fix: prevent composed clustered tasks from getting stuck in RUNNING due to long JobSet pod names

[AdilFayyaz]

Why are the changes needed?

Composed/nested clustered tasks generate long action names. The JobSet plugin derived its resource name directly from that generated name, so JobSet's admission webhook rejected the child pods (<jobSetName>-workers-0-<podIdx>-<suffix> exceeded the 63-char DNS-1035 label limit). The plugin retried the identical, always-invalid object forever, leaving the execution stuck in RUNNING.

What changes were proposed in this pull request?

• clustered/util.go: Add buildJobSetName, which sanitizes and truncates the generated name (appending an FNV hash for uniqueness) so the longest pod name JobSet derives stays within 63 chars. The bound reserves room for the worst-case pod index so the name is derivable from the generated name alone.
• clustered/build.go + plugin.go: Use buildJobSetName on both the create (BuildResource) and lookup/abort (BuildIdentityResource) paths so they always agree on the name.
• plugin_manager.go – addObjectMetadata: Only default the object name to the generated name when the plugin didn't set one, instead of unconditionally clobbering it (which would undo the bounded JobSet name).
• plugin_manager.go – launchResource: Fast-fail on IsInvalid admission errors (InvalidResource) instead of looping via UnknownTransition — a generic safety net so any deterministic validation rejection surfaces as a failure rather than hanging in RUNNING.

How was this patch tested?

• go test ./flyteplugins/go/tasks/plugins/k8s/clustered/...
• TestBuildJobSetName_LongNameFitsPodLimit: a ~140-char name keeps the longest pod name ≤63 and DNS-1035-valid across replica counts 1…100000 (validated with jobset's own placement.GenPodName +
  validation.IsDNS1035Label).
• TestBuildResourceAndIdentityNameMatch: create and lookup paths produce the identical (truncated) name for a long generated name.
• Plus sanitization, uniqueness, and trailing-separator cases.
• go test ./executor/pkg/plugin/k8s/...
• Covers the addObjectMetadata name-preservation and launchResource IsInvalid fast-fail behavior.
• To verify end-to-end: run a composed clustered task whose nesting produces a long action name; confirm the JobSet is admitted, pods schedule, and the execution progresses past RUNNING (previously it hung).

Setup process

Screenshots

Check all the applicable boxes

• I updated the documentation accordingly.
• All new and existing tests passed.
• All commits are signed-off.

Related PRs

Stack

If you do use git town to manage PR Stacks, the stack relevant to this PR
will show below. Otherwise, you can ignore this section.

Docs link

[Copilot]

Pull request overview

This PR prevents composed/nested clustered tasks (JobSet-backed) from hanging in RUNNING when long generated names cause JobSet admission to deterministically reject derived Job/Pod names.

Changes:

• Add deterministic buildJobSetName to sanitize/truncate generated names (with a hash) so JobSet-derived names stay within DNS label limits.
• Ensure create and lookup/abort paths derive the same JobSet name (BuildResource + BuildIdentityResource).
• Update the executor’s K8s plugin manager to (a) not overwrite plugin-chosen object names and (b) fast-fail on deterministic Invalid admission errors instead of retry-looping.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
flyteplugins/go/tasks/plugins/k8s/clustered/util.go	Introduces bounded, deterministic JobSet naming to prevent webhook rejections from long composed names.
flyteplugins/go/tasks/plugins/k8s/clustered/build.go	Uses the bounded JobSet name for resource creation (and subdomain/service naming).
flyteplugins/go/tasks/plugins/k8s/clustered/plugin.go	Aligns identity (lookup/abort) naming with the create path for consistent reconciliation.
flyteplugins/go/tasks/plugins/k8s/clustered/clustered_test.go	Adds unit tests validating name sanitization, uniqueness, and derived-name length constraints.
executor/pkg/plugin/k8s/plugin_manager.go	Preserves plugin-set names and fails permanently on deterministic Invalid create errors.
executor/pkg/plugin/k8s/plugin_manager_test.go	Adds tests covering name preservation and Invalid fast-fail behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• gen/ts/package-lock.json: Generated file

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• gen/ts/package-lock.json: Generated file

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.

