jiebi/CodeConvo huggingface dataset:
Change:
The pod security policy capability test is using wrong CAP format with prefix. In our document, we explicitly say: It fails for cri-containerd. I'll find out why it doesn't fail for Docker, maybe docker has handled it. But we should fix the test anyway.
There are no sig labels on this issue. Please add a sig label. <detailsA sig label can be by either: a sig: e.g., to notify the contributor experience sig, OR the label manually: e.g., to apply the label Note: Method 1 will trigger an email to the group. See the . The in method 1 has to be replaced with one of these: bugs, feature-requests, pr-reviews, test-failures, proposals Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details

Discussion:
tester(unconfined) }) <del> By("Running a CAP_SYS_ADMIN pod", func() { </del> <ins> By("Running a SYS_ADMIN pod", func() { </ins> sysadmin := restrictedPod(f, "sysadmin") sysadmin.Spec.Containers[0].SecurityContext.Capabilities = &v1.Capabilities{ <del> Add: []v1.Capability{"CAP_SYS_ADMIN"}, </del> <ins> Add: []v1.Capability{"SYS_ADMIN"}, </ins> } sysadmin.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = nil tester(sysadmin)
Change:
As we have add to , we should stop using function like in test cases and create a listener and pass to . Because just create a tcp listener and get its port and close it. By this we can not make sure the port not be used between this listener close and the kube-apiserver listener start.
/cc /assign
/sig api-machinery
/cc
Probably a good idea. There are a couple flakes floating around where an integration test gets an "already in use" error
Ok, I can fix it with our guys
create to fix k/k integration test.
Please fix other cases in apiextentions-apiserver.
OK

Discussion:
"//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library", "//vendor/k8s.io/apimachinery/pkg/watch:go_default_library", "//vendor/k8s.io/apiserver/pkg/server:go_default_library", <ins> "//vendor/k8s.io/apiserver/pkg/server/options:go_default_library", </ins> "//vendor/k8s.io/apiserver/pkg/storage/names:go_default_library", "//vendor/k8s.io/client-go/dynamic:go_default_library", ],

"fmt" "net" "os" <del> "strconv" </del> "time" "github.com/pborman/uuid"

"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" "k8s.io/apimachinery/pkg/util/wait" genericapiserver "k8s.io/apiserver/pkg/server" <ins> genericapiserveroptions "k8s.io/apiserver/pkg/server/options" </ins> "k8s.io/client-go/dynamic" ) func DefaultServerConfig() (*extensionsapiserver.Config, error) { <del> port, err := FindFreeLocalPort() </del> <ins> listener, port, err := genericapiserveroptions.CreateListener("tcp", "127.0.0.1:0") </ins> if err != nil { return nil, err }

options.RecommendedOptions.Authorization = nil  // disable options.RecommendedOptions.Admission = nil      // disable options.RecommendedOptions.SecureServing.BindAddress = net.ParseIP("127.0.0.1") <ins> options.RecommendedOptions.SecureServing.Listener = listener </ins> etcdURL, ok := os.LookupEnv("KUBE_INTEGRATION_ETCD_URL") if !ok { etcdURL = "http://127.0.0.1:2379"

return StartServer(config) } <del> // FindFreeLocalPort returns the number of an available port number on // the loopback interface.  Useful for determining the port to launch // a server on.  Error handling required - there is a non-zero chance // that the returned port number will be bound by another process // after this function returns. func FindFreeLocalPort() (int, error) { l, err := net.Listen("tcp", ":0") if err != nil { return 0, err } defer l.Close() _, portStr, err := net.SplitHostPort(l.Addr().String()) if err != nil { return 0, err } port, err := strconv.Atoi(portStr) if err != nil { return 0, err } return port, nil } </del>
Change:
Didn't see an issue for this. Godep recently updated its version to v80. This broke several builds that directly godep, grabbing latest. /kind bug cc Example https://k8s- Here are some examples where we grab master:
We have helpers to grab godep. We should use them everywhere.
/cc
/assign

