Im working on a policy that dictates that a kaniko image must always run on a nodePool kaniko-nodepool.
If a kaniko image is deployed anywhere else, it will be a violation. Im using a combination of container image and nodeSelector to enforce the policy
My policy works well https://play.openpolicyagent.org/p/GOJNyAF5TW .
Change input.review.object.spec.nodeSelector.pool to cause the violation
The only issue remaining is that what if the pod has no nodeSelector and the image being deployed is kaniko, a violation should occur too.
So I added
not input.review.object.spec.nodeSelector
meaning if there is no nodeSelector, that should be true for a violation. Once I remove the whole nodeSelector part, it does not cause a violation.
https://play.openpolicyagent.org/p/AuhepivPHN
Clicking on coverage shows that none of the lines are being processed.
Is there something im missing here ?
I tried a few combos myself..
Based on the documentation here,
not obj.foo.bar.baz checks if paths foo.bar.baz, or foo.bar or foo does not exist.
In your case, input.review.object.spec will always exist .. so, the not input.review.object.spec.nodeSelector might not be the best option.
What I tried was here
i.e. throw a violation if
pool is wrong OR
nodeSelector is missing ..
Let me know if this helps.
Related
In the AWS CDK, it's straight forward to create a Pinpoint Service. But how do you get the Project ID (also referred to as the Pinpoint App ID or Application ID) for use in subsequent CDK code.
Create a Pinpoint project:
const pinpointProject = new pinpoint.CfnApp(this, 'PinpointNotificationProject', {
name: 'myProject',
});
In the AWS CloudFormation docs it says:
"When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the unique identifier (ApplicationId) for the Amazon Pinpoint application."
However, the following CDK code returns the project name not the id. The value of logicalId = myProject.
cdk.Fn.ref(pinpointProject.logicalId); // This returns 'myProject'
pinpointProject.ref; // This also returns 'myProject'
This is confirmed fixed in the latest CDK version 1.130.0. The ref property now returns the Pinpoint ProjectId.
The problem you are running into is that pinpoint is not a finished module. You can see this that all the functions within are prefixed with Cfn - cloudformation. This means that they are barebones and not tied into all the interface hooks that the rest of CDK is making use of to toss things around.
First, the logical ID is NOT the project name. the Logical Id is part of the Cloudformation Template that is generated for any resource Cloudformation is going to stand up. It links the given resource to the stack, so that any changes under the same logical id will be applied to the same stood up resource. It is only referenced internally to the cloudformation stack and never known outside. CDK uses the LogicalID to generate the name of the resource if you do not specify one.
Second, Taking a look at the documentation shows that CfnApp has the following property: attrArn. Meaning in your code, you would reference this by pinpointProject.attrArn - the arn of a pinpoint resource is something like: arn:aws:mobiletargeting:region:accountId:apps/projectId. with, as you guessed it, the projectId as the last value. you can split the string and get that value out, or use the arn manipulation methods provided as part of the core module to extract what you need.
Finally, even though the Pinpoint module is pretty much just barebones, it may still be possible to pass the variable storing your Pinpoint Construct Object to whatever other resource requires it. I say may because, as mentioned, most of the Cfn prefixed functions do not have the proper hooks to do this well - but some do, and Ive never worked with Pinpoint directly.
I recommend spending some time to understand how the CDK Documentation is laid out. Its bare bones in places, but once you understand how they structured it, these kinds of questions are readily answered within.
Context
So I finally give a try to Fish, and as one would expect I encounter some frictions due to differences with my usual routines.
The most astonishing for me, as for many other, was the absence of the bang operator. I'm fine with the lose of sudo !!, as the suggested function replacement seems even better to me, I named it gar which means "To make, compel (someone to do something); to cause (something to be done." However I'll need a replacement for !<abc><enter> which grab the last history line starting with <abc> and run it without further ado, suggestions are welcome.
Now, for the more personal things:
- I use a Typematrix 2030 keyboard
- I use a bépo layout
- I like to configure default finger position keys with the most used actions
Aims
As on my keybord <enter> is well positioned and is semantically relevant for that, ideally I would like to achieve the following key binding:
ctrl-enter: accept the whole suggestion and run it without further confirmation
ctrl-tab: accept the whole suggestion and wait for further edit
alt-enter: redo the last command without further confirmation
But according to xev it appears that, at least with Gnome-terminal, this combinations are not recognized. Are they terminal that supports it? For now I remapped these three to <ctrl>-i, <alt>-i and <alt>-I respectively:
bind --preset \ci forward-char execute
bind --preset \ei forward-char
bind --preset \eI forward-word
This works as expected, but it seems that now the tab key will also map to the first item. I guess that tab map to <alt>-i at some point in the shell stack. I wasn't aware of that, so I don't know yet if it will be possible for Fish to separate each of them.
To manage jobs, I also came with
bind --preset \es fg
bind --preset \eS bg
The first works as expected, but the second one doesn't. With application like vim, the binding should be operated in the application configuration itself of course. But for things as trivial as yes, <alt>-S won't work as expected while <crl>-z continue to operate normally.
