=<IP_ADDRESS> subsys=auth

Conclusion:
mTLS works on AWS EKS as well.

Thanks for the above details, we might just need to add a general note to make sure that PVC is supported in the target cluster with the required permissions.


ProgressToast related cahnges

FluentProgress: Add ValueChanged
FluentProgressRing: Add ValueChanged
Fix #655 and update example

Why do you want to set this Value property, as a bindable property?
In my opinion, this value cannot be modified from within the component itself, but only from the outside.
Fix #655 should be enough.

@vnbaaij Did you forget to revert FluentProgress.razor.cs and FluentProgressRing.razor.cs?
ValueChanged is in there. so Value is bindable. But ValueChanged is never invoked in code. This could be confusing to user.
FYR: https://learn.microsoft.com/en-us/aspnet/core/blazor/components/data-binding?view=aspnetcore-7.0#binding-with-component-parameters


Add Cron expression

:tada: This issue has been resolved in version 1.0.0 :tada:
The release is available on GitHub release
Your semantic-release bot :package::rocket:


standard color of function name is ignored when the arguments is on new line

From @isaklafleur on September 22, 2017 9:1

VSCode Version:
OS Version:

Steps to Reproduce:
I'm using prettier extension and it recommends to break on to separates lines. VSC don't color the variable name according to function color if the arguments are not on the same line.
Paste this in editor and you will see the standard function variable color does appear on function findAbbreviations, but not on replaceAbbreviationsWithExpansions
const findAbbreviations = (string, arrayOfAbbreviations) => {
  const stringArray = stringSplit(string);
  const abbreviationMatches = [];
  arrayOfAbbreviations.forEach(item => {
    if (stringArray.indexOf(item.abbreviation) >= 0) {
      abbreviationMatches.push({
        abbreviation: item.abbreviation,
        expansion: item.expansion
      });
    }
  });
  return abbreviationMatches;
};

const replaceAbbreviationsWithExpansions = (
  string,
  abbreviations,
  findAbbreviations
) => {
  if (findAbbreviations.length > 0) {
    const abbreviationMatches = findAbbreviations(string, abbreviations);
    let newString = string;
    abbreviationMatches.forEach(item => {
      newString = newString.replace(item.abbreviation, item.expansion);
    });
    return newString;
  } else {
    return string;
  }
};

Reproduces without extensions: Yes/No
Yes
Copied from original issue: Microsoft/vscode#34813

Simpler repo:
const f1 = (x) => { }
const f2 = (
    x
) =>  {}

Scope of f1 is:
entity.name.function.js
meta.definition.variable.js
meta.var-single-variable.expr.js
meta.var.expr.js
source.js

Scope of f2 is:
variable.other.readwrite.js
meta.definition.variable.js
meta.var-single-variable.expr.js
meta.var.expr.js
source.js

This is by design since on line 1 we cannot recognize the assignment to f2 as lambda expression

Released VS Code Extension version 0.0.33 that contains #552 which should address issues reported here. After letting it bake in that extension for 2-3 weeks, I could merge #552


Non-code configuration

I couldn't find anything in the post/README/samples yet, is there any idea about how to handle configuration with an external file (like a JSON)? This can be useful to have different configurations according to the environment and maybe even make some changes on the fly. Using ASP.NET Core JSON configuration has some benefits as expressed in this comment: https://github.com/SAFE-Stack/SAFE-BookStore/pull/255#issuecomment-352172785

I still haven't really figured out configuration. I like many things that ASP.NET Core is doing (different providers, detecting changes etc.) so maybe I will try to use just their stuff and work around the fact they use DI framework...

Sorry, I just noticed I pasted the wrong link above, I just fixed it ☝
Please note here I'm talking about configuration you usually put in an external file, like log level, connection strings, etc. In the (fixed) link above Vasily says ASP.NET Core Configuration bypasses IIS caching so it's good for changes on-the-fly.

Configuration should be handled by built-in ASP.NET Core way of handling config.


jellyfin-mpv-shim: 1.10.4 -> 2.0.1

Motivation for this change
Update to latest release https://github.com/jellyfin/jellyfin-mpv-shim/releases/tag/v2.0.0 (changes)
Upstream removed the desktop mode, since now there is the new jellyfin-media-player as a replacement for the desktop mode. Should there be a notice / changelog for that? The desktop mode was not in a stable channel.
Things done

[x] Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
Built on platform(s)

[x] NixOS
[ ] macOS
[ ] other Linux distributions

[ ] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
[ ] Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
[x] Tested execution of all binary files (usually in ./result/bin/)
[x] Determined the impact on package closure size (by running nix path-info -S before and after)

/nix/store/y06995wa30h49rir7zwpy84a35js3ckp-jellyfin-mpv-shim-1.10.4	  953988312
/nix/store/9pvi8dcpf0d5fqlbg3zfs26kvnwfrm4y-jellyfin-mpv-shim-2.0.0	  904213992
/nix/store/iaamjq35jhdpk8nl15mk2k2kmaamzcr0-jellyfin-mpv-shim-2.0.1	  901268936

[ ] Ensured that relevant documentation is up to date
[x] Fits CONTRIBUTING.md.

Upstream removed the desktop mode, since now there is the new jellyfin-media-player as a replacement for the desktop mode. Should there be a notice / changelog for that?

Don't think we need that.

This is a semi-automatic executed nixpkgs-review with nixpkgs-review-checks extension. It is checked by a human on a best effort basis and does not build all packages (e.g. lumo, tensorflow or pytorch).
If you have any questions or problems please reach out to SuperSandro2000 on IRC.
Result of nixpkgs-review pr 119927 run on x86_64-linux 1

1 package built:

jellyfin-mpv-shim

Update to latest release https://github.com/jellyfin/jellyfin-mpv-shim/releases/tag/v2.0.1 (changes)


Optimize ci tests

See commit messages.
Before:

After:

The downside is that we don't get a status-per-test, and instead one step. If it fails one needs to check what failed. (I've put "### Starting ..." that should be easily ctrl+f able to help locate the output of each test)

when I run it locally I get this:
(pr/1838 %) | just test-ci-all
./scripts/test-ci-all.sh
### Making sure workspace is built...
[...]
### Starting all tests in parallel...
parallel: invalid option -- '-'
parallel [OPTIONS] command -- arguments
        for each argument, run command with argument, in parallel
parallel [OPTIONS] -- commands
        run specified commands in parallel
error: Recipe `test-ci-all` failed on line 33 with exit code 1

@mxz42 are you in a nix develop shell?

