jiebi/CodeConvo huggingface dataset:
Change:
When the ip-masq-agent is activated, kubelet installs a rule that looks like: which is nonsensical.

Discussion:
// TODO(#40229): Remove the docker-exec-handler flag. fs.StringVar(&c.DockerExecHandlerName, "docker-exec-handler", c.DockerExecHandlerName, "Handler to use when executing a command in a container. Valid values are 'native' and 'nsenter'.") fs.MarkDeprecated("docker-exec-handler", "this flag will be removed and only the 'native' handler will be supported in the future.") <del> fs.StringVar(&c.NonMasqueradeCIDR, "non-masquerade-cidr", c.NonMasqueradeCIDR, "Traffic to IPs outside this range will use IP masquerade.") </del> <ins> fs.StringVar(&c.NonMasqueradeCIDR, "non-masquerade-cidr", c.NonMasqueradeCIDR, "Traffic to IPs outside this range will use IP masquerade. Set to '0.0.0.0/0' to never masquerade.") fs.MarkDeprecated("non-masquerade-cidr", "will be removed in a future version") </ins> fs.StringVar(&c.PodCIDR, "pod-cidr", "", "The CIDR to use for pod IP addresses, only used in standalone mode.  In cluster mode, this is obtained from the master.") fs.StringVar(&c.ResolverConfig, "resolv-conf", c.ResolverConfig, "Resolver configuration file used as the basis for the container DNS resolution configuration.") fs.BoolVar(&c.CPUCFSQuota, "cpu-cfs-quota", c.CPUCFSQuota, "Enable CPU CFS quota enforcement for containers that specify CPU limits")

// TODO: move thic logic into cni bridge plugin and remove this from kubenet func (plugin *kubenetNetworkPlugin) ensureMasqRule() error { <del> if _, err := plugin.iptables.EnsureRule(utiliptables.Append, utiliptables.TableNAT, utiliptables.ChainPostrouting, "-m", "comment", "--comment", "kubenet: SNAT for outbound traffic from cluster", "-m", "addrtype", "!", "--dst-type", "LOCAL", "!", "-d", plugin.nonMasqueradeCIDR, "-j", "MASQUERADE"); err != nil { return fmt.Errorf("Failed to ensure that %s chain %s jumps to MASQUERADE: %v", utiliptables.TableNAT, utiliptables.ChainPostrouting, err) </del> <ins> if plugin.nonMasqueradeCIDR != "0.0.0.0/0" { if _, err := plugin.iptables.EnsureRule(utiliptables.Append, utiliptables.TableNAT, utiliptables.ChainPostrouting, "-m", "comment", "--comment", "kubenet: SNAT for outbound traffic from cluster", "-m", "addrtype", "!", "--dst-type", "LOCAL", "!", "-d", plugin.nonMasqueradeCIDR, "-j", "MASQUERADE"); err != nil { return fmt.Errorf("Failed to ensure that %s chain %s jumps to MASQUERADE: %v", utiliptables.TableNAT, utiliptables.ChainPostrouting, err) } </ins> } return nil }
Change:
Is this a request for help? (If yes, you should use our troubleshooting guide and community support channels, see ): No What keywords did you search in Kubernetes issues before filing this one? (If you have found any duplicates, you should instead reply there.): cloud provider CloudProviderOptions DefaultExternalHost Is this a BUG REPORT or FEATURE REQUEST? (choose one): FEATURE REQUEST in we have a DefaultExternalHost func that contains a TODO stating that we should extend it to other cloud providers, since it only support AWS and CGE for now, using the following condition :
/assign
/area apiserver
/kind enhancement
/sig api-machinery
Thanks, forgot the sig. I will submit PR on monday.

