jiebi/CodeConvo huggingface dataset:
Change:
fi src_dir="/home/kubernetes/kube-manifests/kubernetes/gci-trusty" <del> cp "${src_dir}/abac-authz-policy.jsonl" /etc/srv/kubernetes/ </del> <ins> local -r abac_policy_json="${src_dir}/abac-authz-policy.jsonl" remove_salt_config_comments "${abac_policy_json}" sed -i -e "s@{{kube_user}}@${KUBE_USER}@g" "${abac_policy_json}" cp "${abac_policy_json}" /etc/srv/kubernetes/ </ins> src_file="${src_dir}/kube-apiserver.manifest" remove_salt_config_comments "${src_file}" # Evaluate variables

Discussion:
abac-authz- hardcodes "admin" instead of using the $KUBE_USER variable. This means that "admin" is the only basic-auth username that will work with that abac config.
To workaround until it is fixed, you can add a line to the master's abac-authz- file: and then restart the kube-apiserver (docker kill it, and let it restart).
Change:
return pod } <del> // IssueCommandWithResult issues command on given node and returns stdout. func (h *hostExecutor) IssueCommandWithResult(cmd string, node *v1.Node) (string, error) { </del> <ins> // Execute executes the command on the given node. If there is no error // performing the remote command execution, the stdout, stderr and exit code // are returned. // This works like ssh.SSH(...) utility. func (h *hostExecutor) Execute(cmd string, node *v1.Node) (Result, error) { result, err := h.exec(cmd, node) if codeExitErr, ok := err.(exec.CodeExitError); ok { // extract the exit code of remote command and silence the command // non-zero exit code error result.Code = codeExitErr.ExitStatus() err = nil } return result, err } func (h *hostExecutor) exec(cmd string, node *v1.Node) (Result, error) { result := Result{ Host: node.Name, Cmd:  cmd, } </ins> pod, ok := h.nodeExecPods[node.Name] if !ok { pod = h.launchNodeExecPod(node.Name) if pod == nil { <del> return "", fmt.Errorf("failed to create hostexec pod for node %q", node) </del> <ins> return result, fmt.Errorf("failed to create hostexec pod for node %q", node) </ins> } h.nodeExecPods[node.Name] = pod } args := []string{ <del> "exec", fmt.Sprintf("--namespace=%v", pod.Namespace), pod.Name, "--", </del> "nsenter", "--mount=/rootfs/proc/1/ns/mnt", "--",

Discussion:
<!-- Please only use this template for submitting enhancement requests --What would you like to be : separate stdout and stderr command exit code: remove kubectl dependency: Why is this needed: to replace
/assign
/sig storage HostExec was originally written for local PV tests. If we want to replace SSH in e2e, some features must be supported and I’d like to help on this. cc
Change:
return nil, nil, fmt.Errorf("could not access credential file %v - %v", pemFile, err) } <del> t := jwt.NewToken(*serviceAccount, authScope, pemBytes) token, err := t.Assert(&http.Client{}) </del> <ins> jwtConfig := &jwt.Config{ Email:      *serviceAccount, Scopes:     []string{authScope}, PrivateKey: pemBytes, TokenURL:   "https://accounts.google.com/o/oauth2/token", } token, err := jwtConfig.TokenSource(oauth2.NoContext).Token() </ins> if err != nil { <del> fmt.Printf("Invalid token: %vn", err) </del> return nil, nil, err } <del> config := &oauth.Config{ ClientId:     *clientId, ClientSecret: *clientSecret, Scope:        authScope, AuthURL:      "https://accounts.google.com/o/oauth2/auth", TokenURL:     "https://accounts.google.com/o/oauth2/token", </del> <ins> if !token.Valid() { return nil, nil, fmt.Errorf("invalid token for BigQuery oauth") </ins> } <del> transport := &oauth.Transport{ Token:  token, Config: config, </del> <ins> config := &oauth2.Config{ ClientID:     *clientId, ClientSecret: *clientSecret, Scopes:       []string{authScope}, Endpoint: oauth2.Endpoint{ AuthURL:  "https://accounts.google.com/o/oauth2/auth", TokenURL: "https://accounts.google.com/o/oauth2/token", }, </ins> } <del> client := transport.Client() </del> <ins> client := config.Client(oauth2.NoContext, token) </ins> service, err := bigquery.New(client) if err != nil {

