jiebi/CodeConvo huggingface dataset:
Change:
// IsMountPoint determines whether a path is a mountpoint by calling findmnt // in the host's root mount namespace. <del> func (*NsenterMounter) IsMountPoint(file string) (bool, error) { </del> <ins> func (n *NsenterMounter) IsMountPoint(file string) (bool, error) { </ins> file, err := filepath.Abs(file) if err != nil { return false, err } <del> args := []string{"--mount=/rootfs/proc/1/ns/mnt", "/usr/bin/findmnt", "-o", "target", "--noheadings", "--target", file} </del> <ins> args := []string{"--mount=/rootfs/proc/1/ns/mnt", "--", n.absHostPath("findmnt"), "-o", "target", "--noheadings", "--target", file} </ins> glog.V(5).Infof("findmnt command: %v %v", nsenterPath, args) exec := exec.New()

Discussion:
What happened: Windows documentation claims: V1.VolumeMount.mountPropagation - only MountPropagationHostToContainer is available. However, the internals suggest otherwise; is always returned on Windows: Either the docs should be corrected, or the Kubelet should be updated, or we should have a comment on why this does in fact enable MountPropagationHostToContainer on Windows. /cc /sig windows
/cc
/cc
I think the doc is not accurate. The doc claims the same thing. For MountPropagationHostToContainer option, we can test it whether it is working or not.
i created two PRs to address the documentation gap. we will also test this and get back to this thread.
For 1.15 we may need to update Kubelet code to allow HostToContainer.
Change:
JSONPatchMaxCopyBytes:       10 * 1024 * 1024, MaxRequestBodyBytes:         -10 * 1024 * 1024, }, <del> expectErr: "--max-resource-write-bytes can not be negative value", </del> <ins> expectErr: "ServerRunOptions.MaxRequestBodyBytes can not be negative value", </ins> }, { name: "Test when LivezGracePeriod is negative value",

Discussion:
kube-apiserver has no --max-resource-write-bytes & --json-patch-max-copy-bytes option. Correct the error message to not use the "--max-resource-write-bytes" & "--json-patch-max-copy-bytes" string. Check the source code: No response v1.19 ~ v1.23 eg: </details<details</details<details</details<details</details<details</details<details</details
/sig api-machinery /area apiserver /kind cleanup /assign FYI:
/cc /triage accepted
Change:
} func (plugin *cniNetworkPlugin) TearDownPod(namespace string, name string, id kubecontainer.ContainerID) error { <ins> if err := plugin.checkInitialized(); err != nil { return err } </ins> netnsPath, err := plugin.host.GetRuntime().GetNetNS(id) if err != nil { return fmt.Errorf("CNI failed to retrieve network namespace path: %v", err) } <del> return plugin.defaultNetwork.deleteFromNetwork(name, namespace, id, netnsPath) </del> <ins> return plugin.getDefaultNetwork().deleteFromNetwork(name, namespace, id, netnsPath) </ins> } // TODO: Use the addToNetwork function to obtain the IP of the Pod. That will assume idempotent ADD call to the plugin.

Discussion:
Host network pods should be able to be created before the container network exists. Pod syncs for pods on the container network should fail until the container network is configured. cc
ref:
I think this is a thing we should make working before v1.4, so adding the milestone. Complain if you disagree. Also, does volunteer to make a PR? :)
Going to make a first pass at this in
Great!
/cc
Change:
func RestartKubeProxy(host string) error { // TODO: Make it work for all providers. if !ProviderIs("gce", "gke", "aws") { <del> return fmt.Errorf("unsupported provider: %s", TestContext.Provider) </del> <ins> return fmt.Errorf("unsupported provider for RestartKubeProxy: %s", TestContext.Provider) </ins> } // kubelet will restart the kube-proxy since it's running in a static pod Logf("Killing kube-proxy on node %v", host)

Discussion:
is failing with "framework.RestartControllerManager() = unsupported provider: gke; want nil" /kind failing-test
/sig network
Introduced in , should be fixed by
Change:
handler = genericapifilters.WithAuthentication(handler, authenticationInfo.Authenticator, failedHandler, nil) } handler = genericapifilters.WithRequestInfo(handler, requestInfoResolver) <ins> handler = genericapifilters.WithCacheControl(handler) </ins> handler = genericfilters.WithPanicRecovery(handler) return handler

