jiebi/CodeConvo huggingface dataset:
Change:
return PodAdmitResult{Admit: true} } <del> // Always admit for remote runtime. if a.Runtime.Type() == kubetypes.RemoteContainerRuntime { </del> <ins> // Always admit runtimes except docker. if a.Runtime.Type() != kubetypes.DockerContainerRuntime { </ins> return PodAdmitResult{Admit: true} } <del> // Make sure it is either docker or rkt runtimes. if a.Runtime.Type() != kubetypes.DockerContainerRuntime && a.Runtime.Type() != kubetypes.RktContainerRuntime { </del> <ins> // Make sure docker api version is valid. rversion, err := a.Runtime.APIVersion() if err != nil { </ins> return PodAdmitResult{ Admit:   false, Reason:  "NoNewPrivs", <del> Message: fmt.Sprintf("Cannot enforce NoNewPrivs: %s runtime not supported", a.Runtime.Type()), </del> <ins> Message: fmt.Sprintf("Cannot enforce NoNewPrivs: %v", err), </ins> } } <del> if a.Runtime.Type() == kubetypes.DockerContainerRuntime { // Make sure docker api version is valid. rversion, err := a.Runtime.APIVersion() if err != nil { return PodAdmitResult{ Admit:   false, Reason:  "NoNewPrivs", Message: fmt.Sprintf("Cannot enforce NoNewPrivs: %v", err), } } v, err := rversion.Compare("1.23.0") if err != nil { return PodAdmitResult{ Admit:   false, Reason:  "NoNewPrivs", Message: fmt.Sprintf("Cannot enforce NoNewPrivs: %v", err), } </del> <ins> v, err := rversion.Compare("1.23.0") if err != nil { return PodAdmitResult{ Admit:   false, Reason:  "NoNewPrivs", Message: fmt.Sprintf("Cannot enforce NoNewPrivs: %v", err), </ins> } <del> // If the version is less than 1.23 it will return -1 above. if v == -1 { return PodAdmitResult{ Admit:   false, Reason:  "NoNewPrivs", Message: fmt.Sprintf("Cannot enforce NoNewPrivs: docker runtime API version %q must be greater than or equal to 1.23", rversion.String()), } </del> <ins> } // If the version is less than 1.23 it will return -1 above. if v == -1 { return PodAdmitResult{ Admit:   false, Reason:  "NoNewPrivs", Message: fmt.Sprintf("Cannot enforce NoNewPrivs: docker runtime API version %q must be greater than or equal to 1.23", rversion.String()), </ins> } }

Discussion:
I tried to add the support for , but the always failed with the error print: I checked the code of k8s, and found that "NoNewPrivs" is admitted only if the runtime is docker or rkt in kubelet. Related code is as follows: Maybe we should define a interface to get the capability of "NoNewPrivs" form runtime-shim.
There are no sig labels on this issue. Please by: a sig: e.g., to notify the contributor experience sig, OR the label manually: e.g., to apply the label Note: Method 1 will trigger an email to the group. You can find the group list and label list . The in the method 1 has to be replaced with one of these: bugs, feature-requests, pr-reviews, test-failures, proposals
/sig node
Sent to fix this. Thanks for finding this out!
Change:
convert_api_ServiceSpec_To_v1_ServiceSpec, convert_api_ServiceStatus_To_v1_ServiceStatus, convert_api_Service_To_v1_Service, <del> convert_api_StatusCause_To_v1_StatusCause, convert_api_StatusDetails_To_v1_StatusDetails, </del> convert_api_Status_To_v1_Status, convert_api_TCPSocketAction_To_v1_TCPSocketAction, convert_api_TypeMeta_To_v1_TypeMeta,

Discussion:
When accessing a non existing entity (example - namespace), the message specifies the requested field as 'id', but it should be 'name'. Example (see the details section) { "kind": "Status", "apiVersion": "v1beta3", "metadata": {}, "status": "Failure", "message": "namespaces "staging" not found", "reason": "NotFound", "details": { "id": "staging", "kind": "namespaces" }, "code": 404 }
Yes. We should rename "id" to "name" in StatusDetails: Not sure if we can change v1beta3 API now. cc
You can add a new field and fill in both, and MAYBE remove ID in v1 , Nikhil Jindal wrote:
I suggest we fix it at most in v1 only. This is an annoying wart, but we could just fix the description string for now.
If trivial, we should fix v1.
Change:
"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp" semconv "go.opentelemetry.io/otel/semconv/v1.17.0" "go.opentelemetry.io/otel/trace" <ins> "k8s.io/apiserver/pkg/endpoints/request" </ins> tracing "k8s.io/component-base/tracing" )

