jiebi/CodeConvo huggingface dataset:
Change:
}{ "No Discovery Error": { discoveryError:    nil, <del> possibleResources: nil, </del> <ins> possibleResources: possibleDiscoveryResource(), </ins> expectedErr:       false, }, "Discovery Calls Partially Failed": { <del> discoveryError: new(discovery.ErrGroupDiscoveryFailed), possibleResources: []*metav1.APIResourceList{ { GroupVersion: "create/v1", APIResources: []metav1.APIResource{ { Name:       "jobs", Verbs:      []string{"create", "list", "watch", "delete"}, ShortNames: []string{"jz"}, Categories: []string{"all"}, }, }, }, }, expectedErr: false, </del> <ins> discoveryError:    new(discovery.ErrGroupDiscoveryFailed), possibleResources: possibleDiscoveryResource(), expectedErr:       false, </ins> }, } for name, test := range tcs {

Discussion:
In we observed a crashlooping controller cause a cluster cold boot failure, as controller-manager wasn't able to stay up long enough to run the deployment that would have fixed the problem. We should audit everything that runs in kube-controller-manager and ensure that they all fail gracefully enough to prevent crashloops, or make them individually restart in that case, instead of the process. Longer term, we should consider classifying the controllers by run level or bootstrap order (), and splitting them into separate binaries or changing the start-up order in kcm to make sure this sort of thing doesn't happen in the future.
Same issue with metrics-server, using minikube. Also reproduced on our test cluster. Steps to reproduce: Set up localkube Install metrics-server Stop minikube: sudo minikube stop Start minikube: sudo -E minikube start --vm-driver=none Expected: Kubernetes is running Actual: Kubernetes is dead Logs: Workaround: To fix the system, we must delete the metrics-server: Now kubernetes will start normally. After that we can reinstall the metrics server, and it will be ok.
Related:
This will be a hard problem to fix permanently. In all likelihood, we should stop allowing Fatalf() in kubernetes/kubernetes, but as you can see we do this to ourselves right here...
/kind bug
I also think this bug would benefit from an e2e test where we misconfigure things in a variety of ways and verify that KCM still comes up and stays up: [ ] misconfigured apiservice [ ] broken service attached to that apiservice [ ] RBAC rules that disallow things. maybe everything! [ ] webhooks that disallow everything [ ] yr example here
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale
Change:
if isHTTPErrorCode(err, http.StatusNotFound) { return false, true, nil } <del> return false, false, fmt.Errorf("error getting load balancer's target pool: %v", err) } if translateAffinityType(affinityType) != tp.SessionAffinity { </del> <ins> // Err on the side of caution in case of errors. Caller should notice the error and retry. // We never want to end up recreating resources because gce api flaked. return true, false, fmt.Errorf("error getting load balancer's target pool: %v", err) } // TODO: If the user modifies their Service's session affinity, it *should* // reflect in the associated target pool. However, currently not setting the // session affinity on a target pool defaults it to the empty string while // not setting in on a Service defaults it to None. There is a lack of // documentation around the default setting for the target pool, so if we // find it's the undocumented empty string, don't blindly recreate the // target pool (which results in downtime). Fix this when we have formally // defined the defaults on either side. if tp.SessionAffinity != "" && translateAffinityType(affinityType) != tp.SessionAffinity { glog.Infof("LoadBalancer target pool %v changed affinity from %v to %v", name, tp.SessionAffinity, affinityType) </ins> return true, true, nil } return true, false, nil

Discussion:
Restarting master causes a recreation of fwrule and target pool for type=loadbalancer services. We are saved in the non restart case because we compare a cached verson of the service to decided if we should even call into the cloudprovider and update resources. This is happening because our reconciliation routines are confused about session affintiy and lbip, leading them to recreate, since inplace update isn't allowed. The impact is at best a few seconds of radio silence, at worst who knows? Repro: Create a loadbalanced service, eg: Wait for it to acquire a vip. Try it out Ssh into master and restart kube-controller-manager: Watch the wgets, you'll notice radio silence after a bit. This is because the targetpool and forwarding rule get recreted, for 2 reasons: affinity mismatch So this check fails: Lbip mismatch: So this check fails: (lbip is retrieved here: )
the session affinity fix is trivial. The easiest change for the lb ip fix is to not actually check the ip, but simply backoff as long as the forwarding rule exists. This is "bad" because of the way we allocate a static-ip, assign it to the fwd rule, then de-allocate it. The alternative is to use to reconcile, but that's racy.
cherry pick
Change:
// Partially update a node using strategic merge patch kubectl patch node k8s-node-1 -p '{"spec":{"unschedulable":true}}' <ins> // Update a container's image; spec.containers[*].name is required because it's a merge key kubectl patch pod valid-pod -p '{"spec":{"containers":[{"name":"kubernetes-serve-hostname","image":"new image"}]}}' </ins> .fi .RE

