jiebi/CodeConvo huggingface dataset:
Change:
cpuPolicyName              string nodeAllocatableReservation v1.ResourceList isTopologyBroken           bool <del> panicMsg                   string </del> expectedPolicy             string expectedError              error skipIfPermissionsError     bool

Discussion:
Is this a BUG REPORT or FEATURE REQUEST?: /kind bug What happened: When enable cpumanager by , but not set and , kubelet will get panic error in log What you expected to happen: Should graceful exit with error not panic. How to reproduce it (as minimally and precisely as possible): set and but not set and Anything else we need to know?:
/sig node
Great that it's not panicing anymore, but I'd also love to get the "requires + to be greater than zero" hint in this particular case. It looks like even with this doesn't seem to be the case (since it errors out with the non-actionable "unable to determine reserved CPU resources for static policy". Should I open another issue for this?
Change:
} } <ins> func TestInvalidSelectors(t *testing.T) { testCases := map[string]struct { labelSelector *metav1.LabelSelector }{ "illegal value key": { labelSelector: &metav1.LabelSelector{ MatchLabels: map[string]string{ "k8s.io/too/many/slashes": "value", }, }, }, "illegal operator": { labelSelector: &metav1.LabelSelector{ MatchExpressions: []metav1.LabelSelectorRequirement{ { Key:      "foo", Operator: metav1.LabelSelectorOperator("illegal"), Values:   []string{"bar"}, }, }, }, }, } for tn, tc := range testCases { t.Run(tn, func(t *testing.T) { dc, ps := newFakeDisruptionController() pdb, pdbName := newMinAvailablePodDisruptionBudget(t, intstr.FromInt(3)) pdb.Spec.Selector = tc.labelSelector add(t, dc.pdbStore, pdb) dc.sync(pdbName) ps.VerifyPdbStatus(t, pdbName, 0, 0, 0, 0, map[string]metav1.Time{}) }) } } </ins> // waitForCacheCount blocks until the given cache store has the desired number // of items in it. This will return an error if the condition is not met after a // 10 second timeout.

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: panicked with "invalid memory address or nil pointer dereference", resulting in crash-looping. What you expected to happen: to gracefully handle nil-valued variables. How to reproduce it (as minimally and precisely as possible): Create a object with a field that, when passed to , returns . Anything else we need to know?: This is the offending code: The nil pointer dereference occurred on line 473. Environment: Kubernetes version (use ): 1.17.14 Cloud provider or hardware configuration: GKE OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others:
/sig apps
/cc /triage accepted
/assign
Change:
# Install aufs kernel module apt-get install --yes linux-image-extra-$(uname -r) <ins> # Install aufs tools apt-get install --yes aufs-tools </ins> DOCKER_OPTS="${DOCKER_OPTS} -s aufs" elif [[ ${docker_storage} == "devicemapper" ]]; then DOCKER_OPTS="${DOCKER_OPTS} -s devicemapper"

Discussion:
On AWS with Vivid, auplink is not installed. There are messages in the docker log about auplink not being in the path. Inspection of the format-disks script confirms this to be the case. (PR coming soon, just opening an issue so we have something to track it back to!)
Change:
_ "k8s.io/kubernetes/pkg/apis/certificates/install" _ "k8s.io/kubernetes/pkg/apis/coordination/install" _ "k8s.io/kubernetes/pkg/apis/core/install" <ins> _ "k8s.io/kubernetes/pkg/apis/discovery/install" </ins> _ "k8s.io/kubernetes/pkg/apis/events/install" _ "k8s.io/kubernetes/pkg/apis/extensions/install" <ins> _ "k8s.io/kubernetes/pkg/apis/flowcontrol/install" _ "k8s.io/kubernetes/pkg/apis/imagepolicy/install" _ "k8s.io/kubernetes/pkg/apis/networking/install" _ "k8s.io/kubernetes/pkg/apis/node/install" </ins> _ "k8s.io/kubernetes/pkg/apis/policy/install" _ "k8s.io/kubernetes/pkg/apis/rbac/install" _ "k8s.io/kubernetes/pkg/apis/scheduling/install"

