add vault_update_policy_type parameter

When changing the loadbalancer from external to internal the instance were not recreated and vault was unreachable
Add vault_update_policy_type parameter for the instance group so the type can be chanched to PROACTIVE as needed
Default value of the parameter is OPPORTUNISTIC to not change the default behavoir altought a PROACTIVE approach is problably better.

Thanks for the PR! 🚀
Unfortunately it looks like some of our CI checks failed. See the Contributing Guide for details.

⚠check_documentation
The documentation needs to be regenerated. Please run make generate_docs.

Checking for documentation generation
diff -r '--exclude=.terraform' '--exclude=.kitchen' '--exclude=.git' '--exclude=autogen' '--exclude=*.tfvars' /workspace/README.md /tmp/tmp.V2lauSaCA0/generate_docs/workspace/README.md
174,231c174,231
< |------|-------------|------|---------|:--------:|
< | allow\_public\_egress | Whether to create a NAT for external egress. If false, you must also specify an `http_proxy` to download required executables including Vault, Fluentd and Stackdriver | `bool` | `true` | no |
< | allow\_ssh | Allow external access to ssh port 22 on the Vault VMs. It is a best practice to set this to false, however it is true by default for the sake of backwards compatibility. | `bool` | `true` | no |
< | domain | The domain name that will be set in the api\_addr. Load Balancer IP used by default | `string` | `""` | no |
< | http\_proxy | HTTP proxy for downloading agents and vault executable on startup. Only necessary if allow\_public\_egress is false. This is only used on the first startup of the Vault cluster and will NOT set the global HTTP\_PROXY environment variable. i.e. If you configure Vault to manage credentials for other services, default HTTP routes will be taken. | `string` | `""` | no |
< | kms\_crypto\_key | The name of the Cloud KMS Key used for encrypting initial TLS certificates and for configuring Vault auto-unseal. Terraform will create this key. | `string` | `"vault-init"` | no |
< | kms\_keyring | Name of the Cloud KMS KeyRing for asset encryption. Terraform will create this keyring. | `string` | `"vault"` | no |
< | kms\_protection\_level | The protection level to use for the KMS crypto key. | `string` | `"software"` | no |
< | load\_balancing\_scheme | Options are INTERNAL or EXTERNAL. If `EXTERNAL`, the forwarding rule will be of type EXTERNAL and a public IP will be created. If `INTERNAL` the type will be INTERNAL and a random RFC 1918 private IP will be assigned | `string` | `"EXTERNAL"` | no |
< | manage\_tls | Set to `false` if you'd like to manage and upload your own TLS files. See `Managing TLS` for more details | `bool` | `true` | no |
< | network | The self link of the VPC network for Vault. By default, one will be created for you. | `string` | `""` | no |
< | network\_subnet\_cidr\_range | CIDR block range for the subnet. | `string` | `"<IP_ADDRESS>/20"` | no |
< | project\_id | ID of the project in which to create resources and add IAM bindings. | `string` | n/a | yes |
< | project\_services | List of services to enable on the project where Vault will run. These services are required in order for this Vault setup to function. | `list(string)` |
[
  "cloudkms.googleapis.com",
  "cloudresourcemanager.googleapis.com",
  "compute.googleapis.com",
  "iam.googleapis.com",
  "logging.googleapis.com",
  "monitoring.googleapis.com"
]
 | no |
< | region | Region in which to create resources. | `string` | `"us-east4"` | no |
< | service\_account\_name | Name of the Vault service account. | `string` | `"vault-admin"` | no |
< | service\_account\_project\_additional\_iam\_roles | List of custom IAM roles to add to the project. | `list(string)` | `[]` | no |
< | service\_account\_project\_iam\_roles | List of IAM roles for the Vault admin service account to function. If you need to add additional roles, update `service_account_project_additional_iam_roles` instead. | `list(string)` |
[
  "roles/logging.logWriter",
  "roles/monitoring.metricWriter",
  "roles/monitoring.viewer"
]
 | no |
< | service\_account\_storage\_bucket\_iam\_roles | List of IAM roles for the Vault admin service account to have on the storage bucket. | `list(string)` |
[
  "roles/storage.legacyBucketReader",
  "roles/storage.objectAdmin"
]
 | no |
< | service\_label | The service label to set on the internal load balancer. If not empty, this enables internal DNS for internal load balancers. By default, the service label is disabled. This has no effect on external load balancers. | `string` | `null` | no |
< | ssh\_allowed\_cidrs | List of CIDR blocks to allow access to SSH into nodes. | `list(string)` |
[
  "<IP_ADDRESS>/0"
]
 | no |
< | storage\_bucket\_class | Type of data storage to use. If you change this value, you will also need to choose a storage\_bucket\_location which matches this parameter type | `string` | `"MULTI_REGIONAL"` | no |
< | storage\_bucket\_enable\_versioning | Set to true to enable object versioning in the GCS bucket.. You may want to define lifecycle rules if you want a finite number of old versions. | `string` | `false` | no |
< | storage\_bucket\_force\_destroy | Set to true to force deletion of backend bucket on `terraform destroy` | `string` | `false` | no |
< | storage\_bucket\_lifecycle\_rules | Vault storage lifecycle rules |
list(object({
    action = map(object({
      type          = string,
      storage_class = string
    })),
    condition = map(object({
      age                   = number,
      created_before        = string,
      with_state            = string,
      is_live               = string,
      matches_storage_class = string,
      num_newer_versions    = number
    }))
  }))
 | `[]` | no |
< | storage\_bucket\_location | Location for the Google Cloud Storage bucket in which Vault data will be stored. | `string` | `"us"` | no |
< | storage\_bucket\_name | Name of the Google Cloud Storage bucket for the Vault backend storage. This must be globally unique across of of GCP. If left as the empty string, this will default to: '<project-id>-vault-data'. | `string` | `""` | no |
< | subnet | The self link of the VPC subnetwork for Vault. By default, one will be created for you. | `string` | `""` | no |
< | tls\_ca\_subject | The `subject` block for the root CA certificate. |
object({
    common_name         = string,
    organization        = string,
    organizational_unit = string,
    street_address      = list(string),
    locality            = string,
    province            = string,
    country             = string,
    postal_code         = string,
  })
 |
{
  "common_name": "Example Inc. Root",
  "country": "US",
  "locality": "The Intranet",
  "organization": "Example, Inc",
  "organizational_unit": "Department of Certificate Authority",
  "postal_code": "95559-1227",
  "province": "CA",
  "street_address": [
    "123 Example Street"
  ]
}
 | no |
< | tls\_cn | The TLS Common Name for the TLS certificates | `string` | `"vault.example.net"` | no |
< | tls\_dns\_names | List of DNS names added to the Vault server self-signed certificate | `list(string)` |
[
  "vault.example.net"
]
 | no |
< | tls\_ips | List of IP addresses added to the Vault server self-signed certificate | `list(string)` |
[
  "<IP_ADDRESS>"
]
 | no |
< | tls\_ou | The TLS Organizational Unit for the TLS certificate | `string` | `"IT Security Operations"` | no |
< | tls\_save\_ca\_to\_disk | Save the CA public certificate on the local filesystem. The CA is always stored in GCS, but this option also saves it to the filesystem. | `bool` | `true` | no |
< | user\_startup\_script | Additional user-provided code injected after Vault is setup | `string` | `""` | no |
< | vault\_allowed\_cidrs | List of CIDR blocks to allow access to the Vault nodes. Since the load balancer is a pass-through load balancer, this must also include all IPs from which you will access Vault. The default is unrestricted (any IP address can access Vault). It is recommended that you reduce this to a smaller list. | `list(string)` |
[
  "<IP_ADDRESS>/0"
]
 | no |
< | vault\_args | Additional command line arguments passed to Vault server | `string` | `""` | no |
< | vault\_ca\_cert\_filename | GCS object path within the vault\_tls\_bucket. This is the root CA certificate. | `string` | `"ca.crt"` | no |
< | vault\_instance\_base\_image | Base operating system image in which to install Vault. This must be a Debian-based system at the moment due to how the metadata startup script runs. | `string` | `"debian-cloud/debian-10"` | no |
< | vault\_instance\_labels | Labels to apply to the Vault instances. | `map(string)` | `{}` | no |
< | vault\_instance\_metadata | Additional metadata to add to the Vault instances. | `map(string)` | `{}` | no |
< | vault\_instance\_tags | Additional tags to apply to the instances. Note 'allow-ssh' and 'allow-vault' will be present on all instances. | `list(string)` | `[]` | no |
< | vault\_log\_level | Log level to run Vault in. See the Vault documentation for valid values. | `string` | `"warn"` | no |
< | vault\_machine\_type | Machine type to use for Vault instances. | `string` | `"e2-standard-2"` | no |
< | vault\_max\_num\_servers | Maximum number of Vault server nodes to run at one time. The group will not autoscale beyond this number. | `string` | `"7"` | no |
< | vault\_min\_num\_servers | Minimum number of Vault server nodes in the autoscaling group. The group will not have less than this number of nodes. | `string` | `"1"` | no |
< | vault\_port | Numeric port on which to run and expose Vault. | `string` | `"8200"` | no |
< | vault\_proxy\_port | Port to expose Vault's health status endpoint on over HTTP on /. This is required for the health checks to verify Vault's status is using an external load balancer. Only the health status endpoint is exposed, and it is only accessible from Google's load balancer addresses. | `string` | `"58200"` | no |
< | vault\_tls\_bucket | GCS Bucket override where Vault will expect TLS certificates are stored. | `string` | `""` | no |
< | vault\_tls\_cert\_filename | GCS object path within the vault\_tls\_bucket. This is the vault server certificate. | `string` | `"vault.crt"` | no |
< | vault\_tls\_disable\_client\_certs | Use client certificates when provided. You may want to disable this if users will not be authenticating to Vault with client certificates. | `string` | `false` | no |
< | vault\_tls\_key\_filename | Encrypted and base64 encoded GCS object path within the vault\_tls\_bucket. This is the Vault TLS private key. | `string` | `"vault.key.enc"` | no |
< | vault\_tls\_kms\_key | Fully qualified name of the KMS key, for example, vault\_tls\_kms\_key = "projects/PROJECT\_ID/locations/LOCATION/keyRings/KEYRING/cryptoKeys/KEY\_NAME". This key should have been used to encrypt the TLS private key if Terraform is not managing TLS. The Vault service account will be granted access to the KMS Decrypter role once it is created so it can pull from this the `vault_tls_bucket` at boot time. This option is required when `manage_tls` is set to false. | `string` | `""` | no |
< | vault\_tls\_kms\_key\_project | Project ID where the KMS key is stored. By default, same as `project_id` | `string` | `""` | no |
< | vault\_tls\_require\_and\_verify\_client\_cert | Always use client certificates. You may want to disable this if users will not be authenticating to Vault with client certificates. | `string` | `false` | no |
< | vault\_ui\_enabled | Controls whether the Vault UI is enabled and accessible. | `string` | `true` | no |
< | vault\_update\_policy\_type | Options are OPPORTUNISTIC or PROACTIVE. If `PROACTIVE`, the instance group manager proactively executes actions in order to bring instances to their target versions | `string` | `"OPPORTUNISTIC"` | no |
< | vault\_version | Version of vault to install. This version must be 1.0+ and must be published on the HashiCorp releases service. | `string` | `"1.6.0"` | no |
---
> |------|-------------|:----:|:-----:|:-----:|
> | allow\_public\_egress | Whether to create a NAT for external egress. If false, you must also specify an `http_proxy` to download required executables including Vault, Fluentd and Stackdriver | bool | `"true"` | no |
> | allow\_ssh | Allow external access to ssh port 22 on the Vault VMs. It is a best practice to set this to false, however it is true by default for the sake of backwards compatibility. | bool | `"true"` | no |
> | domain | The domain name that will be set in the api_addr. Load Balancer IP used by default | string | `""` | no |
> | http\_proxy | HTTP proxy for downloading agents and vault executable on startup. Only necessary if allow_public_egress is false. This is only used on the first startup of the Vault cluster and will NOT set the global HTTP_PROXY environment variable. i.e. If you configure Vault to manage credentials for other services, default HTTP routes will be taken. | string | `""` | no |
> | kms\_crypto\_key | The name of the Cloud KMS Key used for encrypting initial TLS certificates and for configuring Vault auto-unseal. Terraform will create this key. | string | `"vault-init"` | no |
> | kms\_keyring | Name of the Cloud KMS KeyRing for asset encryption. Terraform will create this keyring. | string | `"vault"` | no |
> | kms\_protection\_level | The protection level to use for the KMS crypto key. | string | `"software"` | no |
> | load\_balancing\_scheme | Options are INTERNAL or EXTERNAL. If `EXTERNAL`, the forwarding rule will be of type EXTERNAL and a public IP will be created. If `INTERNAL` the type will be INTERNAL and a random RFC 1918 private IP will be assigned | string | `"EXTERNAL"` | no |
> | manage\_tls | Set to `false` if you'd like to manage and upload your own TLS files. See `Managing TLS` for more details | bool | `"true"` | no |
> | network | The self link of the VPC network for Vault. By default, one will be created for you. | string | `""` | no |
> | network\_subnet\_cidr\_range | CIDR block range for the subnet. | string | `"<IP_ADDRESS>/20"` | no |
