jiebi/CodeConvo huggingface dataset:
Change:
// The set of known safe characters to pass to journalctl / GetWinEvent flags - only add to this list if the // character cannot be used to create invalid sequences. This is intended as a broad defense against malformed // input that could cause an escape. <del> reServiceNameUnsafeCharacters = regexp.MustCompile(`[^a-zA-Z-_0-9@]+`) </del> <ins> reServiceNameUnsafeCharacters = regexp.MustCompile(`[^a-zA-Z-_.:0-9@]+`) </ins> ) // journalServer returns text output from the OS specific service logger to view

Discussion:
I enabled the on EKS 1.27.4 using Ubuntu 20.04.6. When I try to query the kubelet logs or log files from the system I get the error "input contains unsupported characters" The systemd kubelet service runs as a snap called and I think that might be the source of this problem (running the kubelet in a snap), but I'm not sure if it's intended to work. The fact that I couldn't see /var/log file query was surprising and the error message is misleading which is why I'm opening an issue here. I followed the same configuration steps on Amazon Linux 2 and it works as expected. Log query should work on Ubuntu or provide a clearer error message. This should be reproducible on any Kubernetes cluster running Ubuntu with Kubelet in a snap, but this is what I did. Install to make cluster creation and karpenter setup easier) Install Karpenter as a node autoscaler. This will automatically create a provisioner and AWSNodeTemplate objects. Modify the AWSNodeTemplate with userdata that can customize Ubuntu with log query enabled Deploy a workload that uses hostname spread to get more nodes. When the new Ubuntu node is created you can log into the node with session manager. I like to use You can verify that the kubelet is running and logging is enabled Now you can try to query logs This works with AL2. You can test with a different AWSNodeTemplate that uses AL2 instead <details</details<detailsEKS (but should happen on any provider) </details<details</details<details</details<detailscontainerd </details<details</details
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
it's always best to talk to the product support before opening the upstream ticket (this repository in this case). the k8s docs do not have a guide for running the kubelet as a snap. it could be an entirely snap related bug, indeed. please communicate with EKS and the owners of the snap package.

if they confirm a kubernetes/kubernetes bug, you can reopen this ticket. thanks
/sig node /triage needs-information /close to discuss with other users:
Closing this issue. <detailsIn response to : /sig node /triage needs-information /close </details
After digging into the error a bit more I found the problem was actually the regex match for the service name. I opened to fix it.
Change:
return result, nil } <ins> func getInfluxdbClient(c *client.Client) (*influxdb.Client, error) { kubeMasterHttpClient, ok := c.Client.(*http.Client) if !ok { Failf("failed to get master http client") } proxyUrl := fmt.Sprintf("%s/api/v1/proxy/namespaces/%s/services/%s:api/", getMasterHost(), api.NamespaceSystem, influxdbService) config := &influxdb.ClientConfig{ Host: proxyUrl, // TODO(vishh): Infer username and pw from the Pod spec. Username:   influxdbUser, Password:   influxdbPW, Database:   influxdbDatabaseName, HttpClient: kubeMasterHttpClient, IsSecure:   true, } return influxdb.NewClient(config) } </ins> func getInfluxdbData(c *influxdb.Client, query string) (map[string]bool, error) { series, err := c.Query(query, influxdb.Second) if err != nil {

Discussion:
Jenkins project: kubernetes-e2e-gce-autoscaling failed last couple of runs: Initial Resources [Skipped][Autoscaling Suite] should set initial resources based on historical data Expected <int64: to be ~ <int:
couple failing instances:
Re-opening. This flaked again:
status?
The test is disabled and there is no plan to enable it within next few weeks, so closing the issue and I'll back to it some time in the future.
Change:
if err := Convert_v1_Cluster_To_api_Cluster(&curr.Cluster, newCluster, s); err != nil { return err } <ins> if *out == nil { *out = make(map[string]*api.Cluster) } </ins> if (*out)[curr.Name] == nil { (*out)[curr.Name] = newCluster } else {