Discussion:
When enable apiserver tracing, the webhook request spans only show spanName as /, mostly because use http request operations as default span name, which is hard to understand. ! Following the open-telemetry standard of spanName, it's recommended to use as spanName. ! SpanName of webhook request should be , like ! APIServerTracing feature gates of apiserver a pod tracing dashboard No response <details18 </details<detailsNone </details<details</details<details</details<details</details<details</details
I make a fix for this.
/sig api-machinery instrumentation
Do you know if this is fixed in later versions of opentelemetry?
/triage accepted /assign
Looks like might be related
not yet, I think we can fix this in otel upstream, but it's hard to backport to otel , which is the version of otel used in Kubernetes
Good point. It think fixing it here is a good idea in that case.
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
/remove-lifecycle stale
could I take on this issue?
yes. Feel free to work on this.
! I test locally by 1.29 kubernetes and start a sample webhook, looks like the client span has already conforms to semantic conventions , which should be in the form of "HTTP {METHODNAME}"
! For apiserver as a server, now the spanName is still KubernetesAPI, which I think we could enhance it into "HTTP get_account/{accountId}" format
After digging for a while, I found one solution to implement this, I draft this idea in , could you help review about whether this is a correct way to implement it?
Change:
if err != nil { log.Fatalf("Unable to create client; error: %vn", err) } <del> // Double check that worked by getting the server version. if v, err := client.Discovery().ServerVersion(); err != nil { log.Fatalf("Unable to get server version: %vn", err) } else { log.Printf("Server version: %#vn", v) </del> <ins> // Try to get the server version until <timeout>; we use a timeout because // the pod might not have immediate network connectivity. for start := time.Now(); time.Since(start) < timeout; time.Sleep(sleepTime) { // Double check that worked by getting the server version. if versionInfo, err = client.Discovery().ServerVersion(); err != nil { log.Printf("Unable to get server version: %v; retrying.n", err) } else { log.Printf("Server version: %#vn", versionInfo) break } time.Sleep(1 * time.Second) } if err != nil { log.Fatalf("Unable to contact Kubernetes: %vn", err) </ins> } for start := time.Now(); time.Since(start) < timeout; time.Sleep(sleepTime) {

Discussion:
<!-- Please only use this template for submitting reports about failing tests in Kubernetes CI jobs --Which jobs are failing: N/A Which test(s) are failing: [] [sig-node] PreStop should call prestop when killing a pod [Conformance] Since when has it been failing: N/A Testgrid link: N/A Reason for failure: When spawning a Pod, it's container might start before all its networking plumbing has been completed. Thus, if the container tests / needs its network connectivity, it mgiht fail. The ` image tries to connect to the Kubernetes API, but if it cannot, the Pod will end up in an Error state. Retrying the Kubernetes API connection will avoid this issue. Anything else we need to know:
/sig node
/remove-sig node /sig testing
Change:
return resultValue.Interface().(error) } <del> args := []reflect.Value{reflect.ValueOf(obj), reflect.ValueOf(options)} results := handler.printFunc.Call(args) </del> if results[1].IsNil() { rows := results[0].Interface().([]metav1alpha1.TableRow) printRows(output, rows, options) return nil } return results[1].Interface().(error) } // printRows writes the provided rows to output.

