jiebi/CodeConvo huggingface dataset:
Change:
return allErrs } <del> // This validate will make sure targetPath: </del> <ins> // ValidateLocalNonReservedPath makes sure targetPath: </ins> // 1. is not abs path // 2. does not contain any '..' elements // 3. does not start with '..' <del> func validateLocalNonReservedPath(targetPath string, fldPath *field.Path) field.ErrorList { </del> <ins> func ValidateLocalNonReservedPath(targetPath string, fldPath *field.Path) field.ErrorList { </ins> allErrs := field.ErrorList{} allErrs = append(allErrs, validateLocalDescendingPath(targetPath, fldPath)...) // Don't report this error if the check for .. elements already caught it.

Discussion:
Originally posted by in
Hello, I'm new here. Can I try solving this? it seems like a good first issue
sure, context is the change is needed here: We have to tolerate existing pods / pod specs that fail this validation, so we should only do this additional validation on create or if the existing object passes this validation. To do this: an field to , initialize that field to false, and then conditionally override it to if is non-nil and has a projected token volume path that fails (will have to export the function to check this) , if is false, call the validation on the path:
Hi, I'd like to work on this if there is no one is proceeding on. /assign
Change:
library = ":go_default_library", tags = ["automanaged"], deps = [ <ins> "//pkg/cloudprovider/providers/azure:go_default_library", "//pkg/cloudprovider/providers/fake:go_default_library", </ins> "//pkg/util/mount:go_default_library", "//pkg/volume:go_default_library", "//pkg/volume/testing:go_default_library",

Discussion:
<!-- Thanks for filing an issue! Before hitting the button, please answer these questions.--Is this a request for help? NO Note: Please file issues for subcomponents under the appropriate repo What keywords did you search in Kubernetes issues before filing this one? (If you have found any duplicates, you should instead reply there.): kubernetes, azure file, chinacloudapi Is this a BUG REPORT or FEATURE REQUEST? (choose one): BUG REPORT <!-- If this is a BUG REPORT, please: Fill in as much of the template below as you can. If you leave out information, we can't help you as well. If this is a FEATURE REQUEST, please: Describe in detail the feature/behavior/change you'd like to see. In both cases, be ready for followup questions, and please respond in a timely manner. If we can't reproduce a bug or think a feature already exists, we might close your issue. If we're wrong, PLEASE feel free to reopen it and explain why. --Kubernetes version (use ): master Environment: Cloud provider or hardware configuration: OS (e.g. from /etc/os-release): Ubuntu 16.04 Kernel (e.g. ): Install tools: Others: What happened: We try to mount azure file to pod, and get the following error That is because azure china's storage DNS suffix is rather than What you expected to happen: Kubernetes should provide some method to let user specify storage dns suffix, so we can use Azure file volume How to reproduce it (as minimally and precisely as possible): Any Azure cluster in china can reproduce it. Anything else we need to know: kubernetes has hard coded in shows a relative issue
could you help confirm this?
One possible way is configuring DNS suffix via annotations of PV. If thinks this way okay, I'd like to create a PR to fix it.
azure file was implemented without using resource group or azure cloud provider. The endpoint can be found at One fix is to use azure cloud provider and choose the file service endpoint from azure environment as I did in blob service . Let me know if you can help.
I'm not familiar with azure cloud provider and volume codes. I'd like to try to dig into it to see if I can fix as the way you suggested.
Change:
"//pkg/kubelet/cm:go_default_library", "//pkg/kubelet/eviction/api:go_default_library", "//pkg/kubelet/lifecycle:go_default_library", <ins> "//pkg/kubelet/metrics:go_default_library", </ins> "//pkg/kubelet/pod:go_default_library", "//pkg/kubelet/qos:go_default_library", "//pkg/kubelet/server/stats:go_default_library",