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --Following link on sig-network page () is broken Link should be working Kubernetes version (use ):1.21 Cloud provider or hardware configuration:None OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others:
/sig-network
/sig network
/triage accepted
Change:
// NewFakeGCECloud constructs a fake GCE Cloud from the cluster values. func NewFakeGCECloud(vals TestClusterValues) *Cloud { <del> service, _ := compute.NewService(context.Background()) </del> <ins> service, err := compute.NewService(context.Background(), option.WithoutAuthentication()) if err != nil { panic(err) } </ins> gce := &Cloud{ region:           vals.Region, service:          service,

Discussion:
What happened: Unit test failed by command : What you expected to happen: How to reproduce it (as minimally and precisely as possible): Just run command . Anything else we need to know?: Happened on . I first met this issue at v1.15. Environment: Kubernetes version (use ):Cloud provider or hardware configuration: OS (e.g: ):Kernel (e.g. ):Install tools: Network plugin and version (if this is a network-related bug): Others:
/remove-kind bug /kind failing-test /sig cloud-provider
/area provider/gcp
I would be curious to know how is passing then
The reason is that is required here: I guess all CI machinery has a . This will fail in all environments without a .
ah, fixed in
Great!
Change:
. "github.com/onsi/gomega" appsv1 "k8s.io/api/apps/v1" <del> "k8s.io/api/core/v1" </del> <ins> v1 "k8s.io/api/core/v1" </ins> storagev1 "k8s.io/api/storage/v1" apierrors "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/api/resource"

Discussion:
created a spread sheet of the slowest running tests for the pull-kubernetes-gce job. cc discussion on slack: spreadsheet: pie chart of test durations from SIGs: ! it seems appropriate to evaluate the state of the tests and reduce these runtimes. possibly move tests to periodic by marking them as [Slow]. /assign /kind design /area test (?)
/remove-kind bug
Are pull jobs the right place to be calculating the time? Or should be be counting in CI instead?
pull is the one timing out, so probably?
Looking at some of the top slowness:: subPath should fail for new directories when readOnly specified in the volumeSource: This test case is no longer defined in master HostPathType: This test case has not been checked in yet and is trying to be in a PR PersistentVolumes-local StatefulSet with pod affinity should use volumes spread across nodes when pod has anti-affinity: This test is already marked as slow in master
Created This should address most of the top slow storage tests
Change:
(e.g. ssh keys, passwords) separately from the Pods that use them, protecting the sensitive data from proliferation by tools that process pods. <ins> * **API Overview** ([api.md](api.md)): Pointers to API documentation on various topics and explanation of Kubernetes's approaches to API changes and API versioning. </ins> * **Accessing the API** ([accessing_the_api.md](accessing_the_api.md)): Ports, IPs, proxies, and firewall rules.

Discussion:
Simple version is done, more complex version needs work. Done, now that readiness corresponds to Running and is tracked by Kubelet status if the readiness hook is set? Done Done Do we want to do a more generic one or a less generic one? OpenShift was looking more at specific topical plugin commands ("add-volume", "set-default-resources"), but not sure how much hand-holding users need. Getting close. Exec has landed and is a replacement for ssh Attach on start remains hard. Implemented
I/we should also file issues for outstanding items without issues, and add lines for newly filed issues (e.g., command flag for run-container). Readiness is not yet used by rollingupdate. With respect to patch on the command line: I was thinking of a generic mechanism, but I could see the case for domain-aware commands, also. I think we need to better factor the command code and library code, and generic functionality vs. domain-aware functionality. Neither should ever convert to the internal representation. Domain-aware functionality (e.g., describe) should target a specific API version. Configuration generators, such as run-container, should be provided as services, or at least as separate plugin commands.
ref
ref
ref
ref
ref
ref
Change:
Type=oneshot RemainAfterExit=yes ExecStartPre=/usr/bin/mkdir -p /opt/cni <del> ExecStartPre=/usr/bin/curl --fail --silent --show-error --location --create-dirs --output /opt/downloads/cni.tar.gz https://storage.googleapis.com/kubernetes-release/network-plugins/cni-9d5e6e60e79491207834ae8439e80c943db65a69.tar.gz </del> <ins> ExecStartPre=/usr/bin/curl --fail --silent --show-error --location --create-dirs --output /opt/downloads/cni.tar.gz https://storage.googleapis.com/kubernetes-release/network-plugins/cni-07a8a28637e97b22eb8dfe710eeae1344f69d16e.tar.gz </ins> ExecStart=/usr/bin/tar xf /opt/downloads/cni.tar.gz -C /opt/cni/ - name: kubernetes-download-manifests.service

