jiebi/CodeConvo huggingface dataset:
Change:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: If a node with a Azure Disk attached is deleted (before the volume is detached), subsequent attempts by the attach/detach controller to detach it continuously fail, and prevent the controller from attaching the volume to another node. What you expected to happen: How to reproduce it (as minimally and precisely as possible): Create a pod referencing a Azure Disk Wait for pod to get scheduled and running. Delete the node VM that the pod is scheduled to. Check if volume is detached by attach/detach controller: Expected: Volume detached. Actual: Volume continuously fails detach. Workaround: Restart the kube-controller-manager binary on the master. Error logs: Anything else we need to know?: Environment: Kubernetes version (use ): 1.16 Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others: /kind bug /assign /priority important-soon /sig cloud-provider /area provider/azure cc

Discussion:
// DetachDisk detaches a disk from host. The vhd can be identified by diskName or diskURI. func (c *controllerCommon) DetachDisk(diskName, diskURI string, nodeName types.NodeName) error { <del> vmset, err := c.getNodeVMSet(nodeName) if err != nil { return err } </del> instanceid, err := c.cloud.InstanceID(context.TODO(), nodeName) if err != nil { <ins> if err == cloudprovider.InstanceNotFound { // if host doesn't exist, no need to detach klog.Warningf("azureDisk - failed to get azure instance id(%q), DetachDisk(%s) will assume disk is already detached", nodeName, diskURI) return nil } </ins> klog.Warningf("failed to get azure instance id (%v)", err) return fmt.Errorf("failed to get azure instance id for node %q (%v)", nodeName, err) } <ins> vmset, err := c.getNodeVMSet(nodeName) if err != nil { return err } </ins> klog.V(2).Infof("detach %v from node %q", diskURI, nodeName) // make the lock here as small as possible

expectedErr bool }{ { <del> desc:        "an error shall be returned if there's no such instance corresponding to given nodeName", </del> <ins> desc:        "error should not be returned if there's no such instance corresponding to given nodeName", </ins> nodeName:    "vm1", <del> expectedErr: true, </del> <ins> expectedErr: false, </ins> }, { desc:        "no error shall be returned if there's no matching disk according to given diskName",
Change:
<!-- Please only use this template for submitting enhancement requests --What would you like to be : Apply security best practices for both kube-dns and core-dns. Low hanging fruit: [x] Run as non-root & disallow privilege escalation [x] Run with the default seccomp profile (i.e. ) [x] ReadOnlyRootFilesystem [x] Avoid unnecessary HostPath volumes [x] (n/a) More advanced: [ ] Reduce dependencies in the base image () [ ] Custom seccomp profile [ ] Custom AppArmor profile [x] Drop unneeded capabilities[x] Run as non-root & disallow privilege escalation [x] Run with the default seccomp profile (i.e. ) [x] ReadOnlyRootFilesystem [x] Avoid unnecessary HostPath volumes [x] (n/a) More advanced: [ ] Reduce dependencies in the base image () [ ] Custom seccomp profile [ ] Custom AppArmor profile [x] Drop unneeded capabilities This is based on the long term issue and implemented by PR . Why is this needed: Our system pods should run using security best practices, both to enhance cluster security and serve as examples of best practices to users.
/sig auth /area security

Discussion:
labels: k8s-app: kube-dns annotations: <del> seccomp.security.alpha.kubernetes.io/pod: 'docker/default' </del> <ins> seccomp.security.alpha.kubernetes.io/pod: 'runtime/default' </ins> spec: priorityClassName: system-cluster-critical serviceAccountName: coredns

labels: k8s-app: kube-dns annotations: <del> seccomp.security.alpha.kubernetes.io/pod: 'docker/default' </del> <ins> seccomp.security.alpha.kubernetes.io/pod: 'runtime/default' </ins> prometheus.io/port: "10054" prometheus.io/scrape: "true" spec:

volumeMounts: - name: kube-dns-config mountPath: /kube-dns-config <ins> securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true runAsUser: 1001 runAsGroup: 1001 </ins> - name: dnsmasq image: k8s.gcr.io/k8s-dns-dnsmasq-nanny:1.14.13 livenessProbe:

