jiebi/CodeConvo huggingface dataset:
Change:
A node with: fails a pod that uses device plugin resources (empty but non-nil ) : Our device plugin sends the following registration: So we send an empty which is interpreted as "no possible NUMA affinities": How is this different from value? I can workaround the problem by sending but it's not how this is supposed to work. Can the two if's combined or should we updated the documentation? My environment: a single-node k8s cluster w/ device plugin that does The node needs to run two kinds of pods: those that need/use topology single-numa-node and pods that just use a device plugin resources that does not provide topologyhints. <details</details<detailsN/A (kubeadm single node cluster) </details<details</details<detailskubeadm </details<detailscontainerd </details<detailsintel SGX device plugin v0.24 </details
/cc
It's possible that better documentation is needed, but we could also probably do more to handle this better in the device plugin. The implementation you pointed out above relies on depicting "don't care" and depicting "I tried but couldn't generate any hints that provide alignment". One could argue though that should have generated a set of hints and not a . I would need to look at the code again to know for sure if this makes sense or not though.
This interpretation makes sense but Right, if the hint provider fails to provide hints, I guess the pod should not be blamed (by not making it to run) for that. /sig node
/triage accepted /priority backlog
/cc
I can at least help with the documentation part if we decide that it alone needs changing.
I'm reviewing this area for other reasons, we should indeed calrify the hint API expectations. Up until now my rule of thumb was pretty much "what cpumanager does" which has room for improvement.
This could be isolated to only by returning when : when running is pointless, IMO
Submitted a
The corresponding documentation update:

Discussion:
} func (m *ManagerImpl) deviceHasTopologyAlignment(resource string) bool { <del> // If any device has Topology set, we assume they care about alignment. for device := range m.allDevices[resource] { if m.allDevices[resource][device].Topology != nil { </del> <ins> // If any device has Topology NUMANodes available, we assume they care about alignment. for _, device := range m.allDevices[resource] { if device.Topology != nil && len(device.Topology.Nodes) > 0 { </ins> return true } }

return tc.expectedHints[r][i].LessThan(tc.expectedHints[r][j]) }) if !reflect.DeepEqual(hints[r], tc.expectedHints[r]) { <del> t.Errorf("%v: Expected result to be %v, got %v", tc.description, tc.expectedHints[r], hints[r]) </del> <ins> t.Errorf("%v: Expected result to be %#v, got %#v", tc.description, tc.expectedHints[r], hints[r]) </ins> } } }

"testdevice": { {ID: "Dev1"}, {ID: "Dev2"}, <ins> {ID: "Dev3", Topology: &pluginapi.TopologyInfo{Nodes: []*pluginapi.NUMANode{}}}, {ID: "Dev4", Topology: &pluginapi.TopologyInfo{Nodes: nil}}, </ins> }, }, expectedHints: map[string][]topologymanager.TopologyHint{
Change:
When there are more than one controller set to true within ownerRef, the validation would return err msg like this: It is confusing to see two same 'foo' controller name. To make the err msg more accurately, like this: Set an object with two , and both of the Controller set true, then apply to the apiserver will got this error.
/sig api-machinery
/triage accepted

Discussion:
// ValidateOwnerReferences validates that a set of owner references are correctly defined. func ValidateOwnerReferences(ownerReferences []metav1.OwnerReference, fldPath *field.Path) field.ErrorList { allErrs := field.ErrorList{} <del> controllerName := "" </del> <ins> firstControllerName := "" </ins> for _, ref := range ownerReferences { allErrs = append(allErrs, validateOwnerReference(ref, fldPath)...) if ref.Controller != nil && *ref.Controller { <del> if controllerName != "" { </del> <ins> curControllerName := ref.Kind + "/" + ref.Name if firstControllerName != "" { </ins> allErrs = append(allErrs, field.Invalid(fldPath, ownerReferences, <del> fmt.Sprintf("Only one reference can have Controller set to true. Found "true" in references for %v and %v", controllerName, ref.Name))) </del> <ins> fmt.Sprintf("Only one reference can have Controller set to true. Found "true" in references for %v and %v", firstControllerName, curControllerName))) </ins> } else { <del> controllerName = ref.Name </del> <ins> firstControllerName = curControllerName </ins> } } }

ownerReferences: []metav1.OwnerReference{ { APIVersion: "customresourceVersion", <del> Kind:       "customresourceKind", </del> <ins> Kind:       "customresourceKind1", </ins> Name:       "name", UID:        "1", Controller: &falseVar, }, { APIVersion: "customresourceVersion", <del> Kind:       "customresourceKind", </del> <ins> Kind:       "customresourceKind2", </ins> Name:       "name", UID:        "2", Controller: &trueVar, }, { APIVersion: "customresourceVersion", <del> Kind:       "customresourceKind", </del> <ins> Kind:       "customresourceKind3", </ins> Name:       "name", UID:        "3", Controller: &trueVar, }, { APIVersion: "customresourceVersion", <del> Kind:       "customresourceKind", </del> <ins> Kind:       "customresourceKind4", </ins> Name:       "name", UID:        "4", }, }, expectError:          true, <del> expectedErrorMessage: "Only one reference can have Controller set to true", </del> <ins> expectedErrorMessage: "Only one reference can have Controller set to true. Found "true" in references for customresourceKind2/name and customresourceKind3/name", </ins> }, }
Change:
pull-kubernetes-unit: TestRoundTripTypes Unknown No response No response /sig api-machinery
/kind bug /triage accepted
cc
cc I think fuzzing is missing a default for the newly type, so when fuzzing adds an entry, the original doesn't match the round-tripped data (which applies the API default)
/priority important-soon /remove-sig api-machinery /sig scheduling /assign
this will also need picking to release-1.25
/remove-sig scheduling /sig apps
/assign
/unassign

Discussion:
fuzz "github.com/google/gofuzz" runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer" "k8s.io/kubernetes/pkg/apis/batch" <ins> api "k8s.io/kubernetes/pkg/apis/core" </ins> "k8s.io/utils/pointer" )

policies := []batch.ConcurrencyPolicy{batch.AllowConcurrent, batch.ForbidConcurrent, batch.ReplaceConcurrent} *cp = policies[c.Rand.Intn(len(policies))] }, <ins> func(p *batch.PodFailurePolicyOnPodConditionsPattern, c fuzz.Continue) { c.FuzzNoCustom(p) if p.Status == "" { p.Status = api.ConditionTrue } }, </ins> } }
Change:
For raw block CSI volumes on Kubernetes, kubelet ends up calling CSI for every single "map" (i.e. raw block "mount") operation for a volume already attached to the node. , should be called once per volume per node: More specifically, . Create a raw block PVC for a CSI driver Create a pod using that PVC Create another pod using the same PVC and schedule to the same node Kubelet logs will show multiple for the same PVC. Example log: Problem appears to be here: This should first check if "volume is globally mounted" before executing . Does anyone know why we don't? For example, if you look a the equivalent code for file-on-block, it does the check: CC Repro'd on Kubernetes v1.23.5 N/A N/A N/A N/A CSI general (not specific to any driver)
/sig storage
CC -- thanks for your help
I think the reasoning above from is right. I traced the origin code is from here At that time both file and block will call MountDevice repeatedly without checking GetDeviceMountState from actual state. Later there is a fix to check the state, but it only put for file volume, not the block. So I think we should do the same for block here. WDYT?
Yes, NodeStage should be ideally called only once.
Hey Can I work on it? I think this is a cc
Yes please go ahead. We can help review.
/assign
/triage accepted
Thanks

Discussion:
} // Call SetUpDevice if blockVolumeMapper implements CustomBlockVolumeMapper <del> if customBlockVolumeMapper, ok := blockVolumeMapper.(volume.CustomBlockVolumeMapper); ok { </del> <ins> if customBlockVolumeMapper, ok := blockVolumeMapper.(volume.CustomBlockVolumeMapper); ok && actualStateOfWorld.GetDeviceMountState(volumeToMount.VolumeName) != DeviceGloballyMounted { </ins> var mapErr error stagingPath, mapErr = customBlockVolumeMapper.SetUpDevice() if mapErr != nil {
Change:
pull-kubernetes-unit Probably since it was merged in The test checks output from the E2E framework and sometimes some extra log output shows up that isn't expected: No response /sig testing
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign

Discussion:
"github.com/onsi/ginkgo/v2" <ins> "k8s.io/klog/v2" "k8s.io/klog/v2/ktesting" </ins> "k8s.io/kubernetes/test/e2e/framework" "k8s.io/kubernetes/test/e2e/framework/internal/output" testapiserver "k8s.io/kubernetes/test/utils/apiserver"

// // // <del> // // </del> // This must be line #50. var _ = ginkgo.Describe("framework", func() {

) func TestCleanup(t *testing.T) { <ins> // The control plane is noisy and randomly logs through klog, for example: // E0912 07:08:46.100164   75466 controller.go:254] unable to sync kubernetes service: Endpoints "kubernetes" is invalid: subsets[0].addresses[0].ip: Invalid value: "127.0.0.1": may not be in the loopback range (127.0.0.0/8, ::1/128) // // By creating a ktesting logger and registering that as global // default logger we get the control plane output into the // "go test" output in case of a failure (useful for debugging!) // while keeping it out of the captured Ginkgo output that // the test is comparing below. // // There are some small drawbacks: // - The source code location for control plane log messages //   is shown as klog.go because klog does not properly //   skip its own helper functions. That's okay, normally //   ktesting should not be installed as logging backend like this. // - klog.Infof messages are printed with an extra newline. logger, _ := ktesting.NewTestContext(t) klog.SetLogger(logger) </ins> apiServer := testapiserver.StartAPITestServer(t) // This simulates how test/e2e uses the framework and how users
Change:
periodic-kubernetes-unit-test-ppc64le TestCleanup Probably since it was merged in https://k8s- No response The error from build log trace is: Please go through the above job for complete build log. /sig testing
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
This test has been constantly failing in our environment and not just flaking. Also, We see it still failing even after your fix for is the job that ran after merge of
^^
cc
This is a data race in the control plane setup. cc
So yes, this is different from the failure that I ran into. It's still a flake (races don''t always go wrong), but apparently the conditions in your jobs are so that it always triggers.
I'll take care of this /assign
At first glance it looks like access to in lacks protection by a mutex. But why are and racing with each other in different goroutines, and why is called first?
in some executions it seems that it just timeouts, no races I think that the problem is that this environment is under resourced and this test is not able to boot the apsierver , that may explain the race and why Stop is racing with Start
Should we perhaps make this unit test run only on amd64 architectures, with the rationale a) that it isn't architecture-dependent and thus testing it in one unit test job is sufficient and b) that it is an expensive test that stresses slower architectures too much?
the apiserver times out starting up, I think we can make it lighter with it sound fair to me, since we use etcd and it is only guaranteed to build do you want to make the honors? or should I?
Can you do it because we probably want both and you know best how to explain the patch above in the commit message?
I thought about this twice, and I don't think we should tune the tests for running on constrained environments, this is a slippery slope, this environment is clearly constrained , there are also other issues reporting timeouts in this environment ... we should not tune test just to pass The skip based on etcd not supported may be reasonable though
Met this again when running , see
this is for the ppc64le specific problem, we should open a new one for this test it seems there were 2 occurrences more
For tracking, opened a new issue here

Discussion:
<ins> //go:build linux && amd64 </ins> /* Copyright 2022 The Kubernetes Authors.

limitations under the License. */ <ins> // This test uses etcd that is only fully supported for AMD64 and Linux // https://etcd.io/docs/v3.5/op-guide/supported-platform/#support-tiers </ins> package cleanup import (

// // // <del> // // // // // </del> // This must be line #50. var _ = ginkgo.Describe("e2e", func() {
Change:
In it has multiple loops that look similar to this: where is of type . By using this range format, it creates a shallow copy of each element in the slice. We can eliminate this allocation by changing to this format: If there is agreement, I'd be happy to open a PR to fix these. Additionally, there are lots of allocations coming from e.g. , . If we are able to change the map type to contain a instead, we could eliminate allocations when ranging through these as well. /kind cleanup /sig api-machinery
/cc
Seems reasonable, jordan and I attacked a number of these a while back on different critical paths, and there was substantial low hanging fruit elsewhere that just wasn’t top of priority. Will be happy to review.
/triage accepted

Discussion:
if s.Items != nil && SchemaHas(s.Items.Schema, pred) { return true } <del> for _, s := range s.Items.JSONSchemas { if SchemaHas(&s, pred) { </del> <ins> for i := range s.Items.JSONSchemas { if SchemaHas(&s.Items.JSONSchemas[i], pred) { </ins> return true } } } <del> for _, s := range s.AllOf { if SchemaHas(&s, pred) { </del> <ins> for i := range s.AllOf { if SchemaHas(&s.AllOf[i], pred) { </ins> return true } } <del> for _, s := range s.AnyOf { if SchemaHas(&s, pred) { </del> <ins> for i := range s.AnyOf { if SchemaHas(&s.AnyOf[i], pred) { </ins> return true } } <del> for _, s := range s.OneOf { if SchemaHas(&s, pred) { </del> <ins> for i := range s.OneOf { if SchemaHas(&s.OneOf[i], pred) { </ins> return true } }
Change:
Kubernetes e2e suite.[It] [sig-network] LoadBalancers should only allow access from service loadbalancer source ranges [Slow] Sept 1st This PR merged around that time ! /sig network /area ipvs
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
I agree that is a prime suspect. I can't run "ESIPP" (is there a way?) tests locally, but I will try to run the second test and test manually.
Reproduced and found. The was ; The "ACCEPT" should be replaced with "RETURN".

Discussion:
// https://github.com/kubernetes/kubernetes/issues/72236 proxier.filterRules.Write( "-A", string(kubeIPVSFilterChain), <del> "-m", "set", "--match-set", proxier.ipsetList[kubeLoadBalancerSet].Name, "dst,dst", "-j", "ACCEPT") </del> <ins> "-m", "set", "--match-set", proxier.ipsetList[kubeLoadBalancerSet].Name, "dst,dst", "-j", "RETURN") </ins> proxier.filterRules.Write( "-A", string(kubeIPVSFilterChain), <del> "-m", "set", "--match-set", proxier.ipsetList[kubeClusterIPSet].Name, "dst,dst", "-j", "ACCEPT") </del> <ins> "-m", "set", "--match-set", proxier.ipsetList[kubeClusterIPSet].Name, "dst,dst", "-j", "RETURN") </ins> proxier.filterRules.Write( "-A", string(kubeIPVSFilterChain), <del> "-m", "set", "--match-set", proxier.ipsetList[kubeExternalIPSet].Name, "dst,dst", "-j", "ACCEPT") </del> <ins> "-m", "set", "--match-set", proxier.ipsetList[kubeExternalIPSet].Name, "dst,dst", "-j", "RETURN") </ins> proxier.filterRules.Write( "-A", string(kubeIPVSFilterChain), "-m", "conntrack", "--ctstate", "NEW",
Change:
Unit tests failed with , see TestWhoAmIRun/successtest None No response No response_ /sig cli
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig cli
I think it was caused by
When we loop the golang Map, it's unordered.
I can work on this one.
Thanks.
/priority critical-urgent this is impacting CI,

Discussion:
"context" "fmt" "io" <ins> "sort" </ins> "github.com/spf13/cobra" authenticationv1alpha1 "k8s.io/api/authentication/v1alpha1"

} if len(ui.Extra) > 0 { <del> for k, v := range ui.Extra { </del> <ins> sortedKeys := make([]string, 0, len(ui.Extra)) for k := range ui.Extra { sortedKeys = append(sortedKeys, k) } sort.Strings(sortedKeys) for _, k := range sortedKeys { v := ui.Extra[k] </ins> _, err := fmt.Fprintf(w, "Extra: %st%vn", k, v) if err != nil { return fmt.Errorf("cannot write an extra: %w", err)

`Username          jane.doe`, `UID               uniq-id`, `Groups            [students teachers]`, <del> `Extra: subjects   [math sports]`, </del> `Extra: skills     [reading learning]`, <ins> `Extra: subjects   [math sports]`, </ins> ``, }, },
Change:
For 1.25 clusters with PodDIsruptionConditions enabled pods continue to run if the node is tainted with untolerated NoExecute taint. Also, the error is not logged. The pod running on the tainted node should be terminated (prep) Create a 1.25 cluster with the enabled (tested on kind) a job with a single Pod running long enough for the test (say 3min), the node with a custom taint (so that it is not tolerated by the Pod) with the NoExecute effect (nodeName No response <details</details<detailsreproducible on kind </details<details</details<details</details<details</details<details</details
/sig apps /triage accepted /priority important-soon
/assign

Discussion:
// createWorker creates a TimedWorker that will execute `f` not earlier than `fireAt`. func createWorker(ctx context.Context, args *WorkArgs, createdAt time.Time, fireAt time.Time, f func(ctx context.Context, args *WorkArgs) error, clock clock.WithDelayedExecution) *TimedWorker { delay := fireAt.Sub(createdAt) <ins> fWithErrorLogging := func() { err := f(ctx, args) if err != nil { klog.Errorf("NodeLifecycle: timed worker failed with error: %q", err) } } </ins> if delay <= 0 { <del> go f(ctx, args) </del> <ins> go fWithErrorLogging() </ins> return nil } <del> timer := clock.AfterFunc(delay, func() { f(ctx, args) }) </del> <ins> timer := clock.AfterFunc(delay, fWithErrorLogging) </ins> return &TimedWorker{ WorkItem:  args, CreatedAt: createdAt,

}, } if utilfeature.DefaultFeatureGate.Enabled(features.PodDisruptionConditions) { <ins> role.Rules = append(role.Rules, rbacv1helpers.NewRule("get").Groups(legacyGroup).Resources("pods").RuleOrDie()) </ins> role.Rules = append(role.Rules, rbacv1helpers.NewRule("patch").Groups(legacyGroup).Resources("pods/status").RuleOrDie()) } return role
Change:
Recent failed job : https://prow.ppc64le- Expected tests to be run fine without any issues Run following command on any non-amd64/linux platform Could be the side effect of PR <details</details<details</details<details</details<details</details<details</details<details</details
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig testing

Discussion:
<ins> /* Copyright 2022 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ // This is an empty file to avoid "build constraints exclude all Go files" error while running unit tests on non-amd64 && non-linux platforms. package cleanup </ins>
Change:
to have all the mount points sorted and grouped. For example, the following strings are sorted in this exact order: With the current implementation, test, we would get: This is worse on Windows, where paths usually have backslashes instead (with no test changes): [1] ` should group mount points correctly. /kind bug /sig windows Kubernetes master, Kubernetes v1.25 and older. N/A N/A <details</details<details</details<details</details
/triage accepted /milestone v1.26

Discussion:
return fmt.Errorf("invalid container mount point %v", myMountPoint) } myMPSlash := myMountPoint + string(os.PathSeparator) <del> // The previously found nested mountpoint (or "" if none found yet) prevNestedMP := "" </del> <ins> // The previously found nested mountpoints. // NOTE: We can't simply rely on sort.Strings to have all the mountpoints sorted and // grouped. For example, the following strings are sorted in this exact order: // /dir/nested, /dir/nested-vol, /dir/nested.vol, /dir/nested/double, /dir/nested2 // The issue is a bit worse for Windows paths, since the 's value is higher than /'s: // dirnested, dirnested-vol, dirnested.vol, dirnested2, dirnesteddouble // Because of this, we should use a list of previously mounted mountpoints, rather than only one. prevNestedMPs := []string{} </ins> // examine each mount point to see if it's nested beneath this volume // (but skip any that are double-nested beneath this volume) // For example, if this volume is mounted as /dir and other volumes are mounted

if !strings.HasPrefix(mp, myMPSlash) { continue // skip -- not nested beneath myMountPoint } <del> if prevNestedMP != "" && strings.HasPrefix(mp, prevNestedMP) { </del> <ins> isNested := false for _, prevNestedMP := range prevNestedMPs { if strings.HasPrefix(mp, prevNestedMP) { isNested = true break } } if isNested { </ins> continue // skip -- double nested beneath myMountPoint } // since this mount point is nested, remember it so that we can check that following ones aren't nested beneath this one <del> prevNestedMP = mp + string(os.PathSeparator) </del> <ins> prevNestedMPs = append(prevNestedMPs, mp+string(os.PathSeparator)) </ins> retval = append(retval, mp[len(myMPSlash):]) } }

{ name:     "Unsorted Nested Pod", err:      false, <del> expected: sets.NewString("nested", "nested2"), </del> <ins> expected: sets.NewString("nested", "nested2", "nested-vol", "nested.vol"), </ins> volname:  "vol1", pod: v1.Pod{ ObjectMeta: metav1.ObjectMeta{

{MountPath: "/dir/nested", Name: "vol2"}, {MountPath: "/ignore2", Name: "vol5"}, {MountPath: "/dir", Name: "vol1"}, <ins> {MountPath: "/dir/nested-vol", Name: "vol6"}, {MountPath: "/dir/nested.vol", Name: "vol7"}, {MountPath: "/dir/nested2/double", Name: "vol8"}, </ins> {MountPath: "/dir/nested2", Name: "vol3"}, }, },