Discussion:
<!-- This form is for bug reports and feature requests ONLY! If you're looking for help check and the . --Is this a BUG REPORT or FEATURE REQUEST?: What happened: 1when error has occurwe should not print header 2 when i get ns use --all-namespaces, i get NAMESPACE column, we should return error: storageclass is not namespaced What you expected to happen: How to reproduce it (as minimally and precisely as possible): Anything else we need to know?: Environment: Kubernetes version (use ): Cloud provider or hardware configuration**: OS (e.g. from /etc/os-release): Kernel (e.g. ): Install tools: Others:
/assign
/sig cli
Change:
gomega.BeTemporally(">=", time.Now().Add(-maxStatsAge)), // Now() is the test start time, not the match time, so permit a few extra minutes. gomega.BeTemporally("<", time.Now().Add(2*time.Minute))), <del> )})) </del> <ins> ), "Histogram": gstruct.Ignore(), })) </ins> }

Discussion:
There's been a quite a few failures across jobs that query node metrics. The test is Last passing - First failing - appears to point to which is bump in prometheus client library. Possibly related? /kind failing-test <!-- If this is a flake, please add: /kind flake --/sig node
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Verified with presubmit that reverting the prometheus client library results in the test passing. Opened PR for revert in
/cc
/assign
thanks for filing this issue! I think seems like a promising fix (thanks ) and there's a fair chance we won't need the revert
ack, thanks for the fix, it seems we can go with that then and hold the revert.
Change:
terminationGracePeriodSeconds: 600 hostNetwork: true containers: <del> - image: gcr.io/k8s-ingress-image-push/ingress-gce-glbc-amd64:v1.20.1 </del> <ins> - image: gcr.io/k8s-ingress-image-push/ingress-gce-glbc-amd64:v1.23.1 </ins> livenessProbe: httpGet: path: /healthz

Discussion:
master-informing gce-master-scale-correctnessKubernetes e2e suite.[It] [sig-network] Services GCE [Slow] should be able to create and tear down a standard-tier load balancer [Slow] ! 2023-05-24 10:01 PDT Kubernetes e2e suite: [It] [sig-network] Services GCE [Slow] should be able to create and tear down a standard-tier load balancer [Slow] No response /sig scalability cc
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig network
Ok, checking job Download controller-manager logs There are these errors already reported in but that doesn't seem the problem This is weird does this ring a bell? ^^
It seems to be a flake which is passed in the last run.
Yes, I see the last run Green; so closing this as of now! Will re-open it if this will be a release blocker.
/reopen
Reopened this issue. <detailsIn response to : /reopen Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
This seems like a flaky test. It has failed multiple times: cc
/remove-kind failing-test /kind flake
The load balancer tkes a lot of time to be provisioned and the test times out I'm going to bump the ingress-gce version used on the test because is too old and has some performance improvements that can solve this issue
/reopen we need to be completely sure this address the problem, it has to get at least 5/5 consecutive greens
Reopened this issue. <detailsIn response to : /reopen Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository.

</details
It failed again:
Checking last occurrence we can find the logs on the kube-controller-manager So, the problem is that the time to acquire the IP takes too much, the test times out at and the IP is at IIUIC this depends on the underlay infra, what do we want to do with this, bump the timeout of the LB?
/assign
Update on the state of failures. The failures are becoming more frequent: !
Unfortunately I think bumping the timeout is our only option.
can you send a PR to move to 1 hours and add a comment referencing this issue?
Just created
CI is green since 06-27. /close
Closing this issue. <detailsIn response to : CI is green since 06-27. /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Change:
}, expected: TopologyHint{ NUMANodeAffinity: NewTestBitMask(numaNodes...), <del> Preferred:        true, </del> <ins> Preferred:        false, </ins> }, }, {

Discussion:
What happened: I think I'm seeing a problem with the topology manager. I have two numa nodes, 22 cores per node. Kubelet has "--cpu-manager-policy=static --topology-manager-policy=single-numa-node ", and when I try to create a simple pod with 3 cpus and 500Mi of RAM in the guaranteed class it fails. Describing the pod gives "Resources cannot be allocated with Topology Locality", but I know there's lots of CPU and RAM available on both NUMA nodes. I'm instrumenting the topology manager kubelet code, currently there's not enough debug logs to actually be able to tell what's going wrong. What you expected to happen: I expect the pod container to be created on one or the other numa node and get allocated exclusive CPUs (via the static policy) on that NUMA node, and be affined to those CPUs. How to reproduce it (as minimally and precisely as possible): On a kubernetes node with multiple NUMA nodes, enable kubelet with static cpu manager policy and single-numa-node topology manager policy. Try to create a basic pod with a single container in the guaranteed QoS class. Anything else we need to know?: Environment: Kubernetes version (use ): sysadmin chris(keystoneadmin)]$ kubectl version Client Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.0", GitCommit:"", GitTreeState:"archive", BuildDate:"2019-10-09T05:41:44Z", GoVersion:"go1.12.9", Compiler:"gc", Platform:"linux/amd64"} Server Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.0", GitCommit:"", GitTreeState:"clean", BuildDate:"2019-09-18T14:27:17Z", GoVersion:"go1.12.9", Compiler:"gc", Platform:"linux/amd64"} Cloud provider or hardware configuration: wildcat pass hardware, 22 cores per NUMA node, two NUMA nodes. 64GB RAM per NUMA node. OS (e.g: ): CentOS 7 Kernel (e.g.