Discussion:
What happened: I have a test case: This behaves different with different client-go versions. With , the test passes. This is using in with in With , this test panics. This is using in with in Panic logs: Basically it its creating an object to decode into, and this object has some maps. These are set to nil, so when we try to populate them we get a panic. What you expected to happen: Behavior remains the same as previous release, or at least have some alternative that works here? How to reproduce it (as minimally and precisely as possible): I pasted the test above that reproduces this. This can be reproduced with a project with just that file, and a file with only client-go. Using go 1.13
/sig api-machinery
/assign
Change:
}, fakeCloud: &fake_cloud.FakeCloud{ Machines: []string{"node0", "node1", "fake"}, <ins> ExtID: map[string]string{ "node0": "ext-node0", "node1": "ext-node1", "fake":  "ext-fake", }, </ins> }, matchRE:              "node[0-9]+", expectedRequestCount: 2, // List + Create <del> expectedCreated:      []string{"node1"}, </del> <ins> expectedNameCreated:  []string{"node1"}, expectedExtIDCreated: []string{"ext-node1"}, </ins> expectedDeleted:      []string{}, }, }

Discussion:
I see the following in the kube-controller-manager log: - This is happening to me on HEAD and is the reason why pod status is always showing unknown even when they are scheduled and running.
This is with the vagrant cloud provider. It looks like the delta between the new and old minion is the Node.Spec.ExternalID is being set on the incoming minion but is not set in the originally created minion.
I am not sure how this is not affecting other cloud providers. It looks to me that NodeController populated the node ExternalID here: It looks like the Kubelet provided value is missing the ExternalID
Actually, I am now confused on what the NodeController may or may not be doing here that is causing the status to not get updated.
It looks like the client is passing an ExternalID on the incoming request, but the original value that is in etcd does not have an ExternalID set. Not sure what changed that would have caused this issue to appear.
I think this causes problems: The memory is re-used in a for-loop by Go so referring to a pointer value in a map here will cause problems I think.
Ok, the referenced line is the problem. Sending a PR.
Well, I go back on that now. A simple way to reproduce this is to delete all the minions in your cluster, and verify the node controller is able to add them back. For me, this is causing the node controller to add them back in an unknown status, and then all updates to the node fail. The update fails because the node controller is not setting an ExternalID on the original object.
I am looking into this now. cc/ too
Related issue opened while debugging this:
Debugged through here: I can via manual fmt see that the object has an ExternalID set prior to the call Create. When I look at etcd, I end up with this persisted: Note: it is missing an ExternalID somehow ;-)
Ok, I think I see the issue Nodes returned from here: Do not have an ExternalID Which can make Nodes created from here: End up without an External ID. Having two different nodeClient.Create() paths in this code is confusing. Also we are doing bad things in maps holding pointers to memory allocated in for-loop. We need to fix that ;-)
Yeah, this is bug we should fix. Thanks for looking into this.

If you already have a potential fix, please feel free to grab the issue from me.
I think I have a PR that should fix. Testing that now. Will cc you on the PR.
Thanks for fixing - it did end up affecting AWS as well (AWS isn't in a fully working state just yet, particularly with node discovery).
Change:
} cont.ensureStateFunc = func(_ cgroups.Manager) error { <del> return ensureProcessInContainerWithOOMScore(os.Getpid(), qos.KubeletOOMScoreAdj, cont.manager) </del> <ins> return ensureProcessInContainerWithOOMScore(os.Getpid(), int(cm.KubeletOOMScoreAdj), cont.manager) </ins> } systemContainers = append(systemContainers, cont) } else { cm.periodicTasks = append(cm.periodicTasks, func() { <del> if err := ensureProcessInContainerWithOOMScore(os.Getpid(), qos.KubeletOOMScoreAdj, nil); err != nil { </del> <ins> if err := ensureProcessInContainerWithOOMScore(os.Getpid(), int(cm.KubeletOOMScoreAdj), nil); err != nil { </ins> klog.ErrorS(err, "Failed to ensure process in container with oom score") return }

Discussion:
runs in a container. Talos sets OOM score to -450 for the kubelet container and passes in the kubelet config. End result is that OOM score adj is -999 though. should have configured OOM score . Source code analysis. First, OOM score is set correctly from the config (flags): But then, in container manager, OOM score is reset to -999 via the following: This function should skip action if the PID is not running on the host: But the function looks to be confusing: When kubelet runs in a container with PID namespace shared with the host, kubelet's PID namespace will be equal to PID 1 namespace. If kubelet runs in a container with unshared PID namespace, kubelet's PID is 1 and its PID namespace is identical to PID 1 namespace. So how this function can return ever? Moreover, function is always setting OOM score to a hardcoded constant -999 ignoring configuation (). No response <details, reproduced with 1.22. </details<details</details<details</details<details</details<details</details<details</details
/sig node
/triage accepted
/assign
I don't think this method needs to change... I have make a draft PR for the default value to use the flag if present, but I would like more time to add some testing. Maybe you can have a look: ?
Thanks, this PR looks good to me, as it's going to set the OOM score to the configured value. And in our case kubelet runs in a container (not on the host, with proper OOM score via OCI spec), so this code should be even skipped, not sure how this can be addressed.
neither do I...
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
/remove-lifecycle stale
Change:
"fmt" "io" <ins> "k8s.io/apimachinery/pkg/api/errors" </ins> "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apiserver/pkg/admission" "k8s.io/kubernetes/pkg/api"