volumeMounts: - name: kube-dns-config mountPath: /etc/k8s/dns/dnsmasq-nanny <ins> securityContext: capabilities: drop: - all add: - NET_BIND_SERVICE - SETGID </ins> - name: sidecar image: k8s.gcr.io/k8s-dns-sidecar:1.14.13 livenessProbe:

requests: memory: 20Mi cpu: 10m <ins> securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true runAsUser: 1001 runAsGroup: 1001 </ins> dnsPolicy: Default  # Don't use cluster DNS. serviceAccountName: kube-dns
Change:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: The and urls do not provide as much information about the cluster as much as does. It's expected to see and (if kms is enabled) but does not. What you expected to happen: and url to include and How to reproduce it (as minimally and precisely as possible): any 1.16 pre-release cluster the server url for , and Anything else we need to know?: Environment: Kubernetes version (use ):Cloud provider or hardware configuration: IBM OS (e.g: ):Kernel (e.g. ):Install tools: Network plugin and version (if this is a network-related bug): Others: Logs: healthz readyz livez /sig api-machinery
/sig api-machinery
/assign

Discussion:
*completedConfig } <ins> // AddHealthChecks adds a health check to our config to be exposed by the health endpoints // of our configured apiserver. We should prefer this to adding healthChecks directly to // the config unless we explicitly want to add a healthcheck only to a specific health endpoint. func (c *Config) AddHealthChecks(healthChecks ...healthz.HealthChecker) { for _, check := range healthChecks { c.HealthzChecks = append(c.HealthzChecks, check) c.LivezChecks = append(c.LivezChecks, check) c.ReadyzChecks = append(c.ReadyzChecks, check) } } </ins> // Complete fills in any fields not set that are required to have valid data and can be derived // from other fields. If you're going to `ApplyOptions`, do that first. It's mutating the receiver. func (c *Config) Complete(informers informers.SharedInformerFactory) CompletedConfig {

if err != nil { return err } <del> c.HealthzChecks = append(c.HealthzChecks, healthz.NamedCheck("etcd", func(r *http.Request) error { </del> <ins> c.AddHealthChecks(healthz.NamedCheck("etcd", func(r *http.Request) error { </ins> return healthCheck() }))

if err != nil { return err } <del> c.HealthzChecks = append(c.HealthzChecks, kmsPluginHealthzChecks...) </del> <ins> c.AddHealthChecks(kmsPluginHealthzChecks...) </ins> } return nil
Change:
<!-- Please only use this template for submitting reports about failing tests in Kubernetes CI jobs --Which jobs are failing: ci-kubernetes-node-kubelet-serial Which test(s) are failing: StartupProbe [Serial] [Disruptive] [NodeFeature:StartupProbe] Since when has it been failing: Testgrid link: Reason for failure: Anything else we need to know:
Tests are no longer running in CI, but tests are still failing. One failure is related to and another one is related to /reopen
Reopened this issue. <detailsIn response to : Tests are no longer running in CI, but tests are still failing. Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Test failures can now be tracked in
/close It looks like this was solved around Nov 13-14, which is when merged
Closing this issue. <detailsIn response to : /close It looks like this was solved around Nov 13-14, which is when merged Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details

Discussion:
defaultObservationTimeout = time.Minute * 4 ) <del> var _ = framework.KubeDescribe("StartupProbe [Serial] [Disruptive] [NodeFeature:StartupProbe]", func() { f := framework.NewDefaultFramework("critical-pod-test") </del> <ins> var _ = framework.KubeDescribe("StartupProbe [Serial] [Disruptive] [NodeAlphaFeature:StartupProbe]", func() { f := framework.NewDefaultFramework("startup-probe-test") </ins> var podClient *framework.PodClient <ins> ginkgo.BeforeEach(func() { podClient = f.PodClient() }) </ins> /* These tests are located here as they require tempSetCurrentKubeletConfig to enable the feature gate for startupProbe.
Change:
<!-- Please only use this template for submitting reports about failing tests in Kubernetes CI jobs --Which jobs are failing: ci-kubernetes-node-kubelet-serial Which test(s) are failing: [] Container Manager Misc [Serial] Validate OOM score adjustments [NodeFeature:OOMScoreAdj] once the node is setup pod infra containers oom-score-adj should be -998 and best effort container's should be 1000 Since when has it been failing: Testgrid link: Reason for failure: Anything else we need to know:
/assign
Let's monitor this one and see if worked /reopen /milestone v1.17 /priority critical-urgent
Reopened this issue. <detailsIn response to : Let's monitor this one and see if worked /reopen /milestone v1.17 /priority critical-urgent </details
It seems work well.
These now have 8 successful runs without a single flake. Looks like worked! :smile: 's%20should%20be% cc
thanks /close
Closing this issue. <detailsIn response to : thanks Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details