Discussion:
KUBE_ROOT=$(dirname "${BASH_SOURCE}")/.. source "${KUBE_ROOT}/hack/lib/init.sh" <del> source "${KUBE_ROOT}/hack/lib/util.sh" </del> kube::log::status "Restoring kubernetes godeps"

export PATH=${GOPATH}/bin:${PWD}/third_party/etcd:/usr/local/go/bin:${PATH} <del> retry go get github.com/tools/godep && godep version </del> retry go get github.com/jstemmer/go-junit-report retry go get github.com/cespare/prettybench

export PATH=${GOPATH}/bin:${PWD}/third_party/etcd:/usr/local/go/bin:${PATH} <del> retry go get github.com/tools/godep && godep version </del> retry go get github.com/jstemmer/go-junit-report # Enable the Go race detector.

# Set artifacts directory export ARTIFACTS_DIR=${WORKSPACE}/artifacts <del> retry go get github.com/tools/godep && godep version </del> export LOG_LEVEL=4 cd /go/src/k8s.io/kubernetes

# Install a few things needed by the verification tests. command -v etcd &>/dev/null || ./hack/install-etcd.sh <del> go get -u github.com/tools/godep </del> make verify

kube::log::status "Installing godep version ${GODEP_VERSION}" go install ./vendor/github.com/tools/godep/ <ins> GP="$(echo $GOPATH | cut -f1 -d:)" hash -r # force bash to clear PATH cache PATH="${GP}/bin:${PATH}" </ins> if [[ "$(godep version 2>/dev/null)" != *"godep ${GODEP_VERSION}"* ]]; then kube::log::error "Expected godep ${GODEP_VERSION}, got $(godep version)"

set -o nounset set -o pipefail <del> # As of go 1.6, the vendor experiment is enabled by default. export GO15VENDOREXPERIMENT=1 #### HACK #### # Sometimes godep just can't handle things. This lets use manually put # some deps in place first, so godep won't fall over. preload-dep() { org="$1" project="$2" sha="$3" # project_dir ($4) is optional, if unset we will generate it if [[ -z ${4:-} ]]; then project_dir="${GOPATH}/src/${org}/${project}.git" else project_dir="${4}" fi echo "**HACK** preloading dep for ${org} ${project} at ${sha} into ${project_dir}" git clone "https://${org}/${project}" "${project_dir}" > /dev/null 2>&1 pushd "${project_dir}" > /dev/null git checkout "${sha}" popd > /dev/null } </del> KUBE_ROOT=$(dirname "${BASH_SOURCE}")/.. source "${KUBE_ROOT}/hack/lib/init.sh"

exit 0 fi <ins> # Ensure we have the right godep version available kube::util::ensure_godep_version </ins> if [[ -z ${TMP_GOPATH:-} ]]; then # Create a nice clean place to put our new godeps _tmpdir="$(mktemp -d -t gopath.XXXXXX)"
Change:
A race condition between fakeremote.Start() is spawned as a goroutine to listen for connections, and its caller assumes that the listener will immediately be ready to accept connections. This leads to intermittent test failures if the caller attempts before the fake remote runtime is ready to listen. The code needs to be refactored so that the fake remote returns from listen, and then spawns the server as a goroutine and returns. This can be reproduced by running the remoteruntimetest in a loop; it fails periodically. Failure can be accelerated by putting a time.Sleep() in fake.Start() immediately before the call to util.CreateListener; the failure is then effectively deterministic. Fix tested by running about 150,000 iterations without observing any failures.
/sig pod
Reference initial issue:
/sig node

Discussion:
"//pkg/kubelet/apis/cri/testing:go_default_library", "//pkg/kubelet/remote/fake:go_default_library", "//vendor/github.com/stretchr/testify/assert:go_default_library", <ins> "//vendor/github.com/stretchr/testify/require:go_default_library", </ins> ], )

return fmt.Errorf("failed to listen on %q: %v", endpoint, err) } <del> return f.server.Serve(l) </del> <ins> go f.server.Serve(l) return nil </ins> } // Stop stops the fake remote runtime.

