jiebi/CodeConvo huggingface dataset:
Change:
} secondaryAllocatorCIDR := r.secondaryServiceIPs.CIDR() <del> if netutil.IsIPv6String(service.Spec.ClusterIP) && netutil.IsIPv6CIDR(&secondaryAllocatorCIDR) { </del> <ins> if netutil.IsIPv6String(service.Spec.ClusterIP) == netutil.IsIPv6CIDR(&secondaryAllocatorCIDR) { </ins> return r.secondaryServiceIPs }

Discussion:
What happened: When K8s is started in dual-stack mode with IPv6 as the "main" (or base) family services specified with ipFamily:IPv4 still get a ipv6 ; The is expicitly set to "10.0.0.0" using . What you expected to happen: Services with ipFamily:IPv4 shall get ipv4 ClusterIP addresses. How to reproduce it (as minimally and precisely as possible): Setup a K8s cluster in dual-stack mode with family IPv6 as base Define a service with ipFamily: IPv4 To make K8s think IPv6 is the main family the cue is to define ipv6 addresses to K8s binaries. Below are my settings as an example. I do not use but install "from scratch"; Master processes; is accessed with ipv4 which does not affect the K8s family. Worker processes; Anything else we need to know?: There are other problems with dual-stack/ipv6-base but may be caused by this one. For example does not work and some processes does not become "ready". Ipv6 traffic to ipv6 services and DNS works; Environment: Kubernetes version (use ):Cloud provider or hardware configuration: - OS (e.g: ): BusyBox based own setup. Kernel (e.g. ):Install tools: "from scratch" Network plugin and version (if this is a network-related bug): Others:
/sig network /cc
The problem seem to be; The problem occurs when an ipv6 range is specified first, even in an ipv4-based dual-stack cluster. But the ipv6 range must be specified first otherwise the "kubernetes" service gets an ipv4 address but an ipv6 backend; ~Perhaps the way to fix this problem is to make sure the service address is from the right family and require that the order to is "ipv4,ipv6".~ Bad idea!
There seem to be a option; But I can't see it in the help printout. I will try to use it...
:disappointed:
Here it where the kubernetes service address is set;
/assign
/triage unresolved Comment when the issue is assessed and confirmed. I am a bot run by vllry. ‍
Change:
imageutils "k8s.io/kubernetes/test/utils/image" "github.com/onsi/ginkgo" <ins> "github.com/onsi/gomega" </ins> ) <del> var _ = SIGDescribe("Ephemeral Containers", func() { </del> <ins> var _ = SIGDescribe("Ephemeral Containers [NodeFeature:EphemeralContainers]", func() { </ins> f := framework.NewDefaultFramework("ephemeral-containers-test") var podClient *framework.PodClient ginkgo.BeforeEach(func() {

Discussion:
E2eNode Suite.[sig-node] Ephemeral Containers will start an ephemeral container in an existing pod node-kubelet-orphans Unknown, possibly was never green No response KEP: /sig node
Also need to fish this test out of the orphans by adding the label
can you please take a look?
yup, happy to /assign
could you explain this more? This label should exist even though the feature is no longer alpha?
Looks like the tests are still passing in the presubmits It looks like the kubectl invocation is asking for a username?
Moved to node features and now the error message is: kubectl isn't available to the node tests? Hmm..
/triage accepted
/reopen The test is flaking now, can you please take a look?
Reopened this issue. <detailsIn response to : /reopen Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Ah, I think I know what the problem is. Didn't get a chance to look at it today but will get to it soon.
FYI, I spot checked several of the recent failures and so far none of them include the fix commit. Will keep an eye on it.
Yes, thank you. Looks very green now
Change:
import ( "context" <ins> corev1 "k8s.io/api/core/v1" </ins> discoveryv1beta1 "k8s.io/api/discovery/v1beta1" apiequality "k8s.io/apimachinery/pkg/api/equality" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime/schema" <ins> "k8s.io/apimachinery/pkg/util/sets" </ins> "k8s.io/apimachinery/pkg/util/validation/field" genericapirequest "k8s.io/apiserver/pkg/endpoints/request" "k8s.io/apiserver/pkg/storage/names" utilfeature "k8s.io/apiserver/pkg/util/feature" "k8s.io/kubernetes/pkg/api/legacyscheme" <ins> apivalidation "k8s.io/kubernetes/pkg/apis/core/validation" </ins> "k8s.io/kubernetes/pkg/apis/discovery" "k8s.io/kubernetes/pkg/apis/discovery/validation" "k8s.io/kubernetes/pkg/features"