Discussion:
return nil } <del> // TODO: extend for other providers if s.CloudProvider == "gce" || s.CloudProvider == "aws" { </del> <ins> if cloudprovider.IsCloudProvider(s.CloudProvider) { </ins> cloud, err := cloudprovider.InitCloudProvider(s.CloudProvider, s.CloudConfigFile) if err != nil { return fmt.Errorf("%q cloud provider could not be initialized: %v", s.CloudProvider, err)
Change:
Is this a request for help? (If yes, you should use our troubleshooting guide and community support channels, see ): No. Is this a BUG REPORT or FEATURE REQUEST? (choose one): FEATURE REQUEST in we have that perform unnecessary shallow copy on pods () : we get the pods from the cache i think we do not mutate the pods (i.e only reading values) so we can avoid this deepCopy i think.
/assign
/remove-kind enhancement /kind technical-debt
That's actually a shallow copy
- I'm sorry i was thinking about another issue while filing this one.. I will update the issue, Thanks.
/sig network

Discussion:
readyEps := 0 notReadyEps := 0 <del> for i := range pods { // TODO: Do we need to copy here? pod := &(*pods[i]) </del> <ins> for _, pod := range pods { </ins> for i := range service.Spec.Ports { servicePort := &service.Spec.Ports[i]
Change:
Is this a request for help? : No What keywords did you search in Kubernetes issues before filing this one? : PVC, Openstack, RBAC Is this a BUG REPORT or FEATURE REQUEST? : BUG REPORT Kubernetes version (use ): Client Version: version.Info{Major:"1", Minor:"6", GitVersion:"v1.6.4", GitCommit:"", GitTreeState:"clean", BuildDate:"2017-05-19T18:44:27Z", GoVersion:"go1.7.5", Compiler:"gc", Platform:"linux/amd64"} Server Version: version.Info{Major:"1", Minor:"7+", GitVersion:"v1.7.0-alpha.4.666+-dirty", GitCommit:"", GitTreeState:"dirty", BuildDate:"2017-05-30T09:26:07Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"} Environment: Cloud provider or hardware configuration: Openstack OS (e.g. from /etc/os-release): Ubuntu 16.04 Kernel (e.g. ): 4.4.0-47-generic Install tools: kubeadm Others: N/A What happened: kube-controller-manager could not list nodes becase of missing permission for persistent-volume-binder service account. What you expected to happen: persistent-volume-binder service account should be able to list nodes. How to reproduce it (as minimally and precisely as possible): bootstrap a cluster with RBAC and try to create cinder PVC on openstack. Anything else we need to know:
There are no sig labels on this issue. Please by:<br(1) mentioning a sig: <br(2) specifying the label manually: <br<brNote: method (1) will trigger a notification to the team. You can find the team list .
/sig auth

Discussion:
rbac.NewRule("get", "list", "watch").Groups(storageGroup).Resources("storageclasses").RuleOrDie(), rbac.NewRule("get", "create", "delete").Groups(legacyGroup).Resources("services", "endpoints").RuleOrDie(), rbac.NewRule("get").Groups(legacyGroup).Resources("secrets").RuleOrDie(), <ins> // openstack rbac.NewRule("get", "list").Groups(legacyGroup).Resources("nodes").RuleOrDie(), </ins> // recyclerClient.WatchPod rbac.NewRule("watch").Groups(legacyGroup).Resources("events").RuleOrDie(),

- apiGroups: - "" resources: <ins> - nodes verbs: - get - list - apiGroups: - "" resources: </ins> - events verbs: - watch
Change:
e2e_node tests on cos-beta-59-9460-20-0 image use GPUs. To install the NVIDIA drivers, we have to disable loadpin which requires a restart. This results in the runner losing connection with the instance which results in the tests failing/erroring. One way to fix this is to make sure that cloud-init has finished before starting the tests. Something like: We need to make sure that we only do this for images which use cloud-init.
Example: https://k8s-
There are no sig labels on this issue. Please by:<br(1) mentioning a sig: <br(2) specifying the label manually: <br<brNote: method (1) will trigger a notification to the team. You can find the team list .
is working on a fix for node e2es. It's currently failing serial tests on COS.