Discussion:
I have a container that got the broadcast address of podCIDR subnet. My CNI conf is: And the container in question has which is the broadcast address for the subnet. So it can't figure out the MAC of cbr0 because all frames are getting sent to (or at least, that's what seems to indicate). Eg: tcpdump alonside a wget on vs a similar normal container
Looks like a bug in ipam. Will try to put together a fix.
I stress tested your fix overnight with the networking suite I'm writing (the one that found the bug), didn't hit the failure in 100 runs, we should get it in asap
Great. It would be better to pull from upstream once the fix is merged. Otherwise, we have to fork it like we did in 1.3.
Marking this p0 flake so it shows up in release queries
[FLAKE-PING] This flaky-test issue would love to have more attention.
[FLAKE-PING] This flaky-test issue would love to have more attention.
Change:
prometheusURL := "http://" + l.Addr().String() + "/metrics" mux := http.NewServeMux() <del> //lint:ignore SA1019 ignore deprecated warning until we move off of global registries mux.Handle("/metrics", legacyregistry.Handler()) </del> <ins> handler := compbasemetrics.HandlerFor(gather, compbasemetrics.HandlerOpts{}) mux.Handle("/metrics", handler) </ins> server := &http.Server{ Addr:    l.Addr().String(), Handler: mux,

Discussion:
TestRecordOperation TestRecordOperation TestGetHistogramVecFromGatherer /kind failing-test <!-- If this is a flake, please add: /kind flake --<!-- Please assign a SIG using: /sig SIG-NAME --/sig testing This may be related with 
/assign I will do some initial researches on this. is similar
/sig instrument
The label(s) cannot be applied, because the repository doesn't have them. <detailsIn response to : /sig instrument Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig instrumentation
/triage accepted /assign cc
To fix it gracefully, we may refactor the code in like The refactor would change a lot and need some confirmations or demo.(I prefer) A temporary workaround before refactoring it: is another try to ignore the dup error in but it is odd as should panic as designed if one register failed.
Three testings failed due to . Haven't found package promauto () being used in these testings. It might be other issues. These testings are: /filterwithonelabel
What are you guys doing here? What test is this? You cannot change the component-base metrics code base it is doing what it is supposed to be doing. Does this test suite involve multiple sequential runs of the same test?
I think this is odd to change the component-base metrics code base. But the refactor to use is another approach. You can try to reproduce it with is with
Oh, yes. This involves multiple sequential runs of the same test to . It uses 
You can use to register the registry only once. It is important to reset the metrics, or next iteration in the test will fail
Thanks I other fixes in
Change:
Host:        "foo.com", PathPrepend: "/proxy/node/node1:10250", } <ins> emptyHostAndSchemeTransport := &Transport{ PathPrepend: "/proxy/node/node1:10250", } </ins> type Item struct { input        string sourceURL    string