Discussion:
What happened: Tried to convert a v1beta1 Ingress object to v1, and received the following error: What you expected to happen: The conversion to work. How to reproduce it (as minimally and precisely as possible): Then run: /sig cli /assign
Can i work on this issue?
/assign
/triage accepted
Change:
srcs = [ "credentialmanager_test.go", "vsphere_test.go", <ins> "vsphere_util_test.go", </ins> ], embed = [":go_default_library"], deps = [

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks!--What happened: Provsioning a PVC using a storage class with vSphere as the cloud provider failed with error "runtime error: index out of range". What you expected to happen: The PVC should have been created. How to reproduce it (as minimally and precisely as possible): Create a PVC using a storage class with vSphere as the cloud provider and a VMware vCenter Server where the default language is not English. Anything else we need to know?: K8s in conjunction with vSphere PVC relies on English error messages from the VMware API in order to determine the canonical path for a newly created volume (VMDK file). The faulting code (v1.11.3, still the same on master) can be found here (starting at line 312): The line "canonicalVolumePath = match[1]" (340) in the above code is the problem because "File (.*?) was not found" (English) never matches for a different language (e.g. German: "Datei [DATASTORE] kubevols/kube- wurde nicht gefunden") and a “runtime error: index out of range” oocurs in the "kube-controller-manager". This causes the already created volume (VMDK file) not to be reported back to the K8s system which in turn will try to recreate it repeatedly in a loop (fails with "Cannot complete the operation because the file or folder [DATASTORE] /kubevols/kubernetes-dynamic-pvc-[UUID] already exists"). Find below the corresponding log excerpt (kube-controller-manager): Environment: Kubernetes version (use ):Cloud provider or hardware configuration: vSphere OS (e.g. from /etc/os-release): n/a Kernel (e.g. ): n/a Install tools: n/a Others: n/a <!-- DO NOT EDIT BELOW THIS LINE --/kind bug
/assign
Change:
// When the last pending initializer is removed, and no failing result is set, the initializers // struct will be set to nil and the object is considered as initialized and visible to all // clients. <ins> // +patchMergeKey=name // +patchStrategy=merge </ins> repeated Initializer pending = 1; // If result is set with the Failure field, the object will be persisted to storage and then deleted,

Discussion:
There are two issues: doesn't have merge key The validation code regards it as an error if both Initializers.Result and Initializers.Pending are nil. So if multiple initializer controllers sending patches removing themselves from Initializers.Pending at the same time, the last patch that gets applied will get a validation error.
/sig api-machinery
Change:
if s.AdvertiseAddress == nil || s.AdvertiseAddress.IsUnspecified() { hostIP, err := insecure.DefaultExternalAddress() if err != nil { <del> return fmt.Errorf("Unable to find suitable network address.error='%v'. "+ "Try to set the AdvertiseAddress directly or provide a valid BindAddress to fix this.", err) </del> <ins> return fmt.Errorf("unable to find suitable network address.error='%v'. "+ "Try to set the AdvertiseAddress directly or provide a valid BindAddress to fix this", err) </ins> } s.AdvertiseAddress = hostIP }

Discussion:
Currently as authentication and authorization are both standard config for all clusters, the kubeapiserver insecure http handler is unsecure, which means the cluster is vulnerable to the attack. So it should be deprecated, even removed totally.
/sig api-machinery
I think removing the insecure option is a good idea. Can you send an email the sig-apimachinery mailing list with a proposed timeline? I think this should be like other GA features and have a one year clock.
Sure, I will send it ASAP.
:+1:
Change:
podARecByUDPFileName := fmt.Sprintf("%s_udp@PodARecord", fileNamePrefix) podARecByTCPFileName := fmt.Sprintf("%s_tcp@PodARecord", fileNamePrefix) probeCmd += fmt.Sprintf(`podARec=$$(hostname -i| awk -F. '{print $$1"-"$$2"-"$$3"-"$$4".%s.pod.cluster.local"}');`, namespace) <del> probeCmd += fmt.Sprintf(`test -n "$$(dig +notcp +noall +answer +search $${podARec} A)" && echo OK > /results/%s;`, podARecByUDPFileName) probeCmd += fmt.Sprintf(`test -n "$$(dig +tcp +noall +answer +search $${podARec} A)" && echo OK > /results/%s;`, podARecByTCPFileName) </del> <ins> probeCmd += fmt.Sprintf(`check="$$(dig +notcp +noall +answer +search $${podARec} A)" && test -n "$$check" && echo OK > /results/%s;`, podARecByUDPFileName) probeCmd += fmt.Sprintf(`check="$$(dig +tcp +noall +answer +search $${podARec} A)" && test -n "$$check" && echo OK > /results/%s;`, podARecByTCPFileName) </ins> fileNames = append(fileNames, podARecByUDPFileName) fileNames = append(fileNames, podARecByTCPFileName)