Ah, damn. I reproed. On it.

https://github.com/fedimint/fedimint/pull/1862


flatpak fcitx5

Hi, I'm currently using flatpak fcitx5 on Ubuntu 20.04, every time the nvim is launched, I get an error message stating that "please intall im-select binary first, ...". Please figure out what I'm missing, the README just says that im-select is not required on Linux but does not cover the flatpak/appimage cases. BTW, Ubuntu 20.04 delivers fcitx5 that is not fully packaged due to some dependency restrictions.

Have you tried to execute fcitx5-remote -n in your shell or :!fcitx5-remote -n in nvim command mode?
Could you please provide the result?
BTW, I think you can reference https://github.com/keaising/im-select.nvim/issues/12 to debug

Sorry, the flatpak fcitx5 I installed has no this command.

I created an executable shell script at ~/.local/bin/fcitx5-remote with the following content:
#!/bin/bash
exec flatpak run --command=fcitx5-remote org.fcitx.Fcitx5 "$@"

Now the error message is gone, but when I am pressing Esc and then i,  the input method stays at US keyboard instead of switching back to the input method with which I left off the Insert mode.

Please follow the instructions in this new manual, https://github.com/keaising/im-select.nvim/tree/29fa3404d15c71c6725fab391218df9bf4775367, the features of  fcitx5-remote which required by im-select.nvim have been listed in it.
im-select.nvim  only works well when all requirements meet.

I upgraded my flatpak fctix5 to 5.0.23 version from which the fcitx5-remote command has -n option. I also disabled the FocusGained  from the default config and now everything seems to be working well!


Fix connection leak when using the api/util from the metadata comp

What does this PR do?
Fix connection leak when using the api/util from the metadata comp
Describe how to test/QA your changes
Security-agent team to test if connection leak is gone.

/merge

/merge

/merge -c

/merge

/merge


Port to dynet 2.0

Hi,
I've made some changes to port the parser to DyNet 2.0 (+ some other changes to make it more robust when finding the right directory for evaluation).
I've tested this version (MST & Transition-Based) on the PTB with gold & predicted PoS. I have the following results with predicted PoS:
MST:
Dev
LAS = 91.51 %
UAS = 93.97 %
Test
LAS = 91.74 %
UAS = 93.87 %
TB:
Dev
LAS = 91.52 %
UAS = 93.91 %
Test
LAS = 91.61 %
UAS = 93.78 %
Best
--
Corentin

Hi do you have model files for bestarchybrid to run on dynet 2 ? it looks like the one we downloaded is for the old version of model.

Hi, can I get the bestmodel for the MST & Transition-Based? What are the hyperparameters to train this, and how many iterations?
Thank you for the help in advance!


[stable/jenkins] Update Readme to work with Helm 3

Helm 3 requires release name and is of the format
helm install [NAME] [CHART] [flags]

Is this a new chart

NOTE: We're experiencing a high volume of PRs to this repo and reviews will be delayed. Please host your own chart repository and submit your repository to the Helm Hub instead of this repo to make them discoverable to the community. Here is how to submit new chart repositories to the Helm Hub.

What this PR does / why we need it:
Which issue this PR fixes
(optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged)

fixes #

Special notes for your reviewer:
Checklist
[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]

[ ] DCO signed
[ ] Chart Version bumped
[ ] Variables are documented in the README.md
[ ] Title of the PR starts with chart name (e.g. [stable/mychartname])

@bharathkkb Thanks for the PR. To be able to merge it you would need to sing the CLA.
CI also complains because you did not increase the version number in the chart. It would be great if you could add an entry in the changelog.
@maorfr Do you know how other charts are handling the instructions for helm 3? Are they updating their READMEs as well? The chart itself still uses helm 2 and it's also tested with helm 2 as chart-testing is using it.

@torstenwalter I think I messed up when amending the commit signoffs reopened at #20855 20855


Periodically rebuild sandcastle container images due to low activity here

Let's periodically rebuild sandcastle prod/stg images so that we have the latest greatest bits.
This is mostly triggered by rsync being updated and stopping to work as result (different version b/w sandcastle and worker), found by @spotlesstofu

"doing a rebuild" by merging the pre-commit PR: https://github.com/packit/sandcastle/pull/171


zip is not Rx compatible (take 2)

Retry of:

#116

func test() async throws {
    let initial = ContinuousClock.now

    let countUpStream = AsyncTimerSequence(interval: .seconds(1), clock: .continuous)
        .map { initial.duration(to: $0).components.seconds }
    let countUpStream2 = AsyncTimerSequence(interval: .seconds(3), clock: .continuous)
        .map { initial.duration(to: $0).components.seconds }

    let zipped = zip(countUpStream, countUpStream2)

    for try await value in zipped {
        let currentSec = initial.duration(to: .now).components.seconds
        print("===> zip: at \(currentSec) sec, \(value)")
    }
}

Result:
===> zip: at 3 sec, (1, 3)
===> zip: at 6 sec, (3, 6)
===> zip: at 9 sec, (6, 9)
===> zip: at 12 sec, (9, 12)
===> zip: at 15 sec, (12, 15)
...

To Be:
===> zip: at 3 sec, (1, 3)
===> zip: at 6 sec, (2, 6)
===> zip: at 9 sec, (3, 9)
===> zip: at 12 sec, (4, 12)
===> zip: at 15 sec, (5, 15)
...

--1-2-3-4-5-6-7-8-9-->
------3-----6-----9-->

zip
----(1,3)--(2,6)--(3,9)--->

I'd like to run this test but I'm failing to make this test generate anything, for some reason on my machine it stalls the while test. I'm using the latest trunk toolchain. 🤔

@DevAndArtist
This test is using swift-5.6 branch and tested with Xcode 13.3.