): 3.10.0-
Reiterating the mentions to trigger a notification: <detailsIn response to : Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
oops, I thought the "close" meant the comment, not the whole issue. :)
I was able to reproduce this issue. The following (new) uint test in fails unexpectedly: With any policy other than the this test passes. This is due to 3 factors: 1) The CPUManager is the only hint provider passing actual valid hints 2) The devicemanager passes back as its hints, resulting in a single (i.e. don’t care) hint 3) We a special casing for the in the device manager that essentially turns the devicemanager's hint into a : Because the single hint from the devicemanager now has a preference, there is no chance to have it combine with any of the CPUManager hints to result in a successful hint. This should ultimately be addressed as part of the following in 1.17 But we should put a one-off patch into the 1.16.x branch to fix this in 1.16.
ptal
I've just updated with my observations. can you have a look and comment ?
Change:
- apiGroups: - apps resources: <ins> - controllerrevisions </ins> - daemonsets - deployments - deployments/scale

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks!--What happened: User has role binding to in the namespace. What you expected to happen: To roll back successfully. How to reproduce it (as minimally and precisely as possible): A 1.10 cluster (haven't tested 1.11 but I suspect it's the same) and a 1.12 Anything else we need to know?: It seems that the built in and clusterroles don't cover , which is needed in =1.12 for to interact with revision history? Environment: Kubernetes version (use ):Install tools: Self-written ansible roles <!-- DO NOT EDIT BELOW THIS LINE --/kind bug /sig auth /sig cli /sig apps
opened and picks to 1.10, 1.11, 1.12
Change:
import ( dockertypes "github.com/docker/engine-api/types" <ins> dockercontainer "github.com/docker/engine-api/types/container" </ins> "k8s.io/kubernetes/pkg/api" <ins> kubecontainer "k8s.io/kubernetes/pkg/kubelet/container" </ins> ) <ins> // These two functions are OS specific (for now at least) func updateHostConfig(hc *dockercontainer.HostConfig, opts *kubecontainer.RunContainerOptions) { // no-op, there is a windows implementation that is different. } func DefaultMemorySwap() int64 { return 0 } </ins> func getContainerIP(container *dockertypes.ContainerJSON) string { result := "" if container.NetworkSettings != nil {

Discussion:
What happened: Latest kubelet + Windows Docker version 1.14.0-dev refused to start any containers, error output: "invalid option: Windows does not support MemorySwap" How to reproduce it (as minimally and precisely as possible): It's always reproducible with Windows Docker 1.14.0-dev + latest kubelet code base. Anything else do we need to know: It didn't happen for Windows Docker 1.12.2-cs2-ws-beta. The reason behind the issue was because new code was for Windows Docker to check Resources parameters, it doesn't accept a non-zero value for MemorySwap: But kubelet was default to set an unlimited (-1) value. The issue was gone in my setup after applied a private fix to disable MemorySwap by set it to zero for Windows.
Change:
package metrics import ( <ins> "testing" </ins> "github.com/blang/semver" "github.com/prometheus/client_golang/prometheus" "github.com/stretchr/testify/assert" apimachineryversion "k8s.io/apimachinery/pkg/version" <del> "testing" </del> ) var (