Discussion:
<!-- This form is for bug reports and feature requests ONLY! If you're looking for help check and the . If this may be security issue, please disclose it privately via --Is this a BUG REPORT or FEATURE REQUEST?: /kind bug /sig testing What happened: Tests checking DNS responses can have false positives, such as "should provide DNS for services". The tests rely on dig-ing certain domain names [1]: test -n "$(dig +notcp +noall +answer +search kubernetes.default A)" && echo OK /results/ The problems could be that, if a host / container doesn't have any entries in their : ubuntu dig +notcp +noall +answer +search kubernetes.default A ;; connection timed out; no servers could be reached , causing the test to pass and to write "OK" into the results file. [1] What you expected to happen: The tests shouldn't be able to pass if dig failed. How to reproduce it (as minimally and precisely as possible): Comment all nameservers or configure a bogus DNS server in, and run: test -n "$(dig +notcp +noall +answer +search kubernetes.default A)" && echo OK Anything else we need to know?: Environment: Kubernetes version (use ): 1.9.6 Cloud provider or hardware configuration: N/A OS (e.g. from /etc/os-release): "Ubuntu 16.04.3 LTS" Kernel (e.g. ): Linux ubuntu 4.4.0-87-generic
/assign
: But one of the purpose of the test is to ensure that the DNS of the cluster is replying. In other words, if it does not reply then we EXPECT this test to fail. If you are not using DNS then isn't it better to SKIP the test ?
I believe means to say "false negatives" ... meaning that in some situations, the test will errantly pass, when it should fail.
oops . Looks like I misread the description, and agree that the dig should work.
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
Change:
virsh pool-create-as $POOL dir --target "$POOL_PATH" fi <del> wget -N -P "$ROOT" http://${COREOS_CHANNEL:-alpha}.release.core-os.net/amd64-usr/current/coreos_production_qemu_image.img.bz2 </del> <ins> wget -N -P "$ROOT" https://${COREOS_CHANNEL:-alpha}.release.core-os.net/amd64-usr/current/coreos_production_qemu_image.img.bz2 </ins> if [[ "$ROOT/coreos_production_qemu_image.img.bz2" -nt "$POOL_PATH/coreos_base.img" ]]; then bunzip2 -f -k "$ROOT/coreos_production_qemu_image.img.bz2" virsh vol-delete coreos_base.img --pool $POOL 2> /dev/null || true

Discussion:
doesn't have a valid SSL certificate (it looks like it's a GCS bucket since says that I should be using a domain name). We should find a source for the image that can be fetch securely.
Split off of . /cc since I can't assign this to you directly.
you made a (meaningful) change in libvirt_coreos a few months ago. Does still work? Any idea on a better source?
works (at least for my needs) . I use it everyday for dev and I'd like to keep it working. I was not aware of this issue. Having a look and let you know.
I had a look at but I found no reference to maybe something changed since this issue is quite old. Could you check again and eventually share more details on the issue? Thanks in advance
Back in mid-2015 I was looking for places where we were fetching resources dynamically during cluster creation and trying to make sure that the fetches were done over SSL (to prevent a malicious actor from being able to inject code into new clusters) -- see The idea was to try and switch from to . If I run the wget command directly, it appears to work fine over SSL (and is actually way faster for me -- the http endpoint said it would take 3 hrs to download and the https endpoint took 12s).
I've created to switch it to https
Change:
"fmt" "net" "net/url" <ins> "os" </ins> "path/filepath" "strings" "syscall"

