jiebi/CodeConvo huggingface dataset:
Change:
Name:  "bar", Image: image, Command: []string{ <del> "/bin/sh", "-c", "sleep 10; fallocate -l 10M file; sleep 10000", </del> <ins> "/bin/sh", "-c", "sleep 10; dd if=/dev/zero of=file bs=1M count=10; sleep 10000", </ins> }, Resources: v1.ResourceRequirements{ Limits: v1.ResourceList{

Discussion:
in this test the rootfs is limited to 5M and the pod is evicted by creating a 10M file with; But this fails if the fs doesn't support the fallocate syscall. The K8s e2e must not itself require support for features that K8s does not require. I am unsure why my overlay fs in containers doesn't support fallocate(2) while the fs on the node (ext4) does. I have queried on the slack. I build my Linux kernel myself but I can't find anything related. If the command is changed to; the test works on an fs that doesn't support fallocate(2). It may seem more "primitive" but it doesn't require a feature that K8s doesn't. <detailsNone </detailsNo response No response
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig testing
Interesting /Triage accepted
Change:
optional k8s.io.apimachinery.pkg.apis.meta.v1.Time time = 1; // String detailing the error encountered during Attach or Detach operation. <del> // This string maybe logged, so it should not contain sensitive </del> <ins> // This string may be logged, so it should not contain sensitive </ins> // information. // +optional optional string message = 2;

Discussion:
This came up as a follow up to Also rather than opening 5 different issues - we are going to use this github issue to track all follow up items mentioned here -
/sig storage
/assign /assign
: PR
and the rest is fixed in
Change:
volumeMounts: - name: kube-dns-config mountPath: /etc/k8s/dns/dnsmasq-nanny <ins> securityContext: capabilities: drop: - all add: - NET_BIND_SERVICE - SETGID </ins> - name: sidecar image: k8s.gcr.io/k8s-dns-sidecar:1.14.13 livenessProbe:

Discussion:
<!-- Please only use this template for submitting enhancement requests --What would you like to be : Apply security best practices for both kube-dns and core-dns. Low hanging fruit: [x] Run as non-root & disallow privilege escalation [x] Run with the default seccomp profile (i.e. ) [x] ReadOnlyRootFilesystem [x] Avoid unnecessary HostPath volumes [x] (n/a) More advanced: [ ] Reduce dependencies in the base image () [ ] Custom seccomp profile [ ] Custom AppArmor profile [x] Drop unneeded capabilities[x] Run as non-root & disallow privilege escalation [x] Run with the default seccomp profile (i.e. ) [x] ReadOnlyRootFilesystem [x] Avoid unnecessary HostPath volumes [x] (n/a) More advanced: [ ] Reduce dependencies in the base image () [ ] Custom seccomp profile [ ] Custom AppArmor profile [x] Drop unneeded capabilities This is based on the long term issue and implemented by PR . Why is this needed: Our system pods should run using security best practices, both to enhance cluster security and serve as examples of best practices to users.
/sig auth /area security
Change:
} // If both the pod and labels are unchanged, no update is needed <del> if !podChanged && !labelsChanged { </del> <ins> if !podChangedFlag && !labelsChanged { </ins> return }

Discussion:
This test has started failing on our e2e test suite, erroring out with "Failed to get endpoints..." https://k8s- https://k8s- Example failures https://k8s- https://k8s- cc cc
This may be related to our recently-merged endpoints change in . I'll look into it.
I verified that the flakiness introduced was a result of . A fix in should be merging soon. /assign
GitHub didn't allow me to assign the following users: joelsmith. Note that only can be assigned. <detailsIn response to : I verified that the flakiness introduced was a result of . A fix in should be merging soon. /assign Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Change:
"ingressclass.go", "kube_proxy.go", "loadbalancer.go", <del> "network_policy.go", </del> "network_tiers.go", "networking.go", "networking_perf.go",

Discussion:
<!-- Please only use this template for submitting enhancement requests --What would you like to be : Remove the folder in favor of . Why is this needed: With the refactoring from the Netpol validation , the tests from folder are deprecated and duplicated at this point. Action items: tests tests
/area testing /sig network
The label(s) cannot be applied, because the repository doesn't have them <detailsIn response to : /area testing /sig network Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
thank you ... !
/triage accepted
Change:
} } }`) <ins> var structuralSchemaWithEmptyObject = []byte(` { "openAPIV3Schema": { "description": "weird CRD with empty spec, unstructured status. designed to fit test fixtures.", "type": "object", "x-kubernetes-validations": [ { "rule": "[has(self.spec), has(self.status)].exists_one(x, x)" } ], "properties": { "spec": { "type": "object" }, "status": { "type": "object", "additionalProperties": true } } } } `) </ins>