Unfortunately I cannot run the test for some reason. I only managed to run it by using the Mac (Rosetta) scheme, but the output there is even weirder:
===> zip: at 0 sec, (0, 0)
===> zip: at 0 sec, (0, 0)
===> zip: at 0 sec, (0, 0)
===> zip: at 1 sec, (0, 1)
===> zip: at 4 sec, (1, 4)
===> zip: at 7 sec, (4, 7)
===> zip: at 10 sec, (7, 10)
===> zip: at 13 sec, (10, 13)
===> zip: at 16 sec, (13, 16)

awaiting the second element in the tuple ends up delaying the iteration of the next first element of the tuple so the back pressure is causing the shift you are seeing (which is somewhat expected). To note: this project does not have any goal to be Rx compliant - granted it shares a lot of inspiration to similar systems. The differential is that the back pressure is distinctly modeled always as a back pressure of 1 (awaiting the call to next).

Ah right so a general marble diagram wouldn't apply here.
This is what happening:
A:--1-(await B)--3--(await B)--->
B:--------------3-----6-----9-->

zip
----(1,3)--(3,6)--(6,9)--->

Ah, I see!
So the async-pull nature of AsyncSequence will mutually interfere the timing of both emission.
When I changed the example code to not emit the time (which again makes the whole example difficult)
but incrementing count, it worked as expected:
    func test() async throws {
        let initial = ContinuousClock.now
        var count1 = 0
        var count2 = 0

        let countUpStream = AsyncTimerSequence(interval: .seconds(1), clock: .continuous)
            .map { _ -> Int in count1 += 1; return count1 }
        let countUpStream2 = AsyncTimerSequence(interval: .seconds(3), clock: .continuous)
            .map { _ -> Int in count2 += 1; return count2 }

        let zipped = zip(countUpStream, countUpStream2)

        for try await value in zipped {
            let currentSec = initial.duration(to: .now).components.seconds
            print("===> zip: at \(currentSec) sec, \(value)")
        }
    }

===> zip: at 3 sec, (1, 1)
===> zip: at 6 sec, (2, 2)
===> zip: at 9 sec, (3, 3)
===> zip: at 12 sec, (4, 4)
===> zip: at 15 sec, (5, 5)

So I confirmed that this is an expected behavior, and also follows the normal use case of zip
(except one needs to take special care of the timed value with async-pull when using AsyncTimerSequence).


Get path to sdk from dotnet cli

Test discovery didn't work on my machine (Linux) because the path to the dotnet sdk is hardcoded as /usr/lib/dotnet/sdk here https://github.com/GustavEikaas/easy-dotnet.nvim/blob/942467f4b2148bd9c924dee8dba2867980f9ea25/lua/easy-dotnet/options.lua#L11
but in my case the sdk was installed in /usr/share/dotnet/sdk.
You can get the path to the sdk using the dotnet --info command, or dotnet --list-sdks.
Here is the output of dotnet --list-sdks on my machine:
8.0.108 [/usr/share/dotnet/sdk]
8.0.302 [/usr/share/dotnet/sdk]

Yeah I guess this was eventually going to happen, im not sure how to best handle this. Performance wise its best for users to always set the get_sdk_path in their options but I do not want mandatory config properties. I could obviously run dotnet --info but there is a performance cost to this. I could of course cache the result in a file in the hopes that it will resolve the performance issues but  its not an ideal solution.
Any input would be great! :D

Just going to leave here a temporary solution that worked for me on Linux:
sudo ln -s /usr/share/dotnet /usr/lib/dotnet

btw, it didn't solve the problem with discovering all tests. In a small solution with ~1k tests Dotnet testrunner found only one test project with 20 tests.

Creative fix but you can also do like this.
 dotnet.setup({
...
      get_sdk_path = function()
        return "/usr/share/dotnet"
      end,
...
    })

Help me understand more in terms of test discovery, if I understand correctly there are multiple test projects of which the plugin only found one containing 20 tests. It would help if you could provide more information about the .csproj files of the test projects the plugin failed to find.
Below is the code for determining if a project is a testproject
M.is_test_project = function(project_file_path)
  if type(extract_from_project(project_file_path, '<%s*IsTestProject%s*>%s*true%s*</%s*IsTestProject%s*>')) == "string" then
    return true
  end
  if type(extract_from_project(project_file_path, '<PackageReference Include="Microsoft%.NET%.Test%.Sdk" Version=".-" />')) == "string" then
    return true
  end
  if type(extract_from_project(project_file_path, '<PackageReference Include="MSTest%.TestFramework" Version=".-" />')) == "string" then
    return true
  end
  if type(extract_from_project(project_file_path, '<PackageReference Include="NUnit" Version=".-" />')) == "string" then
    return true
  end
  if type(extract_from_project(project_file_path, '<PackageReference Include="xunit" Version=".-" />')) == "string" then
    return true
  end

  return false
end

The only project that showed up as a test project had <IsTestProject>true</IsTestProject> in its .csproj.
What about the others - I think the problem is that your code implies that the version of the package is specified in the .csproj file. But in our solution we use the central package management system, so in the .csproj file there is only this line: <PackageReference Include=“xunit” />, and the version is set in Directory.Packages.props.
csproj of successfully discovered project:
<Project Sdk="Microsoft.NET.Sdk">

    <PropertyGroup>
        <ImplicitUsings>enable</ImplicitUsings>
        <Nullable>enable</Nullable>

        <IsPackable>false</IsPackable>
        <IsTestProject>true</IsTestProject>
    </PropertyGroup>

    <ItemGroup>
        <PackageReference Include="FluentAssertions" />
        <PackageReference Include="Microsoft.NET.Test.Sdk" />
        <PackageReference Include="NSubstitute" />
        <PackageReference Include="xunit" />
        <PackageReference Include="xunit.runner.visualstudio">
            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
            <PrivateAssets>all</PrivateAssets>
        </PackageReference>
        <PackageReference Include="coverlet.collector">
            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
            <PrivateAssets>all</PrivateAssets>
        </PackageReference>
    </ItemGroup>