Discussion:
} instanceRunning = true } <ins> // If instance didn't reach running state in time, return with error now. if err != nil { return name, err } // Instance reached running state in time, make sure that cloud-init is complete if isCloudInitUsed(imageConfig.metadata) { cloudInitFinished := false for i := 0; i < 60 && !cloudInitFinished; i++ { if i > 0 { time.Sleep(time.Second * 20) } var finished string finished, err = remote.SSH(name, "ls", "/var/lib/cloud/instance/boot-finished") if err != nil { err = fmt.Errorf("instance %s has not finished cloud-init script: %s", name, finished) continue } cloudInitFinished = true } } </ins> return name, err } <ins> func isCloudInitUsed(metadata *compute.Metadata) bool { if metadata == nil { return false } for _, item := range metadata.Items { if item.Key == "user-data" && strings.HasPrefix(item.Value, "#cloud-config") { return true } } return false } </ins> func getExternalIp(instance *compute.Instance) string { for i := range instance.NetworkInterfaces { ni := instance.NetworkInterfaces[i]
Change:
https://k8s- Judging by the timestamp, it's this batch of merge caused the failure: NONE
There are no sig labels on this issue. Please by:<br(1) mentioning a sig: <br(2) specifying the label manually: <br<brNote: method (1) will trigger a notification to the team. You can find the team list and label list
looks like it's your pr causing the failure ^^^
cc
There are no sig labels on this issue. Please by:<br(1) mentioning a sig: <br(2) specifying the label manually: <br<brNote: method (1) will trigger a notification to the team. You can find the team list and label list
It's still failing, See build log: https://k8s-, kubelet log: error in kubelet log:

Discussion:
{% endif -%} {% set kubelet_auth = "--anonymous-auth=false --authorization-mode=Webhook --client-ca-file=" + pillar.get('ca_cert_bundle_path', '/var/lib/kubelet/ca.crt') %} <ins> {% set pki=" --cert-dir=/var/lib/kubelet/pki" -%} </ins> # test_args has to be kept at the end, so they'll overwrite any prior configuration <del> DAEMON_ARGS="{{daemon_args}} {{api_servers}} {{debugging_handlers}} {{hostname_override}} {{cloud_provider}} {{cloud_config}} {{config}} {{manifest_url}} --allow-privileged={{pillar['allow_privileged']}} {{log_level}} {{cluster_dns}} {{cluster_domain}} {{docker_root}} {{kubelet_root}}  {{non_masquerade_cidr}} {{cgroup_root}} {{system_container}} {{pod_cidr}} {{ master_kubelet_args }} {{cpu_cfs_quota}} {{network_plugin}} {{kubelet_port}} {{ hairpin_mode }} {{enable_custom_metrics}} {{runtime_container}} {{kubelet_container}} {{node_labels}} {{eviction_hard}} {{kubelet_auth}} {{feature_gates}} {{test_args}}" </del> <ins> DAEMON_ARGS="{{daemon_args}} {{api_servers}} {{debugging_handlers}} {{hostname_override}} {{cloud_provider}} {{cloud_config}} {{config}} {{manifest_url}} --allow-privileged={{pillar['allow_privileged']}} {{log_level}} {{cluster_dns}} {{cluster_domain}} {{docker_root}} {{kubelet_root}}  {{non_masquerade_cidr}} {{cgroup_root}} {{system_container}} {{pod_cidr}} {{ master_kubelet_args }} {{cpu_cfs_quota}} {{network_plugin}} {{kubelet_port}} {{ hairpin_mode }} {{enable_custom_metrics}} {{runtime_container}} {{kubelet_container}} {{node_labels}} {{eviction_hard}} {{kubelet_auth}} {{pki}} {{feature_gates}} {{test_args}}" </ins>