> | project\_id | ID of the project in which to create resources and add IAM bindings. | string | n/a | yes |
> | project\_services | List of services to enable on the project where Vault will run. These services are required in order for this Vault setup to function. | list(string) | `<list>` | no |
> | region | Region in which to create resources. | string | `"us-east4"` | no |
> | service\_account\_name | Name of the Vault service account. | string | `"vault-admin"` | no |
> | service\_account\_project\_additional\_iam\_roles | List of custom IAM roles to add to the project. | list(string) | `<list>` | no |
> | service\_account\_project\_iam\_roles | List of IAM roles for the Vault admin service account to function. If you need to add additional roles, update `service_account_project_additional_iam_roles` instead. | list(string) | `<list>` | no |
> | service\_account\_storage\_bucket\_iam\_roles | List of IAM roles for the Vault admin service account to have on the storage bucket. | list(string) | `<list>` | no |
> | service\_label | The service label to set on the internal load balancer. If not empty, this enables internal DNS for internal load balancers. By default, the service label is disabled. This has no effect on external load balancers. | string | `"null"` | no |
> | ssh\_allowed\_cidrs | List of CIDR blocks to allow access to SSH into nodes. | list(string) | `<list>` | no |
> | storage\_bucket\_class | Type of data storage to use. If you change this value, you will also need to choose a storage_bucket_location which matches this parameter type | string | `"MULTI_REGIONAL"` | no |
> | storage\_bucket\_enable\_versioning | Set to true to enable object versioning in the GCS bucket.. You may want to define lifecycle rules if you want a finite number of old versions. | string | `"false"` | no |
> | storage\_bucket\_force\_destroy | Set to true to force deletion of backend bucket on `terraform destroy` | string | `"false"` | no |
> | storage\_bucket\_lifecycle\_rules | Vault storage lifecycle rules | object | `<list>` | no |
> | storage\_bucket\_location | Location for the Google Cloud Storage bucket in which Vault data will be stored. | string | `"us"` | no |
> | storage\_bucket\_name | Name of the Google Cloud Storage bucket for the Vault backend storage. This must be globally unique across of of GCP. If left as the empty string, this will default to: '<project-id>-vault-data'. | string | `""` | no |
> | subnet | The self link of the VPC subnetwork for Vault. By default, one will be created for you. | string | `""` | no |
> | tls\_ca\_subject | The `subject` block for the root CA certificate. | object | `<map>` | no |
> | tls\_cn | The TLS Common Name for the TLS certificates | string | `"vault.example.net"` | no |
> | tls\_dns\_names | List of DNS names added to the Vault server self-signed certificate | list(string) | `<list>` | no |
> | tls\_ips | List of IP addresses added to the Vault server self-signed certificate | list(string) | `<list>` | no |
> | tls\_ou | The TLS Organizational Unit for the TLS certificate | string | `"IT Security Operations"` | no |
> | tls\_save\_ca\_to\_disk | Save the CA public certificate on the local filesystem. The CA is always stored in GCS, but this option also saves it to the filesystem. | bool | `"true"` | no |
> | user\_startup\_script | Additional user-provided code injected after Vault is setup | string | `""` | no |
> | vault\_allowed\_cidrs | List of CIDR blocks to allow access to the Vault nodes. Since the load balancer is a pass-through load balancer, this must also include all IPs from which you will access Vault. The default is unrestricted (any IP address can access Vault). It is recommended that you reduce this to a smaller list. | list(string) | `<list>` | no |
> | vault\_args | Additional command line arguments passed to Vault server | string | `""` | no |
> | vault\_ca\_cert\_filename | GCS object path within the vault_tls_bucket. This is the root CA certificate. | string | `"ca.crt"` | no |
> | vault\_instance\_base\_image | Base operating system image in which to install Vault. This must be a Debian-based system at the moment due to how the metadata startup script runs. | string | `"debian-cloud/debian-10"` | no |
> | vault\_instance\_labels | Labels to apply to the Vault instances. | map(string) | `<map>` | no |
> | vault\_instance\_metadata | Additional metadata to add to the Vault instances. | map(string) | `<map>` | no |
> | vault\_instance\_tags | Additional tags to apply to the instances. Note 'allow-ssh' and 'allow-vault' will be present on all instances. | list(string) | `<list>` | no |
> | vault\_log\_level | Log level to run Vault in. See the Vault documentation for valid values. | string | `"warn"` | no |
> | vault\_machine\_type | Machine type to use for Vault instances. | string | `"e2-standard-2"` | no |
> | vault\_max\_num\_servers | Maximum number of Vault server nodes to run at one time. The group will not autoscale beyond this number. | string | `"7"` | no |
> | vault\_min\_num\_servers | Minimum number of Vault server nodes in the autoscaling group. The group will not have less than this number of nodes. | string | `"1"` | no |
> | vault\_port | Numeric port on which to run and expose Vault. | string | `"8200"` | no |
> | vault\_proxy\_port | Port to expose Vault's health status endpoint on over HTTP on /. This is required for the health checks to verify Vault's status is using an external load balancer. Only the health status endpoint is exposed, and it is only accessible from Google's load balancer addresses. | string | `"58200"` | no |
> | vault\_tls\_bucket | GCS Bucket override where Vault will expect TLS certificates are stored. | string | `""` | no |
> | vault\_tls\_cert\_filename | GCS object path within the vault_tls_bucket. This is the vault server certificate. | string | `"vault.crt"` | no |
> | vault\_tls\_disable\_client\_certs | Use client certificates when provided. You may want to disable this if users will not be authenticating to Vault with client certificates. | string | `"false"` | no |
> | vault\_tls\_key\_filename | Encrypted and base64 encoded GCS object path within the vault_tls_bucket. This is the Vault TLS private key. | string | `"vault.key.enc"` | no |
> | vault\_tls\_kms\_key | Fully qualified name of the KMS key, for example, vault_tls_kms_key = "projects/PROJECT_ID/locations/LOCATION/keyRings/KEYRING/cryptoKeys/KEY_NAME". This key should have been used to encrypt the TLS private key if Terraform is not managing TLS. The Vault service account will be granted access to the KMS Decrypter role once it is created so it can pull from this the `vault_tls_bucket` at boot time. This option is required when `manage_tls` is set to false. | string | `""` | no |
> | vault\_tls\_kms\_key\_project | Project ID where the KMS key is stored. By default, same as `project_id` | string | `""` | no |
> | vault\_tls\_require\_and\_verify\_client\_cert | Always use client certificates. You may want to disable this if users will not be authenticating to Vault with client certificates. | string | `"false"` | no |
> | vault\_ui\_enabled | Controls whether the Vault UI is enabled and accessible. | string | `"true"` | no |
> | vault\_update\_policy\_type | Options are OPPORTUNISTIC or PROACTIVE. If `PROACTIVE`, the instance group manager proactively executes actions in order to bring instances to their target versions | string | `"OPPORTUNISTIC"` | no |
> | vault\_version | Version of vault to install. This version must be 1.0+ and must be published on the HashiCorp releases service. | string | `"1.6.0"` | no |
240c240
< | vault\_addr | Full protocol, address, and port (FQDN) pointing to the Vault load balancer.This is a drop-in to VAULT\_ADDR: `export VAULT_ADDR="$(terraform output vault_addr)"`. And then continue to use Vault commands as usual. |
---
> | vault\_addr | Full protocol, address, and port (FQDN) pointing to the Vault load balancer.This is a drop-in to VAULT_ADDR: `export VAULT_ADDR="$(terraform output vault_addr)"`. And then continue to use Vault commands as usual. |
diff -r '--exclude=.terraform' '--exclude=.kitchen' '--exclude=.git' '--exclude=autogen' '--exclude=*.tfvars' /workspace/examples/vault-on-gce/README.md /tmp/tmp.V2lauSaCA0/generate_docs/workspace/examples/vault-on-gce/README.md
190,197c190,197
< |------|-------------|------|---------|:--------:|
< | allow\_public\_egress | Whether to create a NAT for external egress. If false, you must also specify an http\_proxy to download required executables including Vault, Fluentd and Stackdriver | `bool` | `true` | no |
< | kms\_crypto\_key | Name of the GCP KMS crypto key | `string` | `"vault-init"` | no |
< | kms\_keyring | Name of the GCP KMS keyring | `string` | `"vault"` | no |
< | kms\_location | Location for the KMS keyring | `string` | `"us-east4"` | no |
< | load\_balancing\_scheme | e.g. [INTERNAL\|EXTERNAL]. Scheme of the load balancer | `string` | `"EXTERNAL"` | no |
< | project\_id | Project ID in which to deploy | `string` | n/a | yes |
< | region | Region in which to deploy | `string` | `"us-east4"` | no |
---
> |------|-------------|:----:|:-----:|:-----:|
> | allow\_public\_egress | Whether to create a NAT for external egress. If false, you must also specify an http_proxy to download required executables including Vault, Fluentd and Stackdriver | bool | `"true"` | no |
> | kms\_crypto\_key | Name of the GCP KMS crypto key | string | `"vault-init"` | no |
> | kms\_keyring | Name of the GCP KMS keyring | string | `"vault"` | no |
> | kms\_location | Location for the KMS keyring | string | `"us-east4"` | no |
> | load\_balancing\_scheme | e.g. [INTERNAL|EXTERNAL]. Scheme of the load balancer | string | `"EXTERNAL"` | no |
> | project\_id | Project ID in which to deploy | string | n/a | yes |
> | region | Region in which to deploy | string | `"us-east4"` | no |
203c203
< | vault\_addr | n/a |
---
> | vault\_addr |  |
diff -r '--exclude=.terraform' '--exclude=.kitchen' '--exclude=.git' '--exclude=autogen' '--exclude=*.tfvars' /workspace/modules/cluster/README.md /tmp/tmp.V2lauSaCA0/generate_docs/workspace/modules/cluster/README.md
33,83c33,83
< |------|-------------|------|---------|:--------:|
< | domain | The domain name that will be set in the api\_addr. Load Balancer IP used by default | `string` | `""` | no |
< | hc\_initial\_delay\_secs | The number of seconds that the managed instance group waits before it applies autohealing policies to new instances or recently recreated instances. | `number` | `60` | no |
< | host\_project\_id | ID of the host project if using Shared VPC | `string` | `""` | no |
< | http\_proxy | HTTP proxy for downloading agents and vault executable on startup. Only necessary if allow\_public\_egress is false. This is only used on the first startup of the Vault cluster and will NOT set the global HTTP\_PROXY environment variable. i.e. If you configure Vault to manage credentials for other services, default HTTP routes will be taken. | `string` | `""` | no |
< | ip\_address | The IP address to assign the forwarding rules to. | `string` | n/a | yes |
< | kms\_crypto\_key | The name of the Cloud KMS Key used for encrypting initial TLS certificates and for configuring Vault auto-unseal. Terraform will create this key. | `string` | `"vault-init"` | no |
< | kms\_keyring | Name of the Cloud KMS KeyRing for asset encryption. Terraform will create this keyring. | `string` | `"vault"` | no |
< | kms\_protection\_level | The protection level to use for the KMS crypto key. | `string` | `"software"` | no |
< | load\_balancing\_scheme | Options are INTERNAL or EXTERNAL. If `EXTERNAL`, the forwarding rule will be of type EXTERNAL and a public IP will be created. If `INTERNAL` the type will be INTERNAL and a random RFC 1918 private IP will be assigned | `string` | `"EXTERNAL"` | no |
< | manage\_tls | Set to `false` if you'd like to manage and upload your own TLS files. See `Managing TLS` for more details | `bool` | `true` | no |
< | min\_ready\_sec | Minimum number of seconds to wait before considering a new or restarted instance as updated. This value must be from range. [0,3600] | `number` | `0` | no |
< | project\_id | ID of the project in which to create resources and add IAM bindings. | `string` | n/a | yes |
< | region | Region in which to create resources. | `string` | `"us-east4"` | no |
< | service\_account\_project\_additional\_iam\_roles | List of custom IAM roles to add to the project. | `list(string)` | `[]` | no |
< | service\_account\_project\_iam\_roles | List of IAM roles for the Vault admin service account to function. If you need to add additional roles, update `service_account_project_additional_iam_roles` instead. | `list(string)` |
[
  "roles/logging.logWriter",
  "roles/monitoring.metricWriter",
  "roles/monitoring.viewer"
]
 | no |
< | service\_account\_storage\_bucket\_iam\_roles | List of IAM roles for the Vault admin service account to have on the storage bucket. | `list(string)` |
[
  "roles/storage.legacyBucketReader",
  "roles/storage.objectAdmin"
]
 | no |
< | service\_label | The service label to set on the internal load balancer. If not empty, this enables internal DNS for internal load balancers. By default, the service label is disabled. This has no effect on external load balancers. | `string` | `null` | no |
< | subnet | The self link of the VPC subnetwork for Vault. By default, one will be created for you. | `string` | n/a | yes |
< | tls\_ca\_subject | The `subject` block for the root CA certificate. |
object({
    common_name         = string,
    organization        = string,
    organizational_unit = string,
    street_address      = list(string),
    locality            = string,
    province            = string,
    country             = string,
    postal_code         = string,
  })
 |
{
  "common_name": "Example Inc. Root",
  "country": "US",
  "locality": "The Intranet",
  "organization": "Example, Inc",
  "organizational_unit": "Department of Certificate Authority",