    <ItemGroup>
      <ProjectReference Include="..\..\src\Shared.DistributedCache\Shared.DistributedCache.csproj" />
    </ItemGroup>

</Project>

an example of a csproj that was not discovered:
<?xml version="1.0" encoding="utf-8"?>
<Project Sdk="Microsoft.NET.Sdk">
  <ItemGroup>
    <PackageReference Include="Microsoft.NET.Test.Sdk" />
    <PackageReference Include="NSubstitute" />
    <PackageReference Include="xunit" />
    <PackageReference Include="xunit.runner.visualstudio">
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
      <PrivateAssets>all</PrivateAssets>
    </PackageReference>
    <PackageReference Include="coverlet.collector">
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
      <PrivateAssets>all</PrivateAssets>
    </PackageReference>
  </ItemGroup>
  <ItemGroup>
    <ProjectReference Include="..\..\src\Processing.Application\Processing.Application.csproj" />
  </ItemGroup>
</Project>

Will be fixed in #147, would you mind testing it? I tried handling both without and without Version in PackageReference

It works great! I checked the number of tests this way:

Dotnet testrunner
E
search by flask pattern (g/)

I got:

A small solution, Rider reports 1059 tests, my method found 1298 tests
big solution, Rider reports 27283 tests, my method found 31065 tests

In this case, each case at a parameterized test also counts as a separate test, but I got pretty realistic results.
Is there any way to count only the test methods, without counting the parameterized cases?

Ah I see, I updated the logic now. the counts should be the same as rider now

Visual studio counts parameterized cases btw

Yes, for some reason I was sure that rider counts only test methods, without parameterized cases, sorry. I got a difference on a small solution of 1059(rider)-978(my method in neovim)=81.
now I counted the number of tests in neovim with this formula: echo count(join(getbufline('%', 1, '$'), ''), '')
It remains to find why some tests were not counted or found.

I found these weird parameterized tests that show up in Rider but not in neovim.

I have had some issues with MemberData,ClassData and InlineData attributes in the past.
But for your discovery issue, try pulling latest from the branch and run the discovery in your :messages you should see multiple paths show up, run cat <file> on these and see if it contains the same amount of tests as rider

cat /tmp/lua_Wqzt0C | grep Parse_WrongInput_ValidationWithCorrectPath | jq
results in
{
  "Id": "25efb9b5-9299-a3ec-be43-6eaef7ce211a",
  "Namespace": "Processing.Contracts.UnitTests.RetailOrderLineInputDtoParserTests.Parse_WrongInput_ValidationWithCorrectPath",
  "Name": "Processing.Contracts.UnitTests.RetailOrderLineInputDtoParserTests.Parse_WrongInput_ValidationWithCorrectPath",
  "FilePath": "/home/mvs/source/work/processing-orders/tests/Processing.Contracts.IntegrationTests/Parsers/RetailOrderLineInputDtoParserTests.cs",
  "Linenumber": 147
}

although a simple parametrized test turns out like this:
{
  "Id": "2208e58f-9a19-ee85-a965-027ac51bee02",
  "Namespace": "Processing.Application.UnitTests.CompositeProcessingPromotionCriterionTests.IsAcceptable_Theory",
  "Name": "Processing.Application.UnitTests.CompositeProcessingPromotionCriterionTests.IsAcceptable_Theory(innerCriteriaResults: [True], expectedResult: True)",
  "FilePath": "/home/mvs/source/work/processing-orders/tests/Processing.Application.UnitTests/Infrastructure/PromotionFiltration/Variants/DayOfWeekProcessingPromotionCriterionTests.cs",
  "Linenumber": 118
}
{
  "Id": "a777a547-f1a8-7289-5116-426f41a06c7f",
  "Namespace": "Processing.Application.UnitTests.CompositeProcessingPromotionCriterionTests.IsAcceptable_Theory",
  "Name": "Processing.Application.UnitTests.CompositeProcessingPromotionCriterionTests.IsAcceptable_Theory(innerCriteriaResults: [False], expectedResult: False)",
  "FilePath": "/home/mvs/source/work/processing-orders/tests/Processing.Application.UnitTests/Infrastructure/PromotionFiltration/Variants/DayOfWeekProcessingPromotionCriterionTests.cs",
  "Linenumber": 118
}
{
  "Id": "c309909f-c0b0-57c5-498b-a2d0f32732cc",
  "Namespace": "Processing.Application.UnitTests.CompositeProcessingPromotionCriterionTests.IsAcceptable_Theory",
  "Name": "Processing.Application.UnitTests.CompositeProcessingPromotionCriterionTests.IsAcceptable_Theory(innerCriteriaResults: [True, False], expectedResult: False)",
  "FilePath": "/home/mvs/source/work/processing-orders/tests/Processing.Application.UnitTests/Infrastructure/PromotionFiltration/Variants/DayOfWeekProcessingPromotionCriterionTests.cs",
  "Linenumber": 118
}

Weird I created a similiar testclass like this
using System.Collections.Generic;
using System.Threading.Tasks;
using Xunit;

namespace NeovimDebugProject.ClassData
{

  public class YourTestClass
  {
    // This is the data provider, returning 3 test cases.
    public static IEnumerable<object[]> ValidationTestCases =>
        new List<object[]>
        {
            // Case 1: Invalid input and corresponding validation error
            new object[] { "input_case_1", "Error for case 1" },

            // Case 2: Another invalid input and corresponding validation error
            new object[] { "input_case_2", "Error for case 2" },

            // Case 3: Yet another invalid input and corresponding validation error
            new object[] { "input_case_3", "Error for case 3" }
        };

    // This is the test method that will be run with each set of data from ValidationTestCases.
    [Theory]
    [MemberData(nameof(ValidationTestCases))]
    public async Task Parse_WrongInput_ValidationWithCorrectPath(object input, string validationErrorWildcard)
    {
      // Arrange: Set up any necessary conditions for your test.
      // For example, if you are calling a method named "Parse" that processes the input.

