fix(validator): stop unenforced nccl-all-reduce-bw gates; wire eks+h200#1338
Conversation
Recipe evidence checkAffected leaf overlays: 5
How to refresh evidenceRun on a cluster matching the recipe's aicr snapshot -o snapshot.yaml
aicr validate \
-r recipes/overlays/<slug>.yaml \
-s snapshot.yaml \
--emit-attestation ./out \
--push ghcr.io/<your-fork>/aicr-evidence
cp ./out/pointer.yaml recipes/evidence/<slug>.yamlThis gate is warning-only and never blocks merge. See ADR-007 for the trust model. |
📝 WalkthroughWalkthroughThis PR adds EKS/H200 support to the NCCL all-reduce bandwidth validator (product matcher and supported-combination entry), adds an EKS H200 TrainingRuntime test manifest, updates related unit tests and template mapping, removes performance validation phases from AKS H100 and GKE B200 recipe overlays (replacing them with explanatory comments), and updates recipe-health and validation docs to reflect the changes. Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related issues
Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
e24939a to
b6725d5
Compare
5ce02c0 to
4cd27e0
Compare
The performance validator resolves nccl-all-reduce-bw support via an exact (variant, service) -> []accelerator table with no Any fallback, so a recipe declaring the check for a tuple absent from the table silently skips. A skipped check does not fail, so the performance phase reports passed without measuring or enforcing the threshold (false assurance). Three tuples were affected: - gke+b200 (b200-gke-cos-training, Kubeflow child inherits) - aks+h100 (h100-aks-training, ubuntu child inherits) - eks+h200 (h200-eks-training) gke+b200 and aks+h100 cannot be enforced without a new, testbed-validated transport-specific runtime template (A4 RoCE/RDMA; AKS has no template or scheduling path at all), so their unenforced checks are removed and replaced with a comment documenting what wiring would require. eks+h200 is Hopper on EFA, electrically identical to h100 for NCCL, so it is wired: H200 added to variantDefault.EKS, a NVIDIA-H200- product matcher added, and testdata/h200/eks/runtime.yaml added (mirrors the H100 EKS template). The recipe keeps its conservative >= 300 GB/s floor. Refs NVIDIA#1337
4cd27e0 to
27e1736
Compare
mchmarny
left a comment
There was a problem hiding this comment.
Clean, well-reasoned fix. Removing the two silently-skipped gates is the fail-closed-correct move — they were reporting passed without ever measuring, so this removes false assurance rather than masking it. The eks+h200 wiring is sound: H200 reuses the H100/EFA template, the product matcher and template path are unit-tested, and h200-eks-training already declares the >= 300 floor (with an honest "loose floor" comment), so the validator change activates a real constraint.
A couple of non-blocking notes:
- The PR body says "Full
make qualifystill pending — PR is WIP/draft," but it's marked ready with reviewers requested. CI is green (covers most of qualify) — just confirmmake qualifyran clean before merge. recipe-health.mdgoing 32→37 also absorbs five pre-existinga100-*recipes whose health doc was stale on main — that's a legitimate drift-fix from regeneration, not new data, but worth a one-line note in the PR description so reviewers don't read it as scope creep.
Nothing blocks merge.
| // EFA — electrically identical to H100 for NCCL — so the two EKS runtime | ||
| // templates must stay byte-identical apart from their leading comment/license | ||
| // headers. This converts the comment-only guarantee into an enforced one: an | ||
| // EFA-related edit to one template that is not mirrored in the other fails here |
There was a problem hiding this comment.
Nice — this converts the "keep in sync with H100" header comment into an enforced guard, so an unmirrored EFA edit fails here instead of silently diverging. Good way to make a 209-line duplicate safe.
Summary
Stops three
nccl-all-reduce-bwperformance gates that were declared in recipes but silently skipped by the validator (false "passed" without measuring). Removes the two that can't be enforced without a new testbed-validated template, and wires the one (eks+h200) that reuses the existing H100/EFA template.Motivation / Context
The performance validator resolves NCCL support via an exact
(variant, service) → []acceleratortable with noAnyfallback, so any declared tuple absent from the table returnsskipped. A skipped check does not fail, so the performance phase reportspassedwithout ever measuring or enforcing the threshold. An audit of all recipes declaringnccl-all-reduce-bw*found three affected tuples.Fixes: #1337
Related: N/A
Type of Change
Component(s) Affected
pkg/recipe)pkg/validator)docs/,examples/)Implementation Notes
Audit result (every recipe with an active NCCL check):
b200-gke-cos-training(+ Kubeflow child)gke+b200h100-aks-training(+ ubuntu child)aks+h100h200-eks-trainingeks+h200gb200-eks-training,gb200-oke-training,h100-eks-training,h100-gke-cos-trainingWiring for
eks+h200: addedH200tovariantDefault.EKS, added aNVIDIA-H200-prefix product matcher, and addedtestdata/h200/eks/runtime.yaml(mirrors the H100 EKS template). Recipe keeps its conservative>= 300 GB/sfloor (loose for H200's HBM3e envelope; wants one EFA-testbed confirmation to tighten). Removed tuples are replaced with comments documenting what wiring each would require.Testing
TestSupportedNCCLCombinationsHaveRuntimeTemplates(wiring guard) now coversh200/eks; addedTestTemplatePathandTestAcceleratorProductMatcherscases for H200 and updated thevariantDefault.EKSassertion. Fullmake qualifystill pending — PR is WIP/draft.Risk Assessment
Rollout notes: The two removed checks were no-ops (already reporting
passedwithout measuring), so removal changes no observed behavior. The H200 wiring activates a check that previously skipped; the floor is conservative.Checklist
make testwith-race)make lint) — scoped to changed packagegit commit -S)