  "postal_code": "95559-1227",
  "province": "CA",
  "street_address": [
    "123 Example Street"
  ]
}
 | no |
< | tls\_cn | The TLS Common Name for the TLS certificates | `string` | `"vault.example.net"` | no |
< | tls\_dns\_names | List of DNS names added to the Vault server self-signed certificate | `list(string)` |
[
  "vault.example.net"
]
 | no |
< | tls\_ips | List of IP addresses added to the Vault server self-signed certificate | `list(string)` |
[
  "<IP_ADDRESS>"
]
 | no |
< | tls\_ou | The TLS Organizational Unit for the TLS certificate | `string` | `"IT Security Operations"` | no |
< | tls\_save\_ca\_to\_disk | Save the CA public certificate on the local filesystem. The CA is always stored in GCS, but this option also saves it to the filesystem. | `bool` | `true` | no |
< | user\_startup\_script | Additional user-provided code injected after Vault is setup | `string` | `""` | no |
< | vault\_args | Additional command line arguments passed to Vault server | `string` | `""` | no |
< | vault\_ca\_cert\_filename | GCS object path within the vault\_tls\_bucket. This is the root CA certificate. | `string` | `"ca.crt"` | no |
< | vault\_instance\_base\_image | Base operating system image in which to install Vault. This must be a Debian-based system at the moment due to how the metadata startup script runs. | `string` | `"debian-cloud/debian-10"` | no |
< | vault\_instance\_labels | Labels to apply to the Vault instances. | `map(string)` | `{}` | no |
< | vault\_instance\_metadata | Additional metadata to add to the Vault instances. | `map(string)` | `{}` | no |
< | vault\_instance\_tags | Additional tags to apply to the instances. Note 'allow-ssh' and 'allow-vault' will be present on all instances. | `list(string)` | `[]` | no |
< | vault\_log\_level | Log level to run Vault in. See the Vault documentation for valid values. | `string` | `"warn"` | no |
< | vault\_machine\_type | Machine type to use for Vault instances. | `string` | `"e2-standard-2"` | no |
< | vault\_max\_num\_servers | Maximum number of Vault server nodes to run at one time. The group will not autoscale beyond this number. | `string` | `"7"` | no |
< | vault\_min\_num\_servers | Minimum number of Vault server nodes in the autoscaling group. The group will not have less than this number of nodes. | `string` | `"1"` | no |
< | vault\_port | Numeric port on which to run and expose Vault. | `string` | `"8200"` | no |
< | vault\_proxy\_port | Port to expose Vault's health status endpoint on over HTTP on /. This is required for the health checks to verify Vault's status is using an external load balancer. Only the health status endpoint is exposed, and it is only accessible from Google's load balancer addresses. | `string` | `"58200"` | no |
< | vault\_service\_account\_email | Vault service account email | `string` | n/a | yes |
< | vault\_storage\_bucket | Storage bucket name where the backend is configured. This bucket will not be created in this module | `string` | n/a | yes |
< | vault\_tls\_bucket | GCS Bucket override where Vault will expect TLS certificates are stored. | `string` | `""` | no |
< | vault\_tls\_cert\_filename | GCS object path within the vault\_tls\_bucket. This is the vault server certificate. | `string` | `"vault.crt"` | no |
< | vault\_tls\_disable\_client\_certs | Use client certificates when provided. You may want to disable this if users will not be authenticating to Vault with client certificates. | `string` | `false` | no |
< | vault\_tls\_key\_filename | Encrypted and base64 encoded GCS object path within the vault\_tls\_bucket. This is the Vault TLS private key. | `string` | `"vault.key.enc"` | no |
< | vault\_tls\_kms\_key | Fully qualified name of the KMS key, for example, vault\_tls\_kms\_key = "projects/PROJECT\_ID/locations/LOCATION/keyRings/KEYRING/cryptoKeys/KEY\_NAME". This key should have been used to encrypt the TLS private key if Terraform is not managing TLS. The Vault service account will be granted access to the KMS Decrypter role once it is created so it can pull from this the `vault_tls_bucket` at boot time. This option is required when `manage_tls` is set to false. | `string` | `""` | no |
< | vault\_tls\_kms\_key\_project | Project ID where the KMS key is stored. By default, same as `project_id` | `string` | `""` | no |
< | vault\_tls\_require\_and\_verify\_client\_cert | Always use client certificates. You may want to disable this if users will not be authenticating to Vault with client certificates. | `string` | `false` | no |
< | vault\_ui\_enabled | Controls whether the Vault UI is enabled and accessible. | `string` | `true` | no |
< | vault\_update\_policy\_type | Options are OPPORTUNISTIC or PROACTIVE. If `PROACTIVE`, the instance group manager proactively executes actions in order to bring instances to their target versions | `string` | `"OPPORTUNISTIC"` | no |
< | vault\_version | Version of vault to install. This version must be 1.0+ and must be published on the HashiCorp releases service. | `string` | `"1.6.0"` | no |
< | zones | The zones to distribute instances across.  If empty, all zones in the region are used.  ['us-west1-a', 'us-west1-b', 'us-west1-c'] | `list(string)` | `[]` | no |
---
> |------|-------------|:----:|:-----:|:-----:|
> | domain | The domain name that will be set in the api_addr. Load Balancer IP used by default | string | `""` | no |
> | hc\_initial\_delay\_secs | The number of seconds that the managed instance group waits before it applies autohealing policies to new instances or recently recreated instances. | number | `"60"` | no |
> | host\_project\_id | ID of the host project if using Shared VPC | string | `""` | no |
> | http\_proxy | HTTP proxy for downloading agents and vault executable on startup. Only necessary if allow_public_egress is false. This is only used on the first startup of the Vault cluster and will NOT set the global HTTP_PROXY environment variable. i.e. If you configure Vault to manage credentials for other services, default HTTP routes will be taken. | string | `""` | no |
> | ip\_address | The IP address to assign the forwarding rules to. | string | n/a | yes |
> | kms\_crypto\_key | The name of the Cloud KMS Key used for encrypting initial TLS certificates and for configuring Vault auto-unseal. Terraform will create this key. | string | `"vault-init"` | no |
> | kms\_keyring | Name of the Cloud KMS KeyRing for asset encryption. Terraform will create this keyring. | string | `"vault"` | no |
> | kms\_protection\_level | The protection level to use for the KMS crypto key. | string | `"software"` | no |
> | load\_balancing\_scheme | Options are INTERNAL or EXTERNAL. If `EXTERNAL`, the forwarding rule will be of type EXTERNAL and a public IP will be created. If `INTERNAL` the type will be INTERNAL and a random RFC 1918 private IP will be assigned | string | `"EXTERNAL"` | no |
> | manage\_tls | Set to `false` if you'd like to manage and upload your own TLS files. See `Managing TLS` for more details | bool | `"true"` | no |
> | min\_ready\_sec | Minimum number of seconds to wait before considering a new or restarted instance as updated. This value must be from range. [0,3600] | number | `"0"` | no |
> | project\_id | ID of the project in which to create resources and add IAM bindings. | string | n/a | yes |
> | region | Region in which to create resources. | string | `"us-east4"` | no |
> | service\_account\_project\_additional\_iam\_roles | List of custom IAM roles to add to the project. | list(string) | `<list>` | no |
> | service\_account\_project\_iam\_roles | List of IAM roles for the Vault admin service account to function. If you need to add additional roles, update `service_account_project_additional_iam_roles` instead. | list(string) | `<list>` | no |
> | service\_account\_storage\_bucket\_iam\_roles | List of IAM roles for the Vault admin service account to have on the storage bucket. | list(string) | `<list>` | no |
> | service\_label | The service label to set on the internal load balancer. If not empty, this enables internal DNS for internal load balancers. By default, the service label is disabled. This has no effect on external load balancers. | string | `"null"` | no |
> | subnet | The self link of the VPC subnetwork for Vault. By default, one will be created for you. | string | n/a | yes |
> | tls\_ca\_subject | The `subject` block for the root CA certificate. | object | `<map>` | no |
> | tls\_cn | The TLS Common Name for the TLS certificates | string | `"vault.example.net"` | no |
> | tls\_dns\_names | List of DNS names added to the Vault server self-signed certificate | list(string) | `<list>` | no |
> | tls\_ips | List of IP addresses added to the Vault server self-signed certificate | list(string) | `<list>` | no |
> | tls\_ou | The TLS Organizational Unit for the TLS certificate | string | `"IT Security Operations"` | no |
> | tls\_save\_ca\_to\_disk | Save the CA public certificate on the local filesystem. The CA is always stored in GCS, but this option also saves it to the filesystem. | bool | `"true"` | no |
> | user\_startup\_script | Additional user-provided code injected after Vault is setup | string | `""` | no |
> | vault\_args | Additional command line arguments passed to Vault server | string | `""` | no |
> | vault\_ca\_cert\_filename | GCS object path within the vault_tls_bucket. This is the root CA certificate. | string | `"ca.crt"` | no |
> | vault\_instance\_base\_image | Base operating system image in which to install Vault. This must be a Debian-based system at the moment due to how the metadata startup script runs. | string | `"debian-cloud/debian-10"` | no |
> | vault\_instance\_labels | Labels to apply to the Vault instances. | map(string) | `<map>` | no |
> | vault\_instance\_metadata | Additional metadata to add to the Vault instances. | map(string) | `<map>` | no |
> | vault\_instance\_tags | Additional tags to apply to the instances. Note 'allow-ssh' and 'allow-vault' will be present on all instances. | list(string) | `<list>` | no |
> | vault\_log\_level | Log level to run Vault in. See the Vault documentation for valid values. | string | `"warn"` | no |
> | vault\_machine\_type | Machine type to use for Vault instances. | string | `"e2-standard-2"` | no |
> | vault\_max\_num\_servers | Maximum number of Vault server nodes to run at one time. The group will not autoscale beyond this number. | string | `"7"` | no |
> | vault\_min\_num\_servers | Minimum number of Vault server nodes in the autoscaling group. The group will not have less than this number of nodes. | string | `"1"` | no |
> | vault\_port | Numeric port on which to run and expose Vault. | string | `"8200"` | no |
> | vault\_proxy\_port | Port to expose Vault's health status endpoint on over HTTP on /. This is required for the health checks to verify Vault's status is using an external load balancer. Only the health status endpoint is exposed, and it is only accessible from Google's load balancer addresses. | string | `"58200"` | no |
> | vault\_service\_account\_email | Vault service account email | string | n/a | yes |
> | vault\_storage\_bucket | Storage bucket name where the backend is configured. This bucket will not be created in this module | string | n/a | yes |
> | vault\_tls\_bucket | GCS Bucket override where Vault will expect TLS certificates are stored. | string | `""` | no |
> | vault\_tls\_cert\_filename | GCS object path within the vault_tls_bucket. This is the vault server certificate. | string | `"vault.crt"` | no |
> | vault\_tls\_disable\_client\_certs | Use client certificates when provided. You may want to disable this if users will not be authenticating to Vault with client certificates. | string | `"false"` | no |
> | vault\_tls\_key\_filename | Encrypted and base64 encoded GCS object path within the vault_tls_bucket. This is the Vault TLS private key. | string | `"vault.key.enc"` | no |
> | vault\_tls\_kms\_key | Fully qualified name of the KMS key, for example, vault_tls_kms_key = "projects/PROJECT_ID/locations/LOCATION/keyRings/KEYRING/cryptoKeys/KEY_NAME". This key should have been used to encrypt the TLS private key if Terraform is not managing TLS. The Vault service account will be granted access to the KMS Decrypter role once it is created so it can pull from this the `vault_tls_bucket` at boot time. This option is required when `manage_tls` is set to false. | string | `""` | no |
> | vault\_tls\_kms\_key\_project | Project ID where the KMS key is stored. By default, same as `project_id` | string | `""` | no |
> | vault\_tls\_require\_and\_verify\_client\_cert | Always use client certificates. You may want to disable this if users will not be authenticating to Vault with client certificates. | string | `"false"` | no |
> | vault\_ui\_enabled | Controls whether the Vault UI is enabled and accessible. | string | `"true"` | no |
> | vault\_update\_policy\_type | Options are OPPORTUNISTIC or PROACTIVE. If `PROACTIVE`, the instance group manager proactively executes actions in order to bring instances to their target versions | string | `"OPPORTUNISTIC"` | no |
> | vault\_version | Version of vault to install. This version must be 1.0+ and must be published on the HashiCorp releases service. | string | `"1.6.0"` | no |
> | zones | The zones to distribute instances across.  If empty, all zones in the region are used.  ['us-west1-a', 'us-west1-b', 'us-west1-c'] | list(string) | `<list>` | no |
91c91
< | vault\_addr | Full protocol, address, and port (FQDN) pointing to the Vault load balancer.This is a drop-in to VAULT\_ADDR: `export VAULT_ADDR="$(terraform output vault_addr)"`. And then continue to use Vault commands as usual. |
---
> | vault\_addr | Full protocol, address, and port (FQDN) pointing to the Vault load balancer.This is a drop-in to VAULT_ADDR: `export VAULT_ADDR="$(terraform output vault_addr)"`. And then continue to use Vault commands as usual. |
Error: Documentation generation has not been run, please run the
'make docker_generate_docs' command and commit the above changes.