Discussion:
On the first update of an EndpointSlice using the v1 API, we drop deprecatedTopology with EndpointSlice strategy. Although we only do this if at least 1 endpoint has been modified, there is no guarantee that node name has been populated for all endpoints within the EndpointSlice. This is most noticeable if the first update using the v1 API is only adding endpoint(s). In that case the EndpointSlice controller does not update EndpointSlices and instead just adds the new endpoint(s). That will cause node names to be dropped from the deprecated topology field without having the newer node name field populated. Node name to be retained in deprecated topology until the new field was populated. an EndpointSlice with the v1beta1 API. an endpoint in that EndpointSlice: No response This is most notable after upgrading a 1.20 cluster to 1.21, but can technically occur in any 1.21 or newer cluster. Any Any Any N/A N/A
I'm working on a fix for this, hoping to have it out later today. /triage accepted /sig network /cc
I think this is better characterized as a controller bug, but is the safest mitigation I can think of in the short term, since we don't want to rewrite 100% of endpointslices on startup. Can you open a separate issue to work through the controller reconciliation so that v1 clients can depend on the nodeName field more reliably?
Change:
podName       string } <del> // func that attempts suicide type jumper func(bindings.ExecutorDriver, <-chan struct{}) type suicideWatcher interface { Next(time.Duration, bindings.ExecutorDriver, jumper) suicideWatcher Reset(time.Duration) bool Stop() bool } </del> type podStatusFunc func() (*api.PodStatus, error) // KubeletInterface consists of the kubelet.Kubelet API's that we actually use

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: Followed the documentation on rules to limit group Id's to non-superuser (root) using the rule. The creation attempt failed with: From PSP yaml: What you expected to happen: Successfully create a new PSP for non-superuser (root) group privileges using available rule values (which actually seems to be , , according the the ) How to reproduce it (as minimally and precisely as possible): Attempt to create a PSP with a rule set to Anything else we need to know?: I don't think so Environment: Kubernetes version (use ): , looks to affect , and doc as well Cloud provider or hardware configuration: IBM Cloud OS (e.g: ):Kernel (e.g. ): Install tools: Others:
/sig docs
/assign
thanks will send out a fix next week
I wonder whether this is a bug in implementation or the document. Is this really a documentation issue?
yes, RunAsGroup does not support MustRunAsNonRoot
Got it. Thank you!
/priority important-soon
Change:
// Not federated namespace, ignoring. return } <del> baseNamespace := baseNamespaceObj.(*api_v1.Namespace) </del> <ins> // Create a copy before modifying the namespace to prevent race condition with // other readers of namespace from store. namespaceObj, err := conversion.NewCloner().DeepCopy(namespaceObjFromStore) baseNamespace, ok := namespaceObj.(*api_v1.Namespace) if err != nil || !ok { glog.Errorf("Error in retrieving obj from store: %v, %v", ok, err) nc.deliverNamespace(namespace, 0, true) return } </ins> if baseNamespace.DeletionTimestamp != nil { if err := nc.delete(baseNamespace); err != nil { glog.Errorf("Failed to delete %s: %v", namespace, err)

Discussion:
Unit tests on PR are failing due to data race in federation-controller/namespace unittest. More logs: https://k8s-
CC
Sent to fix this
Change:
if esTracker.Stale(tc.checksParam) != tc.expectStale { t.Errorf("tc.tracker.Stale(%+v) == %t, expected %t", tc.checksParam, esTracker.Stale(tc.checksParam), tc.expectStale) } <ins> assert.Equal(t, tc.expectResourceVersionsByService, esTracker.resourceVersionsByService) </ins> }) } }

