Missing Test for InitContainers & EphemeralContainers GPU Quota Checks - #2367

Path Under Test

• webhook.go:L131-L178 (fitResourceQuota)

Explanation & Bug Gap

The admission webhook's quota controller only checks resource limits inside pod.Spec.Containers. If a pod runs an InitContainer requesting GPUs, the quota checks are bypassed entirely. The current tests in webhook_test.go only verify resource configurations within regular containers.

Why Add This Test

To verify that init containers and ephemeral containers cannot bypass namespace GPU quota constraints, ensuring proper resource isolation inside multi-tenant clusters.

Mermaid Diagram

graph TD
    A[Test Case: InitContainer with GPUs] --> B[fitResourceQuota]
    B --> C{Scan Containers, InitContainers}
    C --> D[Aggregate Total GPU Core/Memory]
    D --> E{Exceeds Quota?}
    E -- Yes --> F[Assert: Webhook Denies Admission]
    E -- No --> G[Assert: Webhook Allows Admission]

Proposed Test Implementation

Create a test inside webhook_test.go that mocks an admission request for a Pod where Spec.InitContainers requests a GPU count or memory limit exceeding the namespace resource quota. Assert that the admission response has Allowed: false and mentions exceeding the quota.

Summary by CodeRabbit

• Bug Fixes

  • Prevented crashes when GPUs report asymmetric peer-to-peer link information.
  • Added a warning and safely returns a fallback score of zero for affected GPU pairs.

• Documentation

  • Added a changelog entry documenting the fix in version 2.9.1.