Discussion:
No response No response /sig windows /kind failing-test
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign
/sig windows
i think this problem can be fixed when it imports os/net in Am i right?
I also found some other unit test bugs in CI, such as running linux-related tests on windows. I will try to fix them. /assign
/cc
Thanks for opening the issue! I didn't notice the failure through the testgrid dashboard. I've sent a PR here: . While fixing this issue, I noticed there's one unit test that was failing, so that PR also addresses that as well.
Yep, the imports you mentioned are needed. Keep in mind that imports are in alphabetical order. But in addition to that, there was another failing unit test which was masked by this import errors.
Change:
} return -1 } <ins> func (s Status) String() string { if s == Healthy { return "healthy" } else if s == Unhealthy { return "unhealthy" } return "unknown" } </ins>

Discussion:
If the scheduler is not healthy, pods won't schedule and things will get stuck in pending. Right now, there is no user visible feedback (in logs or events or pod status) that indicates that this is true. We should really have at least some logging in the apiserver, and possibly more in-depth information. I'm thinking that we should add a /validatez handler to the apiserver that does a quick sanity check. Added bonus: we could rip out all of the scripted health checking in the startup scripts.
A simple status HTTP page would be useful, showing the health status of each system component. We should seriously think about self-hosting, too. It doesn't seem like it would be hard to run a couple scheduler replicas using master election, managed by a replication controller.
Yeah, I think system components should register themselves with apiserver.
Change:
"io/ioutil" "net" "os" <ins> "reflect" </ins> "testing" certutil "k8s.io/client-go/util/cert"

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: Duplicate altnames in certs which generated by kubeadm ! What you expected to happen: No Duplicate altnames in certs which generated by kubeadm How to reproduce it (as minimally and precisely as possible): Anytime Anything else we need to know?: ! Environment: Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others:
/sig cluster-lifecycle
/area kubeadm
Can you describe your detailed usage scenarios and reproduction steps, and explain the kubernetes version so that we can quickly locate
Thank for your response! I have found why and will fix it soon.
i have commented on the PR. /priority awaiting-more-evidence
/remove-priority awaiting-more-evidence /priority backlog
Change:
}, "ReconcilerSyncLoopPeriod": { SchemaProps: spec.SchemaProps{ <del> Description: "ReconcilerSyncLoopPeriod is the amount of time the reconciler sync states loop wait between successive executions. Is set to 5 sec by default.", </del> <ins> Description: "ReconcilerSyncLoopPeriod is the amount of time the reconciler sync states loop wait between successive executions. Is set to 60 sec by default.", </ins> Default:     0, Ref:         ref("k8s.io/apimachinery/pkg/apis/meta/v1.Duration"), },

Discussion:
// RecommendedDefaultAttachDetachControllerConfiguration defaults a pointer to a // AttachDetachControllerConfiguration struct. This will set the recommended default // values, but they may be subject to change between API versions. This function // is intentionally not registered in the scheme as a "normal" // function to allow consumers of this type to set whatever defaults for their // embedded configs. Forcing consumers to use these defaults would be problematic // as defaulting in the scheme is done as part of the conversion, and there would // be no easy way to opt-out. Instead, if you want to use this defaulting method // run it in your wrapper struct of this type in its method. func RecommendedDefaultAttachDetachControllerConfiguration(obj kubectrlmgrconfigv1alpha1.AttachDetachControllerConfiguration) { zero := metav1.Duration{} if obj.ReconcilerSyncLoopPeriod == zero { obj.ReconcilerSyncLoopPeriod = metav1.Duration{Duration: 60 time.Second} } } Default is set to 60 second. but, the comment said is 5 seconds. // AttachDetachControllerConfiguration contains elements describing AttachDetachController. type AttachDetachControllerConfiguration struct { // Reconciler runs a periodic loop to reconcile the desired state of the with // the actual state of the world by triggering attach detach operations. // This flag enables or disables reconcile. Is false by default, and thus enabled. DisableAttachDetachReconcilerSync bool // ReconcilerSyncLoopPeriod is the amount of time the reconciler sync states loop // wait between successive executions. Is set to 5 sec by default. ReconcilerSyncLoopPeriod metav1.Duration } default should change to 60 seconds. comment errror None <detailsall version until now </details<detailsnot relevent </details<details</details<details</details<details</details<details</details
/sig storage
/remove-kind api-change /kind cleanup
Those labels are not set on the issue: <detailsIn response to : /remove-kind api-change /kind cleanup Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/triage accepted
Change:
allErrs = append(allErrs, ValidateResourceRequirements(&ctr.Resources, idxPath.Child("resources"))...) allErrs = append(allErrs, ValidateSecurityContext(ctr.SecurityContext, idxPath.Child("securityContext"))...) } <del> // Check for colliding ports across all containers. allErrs = append(allErrs, checkHostPortConflicts(containers, fldPath)...) </del> <ins> if isInitContainers { // check initContainers one by one since they are running in sequential order. for _, initContainer := range containers { allErrs = append(allErrs, checkHostPortConflicts([]core.Container{initContainer}, fldPath)...) } } else { // Check for colliding ports across all containers. allErrs = append(allErrs, checkHostPortConflicts(containers, fldPath)...) } </ins> return allErrs }