Can you tell me what went wrong with the linting? I have no access to the see the details of the test

Thanks for the PR! It seems lint is still failing on generating the docs. This can happen if you have a more recent version of the devtools container than Cloud Build is using. The one we're using in this repo is: gcr.io/cloud-foundation-cicd/cft/developer-tools:0.12.0 Is that the same one you have locally?

THis is in the makefile  so that is the version I use
DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 0
DOCKER_IMAGE_DEVELOPER_TOOLS := cft/developer-tools
REGISTRY_URL := gcr.io/cloud-foundation-cicd

Nice. using 0.12.0 worked. All tests passed


Cannot send confirmation email when using alongside with standard devise

I want to use standard devise alongside with devise token auth. When signing up users with standard devise, I found the confirmation email cannot be sent. However, email works well when signing up with devise token auth.  #229 discussed something about this but as a noob, unfortunately, I cannot understand what's going on here as the discussion is so short. Is there a way to enable email confirmation when using standard devise? I believe this happens because devise token gem modifies some parts of the registration controller in standard devise.

I see the code here https://github.com/lynndylanhurley/devise_token_auth/blob/master/app/models/devise_token_auth/concerns/user.rb#L121
states that  "this must be done from the controller so that additional params can be passed on from the client"
So, the quick fix would be add the method called send_confirmation_notification? and return true to your user's model.
But the problem is I cannot find any documentation here about send_confirmation_notification?. Would be nice if someone explain more about this.

I ended up using this gist:
https://gist.github.com/adisos/248da0b1a520b8d85726c2ec224d885e

Sounds like we have a solution, so closing this for now.

So that gist is gone, what was the actual solution?

defining this method inside devise_token_auth like this def send_confirmation_notification?; false; end is OUTRAGEOUS!


Download bandwidth is specified in "MBps". Is it bytes or bits?

I have a similar question as in this issue:
https://github.com/MicrosoftDocs/azure-docs/issues/60201
Download bandwidths for different SKUs of ACR are denoted in "MBps". The capitalized "B" would indicate that it's bytes, but it's most common to denote bandwidth in bits. Is it megabytes, or megabits?

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: dfe5a2a3-6fd3-2cca-0387-5c0d9b19906c
Version Independent ID: 3b1ddae9-b0c3-78ff-15a5-428abea3773e
Content: Registry service tiers and features - Azure Container Registry
Content Source: articles/container-registry/container-registry-skus.md
Service: container-registry
GitHub Login: @dlepow
Microsoft Alias: danlep

@magnus-longva-bouvet Thanks for the feedback. We will check and get back on this.

#assign dlepow

dlepow is already assigned.

@magnus-longva-bouvet - Thanks for pointing this out. The unit here is megabits per sec and you're correct should use the lowercase 'b'. The linked PR corrects the error and the updated content will publish shortly. Cheers!
#please-close


Add CSharpier and GH Actions (Linter and Size Label)

:x: Build POC-dotnet-Asterisk 1.0.6 failed (commit https://github.com/GuilhermeStracini/POC-dotnet-Asterisk/commit/44c72ce45d by @guibranco)

:white_check_mark: Build POC-dotnet-Asterisk 1.0.12 completed (commit https://github.com/GuilhermeStracini/POC-dotnet-Asterisk/commit/acca1d7386 by @guibranco)


Databricks connection, can't use schema

The databricks connection schema gets set in the db variable here
https://github.com/astronomer/astronomer-cosmos/blob/main/cosmos/providers/dbt/core/utils/profiles_generator.py#L195
and then ultimately is missed over here because it's expecting it in the schema variable
https://github.com/astronomer/astronomer-cosmos/blob/main/cosmos/providers/dbt/core/utils/profiles_generator.py#L164
The end result is
[2023-01-30, 14:12:14 GMT] {profiles_generator.py:223} ERROR - Please specify a target schema using the schema parameter.
For the moment I've worked around it by using the schema override option.

@pohek321 apologies for the mention but I've done some dev work on this locally, would it be possible to gain access to push it up so I can share please?

@MikeWallis42 would love to review the PR for you! We do PR's via forking so you should have access to contribute that way!


getBucketLocation should do 'UNSIGNED-PAYLOAD' for https as well

minio-go is not doing UNSINGED-PAYLOAD for getbucketlocation

I tested with UNSIGNED-PAYLOAD and it works fine. However before that, I noticed this text, in the link:
http://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html
The x-amz-content-sha256 header is required for all AWS Signature Version 4 requests. It provides a hash of the request payload. If there is no payload, you must provide the hash of an empty string.
Am I missing something?

I tested with UNSIGNED-PAYLOAD and it works fine. However before that, I noticed this text, in the link:
http://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html
The x-amz-content-sha256 header is required for all AWS Signature Version 4 requests. It provides a hash of the request payload. If there is no payload, you must provide the hash of an empty string.
Am I missing something?

yes 'UNSIGNED-PAYLOAD' should be added for https requests only. This is what aws-sdk tools actually do.  Checksum is only calculated for 'insecure' connections. Current code already does this if you do 'mc ls --debug play'  - only missing is getBucketLocation


net/http/httputil: NewSingleHostReverseProxy doesn't pass http authentication

I am using NewSingleHostReverseProxy its working well for us except it not passing any authentication if I pass the URL with auth its just ignoring auth, is there any way I can work around it

You can write your own transport that wraps the default transport one.
https://golang.org/src/net/http/httputil/reverseproxy.go?s=564:1486#L34

Yeah, I think @mgenov's suggestion is your best bet. I don't think we want to modify ReverseProxy at this point to support auth in URLs. In general, auth info in URLs is somewhat gross and deprecated, and I don't think we should be encouraging it.