Discussion:
The current documentation is very vague and doesn't explain what can be updated in this way. Can I rename or stop the pod, change number of replicas in RC etc. For example it seems to be impossible to change pod name:
cc
After an in person discussion with we think the docs should point people to the swagger-ui to find if a field is mutable. I'll add this point into the docs.
Change:
obj.LeaderElection.LockObjectName = kubescedulerconfigv1alpha1.SchedulerDefaultLockObjectName } <del> if obj.PercentageOfNodesToScore == 0 { // by default, stop finding feasible nodes once the number of feasible nodes is 50% of the cluster. obj.PercentageOfNodesToScore = 50 } </del> if len(obj.FailureDomains) == 0 { obj.FailureDomains = kubeletapis.DefaultFailureDomains }

Discussion:
<!-- Please only use this template for submitting enhancement requests --What would you like to be : Kubernetes scheduler has that specifies what percentage of the cluster nodes should be scored in each scheduling cycle. The scheduler stops scanning more nodes once that many nodes are found feasible for running the pod under consideration. The default value of this config option is 50 (for 50%). We should let the scheduler determine this value based on the size of the cluster when this config option is not provided. I'd propose this formula for finding the percentage: . This is a linear formula that gives us 50 when the cluster size is 100 nodes and 10 for a 5000 node cluster. The scheduler already has a lower bound of 50 nodes per scheduling cycle. As a part of this change, we should also add a 5% lower bound for the formula (If the result of the formula is below 5, we should return 5). Why is this needed: To improve scheduler performance in large clusters. <!-- DO NOT EDIT BELOW THIS LINE --/kind feature /sig scheduling
/assign /remove-help
/assign wgliang
Thanks
Change:
Delete(name string) error Create(pod *api.Pod) (*api.Pod, error) Update(pod *api.Pod) (*api.Pod, error) <ins> Watch(label, field labels.Selector, resourceVersion string) (watch.Interface, error) </ins> Bind(binding *api.Binding) error }

Discussion:
PodInterface should have Watch method behaving in the same way as ServiceInterface.Watch does. Use case: a monitoring system (namely Prometheus) expects to get the list of monitored servers performing a DNS-SD query. Special service (similar to kube2sky shipped with Kubernetes) mirrors status of running Pods into etcd, which is in turn monitored by SkyDNS server and exported as DNS-SD. Schematically the data flow looks like this: Kubernetes -kube2sky -etcd -SkyDNS -Prometheus. The biggest challenge is to deliver list of all running pods from Kubernetes to kube2sky. Currently kube2sky can only poll Kubernetes with PodInterface.List() each N seconds, which is not efficient. Having a Watch method would be much better.
cc Do you know why we do not support watch?
Every object should support Watch.
Watching status doesn't currently work -- that's .
I agree with OP. This is just an accident of history; some boilerplate in the client isn't completely filled out. As Brian mentions, not every field is currently watchable but that's being addressed elsewhere.
This is relevant to your interests potentially w/ your work on
This is a pretty simple change if someone wants to get their feet wet. :)
I'll work on it.
Change:
import ( "bytes" "context" <ins> "encoding/json" </ins> "errors" "fmt" "math/rand"

Discussion:
According to this APIsnoop query, there are still some remaining Endpoints endpoints which are untested. Create a Service in a namespace List all Endpoints in all Namespaces find the created Service(1) Replace/update the Namespaced Endpoint for the Service(1) Patch the Namespaced Endpoint for the Service(1) Get the Namespaced Endpoint for the Service(1) Delete Namespaced Endpoint(1) via a Collection with a LabelSelector Discover useragents: If a test with these calls gets merged, Conformance coverage will go up by 4 points /sig testing /sig architecture /area conformance
When you create a selector, race conditions can occur between controllers and our test code. We have services that test endpoint code, we could do these as explicit tests that are NOT handled by the endpoints controller. Let's try this with are managed by the endpoints controller w/ a selector. Endpoints normally go along with services: we want to create a service sans selector. This keeps it out of the endpoints controller, so we can test directly. Agreed for backlog. Double check that we don't already have test for that, whether it's being done by the endpoints controller that doesn't hit the API. Look at ALL the user agents that hit the endpoint.
/reopen /open Needs promotion!
Reopened this issue. <detailsIn response to : /reopen /open Needs promotion! Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/retitle Promote CoreV1Endpoints test - +4 coverage
This doesn't have an APISnoop PR because (the exact process wasn't in place properly when the original mock test ticket was made)
/retitle Write CoreV1Endpoints test+promote - +4 coverage
please close this Issue in favour of and place in In Progress Issues on org dashboard
/close Close this Issue in favour of and place in In Progress Issues on org dashboard
Closing this issue. <detailsIn response to : /close Close this Issue in favour of and place in In Progress Issues on org dashboard Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/close Close this Issue in favour of and place in In Progress Issues on org dashboard
Change:
currentInflightRequests, currentInqueueRequests, requestTerminationsTotal, <ins> apiSelfRequestCounter, </ins> } // these are the known (e.g. whitelisted/known) content types which we will report for