Discussion:
I found that kubelet will not allocate hostports specified from initContainers. And PodFitsHostPorts in kube-scheduler does not take initContainer into consideration. Also, kube-apiserver think such pod is illegal, but I think it OK. We should make the behavior of spec.HostPorts in initContainer clear
/sig node
Exactly. I think this makes sense. Since initContainers are expected to be completed, we should not expose extra port mappings during creating pod sandbox, which may bring in security risks.
Sounds good to me.
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale
Change:
// to JSON allowed. type Unstructured interface { Object <del> // UnstructuredContent returns a non-nil, mutable map of the contents of this object. Values may be </del> <ins> // UnstructuredContent returns a non-nil map with this object's contents. Values may be </ins> // []interface{}, map[string]interface{}, or any primitive type. Contents are typically serialized to <del> // and from JSON. </del> <ins> // and from JSON. SetUnstructuredContent should be used to mutate the contents. </ins> UnstructuredContent() map[string]interface{} // SetUnstructuredContent updates the object content to match the provided map. SetUnstructuredContent(map[string]interface{})

Discussion:
What happened: In I introduced an optimization - do a deep copy instead of to and from JSON roundtrip to convert anything that implements . I then discovered that the method that is used there in both and may mutate the original object. This is problematic because previously (before ) there was no mutation and because this is unexpected and may lead to data races - it is bad behaviour to mutate original object when you just want a copy of it. This issue was fixed by . However the underlying issue is not fixed here - is brittle and dangerous. Method name does not imply that it mutates data when you call it. And godoc does not mention that either: Something needs to be done about it IMO. This method is misused in these places (mutation side effect is not intended): Also implementation in does not implement the behaviour required by godoc in . What you expected to happen: There should be a method that returns the current unstructured contents without mutation and perhaps not providing the write-through effect. /kind bug /sig api-machinery
/cc
Is this still required and could I work on it? I'm looking for something to work on as a new contributor :)
Yes and yes! :)
Perfect, I'll get started on it!
I've got out. I'd appreciate a review :)
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale
Change:
19: "3.4.13-0", 20: "3.4.13-0", 21: "3.4.13-0", <del> 22: "3.5.3-0", 23: "3.5.3-0", 24: "3.5.3-0", </del> <ins> 22: "3.5.4-0", 23: "3.5.4-0", 24: "3.5.4-0", 25: "3.5.4-0", </ins> } // KubeadmCertsClusterRoleName sets the name for the ClusterRole that allows

Discussion:
Please publish 3.5.4-0 image and update to to benefit from fix for , while still keeping v3.5.3 critical correctness fixes (, ). For recent PRs for update to etcd v3.5.3 see and
/sig release /sig api-machinery /kind bug
/cc /triage accepted
Hey, Can I work on this ? I'm a beginner, but all the good first issues are mostly assigned. Can you guide me on doing this ?
I am working on this. /assign
Hi I would like to work on Make sense to backport in v1.22, v1.23 & v1.24? Thanks!!
hi, it makes sense to me, but requires approval from dependency maintainers. i can only approve the kubeadm changes.
was this backported ?