Discussion:
We should keep track of how stale stats used for evictions are. This will help track improvements in eviction latency, and help uncover regressions. cc If someone could assign this to me, I would appreciate that.
closing via
Change:
// forbidden renders a simple forbidden error func forbidden(attributes authorizer.Attributes, w http.ResponseWriter, req *http.Request, reason string) { msg := forbiddenMessage(attributes) <ins> w.Header().Set("Content-Type", "text/plain") w.Header().Set("X-Content-Type-Options", "nosniff") </ins> w.WriteHeader(http.StatusForbidden) fmt.Fprintf(w, "%s: %q", msg, reason) }

Discussion:
The error reporting functions here all repeat a URI without sanitizing it. An XSS attacker could use this to get the server to embed a reference to a malicious script. (As always, please note that kubernetes apiserver is NOT xss hardened and we do NOT recommend using the api directly from a browser.)
The error correctly sets the content type to , so this is only an issue using a browser that does content sniffing. Would it be sufficient to just add the header here?
Yes, that will work for browsers that honor the header. It's probably sufficient-- we could do that globally, we set Content-Type correctly everywhere, I think.
Change:
if err != nil { allErrs = append(allErrs, err) } <del> if len(infos) == 0 { </del> <ins> if len(infos) == 0 && len(allErrs) == 0 { </ins> outputEmptyListWarning(errOut) }

Discussion:
Is this a BUG REPORT or FEATURE REQUEST? (choose one): bug Kubernetes version (use ): master What happened: is printed when error. What you expected to happen: Only error message was printed.
I believed this has been fixed
, it seems not; in , it's not necessary to print if errs is not empty. Refer to the PR on the proposal :).
ok, seems other issue.
Change:
// This is very low impact. The NodePort range is intentionally obscure, and unlikely to actually collide with real Services. // This only affects UDP connections, which are not common. // See issue: https://github.com/kubernetes/kubernetes/issues/49881 <del> isIPv6 := svcInfo.clusterIP.To4() != nil </del> <ins> isIPv6 := utilproxy.IsIPv6(svcInfo.clusterIP) </ins> err := utilproxy.ClearUDPConntrackForPort(proxier.exec, lp.Port, isIPv6) if err != nil { glog.Errorf("Failed to clear udp conntrack for port %d, error: %v", lp.Port, err)

Discussion:
<!-- This form is for bug reports and feature requests ONLY! If you're looking for help check and the . --Is this a BUG REPORT or FEATURE REQUEST?: /kind bug What happened: There is a bug in ipv6, see: What you expected to happen: The judgement logic should be: How to reproduce it (as minimally and precisely as possible): Anything else we need to know?: Environment: Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g. from /etc/os-release): Kernel (e.g. ): Install tools: Others: /sig network /area ipv6
/assign cc
Change:
c.reflectorMutex.Unlock() var wg wait.Group <del> defer wg.Wait() </del> wg.StartWithChannel(stopCh, r.Run) wait.Until(c.processLoop, time.Second, stopCh) <ins> wg.Wait() </ins> } // Returns true once this controller has completed an initial resource listing

