jiebi/CodeConvo huggingface dataset:
Change:
"k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/util/httpstream" <del> "k8s.io/apimachinery/pkg/util/httpstream/spdy" </del> utilnet "k8s.io/apimachinery/pkg/util/net" "k8s.io/apimachinery/pkg/util/proxy" auditinternal "k8s.io/apiserver/pkg/apis/audit"

Discussion:
What happened: upgrade requests to aggregated APIs (like websocket-based watch requests) on a kube-apiserver using --ssh-user hang What you expected to happen: Websocket-based watch requests work properly How to reproduce it (as minimally and precisely as possible): a kube-apiserver configured to use a node dialer to reach services/pods (e.g. with ) an aggregated API server (like the sample-apiserver) on a node other than the kube-apiserver a websocket-based watch against the aggregated API Anything else we need to know?: Environment: Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g. from /etc/os-release): Kernel (e.g. ): Install tools: Others: <!-- DO NOT EDIT BELOW THIS LINE --/kind bug
/sig api-machinery /cc lavalamp
The code in question is here: handlingInfo.proxyRoundTripper is built here: and inherits the proxyDialerFn built in from the following construction chain: However, drops the custom dialer contained inside and from the returned round tripper. That means that upgrade requests fall back to use the default dialer, which cannot reach the aggregated API server
cc
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/assign would be good to resolve with the apiserver proxy work
Change:
return ec } <ins> // generateNodeDebugPod generates a debugging pod that schedules on the specified node. // The generated pod will run in the host PID, Network & IPC namespaces, and it will have the node's filesystem mounted at /host. func (o *DebugOptions) generateNodeDebugPod(node string) *corev1.Pod { cn := "debugger" // Setting a user-specified container name doesn't make much difference when there's only one container, // but the argument exists for pod debugging so it might be confusing if it didn't work here. if len(o.Container) > 0 { cn = o.Container } // The name of the debugging pod is based on the target node, and it's not configurable to // limit the number of command line flags. There may be a collision on the name, but this // should be rare enough that it's not worth the API round trip to check. pn := fmt.Sprintf("node-debugger-%s-%s", node, nameSuffixFunc(5)) if !o.Quiet { fmt.Fprintf(o.Out, "Creating debugging pod %s with container %s on node %s.n", pn, cn, node) } p := &corev1.Pod{ ObjectMeta: metav1.ObjectMeta{ Name: pn, }, Spec: corev1.PodSpec{ Containers: []corev1.Container{ { Name:                     cn, Env:                      o.Env, Image:                    o.Image, ImagePullPolicy:          o.PullPolicy, Stdin:                    o.Interactive, TerminationMessagePolicy: corev1.TerminationMessageReadFile, TTY:                      o.TTY, VolumeMounts: []corev1.VolumeMount{ { MountPath: "/host", Name:      "host-root", }, }, }, }, HostIPC:       true, HostNetwork:   true, HostPID:       true, NodeName:      node, RestartPolicy: corev1.RestartPolicyNever, Volumes: []corev1.Volume{ { Name: "host-root", VolumeSource: corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{Path: "/"}, }, }, }, }, } if o.ArgsOnly { p.Spec.Containers[0].Args = o.Args } else { p.Spec.Containers[0].Command = o.Args } return p } </ins> // generatePodCopy takes a Pod and returns a copy and the debug container name of that copy func (o *DebugOptions) generatePodCopyWithDebugContainer(pod *corev1.Pod) (*corev1.Pod, string) { copied := &corev1.Pod{