      // Act: Call the method you are testing.
      var result = await Parse(input);

      // Assert: Verify the result meets your expectations.
      // This could involve checking the validation error matches the expected wildcard.
      Assert.Contains(validationErrorWildcard, result.ValidationError);
    }

    // Dummy implementation of Parse method for demonstration purposes.
    // Replace this with your actual logic.
    private Task<(string ValidationError, int StatusCode)> Parse(object input)
    {
      // Example logic for generating a validation error based on input
      string validationError = $"Error for {input}";

      // Example status code, could be 400 for validation errors
      int statusCode = 400;

      // Return both the validation error and the status code as a tuple
      return Task.FromResult((validationError, statusCode));
    }
  }
}

This is the output from my tmp file
{"Id":"ea7dafa7-1951-c325-9bf4-c9d2f1aeacb9","Namespace":"NeovimDebugProject.ClassData.YourTestClass.Parse_Wrong
       │ Input_ValidationWithCorrectPath","Name":"NeovimDebugProject.ClassData.YourTestClass.Parse_WrongInput_ValidationW
       │ ithCorrectPath(input: \"input_case_1\", validationErrorWildcard: \"Error for case 1\")","FilePath":"C:\\Users\\G
       │ ustav\\repo\\NeovimDebugProject\\src\\NeovimDebugProject.ClassData\\MemberData.cs","Linenumber":28}
   2   │ {"Id":"0144cf93-900d-85e8-afe7-7939138810b9","Namespace":"NeovimDebugProject.ClassData.YourTestClass.Parse_Wrong
       │ Input_ValidationWithCorrectPath","Name":"NeovimDebugProject.ClassData.YourTestClass.Parse_WrongInput_ValidationW
       │ ithCorrectPath(input: \"input_case_2\", validationErrorWildcard: \"Error for case 2\")","FilePath":"C:\\Users\\G
       │ ustav\\repo\\NeovimDebugProject\\src\\NeovimDebugProject.ClassData\\MemberData.cs","Linenumber":28}
   3   │ {"Id":"3180559c-a31e-9c1d-8150-9cc630fc766c","Namespace":"NeovimDebugProject.ClassData.YourTestClass.Parse_Wrong
       │ Input_ValidationWithCorrectPath","Name":"NeovimDebugProject.ClassData.YourTestClass.Parse_WrongInput_ValidationW
       │ ithCorrectPath(input: \"input_case_3\", validationErrorWildcard: \"Error for case 3\")","FilePath":"C:\\Users\\G
       │ ustav\\repo\\NeovimDebugProject\\src\\NeovimDebugProject.ClassData\\MemberData.cs","Linenumber":28}
   4   │ {"Id":"62bdc21d-8091-5b84-fa77-6f35195cce0d","Namespace":"NeovimDebugProject.ClassData.MathTests.CanAddNumberss"
       │ ,"Name":"NeovimDebugProject.ClassData.MathTests.CanAddNumberss(value1: 1, type: null)","FilePath":"C:\\Users\\Gu
       │ stav\\repo\\NeovimDebugProject\\src\\NeovimDebugProject.ClassData\\UnitTest1.cs","Linenumber":28}
   5   │ {"Id":"8515d005-5dcb-6c99-ea5f-4cb7d0cd8ca4","Namespace":"NeovimDebugProject.ClassData.MathTests.CanAddNumberss"
       │ ,"Name":"NeovimDebugProject.ClassData.MathTests.CanAddNumberss(value1: 4, type: typeof(System.Exception))","File
       │ Path":"C:\\Users\\Gustav\\repo\\NeovimDebugProject\\src\\NeovimDebugProject.ClassData\\UnitTest1.cs","Linenumber
       │ ":28}
   6   │ {"Id":"56ed99dc-d0c9-b453-9abf-cf89dfc44117","Namespace":"NeovimDebugProject.ClassData.MathTests.CanAddNumberss"
       │ ,"Name":"NeovimDebugProject.ClassData.MathTests.CanAddNumberss(value1: 4, type: typeof(NeovimDebugProject.ClassD
       │ ata.Exceptions.CustomException))","FilePath":"C:\\Users\\Gustav\\repo\\NeovimDebugProject\\src\\NeovimDebugProje
       │ ct.ClassData\\UnitTest1.cs","Linenumber":28}
   7   │ {"Id":"340ccebf-235e-0de0-fc11-4a63b4528e90","Namespace":"NeovimDebugProject.ClassData.MathTests.Check","Name":"
       │ NeovimDebugProject.ClassData.MathTests.Check","FilePath":"C:\\Users\\Gustav\\repo\\NeovimDebugProject\\src\\Neov
       │ imDebugProject.ClassData\\UnitTest1.cs","Linenumber":43}

And the tests are running and parsed correctly
![image](https://github.com/user-attachments/assets/48234f32-3ba0-445b-bcf5-e1f303c88d78)

Yes, of course.
I'll look at the case of the problematic test method a bit later, at a glance it's not clear to me why it's not detecting normally.

A repro would be awesome, I have struggled a lot with these types of cases in previous issues

Hi,
On Linux and using the dotnet-install script the dotnet SDKs defaults to being installed under ~/.dotnet/sdk/[version]. This causes the default get_sdk_path function to return an invalid path since /usr/lib/dotnet/sdk/[version] does not exist.
I've made a workaround for this in my setup function, but thought I'd share it in case others run into the same issue. The function was copied and modified based on the original get_sdk_path function adding a call to dotnet --list-sdks and finding the correct sdk base path from the result.
        get_sdk_path = function()
          local sdk_version = vim.trim(vim.system({ "dotnet", "--version" }):wait().stdout)
          local sdk_list = vim.trim(vim.system({ "dotnet", "--list-sdks" }):wait().stdout)
          local base = nil
          for line in sdk_list:gmatch("[^\n]+") do
            if line:find(sdk_version, 1, true) then
              base = line:match("%[(.-)%]")
              break
            end
          end
          local sdk_path = vim.fs.joinpath(base, sdk_version)
          return sdk_path
        end,

If wanted I can create a PR for this change.


Fix 404 when launching 0215 survey.