- group: root - mode: 755 <ins> /var/lib/kubelet/pki: file.directory: - mode: 755 - makedirs: True </ins> # The default here is that this file is blank. If this is the case, the kubelet # won't be able to parse it as JSON and it will not be able to publish events # to the apiserver. You'll see a single error line in the kubelet start up file

cmd.wait: - name: /opt/kubernetes/helpers/services bounce kubelet - watch: <ins> - file: /var/lib/kubelet/pki </ins> - file: /usr/local/bin/kubelet - file: {{ pillar.get('systemd_system_path') }}/kubelet.service - file: {{ environment_file }}
Change:
Fuentd-gcp image in version , used in contained a bad version of the fluentd (0.14), which introduced regression, detected by the load tests /cc

Discussion:
dnsPolicy: Default containers: - name: fluentd-gcp <del> image: gcr.io/google-containers/fluentd-gcp:2.0.4 </del> <ins> image: gcr.io/google-containers/fluentd-gcp:2.0.5 </ins> # If fluentd consumes its own logs, the following situation may happen: # fluentd fails to send a chunk to the server => writes it to the log => # tries to send this message to the server => fails to send a chunk and so on.
Change:
Kubernetes version (use ): v1.6.x What happened: Users tried to understand what the and flags do, but couldn't. What you expected to happen: Expect users to be able to understand from the the description.
/sig network

Discussion:
fs.DurationVar(&options.config.IPTables.SyncPeriod.Duration, "iptables-sync-period", options.config.IPTables.SyncPeriod.Duration, "The maximum interval of how often iptables rules are refreshed (e.g. '5s', '1m', '2h22m').  Must be greater than 0.") fs.DurationVar(&options.config.IPTables.MinSyncPeriod.Duration, "iptables-min-sync-period", options.config.IPTables.MinSyncPeriod.Duration, "The minimum interval of how often the iptables rules can be refreshed as endpoints and services change (e.g. '5s', '1m', '2h22m').") fs.DurationVar(&options.config.ConfigSyncPeriod.Duration, "config-sync-period", options.config.ConfigSyncPeriod.Duration, "How often configuration from the apiserver is refreshed.  Must be greater than 0.") <del> fs.BoolVar(&options.config.IPTables.MasqueradeAll, "masquerade-all", options.config.IPTables.MasqueradeAll, "If using the pure iptables proxy, SNAT everything (this not commonly needed)") fs.StringVar(&options.config.ClusterCIDR, "cluster-cidr", options.config.ClusterCIDR, "The CIDR range of pods in the cluster. It is used to bridge traffic coming from outside of the cluster. If not provided, no off-cluster bridging will be performed.") </del> <ins> fs.BoolVar(&options.config.IPTables.MasqueradeAll, "masquerade-all", options.config.IPTables.MasqueradeAll, "If using the pure iptables proxy, SNAT all traffic sent via Service cluster IPs (this not commonly needed)") fs.StringVar(&options.config.ClusterCIDR, "cluster-cidr", options.config.ClusterCIDR, "The CIDR range of pods in the cluster. When configured, traffic sent to a Service cluster IP from outside this range will be masqueraded and traffic sent from pods to an external LoadBalancer IP will be directed to the respective cluster IP instead") </ins> fs.StringVar(&options.config.ClientConnection.ContentType, "kube-api-content-type", options.config.ClientConnection.ContentType, "Content type of requests sent to apiserver.") fs.Float32Var(&options.config.ClientConnection.QPS, "kube-api-qps", options.config.ClientConnection.QPS, "QPS to use while talking with kubernetes apiserver") fs.IntVar(&options.config.ClientConnection.Burst, "kube-api-burst", options.config.ClientConnection.Burst, "Burst to use while talking with kubernetes apiserver")
Change:
<!-- Thanks for filing an issue! Before hitting the button, please answer these questions.--Is this a request for help? (If yes, you should use our troubleshooting guide and community support channels, see ): Note: Please file issues for subcomponents under the appropriate repo What keywords did you search in Kubernetes issues before filing this one? (If you have found any duplicates, you should instead reply there.): Is this a BUG REPORT or FEATURE REQUEST? (choose one): BUG REPORT <!-- If this is a BUG REPORT, please: Fill in as much of the template below as you can. If you leave out information, we can't help you as well. If this is a FEATURE REQUEST, please: Describe in detail the feature/behavior/change you'd like to see. In both cases, be ready for followup questions, and please respond in a timely manner. If we can't reproduce a bug or think a feature already exists, we might close your issue. If we're wrong, PLEASE feel free to reopen it and explain why. --Kubernetes version (use ): HEAD Environment: Cloud provider or hardware configuration: OS (e.g. from /etc/os-release): Kernel (e.g. ): Install tools: Others: What happened: PR adds validation of clusterIP when changing service type. e2e test case failed after the PR because the validation of specified ClusterIP. This test case will run on both and . Unfortunately, the two CI jobs have different . ref: What you expected to happen: We should make config of CI jobs the same. How to reproduce it (as minimally and precisely as possible): See that PR. Anything else we need to know: /cc
There are no sig labels on this issue. Please by:<br(1) mentioning a sig: <br(2) specifying the label manually: <br<brNote: method (1) will trigger a notification to the team. You can find the team list and label list
Reiterating the mentions to trigger a notification: <detailsIn response to : Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign
/assign