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: When use client-go to build the client, we implement the event handler for some k8s resourses. Sometime it will panic (maybe cause by the unexpected nil pointer bug), the process will not crash after panic. What you expected to happen: When we use event handler with informer in client-go, sometime it will panic in handler, we expect the process will crash. How to reproduce it (as minimally and precisely as possible): I run process which just panic simpliy in an event handler , use to produce the coredump, and use to check the call stack. The sample code I run is: The call stack of paniced goroutine: We can see the panic was called at frame 16 , and was catched by at 10. It printed the call stack in and panic again. The defer func was call at frame 8, it's (at 5). Panic was blocked at here. Finally, this goroutine was scheduled to , would not exit or crash the whole process. The go code in is : Environment: Kubernetes version (use ):OS (e.g: ):Kernel (e.g. ):
/sig api-machinery
Thanks for finding this! Personally I think any lines of the form are a bug waiting to happen, and in all the cases introduced by are unnecessary - we can simply call at the end.
/assign
Your fix looks better. I think using is easy to make mistakes . It not only defers the execution of a function, but also has some side effects ...
Change:
TEST_ETCD_VERSION="2.2.1" fi <del> retry() { </del> <ins> function retry() { </ins> for i in {1..4}; do "$@" && return 0 || sleep $i done "$@" } <ins> function mount-master-pd() { if [[ ! -e /dev/disk/by-id/google-master-pd ]]; then echo "Can't find master-pd. Skipping mount." return fi device_info=$(ls -l "/dev/disk/by-id/google-master-pd") relative_path=${device_info##* } pd_device="/dev/disk/by-id/${relative_path}" echo "Mounting master-pd" local -r pd_path="/dev/disk/by-id/google-master-pd" local -r mount_point="/mnt/disks/master-pd" # Format and mount the disk, create directories on it for all of the master's # persistent data, and link them to where they're used. mkdir -p "${mount_point}" device=$1 mountpoint=$2 # Format only if the disk is not already formatted. if ! tune2fs -l "${pd_path}" ; then echo "Formatting '${pd_path}'" mkfs.ext4 -F -E lazy_itable_init=0,lazy_journal_init=0,discard "${pd_path}" fi mkdir -p "${mount_point}" echo "Mounting '${pd_path}' at '${mount_point}'" mount -o discard,defaults "${pd_path}" "${mount_point}" echo "Mounted master-pd '${pd_path}' at '${mount_point}'" # Contains all the data stored in etcd. mkdir -m 700 -p "${mount_point}/var/etcd" ln -s -f "${mount_point}/var/etcd" /var/etcd mkdir -p /etc/srv # Contains the dynamically generated apiserver auth certs and keys. mkdir -p "${mount_point}/srv/kubernetes" ln -s -f "${mount_point}/srv/kubernetes" /etc/srv/kubernetes # Directory for kube-apiserver to store SSH key (if necessary). mkdir -p "${mount_point}/srv/sshproxy" ln -s -f "${mount_point}/srv/sshproxy" /etc/srv/sshproxy if ! id etcd &>/dev/null; then useradd -s /sbin/nologin -d /var/etcd etcd fi } </ins> if [ "${EVENT_STORE_IP}" == "127.0.0.1" ]; then # Retry starting etcd to avoid pulling image errors. retry sudo docker run --net=host 

Discussion:
While running kubemark tests we are facing "no space left on device" problems, because master-disk is not mounted in kubemark.
I'm reopening it for now, since it seems that we are still facing "no space left on device" issues in kubemark scale.
Seems to be fixed by
Change:
}, { desc: "getServiceLoadBalancerStatus shall return nil if lb.FrontendIPConfigurations.name != " + <del> "az.getFrontendIPConfigName(service, subnet(service))", </del> <ins> "az.getFrontendIPConfigName(service)", </ins> service: &internalService, lb:      &lb3, },

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: When the specified internal LB uses a subnet with longer name, the LB configuration will fail with following error: What you expected to happen: When constructing the frontend IP configuration name and the load balancing rules name, the subnet name should be truncated if too long. How to reproduce it (as minimally and precisely as possible): Use a subnet that has long name (70 charactors) and create ILB service. Anything else we need to know?: Environment: Kubernetes version (use ): 1.15 Cloud provider or hardware configuration: azure OS (e.g: ): Ubuntu 16.04 Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others:
/sig cloud-provider /area provider/azure /assign
Change:
// Total number of available pods (ready for at least minReadySeconds) targeted by this StatefulSet. // This is a beta field and enabled/disabled by StatefulSetMinReadySeconds feature gate. <ins> // +optional </ins> optional int32 availableReplicas = 11; }

