fix(validators): pair the TCPXO sidecar with the installer AICR ships #2379
+27
−12
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -32,11 +32,17 @@ | |
| # - GPU Operator with driver.enabled=false (GKE COS manages drivers) | ||
| # | ||
| # Image version note: | ||
| # Google ships the plugin installer and the tcpxo-daemon as a coupled release | ||
| # pair; running a mismatched pair is unsupported. This manifest is pinned to | ||
| # v1.0.15 (nccl-plugin-gpudirecttcpx-dev) with v1.0.21 (tcpgpudmarxd-dev), | ||
|
Member
There was a problem hiding this comment. 🔵 Nitpick — Version pair now also stated in prose Adds the v1.0.15 / v1.0.21 pair in prose alongside the two image lines, growing the hand-maintained-literal surface. It also helps the reader by naming the pinned pair where they'll edit it, and the single-source-of-truth follow-up is already tracked in #2378. Fix: No action needed here; noting for completeness.
Contributor
Author
There was a problem hiding this comment. Agreed on both halves. It does grow the hand-maintained surface, and that's the tradeoff — but naming the pair where the reader is about to edit it is the point of the header, since the whole failure mode is updating one image and not the other. #2378 tracks collapsing these literals to a single source of truth; its drift-surface inventory counts every site, this prose included. |
||
| # matching the installer the AICR recipe deploys. | ||
| # | ||
| # If your cluster runs a different installer version, check it with: | ||
| # kubectl get ds nccl-tcpxo-installer -n kube-system \ | ||
| # -o jsonpath='{.spec.template.spec.initContainers[?(@.name=="nccl-tcpxo-installer")].image}' | ||
| # then update BOTH images below to that installer's pair, per Google's | ||
| # release notes: https://github.com/GoogleCloudPlatform/container-engine-accelerators/blob/master/gpudirect-tcpxo/README.md | ||
| # Updating only one half recreates the mismatch this pairing exists to avoid. | ||
| # | ||
| # Usage: | ||
| # kubectl create ns nccl-test | ||
|
|
@@ -127,7 +133,7 @@ spec: | |
| cloud.google.com/gke-accelerator: nvidia-h100-mega-80gb | ||
| containers: | ||
| - name: tcpxo-daemon | ||
| image: us-docker.pkg.dev/gce-ai-infra/gpudirect-tcpxo/tcpgpudmarxd-dev:v1.0.21 | ||
| imagePullPolicy: Always | ||
| command: ["/bin/sh", "-c"] | ||
| args: | ||
|
|
@@ -150,7 +156,7 @@ spec: | |
| - name: LD_LIBRARY_PATH | ||
| value: /usr/local/nvidia/lib64 | ||
| - name: nccl-test | ||
| image: us-docker.pkg.dev/gce-ai-infra/gpudirect-tcpxo/nccl-plugin-gpudirecttcpx-dev:v1.0.15 | ||
| imagePullPolicy: Always | ||
| command: | ||
| - /bin/sh | ||
|
|
@@ -242,7 +248,7 @@ spec: | |
| cloud.google.com/gke-accelerator: nvidia-h100-mega-80gb | ||
| containers: | ||
| - name: tcpxo-daemon | ||
| image: us-docker.pkg.dev/gce-ai-infra/gpudirect-tcpxo/tcpgpudmarxd-dev:v1.0.21 | ||
| imagePullPolicy: Always | ||
| command: ["/bin/sh", "-c"] | ||
| args: | ||
|
|
@@ -265,7 +271,7 @@ spec: | |
| - name: LD_LIBRARY_PATH | ||
| value: /usr/local/nvidia/lib64 | ||
| - name: nccl-test | ||
| image: us-docker.pkg.dev/gce-ai-infra/gpudirect-tcpxo/nccl-plugin-gpudirecttcpx-dev:v1.0.15 | ||
| imagePullPolicy: Always | ||
| command: | ||
| - /bin/sh | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔵 Nitpick — ignoreDeps daemon entry is pre-emptive, not an active drift guard today
Worth keeping, but the comment (:366-370) and the PR body frame this entry as symmetric with the installer entry, and today it isn't in effect. Renovate never extracts
tcpgpudmarxd-dev: the image appears only indemos/**(not covered by thekubernetesmanager'smanagerFilePatterns, which is narrowed to^recipes/components/[^/]+/manifests/[^/]+\.ya?ml$) and invalidators/**/testdata/**(excluded byignorePaths). The siblingnccl-plugin-gpudirecttcpx-deventry IS load-bearing because that image lives in the scanned recipe manifestnccl-tcpxo-installer.yaml:101.Blast radius: None functionally — the entry is harmless and correctly becomes load-bearing if the daemon ever lands in a scanned manifest. This is a wording accuracy note, not a defect.
Fix: Consider softening the comment, e.g. "pre-emptive symmetry — the daemon isn't in a Renovate-scanned path today, but this keeps the pair coupled if it ever lands in recipes/components/*/manifests/."
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You're right, and my reasoning was wrong. I had assumed
demos/was scannable because it isn't inignorePaths— butmanagerFilePatternsis the actual gate, and thekubernetesmanager is narrowed to^recipes/components/[^/]+/manifests/. The daemon appears only indemos/andvalidators/**/testdata/, so Renovate never extracts it.Fixed in 9035485. The comment now says the entry is pre-emptive rather than an active guard, explains why (manager scope, not
ignorePaths), and states what it does buy: a future widening of those patterns can't silently let the daemon move alone. PR body corrected to match — it made the same overstatement.