jiebi/CodeConvo huggingface dataset:
Change:
<ins> load("@io_bazel_rules_go//go:def.bzl", "go_library") go_library( name = "go_default_library", srcs = ["openstack.go"], importpath = "k8s.io/kubernetes/test/e2e/framework/providers/openstack", visibility = ["//visibility:public"], deps = ["//test/e2e/framework:go_default_library"], ) filegroup( name = "package-srcs", srcs = glob(["**"]), tags = ["automanaged"], visibility = ["//visibility:private"], ) filegroup( name = "all-srcs", srcs = [":package-srcs"], tags = ["automanaged"], visibility = ["//visibility:public"], ) </ins>

Discussion:
What happened: When specifying "openstack" as cloud-provider of e2e test, the test is failed like What you expected to happen: We can run e2e test with openstack cloud provider. How to reproduce it (as minimally and precisely as possible): Just kick the following command: ` Anything else we need to know?: This issue doesn't happen on v1.13, so this issue seems to happen during this dev cycle for v1.14. Environment: Kubernetes version (use ): master for v1.14 Cloud provider or hardware configuration: OpenStack OS (e.g: ): Ubuntu 16.04.5 LTS Kernel (e.g. ): 4.4.0-142-generic Install tools: kubeadm Others:
/sig openstack /sig testing
The exception raises at
The reason of this issue comes from
Ideally it is nice to put a new directory for registering the cloud provider.
/assign
I was wondering we could remove "openstack" provider specific tests and conditions from e2e tests, but there are storage tests which are related to OpenStack in e2e tests. So it is nice to add registration for OpenStack at this time.
Change:
# startup, otherwise containers won't land in flannel's network... Requires=docker-cache.service flanneld.service After=docker-cache.service flanneld.service <del> [Service] Environment=DOCKER_OPTS='--registry-mirror=http://$private_ipv4:5000' </del> - name: kube-apiserver.service command: start content: | [Unit] Description=Kubernetes API Server Documentation=https://github.com/GoogleCloudPlatform/kubernetes <del> Requires=etcd2.service After=etcd2.service </del> <ins> Requires=etcd2.service setup-network-environment.service After=etcd2.service setup-network-environment.service </ins> [Service] <ins> EnvironmentFile=/etc/network-environment </ins> ExecStartPre=-/usr/bin/mkdir -p /opt/bin ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kube-apiserver ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-apiserver

Discussion:
Minor issues with 1) The examples rely on cloud vendor specific variables ($private_ipv4 ) 2) The wget command for kube-register always re-downloads
Change:
SystemUUID string `json:"systemUUID"` // BootID is the boot-id reported by the node BootID string `json:"bootID"` <ins> // Kernel version reported by the node KernelVersion string `json:"kernelVersion""` // OS image used reported by the node OsImage string `json:"osImage"` // Container runtime version reported by the node ContainerRuntimeVersion string `json:"containerRuntimeVersion"` // Kubelet version reported by the node KubeletVersion string `json:"kubeletVersion"` // Kube-proxy version reported by the node KubeProxyVersion string `json:"kubeProxyVersion"` </ins> } // NodeStatus is information about the current status of a node.