@bradfitz if I add credentials in header will it work?

Headers are propagated through the proxy.

thanks @bradfitz


conflict with Software Collections repo

Cookbook version
3.0.0
Chef-client version
13.11.10
Platform Details
CentOS 7
Scenario:
package 'centos-release-SCL'
inlcude_recipe 'yum-centos'

Steps to Reproduce:
run recipe
Expected Result:
centos repo is deleted, but Software Collections repo exists
Actual Result:
both centos and Software Collections repos are deleted
Reason:
Software Collections repos are
CentOS-SCLo-scl-rh.repo
CentOS-SCLo-scl.repo

those code delete them:
https://github.com/chef-cookbooks/yum-centos/blob/master/recipes/default.rb#L36-L40

Correct, opening a PR to prevent the deletions of SCL repos.

@tas50 can close this issue ❤


Failure to install lxml breaks build on gh actions

See aurora issue # 313
It looks like something has updated with lxml and python 3.8 & 3.9 are not able to build our environment.
Here is a gh actions test that failed Dec 29
But the same test passed around a week ago.

@kujaku11 can you please add https://github.com/laura-iris to mt_metadata with push permission in order to test branch fix_issue_184?

lxml is being installed through obspy and isn't pinned to a specific version there. Today lxml released version 5.0.0, which explains the change in behavior today. I haven't had time to look much further than that, but I'll get back to it next week.

@kkappler I don't have the permissions to restart the 3.8 pipeline in mt_metadata, but I do see that you have one in aurora that passed about an hour ago. It looks like it handled lxml v5.0.0 just fine in that case: https://github.com/simpeg/aurora/actions/runs/7402625504/job/20140872929
Makes me wonder if it was an issue with the new release that has since been dealt with?

@laura-iris I just added you as a collaborator.

@kkappler @laura-iris Looks like the issue was fixed, all tests pass now.  Gonna close this issue for now.


Memory leak in Java API when using GPU

System information

Custom code: https://github.com/riklopfer/TensorflowJavaGpuMemoryTest
OS: CentOS 7
TensorFlow installed from (source or binary): n/a
TensorFlow version (use command below): n/a
Python version: n/a
Bazel version (if compiling from source): n/a
CUDA/cuDNN version: 8.0
GPU model and memory: GeForce GTX 1080
Exact command to reproduce: see https://github.com/riklopfer/TensorflowJavaGpuMemoryTest

Describe the problem
Main memory on the machine is continuously consumed. Memory consumption hovers around 600M when running on the CPU.
Source code / logs
see: https://github.com/riklopfer/TensorflowJavaGpuMemoryTest

@asimshankar could you please take a look at this.

This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a temporary error. The following address(es) deferred:
<EMAIL_ADDRESS>Domain mazecreator.com has exceeded the max emails per hour (26/25 (104%)) allowed.  Message will be reattempted later
------- This is a copy of the message, including all the headers. ------
Received: from github-smtp2-ext6.iad.github.net ([<IP_ADDRESS>]:36485 helo=github-smtp2b-ext-cp1-prd.iad.github.net)
by server2.lowesthostingrates.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.89)
(envelope-from<EMAIL_ADDRESS>id 1dcxof-000394-2L
for<EMAIL_ADDRESS>Wed, 02 Aug 2017 12:52:47 -0500
Date: Wed, 02 Aug 2017 11:02:54 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com;
s=pf2014; t=1501696974;
bh=xMPs0Zsnl6VbA5xdMKnjzeP7lE3BylmccopCWCfAoao=;
h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID:
List-Archive:List-Post:List-Unsubscribe:From;
b=KzhNBJt5dc6NQDPTP3b9OQT+SxXzLZTrtXknB+dMLh/dvI2do7WjgAc5ivwcDYtSd
QgYEd++UGNV9vYETuWz13UHDGsJnPaK6Lb9RxfXWb0nMNC0FSEmiTxRoOc/jzmE1/J
CPv4vyKxMi95O17akZ0aXxtvIN73NKUYLNuE5iRo=
From: shivaniag<EMAIL_ADDRESS>Reply-To: tensorflow/tensorflow<EMAIL_ADDRESS>To: tensorflow/tensorflow<EMAIL_ADDRESS>Cc: Subscribed<EMAIL_ADDRESS>Message-ID<EMAIL_ADDRESS>In-Reply-To<EMAIL_ADDRESS>References<EMAIL_ADDRESS>Subject: Re: [tensorflow/tensorflow] Memory leak in Java API when using GPU
(#11948)
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="--==_mimepart_598213ceee1b9_5bac3fc740685c302860ce";
charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: shivaniag
X-GitHub-Recipient: Mazecreator
X-GitHub-Reason: subscribed
List-ID: tensorflow/tensorflow <tensorflow.tensorflow.github.com>
List-Archive: https://github.com/tensorflow/tensorflow
List-Post<EMAIL_ADDRESS>List-Unsubscribe<EMAIL_ADDRESS>https://github.com/notifications/unsubscribe/ARjzoG_h_tTzXcwUSJMLp1gQcPpUwyMIks5sULnOgaJpZM4OqJQB
X-Auto-Response-Suppress: All
X-GitHub-Recipient-Address<EMAIL_ADDRESS>X-Spam-Status: No, score=
X-Spam-Score:
X-Spam-Bar:
X-Ham-Report:
X-Spam-Flag: NO
----==_mimepart_598213ceee1b9_5bac3fc740685c302860ce
Content-Type: text/plain;
charset=UTF-8
Content-Transfer-Encoding: 7bit
@asimshankar could you please take a look at this.
--
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/tensorflow/tensorflow/issues/11948#issuecomment-319750457
----==_mimepart_598213ceee1b9_5bac3fc740685c302860ce
Content-Type: text/html;
charset=UTF-8
Content-Transfer-Encoding: 7bit
@asimshankar could you please take a look at this.
—You are receiving this because you are subscribed to this thread.Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_598213ceee1b9_5bac3fc740685c302860ce--

Sample log output fwiw,
2017-08-29 14:30:27.963729: W tensorflow/core/platform/cpu_feature_guard.cc:45] The TensorFlow library wasn't compiled to use SSE4.1 instructions, but these are available on your machine and could speed up CPU computations.
2017-08-29 14:30:27.963779: W tensorflow/core/platform/cpu_feature_guard.cc:45] The TensorFlow library wasn't compiled to use SSE4.2 instructions, but these are available on your machine and could speed up CPU computations.
2017-08-29 14:30:27.963788: W tensorflow/core/platform/cpu_feature_guard.cc:45] The TensorFlow library wasn't compiled to use AVX instructions, but these are available on your machine and could speed up CPU computations.
2017-08-29 14:30:27.963795: W tensorflow/core/platform/cpu_feature_guard.cc:45] The TensorFlow library wasn't compiled to use AVX2 instructions, but these are available on your machine and could speed up CPU computations.
2017-08-29 14:30:27.963802: W tensorflow/core/platform/cpu_feature_guard.cc:45] The TensorFlow library wasn't compiled to use FMA instructions, but these are available on your machine and could speed up CPU computations.
2017-08-29 14:30:29.569904: I tensorflow/core/common_runtime/gpu/gpu_device.cc:955] Found device 0 with properties:
name: GeForce GTX 1080
major: 6 minor: 1 memoryClockRate (GHz) 1.7335
pciBusID 0000:01:00.0
Total memory: 7.92GiB
Free memory: 7.81GiB
2017-08-29 14:30:29.569957: I tensorflow/core/common_runtime/gpu/gpu_device.cc:976] DMA: 0
2017-08-29 14:30:29.569965: I tensorflow/core/common_runtime/gpu/gpu_device.cc:986] 0:   Y
2017-08-29 14:30:29.569981: I tensorflow/core/common_runtime/gpu/gpu_device.cc:1045] Creating TensorFlow device (/gpu:0) -> (device: 0, name: GeForce GTX 1080, pci bus id: 0000:01:00.0)

I've added valgrind output to the test repository: https://github.com/riklopfer/TensorflowJavaGpuMemoryTest/blob/master/valgrind.out

@riklopfer : Thanks very much for getting that information across. Unfortunately not a lot struck out to me.
I did see 32 bytes of leaks from graph construction, which I will fix, but that happens once - not in a loop so won't explain the increasing usage over time.

@asimshankar thanks for the fixes. Were you able to reproduce the issue of ever-increasing memory consumption? Any idea what the next steps might be?

Updating CUDA and Nvidia drivers seems to have greatly mitigated the problem for me. I added updated valgrind output to the test repo.

Thanks for the update @riklopfer
Sampling the latest output, I'm not sure if there are false positives or actual leaks (e.g., many leaks are reported in CreateJavaVM, which IIUC has nothing to do with TensorFlow, it's just JVM initialization.
When you say "greatly mitigated", are you still seeing a monotonic increase in memory usage over time, or does it stabilize?

@asimshankar I no longer see monotonic increase in memory consumption when running my the small test  in the linked repo. However, when I run a longer, more complicated graph on the GPU, it is killed by the OOM killer. I wasn't able to get a valgrind dump for that process. When I have time, I will try increasing the complexity of the test graph until it shows the problem again (or not).

It has been 14 days with no activity and the awaiting response label was assigned. Is this still an issue? Please update the label and/or status accordingly.

Running with 1.4.0, I still see a slow, monotonic increase in memory consumption. I also see that running on the GPU is dramatically slower than running on the CPU, which is unusual. I haven't had a chance to attempt to minimally reproduce the issue.

Closing since the original issue has been fixed. Please file another ticket with a repro if you can. Thanks!