"time" "github.com/stretchr/testify/assert" <ins> "github.com/stretchr/testify/require" </ins> internalapi "k8s.io/kubernetes/pkg/kubelet/apis/cri" apitest "k8s.io/kubernetes/pkg/kubelet/apis/cri/testing" fakeremote "k8s.io/kubernetes/pkg/kubelet/remote/fake"

// Users should call fakeRuntime.Stop() to cleanup the server. func createAndStartFakeRemoteRuntime(t *testing.T) (*fakeremote.RemoteRuntime, string) { endpoint, err := fakeremote.GenerateEndpoint() <del> assert.NoError(t, err) </del> <ins> require.NoError(t, err) </ins> fakeRuntime := fakeremote.NewFakeRemoteRuntime() <del> go fakeRuntime.Start(endpoint) </del> <ins> fakeRuntime.Start(endpoint) </ins> return fakeRuntime, endpoint } func createRemoteRuntimeService(endpoint string, t *testing.T) internalapi.RuntimeService { runtimeService, err := NewRemoteRuntimeService(endpoint, defaultConnectionTimeout) <del> assert.NoError(t, err) </del> <ins> require.NoError(t, err) </ins> return runtimeService }
Change:
<!-- This form is for bug reports and feature requests ONLY! If you're looking for help check and the . --Is this a BUG REPORT or FEATURE REQUEST?: What happened: Internal Load Balancer created and associated with availability set but no target network ip configurations on Azure. What you expected to happen: How to reproduce it (as minimally and precisely as possible): Create Kubernetes service of type LoadBalancer, annotate with "". Anything else we need to know?: Refer Environment: Kubernetes version (use ): 1.9.1 Cloud provider or hardware configuration: azure OS (e.g. from /etc/os-release): Kernel (e.g. ): Install tools: Others:
/sig azure
/assign
/kind bug
Root cause: removes the logic for retrieve private ip. This is required however The controller-manager will crash every time new ilb was created, then will restart and get the IP then. Should get the ip in first round.

Discussion:
glog.V(2).Infof("ensure(%s) abort backoff: lb(%s) - updating", serviceName, lbName) return nil, err } <ins> if isInternal { // Refresh updated lb which will be used later in other places. newLB, exist, err := az.getAzureLoadBalancer(lbName) if err != nil { glog.V(2).Infof("getAzureLoadBalancer(%s) failed: %v", lbName, err) return nil, err } if !exist { return nil, fmt.Errorf("load balancer %q not found", lbName) } lb = &newLB } </ins> } }

return subnet, exists, err } <ins> func (az *Cloud) getAzureLoadBalancer(name string) (lb network.LoadBalancer, exists bool, err error) { var realErr error lb, err = az.LoadBalancerClient.Get(az.ResourceGroup, name, "") exists, realErr = checkResourceExistsFromError(err) if realErr != nil { return lb, false, realErr } if !exists { return lb, false, nil } return lb, exists, err } </ins>
Change:
Is this a BUG REPORT or FEATURE REQUEST?: /kind bug What happened: DaemonSet has an e2e test running that has dubious purpose. What you expected to happen: The e2e test should be refactored and commented clearer as it will be part of the conformance.
To elaborate, we're concerned that the following may not actually ensure that DaemonSet recreates Failed Pods: For example, it seems possible that the Node might simply overwrite the Pod status with its own information if it hasn't yet seen the change to the Phase. Ideally, we should verify that the Pod UID we force to Failed no longer shows up in the DaemonSet's list of Pods after the DaemonSet becomes happy again.

