kueue

Build and manage a kind cluster for Workload-Aware Scheduling (WAS) e2e tests. Use when the user wants to set up, run tests against, or tear down a WAS test cluster built from Kubernetes main.

Flag solutions more elaborate than the problem requires — complexity that exists only because the author reached for a pattern.

Flag identical (or near-identical) blocks across types/adapters/call sites that should live in a shared helper — and newly extracted helpers with only one caller.

Flag code organization that a future maintainer will struggle to follow, modify, or extend.

Flag code put somewhere a reader would not expect to find it — cleanup scattered across callers, validation deep in business logic.

Flag unnecessary indirection, mismatched abstractions, or confusing data flow that obscures what the code is doing.

Flag redundant local variables that add noise without adding clarity.

Flag diffs that bundle a bugfix with an unrelated refactor, or generalize a change to all types when only one type needs it.

Review a diff for small-scale structural problems — unjustified complexity, duplicated logic, scope creep, or misplaced code.

Hard blocker — flag removal or relocation of code that manages cluster state owned by previous controller versions.

Flag feature-gated behavior whose gate-off path is incorrect — early returns that skip cleanup, or state set only when on but read unconditionally.

Flag incorrect conditionals, inverted boolean checks, off-by-one errors, unhandled edge cases, race conditions, or mishandled error returns.

Review a diff for behavioral defects — logic errors, broken edge cases, feature-gate bugs, and deletions that break backwards compatibility during rolling upgrades.

Flag extra checks that are logically unreachable at the call site — they add noise and can mask future regressions.

Evaluate the quality of a git diff between two commits by delegating per-skill analysis (Code Style, Buggy Behavior, Comments, Architectural Decisions, Security) to subagents, then aggregating their findings and recommendations into a scored report.

Flag typos in identifiers, strings, or any text introduced by the diff.

Flag new code that breaks naming conventions already established in the same file or package.

Flag identifiers whose name does not describe exactly what they contain — drift from package patterns, contradictory contents, misnamed feature gates, asymmetric mirror fields.

Flag unit or integration test function names that do not reflect the function or behavior under test.

Flag logic that duplicates an existing util/helper function instead of reusing it.

Review a diff for naming precision, convention drift, reinvented helpers, log-verbosity mistakes, misaligned test names, and typos.

Flag per-reconcile-cycle log lines emitted at V(2) — recurring reconcile-loop logs must be V(4) or higher.

Flag typos and obvious errors in comment text.

Flag any comment or docstring that no longer matches the code — these mislead future maintainers who trust them.

Flag temporary or deprecated compatibility-shim code kept in the diff without a deferred-removal comment naming the removal version and a tracking issue.

Flag comments that explain what self-documenting code already says.

Review a diff for comment hygiene — over-commenting, what-not-why narration, inaccurate comments, and missing TODOs on compatibility shims.

Flag comments that describe *what* the code does instead of *why* it does it.

Flag generic loops over obj.Annotations that copy, forward, or echo values — allow tenant injection into reserved kueue.x-k8s.io/ namespace.

Flag AuthN/AuthZ relaxation — webhook token skipping, failurePolicy Ignore, missing SubjectAccessReview, wildcard RBAC, privileged pod specs (CWE-269, CWE-287, CWE-306, CWE-862, CWE-863).

Flag feature-gated behavior whose security assumptions do not hold in both gate-on and gate-off states; require a comment near the gate check for new alpha attack surface.

Flag information-disclosure patterns — full-object logging, request echoing, credentials in status/annotations, kubeconfig logging, secret-bearing status (CWE-200, CWE-522, CWE-532, CWE-552).

Flag injection vectors from user-supplied strings — exec, SSRF, fmt.Sprintf-built selectors/URLs, template rendering, query concatenation (CWE-78, CWE-94, CWE-918).

Flag missing input validation at trust boundaries — user-settable CR fields, webhook payloads, labels, annotations, or untrusted deserialization (CWE-20, CWE-502).

Flag integration adapters reading credential-like fields from third-party CRDs without treating them as untrusted (RayCluster, SparkApplication, JobSet).

Flag unguarded dereferences of optional pointer fields reachable from a malformed CR, and goroutines without recover (CWE-476).

Flag file paths built from user-supplied names without sanitization, symlink-following in tenant dirs, and unvalidated archive extraction (CWE-22).

Flag missing resource bounds / DoS resistance — uncapped loops or allocations, missing timeouts, reconciler-wedging input, unbounded metric cardinality (CWE-400, CWE-770).

Review a diff for security issues exploitable by a tenant, neighbouring controller, or malicious workload spec — input validation, injection, DoS, nil-safety, authz, info disclosure, supply chain, webhook safety.

Flag supply-chain hygiene gaps — unpinned image refs, TLS bypass, unjustified go.mod replace directives, curl|sh, moving-tag GitHub Actions (CWE-295, CWE-494).