Skip to content

fix(admission): validate subgroup names are lowercase on PodGroup creation#1164

Closed
cluster2600 wants to merge 1 commit intokai-scheduler:mainfrom
cluster2600:fix/validate-lowercase-subgroup-names
Closed

fix(admission): validate subgroup names are lowercase on PodGroup creation#1164
cluster2600 wants to merge 1 commit intokai-scheduler:mainfrom
cluster2600:fix/validate-lowercase-subgroup-names

Conversation

@cluster2600
Copy link
Copy Markdown

@cluster2600 cluster2600 commented Mar 9, 2026

Closes #948.

Problem

The scheduler internally lowercases subgroup parent names via formatParentName() in pkg/scheduler/api/podgroup_info/subgroup_info/factory.go, but this constraint was never validated at admission time. A user creating a PodGroup with mixed-case subgroup names (e.g. Workers) would have their resources accepted by the API but then silently hit parent-lookup failures during scheduling, which is quite confusing to diagnose.

Solution

Added lowercase validation in the PodGroup validating webhook (validateSubGroups) that rejects:

  • Subgroup names containing uppercase characters
  • Parent references containing uppercase characters

Both ValidateCreate and ValidateUpdate paths are covered since they share the same validation function. This ensures the constraint is properly recognised and enforced before the resource reaches the scheduler.

Changes

  • pkg/apis/scheduling/v2alpha2/podgroup_webhook.go — added strings.ToLower checks for SubGroup.Name and SubGroup.Parent in validateSubGroups()
  • pkg/apis/scheduling/v2alpha2/podgroup_webhook_test.go — updated existing test fixtures to use lowercase names (matching the new constraint), added three new test cases:
    • Uppercase subgroup name rejected
    • Mixed-case subgroup name rejceted
    • Uppercase parent reference rejected

Test plan

  • All existing TestValidateSubGroups cases pass with lowercase fixture names
  • New validation cases cover uppercase name, mixed-case name, and uppercase parent

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Mar 9, 2026

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 983b5365-5113-4624-8079-c40dee0b6f68

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.


Comment @coderabbitai help to get the list of available commands and usage tips.

…ation

Closes kai-scheduler#948.

The scheduler internally lowercases subgroup parent names via
formatParentName(), but this was never enforced at admission time.
A user creating a subgroup with mixed-case names would silently
hit lookup failures at scheduling time.

Add validation in the PodGroup webhook that rejects subgroup names
and parent references containing uppercase characters, with a clear
error message guiding the user.

Signed-off-by: Maxime Grenu <maxime.grenu@gmail.com>
@cluster2600 cluster2600 force-pushed the fix/validate-lowercase-subgroup-names branch from b1da24b to 448ab74 Compare March 10, 2026 09:27
@cluster2600
Copy link
Copy Markdown
Author

Closing — upstream merged #1383 which adds kubebuilder validation patterns (^[a-z0-9]([-a-z0-9]*[a-z0-9])?$) on both Name and Parent fields in the CRD spec. This enforces lowercase at the API level, making the webhook-level validation here redundant. Cheers to @itsomri for landing it!

@cluster2600 cluster2600 closed this Apr 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Validate subgroup names are lowercase on podgroup creation

1 participant