jiebi/CodeConvo huggingface dataset:
Change:
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" unstructuredv1 "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" "k8s.io/apimachinery/pkg/runtime/schema" <ins> "k8s.io/apimachinery/pkg/types" </ins> "k8s.io/apimachinery/pkg/util/intstr" "k8s.io/apimachinery/pkg/util/wait" "k8s.io/client-go/discovery"

Discussion:
[x] test pr : kuberenetes/kubernetes# [x] two weeks soak start date : testgrid-link [x] two weeks soak end date : [x] test promotion pr : kubernetes/kubernetes#? According to this APIsnoop query, there are still some remaining APIService endpoints which are untested. With this query you can filter untested endpoints by their category and eligiblity for conformance. e.g below shows a query to find all conformance eligible untested,stable,core endpoints Addressing the following endpoints in this document; Using the current e2e test as a template, create an APIService for Using the REST client, read the APIService status (readApiregistrationV1APIServiceStatus) and confirm the value of . Using the REST client, patch the APIService (patchApiregistrationV1APIService) before confirming that it has been updated. Using the REST client, list all APIServices in the cluster (listApiregistrationV1APIService) before confirming that can be found. Clean up APIService resources used by the test. Due to the complexity of setting up the resources for APIService we have used the current e2e test as template. It has been extended in a for review. This query shows the endpoints hit within a short period of running the e2e test example endpoint | useragent ---------------------------------------|
createApiregistrationV1APIService | Should be able to support the 1.17 Sample API Server using the current Aggregator2 deleteApiregistrationV1APIService | Should be able to support the 1.17 Sample API Server using the current Aggregator2 listApiregistrationV1APIService | Should be able to support the 1.17 Sample API Server using the current Aggregator2 patchApiregistrationV1APIService | Should be able to support the 1.17 Sample API Server using the current Aggregator2 readApiregistrationV1APIService | Should be able to support the 1.17 Sample API Server using the current Aggregator2 readApiregistrationV1APIServiceStatus | Should be able to support the 1.17 Sample API Server using the current Aggregator2 (6 rows) Based on the initial APIsnoop query and the results listed above there are three new endpoints hit.

If a test with these calls gets merged, test coverage will go up by 3 points This test is also created with the goal of conformance promotion. /sig testing /sig architecture /area conformance
/triage accepted
Change:
type HTTPIngressPath struct { // Path is matched against the path of an incoming request. Currently it can // contain characters disallowed from the conventional "path" part of a URL <del> // as defined by RFC 3986. Paths must begin with a '/'. When unspecified, // all paths from incoming requests are matched. </del> <ins> // as defined by RFC 3986. Paths must begin with a '/' and must be present // when using PathType with value "Exact" or "Prefix". </ins> // +optional Path string `json:"path,omitempty" protobuf:"bytes,1,opt,name=path"`

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --When I tried to use the default path I got . No error. According to the path is not needed. "When unspecified, all paths from incoming requests are matched." Create a ingress like so: Kubernetes version (use ):Cloud provider or hardware configuration: AWS OS (e.g: ): N/A Kernel (e.g. ): N/A Install tools: brew Network plugin and version (if this is a network-related bug): N/A Others:
/sig network /area ingress It seems to be a problem of ingress and I suggest creating an issue in I find a similar one which is a little different there
We use - would this be a problem with the aws repo then?
/assign
So digging a bit here, the API docs needs to be improved. By the , is required if the PathPrefix is Exact or Prefix. To solve your issue specifically, you have two ways: Add that accepts ingress without paths Add and change PathPrefix to Prefix, so this becomes a catchAll I'll open a PR to fix the comment/docs. Thanks!
Thanks! In my case because I'm using ALB controller I had to use with prefix to get it working - see
/triage accepted PR will close this ;)
Change:
// charge for storage if request, found := pvc.Spec.Resources.Requests[corev1.ResourceStorage]; found { <ins> roundedRequest := request.DeepCopy() if !roundedRequest.RoundUp(0) { // Ensure storage requests are counted as whole byte values, to pass resourcequota validation. // See http://issue.k8s.io/94313 request = roundedRequest } </ins> result[corev1.ResourceRequestsStorage] = request // charge usage to the storage class (if present) if len(storageClassRef) > 0 {