Discussion:
<!-- This form is for bug reports and feature requests ONLY! If you're looking for help check and the . --Is this a BUG REPORT or FEATURE REQUEST?: What happened: When accessing a service (e.g., ) by using the Apiserver proxy feature and the service returns with header, such as The returned header does not preserve the path if the service sent a redirect with an absolute path. Depending on the cluster, the header written by the service itself might have been and the apiserver proxy did rewrite the host:port to match the correct values. Unfortunately, it did not rewrite the path segment. What you expected to happen: I would expect the apiserver to rewrite the path segment of the response header so that it reflects the fact that it's proxied under the path: How to reproduce it (as minimally and precisely as possible): The path was not preserved. Anything else we need to know?: To work around this issue, a service may return strictly a relative url in the header such as: The feature to rewrite headers is quite common. For instance, Apache Httpd does it thanks to: Environment: Kubernetes version (use ):Cloud provider or hardware configuration**: custom_ OS (e.g. from /etc/os-release): Kernel (e.g. ):
/sig api-machinery /sig network
/assign
Thanks for the bug report!
GitHub didn't allow me to assign the following users: roycaihw. Note that only can be assigned. <detailsIn response to : /assign Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Change:
return } if v.Len() > 0 { <del> extra := reflect.MakeSlice(v.Type(), 0, max) </del> <ins> extra := reflect.MakeSlice(v.Type(), v.Len(), max) </ins> reflect.Copy(extra, v) v.Set(extra) } else {

Discussion:
has by default, and since 1.22 has the same. They seem to return wrong results in certain situations combined with / . And / also use , so they also don't work correctly. outputs partial list of pods on the node, doesn't evict some of the pods. To make it work correctly, I had to specify works correctly with any , since it's just a performance optimizing parameter. I can't provide an actual concrete example (no = default ), but instead I show how to reproduce it with a smaller I believe that the same problem occurs with create two deployments. there are 5 pods in each. with --selector=app=another-server and , it shows only 4 pods. I could confirm that the problem happens in both case of and regardless namespace, even with , or <details</details<detailsGCP / GKE Standard </details<details</details<details</details<details</details<details</details
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig api-machinery
/sig node
I think this is indeed a bug, after some simple testing, it seems to be an bug unique to 1.24, let me fix it. /assign
/assign
I can reproduce this error in a 1.24 cluster, but not in a 1.23.6 cluster. All clusters are created via kind, and I'm guessing gke may have cherry-picked some commits or had some of their own changes to their branch. So I think this fix should at least cherry-pick to 1.23 to help other distributions fix this issue.
/remove-sig api-machinery
Change:
// The agnhost's image default entrypoint / args are: "/agnhost pause" // which will print out "Paused". <del> gomega.Eventually(ctx, pollLogs, 3, framework.Poll).Should(gomega.ContainSubstring("Paused")) </del> <ins> gomega.Eventually(ctx, pollLogs, time.Minute, framework.Poll).Should(gomega.ContainSubstring("Paused")) </ins> }) /*

Discussion:
pull-kubernetes-node-e2e-containerd ci-cos-containerd-node-e2e ci-kubernetes-e2e-node-canary Containers should use the image defaults if command and args are blank At least 7th June: ! No response /sig node
/cc This also flake in
/triage accepted /assign
/priority backlog
couple more flakes
Opened up to see if we can resolve this.
Change:
drainedNodes.Insert(info.Name) printObj(info.Object, o.Out) } else { <ins> if o.drainer.IgnoreErrors && len(o.nodeInfos) > 1 { fmt.Fprintf(o.ErrOut, "error: unable to drain node %q due to error:%s, continuing command...n", info.Name, err) continue } fmt.Fprintf(o.ErrOut, "DEPRECATED WARNING: Aborting the drain command in a list of nodes will be deprecated.n"+ "The new behavior will make the drain command go through all nodes even if one or more nodes failed during the drain.n"+ "For now, users can try such experience via: --ignore-errorsn") </ins> fmt.Fprintf(o.ErrOut, "error: unable to drain node %q, aborting command...nn", info.Name) remainingNodes := []string{} fatal = err

Discussion:
<!-- Please only use this template for submitting enhancement requests --What would you like to be : on multiple nodes, if one node failed, the command aborting. Without special purpose, maybe it's better to continue processing other nodes. Why is this needed: Follow the pattern of other subcommand, such as kubectl delete.
/sig cli
/triage accepted /assign
done /close
Closing this issue. <detailsIn response to : done /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
I would wait the patch get merged before closing :)
Change:
// You HAVE TO explicitly call w.RUnlock() after this function. func (w *watchCache) waitUntilFreshAndBlock(ctx context.Context, resourceVersion uint64) error { startTime := w.clock.Now() <ins> defer func() { if resourceVersion > 0 { metrics.WatchCacheReadWait.WithContext(ctx).WithLabelValues(w.groupResource.String()).Observe(w.clock.Since(startTime).Seconds()) } }() </ins> // In case resourceVersion is 0, we accept arbitrarily stale result. // As a result, the condition in the below for loop will never be

