jiebi/CodeConvo huggingface dataset:
Code change:
}) } } <ins> func TestConvertToAPIContainerStatusesDataRace(t *testing.T) { pod := podWithUIDNameNs("12345", "test-pod", "test-namespace") testTimestamp := time.Unix(123456789, 987654321) criStatus := &kubecontainer.PodStatus{ ID:        pod.UID, Name:      pod.Name, Namespace: pod.Namespace, ContainerStatuses: []*kubecontainer.Status{ {Name: "containerA", CreatedAt: testTimestamp}, {Name: "containerB", CreatedAt: testTimestamp.Add(1)}, }, } testKubelet := newTestKubelet(t, false) defer testKubelet.Cleanup() kl := testKubelet.kubelet // convertToAPIContainerStatuses is purely transformative and shouldn't alter the state of the kubelet // as there are no synchronisation events in that function (no locks, no channels, ...) each test routine // should have its own vector clock increased independently. Golang race detector uses pure happens-before // detection, so would catch a race condition consistently, despite only spawning 2 goroutines for i := 0; i < 2; i++ { go func() { kl.convertToAPIContainerStatuses(pod, criStatus, []v1.ContainerStatus{}, []v1.Container{}, false, false) }() } } </ins>

Related discussion:
text: /lifecycle rotten
Rotten issues close after 30d of inactivity. Reopen the issue with . Mark the issue as fresh with . Send feedback to sig-contributor-experience at . /close
Closing this issue. <detailsIn response to : Rotten issues close after 30d of inactivity. Reopen the issue with . Mark the issue as fresh with . /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Code change:
mountPath: /device-plugin - name: dev mountPath: /dev <ins> updateStrategy: type: RollingUpdate </ins>

Related discussion:
text: This issue is here to satisfy PR requirements of issue association. A lot of times we need to do version bumps for minor bug fixes that don't deserve a separate issue in the kubernetes/kubernetes repo. /kind bug /sig node
/lifecycle frozen
all the linked PRs are emrged and no activity since more than 3 years /close
Closing this issue. <detailsIn response to : all the linked PRs are emrged and no activity since more than 3 years /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Code change:
{ "ImportPath": "github.com/GoogleCloudPlatform/kubernetes", <del> "GoVersion": "go1.3", </del> <ins> "GoVersion": "go1.4.1", </ins> "Packages": [ "./..." ],

Related discussion:
text: committed a changed version of go into godeps. Was this deliberate? I don't see any discussion of it ( I've almost done this by mistake as well, so I'm inclined to think it was just an oversight. (I think this is giving me errors building, but I'm not yet 100% sure this is the cause)
Hmm, this is a good point. It does look to be accidental. I don't know. I think and would have context though I believe they are out— do you know offhand whether this is probably an accident? I guess were talking specifically about in the .
I believe it's an accident.
Thanks, The linked PR should fix this (assuming I don't have to do anything else with Godeps).
This was almost certainly an accident. Whenever I've updated godeps it's changed automatically to 1.3 and I've had to adjust it back manually.
Actually, jeff lowdermilk was super helpful and showed me how to update the deps on this PR. it was his commit which I merged into my PR, so not sure it it was accidental or not. Fortunately, now that k8petstore is in the go build, we will know if it breaks anything when you revert the version back. Thanks for noticing this. , Alex Robinson wrote:
Code change:
import ( "context" <ins> "fmt" </ins> "time" v1 "k8s.io/api/core/v1"

Related discussion:
text: <!-- Please only use this template for submitting reports about continuously failing tests or jobs in Kubernetes CI --Which jobs are failing: aks-engine-azure-windows-master-containerd-serial-slow Which test(s) are failing: [sig-windows] [Feature:Windows] Kubelet-Stats [Serial] Kubelet stats collection for Windows nodes when running 10 pods should return within 10 seconds Since when has it been failing: Unknown. Testgrid link: Reason for failure: The test spawns 10 pods with the same pod name, which contains multiple containers with the same container name. Because of this, the test fails. Logs: Anything else we need to know:
/sig windows These SIGs are my best guesses for this issue. Please comment if I am incorrect about one. I am a bot run by vllry. ‍
Code change:
func (m *manager) UpdatePodStatus(podUID types.UID, podStatus *v1.PodStatus) { for i, c := range podStatus.ContainerStatuses { <del> var ready bool if c.State.Running == nil { ready = false } else if result, ok := m.readinessManager.Get(kubecontainer.ParseContainerID(c.ContainerID)); ok { ready = result == results.Success } else { // The check whether there is a probe which hasn't run yet. _, exists := m.getWorker(podUID, c.Name, readiness) ready = !exists } podStatus.ContainerStatuses[i].Ready = ready </del> var started bool if c.State.Running == nil { started = false