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: When a pvc was specified with a quantity including the suffix : attempts to include that quantity in the resourcequota's storage resulted in the following error, which blocked all other updates to the resourcequota: What you expected to happen: Updates to all other quantities in the resourcequota should not have been blocked by the error above In general, as a suffix (milli) doesn't really make sense when used in the context of memory, and causes issues like the above. Would it be possible to deny the usage of this suffix at admission time for things like pvcs? (Our mitigation right now is to add a rule that does this in Open Policy Agent). How to reproduce it (as minimally and precisely as possible): Create a resourcequota object with limits on pvcs and the a storage type, e.g. Then create a PVC with the following spec: The resource quota controller should start producing the error log above. Anything else we need to know?: Environment: Kubernetes version (use ): v1.17.3 Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others:
/sig api-machinery
/remove-sig api-machinery /sig storage
i guess we should leave api-machinery! /sig api-machinery
/assign I think we should validate the value of field.
I've filed to address this issue.
looks like it is not easy to tighten the validation and that requires careful consideration xref:
/assign
"Updates to all other quantities in the resourcequota should not have been blocked by the error above" should be fixed separately
Opened to round storage requests up to the nearest byte in the quota evaluator.
Change:
if cfg.Global.Datacenter != "us-west" { t.Errorf("incorrect datacenter: %s", cfg.Global.Datacenter) } <ins> if cfg.Global.VMUUID != "1234" { t.Errorf("incorrect vm-uuid: %s", cfg.Global.VMUUID) } </ins> } func TestNewVSphere(t *testing.T) {

Discussion:
What keywords did you search in Kubernetes issues before filing this one?: VMware, vSphere, IP, UUID BUG REPORT. Kubernetes version: Environment: Cloud provider or hardware configuration: VMware vSphere 6.5.0 OS : Debian GNU/Linux 8.7 (jessie) Kernel : Install tools: Kargo What happened: Some containers were launched on a node with a name containing the hostname of a different node and the does not retrieve the right node name : Here is retrieved instead of . When using the VSphere Cloud provider, the node name is retrieved from the function in Since this PR (), the node data are retrieved based on the IP address instead of the UUID. The function gets all the IP address and check if one of the IP on any interface matches a VM on vSphere. The problem is that the docker0 interface has the same IP on all the nodes (usually 172.17.0.1) and this IP is referenced into VMware. As this IP may be the first to appear in the it will match the first VM that vSphere gives with the function and this can be any VM running Docker on vSphere. Thus, the provider has a big chance to not get the informations for the VM it is running on, leading to an inconsistent state in the cluster (wrong pod name for example). Anything else we need to know: An idea would be to first retrieve the VM name with the function and if no results use the IP address (and add an exclusion to not use the interface). What do you think ? If you think this might be the right way to do, we can try to propose the PR. Thanks for your feedback.
Wow, this very much is a bad, bad bug. It was introduced by one of my colleagues here at HPE. It's made worse if you run multiple Kubernetes clusters in the same vSphere Datacenter. I'll send a PR upstream tomorrow to resolve this. I think it's best to go back to using dmidecode, but maybe someone from VMware ( or ?) has another suggestion? This would still require root access, but I can't think of a better way to get the machine's ID.
Related issue Will dig in more. For now instead of making it a value determined runtime the deployment framework should have root privileges and can populate it as part of the cloud config post VM creation.
is my colleague.

