jiebi/CodeConvo huggingface dataset:
Change:
FlagPersistent = 0x1 // FlagHashed specify IPVS service hash flag FlagHashed = 0x2 <ins> // FlagSourceHash enables IPVS service hashing on source port and source IP FlagSourceHash = 0x10 </ins> ) // Equal check the equality of virtual server.

Discussion:
The current support of the load distribution method and in kube-proxy ipvs mode only performs hashing of source IP address to select endpoints. As a result, all connections from a single client (i.e. from a particular source IP) are always forwarded to only one endpoint matching with the hash value of this source IP. If the client opens a vast majority of connections to the k8s cluster, it will result in traffic imbalance as only one endpoint located on one node handles the connections while the remaining endpoints/nodes are idle. Here is an example of the problem when using method for kube-proxy Deploy a service with 4 endpoints located on 4 nodes.Open 200 connections from a client to node IP of any node (e.g. telnet 192.168.1.1 ). All connections receive replies from only one single endpoint.The distribution printout also shows that all connections are forwarded to the endpoint (e.g. 1.0.4.2:5001 in this example)Similar issue is seen with method Connections from a client should be evenly distributed to all endpoints like to avoid unbalanced load distribution between cluster nodes and endpoints. This can be easily done by enabling the source port hash flag that IPVS supports for the methods which performs hashing on both source IP and source port when selecting the target endpoint.
/sig network /area kube-proxy /area ipvs
This issue was raised based on the discussion of the issue
triage/accepted /assign
/triage/accepted
/triage accepted (damn it!)
Change:
continue fi # Skip a directory if 1) it has no files and 2) all the subdirectories contain a go.mod file. <del> if [[ -z "$(find "${DEPS_DIR}/${PACKAGE}" -mindepth 1 -maxdepth 1 -type f)" ]]; then </del> <ins> if [[ -z "$(find "${DEPS_DIR}/${PACKAGE}/" -mindepth 1 -maxdepth 1 -type f)" ]]; then </ins> misses_go_mod=false while read -d "" -r SUBDIR; do if [[ ! -e "${SUBDIR}/go.mod" ]]; then misses_go_mod=true break fi <del> done < <(find "${DEPS_DIR}/${PACKAGE}" -mindepth 1 -maxdepth 1 -type d -print0) </del> <ins> done < <(find "${DEPS_DIR}/${PACKAGE}/" -mindepth 1 -maxdepth 1 -type d -print0) </ins> if [[ $misses_go_mod = false ]]; then echo "${PACKAGE} has no files, skipping" >&2 continue

Discussion:
What happened: Running manually includes this file in LICENSES. Running complains if it is present. The file was incorrectly dropped in This needs to be resolved before 1.19 ships /priority important-soon /milestone v1.19 /cc
There are no sig labels on this issue. Please add an appropriate label by using one of the following commands: - Please see the for a listing of the SIGs, working groups, and committees available. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/area code-organization
fixed in
Change:
const ( // Agnhost image Agnhost = iota <del> // Alpine image Alpine </del> // APIServer image APIServer // AppArmorLoader image

Discussion:
<!-- Please only use this template for submitting reports about failing tests in Kubernetes CI jobs --Which jobs are failing: jobs primarely, like: Which test(s) are failing: [] Container Runtime blackbox test when running a container with a new image should be able to pull image from [NodeConformance] Since when has it been failing: Since this commit merged: Testgrid link: Reason for failure: The test should always pull the image from (), it is not configurable. Anything else we need to know: /sig testing /sig windows /area conformance This issue was fixed once before:
Change:
Start the server: ```sh <del> cluster/kubecfg.sh -proxy -www $PWD/www </del> <ins> cluster/kubectl.sh proxy -www=$PWD/www </ins> ``` The UI should now be running on [localhost](http://localhost:8001/static/index.html#/groups//selector)

Discussion:
It's causing problems and is kind-of GCE dependent anyway, we should just use the kubecfg binary, and document the environment variables it uses.
I think its beneficial to keep something, but remove the GCE dependent pieces, i.e. "external-ip" piece.
I put together some instructions here:
We can remove this when kubecfg is deprecated .
Reopened since it still needs to be removed. /cc
Doh. Didn't mean to declare this fixed in that PR.
Closing this (again) as it is a dupe of
Change:
detect-project &> /dev/null export PATH=$(get_absolute_dirname $kubectl):$PATH kubectl="${GCLOUD}" <del> fi if [[ "$KUBERNETES_PROVIDER" == "vagrant" ]]; then # When we are using vagrant it has hard coded auth.  We repeat that here so that # we don't clobber auth that might be used for a publicly facing cluster. config=( "--auth-path=$HOME/.kubernetes_vagrant_auth" ) elif [[ "${KUBERNETES_PROVIDER}" == "gke" ]]; then </del> # GKE runs kubectl through gcloud. config=( "preview"