Locate service not working for viomi_vacuum_v8

When i try to use service locate
service: vacuum.locate
target:
entity_id: vacuum.viomi_vacuum_v8
I get error
2022-01-18 15:26:59 ERROR (MainThread) [homeassistant.helpers.script.websocket_api_script] websocket_api script: Error executing script. Unexpected error for call_service at pos 1:
Traceback (most recent call last):
File "/usr/src/homeassistant/homeassistant/helpers/script.py", line 381, in _async_step
await getattr(self, handler)()
File "/usr/src/homeassistant/homeassistant/helpers/script.py", line 584, in _async_call_service_step
await service_task
File "/usr/src/homeassistant/homeassistant/core.py", line 1495, in async_call
task.result()
File "/usr/src/homeassistant/homeassistant/core.py", line 1530, in _execute_service
await handler.job.target(service_call)
File "/usr/src/homeassistant/homeassistant/helpers/entity_component.py", line 209, in handle_service
await self.hass.helpers.service.entity_service_call(
File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 663, in entity_service_call
future.result()  # pop exception if have
File "/usr/src/homeassistant/homeassistant/helpers/entity.py", line 896, in async_request_call
await coro
File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 700, in _handle_entity_call
await result
File "/usr/src/homeassistant/homeassistant/components/vacuum/init.py", line 239, in async_locate
await self.hass.async_add_executor_job(partial(self.locate, **kwargs))
File "/usr/local/lib/python3.9/concurrent/futures/thread.py", line 52, in run
result = self.fn(*self.args, **self.kwargs)
File "/usr/src/homeassistant/homeassistant/components/vacuum/init.py", line 232, in locate
raise NotImplementedError()
NotImplementedError
2022-01-18 15:26:59 ERROR (MainThread) [homeassistant.components.websocket_api.http.connection] [139729599148624] Error handling message: Unknown error
Traceback (most recent call last):
File "/usr/src/homeassistant/homeassistant/components/websocket_api/decorators.py", line 27, in _handle_async_response
await func(hass, connection, msg)
File "/usr/src/homeassistant/homeassistant/components/websocket_api/commands.py", line 527, in handle_execute_script
await script_obj.async_run(msg.get("variables"), context=context)
File "/usr/src/homeassistant/homeassistant/helpers/script.py", line 1260, in async_run
await asyncio.shield(run.async_run())
File "/usr/src/homeassistant/homeassistant/helpers/script.py", line 363, in async_run
await self._async_step(log_exceptions=False)
File "/usr/src/homeassistant/homeassistant/helpers/script.py", line 381, in _async_step
await getattr(self, handler)()
File "/usr/src/homeassistant/homeassistant/helpers/script.py", line 584, in _async_call_service_step
await service_task
File "/usr/src/homeassistant/homeassistant/core.py", line 1495, in async_call
task.result()
File "/usr/src/homeassistant/homeassistant/core.py", line 1530, in _execute_service
await handler.job.target(service_call)
File "/usr/src/homeassistant/homeassistant/helpers/entity_component.py", line 209, in handle_service
await self.hass.helpers.service.entity_service_call(
File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 663, in entity_service_call
future.result()  # pop exception if have
File "/usr/src/homeassistant/homeassistant/helpers/entity.py", line 896, in async_request_call
await coro
File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 700, in _handle_entity_call
await result
File "/usr/src/homeassistant/homeassistant/components/vacuum/init.py", line 239, in async_locate
await self.hass.async_add_executor_job(partial(self.locate, **kwargs))
File "/usr/local/lib/python3.9/concurrent/futures/thread.py", line 52, in run
result = self.fn(*self.args, **self.kwargs)
File "/usr/src/homeassistant/homeassistant/components/vacuum/init.py", line 232, in locate
raise NotImplementedError()
NotImplementedError

Added in v0.0.4

v0.0.4 don't work for me at all i create new issue related to the update itself


Feature Request downtime clock

Adding a downtime clock to show how long your coins have not been lent out. DD:HH:MM:SS
Other exchanges may have better rates when Poloniex lending rates are below a certain percentage. By comparing the downtime we can calculate which exchange to keep our coins on.

@AlexMinty How exactly would this work though? Not everyone lends out all their coins, if you're using maxtolend etc then there'll always be coins not lent out.
The only way I can see of doing it would be via a graph, coins not lent on Y and time on X. Which is of course possible, but a lot of work.

I didn't realise this was still open, probably an unnecessary enhancement.


Added PyCharm to the list of editors

PyCharm is great for writing Python

Testing Plan:
GIFs or Screenshots:

Merged, thanks @guettli!  Feel free to batch together a few documentation commits like this in a single PR.


How to inference mllm by Python?

How to inference mllm by Python?

The mllm project currently only provides C++ API. Since the front end of mllm has not yet fully stabilized, we have not prioritized the work on Python bindings. If you want to call some functions of mllm using Python, you can use pybind11 to achieve this.


Update release-notes-rs4.md

some initial edits

 Thank you for your submission, we really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.:x: tmlyon sign nowYou have signed the CLA already but the status is still pending? Let us recheck it.

:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

mixed-reality-docs/release-notes-rs4.md
:white_check_mark:Succeeded
View

For more details, please refer to the build report.
Note: If you changed an existing file name or deleted a file, broken links in other files to the deleted or renamed file are listed only in the full build report.


Day261

Resolves #534.

Pull Request Test Coverage Report for Build 1065

0 of 0   changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 100.0%

Totals

Change from base Build 1063:
0.0%

Covered Lines:
5

Relevant Lines:
5

💛  - Coveralls


Bug in LightningModule.load_from_checkpoint

Suppose you have a class Model(LightningModule) (a LightningModule subclass) and as parameters it takes
params: argparse.Namespace (without a default value), along with other keyword arguments which might take default arguments. Loading from a checkpoint
model = Model(params=params, **kwargs)
...  # saves a checkpoint
model = Model.load_from_checkpoint(params=params, **kwargs)
# same behavior arises if params is passed as positional argument

will throw the error TypeError: __init__() got multiple values for argument 'params'.
This comes from the fact that in line 205 in pytorch_lightning/core/saving.py
model = cls(*cls_args, **cls_kwargs)

when inspected, cls_args is ({'params': params},) and cls_kwargs is, of course, {'params': params}.
This stems from the fact in lines 189-196 (in saving.py):
            if args_name == 'kwargs':
                # in case the class cannot take any extra argument filter only the possible
                cls_kwargs.update(**model_args)
            elif args_name:
                if args_name in cls_init_args_name:
                    cls_kwargs.update({args_name: model_args})
            else:
                cls_args = (model_args,) + cls_args

the else clause is getting called and model_args contains a copy of kwargs!
To be honest, it's very unclear to me exactly what model_args is supposed to be here, but what is clear is that
this block needs more checking so that we don't just stick copies of items in cls_kwargs into cls_args. Just doing
something silly like replacing the else clause with
from typing import Sequence
...
             elif isinstance(model_args, Sequence):
                cls_args = tuple(model_args) + cls_args

fixes the problem for me, but as I said, I'm unclear on exactly how model_args is being used, so I'm sure there is a better
solution.

@Borda any updates on this front?

@Borda any updates on this?

@acturner it is fixed by #2776 mind try...


server,test: fix resourceid for VOLUME.DESTROY in restore VM

Description
Destroys old ROOT volume for the VM to be restored in its own context to allow event to be published with resourceid. Fixes exception in test_event_resources.py
Fixes failures seen in:
https://github.com/apache/cloudstack/pull/8601#issuecomment-2078654228
https://github.com/apache/cloudstack/pull/8601#issuecomment-2079018980
https://github.com/apache/cloudstack/pull/8601#issuecomment-2079141241
Types of changes

[ ] Breaking change (fix or feature that would cause existing functionality to change)
[ ] New feature (non-breaking change which adds functionality)
[x] Bug fix (non-breaking change which fixes an issue)
[ ] Enhancement (improves an existing feature and functionality)
[ ] Cleanup (Code refactoring and cleanup, that may add test cases)
[ ] build/CI

Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale

[ ] Major
[ ] Minor

Bug Severity

[ ] BLOCKER
[ ] Critical
[ ] Major
[ ] Minor
[ ] Trivial

Screenshots (if appropriate):
How Has This Been Tested?

How did you try to break this feature and the system with this change?

@blueorangutan package

@shwstppr a [SL] Jenkins job has been kicked to build packages. It will be bundled with  KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

Codecov Report
Attention: Patch coverage is 0% with 1 lines in your changes are missing coverage. Please review.

Project coverage is 15.67%. Comparing base (b91c387) to head (3986a49).

Files
Patch %
Lines

.../src/main/java/com/cloud/vm/UserVmManagerImpl.java
0.00%
1 Missing :warning:

Additional details and impacted files
@@             Coverage Diff              @@
##               4.19    #9032      +/-   ##
============================================
+ Coverage     14.96%   15.67%   +0.70%
+ Complexity    10996    10995       -1
============================================
  Files          5373     5010     -363
  Lines        468973   439793   -29180
  Branches      60294    54585    -5709
============================================
- Hits          70205    68949    -1256
+ Misses       390995   363214   -27781
+ Partials       7773     7630     -143

Flag
Coverage Δ

uitests
?

unittests
15.67% <0.00%> (+<0.01%)
:arrow_up:

Flags with carried forward coverage won't be shown. Click here to find out more.

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

Packaging result [SF]: ✔ el7 ✔ el8 ✔ el9 ✔ debian ✔ suse15. SL-JID 9520

@blueorangutan test rocky8 kvm-rocky8

@weizhouapache a [SL] Trillian-Jenkins test job (rocky8 mgmt + kvm-rocky8) has been kicked to run smoke tests

[SF] Trillian Build Failed (tid-10150)

@blueorangutan test rocky8 kvm-rocky8

@weizhouapache a [SL] Trillian-Jenkins test job (rocky8 mgmt + kvm-rocky8) has been kicked to run smoke tests

[SF] Trillian test result (tid-10151)
Environment: kvm-rocky8 (x2), Advanced Networking with Mgmt server r8
Total time taken: 46971 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr9032-t10151-kvm-rocky8.zip
Smoke tests completed. 129 look OK, 2 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test
Result
Time (s)
Test File

test_01_restore_vm
Error
0.21
test_restore_vm.py

test_02_restore_vm_allocated_root
Error
0.17
test_restore_vm.py

ContextSuite context=TestRestoreVM>:teardown
Error
1.27
test_restore_vm.py

test_02_trigger_shutdown
Failure
341.57
test_safe_shutdown.py

Failed tests are unrelated, https://github.com/apache/cloudstack/pull/8601#issuecomment-2091938578

@blueorangutan package

@sureshanaparti a [SL] Jenkins job has been kicked to build packages. It will be bundled with  KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

Packaging result [SF]: ✔ el7 ✔ el8 ✔ el9 ✔ debian ✔ suse15. SL-JID 9577

@blueorangutan test

@vishesh92 a [SL] Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

[SF] Trillian test result (tid-10191)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 43205 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr9032-t10191-kvm-centos7.zip
Smoke tests completed. 124 look OK, 7 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test
Result
Time (s)
Test File

test_DeployVmAntiAffinityGroup_in_project
Error
85.31
test_affinity_groups_projects.py

test_DeployVmAntiAffinityGroup
Error
37.76
test_affinity_groups.py

test_03_deploy_and_scale_kubernetes_cluster
Failure
33.13
test_kubernetes_clusters.py

test_08_upgrade_kubernetes_ha_cluster
Failure
0.08
test_kubernetes_clusters.py

test_01_non_strict_host_anti_affinity
Failure
119.79
test_nonstrict_affinity_group.py

test_02_non_strict_host_affinity
Error
81.66
test_nonstrict_affinity_group.py

test_02_trigger_shutdown
Failure
346.79
test_safe_shutdown.py

test_02_list_cpvm_vm
Failure
0.04
test_ssvm.py

test_04_cpvm_internals
Failure
0.04
test_ssvm.py

test_hostha_enable_ha_when_host_in_maintenance
Error
304.95
test_hostha_kvm.py

@blueorangutan package

@shwstppr a [SL] Jenkins job has been kicked to build packages. It will be bundled with  KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

Packaging result [SF]: ✔ el7 ✔ el8 ✔ el9 ✔ debian ✔ suse15. SL-JID 9581

@blueorangutan test

@vishesh92 a [SL] Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

[SF] Trillian test result (tid-10198)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 56385 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr9032-t10198-kvm-centos7.zip
Smoke tests completed. 130 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test
Result
Time (s)
Test File

test_02_trigger_shutdown
Failure
341.65
test_safe_shutdown.py


Prevent creation of empty textblocks

Motivation and Context
When assessing text-exercises with multiple sentences with spaces or newlines in between 2 textblocks, an empty textblock with this space/newline in between got created in the database. This PR fixes this problem
Description

Introduced a check to prevent the creation of empty (only spaces/newlines) textblocks

Steps for Testing

Create a text-exercise
Create a submission with multiple sentences separated by ". " (mind the space after the ".")
Assess the submission using the automatic selection of text-blocks
Submit the assessment
Check the database (Table "text-block") for empty entries

Thanks for discovering this! I could reproduce the issue now. This is not related to the change in this PR, since it happens while loading the submission and creating the textblocks initially. Anyway, I will have a look at this bug!