Related discussion:
text: If I have probe and then all good. Previous version of the pod is terminated after startup probe success, but if wasn't specified the pod becomes ready immediately. It would be nice to add new state (for example starting) which would have pods until a is successful. Also, it would mean that container not ready for connection. Thank you for attention!
/sig cluster-lifecycle
/remove-sig cluster-lifecycle /sig apps try asking in #kubernetes-users on k8s slack.
they are silent in the chat. Who is involved in the development of startup probe?
i think this topic better fits SIG Node. try asking in their channel on slack , but be patient ;) /sig node /remove-sig apps
Those labels are not set on the issue: <detailsIn response to : i think this topic better fits SIG Node. /sig node /remove-sig apps </details
I think this is a feature request, not support, so I changed labels. On its face it SEEMS reasonable, but I am not close enough to the details to say. This is definitely sig-node.
Adding a new pod lifecycle state has been determined to be intractable in the past. Is the proposed change keeping the pod in !Ready until the first success from ?
Where do you usually discuss this? Just wondering. Yes, I want that pod considered not ready until will not be successful. If readiness probe doesn't present then a pod can become ready. How can a pod be ready if it is not running?
how long wait?
Looking at this issue, I can confirm it, at least superficially - a pod with a perma-failing is "ready" if there is no readinessGate defined and "not ready" if it is defined. The question I have is whether we think that is "correct" or not? Initially I thought it was correct, but the more I think about it the less convinced I am. If I have defined a startupProbe and it is not passing, my app should not be ready. Does anyone disagree?
Also, the app should not be ready in status. It's funny, but without a readiness probe, pods in the final state have the status ready and accept requests. This is unexpected.
Whether a pod is ready while terminating is an entirely different question, IMO.
Code change:
func (m *manager) UpdatePodStatus(podUID types.UID, podStatus *v1.PodStatus) { for i, c := range podStatus.ContainerStatuses { <del> var ready bool if c.State.Running == nil { ready = false } else if result, ok := m.readinessManager.Get(kubecontainer.ParseContainerID(c.ContainerID)); ok { ready = result == results.Success } else { // The check whether there is a probe which hasn't run yet. _, exists := m.getWorker(podUID, c.Name, readiness) ready = !exists } podStatus.ContainerStatuses[i].Ready = ready </del> var started bool if c.State.Running == nil { started = false

Related discussion:
text: Apps that server network traffic probably need to "drain" and to do that they need to stay "ready" for a while as upstream LBs de-program. Let's not conflate issues, please.
The fix seems simple - lets see what CI says.
Sorry, I don't spend much time on slack... you could have checked the release notes in 1.18 ;-) Tim's fix seems good, thanks!
/reopen Until we merge all related PRs...
Reopened this issue. <detailsIn response to : /reopen Until we merge all related PRs... Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
All merged. /close
Closing this issue. <detailsIn response to : All merged. /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Code change:
t.Errorf("Invalid content read from cache %q", string(content)) } } <ins> func TestCacheRoundTripperPathPerm(t *testing.T) { assert := assert.New(t) rt := &testRoundTripper{} cacheDir, err := ioutil.TempDir("", "cache-rt") os.RemoveAll(cacheDir) defer os.RemoveAll(cacheDir) if err != nil { t.Fatal(err) } cache := newCacheRoundTripper(cacheDir, rt) // First call, caches the response req := &http.Request{ Method: http.MethodGet, URL:    &url.URL{Host: "localhost"}, } rt.Response = &http.Response{ Header:     http.Header{"ETag": []string{`"123456"`}}, Body:       ioutil.NopCloser(bytes.NewReader([]byte("Content"))), StatusCode: http.StatusOK, } resp, err := cache.RoundTrip(req) if err != nil { t.Fatal(err) } content, err := ioutil.ReadAll(resp.Body) if err != nil { t.Fatal(err) } if string(content) != "Content" { t.Errorf(`Expected Body to be "Content", got %q`, string(content)) } err = filepath.Walk(cacheDir, func(path string, info os.FileInfo, err error) error { if err != nil { return err } if info.IsDir() { assert.Equal(os.FileMode(0750), info.Mode().Perm()) } else { assert.Equal(os.FileMode(0660), info.Mode().Perm()) } return nil }) assert.NoError(err) } </ins>