Discussion:
While migrating webhooks to CEL for one of the structs in our CRD api, I noticed that the empty object in CEL is interpreted wrongly. Empty map object seems to be interpreted correctly. In the example below, both map and object are sent empty () in json output. returns true json (captured on the client side) sent to the apiserver CRD schema No response <details</details<details</details<details</details<details</details<details</details<details</details
/sig api-machinery
CEL only sees the JSON sent to the server, and is correctly evaluated as present. The issue is with the client sending the request populating a value in that field. How is the request being constructed? /remove-kind bug /kind support
/cc /triage accepted
Upon investigation, the problem lies there: We requires either or be set.
Thanks for raising this issue! I was debugging offline with and seems like CRD/CR validation didn't handle the situation of unsetting properties with field type specified . It is a corner case in CRD since we normally would ask for properties defined if the field type is (I could not think of use case which having properties unset). But it might ok to allow it through since it won't hurt from CRD perspective. We will fix in CEL values handling which treat this as empty map passed. /assign
GitHub didn't allow me to assign the following users: jiahui. Note that only with read permissions, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time. For more information please see <detailsIn response to : Thanks for raising this issue! I was debugging offline with and seems like CRD/CR validation didn't handle the situation of unsetting properties with field type specified 'Object1object`(I could not think of use case which having properties unset). But it might ok to allow it through since it won't hurt from CRD perspective. We will fix in CEL values handling which treat this as empty map passed. /assign </details
also check if the CRD validation allows the or values, and if so, if the CEL code handles those properly as well
FYI: We do not allow in crd structured schema now:
Change:
} func (s *sourceFile) processEvent(e *inotify.Event) error { <ins> // Ignore file start with dots if strings.HasPrefix(e.Name, ".") { glog.V(4).Infof("Ignored pod manifest: %s, because it starts with dots", e.Name) return nil } </ins> var eventType podEventType switch { case (e.Mask & inotify.IN_ISDIR) > 0:

Discussion:
Is this a BUG REPORT or FEATURE REQUEST? (choose one): Bug Repport Kubernetes version (use ): 1.5.1 (Both Server and Client) Environment: Cloud provider or hardware configuration: AWS OS (e.g. from /etc/os-release): UBUNTU 16.04 Kernel (e.g. ): 4.4.0-47-generic Install tools: Chef What happened: Kubelet picks up dot files in --pod-manifest-path causing stuff to breaks by replacing existing pods. What you expected to happen: Exclude dot files from being picked up under --pod-manifest-path How to reproduce it (as minimally and precisely as possible): Take any manifest, copy it as and kubelet will deploy that new manifest Anything else do we need to know: From the slack channel it's been identified to be introduce by (by on Slack)
Just sent a simple fix, while still open for discussion.
Change:
} eventBroadcaster := record.NewBroadcaster() <del> recorder := eventBroadcaster.NewRecorder(scheme.Scheme, v1.EventSource{Component: "route_controller"}) </del> <ins> recorder := eventBroadcaster.NewRecorder(scheme.Scheme, v1.EventSource{Component: "route-controller"}) </ins> rc := &RouteController{ routes:           routes,