The issue was the declaration of the LINE_SEPARATOR in TextBlockService.java. Since there was a double-\ in the declaration (\\n instead of \n), the length of it was evaluated to 2, which caused the splitSubmissionIntoBlocks-method to set wrong start/end-indices of the TextBlocks. Removing the doubled \ resolves the issue (on macOS and Linux). Can someone test it on Windows?
@jpbernius Do you know the background of the doubled \?

Newlines are shown correct now! Good Job! One think I noticed is that multiple SPACE right next to each other are capped to just one. I think this is ok because I don't really see a scenario where this would matter, but I wanted you to know that!
Submission:

Assessment:

One thing I noticed is that multiple SPACE right next to each other are capped to just one. I think this is ok because I don't really see a scenario where this would matter, but I wanted you to know that!

Was this also the case before? I could see scenarios where this would have unwanted effects, e.g. when someone is trying to align content into a tabular structure (similar to tables in markdown) but I'm not sure if we want to support something like that at all.

Yes, this was also the case before. So nothing changed here so far.


Appstudio update test-component83344

Pipelines as Code configuration proposal

Pipelines as Code CI/test-component83344-on-pull-request has failed.

StatusDurationName

✅ Succeeded
7 seconds
appstudio-init

✅ Succeeded
58 seconds
clone-repository

✅ Succeeded
45 seconds
sast-snyk-check

✅ Succeeded
24 seconds
appstudio-configure-build

❌ Failed
1 minute
build-container

✅ Succeeded
8 seconds
show-summary

Failure reasontask build-container has the status "Failed":
2022/11/29 08:37:26 Skipping step because a previous step failed

Pipelines as Code CI/test-component83344-on-pull-request has failed.

StatusDurationName

✅ Succeeded
7 seconds
appstudio-init

✅ Succeeded
58 seconds
clone-repository

✅ Succeeded
24 seconds
appstudio-configure-build

✅ Succeeded
45 seconds
sast-snyk-check

❌ Failed
1 minute
build-container

✅ Succeeded
8 seconds
show-summary

Failure reasontask build-container has the status "Failed":
2022/11/29 08:37:26 Skipping step because a previous step failed


Should it be conv weight sharing for the trident net?

I read the tridentnet paper briefly and wondered if it should be using the same conv weight for different dilated conv kernels

I remember the result of sharing weights is lower than original. And my experiments indicate this conclusion too.

I remember the result of sharing weights is lower than original in paper. And my experiments indicate this conclusion too.

I checked the paper again and found out that was not the case. In the ablation study of the paper, a result list indicated that using weight sharing improved performance for various backbone networks.
What I really want to know is that how to update the network with different gradients for different branches and still keeping the parameters shared. Should it be average the gradient across branches or using a regularization method.


pip install beta.11 gives me beta.10

Scenario & Reproduction Steps
pip install --upgrade git+ssh://git<EMAIL_ADDRESS>then
pip list | grep onepassword
Actual Behavior
i get back

pip list | grep onepassword
onepassword       0.1.0b10

Expected Behavior

pip list | grep onepassword
onepassword       0.1.0b11

SDK version
No response
Additional information
No response

Hey @simkimsia! Thank you for reporting this. I can reproduce this issue. We will look into fixing it soon.

think this is fixed. since now 0.1.1


feat: DIA-1410: support multi-label text classification prompts

Codecov Report
All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 66.77%. Comparing base (a25f22b) to head (2f1dcd7).

Additional details and impacted files
@@           Coverage Diff           @@
##           master     #209   +/-   ##
=======================================
  Coverage   66.77%   66.77%
=======================================
  Files          44       44
  Lines        2074     2074
=======================================
  Hits         1385     1385
  Misses        689      689

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

Commit https://github.com/HumanSignal/infra/commit/336696b7857fc9f5b5cd92ff7b2765b7a3b07575 is created.

Commit https://github.com/HumanSignal/infra/commit/c14e71a77a0542132d41492277bc2b67e347aa2f is created.

Commit https://github.com/HumanSignal/infra/commit/8e1561d9c6a63a6a087a60bc2cc8f5861bec0331 is created.

Commit https://github.com/HumanSignal/infra/commit/cbd4441ccda135378badf9a60ff30e5f0bf06de0 is created.

Commit https://github.com/HumanSignal/infra/commit/172d8b6f75c5471d242d4fb43f4b8655a831e744 is created.

Commit https://github.com/HumanSignal/infra/commit/1bc65dc3594d02709ae092b150d5966daf0f218f is created.

Commit https://github.com/HumanSignal/infra/commit/286cc1f05a18df4aa585973478bf136ffc804b3e is created.

Commit https://github.com/HumanSignal/infra/commit/979a979ec050f132b4adc3adbf9072f2a8a1765d is created.

Commit https://github.com/HumanSignal/infra/commit/525dd3da7888cf2535c24d36384e12655f414885 is created.

Commit https://github.com/HumanSignal/infra/commit/d10d8084220ee45631d7f58307300e612bbbb406 is created.

Commit https://github.com/HumanSignal/infra/commit/b95e13ca2b9414c7814ae77ac9abb7db88436f1c is created.

Commit https://github.com/HumanSignal/infra/commit/2ed75a3e9cd72d8c355fed28b1e96496647930b2 is created.

Commit https://github.com/HumanSignal/infra/commit/38ba240a39a4878218bb33fde6a676c86a61ca12 is created.

Commit https://github.com/HumanSignal/infra/commit/3e3df73ba87c3e300858fe126c2e3dd3eb2e18ac is created.

Commit https://github.com/HumanSignal/infra/commit/f343d48f203c95833810c0de8eba2ca2e80d913c is created.


Add Python 3.10, 3.11 support

CI is failing due network issue

Indeed. Re-running just for the green checkmark.

can i raise a PR to drop 3.5 and 3.5 because reached eol

Yes, I think it makes sense to remove support for 3.5 and 3.6 now.


Future bug: Analyze function index offset for imported functions

According to the specs, imported functions are the first to be assigned an index and only afterwards do the normal functions get assigned indexes.
This issue was discovered when implementing a fix for issue #25 and is created in order to track progress on this potential future bug.

Actually, this might not actually be an issue. In the same_type_fn implemented in pr #26, if I add an import to the wat, all tests pass.
(module
    (import "test" "testFunc" (func (param i64 i64) (result i64)))
    (func (export "add_one") (param $x i32) (result i32)
        local.get $x
        i32.const 1
        i32.add)

    (func (export "add_two") (param $x i32) (result i32)
        local.get $x
        i32.const 2
        i32.add)
)

Although the imported function seems to get the ID of 0, the functions section only deals with the functions declared in the module. This does not mean the issue is fixed. We still need to be careful when actually implementing imported functions.

Relevant also to #87


Exception :'+00:00' while reading data frame

Describe the bug
I created data frame with column ingestion_date and value for this source with ```
df['ingestion_date']=pd.to_datetime(datetime.datetime.now(datetime.timezone.utc))
wr.s3.to_parquet(
partition_cols=partition_col,
df=df,
path=s3_write_path,
dataset=True,
sanitize_columns=False
)
so my parquet is created
then i am trying to  read the parquet using
`patient_df = wr.s3.read_parquet(full_path, dataset=True)`
It is throwing error '+00:00'

When i print dataframe  parquet data_frame['ingestion_date'] before writing it gives below value.
2020-09-08 04:52:32.916075+00:00

**To Reproduce**
Steps to reproduce the behavior. Also add details about Python and Wrangler's version and how the library was installed.

*P.S. Don't attach files. Please, prefer add code snippets directly in the message body.*

Fix released on 1.9.3


Disable go mod replace directive for releases

When we build a release of a go module, all declared dependencies should be versioned.
To ensure this, all replace directives should be commented out during the build, and uncommented as part of the post-release process.
For example, when we build and tag a release of gherkin-go, we should not build against cucumber-messages-go using the relative path, but rather the tagged release of cucumber-messages-go.
This poses a new challenge. Go modules requires tags to be of the format vMAJOR.MINOR.PATCH. However, for the monorepo we have adopted a git tag naming convention of COMPONENT/vMAJOR.MINOR.PATCH to avoid collisions of tags between components.
I think we have 2 options here:
a) Adopt a global version number for all components in the monorepo
b) Use splitsh-lite to sync to read-only "sub" repos
We have been using splitsh-lite in the past (before we migrated from TravisCI to CircleCI), so that would be relatively easy. We should still consider option a) as I think it might simplify other aspects of the build.
This is somewhat related to #662

Fixed


lsp-sample: add language contribution to manifest

Looks like this was missed when the sample extension and the guide were updated to reflect the changes to VSCode 1.74.0 and higher.
This allows for the implicit activation documented in the release notes and the respective docs.

This works @vancluever thanks :)

Helped me too, would be nice to get this merged asap because currently the sample doesnt work without the languages contribution

I have no idea how to do any of the things you guys ask. I have a take out file with everything needed. Email me back and I'll send u over the files.

+1 that this PR fixed the same issue for me :)
Thanks!


Cannot find name 'PromiseSettledResult'.

Expected Behavior
Nest wont build
Actual Behavior
`node_modules/@liaoliaots/nestjs-redis/dist/cluster/common/cluster.utils.d.ts:8:73 - error TS2304: Cannot find name 'PromiseSettledResult'.

8 export declare const quitClients: (clients: ClusterClients) => Promise<[PromiseSettledResult<ClientNamespace>, PromiseSettledResult<'OK'>][]>;

node_modules/@liaoliaots/nestjs-redis/dist/cluster/common/cluster.utils.d.ts:8:112 - error TS2304: Cannot find name 'PromiseSettledResult'.

8 export declare const quitClients: (clients: ClusterClients) => Promise<[PromiseSettledResult<ClientNamespace>, PromiseSettledResult<'OK'>][]>;

                                                     `

Steps to Reproduce the Problem
    "node": "16.13.0",
    "yarn": "1.22.x",
    "npm": "8.1.x"

"@liaoliaots/nestjs-redis": "^5.1.0",
"@types/ioredis": "^4.28.1",
 "ioredis": "^4.28.0",
 "typescript": "^4.4.4"
v8 of nest modules

Version 5.1.1 has been released, install new version and try it again.


Add compile options

Sorry, we would like to keep the default value of BUILD_VGICP_CUDA to OFF and close this PR.