Discussion:
Is this a BUG REPORT or FEATURE REQUEST?: /kind bug What happened: According to the two changes are required to enable it: Add to apiserver and scheduler. Add to apiserver. So I modified the apiserver manifest: And the scheduler manifest: confirms that both are running with the required changes. However, I cannot create PodPriorities by following the example in the documentation: also doesn't think the API is enabled: The only relevant message in the apiserver log is: What you expected to happen: I expected to be able to create podpriority resources by following the example in the documentation. How to reproduce it (as minimally and precisely as possible): See description. Anything else we need to know?: Environment: Kubernetes version (use ):Cloud provider or hardware configuration**: GCE OS (e.g. from /etc/os-release): CentOS Linux 7.4 (1708) Kernel (e.g. ): Linux master-head-1 4.13.4- SMP Wed Sep 27 13:32:23 EDT 2017 x8664 x8664 x8664 GNU/Linux Install tools: Custom scripts Others:
/sig scheduling
The example yaml of priorityclass is wrong, the right version is
please try the recommendation from and close this issue?
unfortunately that version change to the YAML does not fix the problem for me either: To me it looks like the error message points me to where I don't see defined?
Yes, you are right, I have commit a pr to fix this.
Not sure but after using the updated config I am able to create Priority Class successfully but unable to use the feature while creating POD. Here are the errors observed Getting following error while creating pod: The PodPriority is enabled in both API server and Scheduler
I'm able to create PriorityClass and schedule pod with specified PriorityClass on Minikube 0.26.0. ` !
This issue was sorted - on kubeadm production setup, this flag needs to be enabled for kubelet as well - updated doc
I've created the PriorityClass and deployed the pod with the specified PriorityClass. The pod is getting created. I'm wondering is there any way to check the PriorityClass of the pod either in UI or CLI? The steps you've shown is giving me the same result. Can you please help me ? Thanks in advance.
Change:
t.Fatalf("cannot assert plugin to be type csiPlugin") } <del> // Wait until the informer in CSI volume plugin has all CSIDrivers. wait.PollImmediate(TestInformerSyncPeriod, TestInformerSyncTimeout, func() (bool, error) { return csiDriverInformer.Informer().HasSynced(), nil }) if volumeAttachmentInformer != nil { wait.PollImmediate(TestInformerSyncPeriod, TestInformerSyncTimeout, func() (bool, error) { return volumeAttachmentInformer.Informer().HasSynced(), nil }) } </del> return csiPlug, fakeWatcher, tmpDir, fakeClient }

Discussion:
Which test(s) are flaking: TestAttacherWithCSIDriver Reason for failure: This is flaking rarely enough that it is not caught by our CI jobs, which currently tolerate up to 2 unit test failures per run (!). With that toleration removed in , this flake has been seen (). Reproducible with the following steps: a test binary for the affected package: the affected test using the tool (setting the timeout to a generous timeout relative to the normal test runtime of .02 seconds): failures are seen, look at the logs to see the details about the error: /sig storage cc
/assign can you help investigate this flake?
I have found the root cause. /assign
filed to address this issue.
Change:
sleep 5 ALL_RUNNING=1 for id in $POD_ID_LIST; do <del> CURRENT_STATUS=$(remove-quotes $($CLOUDCFG -json get "pods/$(remove-quotes ${id})" | jq '.currentState.info["mynginx"].State.Running and .currentState.info["net"].State.Running')) </del> <ins> CURRENT_STATUS=$($CLOUDCFG -template '{{and .CurrentState.Info.mynginx.State.Running .CurrentState.Info.net.State.Running}}' get pods/$id) </ins> if [ "$CURRENT_STATUS" != "true" ]; then ALL_RUNNING=0 fi

Discussion:
We have an e2e test that runs the guestbook example. We should also have one that runs through the other example.
Change:
import ( "context" <ins> "crypto/subtle" </ins> "encoding/csv" "fmt" "io"

Discussion:
This issue was reported in the Description The kube-apiserver includes multiple authentication backends for client request processing. These range in strength from client certificate authentication to simple HTTP Basic Authentication. When using a password (Basic Authentication), the kube-apiserver does not perform a secure comparison of secret values. In theory, this could allow an attacker to perform a timing attack on the comparison. For example, the AuthenticatePassword function simply performs string comparison to authenticate a user’s password (Figure 9.1). Figure 9.1: Username and password authentication handling in Exploit Scenario Alice runs a Kubernetes cluster in production. In order to support multiple organizational “customers,” she configures the cluster with HTTP Basic Authentication. Eve has a large number of username and password pairs for the organization, and uses the side-channel information from string comparison to tune her credential-stuffing attacks. Recommendation Short term, use a safe, constant-time comparison function such as . The comparison function should take the same amount of time regardless of matching prefix data within the password. Long term, deprecate Basic Authentication in favor of more robust and secure options. Add documentation noting that any Basic Authentication is for use only in development scenarios, and not appropriate for production deployments. This will help users create a robust and secure default stance for all deployments. Anything else we need to know?: See for current status of all issues created from these findings. The vendor gave this issue an ID of ATR-K8S-002 and it was finding 18 of the report. The vendor considers this issue Medium Severity. To view the original finding, begin on page 55 of the Environment: Kubernetes version: 1.13.4 Fixed in v1.16.0 by
/sig auth
/area security /kind bug /remove-kind feature
Change:
k8sNodeRouteTag = "k8s-node-route" // AffinityTypeNone - no session affinity. <del> gceAffinityTypeNone = "None" </del> <ins> gceAffinityTypeNone = "NONE" </ins> // AffinityTypeClientIP - affinity based on Client IP. gceAffinityTypeClientIP = "CLIENT_IP" // AffinityTypeClientIPProto - affinity based on Client IP and port.