Discussion:
<!-- This form is for bug reports and feature requests ONLY! If you're looking for help check and the . --Is this a BUG REPORT or FEATURE REQUEST?: /kind feature What happened: kubect create -f to create statefulset, and describe the statefulset, output the event likes <preEvents: FirstSeen LastSeen Count From SubObjectPath Type Reason Message --------- -------- ----- ---- ------------- -------- ------ ------- 1m 1m 1 statefulset Normal SuccessfulCreate create Claim www-web-0 Pod web-0 in StatefulSet web success 1m 1m 1 statefulset Normal SuccessfulCreate create Pod web-0 in StatefulSet web successful </preWhat you expected to happen: the From of event change to 'statefulset-controller' in output, let know the source of event more obvious, likes the event when create job and other resource(replicaset,replication). <preEvents: FirstSeen LastSeen Count From SubObjectPath Type Reason Message --------- -------- ----- ---- ------------- -------- ------ ------- 3m 3m 1 job-controller Normal SuccessfulCreate Created pod: pi-7gd2m </preHow to reproduce it (as minimally and precisely as possible): create a statefulset and describe it to see the event Anything else we need to know?: Environment: Kubernetes version (use ):kubernetes 1.7 Cloud provider or hardware configuration**: OS (e.g. from /etc/os-release): Kernel (e.g. ): Install tools: Others:
There are no sig labels on this issue. Please by: a sig: e.g., to notify the contributor experience sig, OR the label manually: e.g., to apply the label Note: Method 1 will trigger an email to the group. You can find the group list and label list . The in the method 1 has to be replaced with one of these: bugs, feature-requests, pr-reviews, test-failures, proposals
/assign
/area controller-manager
/sig node
Change:
glog.Infof("Version test passed") } <ins> func runSelfLinkTest(c *client.Client) { var svc api.Service err := c.Post().Path("services").Body( &api.Service{ ObjectMeta: api.ObjectMeta{ Name: "selflinktest", Labels: map[string]string{ "name": "selflinktest", }, }, Port: 12345, // This is here because validation requires it. Selector: map[string]string{ "foo": "bar", }, }, ).Do().Into(&svc) if err != nil { glog.Fatalf("Failed creating selflinktest service: %v", err) } err = c.Get().AbsPath(svc.SelfLink).Do().Into(&svc) if err != nil { glog.Fatalf("Failed listing service with supplied self link '%v': %v", svc.SelfLink, err) } var svcList api.ServiceList err = c.Get().Path("services").Do().Into(&svcList) if err != nil { glog.Fatalf("Failed listing services: %v", err) } err = c.Get().AbsPath(svcList.SelfLink).Do().Into(&svcList) if err != nil { glog.Fatalf("Failed listing services with supplied self link '%v': %v", svcList.SelfLink, err) } found := false for i := range svcList.Items { item := &svcList.Items[i] if item.Name != "selflinktest" { continue } found = true err = c.Get().AbsPath(item.SelfLink).Do().Into(&svc) if err != nil { glog.Fatalf("Failed listing service with supplied self link '%v': %v", item.SelfLink, err) } break } if !found { glog.Fatalf("never found selflinktest service") } glog.Infof("Self link test passed") // TODO: Should test PUT at some point, too. } </ins> func runAtomicPutTest(c *client.Client) { var svc api.Service err := c.Post().Path("services").Body(

Discussion:
Had a report of this over email. Filing this issue so we don't forget to investigate.
Can't reproduce.
Change:
}, }, { <del> name: "custom IPv6 networking", </del> <ins> name: "custom IPv6 networking for v1.12.0-beta.2", </ins> cfg: &kubeadmapi.ClusterConfiguration{ Networking:        kubeadmapi.Networking{PodSubnet: "2001:db8::/64"}, CertificatesDir:   testCertsDir, <del> KubernetesVersion: "v1.7.0", </del> <ins> KubernetesVersion: "v1.12.0-beta.2", </ins> }, expected: []string{ "kube-controller-manager",

Discussion:
Is this a BUG REPORT or FEATURE REQUEST?: /kind bug What happened: When I use kubeadm to create an old version k8s cluster, the controller manager pod can not work well. The command like this : "kubeadm init --kubernetes-version=v1.11.2" The error of kube controller manager pod like this : What you expected to happen: The controller manager pod can work well. How to reproduce it (as minimally and precisely as possible): Anything else we need to know?: Environment: Kubernetes version (use ): v1.12.0 Cloud provider or hardware configuration: OS (e.g. from /etc/os-release): CentOS 7 Kernel (e.g. ): Install tools: kubeadm Others:
Reiterating the mentions to trigger a notification: <detailsIn response to : Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/remove-sig contributor-experience /area kubeadm
Please, use when filing kubeadm issues. /sig cluster-lifecycle
OK, thank you for reminding me.
Change:
import ( "net/http" <ins> "strings" </ins> "k8s.io/apimachinery/pkg/util/sets" apirequest "k8s.io/apiserver/pkg/endpoints/request" ) <del> // BasicLongRunningRequestCheck returns true if the given request has one of the specified verbs or one of the specified subresources </del> <ins> // BasicLongRunningRequestCheck returns true if the given request has one of the specified verbs or one of the specified subresources, or is a profiler request. </ins> func BasicLongRunningRequestCheck(longRunningVerbs, longRunningSubresources sets.String) apirequest.LongRunningRequestCheck { return func(r *http.Request, requestInfo *apirequest.RequestInfo) bool { if longRunningVerbs.Has(requestInfo.Verb) {