I also would like to bind some commands like ls -alh and git status --short to a directly executed command, showing the result bellow the currently edited line, allowing to further type seamlessly, but didn't find the way to do it yet.
Summary of remaining question
So here are my more precise questions summarised:
how do I bind the sleep signal to <alt>-S?
is there a terminal I can use where <alt>-<enter> and <ctrl>-<enter> works?
how to seamlessly run command while maintaining the current line edition in place?
can you bind something to <alt>-i without altering <tab>?
how do I bind the sleep signal to -S?
What you are doing with bind \es fg is to alter a binding inside the shell.
But when you execute yes, the shell isn't currently in the foreground, so shell bindings don't apply.
What you'd have to do instead is change the terminal settings via stty susp \cs,
but fish resets the terminal settings when executing commands (so you can't accidentally break them and end up in an unusable environment), so there currently is no way to do this in fish.
can you bind something to <alt>-i without altering <tab>?
Sure. You bind \ei. Which is escape+i, which is alt-i (because in a terminal alt is escape).
Your problem is with ctrl-i, which in the way terminals encode control+character is tab. The application receives an actual tab character, and at that point the information has been lost.
is there a terminal I can use where - and - works?
Most terminals should send \e\r for alt-enter. ctrl-enter again is unencodable with the usual code (because \r is ctrl-m), just like ctrl-tab is.
Any fix to this requires the terminal to encode these combination differently.
how to seamlessly run command while maintaining the current line edition in place?
I don't know what you mean by this. I'm guessing you want fish to remain open and editable while a command also runs in the foreground. That can't work. There's no way to synchronize output from two commands to a terminal, not with cursor movement being what it is.
I run neo4j Version: 3.3.2 in a docker container and tried to configure a default style as described above.
Grass file is accessible via HTTP (http://somedomain.com/resources/style.grass)
CORS rules are set
Command added to config: browser.post_connect_cmd=style http://somedomain.com/resources/style.grass
When i start my container with this config and run match (n) return n i see nothing.
Then i run :style http://somedomain.com/resources/style.grass and it works... Why?
That leads me to conclude that the grass file ifself (content) and the accessible of this file are not the problem.
It seems that there is an error with the default style configuration.
Do you have any tips to debug this? The logs are clean.
I found the problem. We added this property at the end of the neo4j.conf. After startup neo4j reorder the properties, put it at the 2nd place and accidentally add the 3rd property at the end of the 2nd, so that it’s not valid. We put it manually at the 2nd place and now it works.
There is something that is not completely clear to me on hydra. The following jobset:
{ nixpkgs ? import <nixpkgs>
{ config.allowUnfree = true;
config.allowBroken = true;
}
, my_package ? path/to/package/default.nix ## working expr
}:
let
jobs = {
jobA = import ../path/to/jobA/default.nix {inherit my_package;};
};
in
jobs
with 2 build inputs:
ciSrc
nixpkgs
evaluates without errors, and then is built.
BUT, when I change the working expr to:
my_package ? import <my_package> ## problematic expr
and add a third build input:
my_package, Local Path, path/to/package/default.nix
I get the following error:
hydra-eval-jobs returned exit code 1:
error: undefined variable 'foo' at /nix/store/somehash-my_package/.../default.nix:61:11
(use '--show-trace' to show detailed location information)
Why do I get it? what am I missing here?
My NIX_PATH contains both <nixpkgs> that works, and <my_package>, which isn't. This is the only change i did that produces the error.
btw both versions are built by nix-build, as recommended by the hydra-manual
on the same machine and by the same user that the hydra uses.
can anyone please shed light on it?
I doubt that the undefined variable error message is directly caused by swapping the build inputs. It's more likely that the problem has been lurking for a while but never triggered, and swapping the inputs like this has caused it to surface. If that's the case, it's impossible to say what's causing the problem since you've stripped out all of the relevant information. To get better help in the future, I suggest that you post a minimal, complete example of code which encounters this problem. What you've posted is indeed minimal, but it's incomplete (the problem seems to be with package/default.nix, which you haven't included), and also doesn't look like code which encounters this problem (based on things like somehash, path/to/package, etc. I imagine that running this code would hit a syntax error first).
All we know is that a variable has been used without an accompanying binding. Your error message says that the variable is called foo, but I assume that's not the real name. Given this scant information, I would guess that the problem is in your package/default.nix file.
There are a few gotchas to keep in mind with paths in Nix:
Path values used by a derivation (like /tmp/project/foo.nix) will be copied to the Nix store and those values (e.g. /nix/store/...-foo.nix) will be used instead of the original path. This can break relative paths, e.g. if foo.nix references ./bar.nix, then the latter will resolve to /nix/store/bar.nix which doesn't exist. This can be managed by getting the directory added to the store, e.g. "${/tmp/project}/foo.nix".