Discussion:
I've been pulling my hair out trying get kubectl talk to my local cluster. It seems that kubectl merges the local file with values pulled down from the cloud. I've done the following: The I just set is silently overridden. Questions: is this documented anywhere? should kubectl merge in my GCE cluster when I set my cloud-provider to something else? should kubectl override my previously set current-context?
workaround is to use flag to override the config file value.
but not a good UX long term
Someone else hit this as well: . Better fix is to have the local-up script set a context, which I will try to add today. As for the overwriting behavior, it's documented in , but based on what you describe, the intended load order is not working; local .kubeconfig should overwrite global. cc
That sounds infuriating. I'll take a look this morning.
Change:
// File system resize was requested, proceed glog.V(4).Infof(volumeToMount.GenerateMsgDetailed("MountVolume.resizeFileSystem entering", fmt.Sprintf("DevicePath %q", volumeToMount.DevicePath))) <ins> if volumeToMount.VolumeSpec.ReadOnly { simpleMsg, detailedMsg := volumeToMount.GenerateMsg("MountVolume.resizeFileSystem failed", "requested read-only file system") glog.Warningf(detailedMsg) og.recorder.Eventf(volumeToMount.Pod, v1.EventTypeWarning, kevents.FileSystemResizeFailed, simpleMsg) return nil } </ins> diskFormatter := &mount.SafeFormatAndMount{ Interface: mounter, Exec:      og.volumePluginMgr.Host.GetExec(expandableVolumePlugin.GetPluginName()),

Discussion:
We should not attempt resizing of file system if volume is mounted as read-only. /sig storage cc
Change:
} else { dv, err = ds.getDockerVersion() } <ins> if err != nil { return nil, err } </ins> apiVersion, err := semver.Parse(dv.APIVersion) if err != nil {

Discussion:
I was running an experiment to verify that Taints are correctly updated when Condition changes from Unreachable to NotReady and found out that Kubelet can't start when the docker is not running. I did an experiment on CVM and: made no op made no op - wait reverted changes to The result is following: Is this expected, or kubelet should normally start and report itself as 'NotReady'?
Thanks for reporting! kubelet shouldn't panic in this case. This is a bug, and I uploaded a PR to fix this.
We should cherry-pick the fix. On the side note, the impact of this bug at startup is limited because kubelet would fail to start if docker isn't running already.
Change:
<ins> {% set kube_user = grains.kube_user -%} </ins> {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"admin", "namespace": "*", "resource": "*", "apiGroup": "*", "nonResourcePath": "*"}} <ins> {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"{{kube_user}}", "namespace": "*", "resource": "*", "apiGroup": "*", "nonResourcePath": "*"}} </ins> {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"kubelet", "namespace": "*", "resource": "*", "apiGroup": "*", "nonResourcePath": "*"}} {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"kube_proxy", "namespace": "*", "resource": "*", "apiGroup": "*", "nonResourcePath": "*"}} {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"kubecfg", "namespace": "*", "resource": "*", "apiGroup": "*", "nonResourcePath": "*"}}

Discussion:
abac-authz- hardcodes "admin" instead of using the $KUBE_USER variable. This means that "admin" is the only basic-auth username that will work with that abac config.
To workaround until it is fixed, you can add a line to the master's abac-authz- file: and then restart the kube-apiserver (docker kill it, and let it restart).
Change:
return fmt.Errorf("failed to delete disk(%s) since it's in attaching or detaching state", diskURI) } <del> rerr := c.common.cloud.DisksClient.Delete(ctx, resourceGroup, diskName) </del> <ins> disk, rerr := c.common.cloud.DisksClient.Get(ctx, resourceGroup, diskName) if rerr != nil { return rerr.Error() } if disk.ManagedBy != nil { return fmt.Errorf("disk(%s) already attached to node(%s), could not be deleted", diskURI, *disk.ManagedBy) } rerr = c.common.cloud.DisksClient.Delete(ctx, resourceGroup, diskName) </ins> if rerr != nil { return rerr.Error() }