Discussion:
apps "k8s.io/api/apps/v1" "k8s.io/api/core/v1" <ins> "k8s.io/apimachinery/pkg/api/errors" </ins> apierrs "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/labels"

Expect(err).NotTo(HaveOccurred(), "error failing a daemon pod") err = wait.PollImmediate(dsRetryPeriod, dsRetryTimeout, checkRunningOnAllNodes(f, ds)) Expect(err).NotTo(HaveOccurred(), "error waiting for daemon pod to revive") <ins> By("Wait for the failed daemon pod to be completely deleted.") err = wait.PollImmediate(dsRetryPeriod, dsRetryTimeout, waitFailedDaemonPodDeleted(c, &pod)) Expect(err).NotTo(HaveOccurred(), "error waiting for the failed daemon pod to be completely deleted") </ins> }) // This test should not be added to conformance. We will consider deprecating OnDelete when the

Name: dsName, }, Spec: apps.DaemonSetSpec{ <ins> Selector: &metav1.LabelSelector{ MatchLabels: label, }, </ins> Template: v1.PodTemplateSpec{ ObjectMeta: metav1.ObjectMeta{ Labels: label,

Expect(curHistory).NotTo(BeNil()) return curHistory } <ins> func waitFailedDaemonPodDeleted(c clientset.Interface, pod *v1.Pod) func() (bool, error) { return func() (bool, error) { if _, err := c.CoreV1().Pods(pod.Namespace).Get(pod.Name, metav1.GetOptions{}); err != nil { if errors.IsNotFound(err) { return true, nil } return false, fmt.Errorf("failed to get failed daemon pod %q: %v", pod.Name, err) } return false, nil } } </ins>
Change:
https://k8s- https://k8s- cc: /kind bug /priority failing-test
/cc
Looking at the k8s-merge-robot in PR , it says: "pull-kubernetes-cross Skipped" (That's under "k8s-merge-robot merged commit into kubernetes:master 17 hours ago") Can someone tell why that test was skipped there? Wasn't the bot supposed to catch that breakage at that point instead? Just sent to fix this, someone please review. Thanks, Filipe
because the cross build is pretty expensive and takes a while, we only run it when we think a PR is likely to cause problems, based on the files it touches (regex at ). it's obviously not perfect - nothing in your PR immediately suggested there'd be a cross-build failure.
Ah ok I see thanks for the clarification!

Discussion:
createConfig.HostConfig.NetworkMode = dockercontainer.NetworkMode(networkMode) } else { // Todo: Refactor this call in future for calling methods directly in security_context.go <del> modifyHostNetworkOptionForContainer(false, podSandboxID, createConfig.HostConfig) </del> <ins> modifyHostOptionsForContainer(false, podSandboxID, createConfig.HostConfig) </ins> } return nil
Change:
We have noticed few months ago that this test flaked again() Opening this issue again to start dicussion on the test. Following are my observations after going through history and logs : We are bringing up a nginx container and trying to check if <container_IP:80is available. While this is not a bad idea, there are many things that could go wrong because of which nginx may not come to running. Some of them could be related to underlying infrastructure on which we have no control over, some could be related to network plugin being used etc. Some were mentioned in kubernetes/kubernetes (comment) as well. For example, the latest one failed with dial tcp 10.128.1.69:80: getsockopt: no route to host. This could be related to network setup as well. This makes the test indeterministic and therefore flaky. Since the goal this test is to check that a good container won't restart based on liveness probe, would it make sense to add a liveness command that checks for the existence of a particular directory that was created during container start up or something else instead of a HTTP GET. /sig node cc
not sure if this is helpful, but to my understanding, this is technically already supported as described in this page. You just have to figure out which probe you need most, either httpGet or exec.
It is not about configuring which probe to use. The problem is with test case flaking out and it flakes for what I believe could be an infrastructure related issue. I raised this issue to ensure that everyone is ok switching to exec from httpGet.
- I just noticed that we already have a test which does exec liveness probe test. Do we still need the http test? If not, can we delete it or increase timeouts?
/kind flake