Discussion:
This issue tracks implementing node debugging with privileged containers for , as described in the This feature allows administrators to start a privileged container on a node in host namespaces rather than having to SSH to the node. For example: /kind feature /sig cli
/assign
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale
Change:
float64(time.Hour) * maxAllowedRestartsPerHour)) podRunDelay := time.Duration(int64(jobDuration) / int64(maxPodCount)) <del> podRunCount := int(testDuration.Seconds())/int(podRunDelay.Seconds()) - 1 </del> <ins> podRunCount := maxPodCount*(int(testDuration/jobDuration)-1) + 1 </ins> linesPerPod := linesPerPodPerSecond * int(jobDuration.Seconds()) <del> By("Running short-living pods") </del> pods := []*loggingPod{} for runIdx := 0; runIdx < podRunCount; runIdx++ { for nodeIdx, node := range nodes { podName := fmt.Sprintf("job-logs-generator-%d-%d-%d-%d", maxPodCount, linesPerPod, runIdx, nodeIdx) <del> pods = append(pods, createLoggingPod(f, podName, node.Name, linesPerPod, jobDuration)) defer f.PodClient().Delete(podName, &meta_v1.DeleteOptions{}) </del> <ins> pods = append(pods, newLoggingPod(podName, node.Name, linesPerPod, jobDuration)) </ins> } <del> time.Sleep(podRunDelay) </del> } <ins> By("Running short-living pods") go func() { for _, pod := range pods { pod.Start(f) time.Sleep(podRunDelay) defer f.PodClient().Delete(pod.Name, &meta_v1.DeleteOptions{}) } // Waiting until the last pod has completed time.Sleep(jobDuration - podRunDelay + lastPodIngestionSlack) }() </ins> By("Waiting for all log lines to be ingested") config := &loggingTestConfig{ LogsProvider:              sdLogsProvider,

Discussion:
Pods should be run in parallel with checking the logs from the backend to fit into the timeout.
Change:
# Reset core_pattern. On GCI, the default core_pattern pipes the core dumps to # /sbin/crash_reporter which is more restrictive in saving crash dumps. So for # now, set a generic core_pattern that users can work with. <del> echo "core.%e.%p.%t" > /proc/sys/kernel/core_pattern </del> <ins> echo "/core.%e.%p.%t" > /proc/sys/kernel/core_pattern </ins> } # secure_random generates a secure random string of bytes. This function accepts

Discussion:
The way we're setting the core dump pattern on GCI (COS) leaves the kernel complaining over and over on the console. Fix incoming.
could you elaborate on the kernel complains due to the current relative path a little bit?
Change:
func (m *Master) InstallSwaggerAPI() { // Enable swagger UI and discovery API swaggerConfig := swagger.Config{ <del> WebServicesUrl: net.JoinHostPort(m.publicIP.String(), strconv.Itoa(int(m.publicReadWritePort))), </del> <ins> WebServicesUrl: net.JoinHostPort(m.publicIP.String(), strconv.Itoa(m.publicReadWritePort)), </ins> WebServices:    m.handlerContainer.RegisteredWebServices(), // TODO: Parameterize the path? ApiPath:         "/swaggerapi/",

Discussion:
Trying to hit the read-write kubernetes service from inside a cluster does not work. tailing the kube-proxy logs shows: And sure enough, kube-apiserver is not listening on the NIC on that port. 8080 is only for the localhost HTTP communications between master components (and nginx redirect after HTTPS termination). The "kubernetes" master service needs to get created with Port set to 443.
+1
This needs to be port 6443 the auth_port On Feb 6, 2015 10:14 AM, "Paulo Pires" wrote:
The code says 8443, but then a flag changes to 6443. Will fix. , Eric Tune wrote:
Holy macaroni this is a mess. , Tim Hockin wrote:
Change:
// This is to avoid memory reallocations and thus improve performance. proxier.natChains.Reset() proxier.natRules.Reset() <ins> proxier.filterChains.Reset() proxier.filterRules.Reset() </ins> // Write table headers. writeLine(proxier.filterChains, "*filter")