Discussion:
}) It("should provide DNS for ExternalName services", func() { <del> // TODO(xiangpengzhao): allow AWS when pull-kubernetes-e2e-kops-aws and pull-kubernetes-e2e-gce-etcd3 // have the same "service-cluster-ip-range". See: https://github.com/kubernetes/kubernetes/issues/47224 framework.SkipUnlessProviderIs("gce") </del> // Create a test ExternalName service. By("Creating a test externalName service") serviceName := "dns-test-service-3"
Change:
Kubernetes version (use ): kubernetes/master Environment: na What happened: What you expected to happen: How to reproduce it (as minimally and precisely as possible): see above Anything else we need to know: nope, have a fix.
There are no sig labels on this issue. Please by:<br(1) mentioning a sig: <br(2) specifying the label manually: <br<brNote: method (1) will trigger a notification to the team. You can find the team list and label list

Discussion:
return err } glog.V(4).Info("Successfully created federation controller manager deployment") <del> fmt.Println(cmdOut, " done") </del> <ins> fmt.Fprintln(cmdOut, " done") </ins> fmt.Fprint(cmdOut, "Updating kubeconfig...") glog.V(4).Info("Updating kubeconfig")
Change:
Test is constantly failing. https://k8s- https://k8s- /cc
After was manually merged last Friday, serial tests is back to normal flaky stage except this test which is constantly failing. Raise the priority.
i will take a look.
Is supposed to fix this?
they seem like different issues. is about slow namespace deletion. This seems to be an issue with the namespace objects being created?
spotted a bug in the tests. Sent
-- i think this is a separate issue.. for some reason, an empty namespace name is being passed into client which doesnt appear possible at first glance.
I'm going to necro this bug because I figured out why it's failing pod starts trying to get pod namespace starts trying to get the service account secret, but it's been deleted keeps trying and trying and trying to mount, but goes into backoff ~80s later it finally gives up and unmounts the secret it never mounted Logs above are from 1.12. When a pod is detected as deleted, we're trying to unmount a secret that can't / doesn't exist. The fact that the pod is deleted should abort mount much faster, even if mount is in backoff. this is a flaky conformance test (and fixing this should have an impact on other failure modes like this).
It is different than the other cause, so probably deserves a second issue, but we should assess which linked issues are actually this problem and link those into the final fix.
cc fixed a secret teardown issue in the past
/area conformance
I am not sure if it is a bug as such. It is true that when pod is removed, volumemanager tries to mount the volume anyways and since it fails to fetch secret, it keeps failing. to fetch secret is a non-fatal error and volumemamanger is right in retrying that operation. think bit that is problematic is - mount and unmount operation basically share the exponential backoff . I have filed to track this. A workaround might be to increase the wait period in following code: But I can see how having this shared exp. backoff may have domino effect on other tests and may be pod teardown time can be improved in general if mount and unmount did not share the exp. backoff.
/assign
As far as I can see the issue has now been resolved; on test grid I see only green for this test: https://k8s- https://k8s- was the PR that seems to have fixed this. /close
Closing this issue. <detailsIn response to : As far as I can see the issue has now been resolved; on test grid I see only green for this test: https://k8s- https://k8s- Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details