Discussion:
}, InitialDelaySeconds: 15, TimeoutSeconds:      5, <del> FailureThreshold:    1, </del> <ins> FailureThreshold:    5, // to accommodate nodes which are slow in bringing up containers. </ins> }, }, },
Change:
Is this a BUG REPORT or FEATURE REQUEST?: /kind bug What happened: Deployment's collision avoidance mechanism assumes that if a replicaset's PodTemplateSpec is semantically deep equal with the deployment's PodTemplateSpec, then the replicaset is the new replicaset for the deployment. This assumption does not take into account the case when the user updates only a field of the replicaset that does not reside within the replicaset's PodTemplateSpec, in which the collision avoidance mechanism should also be triggered. What you expected to happen: The collision avoidance mechanism should be triggered when a non-PodTemplateSpec field (e.g., field) of the replicaset is changed. After making changes to (), the e2e test can be elaborated () to verify the mechanism works as expected. How to reproduce it (as minimally and precisely as possible): a Deployment for ReplicaSet and its Pod(s) to become ready a non-PodTemplateSpec field of the ReplicaSet that Deployment does not create a new ReplicaSet /sig apps /cc
To clarify, we don't actually care about RS label changes in this case. What we do care about is the change of ownership between Deployment and its RSes.
Update description of the issue. Tell me if it is still confusing.
Thanks for pointing to the e2e test.

Discussion:
err = framework.WaitForDeploymentComplete(c, deploy) Expect(err).NotTo(HaveOccurred()) <del> framework.Logf("Checking its ReplicaSet has the right controllerRef") </del> <ins> framework.Logf("Verifying Deployment %q has only one ReplicaSet", deploymentName) rsList := listDeploymentReplicaSets(c, ns, podLabels) Expect(len(rsList.Items)).Should(Equal(1)) framework.Logf("Obtaining the ReplicaSet's UID") orphanedRSUID := rsList.Items[0].UID framework.Logf("Checking the ReplicaSet has the right controllerRef") </ins> err = checkDeploymentReplicaSetsControllerRef(c, ns, deploy.UID, podLabels) Expect(err).NotTo(HaveOccurred()) <del> framework.Logf("Deleting Deployment %q and orphaning its ReplicaSets", deploymentName) </del> <ins> framework.Logf("Deleting Deployment %q and orphaning its ReplicaSet", deploymentName) </ins> err = orphanDeploymentReplicaSets(c, deploy) Expect(err).NotTo(HaveOccurred())

framework.Logf("Waiting for the ReplicaSet to have the right controllerRef") err = checkDeploymentReplicaSetsControllerRef(c, ns, deploy.UID, podLabels) Expect(err).NotTo(HaveOccurred()) <ins> framework.Logf("Verifying no extra ReplicaSet is created (Deployment %q still has only one ReplicaSet after adoption)", deploymentName) rsList = listDeploymentReplicaSets(c, ns, podLabels) Expect(len(rsList.Items)).Should(Equal(1)) framework.Logf("Verifying the ReplicaSet has the same UID as the orphaned ReplicaSet") Expect(rsList.Items[0].UID).Should(Equal(orphanedRSUID)) </ins> } func checkDeploymentReplicaSetsControllerRef(c clientset.Interface, ns string, uid types.UID, label map[string]string) error {
Change:
<!-- This form is for bug reports and feature requests ONLY! If you're looking for help check and the . --Is this a BUG REPORT or FEATURE REQUEST?: What happened: When creating many LoadBalancer services, some services may exceed Azure basic LB's FrontendIPConfiguations quota (default is 10). Public IPs are created for all services, but it is not removed after deleting the kubernetes services. What you expected to happen: Remove the public IP. How to reproduce it (as minimally and precisely as possible): Create more than 10 LoadBalancer services, wait a while for 10 services success, and then remove all services. Anything else we need to know?: Environment: Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g. from /etc/os-release): Kernel (e.g. ): Install tools: Others:
/sig azure
/area cloudprovider