A little more info and a few ideas. I would also support going back to ` (still requires root though). We could also have the following logic: Get UUID and use it to get the VM Name with FindByUUID if possible, If not, get the hostname and use FindByDNSName, If still nothing is found, keep the current logic, excluding docker0 from the interfaces we examine. However, I agree with that getting this from the cloud config may be the best and most reliable solution.
I'm working on a patch right now that will do the following: Add a VMUUID field to the cloud config If VMUUID is not set, will use Error out if neither one is available
PR is - if someone would like to review :)
Change:
$PARSERS_CONFIG | Out-File -FilePath $fluentbit_parser_file -Encoding ASCII # Create directory for all the log position files. <del> New-Item -Type Directory -Path "/var/run/google-fluentbit/pos-files/" </del> <ins> New-Item -Type Directory -Path "/var/run/google-fluentbit/pos-files/" -Force | Out-Null </ins> Log-Output "Wrote logging config to $fluentbit_parser_file" }

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --The default fluent-bit configuration for GCE Windows nodes produces unparsed JSON logs and does not forward container logs. Container log output is produced. fluent-bit on a given windows image. a GCE Windows e2e cluster and view the stackdriver output for pods. Kubernetes version (use ): 1.20+ Cloud provider or hardware configuration: GKE/GCE OS (e.g: ): Windows Kernel (e.g. ): Any version Install tools: fluent-bit Network plugin and version (if this is a network-related bug): Others:
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig windows
Change:
cName6 = "container6-name" cName7 = "container7-name" cName8 = "container8-name" <ins> cName9 = "container9-name" </ins> ) func TestCRIListPodStats(t *testing.T) {

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: CPU.Time is set to cs.StartTime but ps.Memory.Time is set to timestamp when collecting the memoryusage. What you expected to happen: CPU.Time is set to cs.CPU.Time How to reproduce it (as minimally and precisely as possible): Check the code Anything else we need to know?: Environment: Kubernetes version (use ): master branch when creating this issue. Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others:
/assign
/sig kubelet
The label(s) cannot be applied, because the repository doesn't have them <detailsIn response to : /sig kubelet Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig node
I am happy to take over this. /assign
Change:
__custom_func() { case ${last_command} in kubectl_get | kubectl_describe | kubectl_delete | kubectl_label | kubectl_stop) <del> __kubectl_get_resource </del> <ins> __kubectl_get_resource return ;; kubectl_logs) __kubectl_require_pod_and_container return ;; kubectl_exec) __kubectl_get_resource_pod </ins> return ;; <del> kubectl_logs) __kubectl_require_pod_and_container return ;; </del> *) ;; esac

Discussion:
TODOs: Last updated on Sept 2 by Janet [x] kubectl label - suggest a resource type [x] kubectl get and delete also use kubectl.NewHumanReadablePrinter to get the resources back, thus should be fixed as well. [x] kubectl exec - suggest the pod name [x] kubectl rolling-update - suggest the rc name [x] check that is doing the right thing [x] Distribute with kubernetes binaries [x] Put information about kubectl completion in user guide [x] docs/getting-started- Recently some users reported that there is no completion for the kubectl command. But there is. Unfortunately it is not documented how to install it. I found that all needs to be done is to: (or maybe just copy this file into /etc/bash_completion.d/) This information should be put into the user guide (maybe it is there - I just can't find it) I think it should be included for instance here: docs/getting-started- There are also some minor issues: does not suggest the rc name does not suggest the pod name does not suggest a resource type (maybe this is ok because we can give --overwrite here)
It looks like the bash-completion file is not distributed with kubernetes binaries:
:+1: This should definitely be provided with the binaries.
Good suggestions. Cc
, please cofirm that the bash completion file is distributed with k8s binaries: namely contrib/completions/bash/kubectl For me it looks like it isn't.
cc
I confirmed and it isn't.
TODOs: [x] kubectl label - suggest a resource type [x] kubectl get and delete also use kubectl.NewHumanReadablePrinter to get the resources back, thus should be fixed as well. [x] kubectl exec - suggest the pod name [x] kubectl rolling-update - suggest the rc name [x] check that is doing the right thing [x] Distribute with kubernetes binaries [x] Put information about kubectl completion in user guide [x] docs/getting-started- Last updated on Sept 2
Maybe add: check that is doing the right thing....
Thanks for the suggestion. Checklist updated.
Depending on where you want it in the tarball, is a good place to start. You can use and then iterate on until you're comfortable with the changes.