Discussion:
When a node is deleting a pod, the NodeRestriction admission plugin ensures the pod is bound to the node. It first checks the server cache for the pod. In the case where a pod was created and immediately deleted, it may not yet exist in the server cache. Before forbidding, we should do a live lookup. https://k8s- cc
Change:
// parseExactValue parses the only value for exact match style func (p *Parser) parseExactValue() (sets.String, error) { s := sets.NewString() <del> tok, lit := p.consume(Values) </del> <ins> tok, lit := p.lookahead(Values) if tok == EndOfStringToken || tok == CommaToken { s.Insert("") return s, nil } tok, lit = p.consume(Values) </ins> if tok == IdentifierToken { s.Insert(lit) return s, nil

Discussion:
When polling a k8s master with the response is an HTTP 500. But even if this selector is invalid, it should return a 4xx code instead.
Do you get 500 without the label selector? cc
No, and not with a value like "environment%3Dfoobar". But if I remove "foobar" or replace it with an url-encoded space, i.e. "environment%3D%20" or "environment%3D+" I get a 500. I suspect that the value (after the colon) is stripped of whitespace, and if the result is the empty string, this error happens.
Bumping priority to P1 since this is definitely a bug and we should fix it.
you had five days, I'm kicking you off of this & giving to Chao. :)
Change:
import ( "fmt" <ins> "io/ioutil" "net/http" </ins> "sort" <ins> "strings" </ins> "time" "github.com/GoogleCloudPlatform/kubernetes/pkg/api"

Discussion:
Follow up from
Bumping this up to P1 given that 0.12.2 wasn't able to create a service with an external load balancer and we didn't notice before cutting the release.
No, to be clearer, 0.12.2 wasn't able to create a service with ELB on GKE. That was on our side entirely.
But it doesn't invalidate the need for this.
The example is using ELB.
are you actively working on this? If not, I'd be up for doing it today.
Maybe not actively but I know what to, however I won't be able to finish it today, so if you think you can do it today please move forward.
We run the e2e tests on GKE, so if we had a test for creating an ELB we would have known that the 0.12.2 release wouldn't work on GKE. I don't see how your point applies. The e2e tests are in place so that we don't have to test each feature manually to verify that it is working, and we only found out that this feature was broken on GKE after we pushed 0.12.2, hence the need for an e2e test.
I think and you are in fact in agreement
right now, k8petstore tests the external load balancer by curling down the amount of transactions ingested from the REST API. im playing with porting it as a e2e test now. The code in the shell script is a little raw, but you can see that it specifies a PUBLIC_IP and then curls down from it at the end ().
that sounds great. What I'd really like to see here though (and what is going to do early next week) is a very simple test that isolates creating a service with an ELB to verify that creating a load balancer works in isolation from a complex test of other parts of the system. This will give us a really clear signal when the test starts to fail instead of needing to debug lots of moving parts when we see a test failure.
Change:
) var ( <del> debugLong = templates.LongDesc(i18n.T(`Tools for debugging Kubernetes resources`)) </del> <ins> debugLong = templates.LongDesc(i18n.T(` Debug cluster resources using interactive debugging containers. 'debug' provides automation for common debugging tasks for cluster objects identified by resource and name. Pods will be used by default if resource is not specified. The action taken by 'debug' varies depending on what resource is specified. Supported actions include: * Workload: Create a copy of an existing pod with certain attributes changed, for example changing the image tag to a new version. * Workload: Add an ephemeral container to an already running pod, for example to add debugging utilities without restarting the pod. * Node: Create a new pod that runs in the node's host namespaces and can access the node's filesystem. Alpha disclaimer: command line flags may change`)) </ins> debugExample = templates.Examples(i18n.T(` # Create an interactive debugging session in pod mypod and immediately attach to it. # (requires the EphemeralContainers feature to be enabled in the cluster) <del> kubectl alpha debug mypod -i --image=busybox </del> <ins> kubectl alpha debug mypod -it --image=busybox </ins> # Create a debug container named debugger using a custom automated debugging image. # (requires the EphemeralContainers feature to be enabled in the cluster)