Discussion:
Is this a BUG REPORT or FEATURE REQUEST?: What happened: In the log: What you expected to happen: The timeout should be more relaxed on /debug/pprof endpoints. How to reproduce it (as minimally and precisely as possible):
/assign
Change:
Design docs are in [design](design). <ins> API objects are explained at [http://kubernetes.io/third_party/swagger-ui/](http://kubernetes.io/third_party/swagger-ui/). </ins> ## Primary concepts * **Overview** ([overview.md](overview.md)): A brief overview

Discussion:
The schema understood by the Kubernetes configuration file is not described any where. The current practice mostly is copy/paste existing samples (for example ) and edit them. There is a need to define a comprehensive list of elements, and their documentation, so that other examples can leverage them.
Configuration files specify exactly our API objects. See:
This is exactly what I was looking for but not easily googlable, or documented clearly.
Could you please put a link to the swagger UI here?
The only mention in the public docs is here: which links directly to the struct definition on github. It appears that the Swagger docs have been deprecated, and I'm unable to find any documentation for the KubeletConfiguration resource kind in the new docs. It's referred to in at least one place, but is still not actually covered:
Change:
isErrorRetriableWithSideEffectsFn := func(err error) bool { if canRetry := isWatchErrorRetriable(err); canRetry { klog.V(2).Infof("%s: watch-list of %v returned %v - backing off", r.name, r.typeDescription, err) <del> <-r.initConnBackoffManager.Backoff().C() </del> <ins> <-r.backoffManager.Backoff().C() </ins> return true } if isExpiredError(err) || isTooLargeResourceVersionError(err) {

Discussion:
Currently, reflector uses two backoff managers: One is used for initial list call and other for watch call. Imagine following scenaraion when k8s apiserver is under very heavy load: the beginning, reflector spams k8s apiserver (with exponential backoff) with calls until one of them succeeds (due to APF throtling and receiving ) tries to run request and uses separate backoffManager - so again spams k8s apiserver with requests Watch does not succeed during Etcd compaction window (2.5 - 5 minutes usually) at some point it will receive and go back to point 1, spamming k8s apiserver again with List calls (because first backoffManager for List got reseted after 2 minutes of retries for Watch requests) I propose we combine these two backoff managers into one. If we combine these two backoffManagers into one, it will work like this: At the beginning, reflector spams k8s apiserver (still with exponential backoff) with calls until one of them succeeds Tries to make first watch call instantly (as there is no backoff on this path) If it fails, it will makre retries every (30, 60)s If watch request fails all the times during Etcd compaction window it will go back to List call, but already being throttled with (30, 60)s window. /sig scalability
/cc
/assign
I think the proposed solution makes sense to me. Probably before we start, we should to understand why we ended up with two back off managers by looking into PRs touching them. Maybe the code authors had some specific case in mind.
for thoughts too I agree it makes sense, but I don't know the historical context here.
/sig api-machinery
/triage accepted
Change:
} func (asw *actualStateOfWorld) MarkDeviceAsMounted( <del> volumeName v1.UniqueVolumeName) error { return asw.SetVolumeGloballyMounted(volumeName, true /* globallyMounted */) </del> <ins> volumeName v1.UniqueVolumeName, devicePath string) error { return asw.SetVolumeGloballyMounted(volumeName, true /* globallyMounted */, devicePath) </ins> } func (asw *actualStateOfWorld) MarkDeviceAsUnmounted( volumeName v1.UniqueVolumeName) error { <del> return asw.SetVolumeGloballyMounted(volumeName, false /* globallyMounted */) </del> <ins> return asw.SetVolumeGloballyMounted(volumeName, false /* globallyMounted */, "" /*devicePath*/) </ins> } // addVolume adds the given volume to the cache indicating the specified