Discussion:
<!-- This form is for bug reports and feature requests ONLY! If you're looking for help check and the . If the matter is security related, please disclose it privately via --Is this a BUG REPORT or FEATURE REQUEST?: /kind bug What happened: After setting up kube-proxy, and static routing. The node is not forwarding the ClusterIP of a service. Services are accessible if the default policy filter FORWARD chain is set to ACCEPT, but not DROP. What you expected to happen: nodes should be forwarding ClusterIP from external cluster to the correctly Pod IP. How to reproduce it (as minimally and precisely as possible): K8S cluser. NGINX and ClusterIP type of service for NGINX. static routing from external. from external with curl. Anything else we need to know?: The filter table function seems dropped since merge of . However the github merge request dosen't seem to relate to removing the functionality. Is this a merge issue? or intentienal? Environment: Kubernetes version (use ):Cloud provider or hardware configuration:OS (e.g. from /etc/os-release):Kernel (e.g. ):Install tools:Others:
/sig network
Related logging:
/assign
/cc
Hi guys, Altough I'm new to kubernetes, the missing function might be an easy fix. Do you guys mind if I work on it? Jia
PRs are always welcome!
11.6 still has this issue
We didn't cherry-pick this fix to 1.11 branch. As community is going to not maintain 1.11 release, I would suggest you upgrade to 1.12.
Change:
"foo": "foo", "bar": "bar", } <ins> matchee := Set(map[string]string{ "foo":   "foo", "bar":   "bar", "extra": "label", }) </ins> for i := 0; i < b.N; i++ { <del> if SelectorFromValidatedSet(set).Empty() { </del> <ins> s := SelectorFromValidatedSet(set) if s.Empty() { </ins> b.Errorf("Unexpected selector") } <ins> if !s.Matches(matchee) { b.Errorf("Unexpected match") } } } func BenchmarkSetSelector(b *testing.B) { set := map[string]string{ "foo": "foo", "bar": "bar", } matchee := Set(map[string]string{ "foo":   "foo", "bar":   "bar", "extra": "label", }) for i := 0; i < b.N; i++ { s := ValidatedSetSelector(set) if s.Empty() { b.Errorf("Unexpected selector") } if !s.Matches(matchee) { b.Errorf("Unexpected match") } } } func TestSetSelectorString(t *testing.T) { cases := []struct { set Set out string }{ { Set{}, "", }, { Set{"app": "foo"}, "app=foo", }, { Set{"app": "foo", "a": "b"}, "a=b,app=foo", }, } for _, tt := range cases { t.Run(tt.out, func(t *testing.T) { if got := ValidatedSetSelector(tt.set).String(); tt.out != got { t.Fatalf("expected %v, got %v", tt.out, got) } }) </ins> } }

Discussion:
A common pattern in Kubernetes (both internally and in third party usage) is something like: (this is from the ). This is commonly called at a fairly high rate; in our case we would actually end up seeing this account for significant portions of CPU/memory to compute the and run on it. In our controller, as an optimization, we replaced usage of and just used our own simpler label matching code, leading to a 70% speed up in our function (which does more than just match) and 96% allocation size improvement; see I believe similar could be done in Kubernetes directly by having a specialized Selector implementation for simple labels. This would transparently given substantial performance benefits to anyone using the library
/sig api-machinery
is the change here a new kind of selector matching or a tweak to something existing? It's hard to tell if this is proposing a new design to partition types of selectors that needs a kep versus a perf tweak to existing code that is straight-forward.
The proposal is an internal performance improvement to make a specialized implementation of the selector matching internally. So two concrete implementations for 1 shared interface. is a PoC of this. I think it can be extended (by me, or others if someone wants to) to complete it
We discussed this one during our bug triage. There seemed to be the feeling that this is large enough to need a KEP? Would you be up for that? Additionally you could bring it up in our SIG meeting to socialize / discuss it more if you wanted.
The patch shared in helps to explain, it's a lot smaller than the description made it sound. This is a special case for equality-only selectors. Probably still worth bringing up at a sig-meeting, but if if the patch is a good representation, it is more bounded than expected from the issue description.
/triage accepted
Change:
// Bypass eCache if node has any nominated pods. // TODO(bsalamat): consider using eCache and adding proper eCache invalidations // when pods are nominated or their nominations change. <del> eCacheAvailable = eCacheAvailable && !podsAdded </del> <ins> eCacheAvailable = equivCacheInfo != nil && !podsAdded </ins> for _, predicateKey := range predicates.PredicatesOrdering() { <del> //TODO (yastij) : compute average predicate restrictiveness to export it as promethus metric </del> <ins> //TODO (yastij) : compute average predicate restrictiveness to export it as Prometheus metric </ins> if predicate, exist := predicateFuncs[predicateKey]; exist { if eCacheAvailable { // PredicateWithECache will return its cached predicate results. <del> fit, reasons, invalid = ecache.PredicateWithECache(pod.GetName(), info.Node().GetName(), predicateKey, equivalenceHash) </del> <ins> fit, reasons, invalid = ecache.PredicateWithECache(pod.GetName(), info.Node().GetName(), predicateKey, equivCacheInfo.hash) </ins> } if !eCacheAvailable || invalid {