Discussion:
// This error is ok, beacuse we will delete the pod before it completes initialization framework.Logf("error from create uninitialized namespace: %v", err) }() <del> podB = waitForPodInNamespace(f.ClientSet, podB.Namespace, podB.Name) </del> <ins> podB = waitForPodInNamespace(f.ClientSet, namespace.Name, podB.Name) </ins> By("Deleting the namespace") err = f.ClientSet.Core().Namespaces().Delete(namespace.Name, nil)
Change:
In we stopped filtering nodes by their running state. But this means that the NodeName is no longer a unique key. We need to rework the volume status checker to deal with this.
There are no sig labels on this issue. Please by:<br(1) mentioning a sig: <br(2) specifying the label manually: <br<brNote: method (1) will trigger a notification to the team. You can find the team list and label list
Was discussing this with offline. Why can't we extend the filter to exclude terminated ones? I understand that AWS API doesn't provide a documented way of doing negative filtering, but can we not simply list all the known states we care about? such as - , , etc.
We can do that too :-)

Discussion:
return attached, nil } <del> dnsNameSlice := []string{} </del> <ins> nodeNames := []string{} </ins> for nodeName, diskNames := range nodeDisks { for _, diskName := range diskNames { setNodeDisk(attached, diskName, nodeName, false) } <del> dnsNameSlice = append(dnsNameSlice, mapNodeNameToPrivateDNSName(nodeName)) </del> <ins> nodeNames = append(nodeNames, mapNodeNameToPrivateDNSName(nodeName)) </ins> } <del> awsInstances, err := c.getInstancesByNodeNames(dnsNameSlice) </del> <ins> // Note that we get instances regardless of state. // This means there might be multiple nodes with the same node names. awsInstances, err := c.getInstancesByNodeNames(nodeNames) </ins> if err != nil { // When there is an error fetching instance information // it is safer to return nil and let volume information not be touched.

} if len(awsInstances) == 0 { <del> glog.V(2).Infof("DisksAreAttached will assume no disks are attached to any node on AWS cluster.") </del> <ins> glog.V(2).Infof("DisksAreAttached found no instances matching node names; will assume disks not attached") </ins> return attached, nil } <del> awsInstanceMap := make(map[types.NodeName]*ec2.Instance) </del> <ins> // Note that we check that the volume is attached to the correct node, not that it is attached to _a_ node </ins> for _, awsInstance := range awsInstances { <del> awsInstanceMap[mapInstanceToNodeName(awsInstance)] = awsInstance } </del> <ins> nodeName := mapInstanceToNodeName(awsInstance) </ins> <del> // Note that we check that the volume is attached to the correct node, not that it is attached to _a_ node for nodeName, diskNames := range nodeDisks { awsInstance := awsInstanceMap[nodeName] if awsInstance == nil { // If instance no longer exists, safe to assume volume is not attached. glog.Warningf( "Node %q does not exist. DisksAreAttached will assume disks %v are not attached to it.", nodeName, diskNames) </del> <ins> diskNames := nodeDisks[nodeName] if len(diskNames) == 0 { continue } awsInstanceState := "<nil>" if awsInstance != nil && awsInstance.State != nil { awsInstanceState = aws.StringValue(awsInstance.State.Name) } if awsInstanceState == "terminated" { // Instance is terminated, safe to assume volumes not attached // Note that we keep volumes attached to instances in other states (most notably, stopped) </ins> continue }