Discussion:
Looking at the for , it defines as a required attribute. But looking at the of , it states . Should this in fact be a required attribute? I come about this from using , a python package that generates models from the swagger definitions and thus builds a that requires an attribute that is not enabled. That only truly required attributes be required in the swagger definition Reproduction is not applicable as this is an issue with a spec No response Appeared in 1.22 (I believe) and affects current versions. Does not affect 1.21 n/a No response No response No response No response
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
alpha: has that is planned for removal in beta. ( results in fields as non-required in the OpenAPI) beta: removes the this might be a question whether feature gate controlled fields must remain until the feature gate is removed (and how would validation work in that case). ~old feature gates graduations to beta enabled a feature by default.~ a topic related to ? but it does not apply to feature gates. /kind documentation /sig apps
cc (since you are the author)
new fields to existing types must always be marked as +optional, since clients are not required to specify them
please open a PR adding back the +optional tag, regenerate openapi, and open picks back to 1.23 and 1.22
Change:
package create import ( <ins> "k8s.io/cli-runtime/pkg/genericclioptions" restclient "k8s.io/client-go/rest" cmdtesting "k8s.io/kubectl/pkg/cmd/testing" </ins> "testing" v1 "k8s.io/api/core/v1"

Discussion:
I'm writing a small bash script which generates some k8s resources in a namespace (other than ). When using to generate a service, the yaml which is generated does not include the defined namespace. I've also tried to move around the argument to the beginning (i.e. , but that doesn't work as well. Generated yaml should include the , when it's defined as an option. Kubernetes version (use ): Cloud provider or hardware configuration: n/a (not really important) OS (e.g: ): Kernel (e.g. ): Install tools: kubectl Network plugin and version (if this is a network-related bug): n/a Others: /sig cli
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig cli
/assign
Change:
import ( "github.com/onsi/ginkgo" <ins> v1 "k8s.io/api/core/v1" </ins> "k8s.io/apimachinery/pkg/util/sets" "k8s.io/kubernetes/test/e2e/framework" e2enetwork "k8s.io/kubernetes/test/e2e/framework/network"

Discussion:
What would you like to be : Right now we poll one node at a time for intra-pod tests. We ultimately fail a test if any one node is unreachable. If we instead polled all nodes, multiple times, and collected the number of times a node was unreachable, this would tell us what % of nodes on the cluster were broken, rather then just telling us the first node that was broken. not break the testing contract (were still verifying intra-pod connectivity, just doing so in a way that gives us holistic cluster info) Why is this needed: I described why this would make triage alot easier, and in general make it easier to see why tests are failing, here ... i'll collect a little more data on this to justify the decision .... as this is a conformance test so the bar for modification is higher (even if the test itself isnt changing) then regular tests.
/sig network
/assign
/triage unresolved Comment when the issue is assessed and confirmed. I am a bot run by vllry. ‍
/remove-triage unresolved
Change:
{% set override_deb_sha1='81abef31dd2c616883a61f85bfb294d743b1c889' %} {% endif %} <ins> {% if override_deb_url == '' %} {% set override_deb_url=storage_base + override_deb %} {% endif %} </ins> {% if override_docker_ver != '' %} purge-old-docker-package: pkg.removed:

Discussion:
GCE updated docker, but only via a base-image update. AWS should match versions of docker, to slipstream off all the testing that GCE gets. This will be slightly complicated because docker 1.8.3 isn't in the bucket AFAICT. Thanks to for the tip.
This is done by
Change:
} resyncPeriod := 1 * time.Millisecond r := NewReflector(lw, &api.Pod{}, s, resyncPeriod) <del> r.ListAndWatch(stopCh) </del> <ins> err := r.ListAndWatch(stopCh) if err != rerr { t.Errorf("expected exiting from err %v, got: %v", rerr, err) } </ins> if iteration != 2 { t.Errorf("exactly 2 iterations were expected, got: %v", iteration) }