Discussion:
This issue tracks implementing node debugging with privileged containers for , as described in the This feature allows administrators to start a privileged container on a node in host namespaces rather than having to SSH to the node. For example: /kind feature /sig cli
/assign
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale
Change:
DeclTypes:         declTypes, }, ) <del> if err != nil { return nil, err } return env.Env(environment.StoredExpressions) </del> } // createVariableOpts creates a slice of EnvOption

Discussion:
When I load a policy definition like this The object is updated with the following status While this error is reported, the policy does seem to be fully functioning This is similar to the documented examples No error reported on a valid spec Create a a policy that uses variables Observe the status of the newly created policy No response <details</details<detailsn/a </details<details</details<detailskind </details<details</details<details</details
/sig api-machinery
/assign Oops. Good find. Thank you. /triage accepted
Change:
- --memory={{ base_metrics_server_memory }} - --extra-memory={{ metrics_server_memory_per_node }}Mi - --threshold=5 <del> - --deployment=metrics-server-v0.5.0 </del> <ins> - --deployment=metrics-server-v0.5.1 </ins> - --container=metrics-server - --poll-period=30000 - --estimator=exponential

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --As described in issue , we found kubernetes have been running normally, but the control-plane nodes's metrics value of startTime is similar to the timestamp. Get the correct metrics of node As described in issue anything else we need to provide? As described in issue Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others:
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig node
/remove-sig node /sig instrumentation /assign
I think the issue is about Summary API having start time for node metric, but this timestamp is incorrect. This is node issue, not instrumentation. /sig node /remove-sig instrumentation /unassign
When discussing adding node start time metric to /metrics/resource endpoint I remember that SIG Node response to this was that there is no good way to define node start time. I don't think we will be able to provide correct value here. As summary API is technically deprecated, it makes no sense to fix it. We should warn users against using it and wait for removal of Summary API.
Okay, let's wait for the release of metrics-server v0.6.0
Do you know if this is fixed in metrics server?
/triage needs-information Can you please add info on name of timeserias and other steps to repro ti understand exactly what is needed here. Thank you!

in metrics server v0.6.0, we will use /metrics/resource Kubelet endpoint instead summary API
as issue described , the result is: for example : the startup time of the node test-us-west-1-control-plane-577lp is "startTime": "2021-08-03T19:33:50Z",, and timestamp reported by metrics is "2021-08-03T19:34:36Z", but as described, output from control plane node
Change:
return &svcPort, nil } } <del> return nil, errors.NewServiceUnavailable(fmt.Sprintf("no service port %q found for service %q", port, svc.Name)) </del> <ins> return nil, errors.NewServiceUnavailable(fmt.Sprintf("no service port %d found for service %q", port, svc.Name)) </ins> } // ResourceLocation returns a URL to which one can send traffic for the specified service.

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: When trying to use the webhookConversionServer, im getting . I was able to figure out that the unicode character displayed maps to port 443. see code What you expected to happen: If the service reference doesnt define 443, it should show an error that the service doesnt have the port number (whatever the number may be). How to reproduce it (as minimally and precisely as possible): your service (missing the default port 443) your CRD (one version no conversion webhook) your resource at this old version crd with new version and conversion webhook, and use new version for storage. to get the resource yaml, and see error Anything else we need to know?: current implementation will convert port number into a unicode character. ie. im seeing where . Must use instead of to maintain decimal. Environment: Kubernetes version (use ): v1.15.4+IKS Cloud provider or hardware configuration: IBM IKS OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others:
/sig api-machinery
Are you planning to send out a PR ?
i was going to.. but didnt know which repo was relevant and didnt feel like reading through all contibution gorp.
Created a PR to fix the message output.
Change:
cmdutil.AddApplyAnnotationFlags(cmd) cmdutil.AddRecordFlag(cmd) cmdutil.AddInclude3rdPartyFlags(cmd) <ins> return cmd </ins> } func RunEdit(f cmdutil.Factory, out, errOut io.Writer, cmd *cobra.Command, args []string, options *resource.FilenameOptions) error {

Discussion:
kubectl edit is not working on HEAD. It's working on 1.5.