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: The endpointSliceTracker creates a set of resource versions for each service, the resource versions in the set could be deleted when endpointslices are deleted, but the set and its key in the map is never deleted, leading to memory leak. What you expected to happen: The set of resource versions should be delete from endpointSliceTracker when the service is deleted. Environment: Kubernetes version (use ): 1.18.5
There are no sig labels on this issue. Please add an appropriate label by using one of the following commands: - Please see the for a listing of the SIGs, working groups, and committees available. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/cc
Change:
newVM := compute.VirtualMachine{ Location: vm.Location, VirtualMachineProperties: &compute.VirtualMachineProperties{ <ins> HardwareProfile: vm.HardwareProfile, </ins> StorageProfile: &compute.StorageProfile{ DataDisks: &disks, },

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks!--What happened: vm sku restriction policy does not work in azure disk attach/detach If user set up a vm sku(vm size) restriction policy, only allow set up specified VM size in current subscription, disk attach/detach would fail. Error is like following: What you expected to happen: How to reproduce it (as minimally and precisely as possible): Anything else we need to know?: Environment: Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g. from /etc/os-release): Kernel (e.g. ): Install tools: Others: <!-- DO NOT EDIT BELOW THIS LINE --/kind bug /sig azure /assign
Change:
# cleanup kubectl delete svc prune-svc 2>&1 "${kube_flags[@]:?}" <ins> ## kubectl apply --prune can prune resources not in the defaulted namespace # Pre-Condition: namespace nsb exists; no POD exists kubectl create ns nsb kube::test::get_object_assert pods "{{range.items}}{{${id_field:?}}}:{{end}}" '' # apply a into namespace nsb kubectl apply --namespace nsb -f hack/testdata/prune/a.yaml "${kube_flags[@]:?}" kube::test::get_object_assert 'pods a -n nsb' "{{${id_field:?}}}" 'a' # apply b with namespace kubectl apply --namespace nsb -f hack/testdata/prune/b.yaml "${kube_flags[@]:?}" kube::test::get_object_assert 'pods b -n nsb' "{{${id_field:?}}}" 'b' # apply --prune must prune a kubectl apply --prune --all -f hack/testdata/prune/b.yaml # check wrong pod doesn't exist output_message=$(! kubectl get pods a -n nsb 2>&1 "${kube_flags[@]:?}") kube::test::if_has_string "${output_message}" 'pods "a" not found' # check right pod exists kube::test::get_object_assert 'pods b -n nsb' "{{${id_field:?}}}" 'b' # cleanup kubectl delete ns nsb ## kubectl apply -n must fail if input file contains namespace other than the one given in -n output_message=$(! kubectl apply -n foo -f hack/testdata/prune/b.yaml 2>&1 "${kube_flags[@]:?}") kube::test::if_has_string "${output_message}" 'the namespace from the provided object "nsb" does not match the namespace "foo".' </ins> ## kubectl apply -f some.yml --force # Pre-condition: no service exists

Discussion:
Not sure if this is a bug, feature requests, or a documentation issue. What happened: I am trying to apply some configs with --prune, and was surprised by the behavior. I have a config file with objects in multiple namespaces, and apply with (note: no flag). By kube context was set to a namespace that was not in the manifests. Here is what I found: If my context is set to a random namespace, nothing is pruned If its set to namespace X, only objects in namespace X are applied If I pass a flag I can control which namespace gets pruned, but that will break the apply because the file has multiple namespaces in it What you expected to happen: I expect some way to be able to apply a config file with objects in multiple namespace and having pruning across all namespaces. Seems there are a few options: all namespaces referenced in the file, prune these across all namespaces warn about why we are not pruning due to namespace mismatch How to reproduce it (as minimally and precisely as possible): Run the script from namespace default, a, and b. You will see different behavior on each run. Related? Environment: Kubernetes version (use ): 1.17.0 Others: /sig cli
I encountered this issue. I think has the bug that o.namespace gets "default" if no namespace is given. Then only a single namespace is visited with or without namespace. If my observation is correct, it changes the bahaviour drastically. In my work, pruning just stops working.
Change:
return err } for ix := range objs { <del> if err := s.printOneObject(objs[ix], parsers, w); err != nil { </del> <ins> if err := s.printOneObject(objs[ix], parsers, out); err != nil { </ins> return err } } } else { <del> if err := s.printOneObject(obj, parsers, w); err != nil { </del> <ins> if err := s.printOneObject(obj, parsers, out); err != nil { </ins> return err } } <del> return w.Flush() </del> <ins> return nil </ins> } func (s *CustomColumnsPrinter) printOneObject(obj runtime.Object, parsers []*jsonpath.JSONPath, out io.Writer) error {