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: check disk status before disk azure disk There is little possibility that attach disk would cost 10min, and disk could be attached, deleted in same time, that would cause race condition. What you expected to happen: How to reproduce it (as minimally and precisely as possible): Anything else we need to know?: Environment: Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others: /kind bug /assign /priority important-soon /sig cloud-provider /area provider/azure
Change:
} if cfg.Disk.SCSIControllerType == "" { <del> cfg.Disk.SCSIControllerType = DefaultSCSIControllerType </del> <ins> cfg.Disk.SCSIControllerType = LSILogicSASControllerType </ins> } else if !checkControllerSupported(cfg.Disk.SCSIControllerType) { glog.Errorf("%v is not a supported SCSI Controller type. Please configure 'lsilogic-sas' OR 'pvscsi'", cfg.Disk.SCSIControllerType) return nil, errors.New("Controller type not supported. Please configure 'lsilogic-sas' OR 'pvscsi'")

Discussion:
vSphere cloud provider volume plugin attach disk limits the number of volumes because of two issues: new SCSI controller is only created when one does not exist. A new controller should be when required and limit not reached. disk will fail when attaching disk to slot 7 on controller. Slot 7 on SCSI controller is reserved and therefore should be skipped. This issue has been brought up in Govmomi library .
Change:
return } <ins> type PingCommand string const ( IPv4PingCommand PingCommand = "ping" IPv6PingCommand PingCommand = "ping6" ) </ins> // CheckConnectivityToHost launches a pod to test connectivity to the specified // host. An error will be returned if the host is not reachable from the pod. // // An empty nodeName will use the schedule to choose where the pod is executed. <del> func CheckConnectivityToHost(f *Framework, nodeName, podName, host string, timeout int) error { </del> <ins> func CheckConnectivityToHost(f *Framework, nodeName, podName, host string, pingCmd PingCommand, timeout int) error { </ins> contName := fmt.Sprintf("%s-container", podName) command := []string{ <del> "ping", </del> <ins> string(pingCmd), </ins> "-c", "3", // send 3 pings "-W", "2", // wait at most 2 seconds for a reply "-w", strconv.Itoa(timeout),

Discussion:
<!-- This form is for bug reports and feature requests ONLY! If you're looking for help check and the . --Is this a BUG REPORT or FEATURE REQUEST?: /kind feature What happened: e2e tests provide only an (IPv4) ping test for external connectivity. What you expected to happen: Need a way to conditionally run a ping6 external connectivity check, and disable the (IPv4) external connectivity check, for IPv6-only clusters. How to reproduce it (as minimally and precisely as possible): Examine the e2e code ((), or run this test on an IPv6-only cluster. Anything else we need to know?: This test will be needed for IPv6 gating CI tests, at least until Kubernetes dual-stack is fully implemented. /area ipv6 Environment: Kubernetes version (use ): Latest master Cloud provider or hardware configuration**: VirtualBox cluster, Ubuntu 16.04.1 host, CentOS 7 guests OS (e.g. from /etc/os-release): CentOS 7 Kernel (e.g. ): 3.10.0-514.26.2.el7.x8664 SMP Tue Jul 4 15:04:05 UTC 2017 x8664 x8664 x8664 GNU/Linux Install tools: Others:
There are no sig labels on this issue. Please by: a sig: e.g., to notify the contributor experience sig, OR the label manually: e.g., to apply the label Note: Method 1 will trigger an email to the group. You can find the group list and label list . The in the method 1 has to be replaced with one of these: bugs, feature-requests, pr-reviews, test-failures, proposals
/sig network
Change:
elif [[ ${platform} == "linux/ppc64le" ]]; then export CGO_ENABLED=1 export CC=powerpc64le-linux-gnu-gcc <ins> elif [[ ${platform} == "darwin/"* ]]; then # See https://github.com/kubernetes/kubernetes/issues/32999 export GOROOT=${K8S_PATCHED_GOROOT} </ins> fi fi }

