Kubernetes field note · 2026-08-29
The queue name was right. The identity was wrong.
How a missing namespace crossed a fair-sharing boundary, and how a small regression test made the bug undeniable.
In Kubernetes, a name is often only unique inside a namespace. That sounds elementary. It is also exactly the kind of fact that disappears when an object is converted into a smaller internal key and passed through several scheduling layers.
The failure shape
Kueue’s fair-sharing preemption logic needed to identify the LocalQueue associated with a workload. One path retained only the queue’s short name. If two namespaces both had a LocalQueue called default, that short name no longer identified one queue.
Nothing was wrong with the string “default”. The mistake was treating a locally unique name as a globally unique identity.
The useful reproduction therefore needed two namespaces, not a more complicated scheduler. With one namespace, both the correct and incorrect implementations returned the same answer. With two same-named queues, the missing namespace became observable.
Why the test mattered
The regression pins the smallest state that distinguishes identity from name: two LocalQueues with equal names and different namespaces participating in the preemption path. Removing the fix makes that focused test fail. That gave reviewers a direct way to verify the causal claim, rather than accepting a theoretical collision argument.
Maintainers merged the change to main and then backported it to both release-0.18 and release-0.19. The full implementation and review trail are inKueue PR #14547.
The reusable rule
Whenever an object crosses a cache, queue, index, or scheduler boundary, ask whether its key preserves the same scope as the source API. A short name can be perfectly valid data and still be an invalid identity.