What is the context of this PR?
Fixes #843
How to review
Re-test the defect

Defect passed QA in Pre-prod


Adding special exception handling around bucket.get_location. Removed…

… redundant sts conn call. Removed conn.close()
It's possible to have an S3 bucket with permissions so messed up that you cannot call bucket.get_location() without throwing an exception.
Unfortunately, security_monkey will skip all other S3 buckets in the given account.  This PR patches the situation so only the bad bucket is ignored by security_monkey.
Future work should focus on displaying buckets with bad permissions up to the web UI.

Seems like a reasonable fix for now. I don't think the hardcoded us-east region in the exception map will be too confusing considering the names are global anyway.


missing accept-header

Hello,
I noticed that the microsoft browser edge does not send an accept-header when doing an OPTIONS-request.
Postman or chrome does send the header { 'Accept': '/' } by default.
I use Slim Framework 4 like this:
$app->add((new Middlewares\ContentType(['html', 'json']))->errorResponse());
ContentType::detectFromHeader will not find a corresponding mime-type without the accept header.
I could add the accept-header before the ContentType-middleware is called when dealing with a OPTIONS-request, like this:
if( $request->getMethod() === 'OPTIONS' && $request->hasHeader('Accept') === false ) {
$request = $request->withHeader('Accept', '/');
}
But is this the way to handle this problem?
thanks for your effort!
Coen

Hi, thanks for bringing this up!
According to the specs (https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html):

If no Accept header field is present, then it is assumed that the client accepts all media types. If an Accept header field is present, and if the server cannot send a response which is acceptable according to the combined Accept field value, then the server SHOULD send a 406 (not acceptable) response.

So I think the good solution is returning the default type if no Accept header is found, and only return an errorResponse if no format has found but the header exists.
What do you think? Do you want to work on a pull request? It can be fixed easily here: https://github.com/middlewares/negotiation/blob/master/src/ContentType.php#L190

yes, that is going to be my first pull request on an other persons project! I shall read the specs and try to make a pr.

There is always a first time for everything 😄
Thanks you!

Version 2.0.1 released. Thanks for your contribution!

Thank you also,
I learned a few things yet again!
Have a nice weekend!
I will keep testing your middlewares ;-)
Gr Coen
Op za 7 mrt. 2020 12:57 schreef Oscar Otero<EMAIL_ADDRESS>
Version 2.0.1 released. Thanks for your contribution!
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/middlewares/negotiation/issues/6?email_source=notifications&email_token=AAM5O2CRPXSJIAXOQNKJL4TRGIZCDA5CNFSM4LCEUTF2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEODXQPA#issuecomment-596080700,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAM5O2CV7MEBVTPJ33CGIZTRGIZCDANCNFSM4LCEUTFQ
.


Add ImageManager interface

In v3 the ImageManager class is now final making it impossible to mock out in tests, and while most other classes in this library have corresponding interfaces enabling mocking this class does not.
This PR adds a new ImageManagerInterface interface with the 4 public instance methods from ImageManager. I've based it off how the Image & ImageInterface pair is set up, so the docblock contents for those methods have also been moved to the interface.
Addresses #1324.

Thank you, I think this can be adopted as is.


Provide initial values for range filter UI

Currently in all range filter UIs always upper and lower limit have to be set.
Allow to only set one limit.

bf64fc5213729673eff19a24f5c694b4419bfe27

Duration filter: Added More than and Less than fields, changed existing field to duration between
StartTime filter: Pre-filled fields with dates "a month ago" (to the minute) and "now", for "from" and "to" selections, respectively


defineComponent props TS error

There is a deficiency in the ts structure on the @oku-ui/primitive, I could not solve it.
The bellow example, I am trying to add props to the component but the the following error

No overload matches this call.
  Overload 1 of 5, '(setup: (props: LabelProps, ctx: { attrs: Data; slots: Readonly<InternalSlots>; emit: (event: string, ...args: any[]) => void; expose: (exposed?: Record<string, any> | undefined) => void; }) => RenderFunction | Promise<...>, options?: (Pick<...> & { ...; }) | undefined): (props: LabelProps & {}) => any', gave the following error.

runtime-core.d.ts(549, 5): The expected type comes from property 'props' which is declared here on type 'ComponentOptionsWithoutProps<LabelProps, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {}, string, {}, string, {}, LabelProps & {}>'

Try this.
  props: {
    test: {
      type: String
    }
  } as never

@johnsoncodehk thank you, with your help this has been resolved automatically.


be more verbose by default

Running the script and am getting no output which scares me a lot:
tt at hops ~/g/p/git.centos.org ~/g/packit-service/dist-git-to-source-git/dist2src.py convert {rpms,source-git}/gnome-settings-daemon:c8s
▌

What's happening? I really need to know!
I literally had to open htop/pstree to see what it's doing:
├─zsh───dist2src.py─┬─get_sources.sh───curl
│                   └─{dist2src.py}

this is now fixed


Can you provide the pretrained model?

It takes a long time (8 days) for me to train from scratch.

It takes about 3 days on my machine (8 GPUS). Something may be blocking your speed when running. good luck! my pretrained model is uploaded: https://drive.google.com/file/d/1BCP-BYuEdxIRT0P5m6y_WmDy_LTykctR/view?usp=sharing

Thanks a lot

@sumai-1998 Some keys need to be replaced :
import torch model = torch.load("sketchsampler.ckpt") for key in list(model['state_dict'].keys()):     if key.startswith("g_Feat."):         model['state_dict'][key.replace("g_Feat.", "sketch_translator.parameter.")] = model['state_dict'][key]         del model['state_dict'][key]     if key.startswith("g_Feat2PC."):         model['state_dict'][key.replace("g_Feat2PC.", "depth_head.")] = model['state_dict'][key]         del model['state_dict'][key]     if key.startswith("g_Entropy."):         model['state_dict'][key.replace("g_Entropy.", "density_head.")] = model['state_dict'][key]         del model['state_dict'][key] torch.save(model, "sketchsampler_new.ckpt")

@sumai-1998 Some keys need to be replaced :
import torch
model = torch.load("sketchsampler.ckpt")
for key in list(model['state_dict'].keys()):
   if key.startswith("g_Feat."):
       model['state_dict'][key.replace("g_Feat.", "sketch_translator.parameter.")] = model['state_dict'][key]
       del model['state_dict'][key]
   if key.startswith("g_Feat2PC."):
       model['state_dict'][key.replace("g_Feat2PC.", "depth_head.")] = model['state_dict'][key]
       del model['state_dict'][key]
   if key.startswith("g_Entropy."):
       model['state_dict'][key.replace("g_Entropy.", "density_head.")] = model['state_dict'][key]
       del model['state_dict'][key]
torch.save(model, "sketchsampler_new.ckpt")

This is helpful, thanks !