Related discussion:
text: In kubectl v1.8.0+, schema info is cached in the location specified by (defaulting to ), written with world-writeable permissions (rw-rw-rw-). If is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation. CVSS score: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N (3.3, low) What versions are affected? kubectl v1.8.0+ What configurations are affected? Invocations that point at world-writeable locations Impact Malformed responses written to the cache directory can disrupt the kubectl invocation Workaround Use the default location in the $HOME directory or point it at a directory that is only accessible to desired users/groups. (original description follows) ==== What happened: The files inside of ".kube/http-cache" are world writeable (rw-rw-rw-). While the default for these files appears to be the home directory, using the "--cache-dir" flag could put these files into a place where world writeable files would allow any user / process to modify the cache files. Modification of the cache files could influence the kubectl utility in a negative way for other users. What you expected to happen: Apply stricter file permissions to the http-cache files. How to reproduce it (as minimally and precisely as possible): Run any generic kubectl command which is successful and then list the cache directory $ kubectl get pods --all-namespaces $ ls -la Anything else we need to know?
Code change:
t.Errorf("Invalid content read from cache %q", string(content)) } } <ins> func TestCacheRoundTripperPathPerm(t *testing.T) { assert := assert.New(t) rt := &testRoundTripper{} cacheDir, err := ioutil.TempDir("", "cache-rt") os.RemoveAll(cacheDir) defer os.RemoveAll(cacheDir) if err != nil { t.Fatal(err) } cache := newCacheRoundTripper(cacheDir, rt) // First call, caches the response req := &http.Request{ Method: http.MethodGet, URL:    &url.URL{Host: "localhost"}, } rt.Response = &http.Response{ Header:     http.Header{"ETag": []string{`"123456"`}}, Body:       ioutil.NopCloser(bytes.NewReader([]byte("Content"))), StatusCode: http.StatusOK, } resp, err := cache.RoundTrip(req) if err != nil { t.Fatal(err) } content, err := ioutil.ReadAll(resp.Body) if err != nil { t.Fatal(err) } if string(content) != "Content" { t.Errorf(`Expected Body to be "Content", got %q`, string(content)) } err = filepath.Walk(cacheDir, func(path string, info os.FileInfo, err error) error { if err != nil { return err } if info.IsDir() { assert.Equal(os.FileMode(0750), info.Mode().Perm()) } else { assert.Equal(os.FileMode(0660), info.Mode().Perm()) } return nil }) assert.NoError(err) } </ins>