Discussion:
See
CI has built and uploaded unofficial prerelease darwin binaries for 1.4 using go1.7.1: cc Official binaries will ship as soon as we cut 1.4.1.
We have official v1.4.1 binaries available now, too.
Hooray
Change:
ErrPodNotMatchHostName = NewPredicateFailureError("HostName", "node(s) didn't match the requested hostname") // ErrPodNotFitsHostPorts is used for PodFitsHostPorts predicate error. ErrPodNotFitsHostPorts = NewPredicateFailureError("PodFitsHostPorts", "node(s) didn't have free ports for the requested pod ports") <del> // ErrServiceAffinityViolated is used for CheckServiceAffinity predicate error. ErrServiceAffinityViolated = NewPredicateFailureError("CheckServiceAffinity", "node(s) didn't match service affinity") </del> // ErrNodeUnderMemoryPressure is used for NodeUnderMemoryPressure predicate error. ErrNodeUnderMemoryPressure = NewPredicateFailureError("NodeUnderMemoryPressure", "node(s) had memory pressure") // ErrNodeUnderDiskPressure is used for NodeUnderDiskPressure predicate error.

Discussion:
Part of See example /sig scheduling /kind cleanup /help /priority important-soon
/assign /remove-help
Change:
// At this point there was either no PDB or we succeeded in decrementing // Try the delete <del> _, _, err = r.store.Delete(ctx, eviction.Name, eviction.DeleteOptions) </del> <ins> deletionOptions := eviction.DeleteOptions if deletionOptions == nil { // default to non-nil to trigger graceful deletion deletionOptions = &metav1.DeleteOptions{} } _, _, err = r.store.Delete(ctx, eviction.Name, deletionOptions) </ins> if err != nil { return nil, err }

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks!--What happened: When using the function from Python's Kuberneets API, we noticed that Pods are terminated bythe cluster without respecting their preStop hooks or terminationGracePeriodSeconds seconds. What you expected to happen: When using the eviction API, just as when using delete, Pods should be allowed to run their preStop hooks, as well as be given terminationGracePeriodSeconds before being terminated with SIGKILL. How to reproduce it (as minimally and precisely as possible): the following pod: the pod logs in another window to evict the pod. Here is a sample curl equivalent of what (1.13) is doing - happy path: Here is a sample curl equivalent of what Python's is doing (when not passed ) - broken path: The log output generated by the guinea pod on the happy path looks like this: The "Got signal 15" message shows up only after the preStop hook is finished, so ~10 seconds after the evict call is made What happens on the broken path is: We seem to be getting 2x SIGTERM, there are no messages indicating continued processing after the signal, and the signal itself is registered immediately after the eviction call is made, suggesting that preStop didn't run. Anything else we need to know?: Environment: Kubernetes version (use ):Cloud provider or hardware configuration: AWS OS (e.g. from /etc/os-release): CentOS Linux release 7.5.1804 Kernel (e.g. ): 3.10.0-862.14.4.el7.x8664 SMP Wed Sep 26 15:12:11 UTC 2018 x8664 x8664 x8664 GNU/Linux Install tools: in-house Others:
/sig api-machinery
this is because of this code: invoked from here: it is passing in the eviction delete options field as-is, meaning nil gets propagated and defaulted to mean delete immediately. when calling delete APIs normally, delete options defaults to a non-nil empty set of options:
Fixed in
patch looks legit. Thanks for the quick reaction and for the pointers!
I've a elasticsearch stateful set which have a preHook which never completes and the pod is never killed despite terminationGracePeriodSeconds being set.

Is it related ? If so can this be considered to be cherry-picked on v1.13.x release branch ?
Change:
if err != nil || len(internalDNS) == 0 { //TODO: It would be nice to be able to determine the reason for the failure, // but the AWS client masks all failures with the same error description. <del> glog.V(2).Info("Could not determine private DNS from AWS metadata.") </del> <ins> glog.V(4).Info("Could not determine private DNS from AWS metadata.") </ins> } else { addresses = append(addresses, v1.NodeAddress{Type: v1.NodeInternalDNS, Address: internalDNS}) }

Discussion:
Is this a BUG REPORT or FEATURE REQUEST?: /kind bug /sig aws What happened: Every few seconds I get spam in my logs about "Could not determine public DNS from AWS metadata" from every node. This is really very spammy. What you expected to happen: No spam. How to reproduce it (as minimally and precisely as possible): Launch a private topology cluster with kops. Anything else we need to know?: There will never be a public-hostname in the metadata for private topology clusters. This line: Should be glog.V(4) i suspect, like line 1033 above it. Environment: Kubernetes version (use ): 1.7.4 Cloud provider or hardware configuration: AWS OS (e.g. from /etc/os-release): Jessie Kernel (e.g. ): 4.4.78-k8s Install tools: kops Others:
fixed in . PTAL. Thanks!
Thanks On a side note the metadata should probably be cached to stop thrashing the API but I don't know enough to be sure.
/cc
Change:
func (r RequiredIPVSKernelModulesAvailableCheck) Check() (warnings, errors []error) { glog.V(1).Infoln("validating the kernel module IPVS required exists in machine or not") <ins> kernelVersion, ipvsModules, err := GetKernelVersionAndIPVSMods(r.Executor) if err != nil { errors = append(errors, err) } </ins> // Find out loaded kernel modules out, err := r.Executor.Command("cut", "-f1", "-d", " ", "/proc/modules").CombinedOutput() if err != nil {