Discussion:
Currently we don't have an easy way of determining what number of requests are apiserver self-requests. This has historically bitten us, since we used to have a 50(?) QPS limit on apiserver self-requests (which thus has been removed). Even so, it would be a good idea to know this generally, since this may be helpful in pinpointing performance regressions for apiserver. /sig api-machinery instrumentation
Can this issue be considered a newbie one? I'm hunting for issues which might be a good first PR.
In the triage meeting was mentioned that would be good to have similar issues to track other well known actors like controller-manager and kubelet. But let's keep this one for api-server calling itself to have it done. /cc
/cc
Change:
t.Run(test.name, func(t *testing.T) { defer featuregatetesting.SetFeatureGateDuringTest(t, feature.DefaultFeatureGate, features.PodDisruptionConditions, test.enablePodDisruptionConditions)() filter.Tokens = test.initTokens <ins> filter.EnablePreFilter = test.enablePreFilter </ins> filter.Unresolvable = test.unresolvable pods := make([]*v1.Pod, len(test.existingPods)) // Create and run existingPods.

Discussion:
In k8s 1.27, scheduler introduced a new "short circuit" semantics in PreFilter to bypass a Pod quickly. A change introduced here is it relies on that plugin to be stored in , which makes sense as what it was explained . However, the info, although is populated upon each plugin's PreFilter invocation, is not injected into when some PreFilter returns unschedulable: So think about this workflow: pluginA returns Skip in its PreFilter pluginB return Unschedulable in its PreFilter note: pluginA is not included in due to aforementioned bug a Pod is claimed as unschedulable (failed by pluginB) during PostFilter, it's supposed to bypass pluginA's PreEnqueueExtension's AddPod/RemovePod, but it doesn't calling a "skipped" Plugin's AddPod/RemovePod during preemption, sometimes will abort the whole preemption as the logic tries to read info from cycleState, and some plugin's "skip" version doesn't fill cycleState properly, e.g., InterPodAffinity (skip immediately w/o write preFilterStateKey). Short circuiting using Skip is fine, but should injected properly at all cases. Described in the workflow above. It's firstly captured in an out-of-tree PostFilter plugin: , but can also happen in in-tree plugins. No response v1.27 <details</details<details</details<details</details<details</details<details</details
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/kind regression /sig scheduling
cc
Among in-tree plugins, 3 plugins employ non-nil and may return Skip in their PreFilter() implementation w/o writing to cycleState, while return error immediately if is missing in their Add/RemovePod() functions.

So technically, as long as a scheduling flow hit the following criteria, it would hit the bug (preemption doesn't function): plugin 1/2/3 return Skip in PreFilter arbitrary PreFilter plugin after the "skipped" plugin returns Unschedulable in its PreFilter
/cc
/cc
Cherry-pick PRs: 1.28: 1.27:
Change:
w.Header().Add(httpstream.HeaderUpgrade, HeaderSpdy31) w.WriteHeader(http.StatusSwitchingProtocols) <del> conn, _, err := hijacker.Hijack() </del> <ins> conn, bufrw, err := hijacker.Hijack() </ins> if err != nil { runtime.HandleError(fmt.Errorf("unable to upgrade: error hijacking response: %v", err)) return nil } <del> spdyConn, err := NewServerConnection(conn, newStreamHandler) </del> <ins> connWithBuf := &connWrapper{Conn: conn, bufReader: bufrw.Reader} spdyConn, err := NewServerConnection(connWithBuf, newStreamHandler) </ins> if err != nil { runtime.HandleError(fmt.Errorf("unable to upgrade: error creating SPDY server connection: %v", err)) return nil