Hello, thanks for your help! But when I try to load the "sketchsamper_new.ckpt" use code  model.load_from_checkpoint("sketchsampler_new.ckpt")
It shows
Traceback (most recent call last):
File "src/trainval.py", line 139, in main
run(cfg)
File "src/trainval.py", line 125, in run
model.load_from_checkpoint("sketchsampler_new.ckpt")
File "/data/anaconda3/envs/implicit/lib/python3.7/site-packages/pytorch_lightning/core/saving.py", line 156, in load_from_checkpoint
model = cls._load_model_state(checkpoint, strict=strict, kwargs)
File "/data/anaconda3/envs/implicit/lib/python3.7/site-packages/pytorch_lightning/core/saving.py", line 198, in _load_model_state
model = cls(_cls_kwargs)
File "/data/ssd/00_direction_induced/sketchsampler/src/model/sketchsampler.py", line 154, in init
self.n_points = self.cfg.train.n_points
omegaconf.errors.ConfigAttributeError: Key 'n_points' is not in struct
full_key: train.n_points
reference_type=Optional[Dict[Union[str, Enum], Any]]
object_type=dict
It seems that the keys still do not match. Really appreciate it if you can give some suggestions about it. Thanks in advanced!

Hello, thanks for your help! But when I try to load the "sketchsamper_new.ckpt" use code model.load_from_checkpoint("sketchsampler_new.ckpt") It shows
Traceback (most recent call last): File "src/trainval.py", line 139, in main run(cfg) File "src/trainval.py", line 125, in run model.load_from_checkpoint("sketchsampler_new.ckpt") File "/data/anaconda3/envs/implicit/lib/python3.7/site-packages/pytorch_lightning/core/saving.py", line 156, in load_from_checkpoint model = cls._load_model_state(checkpoint, strict=strict, kwargs) File "/data/anaconda3/envs/implicit/lib/python3.7/site-packages/pytorch_lightning/core/saving.py", line 198, in _load_model_state model = cls(_cls_kwargs) File "/data/ssd/00_direction_induced/sketchsampler/src/model/sketchsampler.py", line 154, in init self.n_points = self.cfg.train.n_points omegaconf.errors.ConfigAttributeError: Key 'n_points' is not in struct full_key: train.n_points reference_type=Optional[Dict[Union[str, Enum], Any]] object_type=dict
It seems that the keys still do not match. Really appreciate it if you can give some suggestions about it. Thanks in advanced!

I have tested this code:

# Instantiate model
    hydra.utils.log.info(f"Instantiating <{cfg.model._target_}>")
    modelcls = hydra.utils.get_class(cfg.model._target_)
    checkpoint_path = cfg.train.ckpt
    model = modelcls.load_from_checkpoint(checkpoint_path=checkpoint_path, cfg=cfg, strict=False)
    model.freeze()

This code should work.

Hi, thanks for your response. This code does help to load the pre-trained model, but when it runs into trainer.test(), there comes other bugs as follows. Do you meet the similar problem? Thanks again for the quick reply.
Set the environment variable HYDRA_FULL_ERROR=1 for a complete stack trace.
Traceback (most recent call last):
File "/data/ssd/jingyu/00_direction_induced/moreresults/sketchsampler/src/trainval.py", line 143, in main
run(cfg)
File "/data/ssd/jingyu/00_direction_induced/moreresults/sketchsampler/src/trainval.py", line 132, in run
trainer.test(model=model, datamodule=datamodule)
File "/data/anaconda3/envs/implicit/lib/python3.7/site-packages/pytorch_lightning/trainer/trainer.py", line 923, in test
results = self.__test_given_model(model, test_dataloaders)
File "/data/anaconda3/envs/implicit/lib/python3.7/site-packages/pytorch_lightning/trainer/trainer.py", line 981, in __test_given_model
results = self.fit(model)
File "/data/anaconda3/envs/implicit/lib/python3.7/site-packages/pytorch_lightning/trainer/trainer.py", line 511, in fit
self.pre_dispatch()
File "/data/anaconda3/envs/implicit/lib/python3.7/site-packages/pytorch_lightning/trainer/trainer.py", line 540, in pre_dispatch
self.accelerator.pre_dispatch()
File "/data/anaconda3/envs/implicit/lib/python3.7/site-packages/pytorch_lightning/accelerators/accelerator.py", line 84, in pre_dispatch
self.training_type_plugin.pre_dispatch()
File "/data/anaconda3/envs/implicit/lib/python3.7/site-packages/pytorch_lightning/plugins/training_type/ddp.py", line 256, in pre_dispatch
self.configure_ddp()
File "/data/anaconda3/envs/implicit/lib/python3.7/site-packages/pytorch_lightning/plugins/training_type/ddp.py", line 200, in configure_ddp
**self._ddp_kwargs,
File "/data/anaconda3/envs/implicit/lib/python3.7/site-packages/torch/nn/parallel/distributed.py", line 479, in init
"DistributedDataParallel is not needed when a module "
File "/data/anaconda3/envs/implicit/lib/python3.7/site-packages/torch/nn/parallel/distributed.py", line 604, in _log_and_throw
raise err_type(err_msg)
RuntimeError: DistributedDataParallel is not needed when a module doesn't have any parameter that requires a gradient.
Set the environment variable HYDRA_FULL_ERROR=1 for a complete stack trace.

I try to comment out the DDP line in the configuration yaml, but there is additional errors as follows.
[2023-04-12 11:20:29,183][hydra.utils][INFO] - Instantiating the Trainer
/data/hjy/anaconda3/envs/implicit/lib/python3.7/site-packages/pytorch_lightning/utilities/distributed.py:50: UserWarning: You requested multiple GPUs but did not specify a backend, e.g. Trainer(accelerator="dp"|"ddp"|"ddp2"). Setting accelerator="ddp_spawn" for you.
warnings.warn(*args, **kwargs)
GPU available: True, used: True
[2023-04-12 11:20:29,191][lightning][INFO] - GPU available: True, used: True
TPU available: None, using: 0 TPU cores
[2023-04-12 11:20:29,191][lightning][INFO] - TPU available: None, using: 0 TPU cores
[2023-04-12 11:20:29,193][hydra.utils][INFO] - Starting testing!
[2023-04-12 11:20:30,178][pytorch_lightning.accelerators.gpu][INFO] - LOCAL_RANK: 0 - CUDA_VISIBLE_DEVICES: [0,1,2,3,4,5,6,7]
Traceback (most recent call last):
File "src/trainval.py", line 149, in main
run(cfg)
File "src/trainval.py", line 138, in run
trainer.test(model=model, datamodule=datamodule)
File "/data/hjy/anaconda3/envs/implicit/lib/python3.7/site-packages/pytorch_lightning/trainer/trainer.py", line 923, in test
results = self.__test_given_model(model, test_dataloaders)
File "/data/hjy/anaconda3/envs/implicit/lib/python3.7/site-packages/pytorch_lightning/trainer/trainer.py", line 981, in __test_given_model
results = self.fit(model)
File "/data/hjy/anaconda3/envs/implicit/lib/python3.7/site-packages/pytorch_lightning/trainer/trainer.py", line 514, in fit
self.dispatch()
File "/data/hjy/anaconda3/envs/implicit/lib/python3.7/site-packages/pytorch_lightning/trainer/trainer.py", line 548, in dispatch
self.accelerator.start_testing(self)
File "/data/hjy/anaconda3/envs/implicit/lib/python3.7/site-packages/pytorch_lightning/accelerators/accelerator.py", line 77, in start_testing
self.training_type_plugin.start_testing(trainer)
File "/data/hjy/anaconda3/envs/implicit/lib/python3.7/site-packages/pytorch_lightning/plugins/training_type/ddp_spawn.py", line 111, in start_testing
mp.spawn(self.new_process, **self.mp_spawn_kwargs)
File "/data/hjy/anaconda3/envs/implicit/lib/python3.7/site-packages/torch/multiprocessing/spawn.py", line 230, in spawn
return start_processes(fn, args, nprocs, join, daemon, start_method='spawn')
File "/data/hjy/anaconda3/envs/implicit/lib/python3.7/site-packages/torch/multiprocessing/spawn.py", line 179, in start_processes
process.start()
File "/data/hjy/anaconda3/envs/implicit/lib/python3.7/multiprocessing/process.py", line 112, in start
self._popen = self._Popen(self)
File "/data/hjy/anaconda3/envs/implicit/lib/python3.7/multiprocessing/context.py", line 284, in _Popen
return Popen(process_obj)
File "/data/hjy/anaconda3/envs/implicit/lib/python3.7/multiprocessing/popen_spawn_posix.py", line 32, in init
super().init(process_obj)
File "/data/hjy/anaconda3/envs/implicit/lib/python3.7/multiprocessing/popen_fork.py", line 20, in init
self._launch(process_obj)
File "/data/hjy/anaconda3/envs/implicit/lib/python3.7/multiprocessing/popen_spawn_posix.py", line 47, in _launch
reduction.dump(process_obj, fp)
File "/data/hjy/anaconda3/envs/implicit/lib/python3.7/multiprocessing/reduction.py", line 60, in dump
ForkingPickler(file, protocol).dump(obj)
AttributeError: Can't pickle local object 'TorchHistory.add_log_hooks_to_pytorch_module..'
Set the environment variable HYDRA_FULL_ERROR=1 for a complete stack trace.

You requested multiple GPUs but did not specify a backend

@hujingyucd assign single gpu id?

Hi,
Thanks for your suggestions. I can get the results by running your pre-trained model. However, I find that the predicted point cloud are not aligned.

Is there any method to align these predicted point cloud? Thanks again for your help!

@hujingyucd what is the chamfer distance in your results?

Hi, Thanks for your suggestions. I can get the results by running your pre-trained model. However, I find that the predicted point cloud are not aligned.

Is there any method to align these predicted point cloud? Thanks again for your help!

@hujingyucd What does "align" mean, between what?

Can you give more explanations (some example code if possible) on how to achieve this if possible? Since I am not sure about the details, I am afraid I cannot achieve it correctly.

Can you give more explanations (some example code if possible) on how to achieve this if possible? Since I am not sure about the details, I am afraid I cannot achieve it correctly.

@hujingyucd a possible version using numpy:

        # camera coordinate to world corrdinate
        cam_mat, cam_pos = pickle.load(open(camera_path, 'rb'))
        ours_pt = np.dot(ours_pt, cam_mat)

        # normalize aabb
        bbox_ours = np.concatenate([np.min(ours_pt, axis=0, keepdims=True), np.max(ours_pt, axis=0, keepdims=True)], axis=0)
        loc_ours = (bbox_ours[0] + bbox_ours[1]) / 2
        scale_ours = (bbox_ours[1] - bbox_ours[0]).max()

        # Transform input mesh
        ours_pt -= loc_ours
        ours_pt /= scale_ours

Got it! Really appreciate your help!
There is just one more question about evaluation. I noticed that you compare your work with Sketch2mesh in all categories. However, it only released its pre-trained model for car and chair and do not released training code. Did you re-implement its code to get its inference results?

Got it! Really appreciate your help! There is just one more question about evaluation. I noticed that you compare your work with Sketch2mesh in all categories. However, it only released its pre-trained model for car and chair and do not released training code. Did you re-implement its code to get its inference results?

@hujingyucd We retrained their model using their official code on our dataset, and you can refer to the links https://github.com/cvlab-epfl/MeshSDF and https://github.com/cvlab-epfl/sketch2mesh

Thanks for your help!

Hello, can you share the code you generated using a pre trained model thanks！