Discussion:
<!-- This form is for bug reports and feature requests ONLY! If you're looking for help check and the . --Today, . This seems unnecessary and should be done once for all the nodes. Is this a BUG REPORT or FEATURE REQUEST?: /kind enhancement /sig scheduling cc:
/assign Thanks, will send fix per slack discussion.
/cc
Change:
} func (recorder *recorderImpl) Event(object runtime.Object, eventtype, reason, message string) { <del> recorder.generateEvent(object, nil, metav1.Now(), eventtype, reason, message) </del> <ins> recorder.generateEvent(object, nil, eventtype, reason, message) </ins> } func (recorder *recorderImpl) Eventf(object runtime.Object, eventtype, reason, messageFmt string, args ...interface{}) {

Discussion:
is defined here but never used. As this is an unexported method it doesn't affect anyone, just a small point of confusion for the reader. /sig api-machinery /kind bug
/triage accepted
The label cannot be applied. Only GitHub organization members can add the label. <detailsIn response to : /triage accepted </details
/triage accepted removing triage since the PR seem to be fixing the issue /assign Please close when merged! thank you
Change:
}, wantBinderID: -1, // default binding. }, <ins> { name:    "ignore when extender bind failed", podName: "pod1", extenders: []framework.Extender{ &fakeExtender{isBinder: true, errBind: true, interestedPodName: "pod1", ignorable: true}, }, wantBinderID: -1, // default binding. }, </ins> } for _, test := range table {

Discussion:
I use extenders to add webhook for default-scheduler: And set to ignore scheuler error when scheduler extender is not working. But I got an error: . I suppose work fine in predicate path, but not work fine in bind path. The Ignorable logic in kube-scheduler: 637: and, 905: the is not judge in . Schedule should not error when set . extenders to kube-scheduler config(which has filterVerb and bindVerb and ignorable flag), example: and add config flag in kube-scheduler pod start up command. a scheduler-extender() and then stop it. a pod and you will see the schedule error. No response <details</details<detailsLocal environment </details<details</details<details</details<details</details<details</details
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig scheduling
/cc
/assign
Maybe this is not a bug but as designed, because bind is more critical than filter, what would you do in bind? I have no history context, cc
Hi, Kerthcet, in my scene, I use extender to bind IP(from my own network system) to my pod's annotaion. I'm aware of the critical of binding path, but, what If the extender is broken, how to skip it and continue? The scheduler extender design has supported ignorable, but only work for filter path make no sense for extender both has filter and bind. Maybe we can add an option to allow user to chose what can be ignored. Thanks for your reply anyway~
Reiterating the mentions to trigger a notification: <detailsIn response to : Maybe this is not a bug but as designed, because bind is more critical than filter, what would you do in bind? I have no history context, cc I'm aware of the critical of binding path, but, what If the extender is broken, how to skip it and continue?

The scheduler extender design has supported ignorable, but only work for filter path make no scence for extender both has filter and bind. Maybe we can add an option to allow user to chose what can be ignored. thanks for your reply anyway~ Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
So even the extender bind failed, will not impact your pod scheduling, right?
Yup
Right, if the field is there, we should support it. It's up to the cluster administrator to judge whether it makes sense to ignore a failed extender during bind.
Change:
"io" "io/ioutil" "os" <ins> "path/filepath" </ins> "testing" "time" v1 "k8s.io/api/core/v1" apitesting "k8s.io/cri-api/pkg/apis/testing" <ins> "k8s.io/kubernetes/pkg/kubelet/types" </ins> "k8s.io/utils/pointer" "github.com/stretchr/testify/assert"

Discussion:
won't output logs after kubelet rotate log filer of the container. kubectl output logs correctly after the log file is rotated. the config to . So kubelet will rotate the log soon. Build a image with this program a deploy with the previous image. the command No response <details</details<detailsNone </details<details</details<details</details<details</details<details</details
/sig node
/area kubelet
/triage accepted /priority important-longterm
/assign since you sent a PR already
Ran into this issue!
Change:
"//staging/src/k8s.io/api/rbac/v1:go_default_library", "//staging/src/k8s.io/apimachinery/pkg/api/errors:go_default_library", "//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library", <ins> "//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured:go_default_library", </ins> "//staging/src/k8s.io/apimachinery/pkg/fields:go_default_library", "//staging/src/k8s.io/apimachinery/pkg/labels:go_default_library", "//staging/src/k8s.io/apimachinery/pkg/runtime:go_default_library",