(If I'm making packaging changes, I'll frequently start by dumping the sorted output of that command into a file, then later diff against it to make sure I got exactly the change I wanted.)
Right now both and brings up all containers that has. Since is optional (the without -c way is supported as legacy behavior), this is expected. I'm not sure how to force the bash completion to print instead of container names when since flag isn't set as required in code.
Change:
log_level_logfile: debug EOF <del> hostnamef=$(hostname -f) </del> <ins> hostnamef=$(uname -n) </ins> apt-get install -y ipcalc netmask=$(ipcalc $MINION_IP_RANGE | grep Netmask | awk '{ print $2 }') network=$(ipcalc $MINION_IP_RANGE | grep Address | awk '{ print $2 }')

Discussion:
Actually appending fqdn suffix already causes issue for non-resolvable node names based on today: Today when NodeController "registers" nodes in SyncCloud by getting bare instance names () from GCE, and recreating the fqdn and append it to instance names().
Change:
#   CLUSTER_NAME # Vars set: #   NODE_INSTANCE_GROUPS <ins> #   ALL_INSTANCE_GROUP_URLS </ins> function detect-node-instance-groups { echo "... in gke:detect-node-instance-groups()" >&2 local urls=$("${GCLOUD}" ${CMD_GROUP:-} container clusters describe  --project="${PROJECT}" --zone="${ZONE}"  --format='value(instanceGroupUrls)' "${CLUSTER_NAME}") urls=(${urls//;/ }) <ins> ALL_INSTANCE_GROUP_URLS=${urls[*]} </ins> NODE_INSTANCE_GROUPS=() for url in "${urls[@]:-}"; do <del> NODE_INSTANCE_GROUPS+=("${url##*/}") </del> <ins> local igm_zone=$(expr match ${url} '.*/zones/([a-z0-9-]*)/') if [[ "${igm_zone}" == "${ZONE}" ]]; then NODE_INSTANCE_GROUPS+=("${url##*/}") fi </ins> done }

Discussion:
The test job was passing consistently until midday on 6/18, e.g. Then it started failing consistently, e.g: ... with this error: 12:31:41 ... in gke:detect-node-instance-groups() 12:31:42 ERROR: (gcloud.compute.instance-) Some requests did not succeed: 12:31:42 - The resource 'projects/k8s-jkns-e2e-gke-multizone/zones/us-central1-f/instanceGroupManagers/gke-jenkins-e2e-default-pool--grp' was not found 12:31:42 Assigning to and to triage and assign someone to fix.
cc:
Almost certainly caused by . I'm not going to bother rushing in a rollback today since it's not a critical build, but could you fix this up tomorrow
Yeah, that's me. The change to support multiple MIGs in a single zone doesn't quite work. Didn't know of this test variation. Just to confirm, to run this test variation, the additional env vars I should set are (aside from the standard ones): export KUBERNETESPROVIDER=gke export ADDITIONALZONES=us-central1-a,us-central1-b Any other?
-- yet another instance of a PR passing all presubmit tests and breaking other jenkins jobs after being merged.
Can you tell me a bit more how this test is setup? I tried to do a "kube-" with the additional zones and it worked for me. My settings: export KUBERNETESPROVIDER=gke export ZONE=us-central1-f export CLOUDSDKBUCKET=gs://cloud-sdk-testing/ci/staging export CLOUDSDKAPIENDPOINTOVERRIDESCONTAINER=https://test- export ADDITIONAL_ZONES=us-central1-a,us-central1-b
Have you read ?
Oh, sorry, wrong link.
Take a look at and let me know if you need any more info.
The above PR was the one for GCE. The following is the one did for GKE. There are some relatively minor differences:
Hum, I'll have to dig a bit deeper. I tried the exact combination of env vars and my "kube-up" was successful (with the correct number of nodes across the zones).

Curious...
Any ETA, I'm getting tired of all the test failure emails :p
I think I found the problem. I have a workaround that'll make it work for now. I'm hoping sometime this afternoon.
The PR merged and gke-multizone Jenkins has gone green. Sorry for the trouble. There's still a larger issue of multi-zone handling in the test runner itself, but I think that's for another day.
Change:
svc = jig.WaitForLoadBalancerOrFail(namespace, serviceName, loadBalancerCreateTimeout) jig.SanityCheckService(svc, v1.ServiceTypeLoadBalancer) <ins> // timeout when we haven't just created the load balancer normalReachabilityTimeout := 2 * time.Minute </ins> By("check reachability from different sources") svcIP := framework.GetIngressPoint(&svc.Status.LoadBalancer.Ingress[0]) <del> framework.CheckReachabilityFromPod(true, namespace, acceptPodName, svcIP) framework.CheckReachabilityFromPod(false, namespace, dropPodName, svcIP) </del> <ins> // Wait longer as this is our first request after creation.  We can't check using a separate method, // because the LB should only be reachable from the "accept" pod framework.CheckReachabilityFromPod(true, loadBalancerLagTimeout, namespace, acceptPodName, svcIP) framework.CheckReachabilityFromPod(false, normalReachabilityTimeout, namespace, dropPodName, svcIP) </ins> By("Update service LoadBalancerSourceRange and check reachability") jig.UpdateServiceOrFail(svc.Namespace, svc.Name, func(svc *v1.Service) { // only allow access from dropPod svc.Spec.LoadBalancerSourceRanges = []string{dropPod.Status.PodIP + "/32"} }) <del> framework.CheckReachabilityFromPod(false, namespace, acceptPodName, svcIP) framework.CheckReachabilityFromPod(true, namespace, dropPodName, svcIP) </del> <ins> framework.CheckReachabilityFromPod(false, normalReachabilityTimeout, namespace, acceptPodName, svcIP) framework.CheckReachabilityFromPod(true, normalReachabilityTimeout, namespace, dropPodName, svcIP) </ins> By("Delete LoadBalancerSourceRange field and check reachability") jig.UpdateServiceOrFail(svc.Namespace, svc.Name, func(svc *v1.Service) { svc.Spec.LoadBalancerSourceRanges = nil }) <del> framework.CheckReachabilityFromPod(true, namespace, acceptPodName, svcIP) framework.CheckReachabilityFromPod(true, namespace, dropPodName, svcIP) </del> <ins> framework.CheckReachabilityFromPod(true, normalReachabilityTimeout, namespace, acceptPodName, svcIP) framework.CheckReachabilityFromPod(true, normalReachabilityTimeout, namespace, dropPodName, svcIP) </ins> }) })

Discussion:
Sub-issue for For AWS ELB, when an ELB is first created, is made it is very normal that it takes 2 minutes to be created, but the DNS name is reported fairly quickly.
Change:
package anonymous import ( <ins> "net/http" </ins> "testing" "k8s.io/apimachinery/pkg/util/sets"

Discussion:
Semantics are going to vary. We need to cross off these authenticators: [x] if ctx has an audience limitation, verify the token audience and echo in the response [x] take implicit audiences at WebhookTokenAuthenticator construction time if ctx is audience-limited, add into the tokenreview object if the tokenreview returns with an audience set that matches the ctx, copy into the response and return success if the tokenreview returns without an audience set, ensure the ctx audiences intersect with the implicit audiences taken at WebhookTokenAuthenticator construction time, and pick one to add into the response [x] echo audience in response if present in ctx [x] echo audience in response if present in ctx [x] check that the the order of (audience in the context) ∩ ( (implicit api audiences) ∪ (clientids) ) 0 Take implicit audiences at Authenticator construction time, and if ctx is audience-limited, ensure it intersects with the implicit audiences, and echo an audience in the response. [x] [x] [x] [x] [x] [x] Do nothing? [x] [x] [x] [x] [x] [x] [x] note: we already keyed the cache with the audience. [x]
There are no sig labels on this issue. Please add a sig label by either: a sig: e.g., to notify the contributor experience sig, OR the label manually: e.g., to apply the label Note: Method 1 will trigger an email to the group. See the . The in method 1 has to be replaced with one of these: bugs, feature-requests, pr-reviews, test-failures, proposals. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/close
Closing this issue. <detailsIn response to : /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details