Specified cast is not valid only when using Effort In-Memory DB

I'm performing 2 left outer joins and plugging data into a DTO that has a property defined as public long PersonId { get; set; } and the EF data model also has a property defined as public long PersonId { get; set; }. When I use the query normally in the application the code works, but when I use an Effort in-memory database DbConnectionFactory.CreateTransient() I receive the following exception:
StackTrace:
at Effort.Provider.EffortDataReader.GetInt64(Int32 ordinal)
   at lambda_method(Closure , Shaper )
   at System.Data.Entity.Core.Common.Internal.Materialization.Coordinator`1.ReadNextElement(Shaper shaper)
   at System.Data.Entity.Core.Common.Internal.Materialization.Shaper`1.SimpleEnumerator.MoveNext()
   at System.Collections.Generic.List`1..ctor(IEnumerable`1 collection)
   at System.Linq.Enumerable.ToList[TSource](IEnumerable`1 source)
   at ...
Result Message:	System.InvalidCastException : Specified cast is not valid.

I think there may be a bug in Effort related to reading long types into non-entities even thought it should be long to long.

Hello @nick-beers ,
Do you think you could provide a "working" project example/test with this issue?
It will make easier/faster for my developer to getting started for investigating it.
You can send it to<EMAIL_ADDRESS>if you need to keep the source private
We now always ask for a project since we found out that most issues are missing some essential information, have some syntax mistake or are resolved by the requestor when creating it
(Even if the issue seem very easy to reproduce, by getting a test project, it allow us to give a faster support and better experience for the support of all our free libraries)
Best Regards,
Jonathan

Performance Libraries
context.BulkInsert(list, options => options.BatchSize = 1000);
Entity Framework Extensions • Bulk Operations •  Dapper Plus •  LinqToSql Plus
Runtime Evaluation
Eval.Execute("x + y", new {x = 1, y = 2}); // return 3
C# Eval Function • SQL Eval Function


Question: Slurm MinCount is this min nodes running or min nodes available to take jobs?

I'm looking for an option similar to MinCount, but instead of specifying the minimum number of nodes that are always running, I'd like to specify that there is at least X nodes running and those nodes are able to take jobs.

I'm not sure I understand the difference you are specifying?  minimum number of nodes that are always running vs at least X nodes running. They seem to be the same thing.
MinCount is indeed the number of static nodes that are always available to take jobs


Change storage default async to aiohttp

Make aiohttp the default async transport. Import is done locally, so customer can provide their own transport if they want if they donùt have aiohttp installed

(message created by the CI based on PR content)


Fixed leading button size on app bar (#110043)

fix for #109432 in release branch.

we will need to cherry pick 2 more on top of this one. According to the author this is a fix CL and not a revert


[SPARK-45441][PYTHON] Introduce more util functions for PythonWorkerUtils

What changes were proposed in this pull request?
Introduces more util functions for PythonWorkerUtils.
The following util functions will be added:

writePythonFunction
readUTF

Why are the changes needed?
There are more common codes to communicate with the Python worker.
Does this PR introduce any user-facing change?
No.
How was this patch tested?
The existing tests.
Was this patch authored or co-authored using generative AI tooling?
No.

Also cc @dtenedor @WweiL


New version: HTTP v0.8.3

Registering package: HTTP
Repository: https://github.com/JuliaWeb/HTTP.jl
Created by: @quinnj
Version: v0.8.3
Commit: 488fd724df669e3bbc62aa44050019323f2a1967
Reviewed by: @quinnj
Reference: https://github.com/JuliaWeb/HTTP.jl/commit/488fd724df669e3bbc62aa44050019323f2a1967#commitcomment-34146354

Please don't merge. I need to fix something.

Actually, nevermind, merge at will (the breaking is on Julia master (1.3-DEV), not 1.2, so things are ok).


Font-face with comments reduced bad

Hi!
I'm using clean-css with gulp-minify-css
if I have comments like this in @font-face rule:
@font-face {
    font-family: "myfont";
    src: url("../font/myfont.eot"); /* IE9 */
    src: url("../font/myfont.eot?#iefix") format("embedded-opentype"), /* IE6-IE8 */

    url("../font/myfont.woff") format("woff"), /* chrome, firefox */
    url("../font/myfont.ttf") format("truetype"), /* chrome, firefox, opera, Safari, Android, iOS 4.2+ */

    url("../font/myfont.svg#myfont") format("svg"); /* iOS 4.1- */
    font-style: normal;
    font-weight: normal;
}

the generated css is broken like this (I reformatted it back to human-readable):
@font-face {
    font-family: myfont;
    src: url(build/font/myfont.eot);
    src: url(build/font/myfont.eot?#iefix)format("embedded-opentype"),;
    url(build/font/myfont.woff)format("woff"),url(build/font/myfont.ttf)format("truetype"),url(build/font/myfont.svg#myfont)format("svg")font-style: normal;
    font-weight: 400
}

Notice the ,; in the end of line 4. ; Should not be there, it breaks font-face and such font does not work. Removing comments on line 4 helps, but same happens on next line (line 5). Removing comments on line 5 makes this happen on line 6, etc. (untill all comments in font-face declaration are removed)

Please use gulp bound to 3.1.x for now. Fix is coming!

Oh, well, I can't reproduce it locally with the latest 3.2 master:
@font-face{
  font-family:myfont;
  src:url(../font/myfont.eot);
  src:url(../font/myfont.eot?#iefix)format("embedded-opentype"),url(../font/myfont.woff)format("woff"),url(../font/myfont.ttf)format("truetype"),url(../font/myfont.svg#myfont)format("svg");
  font-style:normal;
  font-weight:400
}

Does your code go through any preprocessor?

Yes an no. It's sass which is not parsing css imports, so these imports are left for clean-css to be injected. One of those imports contains this font-face rule.
I'm sorry, I forgot to mention this rule is from imported file. Please try to use via import with {processImport: true}. Actually I use this:
{
			keepSpecialComments: 1,
			relativeTo: './',
			processImport: true
}

Thanks!

No worries at all :) Let me give it a try with an imported file.

Used version is:
$ web /usr/lib/node_modules/gulp-minify-css/node_modules/clean-css # bin/cleancss -v
3.1.9

hmm...
web /usr/lib/node_modules/gulp-minify-css/node_modules/clean-css # cat /tmp/import.css
@import "imported.css";
web /usr/lib/node_modules/gulp-minify-css/node_modules/clean-css # cat /tmp/imported.css
@font-face {
    font-family: "myfont";
    src: url("../font/myfont.eot"); /* IE9 */
    src: url("../font/myfont.eot?#iefix") format("embedded-opentype"), /* IE6-IE8 */

    url("../font/myfont.woff") format("woff"), /* chrome, firefox */
    url("../font/myfont.ttf") format("truetype"), /* chrome, firefox, opera, Safari, Android, iOS 4.2+ */

    url("../font/myfont.svg#myfont") format("svg"); /* iOS 4.1- */
    font-style: normal;
    font-weight: normal;
}
web /usr/lib/node_modules/gulp-minify-css/node_modules/clean-css # bin/cleancss /tmp/import.css
@font-face{font-family:myfont;src:url(../font/myfont.eot);src:url(../font/myfont.eot?#iefix)format("embedded-opentype"),url(../font/myfont.woff)format("woff"),url(../font/myfont.ttf)format("truetype"),url(../font/myfont.svg#myfont)format("svg");font-style:normal;font-weight:400}

Looks like same console version works ok.

Using exact same files with gulp still cause an broken font-face declaration
@font-face{font-family:myfont;src:url(../font/myfont.eot);src:url(../font/myfont.eot?#iefix)format("embedded-opentype"),;url(../font/myfont.woff)format("woff"),url(../font/myfont.ttf)format("truetype"),url(../font/myfont.svg#myfont)format("svg")font-style:normal;font-weight:400}

...format("embedded-opentype") ,;

Ouch, if I use it without import (in main file) the declaration is not even broken, but also cut
@font-face{font-family:"myfont";src:url(../font/myfont.eot);src:url(../font/myfont.eot?#iefix)format("embedded-opentype"),;font-style:normal;font-weight:400}

Hi Oleg,
That's truly puzzling. Since I checked on 3.2.3 I need to do so again on 3.1.9. I'll do later today when I get my hands on a proper device.
Jakub

On 23 Apr 2015, at 13:03, Oleg Stepura<EMAIL_ADDRESS>wrote:
Ouch, if I use it without import (in main file) the declaration is not even broken, but also cut
@font-face{font-family:"myfont";src:url(../font/myfont.eot);src:url(../font/myfont.eot?#iefix)format("embedded-opentype"),;font-style:normal;font-weight:400}
—
Reply to this email directly or view it on GitHub.

@olegstepura would you be able to share the full CSS file with me? I can't reproduce it :/

You can just use the file contents from https://github.com/jakubpawlowicz/clean-css/issues/543#issuecomment-95518500
I've run npm update from inside gulp-minify-css's dir
Npm wrote
<EMAIL_ADDRESS>node_modules/clean-css
├──<EMAIL_ADDRESS><EMAIL_ADDRESS>└──<EMAIL_ADDRESS><EMAIL_ADDRESS>
issue is till there
how can I log currently used version from inside the task? Does CleanCSS class have any property which indicates the current version?

The version no is unfortunately not exposed but it should be the one you upgraded to.
Re file I have more idea so bear with me.

On 24 Apr 2015, at 17:10, Oleg Stepura<EMAIL_ADDRESS>wrote:
You can just use the file contents from #543 (comment)
I've run npm update from inside gulp-minify-css's dir
Npm wrote
<EMAIL_ADDRESS>node_modules/clean-css
├──<EMAIL_ADDRESS><EMAIL_ADDRESS>└──<EMAIL_ADDRESS><EMAIL_ADDRESS>issue is till there
how can I log currently used version from inside the task? Does CleanCSS class have any property which indicates the current version?
—
Reply to this email directly or view it on GitHub.

@olegstepura I can see it now when the comments are different:
@font-face {
    font-family: "myfont";
    src: url("../font/myfont.eot"); /*! IE9 */
    src: url("../font/myfont.eot?#iefix") format("embedded-opentype"), /*! IE6-IE8 */

    url("../font/myfont.woff") format("woff"), /*! chrome, firefox */
    url("../font/myfont.ttf") format("truetype"), /*! chrome, firefox, opera, Safari, Android, iOS 4.2+ */

    url("../font/myfont.svg#myfont") format("svg"); /* iOS 4.1- */
    font-style: normal;
    font-weight: normal;
}

Mystics is that different usage makes bug appear with differemt comments ;)
Did you try using a gulp plugin?


No longer need to force version of Objenesis in Paper's build.gradle.

Kryo 4.0.1 uses the updated Objenesis lib

Fixed in 9436bcb55c273fa953e649fed3dd7f8b6c9cce64


Update Travis integration

Update Travis integration to use scripts from a central repository. This
allows us to apply fixes and improvements to these scripts for all
packages, and also removes some clutter from package repositories.

I have already done this in https://github.com/gap-packages/walrus/commit/19d3d0701b03c86a968016e9c3975c5b7a92daae


Fix/wwwd 2132 2142 multiple videos bugs

Resolves http://vjira2:8080/browse/WWWD-2132 and http://vjira2:8080/browse/WWWD-2142
The way multiple web component classes were previously being created (i.e. by defining/extending them in video.js) was causing the bugs in the above issues.
This PR maintains support for namespacing the web component classes, but simplifies the way the classes are defined.

Tip when reviewing, use the "hide whitespace changes" in the github diff settings to hide all the indent changes:

@remydenton assuming you've tested this out and everything is working as expected, this looks good to me!