Discussion:
Hi, I have a problem with my GCE cluster about LoadBalancer type Services It's creating a lot of unused static external IP on the google network of my project the cluster is running kubernetes v1.1.2. Tried restarting nodes, tried destroy/recreate of the entire cluster.
Seeing exactly the same issue at GKE since a few hours. First on a v1.0.7 cluster which I later upgraded to v1.1.2 to fix the problem but the issue is still there. Double checked my yaml config files but no changes from our side. Existing loadbalancers do work as before.
I dealt with this last night and a workaround was to add to the spec
Thx :+1:
We'll get this cherry picked into the two release branches once it's been verified at HEAD.
Change:
ss = sst.WaitForStatus(ss) By("getting scale subresource") <del> scale := framework.NewStatefulSetScale(ss) scaleResult := &appsv1beta2.Scale{} err = c.AppsV1().RESTClient().Get().AbsPath("/apis/apps/v1").Namespace(ns).Resource("statefulsets").Name(ssName).SubResource("scale").Do().Into(scale) </del> <ins> scale, err := c.AppsV1().StatefulSets(ns).GetScale(ssName, metav1.GetOptions{}) </ins> if err != nil { framework.Failf("Failed to get scale subresource: %v", err) }

Discussion:
What would you like to be : e2e test suites for: GET /apis/apps/v1/namespaces/{namespace}/statefulsets/{name}/scale PUT /apis/apps/v1/namespaces/{namespace}/statefulsets/{name}/scale Why is this needed: PR has already been merged, but the following tests are still commented out. Therefore, scale sub-resource of statefulsets is not tested and test should be . /sig testing
Change:
} By("creating the pod with failed condition") <del> pod, err := f.ClientSet.CoreV1().Pods(f.Namespace.Name).Create(pod) Expect(err).ToNot(HaveOccurred(), "while creating pod") err = framework.WaitTimeoutForPodRunningInNamespace(f.ClientSet, pod.Name, pod.Namespace, framework.PodStartShortTimeout) Expect(err).To(HaveOccurred(), "while waiting for pod to be running") </del> var podClient *framework.PodClient podClient = f.PodClient() <ins> pod = podClient.Create(pod) err := framework.WaitTimeoutForPodRunningInNamespace(f.ClientSet, pod.Name, pod.Namespace, framework.PodStartShortTimeout) Expect(err).To(HaveOccurred(), "while waiting for pod to be running") </ins> By("updating the pod") podClient.Update(podName, func(pod *v1.Pod) {

Discussion:
Which jobs are failing: All new tests introduced for api change Which test(s) are failing: New alpha subpathExpr tests [Feature:VolumeSubpathEnvExpansion][NodeAlphaFeature:VolumeSubpathEnvExpansion] Existing tests are working fine and the whole suite works correctly in the gce suite https://k8s- Since when has it been failing: 21st February 2019 (since merge of PR) Testgrid link: https://k8s- Reason for failure: Investigation shows that node e2e tests use a different framework pod creation pattern Doing some comparisons of tests that work and those that don't reveals differences in the standard client set as and the existing ones which do work go through the intermediate which uses The version has an additional function specifically for node tests
/sig storage
/sig node /sig test
/assign
/cc
/sig test
Change:
} // Columns: Name, ParentRef, Age expected := []metav1.TableRow{ <del> {Cells: []interface{}{"192.168.2.2", "myresource.mygroup/mynamespace/myname", "10y"}}, {Cells: []interface{}{"2001:db8::2", "myresource2.mygroup2/mynamespace2/myname2", "5y1d"}}, </del> <ins> {Cells: []interface{}{"192.168.2.2", "myresource.mygroup/mynamespace/myname", "<unknown>"}}, {Cells: []interface{}{"2001:db8::2", "myresource2.mygroup2/mynamespace2/myname2", "<unknown>"}}, </ins> } rows, err := printIPAddressList(&ipList, printers.GenerateOptions{})

Discussion:
and also v1.27-1.29 TestPrintIPAddressList After 03-01 the leap day caused the failure /sig cli network
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Change:
API_PORT=${API_PORT:-8080} API_HOST=${API_HOST:-127.0.0.1} API_HOST_IP=${API_HOST_IP:-${API_HOST}} <del> API_BIND_ADDR=${API_HOST_IP:-"0.0.0.0"} </del> <ins> API_BIND_ADDR=${API_BIND_ADDR:-"0.0.0.0"} </ins> KUBELET_HOST=${KUBELET_HOST:-"127.0.0.1"} # By default only allow CORS for requests on localhost API_CORS_ALLOWED_ORIGINS=${API_CORS_ALLOWED_ORIGINS:-"/127.0.0.1(:[0-9]+)?$,/localhost(:[0-9]+)?$"}

Discussion:
The script doesn't support a user-value for the Kube-apiserver option. This is the IPs on which the Kube API will listen for secure API requests. The local-cluster-up script is set in such a way that it will only bind to the same IP as the one defined in : The default value of will never be used as is always set on the line before. This means that today getting to the secure Kube API through the kube service IP doesn't work. (By default the secure API only binds to on the host). Proposal is to have a default of for secure API binding, or whatever value is provided by the user.
Change:
l.migrationCheck.validateMigrationVolumeOpCounts() } <del> ginkgo.It("multiple pods should access different volumes repeatedly [Slow] [Serial]", func() { l := init() defer func() { cleanup(l) }() for i := 0; i < l.testOptions.NumPods; i++ { framework.Logf("Creating resources for pod %v/%v", i, l.testOptions.NumPods-1) r := CreateVolumeResource(driver, l.config, pattern, t.GetTestSuiteInfo().SupportedSizeRange) l.resources = append(l.resources, r) podConfig := e2epod.Config{ NS:           f.Namespace.Name, PVCs:         []*v1.PersistentVolumeClaim{r.Pvc}, SeLinuxLabel: e2epv.SELinuxLabel, } pod, err := e2epod.MakeSecPod(&podConfig) framework.ExpectNoError(err) </del> <ins> ginkgo.BeforeEach(func() { init() createPodsAndVolumes() }) </ins> <del> l.pods = append(l.pods, pod) } </del> <ins> f.AddAfterEach("cleanup", func(f *framework.Framework, failed bool) { cleanup() }) ginkgo.It("multiple pods should access different volumes repeatedly [Slow] [Serial]", func() { </ins> // Restart pod repeatedly for i := 0; i < l.testOptions.NumPods; i++ { podIndex := i

Discussion:
/sig storage What happened: When you interrupt the e2e storage stress test, namespaced objects are cleaned up, but non-namespaced objects like StorageClasses are not cleaned up. What you expected to happen: Non-namespaced objects like StorageClasses are cleaned up so long as the user doesn't interrupt a second time. How to reproduce it (as minimally and precisely as possible):
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Change:
if err != nil { t.Errorf("Test %q failed: GetPV %q returned error: %v", name, pv.Name, err) } <del> if !reflect.DeepEqual(cachedPV, pv) { </del> <ins> // Cache may be overridden by API object with higher version, compare but ignore resource version. newCachedPV := cachedPV.DeepCopy() newCachedPV.ResourceVersion = pv.ResourceVersion if !reflect.DeepEqual(newCachedPV, pv) { </ins> t.Errorf("Test %q failed: cached PV check failed [A-expected, B-got]:n%s", name, diff.ObjectDiff(pv, cachedPV)) } }

Discussion:
<!-- Please only use this template for submitting reports about failing tests in Kubernetes CI jobs --Which jobs are failing: pull-kubernetes-bazel-test Which test(s) are failing: Since when has it been failing: Testgrid link: Reason for failure: Anything else we need to know:
the test failure seems related to the PR that is being tested no other flakes have been observed:
I've run it against latest master locally and it may fail. Not sure why it has low chance to fail in prow job.
- i can recreate it with
/sig testing
Change:
} func (g *GCERunner) machineType(machine string) string { <ins> var ret string </ins> if machine == "" && *instanceType != "" { <del> machine = *instanceType </del> <ins> ret = *instanceType } else if machine != "" { ret = machine </ins> } else { <del> machine = defaultGCEMachine </del> <ins> ret = defaultGCEMachine </ins> } <del> return fmt.Sprintf("zones/%s/machineTypes/%s", *zone, machine) </del> <ins> return fmt.Sprintf("zones/%s/machineTypes/%s", *zone, ret) </ins> } func (g *GCERunner) rebootInstance(instance *compute.Instance) error { // wait until the instance will not response to SSH

Discussion:
seems like an infra issue. No tests run 7/21 No response No response /sig node
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/cc
/cc
ssh connection timeouts: Which weird given that it ran on the default network and there is a firewall rule in there that allows ssh from anywhere.
Got a fix, another regression from I really need to get these kubetest2 jobs ran as presubmits by default on k/k ASAP.
Change:
"k8s.io/kubernetes/test/integration/framework" ) <ins> const ( resourceQuotaTimeout = 10 * time.Second ) </ins> // 1.2 code gets: // 	quota_test.go:95: Took 4.218619579s to scale up without quota // 	quota_test.go:199: unexpected error: timed out waiting for the condition, ended with 342 pods (1 minute)

Discussion:
<!-- Please only use this template for submitting reports about flaky tests or jobs (pass or fail with no underlying change in code) in Kubernetes CI --integration test jobs TestQuotaLimitService which was recently in One example run: I suspect this is because TestQuotaLimitService runs through multiple test cases where each test case relies on state created from the previous case. However, resource quota changes take some time to get propagated on the system and the test is trying to validate acceptance of new Services before the resource quota controller applies the necessary changes. links to appreciated links to specific failures in spyglass appreciated <!-- Please see the deflaking doc () for more guidance! --
cc
/sig network /sig apimachinery
The label(s) cannot be applied, because the repository doesn't have them. <detailsIn response to : /sig network /sig apimachinery Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig api-machinery
Opened a fix here
/triage accepted
Change:
return fmt.Sprintf("%s%s%s", scaleSetName, vmssNameSeparator, instanceID) } <del> func (ss *scaleSet) extractVmssVMName(name string) (string, string, error) { </del> <ins> func extractVmssVMName(name string) (string, string, error) { </ins> ret := strings.Split(name, vmssNameSeparator) if len(ret) != 2 { glog.Errorf("Failed to extract vmssVMName %q", name)

Discussion:
<!-- This form is for bug reports and feature requests ONLY! If you're looking for help check and the . --Is this a BUG REPORT or FEATURE REQUEST?: What happened: When useInstanceMetadata is set to true for vmss nodes, their providerID is wrong. What you expected to happen: Their providerID should be in format azure:///subscriptions/&lt;subscription-id/resourceGroups/&lt;rg-name/providers/Microsoft.Compute/virtualMachineScaleSets/&lt;scaleset-name/virtualMachines/&lt;instance-id How to reproduce it (as minimally and precisely as possible): Anything else we need to know?: Environment: Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g. from /etc/os-release): Kernel (e.g. ): Install tools: Others:
/sig azure
adding priority important-soon so that this issue can stay in 1.10. Please update if incorrect. /priority important-soon
Change:
}, wantFinishTime: defaultTestTime, }, <ins> // In this case, init container is stopped after the regular containers. // This is because with the sidecar (restartable init) containers, // sidecar containers will always finish later than regular containers. "Pod with sidecar container and all containers terminated": { pod: v1.Pod{ Spec: v1.PodSpec{ InitContainers: []v1.Container{ { Name:          "sidecar", RestartPolicy: &containerRestartPolicyAlways, }, }, }, Status: v1.PodStatus{ ContainerStatuses: []v1.ContainerStatus{ { State: v1.ContainerState{ Terminated: &v1.ContainerStateTerminated{FinishedAt: metav1.NewTime(defaultTestTime.Add(-1 * time.Second))}, }, }, }, InitContainerStatuses: []v1.ContainerStatus{ { Name: "sidecar", State: v1.ContainerState{ Terminated: &v1.ContainerStateTerminated{FinishedAt: metav1.NewTime(defaultTestTime)}, }, }, }, }, }, wantFinishTime: defaultTestTime, }, </ins> } for name, tc := range testCases {

Discussion:
Today the function () only account for the regular containers finish time, presumably assuming that init containers have completed before before. However, with the sidecar (restartable init) containers, sidecar containers will always finish later than regular containers. And those needs to be accounted for the calculation. /kind bug The sidecar finish time will be accounted when calculating the job's finish time. Sidecar container with prolonged termination logic on a job will result in incorrect finish time reporting. /sig apps /priority backlog KEP:
/assign
/triage accepted