Discussion:
Compare the following two outputs (note the bad alignment in the last line): The custom-columns string is exactly the same in both cases, but something messes up the column widths when using openapi print columns. Is this a BUG REPORT or FEATURE REQUEST?: /kind bug What happened: Columns printed when using are misaligned. What you expected to happen: Columns in all rows should be aligned. How to reproduce it (as minimally and precisely as possible): Deploy Service Catalog, patched with Run the above two commands Environment: Kubernetes version (use ): Client Version: version.Info{Major:"1", Minor:"9+", GitVersion:"v1.9.0-alpha.3", GitCommit:"", GitTreeState:"clean", BuildDate:"2017-11-15T23:06:17Z", GoVersion:"go1.9.1", Compiler:"gc", Platform:"linux/amd64"} Server Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.0", GitCommit:"", GitTreeState:"dirty", BuildDate:"2017-10-17T15:09:55Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"} (same behavior with kubectl built from current master branch)
/sig api-machinery
/remove-sig api-machinery /sig cli PR is ready:
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale
Change:
} func (p *Poller) sync(e Enumerator) { <del> current := p.store.Contains() </del> <ins> current := p.store.ContainedIDs() </ins> for i := 0; i < e.Len(); i++ { id, object := e.Get(i) p.store.Update(id, object)

Discussion:
The client/cache interface has a method which is supposed to return a of the IDs in a store. This is a bit misleading and should probably be renamed to 'Contents' or 'ContainedIDs'.
Thoughts
I tend to agree. contains to me should always return a bool and take an input key. Sent from my iPhone
Yeah, I agree, both of the suggested names would be an improvement.
Change:
signalToNodeCondition map[evictionapi.Signal]v1.NodeConditionType // signalToResource maps a Signal to its associated Resource. signalToResource map[evictionapi.Signal]v1.ResourceName <del> // resourceToSignal maps a Resource to its associated Signal resourceToSignal map[v1.ResourceName]evictionapi.Signal </del> <ins> // resourceClaimToSignal maps a Resource that can be reclaimed to its associated Signal resourceClaimToSignal map[v1.ResourceName][]evictionapi.Signal </ins> ) func init() {

Discussion:
It is possible to have multiple signals that point to the same type of resource, e.g., both SignalNodeFsAvailable and SignalAllocatableNodeFsAvailable refer to the same resource NodeFs. Change the map from map[v1.ResourceName]evictionapi.Signal to map[v1.ResourceName][]evictionapi.Signal
There are no sig labels on this issue. Please by: a sig: e.g., to notify the contributor experience sig, OR the label manually: e.g., to apply the label Note: Method 1 will trigger an email to the group. You can find the group list and label list . The in the method 1 has to be replaced with one of these: bugs, feature-requests, pr-reviews, test-failures, proposals
/kind cleanup /priority important/soon taking a guess at labels to satisfy the milestone munger
[MILESTONENOTIFIER] Milestone Labels Complete Issue label settings: sig/node sig/storage: Issue will be escalated to these SIGs if needed. priority/important-soon: Escalate to the issue owners and SIG owner; move out of milestone after several unsuccessful escalation attempts. kind/cleanup: Adding tests, refactoring, fixing old bugs. <detailsAdditional instructions available <a href=""here</aThe commands available for adding these labels are documented <a href=""here</a</details
Looks like the PR for this is just awaiting merge
Change:
} runner := New(&fexec) // Success <del> ok, err := runner.TestEntry(testEntry.String(), "FOOBAR") </del> <ins> ok, err := runner.TestEntry(testEntry.String(), setName) </ins> if err != nil { t.Errorf("expected success, got %v", err) } if fcmd.CombinedOutputCalls != 1 { t.Errorf("expected 2 CombinedOutput() calls, got %d", fcmd.CombinedOutputCalls) } <del> if !sets.NewString(fcmd.CombinedOutputLog[0]...).HasAll("ipset", "test", "FOOBAR", "10.120.7.100,tcp:8080") { </del> <ins> if !sets.NewString(fcmd.CombinedOutputLog[0]...).HasAll("ipset", "test", setName, "10.120.7.100,tcp:8080") { </ins> t.Errorf("wrong CombinedOutput() log, got %s", fcmd.CombinedOutputLog[0]) } if !ok {