Discussion:
https://k8s- Failed: TestServeExec {streaming}
Should be fixed by

https://k8s- Failed: TestRoundTripAndNewConnection/redirect=false {spdy}
https://k8s- Failed: TestRoundTripAndNewConnection/redirect=false {spdy}
Should be fixed by
https://k8s- Failed: TestRoundTripAndNewConnection/redirect=false {spdy}

https://k8s- Failed: TestServeExecInContainer {server}
Should be fixed by
https://k8s- Failed: TestServeExecInContainer {server}

https://k8s- Failed: TestServeAttachContainer {server}
https://k8s- Failed: TestServeAttachContainer {server}
Should be fixed by

https://k8s- Failed: TestRoundTripAndNewConnection/redirect=true {spdy}
https://k8s- Failed: TestRoundTripAndNewConnection/redirect=true {spdy}
https://k8s- Failed: TestRoundTripAndNewConnection/redirect=true {spdy}
Should be fixed by
https://k8s- Failed: TestRoundTripAndNewConnection/redirect=true {spdy}
https://k8s- Failed: TestRoundTripAndNewConnection/redirect=true {spdy}

seen in https://k8s-
Should be fixed by
I believe this is fixed?
Yes, I missed this one.
Change:
<del> /* Copyright 2014 Google Inc. All rights reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ package e2e import ( "github.com/GoogleCloudPlatform/kubernetes/pkg/api" "github.com/GoogleCloudPlatform/kubernetes/pkg/client" "github.com/golang/glog" . "github.com/onsi/ginkgo" . "github.com/onsi/gomega" ) func TestKubernetesROService(c *client.Client) bool { svc := api.ServiceList{} err := c.Get(). Namespace("default"). AbsPath("/api/v1beta1/proxy/services/kubernetes-ro/api/v1beta1/services"). Do(). Into(&svc) if err != nil { glog.Errorf("unexpected error listing services using ro service: %v", err) return false } var foundRW, foundRO bool for i := range svc.Items { if svc.Items[i].Name == "kubernetes" { foundRW = true } if svc.Items[i].Name == "kubernetes-ro" { foundRO = true } } if !foundRW { glog.Error("no RW service found") } if !foundRO { glog.Error("no RO service found") } if !foundRW || !foundRO { return false } return true } var _ = Describe("TestKubernetesROService", func() { It("should pass", func() { // TODO: Instead of OrDie, client should Fail the test if there's a problem. // In general tests should Fail() instead of glog.Fatalf(). Expect(TestKubernetesROService(loadClientOrDie())).To(BeTrue()) }) }) </del>

Discussion:
Create a ginkgo suite to test services. Initially this could contain the following tests: TestClusterDNS TestKubernetesROService
Part of the ginko-ization of the e2e tests
Fixed by .
Change:
lock sync.RWMutex cond sync.Cond <del> // `items` maps keys to Deltas. // `queue` maintains FIFO order of keys for consumption in Pop(). // We maintain the property that keys in the `items` and `queue` are // strictly 1:1 mapping, and that all Deltas in `items` should have // at least one Delta. </del> <ins> // `items` maps a key to a Deltas. // Each such Deltas has at least one Delta. </ins> items map[string]Deltas <ins> // `queue` maintains FIFO order of keys for consumption in Pop(). // There are no duplicates in `queue`. // A key is in `queue` if and only if it is in `items`. </ins> queue []string // populated is true if the first batch of items inserted by Replace() has been populated

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: In reviewing another PR, I noticed incorrect commentary and code. The primary offense is at , where a comment asserts (incorrectly) that a key can be present in but not and the code removes a key from without ensuring it is absent from . The only saving grace is that this code is actually unreachable (as also noted in the comment). I think it would be better to fix the comment and in this unreachable situation, than to violate an invariant that is critical to other code in this file. also contemplates the possibility that a key can be in and absent from . What you expected to happen: I expected there to be no comments or code that contemplate violations of the invariant at How to reproduce it (as minimally and precisely as possible): Anything else we need to know?: Environment: Kubernetes version (use ): current branch Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others:
Sorry, I should have noticed this in my earlier pass over this code.
Agreed. Was discussing this with at
We discussed this one, Mike will send PR, Daniel will review.
Change:
} return err } <ins> // VerifyFilePathGidInPod verfies expected GID of the target filepath func VerifyFilePathGidInPod(f *framework.Framework, filePath, expectedGid string, pod *v1.Pod) { cmd := fmt.Sprintf("ls -l %s", filePath) stdout, stderr, err := PodExec(f, pod, cmd) framework.ExpectNoError(err) framework.Logf("pod %s/%s exec for cmd %s, stdout: %s, stderr: %s", pod.Namespace, pod.Name, cmd, stdout, stderr) ll := strings.Fields(stdout) framework.Logf("stdout split: %v, expected gid: %v", ll, expectedGid) framework.ExpectEqual(ll[3], expectedGid) } // ChangeFilePathGidInPod changes the GID of the target filepath. func ChangeFilePathGidInPod(f *framework.Framework, filePath, targetGid string, pod *v1.Pod) { cmd := fmt.Sprintf("chgrp %s %s", targetGid, filePath) _, _, err := PodExec(f, pod, cmd) framework.ExpectNoError(err) VerifyFilePathGidInPod(f, filePath, targetGid, pod) } </ins>

Discussion:
We need to add e2e that verifies volume permissions in pod with different values of fsGroupChangePolicy. /sig storage
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign