jiebi/CodeConvo huggingface dataset:
Change:
// This object has an invalid selector, it does not match the pod continue } <del> // If a PDB with a nil or empty selector creeps in, it should match nothing, not everything. if selector.Empty() || !selector.Matches(labels.Set(pod.Labels)) { </del> <ins> if !selector.Matches(labels.Set(pod.Labels)) { </ins> continue }

Discussion:
with an empty selector selects all the pods as expected. But, during the /, the pdb is not being honored correctly i.e. all the pods are getting evicted. This issue is only observed with the empty selector and works as expected if a valid label selector is provided that selects all the pods in a namespace. When an empty selector is provided in the 's spec, the created needs to be honored by not evicting all the pods during the api call Create a simple busybox deployment with 3 replicas on a local cluster (or any cluster)Create a pdb object with an selectorCheck the status of the created pdb object that has the observed to be 3 (which is expected)Call the api to see the pdb not being honored and all the pods being evictedDelete the above pdb object and create a new one with the label selectorObserve the expected status of the pdb object same as the old one with the set to 3Call the api to observe the pdb being honored as expected No response <details</details<detailslocal cluster - N/A </details<details</details<details</details<detailsCRI-O </details<details</details
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig apps
/assign
Change:
{% endif -%} {% set kubelet_auth = "--anonymous-auth=false --authorization-mode=Webhook --client-ca-file=" + pillar.get('ca_cert_bundle_path', '/var/lib/kubelet/ca.crt') %} <ins> {% set pki=" --cert-dir=/var/lib/kubelet/pki" -%} </ins> # test_args has to be kept at the end, so they'll overwrite any prior configuration <del> DAEMON_ARGS="{{daemon_args}} {{api_servers}} {{debugging_handlers}} {{hostname_override}} {{cloud_provider}} {{cloud_config}} {{config}} {{manifest_url}} --allow-privileged={{pillar['allow_privileged']}} {{log_level}} {{cluster_dns}} {{cluster_domain}} {{docker_root}} {{kubelet_root}}  {{non_masquerade_cidr}} {{cgroup_root}} {{system_container}} {{pod_cidr}} {{ master_kubelet_args }} {{cpu_cfs_quota}} {{network_plugin}} {{kubelet_port}} {{ hairpin_mode }} {{enable_custom_metrics}} {{runtime_container}} {{kubelet_container}} {{node_labels}} {{eviction_hard}} {{kubelet_auth}} {{feature_gates}} {{test_args}}" </del> <ins> DAEMON_ARGS="{{daemon_args}} {{api_servers}} {{debugging_handlers}} {{hostname_override}} {{cloud_provider}} {{cloud_config}} {{config}} {{manifest_url}} --allow-privileged={{pillar['allow_privileged']}} {{log_level}} {{cluster_dns}} {{cluster_domain}} {{docker_root}} {{kubelet_root}}  {{non_masquerade_cidr}} {{cgroup_root}} {{system_container}} {{pod_cidr}} {{ master_kubelet_args }} {{cpu_cfs_quota}} {{network_plugin}} {{kubelet_port}} {{ hairpin_mode }} {{enable_custom_metrics}} {{runtime_container}} {{kubelet_container}} {{node_labels}} {{eviction_hard}} {{kubelet_auth}} {{pki}} {{feature_gates}} {{test_args}}" </ins>

Discussion:
https://k8s- Judging by the timestamp, it's this batch of merge caused the failure: NONE
There are no sig labels on this issue. Please by:<br(1) mentioning a sig: <br(2) specifying the label manually: <br<brNote: method (1) will trigger a notification to the team. You can find the team list and label list
looks like it's your pr causing the failure ^^^
cc
There are no sig labels on this issue. Please by:<br(1) mentioning a sig: <br(2) specifying the label manually: <br<brNote: method (1) will trigger a notification to the team. You can find the team list and label list
It's still failing, See build log: https://k8s-, kubelet log: error in kubelet log:
Change:
GOARM ?= 7 DOCKER_CERT_BASE_PATH ?= QEMUVERSION=v5.1.0-2 <del> GOLANG_VERSION=1.23rc2 </del> <ins> GOLANG_VERSION=1.22.5 </ins> export ifndef WHAT

Discussion:
sgtm, add an issue labeled as release-blocking and in the milestone to either promote to 1.23.0 or revert this to 1.22.x before our 1.31 release Originally posted by in Kubernetes is being built and tested with go1.23rc2 at HEAD () to let it bake in the CI and help iron out issues, if any, with this version of Go. However, for the 1.31 release, the version of Go should be a non-rc, released version. The release timeline of go1.23.0 is ~same as the release timeline of K8s 1.31.0 (see ). If go1.23.0 is not out by then, we should revert to go1.22.x before cutting K8s 1.31.0. /sig release architecture /area code-organization /cc
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/triage accepted /cc
/milestone v1.31
cc
xposting relevant slack thread:
Also unlike in the past, missing shipping 1.23.0 in 1.31.0 is not a big deal, we have much more room to switch to 1.23.0 in a patch release after all the compat changes with the go team. So we should not fear reverting if the timelines don't line up.
(though go1.23 adds the thing that makes it workable to default to old go version compat settings, so we'll have to eke out another 5 months on 1.21/1.22 for until we can adopt 1.23 on release branches in ~Jan if we miss 1.31, but that's how it looks like it will have to happen)
Change:
// Extenders returns a slice of extender config. This is exposed for // testing. Extenders() []algorithm.SchedulerExtender <ins> // GetPredicateMetadataProducer returns the predicate metadata producer. This is needed // for cluster autoscaler integration. // TODO(ahg-g): remove this once CA migrates to creating a Framework instead of a full scheduler. PredicateMetadataProducer() predicates.PredicateMetadataProducer </ins> } // ScheduleResult represents the result of one pod scheduled. It will contain

Discussion:
/sig scheduling What would you like to be : Expose from constructed object. Why is this needed: Cluster Autoscaler is internally creating scheduler instance to perform predicates simulations. Up until now we used for bootstrapping scheduler. This allowed as to obtain the via (). We wanted to migrate to to simplify bootstrapping but now we cannot get the as it is not exposed via any public method/field of object. See WIP branch with migrated to () /sig scheduling
/assign
Change:
echo "Annotating node objects with ${annotation_size_bytes} byte label" label=$( (< /dev/urandom tr -dc 'a-zA-Z0-9' | fold -w "$annotation_size_bytes"; true) | head -n 1) "${KUBECTL}" --kubeconfig="${LOCAL_KUBECONFIG}" get nodes -o name  <del> | xargs -n10 -P100 -r -I% "${KUBECTL}" --kubeconfig="${LOCAL_KUBECONFIG}" annotate --overwrite % label="$label" </del> <ins> | xargs -n10 -P100 -r -I% "${KUBECTL}" --kubeconfig="${LOCAL_KUBECONFIG}" annotate --overwrite % label="$label" > /dev/null </ins> echo "Annotating node objects completed" }

Discussion:
After has been implemented and enabled the 5k node kubemark run has extra ~10k lines of logs like this ones: Example kubemark 5k run: We should get rid of that, it doesn't bring any value only pollutes the log
/sig scalability /cc
Change:
} if s.BootstrapToken != nil { <del> fs.BoolVar(&s.BootstrapToken.Enable, "experimental-bootstrap-token-auth", s.BootstrapToken.Enable, ""+ "Deprecated (use --enable-bootstrap-token-auth).") fs.MarkDeprecated("experimental-bootstrap-token-auth", "use --enable-bootstrap-token-auth instead.") </del> fs.BoolVar(&s.BootstrapToken.Enable, "enable-bootstrap-token-auth", s.BootstrapToken.Enable, ""+ "Enable to allow secrets of type 'bootstrap.kubernetes.io/token' in the 'kube-system' "+ "namespace to be used for TLS bootstrapping authentication.")

Discussion:
/kind feature As part of , the flag on the API server should be renamed to something like . We'll leave deprecated (should it be a no-op or not?) for v1.8. Or we should consider adding an explicit flag to the API server in the same way we have  flag on controller-manager. Right now, it enables/disables most authn plugins implicitely based on other flags (often pointing to various files on disk; if you specified a path to that file, you also want to enable this authn module) What way do you prefer?
/assign
Rough plan: (1.8) Add (1.8) Make it an error to specify both and (so we don't have to decide on precedence) (1.8) Add a warning if is used. (1.9) Drop
is: Mark deprecated. cc Approve?
/reopen Re-opening because there's a little bit left to do in 1.9 (ready to go in ).
[MILESTONENOTIFIER] Milestone Labels Incomplete Action required: This issue requires label changes. If the required changes are not made within 6 days, the issue will be moved out of the v1.8 milestone. priority: Must specify exactly one of [, , ]. <detailsAdditional instructions available <a href=""here</aThe commands available for adding these labels are documented <a href=""here</a</details
Change:
q := req.URL.Query() q.Del("timeout") q.Del("timeoutSeconds") <ins> q.Del("allowWatchBookmarks") </ins> req.URL.RawQuery = q.Encode() t.Logf("Request %q %q %q", req.Method, req.URL, req.UserAgent()) <del> if len(s.expectUserAgent) > 0 && req.UserAgent() != s.expectUserAgent { </del> <ins> if a := s.ExpectUserAgent(); len(a) > 0 && req.UserAgent() != a { </ins> t.Errorf("Unexpected user agent: %s", req.UserAgent()) }

Discussion:
<!-- Please only use this template for submitting reports about failing tests in Kubernetes CI jobs --Which jobs are failing: pull-kubernetes-bazel-test Which test(s) are failing: Test_buildClientCertificateManager Testgrid link: Reason for failure: Anything else we need to know:
/remove-kind failing-test /kind flake /sig scheduling
/sig node
Change:
"//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library", "//vendor/k8s.io/apimachinery/pkg/watch:go_default_library", "//vendor/k8s.io/client-go/testing:go_default_library", <ins> "//vendor/k8s.io/client-go/tools/cache:go_default_library", "//vendor/k8s.io/client-go/util/workqueue:go_default_library", </ins> "//vendor/k8s.io/kube-aggregator/pkg/apis/apiregistration:go_default_library", "//vendor/k8s.io/kube-aggregator/pkg/client/clientset_generated/internalclientset:go_default_library", "//vendor/k8s.io/kube-aggregator/pkg/client/clientset_generated/internalclientset/fake:go_default_library", "//vendor/k8s.io/kube-aggregator/pkg/client/informers/internalversion:go_default_library", <ins> "//vendor/k8s.io/kube-aggregator/pkg/client/listers/apiregistration/internalversion:go_default_library", </ins> ], )

Discussion:
The unit tests described here are really hard to read and they've been flaking. A pattern based on indexers like this is easier to understand. I would suggest writing a new unit test file and once the coverage is consistent, just deleting the old one. We need coverage for: ignoring APIServices that aren't auto managed when they are mutated create an APIService in response to AddAPIServiceToSync delete an APIService in response to RemoveAPIServiceToSync duplicate RemoveAPIServiceToSync don't panic duplicate AddAPIServiceToSync don't panic AddAPIServiceToSync an APIService, then having the user take ownership (remove annotation), then RemoveAPIServiceToSync should not touch the APIService creating an APIService with the when no such service has been AddAPIServiceToSync, should result in APIService deletion AddAPIServiceToSync an APIService, then modify the APIService. The APIService should be stomped back to the AddAPIServiceToSync value.
hi, , about follow the indexers pattern to refactor , so I using a to replace previous and , and using to manipulate ? I wrote a basic framwork of new unit test file, is this right ? here is my code(not finished yet) :
Change:
<ins> #!/usr/bin/env bash # Copyright 2018 The Kubernetes Authors. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # #     http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. set -o errexit set -o nounset set -o pipefail run_wait_tests() { set -o nounset set -o errexit kube::log::status "Testing kubectl wait" create_and_use_new_namespace ### Wait for deletion using --all flag # create test data kubectl create deployment test-1 --image=busybox kubectl create deployment test-2 --image=busybox # Post-Condition: deployments exists kube::test::get_object_assert "deployments" "{{range .items}}{{.metadata.name}},{{end}}" 'test-1,test-2,' # Delete all deployments async to kubectl wait ( sleep 2 && kubectl delete deployment --all ) & # Command: Wait for all deployments to be deleted output_message=$(kubectl wait deployment --for=delete --all) # Post-Condition: Wait was successful kube::test::if_has_string "${output_message}" 'test-1 condition met' kube::test::if_has_string "${output_message}" 'test-2 condition met' set +o nounset set +o errexit } </ins>  No newline at end of file

Discussion:
We should consider updating the command to wait on all resources for a given kind. For example: would wait for every pod in the current namespace to be deleted. /sig cli cc
Interestingly, the error text implies that this is already supported: Yet when you try to use it, it declares Would really like the wait functionality given some much needed TLC. Still no way to determine what conditions are supported for various resources (eg. I can say and it just waits for the timeout like that resource might actually potato at some point).
I'm looking into adding the --all flag to wait, sounds like a nice feature to have :)
Change:
- [Debugging clusters](#debugging-clusters) - [Local clusters](#local-clusters) - [Testing against local clusters](#testing-against-local-clusters) <ins> - [Version-skewed and upgrade testing](#version-skewed-and-upgrade-testing) </ins> - [Kinds of tests](#kinds-of-tests) - [Conformance tests](#conformance-tests) - [Defining Conformance Subset](#defining-conformance-subset)

Discussion:
Data as of June 3rd, 9:00 PM Eastern. Latest data can be found here: Prow link to the 2 jobs: * Additional Context:
/sig storage cc
I'm working on , it's hard to get a job yaml right at the first time. I'll check iscsi. /assign
/triage accepted /kind failing-test
ci-kubernetes-e2e-storage-kind-disruptive fixed: has 1 green run pull-kubernetes-e2e-storage-kind-disruptive fixed: , it fails when it should fail, it's green otherwise, I'll continue with iscsi.
/reopen it's still red, but at least it installs now:
Reopened this issue. <detailsIn response to : /reopen it's still red, but at least it installs now: Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
e2e-gce-iscsi-serial job passes now: e2e-gce-iscsi is getting greener: I'll let it run for few more days to see if today's failures are flakes. /reopen
Reopened this issue. <detailsIn response to : It's getting greener: /reopen </details
iscsi-serial is green:
Change:
return nil, fmt.Errorf("failed to select a host interface: %v", err) } <ins> err = setRLimit(64 * 1000) if err != nil { return nil, fmt.Errorf("failed to set open file handler limit: %v", err) } </ins> proxyPorts := newPortAllocator(pr) glog.V(2).Infof("Setting proxy IP to %v and initializing iptables", hostIP) return createProxier(loadBalancer, listenIP, iptables, hostIP, proxyPorts, udpIdleTimeout) } <ins> func setRLimit(limit uint64) error { return syscall.Setrlimit(syscall.RLIMIT_NOFILE, &syscall.Rlimit{Max: limit, Cur: limit}) } </ins> func createProxier(loadBalancer LoadBalancer, listenIP net.IP, iptables iptables.Interface, hostIP net.IP, proxyPorts PortAllocator, udpIdleTimeout time.Duration) (*Proxier, error) { // convenient to pass nil for tests.. if proxyPorts == nil {

Discussion:
There's some practical limit on the number of concurrent access tokens that can be used in a Kubernetes cluster before it begins to spend all of its time in the authn stack verifying them. Absent fixes to it was < 500; with the fixes linked there it's still not infinitely scalable-- I still hit (what I believe to be) with ~ 5k unique tokens @ ~700QPS. This request is to this dimension an official name & definition, and list it with others, e.g. here: it it have a useful value (I think it should be 10k) /kind bug /sig scalability
/cc
oh and 4. add tests which verify it is as high as believed.
cc since projected tokens will increase the number of unique tokens
/sig auth
LRUs are not good at scaling and sharding has some major pitfalls as pointed out. I would suggest that we try to drop the LRU cache for successful authentication results in the token cache. The main benefit of using an LRU here is bound cache size. Entries in the token cache have a fast expiration independent of the LRU policy. The records probably take up O(2kb) (guesstimate) of memory. Given that these are successful attempts with presumably valid tokens, I don't think we are getting any benefit from the LRU. If we don't have a constraint on fixed cache size, we can back the token cache with a sync.Map and run a single background goroutine to periodically walk the map and remove expired entries. This would fix the problematic locking and eviction due to nonuniform distribution of tokens over shards. The failure cache is less important and we don't cache failures by default. If we consider this the "slowpath", we can probably leave it as. If that's not good enough, we have a couple options (with various tradeoffs) to improve it.
If off by default is not enough, more reasoning why the failed cache is not super useful: it might help with an accidental DoS but it doesn't prevent anything actively malicious DoS. I think we can focus our improvements on the success cache.
/assign He is already working on adding an explicit test for it.
has taken it over and is actively working on this. Unfortunately, I cannot assign this issue to him as he's not a k8s member yet
It's not closed - all testes must be submitted and appropriate documentation must be
Thanks everyone!!
Change:
if err != nil { continue } <del> if options.PodName != test.expectedPod { t.Errorf("expected: %s, got: %s (%s)", test.expectedPod, options.PodName, test.name) </del> <ins> if options.PodName != test.expectedPod.Name { t.Errorf("expected: %s, got: %s (%s)", test.expectedPod.Name, options.PodName, test.name) </ins> } if options.ContainerName != test.expectedContainer { t.Errorf("expected: %s, got: %s (%s)", test.expectedContainer, options.ContainerName, test.name)

Discussion:
I feel like I should be able to do: but I get
or we have to do something like this: sounds reasonable to me. needs more comments.
All commands that accept resources should accept resource/NAME syntax. In this case for back compat we must only accept a single argument, is familiar with this.
Exactly. ResourceNames in the resource builder is what is needed here to handle the default resource (pod in this case) and provide the ability to specify more.
Related
If nobody is working on it, I'd like to pick the issue, pls.
I don't think anyone is. , Illia Khudoshyn wrote:
So could you please assign me?
I can't assign to just anyone, unfortunately, but by responding here, anyone else who might work on it will see that you are already in progress. , Illia Khudoshyn wrote:
please go ahead, you did own this now. :)
Has this been reverted again? I cannot use “pod/podname” for v1.11:
^ Seconding the above. I'm getting the same 'may not contain /' error. Naturally it's trivial to use unix commands to filter this, but this is such a basic feature and matches the way the rest of kubectl works, so it's quite a shocking omission.
as a unix novice who's also experiencing this problem, I'd love to know your workaround
If you use selectors, you can do something like this: Otherwise you'll need to manually grep, something like this: is the syntax in bash to run the command and use its output as part of another command. You can also use backticks to achieve the same effect but that's considered bad form by many (myself included). For example: If going the grep route, take care to make sure your regex will only return one result, otherwise you'll have to pipe it to xargs or something similar.
Just ran into this on a brand new default installation. Local Mac Docker for Desktop Enabled k8 in preferences error: invalid resource name "svc/broken-gorilla-postgresql": [may not contain '/']
FWIW you can use combined with the flag, e.g.
Had the same problem. Updating kubectl resolved the issue for me.
Change:
return } <ins> plugin.mu.Lock() defer plugin.mu.Unlock() </ins> podCIDR, ok := details[network.NET_PLUGIN_EVENT_POD_CIDR_CHANGE_DETAIL_CIDR].(string) if !ok { glog.Warningf("%s event didn't contain pod CIDR", network.NET_PLUGIN_EVENT_POD_CIDR_CHANGE)

Discussion:
I gathered e2e test results of suite for last 100 runs. The following is the list of flaky tests. Some might not be related to . I will start with the service tests. Any help would be appreciated. Detail list: Jenkins project:
cc/ Cluster team is working on to make kubenet default. Once we switch this to production, we don't need to restart docker to configure cbr0.
After a bunch of PRs got merged, the kubenet suite is much more stable. One more known flake can be fixed by I will post new flake tests here.
Just bump into a new failure: One of the nodes () got panic: Looks like it crashed at shaper reset.: Can you take a look?
Change:
dir := t.TempDir() configFileName := filepath.Join(dir, "config.yaml") <del> if err := os.WriteFile(configFileName, []byte(` </del> <ins> if err := atomicWriteFile(configFileName, []byte(` </ins> apiVersion: apiserver.config.k8s.io/v1alpha1 kind: AuthorizationConfiguration authorizers:

Discussion:
ci-kubernetes-integration-master --- FAIL: TestMultiWebhookAuthzConfig (9.23s) (03-20) I cannot search for previous flake. updated recently /sig auth /cc
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Updated the description, the actual cause of the flake is an unexpected change in the file reload timestamp metric
interestingly, doesn't show any failures of this test for this reason (there are a few failures on a PR that broke a bunch of integration tests for a different reason)
Fix open in , switched the file write to an atomic write
No flake after 03-29. Thanks.
Change:
fmt.Printf("Initializing e2e tests using host %s.n", host) running++ go func(host string) { <del> results <- testHost(host, archive) </del> <ins> results <- testHost(host, archive, *cleanup) </ins> }(host) } }

Discussion:
Looks like it maybe the ssh connect is getting killed
The relevant log snippet:
And another one, not just coreos.