Related discussion:
text: : I estimate this is a low severity security issue with a CVSS score of "3.3 / CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" - Environment: Linux Kubernetes version (use kubectl version):Client Version: version.Info{Major:"1", Minor:"12", GitVersion:"v1.12.6", GitCommit:"", GitTreeState:"clean", BuildDate:"2019-02-26T12:49:28Z", GoVersion:"go1.10.8", Compiler:"gc", Platform:"linux/amd64"} Server Version: version.Info{Major:"1", Minor:"12", GitVersion:"v1.12.6", GitCommit:"", GitTreeState:"clean", BuildDate:"2019-02-26T12:49:28Z", GoVersion:"go1.10.8", Compiler:"gc", Platform:"linux/amd64"} Cloud provider or hardware configuration: AWS. Running kube api server in hyperkube. OS (e.g: cat /etc/os-release): NAME="CentOS Linux" VERSION="7.1808 (Core)" ID="centos" IDLIKE="rhel fedora" VERSIONID="7" PRETTYNAME="CentOS Linux 7.1808 (Core)" ANSICOLOR="0;31" CPENAME="cpe:/o:centos:centos:7" HOMEURL="" BUGREPORTURL="" CENTOSMANTISBTPROJECT="CentOS-7" CENTOSMANTISBTPROJECTVERSION="7" REDHATSUPPORTPRODUCT="centos" REDHATSUPPORTPRODUCTVERSION="7" OSTREEVERSION=7.1808 Kernel (e.g. uname -a): Linux hackit.internal 3.10.0-862.11.6.el7.x8664 SMP Tue Aug 14 21:49:04 UTC 2018 x8664 x8664 x86_64 GNU/Linux Install tools: Manual installation. Others: n/a
/sig product-security
Closing this issue. <detailsIn response to : if you think this is serious, send an email thanks!
Code change:
t.Errorf("Invalid content read from cache %q", string(content)) } } <ins> func TestCacheRoundTripperPathPerm(t *testing.T) { assert := assert.New(t) rt := &testRoundTripper{} cacheDir, err := ioutil.TempDir("", "cache-rt") os.RemoveAll(cacheDir) defer os.RemoveAll(cacheDir) if err != nil { t.Fatal(err) } cache := newCacheRoundTripper(cacheDir, rt) // First call, caches the response req := &http.Request{ Method: http.MethodGet, URL:    &url.URL{Host: "localhost"}, } rt.Response = &http.Response{ Header:     http.Header{"ETag": []string{`"123456"`}}, Body:       ioutil.NopCloser(bytes.NewReader([]byte("Content"))), StatusCode: http.StatusOK, } resp, err := cache.RoundTrip(req) if err != nil { t.Fatal(err) } content, err := ioutil.ReadAll(resp.Body) if err != nil { t.Fatal(err) } if string(content) != "Content" { t.Errorf(`Expected Body to be "Content", got %q`, string(content)) } err = filepath.Walk(cacheDir, func(path string, info os.FileInfo, err error) error { if err != nil { return err } if info.IsDir() { assert.Equal(os.FileMode(0750), info.Mode().Perm()) } else { assert.Equal(os.FileMode(0660), info.Mode().Perm()) } return nil }) assert.NoError(err) } </ins>

Related discussion:
text: </details
Adjusted the CVSS score to to indicate user interaction is required (since they must specify a non-default cache option pointed at a shared writeable location)
There are two places this should be done: PathPerm and FilePerm should be set here: the temp file and final file should have stricter permissions (probably 0660) here:
/cc
/help
This request has been marked as needing help from a contributor. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /help Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign
/assign I would like to work on release-1.9, as I just made a hot fix for our team's k8s version of 1.9.
GitHub didn't allow me to assign the following users: yuchengwu. Note that only and repo collaborators can be assigned and that issues/PRs can only have 10 assignees at the same time. For more information please see <detailsIn response to : /assign I would like to work on release-1.9, as I just made a hot fix for our team's k8s version of 1.9. Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
help fixing this is welcome, though it would only be fixed in releases 1.12+, per
/label official-cve-feed (Related to kubernetes/sig-security)
Code change:
}) } } <ins> func TestSubnet(t *testing.T) { for i, c := range []struct { desc     string service  *v1.Service expected *string }{ { desc:     "No annotation should return nil", service:  &v1.Service{}, expected: nil, }, { desc: "annotation with subnet but no ILB should return nil", service: &v1.Service{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ ServiceAnnotationLoadBalancerInternalSubnet: "subnet", }, }, }, expected: nil, }, { desc: "annotation with subnet but ILB=false should return nil", service: &v1.Service{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ ServiceAnnotationLoadBalancerInternalSubnet: "subnet", ServiceAnnotationLoadBalancerInternal:       "false", }, }, }, expected: nil, }, { desc: "annotation with empty subnet should return nil", service: &v1.Service{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ ServiceAnnotationLoadBalancerInternalSubnet: "", ServiceAnnotationLoadBalancerInternal:       "true", }, }, }, expected: nil, }, { desc: "annotation with subnet and ILB should return subnet", service: &v1.Service{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ ServiceAnnotationLoadBalancerInternalSubnet: "subnet", ServiceAnnotationLoadBalancerInternal:       "true", }, }, }, expected: to.StringPtr("subnet"), }, } { real := subnet(c.service) assert.Equal(t, c.expected, real, fmt.Sprintf("TestCase[%d]: %s", i, c.desc)) } } </ins>

Related discussion:
text: <!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: When service is set with ILB annotation and empty string subnet, e.g. The service would be pending forever with following error: What you expected to happen: ILB should be provisioned successfully. How to reproduce it (as minimally and precisely as possible): Anything else we need to know?: Environment: Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Others: /sig azure /kind bug /assign
/milestone v1.14 We're entering and this looks relevant to the 1.14 release. Please if I am incorrect
Thanks
Code change:
"fmt" "os" "path/filepath" <ins> "strings" </ins> "time" "github.com/pkg/errors"

