[apullo777]

What type of PR is this?

/kind bug
/area multikueue

What this PR does / why we need it:

The external-framework MultiKueue adapter created remote objects from localObj.DeepCopy() and only cleared resourceVersion. This could copy source-cluster metadata such as ownerReferences to the worker cluster.

Since those owner UIDs do not exist on the worker, the worker garbage collector can delete the remote object, causing the adapter to recreate it repeatedly.

This PR builds the remote unstructured object from scratch instead, keeping only GVK, name, namespace, labels, annotations, and spec. This mirrors the api.CloneObjectMetaForCreation whitelist used by the typed adapters.

The integration test asserts that the remote object is created without ownerReferences, finalizers, or status. It does not assert the full create-delete loop because envtest does not run a real garbage collector. AI assistance was used for parts of this change.

Which issue(s) this PR fixes:

Fixes #12540

Special notes for your reviewer:

Does this PR introduce a user-facing change?

MultiKueue: Fixed custom jobs using external-framework adapters being repeatedly created and deleted on worker clusters when source-cluster metadata was copied to the remote object.

Summary by CodeRabbit

• Bug Fixes

  • Remote objects created for admitted workloads are now sanitized to include only the expected creation-safe metadata (and spec only when present), avoiding unintended carryover such as local ownership details and status.
  • Worker-created resources no longer inherit source-cluster ownership, finalizers, or status metadata.

• Tests

  • Added unit tests to verify creation-safe cloning and remote object metadata/spec handling (including replicas/spec behavior).
  • Added an integration scenario ensuring worker-created RayCluster resources start without inherited source metadata.

[netlify]

✅ Deploy Preview for kubernetes-sigs-kueue canceled.

Name	Link
🔨 Latest commit	8f9fe91
🔍 Latest deploy log	https://app.netlify.com/projects/kubernetes-sigs-kueue/deploys/6a44086a2e87740008d88bf2

[kubernetes-prow]

Hi @apullo777. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b523f09d-0ef7-407c-bc0c-f8b930f33ac3

📥 Commits

Reviewing files that changed from the base of the PR and between 9e277c5 and 8f9fe91.

📒 Files selected for processing (2)

• pkg/controller/admissionchecks/multikueue/externalframeworks/adapter.go
• pkg/controller/admissionchecks/multikueue/externalframeworks/adapter_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

• pkg/controller/admissionchecks/multikueue/externalframeworks/adapter.go
• pkg/controller/admissionchecks/multikueue/externalframeworks/adapter_test.go

---

📝 Walkthrough

Walkthrough

createRemoteObject in the MultiKueue external frameworks adapter now clones only creation-safe metadata and spec fields before creating remote objects. New unit and integration tests verify that source-cluster metadata is stripped and expected fields are preserved.

Safe remote object cloning

Layer / File(s)	Summary
Creation-safe clone helper pkg/controller/admissionchecks/multikueue/externalframeworks/adapter.go	createRemoteObject now uses cloneUnstructuredForCreation, which rebuilds an unstructured.Unstructured with cleaned metadata from api.CloneObjectMetaForCreation and copies spec when present.
Unit coverage for cloning and remote creation pkg/controller/admissionchecks/multikueue/externalframeworks/adapter_test.go	Tests verify the clone helper preserves apiVersion/kind, name/namespace, labels, annotations, and spec, while removing creation-forbidden metadata. Another test verifies remote object creation sanitization and spec handling.
Integration coverage for worker copies test/integration/multikueue/external_job_test.go	A new integration test creates a manager RayCluster with a fake owner reference and checks that the worker-side remote RayCluster has empty OwnerReferences, empty Finalizers, and zero Status.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 I hopped through the metadata brush,
Leaving behind the noisy rush.
Only clean fields crossed the gate,
So remote clones now feel just great.
No shadow refs to cause a fuss—
Just specs and names that travel with us.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: sanitizing remote metadata for MultiKueue external-framework jobs.
Linked Issues check	✅ Passed	The adapter now builds remote objects from a creation-safe subset and tests confirm unsafe metadata is stripped, addressing the reported Create-Delete loop.
Out of Scope Changes check	✅ Passed	The only code changes are the adapter fix and tests that directly support the linked metadata-sanitization bug.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mbobrovskyi]

/ok-to-test

[Singularity23x0]

To be more precise, this replicates the logic of copySpec func(dst, src PtrT), which just so happens to, for every implementation, copy the spec and use the api.CloneObjectMetaForCreation to copy the ObjectMeta.

To avoid having to sync methods we can extract the part that does indeed focus on mirroring api.CloneObjectMetaForCreation and make one of the methods call the other. Since both cases would require converting Unstructured and ObjectMeta in both directions, choosing where the logic actually lies should mainly be a cosmetic choice. It might be easier to use the api.CloneObjectMetaForCreation here instead of the other way around as it is placed in the utils/api package.

[apullo777]

Thanks, that makes sense. I will update cloneUnstructuredForCreation to reuse api.CloneObjectMetaForCreation for the metadata part, and keep only the unstructured-specific spec copy locally.

That should remove the parallel whitelist / “keep in sync” concern while keeping the behavior covered by the existing TestCloneUnstructuredForCreation cases. I will also thread an error return through, since the unstructured to ObjectMeta conversion can fail.

[mimowo]

/lgtm
/approve
/cherrypick release-0.18
/cherrypick release-0.17
Thank you for hardening of Kueue 👍

[k8s-infra-cherrypick-robot]

@mimowo: once the present PR merges, I will cherry-pick it on top of release-0.17, release-0.18 in new PRs and assign them to you.

Details

In response to this:

/lgtm
/approve
/cherrypick release-0.18
/cherrypick release-0.17
Thank you for hardening of Kueue 👍

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[kubernetes-prow]

LGTM label has been added.

Details

Git tree hash: ec9a735ee501ab2f081e4af9bf893c27f6943b18

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: apullo777, mimowo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• pkg/controller/admissionchecks/multikueue/OWNERS [mimowo]
• test/OWNERS [mimowo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-infra-cherrypick-robot]

@mimowo: new pull request created: #12677

Details

In response to this:

/lgtm
/approve
/cherrypick release-0.18
/cherrypick release-0.17
Thank you for hardening of Kueue 👍

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-infra-cherrypick-robot]

@mimowo: #12643 failed to apply on top of branch "release-0.17":

Applying: Sanitize remote metadata for MultiKueue external-framework jobs
Using index info to reconstruct a base tree...
M	pkg/controller/admissionchecks/multikueue/externalframeworks/adapter.go
M	test/integration/multikueue/external_job_test.go
Falling back to patching base and 3-way merge...
Auto-merging pkg/controller/admissionchecks/multikueue/externalframeworks/adapter.go
Auto-merging test/integration/multikueue/external_job_test.go
CONFLICT (content): Merge conflict in test/integration/multikueue/external_job_test.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 Sanitize remote metadata for MultiKueue external-framework jobs

Details

In response to this:

/lgtm
/approve
/cherrypick release-0.18
/cherrypick release-0.17
Thank you for hardening of Kueue 👍

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[apullo777]

Let me do the cherry-pick for 0.17 :)