Discussion:
The metrics framework requires the ability to optionally display hidden (deprecated) metrics. A boolean needs to be piped through the registry (possibly at initialization or possibly set later) which then needs to be passed to the Create function so that we can determine whether we need to actually create the metric. /sig instrumentation
Change:
CROSS_BUILD_COPY qemu-QEMUARCH-static /usr/bin/ <del> RUN apt-get update && apt-get install -y --no-install-recommends stress &&  rm -rf /var/lib/apt/lists/* </del> <ins> RUN clean-install stress </ins> ADD consumer /consumer ADD consume-cpu /consume-cpu

Discussion:
<!-- This form is for bug reports and feature requests ONLY! If you're looking for help check and the . --Is this a BUG REPORT or FEATURE REQUEST?: /kind bug What happened: BASEIMAGE for resource-consumer was ubuntu before and there is a ask for migrating to debian via - What you expected to happen: Use debian-base as BASEIMAGE for resource-consumer test image How to reproduce it (as minimally and precisely as possible): Anything else we need to know?: Environment: Kubernetes version (use ): Cloud provider or hardware configuration**: OS (e.g. from /etc/os-release): Kernel (e.g. ): Install tools: Others:
/assign
There are no sig labels on this issue. Please by: a sig: e.g., to notify the contributor experience sig, OR the label manually: e.g., to apply the label Note: Method 1 will trigger an email to the group. You can find the group list and label list . The in the method 1 has to be replaced with one of these: bugs, feature-requests, pr-reviews, test-failures, proposals
/sig testing
Change:
gomega.Expect(result.Code).To(gomega.Equal(0)) } <del> ginkgo.By("Check node-problem-detector can post conditions and events to API server") for _, node := range nodes { ginkgo.By(fmt.Sprintf("Check node-problem-detector posted KernelDeadlock condition on node %q", node.Name)) gomega.Eventually(ctx, func() error { return verifyNodeCondition(ctx, f, "KernelDeadlock", v1.ConditionTrue, "DockerHung", node.Name) }, pollTimeout, pollInterval).Should(gomega.Succeed()) ginkgo.By(fmt.Sprintf("Check node-problem-detector posted DockerHung event on node %q", node.Name)) eventListOptions := metav1.ListOptions{FieldSelector: fields.Set{"involvedObject.kind": "Node"}.AsSelector().String()} gomega.Eventually(ctx, func(ctx context.Context) error { return verifyEvents(ctx, f, eventListOptions, 1, "DockerHung", node.Name) }, pollTimeout, pollInterval).Should(gomega.Succeed()) if checkForKubeletStart { // Node problem detector reports kubelet start events automatically starting from NPD v0.7.0+. // Since Kubelet may be restarted for a few times after node is booted. We just check the event // is detected, but do not check how many times Kubelet is started. // // Some test suites run for hours and KubeletStart event will already be cleaned up ginkgo.By(fmt.Sprintf("Check node-problem-detector posted KubeletStart event on node %q", node.Name)) gomega.Eventually(ctx, func(ctx context.Context) error { return verifyEventExists(ctx, f, eventListOptions, "KubeletStart", node.Name) }, pollTimeout, pollInterval).Should(gomega.Succeed()) } else { ginkgo.By("KubeletStart event will NOT be checked") } } </del> ginkgo.By("Gather node-problem-detector cpu and memory stats") numIterations := 60 for i := 1; i <= numIterations; i++ {

Discussion:
/kind failing-test <!-- If this is a flake, please add: /kind flake --/sig node
needs containerd 1.7.14 in the COS image - specifically
Thanks, I missed that. Checking the logs from i noticed that container is destroyed ! I see also from kernel logs that docker is blocked for 120second ( around the same time the container is destroyed ) Could it be that Docker Hung should be moved to be last in the test to avoid deleting a container?
/assign
/cc
Looking at the in job name initially I thought this job runs alpha features, so they might have forgotten to disable feature. But it seems this has already taken care -
/triage accepted
Change:
if len(filteredNodes) == 0 { return result, &FitError{ Pod:              pod, <del> NumAllNodes:      len(nodes), </del> <ins> NumAllNodes:      numNodes, </ins> FailedPredicates: failedPredicateMap, } }

Discussion:
In : It seems that nodes are only used in the case there are no predicates. This call can be moved inside . Moving it there saves us from creating the node slice unless it is necessary. Checking if there are no nodes (line 202 below) can be done using . /kind cleanup /sig scheduling
I can work on this