Discussion:
}, }, }) var pausePids []int ginkgo.By("checking infra container's oom-score-adj") gomega.Eventually(func() error {

var shPids []int ginkgo.By("checking besteffort container's oom-score-adj") gomega.Eventually(func() error { <del> shPids, err = getPidsForProcess("serve_hostname", "") </del> <ins> shPids, err = getPidsForProcess("agnhost", "") </ins> if err != nil { return fmt.Errorf("failed to get list of serve hostname process pids: %v", err) } if len(shPids) != 1 { <del> return fmt.Errorf("expected only one serve_hostname process; found %d", len(shPids)) </del> <ins> return fmt.Errorf("expected only one agnhost process; found %d", len(shPids)) </ins> } return validateOOMScoreAdjSetting(shPids[0], 1000) }, 2*time.Minute, time.Second*4).Should(gomega.BeNil())
Change:
What would you like to be : Our tooling that makes the list of conformance tests needs to allow conformance tests to be marked as disruptive. Why is this needed: To test default, conformance behavior which may be disruptive (e.g. taint eviction) ref /sig testing /area conformance

Discussion:
totalConfTests, totalLegacyTests, missingComments int // If a test name contains any of these tags, it is ineligble for promotion to conformance <del> regexIneligibleTags = regexp.MustCompile(`[(Alpha|Disruptive|Feature:[^]]+|Flaky)]`) </del> <ins> regexIneligibleTags = regexp.MustCompile(`[(Alpha|Feature:[^]]+|Flaky)]`) </ins> ) const regexDescribe = "Describe|KubeDescribe|SIGDescribe"

"", }, { <del> "a test case with valid tags [LinuxOnly] [NodeConformance] [Serial]", </del> <ins> "a test case with valid tags [LinuxOnly] [NodeConformance] [Serial] [Disruptive]", </ins> "", }, {

"[Flaky]", }, { <del> "a disruptive test case that is invalid [Disruptive]", "[Disruptive]", }, { </del> "a feature test case that is invalid [Feature:Awesome]", "[Feature:Awesome]", },

"[Alpha]", }, { <del> "a test case with multiple invalid tags [Flaky][Disruptive] [Feature:Awesome] [Alpha]", "[Flaky],[Disruptive],[Feature:Awesome],[Alpha]", </del> <ins> "a test case with multiple invalid tags [Flaky] [Feature:Awesome] [Alpha]", "[Flaky],[Feature:Awesome],[Alpha]", </ins> }, { <del> "[sig-awesome] [Disruptive] a test case with valid and invalid tags [Alpha] [Serial] [Flaky]", "[Disruptive],[Alpha],[Flaky]", </del> <ins> "[sig-awesome] [Alpha] [Disruptive] a test case with valid and invalid tags [Serial] [Flaky]", "[Alpha],[Flaky]", </ins> }, } for i, tc := range testCases {

Description: The Pod with toleration timeout scheduled on a tainted Node MUST not be evicted if the taint is removed before toleration time ends. */ <del> framework.ConformanceIt("removing taint cancels eviction", func() { </del> <ins> framework.ConformanceIt("removing taint cancels eviction [Disruptive]", func() { </ins> podName := "taint-eviction-4" pod := createPodForTaintsTest(true, 2*additionalWaitPerDeleteSeconds, podName, podName, ns) observedDeletions := make(chan string, 100)

Description: In a multi-pods scenario with tolerationSeconds, the pods MUST be evicted as per the toleration time limit. */ <del> framework.ConformanceIt("evicts pods with minTolerationSeconds", func() { </del> <ins> framework.ConformanceIt("evicts pods with minTolerationSeconds [Disruptive]", func() { </ins> podGroup := "taint-eviction-b" observedDeletions := make(chan string, 100) stopCh := make(chan struct{})
Change:
<!-- Please only use this template for submitting reports about failing tests in Kubernetes CI jobs --Which jobs are failing: ci-kubernetes-node-kubelet-orphans Which test(s) are failing: [] Security Context should run with an image specified user ID [It] [] Security Context When creating a container with runAsNonRoot should not run with an explicit root user ID [LinuxOnly] [It] Since when has it been failing: Testgrid link: Reason for failure: "" is not in the white list Anything else we need to know:
/area test /sig node

Discussion:
imageutils.GetE2EImage(imageutils.TestWebserver), imageutils.GetE2EImage(imageutils.VolumeNFSServer), imageutils.GetE2EImage(imageutils.VolumeGlusterServer), <ins> imageutils.GetE2EImage(imageutils.NonRoot), </ins> ) type testImagesStruct struct {
Change:
I am running k8s 1.15 and I see kubectl top --help is returning the following info: ...This command requires Heapster to be correctly configured and working on the server. As far as I know Heaspter is deprecated since 1.11. 1) Should the command help be updated i.e. replace Heapster with Metrics Server? 2) Will the command work if Metrics Server is deployed in the cluster? 3) Is kubectl top utility the easiest way to display (actual) resource usage info for pods and nodes? Any suggestions?
/sig cli
submitted a pr for this yes yes, or kubernetes dashboard

Discussion:
The top command allows you to see the resource consumption for nodes or pods. <del> This command requires Heapster to be correctly configured and working on the server. `)) </del> <ins> This command requires Metrics Server to be correctly configured and working on the server. `)) </ins> ) func NewCmdTop(f cmdutil.Factory, streams genericclioptions.IOStreams) *cobra.Command {
Change:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: hack/local-up- -O doesn't work in the latest code of master branch It will output "Could not guess the correct output directory to use." What you expected to happen: hack/local-up- -O should be able to guess the output directory How to reproduce it (as minimally and precisely as possible): run "hack/local-up- -O" Anything else we need to know?: Environment: Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others:
There are no sig labels on this issue. Please add a sig label by either: a sig: e.g., to notify the contributor experience sig, OR the label manually: e.g., to apply the label Note: Method 1 will trigger an email to the group. See the . The in method 1 has to be replaced with one of these: bugs, feature-requests, pr-reviews, test-failures, proposals. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details

Discussion:
# This function guesses where the existing cached binary build is for the `-O` # flag function guess_built_binary_path { <del> local hyperkube_path hyperkube_path=$(kube::util::find-binary "hyperkube") if [[ -z "${hyperkube_path}" ]]; then </del> <ins> local apiserver_path apiserver_path=$(kube::util::find-binary "kube-apiserver") if [[ -z "${apiserver_path}" ]]; then </ins> return fi <del> echo -n "$(dirname "${hyperkube_path}")" </del> <ins> echo -n "$(dirname "${apiserver_path}")" </ins> } ### Allow user to supply the source directory.
Change:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: when I run , found bound variable err. What you expected to happen: Build success How to reproduce it (as minimally and precisely as possible): Anything else we need to know?: Environment: Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ):Linux paasn1 4.14.78-300.el7.Centos.x8664 SMP Sat Jan 5 15:49:43 CST 2019 x8664 x8664 x8664 GNU/Linux Install tools: Network plugin and version (if this is a network-related bug): Others: GNU bash version 4.2.46(2)-release (x8664-redhat-linux-gnu) Copyright (C) 2011 Free Software Foundation, Inc.
/sig release

Discussion:
return 1 fi <ins> # provide `--pull` argument to `docker build` if `KUBE_BUILD_PULL_LATEST_IMAGES` # is set to y or Y; otherwise try to build the image without forcefully # pulling the latest base image. local DOCKER_BUILD_OPTS=() if [[ "${KUBE_BUILD_PULL_LATEST_IMAGES}" =~ [yY] ]]; then DOCKER_BUILD_OPTS+=("--pull") fi local -r docker_build_opts="${DOCKER_BUILD_OPTS[@]}" </ins> for wrappable in "${binaries[@]}"; do local oldifs=$IFS

echo "COPY nsswitch.conf /etc/" >> "${docker_file_path}" fi <del> # provide `--pull` argument to `docker build` if `KUBE_BUILD_PULL_LATEST_IMAGES` # is set to y or Y; otherwise try to build the image without forcefully # pulling the latest base image. local -a docker_build_opts=() if [[ "${KUBE_BUILD_PULL_LATEST_IMAGES}" =~ [yY] ]]; then docker_build_opts+=("--pull") fi "${DOCKER[@]}" build "${docker_build_opts[@]}" -q -t "${docker_image_tag}" "${docker_build_path}" >/dev/null </del> <ins> "${DOCKER[@]}" build ${docker_build_opts} -q -t "${docker_image_tag}" "${docker_build_path}" >/dev/null </ins> # If we are building an official/alpha/beta release we want to keep # docker images and tag them appropriately. local -r release_docker_image_tag="${KUBE_DOCKER_REGISTRY-$docker_registry}/${binary_name}-${arch}:${KUBE_DOCKER_IMAGE_TAG-$docker_tag}"
Change:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: kubeadm init --feature-gates get panic ! What you expected to happen: no panic How to reproduce it (as minimally and precisely as possible): kubeadm init --feature-gates Anything else we need to know?: Environment: Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others:
what version of kubeadm are you using?
/area kubeadm /sig cluster-lifecycle
cc

Discussion:
// DefaultKubeProxyConfiguration assigns default values for the kube-proxy ComponentConfig func DefaultKubeProxyConfiguration(internalcfg *kubeadmapi.ClusterConfiguration) { <del> externalproxycfg := &kubeproxyconfigv1alpha1.KubeProxyConfiguration{} </del> <ins> externalproxycfg := &kubeproxyconfigv1alpha1.KubeProxyConfiguration{FeatureGates: make(map[string]bool)} </ins> kind := "KubeProxyConfiguration" // Do a roundtrip to the external version for defaulting
Change:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: This requires 1.16 alpha feature: Endpoint Slices being enabled. After deleting a , EndpointSliceController kept enqueuing the service after syncing it successfully, until its retry budget exceeded. And the logs are misleading by indicating something wrong happened while the cleanup has been executed successfully: What you expected to happen: The deletion should be triggered only once and there should be no warning and error logs if the cleanup is successfully. How to reproduce it (as minimally and precisely as possible): Endpoint Slices feature a then delete it. kube-controller-manager logs, there would be repeated logs. Anything else we need to know?: Environment: Kubernetes version (use ):Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others:
There are no sig labels on this issue. Please add a sig label by either: a sig: e.g., to notify the contributor experience sig, OR the label manually: e.g., to apply the label Note: Method 1 will trigger an email to the group. See the . The in method 1 has to be replaced with one of these: bugs, feature-requests, pr-reviews, test-failures, proposals. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign
/assign

Discussion:
if err != nil { if apierrors.IsNotFound(err) { c.triggerTimeTracker.DeleteService(namespace, name) <ins> // The service has been deleted, return nil so that it won't be retried. return nil </ins> } return err }

err := esController.syncService(fmt.Sprintf("%s/%s", namespace, missingServiceName)) <del> // Since the service doesn't exist, we should get a not found error assert.NotNil(t, err, "Expected no error syncing service") assert.Equal(t, err.Error(), "service "notthere" not found") </del> <ins> // nil should be returned when the service doesn't exist assert.Nil(t, err, "Expected no error syncing service") </ins> // That should mean no client actions were performed assert.Len(t, client.Actions(), 0)
Change:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: the default DaemonSetUpdateStrategyType was changed to Ondelete by default, but the document still say that the default value was refer doc What you expected to happen: How to reproduce it (as minimally and precisely as possible): Anything else we need to know?: Environment: Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others:
refer the code for the default value of daemonset updateStrategytype
/sig docs
The default update strategy for Daemonset should be see here , I believe that code comment that you linked to is mistaken.
yep, I think the code comment is outofdate, I will fix it. /assign
/remove-kind bug /kind documentation

Discussion:
// DaemonSetUpdateStrategy defines a strategy to update a daemon set. type DaemonSetUpdateStrategy struct { // Type of daemon set update. Can be "RollingUpdate" or "OnDelete". <del> // Default is OnDelete. </del> // +optional Type DaemonSetUpdateStrategyType