Discussion:
Part of From For now posted as a "help wanted" issue, however if we cannot hit the timeline for 1.30 code freeze () I would take it over so we don't miss. Still issue is simple enough that it can be quickly implemented. Implementation tips: Add a metric around waitUnitlFreshAndBlock method Metric should be a histogram with latency buckets similar to api latency Metric should have label for resource version. A way to monitor watch cache impact on request latency.
/sig api-machinery /triage accepted /help
This request has been marked as needing help from a contributor. Please ensure that the issue body includes answers to the following questions: Why are we solving this issue? To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points? Does this issue have zero to low barrier of entry? How can the assignee reach out to you for help? For more details on the requirements of such an issue, please see and ensure that they are met. If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /sig api-machinery /triage accepted /help Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Change:
BackendIPConfigurations: &[]network.InterfaceIPConfiguration{ { Name: to.StringPtr("ip-1"), <del> ID:   to.StringPtr("/subscriptions/sub/resourceGroups/rg/providers/Microsoft.Compute/virtualMachineScaleSets/vmss/virtualMachines/0/networkInterfaces/nic"), </del> <ins> ID:   to.StringPtr("/subscriptions/sub/resourceGroups/rg/providers/Microsoft.Compute/virtualMachineScaleSets/vmss-0/virtualMachines/0/networkInterfaces/nic"), </ins> }, }, },

Discussion:
Which jobs are flaking: pull-kubernetes-bazel-test Which test(s) are flaking: TestEnsureBackendPoolDeletedConcurrently Testgrid link: Reason for failure: /sig cloud-provider
cc
/assign /area provider/azure
Change:
srcs = [":package-srcs"], tags = ["automanaged"], ) <ins> go_test( name = "go_default_test", srcs = ["configfiles_test.go"], library = ":go_default_library", deps = [ "//pkg/kubelet/apis/kubeletconfig:go_default_library", "//pkg/kubelet/apis/kubeletconfig/scheme:go_default_library", "//pkg/kubelet/apis/kubeletconfig/v1alpha1:go_default_library", "//pkg/kubelet/kubeletconfig/util/files:go_default_library", "//pkg/kubelet/kubeletconfig/util/filesystem:go_default_library", "//pkg/kubelet/kubeletconfig/util/test:go_default_library", "//vendor/github.com/davecgh/go-spew/spew:go_default_library", "//vendor/k8s.io/apimachinery/pkg/api/equality:go_default_library", ], ) </ins>

Discussion:
From in The most important things I want to see through node e2e tests: 1) the kubelet is started from last-known-good-config file 2) kubelet can download the new config properly to the node; and restart itself from the new config file 3) kubelet can mark the config bad properly after several round of crashing caused the bad config 4) Kubelet can roll back the last-known-good-config and restart itself from that good one 5) kubelet can properly reports its configuration status Note: (2) is covered by existing e2enode tests (1, 4, 5) were covered by the , all of which I plan to turn into automated tests after this PR merges - but I'm trying not to increase the size of this PR any further ~(3) we need to figure out how to test this. I don't want to rely on a "valid" config that causes a crash loop - because the very existence of such a config should be viewed as a bug. I also don't want to include a "please crash loop for our tests" field in the config, because that's an ugly API. The best solution is not clear here.~ We decided to remove crash-loop detection, see . Filing this issue to track this work: into e2e_node tests [x] remote config [x] local (from file) config [x] ~test the crash-loop detection~ removed, see above /cc
[MILESTONENOTIFIER] Milestone Removed Important: This issue was missing labels required for the v1.8 milestone for more than 7 days: kind: Must specify exactly one of [, , ]. priority: Must specify exactly one of [, , ]. Removing it from the milestone. <detailsAdditional instructions available <a href=""here</aThe commands available for adding these labels are documented <a href=""here</a</details
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. Prevent issues from auto-closing with an comment. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale
The test cases in the OP have been covered by our e2e_node tests for a while.