Discussion:
return "", err } if !existsLb { <del> return "", fmt.Errorf("Expected to find an IP address for service %s but did not", service.Name) </del> <ins> glog.V(2).Infof("Expected to find an IP address for service %s but did not. Assuming it has been removed", service.Name) return "", nil </ins> } if len(lbStatus.Ingress) < 1 { <del> return "", fmt.Errorf("Expected to find an IP address for service %s but it had no ingresses", service.Name) </del> <ins> glog.V(2).Infof("Expected to find an IP address for service %s but it had no ingresses. Assuming it has been removed", service.Name) return "", nil </ins> } return lbStatus.Ingress[0].IP, nil
Change:
/kind bug cc. What happened: Since - specifically , kubelet always calls , leading it to always register an apiserver source with the . This leads to to never return true in cases where the kubelet is not configured to communicate with an apiserver. The direct result of this is that when removing a manifest from the directory, kubelet never kills the containers. What you expected to happen: The containers get killed properly. How to reproduce it (as minimally and precisely as possible): Configure kubelet standalone without an apiserver, and with a static pod manifest path. Add a manifest, then remove it. Observe the containers stick around. Set logging to greater than level 6, and see a lot of . Environment: Kubernetes version (use ): 1.9.2 (1.8.7 works)
- Is there a run a static manifest that's not a master test case in the node-e2e suite?
I don't think there are standalone kubelet tests since it's hard to observe the pod status.

Discussion:
// Restore from the checkpoint path // NOTE: This MUST happen before creating the apiserver source // below, or the checkpoint would override the source of truth. <del> updatechannel := cfg.Channel(kubetypes.ApiserverSource) </del> <ins> var updatechannel chan<- interface{} </ins> if bootstrapCheckpointPath != "" { glog.Infof("Adding checkpoint path: %v", bootstrapCheckpointPath) <ins> updatechannel = cfg.Channel(kubetypes.ApiserverSource) </ins> err := cfg.Restore(bootstrapCheckpointPath, updatechannel) if err != nil { return nil, err

if kubeDeps.KubeClient != nil { glog.Infof("Watching apiserver") <ins> if updatechannel == nil { updatechannel = cfg.Channel(kubetypes.ApiserverSource) } </ins> config.NewSourceApiserver(kubeDeps.KubeClient, nodeName, updatechannel) } return cfg, nil
Change:
/kind bug /sig network /assign What happened: For events being generated within the GCE cloudprovider, slices of firewall parameters are not being sorted before converted into a string. Due to random ordering, this may result in the same line being repeated.

Discussion:
"net" "net/http" "regexp" <ins> "sort" </ins> "strings" "k8s.io/api/core/v1"

allPorts = append(allPorts, fmt.Sprintf("%v:%v", a.IPProtocol, p)) } } <ins> // Sort all slices to prevent the event from being duped sort.Strings(allPorts) </ins> allow := strings.Join(allPorts, ",") <ins> sort.Strings(fw.SourceRanges) </ins> srcRngs := strings.Join(fw.SourceRanges, ",") <ins> sort.Strings(fw.TargetTags) </ins> targets := strings.Join(fw.TargetTags, ",") return fmt.Sprintf("--description %q --allow %v --source-ranges %v --target-tags %v --project %v", fw.Description, allow, srcRngs, targets, projectID) }

t.Errorf("autoSubnetInList() = %v, expected: %v", gotNames, expectedNames) } } <ins> func TestFirewallToGcloudArgs(t *testing.T) { firewall := compute.Firewall{ Description:  "Last Line of Defense", TargetTags:   []string{"jock-nodes", "band-nodes"}, SourceRanges: []string{"3.3.3.3/20", "1.1.1.1/20", "2.2.2.2/20"}, Allowed: []*compute.FirewallAllowed{ { IPProtocol: "udp", Ports:      []string{"321", "123-456", "123"}, }, { IPProtocol: "tcp", Ports:      []string{"321", "123-456", "123"}, }, }, } got := firewallToGcloudArgs(&firewall, "my-project") var e = `--description "Last Line of Defense" --allow tcp:123,tcp:123-456,tcp:321,udp:123,udp:123-456,udp:321 --source-ranges 1.1.1.1/20,2.2.2.2/20,3.3.3.3/20 --target-tags band-nodes,jock-nodes --project my-project` if got != e { t.Errorf("%q does not equal %q", got, e) } } </ins>