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks!--kube-proxy cannot use ipvs mode on Linux 4.19 due to a check for the module, which was changed to (). uses to check for : It should instead accept on Linux 4.19 or above. What happened: kube-proxy fell back from ipvs mode to iptables mode. What you expected to happen: kube-proxy using ipvs. How to reproduce it (as minimally and precisely as possible): Launch a cluster on an image using Linux 4.19 or above with kube-proxy using ipvs mode (see ). Environment: Kubernetes version (use ): All Kernel (e.g. ): 4.19 <!-- DO NOT EDIT BELOW THIS LINE --/kind bug
/sig network
/area ipvs /assign /cc
Okay, so should check {nfconntrackipv4 | nf_conntrack} and expect load at least one module?
I think so
Please just go ahead :)
Change:
} if len(tried) != 0 { <del> return fmt.Errorf("recognized csr %q as %v but subject access review was not approved", csr.Name, tried) </del> <ins> return certificates.IgnorableError("recognized csr %q as %v but subject access review was not approved", csr.Name, tried) </ins> } return nil

Discussion:
Each node waiting for bootstrapping creates 1 line per 2-3s in the logs when the requesting client doesn't have access. It should not be logging at v(0), these are all v(4) level. We should be reporting these appropriately. I don't want a 5k node cluster showing this.
I'd like to fix it
Change:
} func TestDescribePod(t *testing.T) { <del> deletionTimestamp := metav1.Time{Time: time.Now().UTC().AddDate(10, 0, 0)} </del> <ins> deletionTimestamp := metav1.Time{Time: time.Now().UTC().AddDate(-10, 0, 0)} </ins> gracePeriod := int64(1234) condition1 := corev1.PodConditionType("condition1") condition2 := corev1.PodConditionType("condition2")

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: Kubectl describe pv xxx shows last<invalidif pv is terminating ! I found pvc and pod have the same issue What you expected to happen: Terminating (lasts 10s) How to reproduce it (as minimally and precisely as possible): 1 create a pv, pvc or pod is terminating 2 using kubectk describe xxx Anything else we need to know?: Environment: Kubernetes version (use ): 1.13.3 Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Others:
/sig cli
Reiterating the mentions to trigger a notification: <detailsIn response to : Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign
Change:
}, gvk: examplev1.SchemeGroupVersion.WithKind("Pod"), expectedObj: &examplev1.Pod{ <ins> TypeMeta: metav1.TypeMeta{ APIVersion: "example.apiserver.k8s.io/v1", Kind:       "Pod", }, </ins> ObjectMeta: metav1.ObjectMeta{ Name: "pod1", Labels: map[string]string{

Discussion:
The admission webhook review requests seem not to include a GVK in the raw object. It's included elsewhere in the review request, so it's generally not an issue, except that the unstructured codec requires GVKs to be present (it's not a technical requirement AFAICT, just a check done in the codec logic). This means that trying to use or on an Unstructured fails. A workaround in the mean time is to use , but it would be nice if this just worked properly (fixes to the review request logic and the unstructured codec logic. <details</summary</details<details</summary</detailsserving CA and certs (at and ) webhook with CA bundle `kubectl create -f that the output object doesn't have GVK in the field Environment: Kubernetes version (use ): master-ish () /sig api-machinery
when encoded to the wire, apiVersion and kind must always be included. do you have a gist handy of what the webhook receives for a built-in type (like a pod) and a for a custom resource?
Looks like custom objects (held in unstructured objects) would include GVK, but in-tree types would not. It might be as simple as explicitly setting the GVK in ConvertToGVK: and we need to update the webhook test to ensure objects in requests always have an apiVersion/kind
fixed in
/milestone v1.14 We're entering and this looks relevant to the 1.14 release. Please if I am incorrect