Repository navigation
Automated cherry pick of #13279: Reject leaderWorkerTemplate.size updates on managed LeaderWorkerSets - #13809
Conversation
When a LeaderWorkerSet is managed by Kueue, its validating webhook keeps the leader and worker pod templates immutable on update, but spec.leaderWorkerTemplate.size is not covered, since it sits outside the PodTemplateSpec. A group's admitted quota is the PodSet Count, which podSets() derives from size. Existing groups' Workloads go to toUpdate in filterWorkloads, and updateWorkload never recomputes their PodSets, so raising size on an admitted LeaderWorkerSet grows the pods per group without accounting for the added quota. The upstream controller creates the extra pods and the pod controller ungates them, so a tenant can create a small LeaderWorkerSet, let it get admitted, then raise size to run more pods than the ClusterQueue allows. Make spec.leaderWorkerTemplate.size immutable while the LeaderWorkerSet is managed by Kueue, with apivalidation.ValidateImmutableField in the same block that already validates the pod templates as immutable. replicas stays mutable, since each replica is a separate Workload that re-admits through quota. Put the check behind LWSImmutableGroupSize, Beta and on by default since 0.20. Changing size before anything is admitted, and scaling down, are arguably valid mutations, so operators who need either can opt out and accept the previous behavior until Kueue can re-admit a resized group through quota.
kubernetes-prow
Bot
added
the
release-note-action-required
kubernetes-prow
Bot
added
kind/bug
✅ Deploy Preview for kubernetes-sigs-kueue ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
kubernetes-prow
Bot
added
cncf-cla: yes
|
/lgtm |
kubernetes-prow
Bot
added
the
lgtm
|
LGTM label has been added. DetailsGit tree hash: f5dff912aa930ac7d9fcf2203a92c63884a55073 |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ivnovakov, mimowo The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
kubernetes-prow
Bot
added
the
approved
691daa7
into
kubernetes-sigs:release-0.19
Cherry pick of #13279 on release-0.19.
#13279: Reject leaderWorkerTemplate.size updates on managed LeaderWorkerSets
For details on the cherry pick process, see the cherry pick requests page.
What type of PR is this?
/kind bug
/area release