Discussion:
I saw this as well. Log: Brief discussion in
I think I have a fix for this
Just submitted a PR that I believe fixes this. I was able to get the flakes locally w/o my PR and haven't seen any with it. PTAL!
how did you repro locally? I tried ran this test 1,000 times last night and it passed 1,000 times.
Change the resync period from 1 milli to 1 microsecond. You can also add 'stress -c 8' to the mix. On Friday, May 20, 2016, Matt Liggett wrote:
- FYI
sent which should fix this
Change:
validArgs := cmdutil.ValidArgList(f) cmd := &cobra.Command{ <del> Use: "get [(-o|--output=)json|yaml|wide|custom-columns=...|custom-columns-file=...|go-template=...|go-template-file=...|jsonpath=...|jsonpath-file=...] (TYPE [NAME | -l label] | TYPE/NAME ...) [flags]", </del> <ins> Use: "get [(-o|--output=)json|yaml|wide|custom-columns=...|custom-columns-file=...|go-template=...|go-template-file=...|jsonpath=...|jsonpath-file=...] (TYPE[.VERSION][.GROUP] [NAME | -l label] | TYPE[.VERSION][.GROUP]/NAME ...) [flags]", </ins> DisableFlagsInUseLine: true, Short:   i18n.T("Display one or many resources"), Long:    getLong + "nn" + cmdutil.SuggestApiResources(parent),

Discussion:
Is this a BUG REPORT or FEATURE REQUEST?: /kind feature /sig cli What happened: I have two custom resources in my cluster called Cluster, and couldn't figure out how to ask for one or the other. was of no help, and various Google searches for things like "kubectl apigroup" or "kubectl crd" revealed nothing of use. Worse, some bugs that came up like suggested that the syntax was , which produced entirely incorrect output (e.g. results in . Eventually, I stumbled by accident on the correct way to do it, which is to do and then , where is the name of the custom resource exactly as listed in the output of . I still don't know how to request a specific API version using this syntax, if that is even possible. What you expected to happen: I expected to document how to query custom resources, given that they're increasingly central to running production quality clusters with various operators. Failing that, I expected the k8s website to have documentation on querying custom resources that is discoverable via Google search. How to reproduce it (as minimally and precisely as possible): Install something that uses custom resources (e.g. Calico in k8s datastore mode, Rook), and try to one of the custom resources by precise name (e.g. assume that there are multiple objects defined by different CRDs, so you can't just , you have to be more precise). Environment: Kubernetes version (use ): 1.10.2 client+cserver
Opened with examples
Change:
Resource("pods"). Name(pod.Name). Namespace(pod.Namespace). <del> SubResource("exec"). Param("container", containerName) </del> <ins> SubResource("exec") </ins> req.VersionedParams(&corev1.PodExecOptions{ Container: containerName, Command:   p.Command,

Discussion:
<!-- --What happened: when use command, we found multi query param in the request, because we set the param twice in What you expected to happen: How to reproduce it (as minimally and precisely as possible): use command and set the log level to Anything else we need to know?: Environment: Kubernetes version (use ):Cloud provider or hardware configuration: OS (e.g. from /etc/os-release): Kernel (e.g. ): Install tools: Others:
/sig cli
It seems a duplicate 'container' param are set, thanks for your report. I will fix it later.
Change:
"storage.k8s.io/v1/csidrivers":                                     "hL6j/rwBV5w=", "storage.k8s.io/v1/csinodes":                                       "Pe62DkZtjuo=", "storage.k8s.io/v1/storageclasses":                                 "K+m6uJwbjGY=", <del> "storage.k8s.io/v1/csistoragecapacities":                           "4as6MA/kOg0=", </del> <ins> "storage.k8s.io/v1/csistoragecapacities":                           "xeVl+2Ly1kE=", </ins> "storage.k8s.io/v1/volumeattachments":                              "tJx/ezt6UDU=", <del> "storage.k8s.io/v1beta1/csistoragecapacities":                      "4as6MA/kOg0=", </del> <ins> "storage.k8s.io/v1beta1/csistoragecapacities":                      "xeVl+2Ly1kE=", </ins> "apps/v1/controllerrevisions":                                      "85nkx63pcBU=", "apps/v1/daemonsets":                                               "dd7pWHUlMKQ=", "apps/v1/deployments":                                              "8aSe+NMegvE=",

Discussion:
The override in can be removed in Kubernetes v1.25 because then the oldest supported kube-apiserver for downgrades will be v1.24 which will understand the v1 format. Also need to adapt See and Code cleanup...
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign
/sig storage
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
/remove-lifecycle stale /lifecycle frozen