Discussion:
We fixed invalid device path in bunch of places via - but call still could use invalid device path. That check can sometimes use invalid path and hence can cause UnmountDevice operation to fails even though device has already been unmounted. /sig storage /sig openstack /assign
Actually this does not affect version 1.10 onwards. Not sure if 1.9 is still supported. I think I will close this for now. /close
I just noticed that 1.9 is still supported and hence it is probably worth fixing there for now.
How come the check can "sometimes" use invalid device path?
So on Cinder for example - call would return something like as attach device path. But if you see the linked PR(), will do a and use that device path for global mount. In general it is always a good idea to use device path returned by as single source of truth. This applies to something like EBS with NVMe too where device is discovered via call (but nvme disks aren't directly affected by this bug because returned device path on EBS is bogus).
So on EBS with NVMe for example - check will always fail (but still return success) because it will use something like as device path which does not actually exist on the node.
You said the issue only happens "sometimes". Can you clarify why it only happens occasionally?
doesn't the linked PR make it clear? detection based on the drive serial number (aka It's cinder ID) on the kubelet itself. As for why - Cinder sometimes returns wrong device path on call, I don't know. But it happens and we have worked around it.
Fixed by
Change:
} pod.Spec.Containers = append(pod.Spec.Containers, rwcontainer) <del> f.PodClient().CreateSync(pod) </del> <ins> pod = f.PodClient().CreateSync(pod) ginkgo.By("verifying that pod has the correct nodeSelector") framework.ExpectEqual(pod.Spec.NodeSelector["kubernetes.io/os"], "windows") </ins> cmd := []string{"cmd", "/c", "echo windows-volume-test", ">", filePath}

Discussion:
similar to PR en route
/sig windows
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Change:
return nil, fmt.Errorf("either run this scheduler via km or else --executor-path is required") } else { if strings.Index(s.kmPath, "://") > 0 { <del> // URI could point directly to executable, e.g. hdfs:///km // or else indirectly, e.g. http://acmestorage/tarball.tgz // so we assume that for this case the command will always "km" ci.Uris = append(ci.Uris, &mesos.CommandInfo_URI{Value: proto.String(s.kmPath), Executable: proto.Bool(true)}) ci.Value = proto.String("./km") // TODO(jdef) extract constant </del> <ins> if strings.HasPrefix(s.kmPath, "file://") { // If `kmPath` started with "file://", `km` in agent local path was used. ci.Value = proto.String(strings.TrimPrefix(s.kmPath, "file://")) } else { // URI could point directly to executable, e.g. hdfs:///km // or else indirectly, e.g. http://acmestorage/tarball.tgz // so we assume that for this case the command will always "km" ci.Uris = append(ci.Uris, &mesos.CommandInfo_URI{Value: proto.String(s.kmPath), Executable: proto.Bool(true)}) ci.Value = proto.String("./km") // TODO(jdef) extract constant } </ins> } else if s.kmPath != "" { uri, kmCmd := s.serveFrameworkArtifact(s.kmPath) ci.Uris = append(ci.Uris, &mesos.CommandInfo_URI{Value: proto.String(uri), Executable: proto.Bool(true)})

Discussion:
I'd like to run local in agent host. The parameters is used to set executor, but it did not set 's arguments. The proposal is to provide an argument to set the local path of in agent host. cc
It seems we have a hidden parameter , I'll try it firstly.
any suggestion?
how did work out? if you ran into problems .. what were they?
Just have a try, it seems not work; I'm on sure whether configuration issue.
, just go through the code; the will only point to the binaries in master and Mesos agent will fetch it. It did not match this requirement. Do you have time on this? I'd like to work on this and let you review it :).
, would you help to review the patch?
Yes, just provided some feedback on your PR , Klaus Ma wrote:
Change:
GCE_IMAGE_PROJECT=kubernetes-jenkins-pull INSTALL_GODEP=true CLEANUP=true <del> GINKGO_FLAGS= </del> <ins> GINKGO_FLAGS=--ginkgo.skip=FLAKY </ins> SETUP_NODE=false  No newline at end of file

Discussion:
As of now node e2e requires all the tests to pass. There are tests like the container conformance tests which have been flaky in the past - , , We need ability to mark certain tests as flaky and not run them as part of merge queue.
Ginkgo flags makes it possible to skip tests. We can use a prefix to not run flaky tests in our existing jenkins CIs.
Closing via