VPA parent lookup treats informer lag as a missing Job #5555

🤖 Generated by the Agentic Engineer

Expected Behavior

VPA resolves a Pod's existing Job and CronJob owners even when an informer event arrives after admission. Temporary cache lag must not become a definitive missing-owner error or silently bypass a matching autoscaling policy.

Actual Behavior

A controlled reproduction against the unmodified released VPA modules 1.7.1 and 1.8.1 starts and synchronizes all controller informers, creates a Job in the fake API, and holds its watch event. The API can read the same Job UID, but the real parent lookup reports that the Job does not exist. Delivering the event makes the unchanged lookup resolve its CronJob parent. Both versions pass this paired diagnostic three times under the race detector. This establishes the cache-lag mechanism; it does not establish the cause of any particular production event.

Steps to Replicate

1. Synchronize the released controller fetcher's informers using a fake Kubernetes client seeded with a CronJob.
2. Create its Job while holding the Job watch event, then verify the API can retrieve the Job.
3. Call the released Pod parent lookup before and after delivering that event. Observe the missing-owner error before delivery and the CronJob parent afterward.

Acceptance Criteria

• Add a failing regression for an existing owner absent from a synchronized informer cache and a passing warm-cache control.
• Fix the lookup at its source with bounded, context-aware handling; preserve genuine NotFound, forbidden, transport and malformed-owner failures.
• Verify matching VPA behavior, including a CronJob owner, rather than only removing a log message.
• Adopt an accepted, verifiable runtime through the normal protected delivery path and check the production signal afterward.

Upstream necessity

The owning dependency is the public CNCF Kubernetes autoscaler project, independently identified from VPA's module identity and unrelated to employment repositories. Both the deployed release and latest released VPA reproduce the lookup behavior. A Helm value or policy change cannot change this dependency's informer lookup; suppressing the error or removing autoscaling would not deliver the required behavior. A minimal upstream bug report is therefore necessary. Public material will contain only synthetic objects and released source references, with no private logs, environment identifiers or configuration.

The target's contribution guide and Kubernetes AI guidance have been inspected. Code submission requires a contributor agreement; that fact remains unresolved and no agreement will be accepted by the agent. Kubernetes requires human responses to review comments, so automated review replies are outside this contribution's scope.

Planning

Bug, medium priority and medium effort. Keep in Backlog pending upstream handling and an eligible code contribution path. No production outage, resource-sizing fault or deleted-Job diagnosis is established by this reproduction. This report does not authorize an extra draft PR beyond the current run's limit.

Part of #4981.

Upstream report

The synthetic reproduction is published as kubernetes/autoscaler #10564. No production identifiers or logs were submitted. No fix or production acceptance is claimed.