Discussion:
The kube-apiserver is protected, so it's responses should not be cached. The only known exception is for openapi data which is not sensitive, which is large, and which has etags. /assign
/sig api-machinery
Change:
func (p *JSONPathPrinter) HandledResources() []string { return []string{} } <ins> // formatEventSource formats EventSource as a comma separated string excluding Host when empty func formatEventSource(es api.EventSource) string { EventSourceString := []string{es.Component} if len(es.Host) > 0 { EventSourceString = append(EventSourceString, es.Host) } return strings.Join(EventSourceString, ", ") } </ins>

Discussion:
Greetings, currently, when doing then in column, the ui result is maybe can do something like this instead? remove then join it with
How about something like ?
Greetings, thanks for the interest, I thought I may throw hacking on it. btw, how about for ?
For we can just print since it's master's component.
Hi looks like there is the same issue reported on the OpenShift Origin github: It would make more sense to solve that upstream. Should we do something together to solve it?
There is a pull request for that:
Change:
return false, []algorithm.PredicateFailureReason{ErrNodeUnschedulable}, nil } <ins> return true, nil, nil } // PodToleratesNodeTaints checks if a pod tolerations can tolerate the node taints func PodToleratesNodeTaints(pod *v1.Pod, meta algorithm.PredicateMetadata, nodeInfo *schedulercache.NodeInfo) (bool, []algorithm.PredicateFailureReason, error) { if nodeInfo == nil || nodeInfo.Node() == nil { return false, []algorithm.PredicateFailureReason{ErrNodeUnknownCondition}, nil } </ins> return podToleratesNodeTaints(pod, nodeInfo, func(t *v1.Taint) bool { // PodToleratesNodeTaints is only interested in NoSchedule and NoExecute taints. return t.Effect == v1.TaintEffectNoSchedule || t.Effect == v1.TaintEffectNoExecute

Discussion:
DaemonSet should not respect node's field. It's because cluster operators often want system components to be running and ready before workloads run on a given node. OTOH, DaemonSet does respect NoSchedule taints. This behavior is broken by , because DaemonSet share some predicates code with default scheduler.
/assign
Added this to 1.10 milestone, because it's a regression introduced in 1.10.
can you (or a SIG lead) add status/approved-for-milestone please? I'll add the priority. /priority important-soon
how is this use case satisfied by the daemonset controller creating pods and depending on the scheduler to assign them to nodes? having the scheduler ignore the unschedulable field seems nonsensical
I'd like get this as limitation for alpha feature; when upgrade to beta, I'd like to use taint to replace un-scheduable, so DaemonSet pod can tolerate it on-demand.
Escalating to critical-urgent, since we are now in Code Freeze. Please update daily with status, thanks! /priority critical-urgent /remove-priority important-soon
In short term, scheduler can check of pods and ignore bit of nodes for DS pods. Long term, when TaintNodesByCondition is stable, we should replace bit by taint and have DS controller add toleration for the taint when creating pods.
That doesn't seem proper. Making pods behave differently depending on the type of their creating object is very counterintuitive. That seems more reasonable. I'm less certain about auto- tolerations
- indeed there's some work currently to move from to a taint based behaviour, tracked by
Change:
} By("updating the annotation value") <del> var podClient *framework.PodClient podClient = f.PodClient() </del> podClient.Update(podName, func(pod *v1.Pod) { pod.ObjectMeta.Annotations["mysubpath"] = "mynewpath" })

Discussion:
Which jobs are failing: All new tests introduced for api change Which test(s) are failing: New alpha subpathExpr tests [Feature:VolumeSubpathEnvExpansion][NodeAlphaFeature:VolumeSubpathEnvExpansion] Existing tests are working fine and the whole suite works correctly in the gce suite https://k8s- Since when has it been failing: 21st February 2019 (since merge of PR) Testgrid link: https://k8s- Reason for failure: Investigation shows that node e2e tests use a different framework pod creation pattern Doing some comparisons of tests that work and those that don't reveals differences in the standard client set as and the existing ones which do work go through the intermediate which uses The version has an additional function specifically for node tests
/sig storage
/sig node /sig test
/assign
/cc
/sig test
Change:
func IsValidPortNum(port int) bool { return 0 < port && port < 65536 } <ins> // IsValidIP tests that the argument is a valid IPv4 address. func IsValidIP(value string) bool { return net.ParseIP(value) != nil && net.ParseIP(value).To4() != nil } </ins>

Discussion:
When spinning up VMs w/ kube, I attempted to use but this fails. ironically, 127.0.0.1 succeeds (internally you can then access a kube service via , for example, but you cannot do this if you try to bind to 0.0.0.0. binding works to 127.0.0.1, but is a horrible idea (since this IP wont be reachable by the outside world), so in that case kube should print a clear message on why this is the case and fail. binding to 0.0.0.0 fails right out of the bat, so in this case, also, kube should fail immediately. To be clear, im suggesting that these should fail at the service submission layer. Possibly a module for validating logic of submitted services/pods , which extends syntactical validation is in order if one doesn't already exist?
Please also see
Since this is very similar to I'm gonna take this.
Change:
return nil } <del> func (lbaas *LbaasV2) createLoadBalancer(service *v1.Service, name string) (*loadbalancers.LoadBalancer, error) { </del> <ins> func (lbaas *LbaasV2) createLoadBalancer(service *v1.Service, name string, internalAnnotation bool) (*loadbalancers.LoadBalancer, error) { </ins> createOpts := loadbalancers.CreateOpts{ Name:        name, Description: fmt.Sprintf("Kubernetes external service %s", name),

Discussion:
Is this a BUG REPORT or FEATURE REQUEST?: /kind feature What happened: Currently openstack cloud provider just support for specifying internal LoadBalancerIP. I think that is unreasonable, actually user just use a floating ip to access a LoadBalancer service. So it is necessary to spport for specifying external LoadBalancerIP. What you expected to happen: Support for specifying external LoadBalancerIP on openstack Anything else we need to know?: Currently LoadBalancerIP can be specified in service.Spec.LoadBalancerIP, we can add annotation to distinguish between internal and external.
/sig openstack /assign I'd like to work for it.
Change:
container := api.Container{ Ports: []api.ContainerPort{ { <del> Name:     "foo", HostPort: 8080, </del> <ins> Name:          "foo", ContainerPort: 8080, </ins> }, { <del> Name:     "bar", HostPort: 9000, </del> <ins> Name:          "bar", ContainerPort: 9000, </ins> }, }, }

Discussion:
When using probe, define the port by number, it works. But if the port is defined by name like below, it doesn't work. it seems should return other than .
Change:
"x=a,y=b,z=c", "", "x!=a,y=b", <ins> "x=", "x= ", "x=,z= ", "x= ,z= ", </ins> } testBadStrings := []string{ "x=a||y=b",

Discussion:
When polling a k8s master with the response is an HTTP 500. But even if this selector is invalid, it should return a 4xx code instead.
Do you get 500 without the label selector? cc
No, and not with a value like "environment%3Dfoobar". But if I remove "foobar" or replace it with an url-encoded space, i.e. "environment%3D%20" or "environment%3D+" I get a 500. I suspect that the value (after the colon) is stripped of whitespace, and if the result is the empty string, this error happens.
Bumping priority to P1 since this is definitely a bug and we should fix it.
you had five days, I'm kicking you off of this & giving to Chao. :)
Change:
} } <ins> func TestStatus(t *testing.T) { _, s, closeFn := framework.RunAMaster(nil) defer closeFn() u := s.URL + "/apis/batch/v1/namespaces/default/jobs/foo" resp, err := http.Get(u) if err != nil { t.Fatalf("unexpected error getting %s: %v", u, err) } if resp.StatusCode != http.StatusNotFound { t.Fatalf("got status %v instead of 404", resp.StatusCode) } defer resp.Body.Close() data, _ := ioutil.ReadAll(resp.Body) decodedData := map[string]interface{}{} if err := json.Unmarshal(data, &decodedData); err != nil { t.Logf("body: %s", string(data)) t.Fatalf("got error decoding data: %v", err) } t.Logf("body: %s", string(data)) if got, expected := decodedData["apiVersion"], "v1"; got != expected { t.Errorf("unexpected apiVersion %q, expected %q", got, expected) } if got, expected := decodedData["kind"], "Status"; got != expected { t.Errorf("unexpected kind %q, expected %q", got, expected) } if got, expected := decodedData["status"], "Failure"; got != expected { t.Errorf("unexpected status %q, expected %q", got, expected) } if got, expected := decodedData["code"], float64(404); got != expected { t.Errorf("unexpected code %v, expected %v", got, expected) } } </ins> func TestWatchSucceedsWithoutArgs(t *testing.T) { _, s, closeFn := framework.RunAMaster(nil) defer closeFn()