Related discussion:
text: <!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --When attempting to upgrade kubernetes using kubeadm upgrade apply, kubeadm fails to parse an etcd imagetag containing build metadata in the form of as a valid semver. An example upgrade produces an error similar to: Note this will occur even if the etcd version is unchanged. The +` character. This pattern is used to support custom kubernetes images, for instance kube-apiserver:v1.20.4+patch.0 will be converted to imagetag v1.20.4_patch.0 when running make quick-release-images. Add the following to kubeadm- Install kubernetes. Then upgrade kubernetes with kubeadm upgrade apply. I have tested a fix for this issue and will PR shortly. Kubernetes version (use ): N/A Cloud provider or hardware configuration: N/A OS (e.g: ): N/A Kernel (e.g. ): N/A Install tools: kubeadm Network plugin and version (if this is a network-related bug): N/A Others: N/A
/sig cluster-lifecycle
/area kubeadm
/triage accepted
Code change:
} // CleanupAdapter deletes Custom Metrics - Stackdriver adapter deployments. <del> func CleanupAdapter(namespace, adapterDeploymentFile string) { stat, err := framework.RunKubectl(namespace, "delete", "-f", adapterDeploymentFile) </del> <ins> func CleanupAdapter(adapterDeploymentFile string) { stat, err := framework.RunKubectl("", "delete", "-f", adapterDeploymentFile) </ins> framework.Logf(stat) if err != nil { framework.Logf("Failed to delete adapter deployments: %s", err)

Related discussion:
text: /kind failing-test <!-- If this is a flake, please add: /kind flake --/sig autoscaling Looks like it just started happening today (@ 2020-09-15 03:54:19 +0000 UTC) !
cc the namespace from the provided object "kube-system" does not match the namespace "horizontal-pod-autoscaling-830". You must pass '--namespace=kube-system' to perform this operation. the namespace from the provided object "custom-metrics" does not match the namespace "horizontal-pod-autoscaling-830". You must pass '--namespace=custom-metrics' to perform this operation. the namespace from the provided object "custom-metrics" does not match the namespace "horizontal-pod-autoscaling-830". You must pass '--namespace=custom-metrics' to perform this operation.
related fix:
No I don't think that's the fix for this (that is just a little cleanup). Actually I think we have to delete namespace parameter in line : Because before , the will have no actually effect. But now with the change of , it will have namespace : at the end of the command. But the namespace in yaml file is which is different from . We should not have parameter when applying from file because this test didn't have before, right? Related PR:
/assign
Code change:
internalapi "k8s.io/cri-api/pkg/apis" apitest "k8s.io/cri-api/pkg/apis/testing" fakeremote "k8s.io/kubernetes/pkg/kubelet/cri/remote/fake" <ins> "k8s.io/kubernetes/pkg/kubelet/cri/remote/util" </ins> ) const (

Related discussion:
text: Which jobs are flaking: periodics-kubernetes-bazel-test Which test(s) are flaking: //pkg/kubelet/cri/remote TestVersion Testgrid link: Reason for failure: Error: Received unexpected error: rpc error: code = Unavailable desc = transport is closing panic: runtime error: invalid memory address or nil pointer dereference [recovered] panic: runtime error: invalid memory address or nil pointer dereference Anything else we need to know: To reproduce with stress: go test -race -c ./pkg/kubelet/cri/remote stress - TestVersion Detailed logs
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig testing
I 'll give it a see and fix it :)
/assign
/remove-sig testing SIG node owns their unit tests. SIG testing owns the framework, infrastructure, etc.
/sig node
Code change:
* [Example of dynamic updates](examples/update-demo/README.md) * [Cluster monitoring with heapster and cAdvisor](https://github.com/GoogleCloudPlatform/heapster) * [Community projects](https://github.com/GoogleCloudPlatform/kubernetes/wiki/Kubernetes-Community) <del> * [Development guide](docs/development.md) </del> <ins> * [Development guide](docs/devel/development.md) </ins> Or fork and start hacking!

Related discussion:
text: Right now, we have a mixture of user documentation and developer documentation in the top-level directory. We should make it easier to find a just user documentation. Step 1 would be to move developer documentation into a subdir like docs/development or something like that. User docs would stay in the top-level docs dir.
move to