Suppressed comments (1)

executor/pkg/plugin/k8s/plugin_manager.go:128

• The PR description says addObjectMetadata now preserves a plugin-supplied object name (only defaulting to the generated name when the plugin didn’t set one). In the current implementation, the name is still unconditionally overwritten (o.SetName(name)), so a plugin that explicitly sets metadata.name (e.g. to a bounded/derived value) would still get clobbered. If name-preservation is required for this fix, addObjectMetadata needs to be updated accordingly; otherwise the PR description/test plan should be corrected to match the actual behavior.

		// Admission/validation rejections (e.g. a generated object or derived child name
		// exceeding k8s length limits) are deterministic: retrying re-submits the identical
		// object and fails the same way, leaving the execution stuck RUNNING. Fast-fail
		// instead of looping via UnknownTransition.
		if k8serrors.IsInvalid(err) {
			return pluginsCore.DoTransition(pluginsCore.PhaseInfoFailure("InvalidResource", err.Error(), nil)), nil
		}

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.

Suppressed comments (2)

flyteplugins/go/tasks/plugins/k8s/clustered/util.go:44

• PR description mentions adding/using a new buildJobSetName helper to sanitize/truncate JobSet names, but the implementation in this PR appears to rely entirely on PluginProperties.GeneratedNameMaxLength + TaskExecutionID.GetGeneratedNameWith(...) instead (and there is no buildJobSetName symbol in the repo). Please update the PR description to match the current approach, or add the helper if it is still required for other call paths.

// generatedNameMaxLength bounds the task's generated name via the plugin's
// PluginProperties. The plugin manager stamps the object name with
// GetGeneratedNameWith(0, GeneratedNameMaxLength) — DNS-1035-sanitized and bounded —
// on both the create and lookup paths. JobSet's admission webhook computes the
// longest child pod name as "<jobSetName>-<replicatedJob>-<jobIdx>-<podIdx>-<5-char

executor/pkg/plugin/k8s/plugin_manager.go:126

• PR description says addObjectMetadata was changed to avoid clobbering a plugin-provided object name, but addObjectMetadata still unconditionally sets o.SetName(name) based on the generated name (executor/pkg/plugin/k8s/plugin_manager.go:79-103). If name preservation is still intended (e.g. for plugins that must set a bounded name), please either update the description or include that code change here.

		// Admission/validation rejections (e.g. a generated object or derived child name
		// exceeding k8s length limits) are deterministic: retrying re-submits the identical
		// object and fails the same way, leaving the execution stuck RUNNING. Fast-fail
		// instead of looping via UnknownTransition.
		if k8serrors.IsInvalid(err) {

[pingsutw]

Do we really need ConvertToDNS1035LabelCompatibleString? dot and leading digit aren't not allow in the run name now in cloud. I think we need to add the same check in oss run service as well

[pingsutw]

we can add that in a separate PR

[AdilFayyaz]

OSS doesnt have any validation for run name rn
Makes sense to add it but that change should land before this PR gets merged. I'll create a new one for this.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (2)

executor/pkg/plugin/k8s/plugin_manager.go:128

• PR description says addObjectMetadata “only default[s] the object name … when the plugin didn't set one”, but addObjectMetadata still unconditionally calls o.SetName(name) (plugin_manager.go:83–90), which will clobber any plugin-supplied name. Either update addObjectMetadata to respect an existing name or adjust the PR description so reviewers/users aren’t relying on behavior that isn’t implemented.

		// Admission/validation rejections (e.g. a generated object or derived child name
		// exceeding k8s length limits) are deterministic: retrying re-submits the identical
		// object and fails the same way, leaving the execution stuck RUNNING. Fast-fail
		// instead of looping via UnknownTransition.
		if k8serrors.IsInvalid(err) {
			return pluginsCore.DoTransition(pluginsCore.PhaseInfoFailure("InvalidResource", err.Error(), nil)), nil
		}

flyteplugins/go/tasks/plugins/k8s/clustered/util.go:43

• The comment says GetGeneratedNameWith(...) is “DNS-1035-sanitized”, but GetGeneratedNameWith only truncates/hashes (see executor/pkg/plugin/task_exec_metadata.go:35–37) and the plugin manager only enforces/sanitizes DNS-1123 subdomain in addObjectMetadata. Please reword this to avoid implying DNS-1035 sanitization happens here.

// generatedNameMaxLength bounds the task's generated name via the plugin's
// PluginProperties. The plugin manager stamps the object name with
// GetGeneratedNameWith(0, GeneratedNameMaxLength) — DNS-1035-sanitized and bounded —
// on both the create and lookup paths. JobSet's admission webhook computes the