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks!--The method only finds string in output of , but when the name of the set contains , it will return no matter the entry exists in ipset or not. What happened: returns false whenever entry exists if the name of set contains , e,g: , , What you expected to happen: returns whether the entry exists whatever the set name is How to reproduce it (as minimally and precisely as possible): replace the set name to any name containing , for example in of , then cd to and run , and it fails on . Anything else we need to know?: Environment: Kubernetes version (use ): v1.11.6, but the bug still exists in Cloud provider or hardware configuration: OS (e.g. from /etc/os-release): Kernel (e.g. ): Install tools: Others: /sig network /kind bug
/assign
This page says that returns non-zero when entry does not exist in set, and zero when entry exists: and I tested the output of (ipset v6.29 on Ubuntu 16.04 LTS, kernel 4.4.0-116-generic),the result goes as follow: so maybe we can judge by return value of command and the separated output of stdout and stderr,
Change:
} options.CleanupAndExit = true <del> proxyserver, err := NewProxyServer(options.config, options.CleanupAndExit, options.CleanupIPVS, options.scheme, options.master) </del> <ins> proxyserver, err := NewProxyServer(options) </ins> assert.Nil(t, err, "unexpected error in NewProxyServer, addr: %s", addr) assert.NotNil(t, proxyserver, "nil proxy server obj, addr: %s", addr)

Discussion:
https://k8s- https://k8s- cc: /kind bug /priority failing-test
This is at least twice in a week we've had cross break due to a public method signature change not being brought to all platforms () We should do:
I'm lost - the PR in question adds an argument and fixes the call-site - what is broken?
Ahh, I see.
How did that PR get through, if it is so obviously broken on Cross?
Cross build doesn't run 100% of the time as a pre-submit (because it takes so long), and it can't block. It's something sig-testing is tracking, but there isn't a quick fix yet.
Looks like was skipped for that PR: "pull-kubernetes-cross Skipped" not sure why yet.
Cross runs when a file matching: changes, (which needs to be fixed, opening a test-infra issue to expand the regex), but also some files could have build tags without the file name matching () Additionally cross is not blocking (), the underlying bug should be fixed now though so once we get the fix in to k/k we can make it blocking when it does run.
I find has already sent a PR. Thanks!
Change:
return err } <ins> // visitNode handles debugging for node targets by creating a privileged pod running in the host namespaces. // Returns an already created pod and container name for subsequent attach, if applicable. func (o *DebugOptions) visitNode(ctx context.Context, node *corev1.Node) (*corev1.Pod, string, error) { pods := o.podClient.Pods(o.Namespace) newPod, err := pods.Create(ctx, o.generateNodeDebugPod(node.Name), metav1.CreateOptions{}) if err != nil { return nil, "", err } return newPod, newPod.Spec.Containers[0].Name, nil } </ins> // visitPod handles debugging for pod targets by (depending on options): //   1. Creating an ephemeral debug container in an existing pod, OR //   2. Making a copy of pod with certain attributes changed

Discussion:
This issue tracks implementing node debugging with privileged containers for , as described in the This feature allows administrators to start a privileged container on a node in host namespaces rather than having to SSH to the node. For example: /kind feature /sig cli
/assign
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale