jiebi/CodeConvo huggingface dataset:
Change:
Kubernetes e2e suite: [It] [sig-api-machinery] Garbage collector should support orphan deletion of custom resources [sig-api-machinery] As stated in When I replace PollWithContext with PollUntilContextTimeout in the test directory, the CI always returns the following error: The testcase can pass consistently. In the code where the error occurs, replace PollWithContext with PollUntilContextTimeout No response <details</details<details</details<details</details<details</details<details</details<details</details
/sig api-machinery testing
/triage accepted

Discussion:
framework.Failf("timeout in waiting for the owner to be deleted: %v", err) } <del> // Wait 30s and ensure the dependent is not deleted. ginkgo.By("wait for 30 seconds to see if the garbage collector mistakenly deletes the dependent crd") if err := wait.PollWithContext(ctx, 5*time.Second, 30*time.Second+gcInformerResyncRetryTimeout, func(ctx context.Context) (bool, error) { _, err := resourceClient.Get(ctx, dependentName, metav1.GetOptions{}) return false, err }); err != nil && !wait.Interrupted(err) { framework.Failf("failed to ensure the dependent is not deleted: %v", err) } </del> <ins> timeout := 30*time.Second + gcInformerResyncRetryTimeout ginkgo.By(fmt.Sprintf("wait for %s to see if the garbage collector mistakenly deletes the dependent crdn", timeout)) gomega.Consistently(ctx, framework.HandleRetry(func(ctx context.Context) (*unstructured.Unstructured, error) { return resourceClient.Get(ctx, dependentName, metav1.GetOptions{}) })).WithTimeout(timeout).WithPolling(5 * time.Second).ShouldNot(gomega.BeNil()) </ins> }) ginkgo.It("should delete jobs and pods created by cronjob", func(ctx context.Context) {
Change:
In We should be using ConteaxtEval for evaluation. Use ContextEval for cel evaluation n/a No response <details</details<details</details<details</details<details</details<details</details<details</details
/assign /triage accepted /sig api-machinery

Discussion:
return types.NewErr("composited variable %q fails to compile: %v", a.name, a.result.Error) } <del> v, details, err := a.result.Program.Eval(a.activation) </del> <ins> v, details, err := a.result.Program.ContextEval(a.context, a.activation) </ins> if details == nil { return types.NewErr("unable to get evaluation details of variable %q", a.name) }
Change:
various Oct 30 2023 6pm pst No response Looks like different test are failing with connection timeout errors: One of the tests triggered a core dump: No response /sig
are both suffers from pkg/registry and is from compoent-base, which likely same reason from `
/retitle failing-test: pkg/kubelet/eviction TestManagerWithLocalStorageCapacityIsolationOpen
/sig node
TestManagerWithLocalStorageCapacityIsolationOpen only failed in one of the PRs, so I don't think that specific test is the problem.
ok, rename as see fit. just put owning sigs please for triage.
TestStoreDeleteCollectionWithContextCancellation is the one that seems to be failing across all the failing PRs, so let's start there first. /retitle failing-test: TestStoreDeleteCollectionWithContextCancellation /sig api-machinery
triage link at shows this just starting (happening in CI jobs as well)
image used in the unit test job didn't change around the timeframe this was seen ()
looking for jumps in package unit test runtimes when this failure started happening to see if something is taking longer or stressing the system: ! - cc ! - cc ! - cc Could any of those have introduced changes that could be stressing or exhausting listener connections in unit tests?
the PR in question introduced a poll function around an API call that is unit tested with a fake client i.e. the poll is unit tested, but the fake client has reactors that return error or success right away, so in theory the poll should not be stretched to 1 retries with 1 connection attempts per fake client. while testing locally i did not notice any significant time difference after or the prior i can do some more checks to see what's going on.
merged right at the time the flakes were seen DeleteCollection invokes List, which was modified in that PR to cancel more aggressively cc
I can reproduce about a 10-20% flake rate at HEAD with: failures look like: or while testing that package with , I see ~1300-1500 open connections with this:
Let's revert it then. I looked into it and I don't know from a quick glance why it's failing and I don't have time to debug it now. I opened
Okay, it looks like we need more debugging to open this PR
one optimization to strip some ~40 fake client connections and 2 seconds from a test:
sounds good, pointed at that commit as well
/triage accepted

Discussion:
// and reduce the default page size to 2. storeWithCounter := &storageWithCounter{Interface: registry.Storage.Storage} registry.Storage.Storage = storeWithCounter <ins> originalDeleteCollectionPageSize := deleteCollectionPageSize </ins> deleteCollectionPageSize = 2 <ins> defer func() { deleteCollectionPageSize = originalDeleteCollectionPageSize }() </ins> numPods := 10 for i := 0; i < numPods; i++ {
Change:
When initializing kube-scheduler, We provided a custom config file for KubeSchedulerConfiguration and disabled the score plugin. This resulted in a panic in kube-scheduler at kube-scheduler up and running Using the below KubeSchedulerConfiguration file to enable kube-scheduler. apiVersion: kind: KubeSchedulerConfiguration clientConnection: kubeconfig: profiles: plugins: score: disabled: name: '*' extenders: urlPrefix: https://127.0.0.1:/scheduler filterVerb: "predicates" weight: 1 httpTimeout: 60s enableHTTPS: true nodeCacheCapable: false ignorable: false While trying to debug the issue, I found a change done recently for preScore calculation which might be causing the issue When we disable only the Score plugin then scheduler configuration will result in default preScorePlugins with 3 enabled [NodeResourcesFit, InterPodAffinity, TaintToleration] And due to this change, the preScore for InterPodAffinity results in skip status for some case (still not able to figured out what exactly it is), and this might result in a panic for kube-scheduler. The numplugin variable turns out to be negative. 28.3 N/A No response kubeadm No response No response
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig scheduling
Let me take a look.
/assign
maybe related to
Past me argued this in the PR
scheduler-plugins' integration test also hits this: To end-users: if the fix () or its cherrypicks are not around in your k8s cluster. The workaround is that when disabling Score plugins, ensure to disable their PreScore counterparts as well.

Discussion:
metrics.FrameworkExtensionPointDuration.WithLabelValues(metrics.Score, status.Code().String(), f.profileName).Observe(metrics.SinceInSeconds(startTime)) }() allNodePluginScores := make([]framework.NodePluginScores, len(nodes)) <del> numPlugins := len(f.scorePlugins) - state.SkipScorePlugins.Len() </del> <ins> numPlugins := len(f.scorePlugins) </ins> plugins := make([]framework.ScorePlugin, 0, numPlugins) pluginToNodeScores := make(map[string]framework.NodeScoreList, numPlugins) for _, pl := range f.scorePlugins {

}, }, }, <ins> { name:           "skipped prescore plugin number greater than the number of score plugins", plugins:        buildScoreConfigDefaultWeights(scorePlugin1), pluginConfigs:  nil, skippedPlugins: sets.New(scorePlugin1, "score-plugin-unknown"), want: []framework.NodePluginScores{ { Name:   "node1", Scores: []framework.PluginScore{}, }, { Name:   "node2", Scores: []framework.PluginScore{}, }, }, }, </ins> } for _, tt := range tests {
Change:
Priority and Fairness is going GA in 1.29, the feature has been marked stable and the feature gate has been locked to default. See In 1.31, we need to remove the feature gate.
/kind bug /sig api-machinery /cc
/assign
/triage accepted

Discussion:
genericfeatures.APIListChunking: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, // remove in 1.32 <del> genericfeatures.APIPriorityAndFairness: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, // remove in 1.31 </del> genericfeatures.APIResponseCompression: {Default: true, PreRelease: featuregate.Beta}, genericfeatures.APIServerIdentity: {Default: true, PreRelease: featuregate.Beta},

// all at once. APIListChunking featuregate.Feature = "APIListChunking" <del> // owner: @MikeSpreitzer @yue9944882 // alpha: v1.18 // beta: v1.20 // stable: 1.29 // // Enables managing request concurrency with prioritization and fairness at each server. // The FeatureGate was introduced in release 1.15 but the feature // was not really implemented before 1.18. APIPriorityAndFairness featuregate.Feature = "APIPriorityAndFairness" </del> // owner: @ilackams // alpha: v1.7 // beta: v1.16

APIListChunking: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, // remove in 1.32 <del> APIPriorityAndFairness: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, // remove in 1.31 </del> APIResponseCompression: {Default: true, PreRelease: featuregate.Beta}, APIServerIdentity: {Default: true, PreRelease: featuregate.Beta},
Change:
A data race manifested in job link: NA NA No response No response No response /sig api-machinery
/cc
/assign
ack, fixing ...
/triage accepted

Discussion:
wm[number] = w } <del> func (wm watchersMap) deleteWatcher(number int) { delete(wm, number) </del> <ins> func (wm watchersMap) deleteWatcher(number int, done func(*cacheWatcher)) { if watcher, ok := wm[number]; ok { delete(wm, number) done(watcher) } </ins> } func (wm watchersMap) terminateAll(done func(*cacheWatcher)) {

} } <del> func (i *indexedWatchers) deleteWatcher(number int, scope namespacedName, value string, supported bool) { </del> <ins> func (i *indexedWatchers) deleteWatcher(number int, scope namespacedName, value string, supported bool, done func(*cacheWatcher)) { </ins> if supported { <del> i.valueWatchers[value].deleteWatcher(number) </del> <ins> i.valueWatchers[value].deleteWatcher(number, done) </ins> if len(i.valueWatchers[value]) == 0 { delete(i.valueWatchers, value) } } else { <del> i.allWatchers[scope].deleteWatcher(number) </del> <ins> i.allWatchers[scope].deleteWatcher(number, done) </ins> if len(i.allWatchers[scope]) == 0 { delete(i.allWatchers, scope) }

// It's possible that the watcher is already not in the structure (e.g. in case of // simultaneous Stop() and terminateAllWatchers(), but it is safe to call stopLocked() // on a watcher multiple times. <del> c.watchers.deleteWatcher(index, scope, triggerValue, triggerSupported) c.stopWatcherLocked(w) </del> <ins> c.watchers.deleteWatcher(index, scope, triggerValue, triggerSupported, c.stopWatcherLocked) </ins> } }

utilfeature "k8s.io/apiserver/pkg/util/feature" featuregatetesting "k8s.io/component-base/featuregate/testing" "k8s.io/utils/clock" <del> testingclock "k8s.io/utils/clock/testing" </del> "k8s.io/utils/pointer" )

}}, }, true) } <del> func TestForgetWatcher(t *testing.T) { backingStorage := &dummyStorage{} cacher, _, err := newTestCacher(backingStorage) require.NoError(t, err) defer cacher.Stop() require.Equal(t, 0, len(cacher.watchers.allWatchers)) require.Equal(t, 0, len(cacher.watchers.valueWatchers)) var forgetWatcherFn func(bool) var forgetCounter int forgetWatcherWrapped := func(drainWatcher bool) { forgetCounter++ forgetWatcherFn(drainWatcher) } w := newCacheWatcher( 0, func(_ string, _ labels.Set, _ fields.Set) bool { return true }, nil, storage.APIObjectVersioner{}, testingclock.NewFakeClock(time.Now()).Now().Add(2*time.Minute), true, schema.GroupResource{Resource: "pods"}, "1", ) forgetWatcherFn = forgetWatcher(cacher, w, 0, namespacedName{}, "", false) cacher.watchers.addWatcher(w, 0, namespacedName{}, "", false) require.Equal(t, 0, len(cacher.watchers.valueWatchers)) require.Equal(t, 1, len(cacher.watchers.allWatchers)) forgetWatcherWrapped(false) require.Equal(t, 0, len(cacher.watchers.allWatchers)) require.Equal(t, 0, len(cacher.watchers.valueWatchers)) require.Equal(t, 1, forgetCounter) forgetWatcherWrapped(false) require.Equal(t, 0, len(cacher.watchers.allWatchers)) require.Equal(t, 0, len(cacher.watchers.valueWatchers)) require.Equal(t, 2, forgetCounter) } </del>
Change:
test Since Oct 25th No response stack trace: Test has been flaking with master golang as well. /sig node
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
seems like we need to increase the timeout.. /assign
I tried with different values of timeout in function viz and running test binary using stress tool. In most cases, test is getting passed.
Flake in master blocking board: /cc
Flake in as well.
is waiting for approve been a while, which try to fix the flake
We can still observe this flakiness with 30ms timeout in CI Wondering, if timeout has to be increased further. Please let us know if more information is required.
It flaked in today as well. /reopen
Reopened this issue. <detailsIn response to : It flaked in today as well. </details
We're seeing this flake frequently downstream as well, both in TestUnprepareResources and TestPrepareResources.
cc
is trying to fix it but still pending

Discussion:
driverName: driverName, } if shouldTimeout { <del> timeout := plugin.PluginClientTimeout + 10*time.Millisecond </del> <ins> timeout := plugin.PluginClientTimeout + 30*time.Millisecond </ins> fakeDRADriverGRPCServer.timeout = &timeout }
Change:
test Since Oct 25th No response stack trace: Test has been flaking with master golang as well. /sig node
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
seems like we need to increase the timeout.. /assign
I tried with different values of timeout in function viz and running test binary using stress tool. In most cases, test is getting passed.
Flake in master blocking board: /cc
Flake in as well.
is waiting for approve been a while, which try to fix the flake
We can still observe this flakiness with 30ms timeout in CI Wondering, if timeout has to be increased further. Please let us know if more information is required.
It flaked in today as well. /reopen
Reopened this issue. <detailsIn response to : It flaked in today as well. </details
We're seeing this flake frequently downstream as well, both in TestUnprepareResources and TestPrepareResources.
cc
is trying to fix it but still pending

Discussion:
driverName: driverName, } if shouldTimeout { <del> timeout := plugin.PluginClientTimeout + 30*time.Millisecond </del> <ins> timeout := plugin.PluginClientTimeout + time.Second </ins> fakeDRADriverGRPCServer.timeout = &timeout }
Change:
recently merged, adding nodes as something we can put in bound object refs (yay!) Today while reading noderestriction code for a different reason, I realized we never extended noderestriction to block Kubelets from binding tokens to nodes other than themselves. Today, noderestriction does block Kubelets from binding tokens to Pods on other nodes, so perhaps it should do the same for bound node references. noderestriction to block it, probably. Read the code here: And note that we didn't modify in No response Not yet in any released version of K8s. N/A N/A N/A N/A N/A
/triage accepted
To summarize Slack discussion: TokenRequest can only bind to one object at a time. kubelet (node identity) is already required to bind to Pod by noderestriction. kube-apiserver automatically inserts the node information based on the Pod binding. kubelet does not set it. So this is technically still node bound. We should still add a comment in to avoid future confusion. There may be other reasons to add a check, like future proofing...

Discussion:
return admission.NewForbidden(a, fmt.Errorf("node requested token bound to a pod scheduled on a different node")) } <ins> // Note: A token may only be bound to one object at a time. By requiring // the Pod binding, noderestriction eliminates the opportunity to spoof // a Node binding. Instead, kube-apiserver automatically infers and sets // the Node binding when it receives a Pod binding. See: // https://github.com/kubernetes/kubernetes/issues/121723 for more info. </ins> return nil }
Change:
It is possible to deploy Kubernetes with a separate filesystem. We default the settings for EvictionHard . A concern is that if users are using the default settings and separate filesystem for images, we are effectively turning off monitoring for INodes on the imagefs. This means that we won't have disk pressure if inodes run out on the ImageFs. The fix can be to add To default settings. This doesn't seem to be a regression as these defaults were 5 years ago (k8s 1.12) but this could be a potential bug if either users mount a separate filesystem to their container runtime storage or they configure their runtime to store their images on a separate filesystem.
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig node
/assign
/kind feature

Discussion:
// DefaultEvictionHard includes default options for hard eviction. var DefaultEvictionHard = map[string]string{ <del> "memory.available":  "100Mi", "nodefs.available":  "10%", "nodefs.inodesFree": "5%", "imagefs.available": "15%", </del> <ins> "memory.available":   "100Mi", "nodefs.available":   "10%", "nodefs.inodesFree":  "5%", "imagefs.available":  "15%", "imagefs.inodesFree": "5%", </ins> }
Change:
Package use a custom-defined type . Go 1.21 support an official package cmp which has .
/sig api-machinery
cc
/assign xgp01
/triage accepted
/kind cleanup

Discussion:
<del> /* Copyright 2022 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ package sets // ordered is a constraint that permits any ordered type: any type // that supports the operators < <= >= >. // If future releases of Go add new ordered types, // this constraint will be modified to include them. type ordered interface { integer | float | ~string } // integer is a constraint that permits any integer type. // If future releases of Go add new predeclared integer types, // this constraint will be modified to include them. type integer interface { signed | unsigned } // float is a constraint that permits any floating-point type. // If future releases of Go add new predeclared floating-point types, // this constraint will be modified to include them. type float interface { ~float32 | ~float64 } // signed is a constraint that permits any signed integer type. // If future releases of Go add new predeclared signed integer types, // this constraint will be modified to include them. type signed interface { ~int | ~int8 | ~int16 | ~int32 | ~int64 } // unsigned is a constraint that permits any unsigned integer type. // If future releases of Go add new predeclared unsigned integer types, // this constraint will be modified to include them. type unsigned interface { ~uint | ~uint8 | ~uint16 | ~uint32 | ~uint64 | ~uintptr } </del>

return len(s1) == len(s2) && s1.IsSuperset(s2) } <del> type sortableSliceOfGeneric[T ordered] []T </del> <ins> type sortableSliceOfGeneric[T cmp.Ordered] []T </ins> func (g sortableSliceOfGeneric[T]) Len() int           { return len(g) } func (g sortableSliceOfGeneric[T]) Less(i, j int) bool { return less[T](g[i], g[j]) }

// // This is a separate function and not a method because not all types supported // by Generic are ordered and only those can be sorted. <del> func List[T ordered](s Set[T]) []T { </del> <ins> func List[T cmp.Ordered](s Set[T]) []T { </ins> res := make(sortableSliceOfGeneric[T], 0, len(s)) for key := range s { res = append(res, key)

return len(s) } <del> func less[T ordered](lhs, rhs T) bool { </del> <ins> func less[T cmp.Ordered](lhs, rhs T) bool { </ins> return lhs < rhs }
Change:
Any test that invokes with the parameter October 21, 2023 No response /sig-storage
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign
Minimal Repro:
/sig storage

Discussion:
args = append(args, func() { storageframework.DefineTestSuites(driver, testsuites.CSISuites) }) <del> framework.Describe(args) </del> <ins> framework.Describe(args...) </ins> return nil }
Change:
I have a Service in v1.27.5 k8s version: I have 2 pods on the node with CNI IPs (calico). One pod (nginx) matches labelSelector of the service. I make a curl request from the second pod: First request is successful. The second request is rejected with icmp-port-unreachable. I expect both of the requests are successfull (as in the v1.24.6 version). Create a Service with my configuration and two pods. Make two requests: ip placed both to status.loadBalancer.ingress[0].ip and externalIPs ip placed only in externalIPs I see that ip 10.3.49.15 is placed to ipsets: -EXTERNAL-IP-LOCAL -IPVS-IPS -LOAD-BALANCER -LOAD-BALANCER-LOCAL And 10.3.49.16 is placed to ipsets: -EXTERNAL-IP-LOCAL -IPVS-IPS And iptables rules rejects the trafic to the second address: I think, the ips must be placed both to KUBE-EXTERNAL-IP-LOCAL and KUBE-EXTERNAL-IP ipsets. <details</details<detailsBaremetal </details<details</details<detailsKubespray v2.22.1 </details<details</details<details</details
/sig network
/area ipvs /cc
Has any (both) POD ?
No, pods have cni IPs (calico).
I think you are right. /triage accepted
BTW, I don't think "externalTrafficPolicy" is supported for "externalIPs". Service is required for that. But IMO it should work anyway.
This behavior was supported in previous versions. I have tested in v1.24.6.
That doesn't work, but KUBE-EXTERNAL-IP-LOCAL should be to the list of "RETURN" rules, as:
/assign

Discussion:
"-m", "set", "--match-set", proxier.ipsetList[kubeExternalIPSet].Name, "dst,dst", "-j", "RETURN") proxier.filterRules.Write( "-A", string(kubeIPVSFilterChain), <ins> "-m", "set", "--match-set", proxier.ipsetList[kubeExternalIPLocalSet].Name, "dst,dst", "-j", "RETURN") proxier.filterRules.Write( "-A", string(kubeIPVSFilterChain), </ins> "-m", "set", "--match-set", proxier.ipsetList[kubeHealthCheckNodePortSet].Name, "dst", "-j", "RETURN") proxier.filterRules.Write( "-A", string(kubeIPVSFilterChain),