Discussion:
We have moved to non-global schema in a number of places in 1.6 and 1.7. It is easy to forget registering the unversioned types like , leading to encoding errors in error cases. The registration of the unversioned types should be automatic as for the types, i.e. in .
There are no sig labels on this issue. Please by:<br(1) mentioning a sig: <br(2) specifying the label manually: <br<brNote: method (1) will trigger a notification to the team. You can find the team list and label list
do we need to close out this issue? (since referenced PR has merged)
Fixed by
Change:
return p.parseInsideAction(cur) } <del> // parseRecursive scans the recursive desent operator .. </del> <ins> // parseRecursive scans the recursive descent operator .. </ins> func (p *Parser) parseRecursive(cur *ListNode) error { <ins> if lastIndex := len(cur.Nodes) - 1; lastIndex >= 0 && cur.Nodes[lastIndex].Type() == NodeRecursive { return fmt.Errorf("invalid multiple recursive descent") } </ins> p.pos += len("..") p.consumeText() cur.append(newRecursive())

Discussion:
What happened: This issue was originally reported via the Kubernetes HackerOne bug bounty by HackerOne user but we have decided that due to the high privileges required, it can be addressed publicly. A user able to create CRDs could create a malicious CRD such that listing CRs will cause enormous amounts of CPU usage on the API server. What you expected to happen: The function should not expand strings with more than two consecutive periods. Either it should collapse additional repeated periods or it should return an error. How to reproduce it (as minimally and precisely as possible): /kind bug /area apiserver /area security /committee product-security /priority important-longterm
How about we take it a step further by rejecting the jsonpath which contains when parsing it? as more than 2 periods seem to make no sense IMO
good idea. I have posted to do what you suggest.
/sig api-machinery
/cc
Change:
errorStatus  = "ERROR" ServiceAnnotationLoadBalancerFloatingNetworkId = "loadbalancer.openstack.org/floating-network-id" <ins> // ServiceAnnotationLoadBalancerInternal is the annotation used on the service // to indicate that we want an internal loadbalancer service. // If the value of ServiceAnnotationLoadBalancerInternal is false, it indicates that we want an external loadbalancer service. Default to true. ServiceAnnotationLoadBalancerInternal = "service.beta.kubernetes.io/openstack-internal-load-balancer" </ins> ) // LoadBalancer implementation for LBaaS v1

Discussion:
Is this a BUG REPORT or FEATURE REQUEST?: /kind feature What happened: Currently openstack cloud provider just support for specifying internal LoadBalancerIP. I think that is unreasonable, actually user just use a floating ip to access a LoadBalancer service. So it is necessary to spport for specifying external LoadBalancerIP. What you expected to happen: Support for specifying external LoadBalancerIP on openstack Anything else we need to know?: Currently LoadBalancerIP can be specified in service.Spec.LoadBalancerIP, we can add annotation to distinguish between internal and external.
/sig openstack /assign I'd like to work for it.
Change:
BeforeEach(func() { framework.SkipUnlessNodeCountIsAtLeast(minNodes) <ins> cs = f.ClientSet ns = f.Namespace.Name </ins> <del> podClient = f.ClientSet.Core().Pods(f.Namespace.Name) nodeClient = f.ClientSet.Core().Nodes() nodes = framework.GetReadySchedulableNodesOrDie(f.ClientSet) </del> <ins> podClient = cs.Core().Pods(ns) nodeClient = cs.Core().Nodes() nodes = framework.GetReadySchedulableNodesOrDie(cs) </ins> Expect(len(nodes.Items)).To(BeNumerically(">=", minNodes), fmt.Sprintf("Requires at least %d nodes", minNodes)) host0Name = types.NodeName(nodes.Items[0].ObjectMeta.Name) host1Name = types.NodeName(nodes.Items[1].ObjectMeta.Name)