Discussion:
[ ] two weeks soak start date : testgrid-link [ ] two weeks soak end date : [ ] test promotion pr : kubernetes/kubernetes#? It was picked up in APISnoop that an untested endpoint was promoted from Beta to GA. PR ingress: promote CRUD API tests for v1 to conformance covered the Ingress life cycle tests, but readNetworkingV1NamespacedIngressStatus was missed. According to this APIsnoop readNetworkingV1NamespacedIngressStatus endpoint is untested. ginkgo.By("get /status") ingResource := schema.GroupVersionResource{Group: "", Version: ingVersion, Resource: "ingresses"} gottenStatus, err := f.DynamicClient.Resource(ingResource).Namespace(ns).Get(context.TODO(), createdIngress.Name, metav1.GetOptions{}, "status") framework.ExpectNoError(err) statusUID, _, err := unstructured.NestedFieldCopy(gottenStatus.Object, "metadata", "uid") framework.ExpectNoError(err) framework.ExpectEqual(string(createdIngress.UID), statusUID, fmt.Sprintf("createdIngress.UID: %v expected to match statusUID: %v ", createdIngress.UID, statusUID)) ''' List endpoints hit by the test: readNetworkingV1NamespacedIngressStatus endpoint If this test get merged, test coverage will go up by 1 point This test is also created with the goal of conformance promotion. /sig testing /sig architecture /area conformance
Duplicate of
/reopen Merged /assign Ready for creation of Promotion PR
Reopened this issue. <detailsIn response to : /reopen Merged /assign Ready for creation of Promotion PR Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Code change was a bug fix in a Merged conformance test. The correction should not require Promotion. /close
Closing this issue. <detailsIn response to : Code change was a bug fix in a Merged conformance test. The correction should not require Promotion. /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Change:
testDoneWG.Wait() close(stop) } <ins> func TestPanicPropagated(t *testing.T) { // source simulates an apiserver object endpoint. source := fcache.NewFakeControllerSource() // Make a controller that just panic if the AddFunc is called. _, controller := NewInformer( source, &v1.Pod{}, time.Millisecond*100, ResourceEventHandlerFuncs{ AddFunc: func(obj interface{}) { // Create a panic. panic("Just panic.") }, }, ) // Run the controller and run it until we close stop. stop := make(chan struct{}) defer close(stop) propagated := make(chan interface{}) go func() { defer func() { if r := recover(); r != nil { propagated <- r } }() controller.Run(stop) }() // Let's add a object to the source. It will trigger a panic. source.Add(&v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test"}}) // Check if the panic propagated up. select { case p := <-propagated: if p == "Just panic." { t.Logf("Test Passed") } else { t.Errorf("unrecognized panic in controller run: %v", p) } case <-time.After(wait.ForeverTestTimeout): t.Errorf("timeout: the panic failed to propagate from the controller run method!") } } </ins>

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: When use client-go to build the client, we implement the event handler for some k8s resourses. Sometime it will panic (maybe cause by the unexpected nil pointer bug), the process will not crash after panic. What you expected to happen: When we use event handler with informer in client-go, sometime it will panic in handler, we expect the process will crash. How to reproduce it (as minimally and precisely as possible): I run process which just panic simpliy in an event handler , use to produce the coredump, and use to check the call stack. The sample code I run is: The call stack of paniced goroutine: We can see the panic was called at frame 16 , and was catched by at 10. It printed the call stack in and panic again. The defer func was call at frame 8, it's (at 5). Panic was blocked at here. Finally, this goroutine was scheduled to , would not exit or crash the whole process. The go code in is : Environment: Kubernetes version (use ):OS (e.g: ):Kernel (e.g. ):
/sig api-machinery
Thanks for finding this! Personally I think any lines of the form are a bug waiting to happen, and in all the cases introduced by are unnecessary - we can simply call at the end.
/assign
Your fix looks better. I think using is easy to make mistakes . It not only defers the execution of a function, but also has some side effects ...