String values, like "/tmp/project/foo.nix", do not cause things to be copied into the store.
It's easy for calculations to turn paths into strings, but hard to keep them as paths. One useful trick is to use + with a path as the first argument, e.g. /tmp + "/project" will produce the path /tmp/project. We can use this with "/.." to go up a level. As an extreme case, we can convert a string containing an absolute path to a path value by doing e.g. with { myString = "/foo/bar"; }; /tmp + "/..${myString}", which will give the path /tmp/../foo/bar which resolves to /foo/bar.
When a mutable local path gets inserted into the Nix store, it's only an immutable "snapshot". If the contents are changed later, it can be a little unpredictable whether the old, cached snapshot will be used or whether a new snapshot will be made. For this reason, it's important to look at the paths given in error messages, e.g. take a look at /nix/store/...-project/foo.nix rather than /tmp/foo.nix, since they may not contain the same thing.
I am trying to create a setup project for a Windows Service. I've followed the directions at http://support.microsoft.com/kb/816169 to create the setup project with no trouble.
I want to be able to get a value during the installation in order to update the app.config with the user's desired settings. I added a Textboxes (A) dialog to retrieve the values. I set the Edit1Property property to "TIMETORUN", and in my Primary Output action's CustomActionData property I put in the following: /TimeToRun="[TIMETORUN]\". So far so good. Running the setup I can retrieve the TimeToRun value from the Context.Parameters collection without issue.
In order to locate the app.config I need to also pass in the value of the TARGETDIR Windows Installer Property to my custom action. This is where things begin to fall apart. In order to achieve this, the above CustomActionData must be altered like so: /TimeToRun="[TIMETORUN]\" /TargetDir="[TARGETDIR]\". Now when I run the setup I get the following error message:
Error 1001. Exception occurred while initializing the installation.
System.IO.FileNotFoundException: Could not load file or assembly 'file:///C:\Windows\SysWOW64\Files' or one of its dependencies. The system cannot
find the file specified.
If you google this problem you will inevitably find people having tremendous success by simply adding the trailing slash to the /TargetDir="[TARGETDIR]\" portion of the CustomActionData. This unfortunately does not solve my issue.
I tried so many different variations of the CustomActionData string and none of them worked. I tried logging to a file from my overridden Install method to determine where the breakage was, but no log file is created because it's not even getting that far. As the error indicates, the failure is during the Initialization step.
I have a hunch that it could be one of the dependencies that the setup project is trying to load. Perhaps somehow something is being appended to the CustomActionData string and isn't playing well with the TARGETDIR value (which contains spaces, i.e. "C:\Program Files\My Company\Project Name"). Again, this is another hunch that I cannot seem to confirm due to my inability to debug the setup process.
One further thing to mention, and yes it's another hunch, could this be an issue with Setup Projects on 64-bit version of Windows? I'm running Windows 7 Professional.
I'll provide names of the dependencies in case it helps:
Microsoft .NET Framework
Microsoft.SqlServer.DtsMsg.dll
Microsoft.SqlServer.DTSPipelineWrap.dll
Microsoft.SqlServer.DTSRuntimeWrap.dll
Microsoft.SQLServer.ManagedDTS.dll
Microsoft.SqlServer.msxml6_interop.dll
Microsoft.SqlServer.PipelineHost.dll
Microsoft.SqlServer.SqlTDiagM.dll
As you may glean from the dependencies, the Windows Service is scheduling a call to a DTSX package.
Sorry for the long rant. Thanks for any help you can provide.
The answer is so maddeningly simple. If the last argument in the CustomActionData is going to contain spaces and thus you have to surround it with quotes and a trailing slash, you must also have a space following the trailing slash, like this:
/TimeToRun="[TIMETORUN]\" /TargetDir="[TARGETDIR]\ "
The solution and explanation can be found here.
Had a similar issue. In my case, it was odd because my installer had ran successfully once, then I uninstalled my app via Add/Remove Programs successfully, did some coding (did NOT touch my CustomActionData string), and rebuilt my project and setup project. It was when I re-ran my MSI that I got this error.
The coding I had done was to bring in more values of more parameters I had been specifying in my CustomActionData string. That syntax for getting the parameter values (i.e. string filepath = Context.Paramenters["filepath"]), which was in my Installer class, was actually fine, but as I found out, the syntax of the later parameters I was now trying to get from my CustomActionData string had not been correct, from the very beginning. I had failed to add a second quote around one of those parameters, so nothing else could be obtained.
I was using the "Textboxes (A)" and "Textboxes (B)" windows in the User Interface section. A has 1 box, EDITA1, where I get the path to a file, and B has 2 boxes, EDITB1 and EDITB2, for some database parameters. My CustomActionData string looked like this:
/filepath="[EDITA1]" /host="[EDITB1] /port="[EDITB2]"
It should have been:
/filepath="[EDITA1]" /host="[EDITB1]" /port="[EDITB2]"
(closing quote on [EDITB1])