Discussion:
When pod is evicted, pod is terminated. After this change , attach/detach controller should be able to detach the pod correctly so that new pod which uses the same volume will start up. We need to have an e2e test for this scenario.
what environment is good for this e2e test? GCE or GKE or AWS? I see we have which has func, Can you comment on why is insufficient to cover this issue?
does the pod need to be evicted? Or would be ok to delete the pod and then check that the PD is detached. Then create a new pod using the same PD and test that it attaches?
[MILESTONENOTIFIER] Milestone Removed Important: This issue was missing labels required for the v1.9 milestone for more than 3 days: kind: Must specify exactly one of , or . <details<summaryHelp</summary<ul<li<a href=""Additional instructions</a</li<li<a href=""Commands for setting labels</a</li</ul</details
ping ^^
sorry for the delay. Here we want to test the detach behavior of evicted pods. So delete a pod directly is different from it. When Pod is evicted, the containers will be killed and the pod status is terminated. But the pod api object is not deleted from API server. Before PR , such evicted pods will not trigger detach operation because the pod api object is not deleted from api server. So the purpose of the test is to make sure detach operation is triggered for such evicted pods.
Thanks Do you have a suggestion for how to force a pod to be evicted?
You could have the pod do some memory intensive application
ah, like my use of in the io-streaming pr :-)
- Here's another option to cause eviction: .
Change:
stop := make(chan struct{}) namespaceController.Run(stop) <del> ns1 := api_v1.Namespace{ ObjectMeta: api_v1.ObjectMeta{ Name:     "test-namespace", SelfLink: "/api/v1/namespaces/test-namespace", }, } </del> // Test add federated namespace. namespaceWatch.Add(&ns1) createdNamespace := GetNamespaceFromChan(cluster1CreateChan)

Discussion:
In PR the specific resource types are handled explicitly. Need to delete them in more generic way, in a similar way that namespace controller does.
- switching this to 1.6 as it's too late for 1.5. ok? (please switch it right back if you disagree)
did fix this?
Please close or move to next-candidate with work remaining to be done.
Yes fixed by
Change:
selector: matchLabels: k8s-app: elasticsearch-logging <del> version: v7.1.1 </del> <ins> version: v7.2.0 </ins> template: metadata: labels: k8s-app: elasticsearch-logging <del> version: v7.1.1 </del> <ins> version: v7.2.0 </ins> spec: serviceAccountName: elasticsearch-logging containers: <del> - image: quay.io/fluentd_elasticsearch/elasticsearch:v7.1.1 </del> <ins> - image: quay.io/fluentd_elasticsearch/elasticsearch:v7.2.0 </ins> name: elasticsearch-logging <ins> imagePullPolicy: Always </ins> resources: # need more cpu upon initialization, therefore burstable class limits:

Discussion:
What happened: On latest fluentd-elasticsearch, the elasticsearch replicas seems failed to form a valid cluster with the service discovery helper written in golang. What you expected to happen: Successfully boot up an elasticsearch cluster I guess. How to reproduce it (as minimally and precisely as possible): Just use the yamls in and the elasticsearch-logging pods will keep spamming warning messages. I think thats because options are deprecated in elasticsearch 7.x.x Anything else we need to know?: IMHO I think thats all. Environment: Kubernetes version (use ): 1.12.4 Cloud provider or hardware configuration: AKS OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others:
/sig instrumentation
Thanks
Change:
// Note that containerID is only needed when following the log, or else // just pass in empty string "". func ReadLogs(ctx context.Context, path, containerID string, opts *LogOptions, runtimeService internalapi.RuntimeService, stdout, stderr io.Writer) error { <ins> // fsnotify has different behavior for symlinks in different platform, // for example it follows symlink on Linux, but not on Windows, // so we explicitly resolve symlinks before reading the logs. // There shouldn't be security issue because the container log // path is owned by kubelet and the container runtime. evaluated, err := filepath.EvalSymlinks(path) if err != nil { return fmt.Errorf("failed to try resolving symlinks in path %q: %v", path, err) } path = evaluated </ins> f, err := os.Open(path) if err != nil { return fmt.Errorf("failed to open log file %q: %v", path, err)

Discussion:
doesn't work for Windows node. After some investigation, I think the problem is that for Docker the log file reads is a symlink to the actual docker container log file. On linux, I believe fsnotify follows symlink by default , so it works on linux. However, on windows I believe it doesn't follow the symlink. I tried to replace the symlink file with an actual file and append log to it, will start working after that. The proposed solution is to explicitly follow the symlink in Kubelet, so that we get more consist behavior across different platforms.
/cc
Note that this happened to be fixed by in HEAD. But we may still want to follow the symlink which is a more proper fix.