From b14129dce5b92c03d966fd720b9bed990bd3b5c9 Mon Sep 17 00:00:00 2001 From: Tuomas Katila Date: Fri, 18 Sep 2026 09:13:35 +0300 Subject: [PATCH 1/3] update dependency containers dp to 0.37.0 dra to 0.12.0 xpumd to 2.2.0 Signed-off-by: Tuomas Katila --- api/v1alpha1/clusterpolicy_webhook.go | 6 +++--- charts/gpu-base-operator-policy/README.md | 6 +++--- charts/gpu-base-operator-policy/values.yaml | 6 +++--- config/samples/base/clusterpolicy.yaml | 2 +- config/samples/deviceplugin/clusterpolicy.yaml | 2 +- config/samples/dra/clusterpolicy.yaml | 2 +- 6 files changed, 12 insertions(+), 12 deletions(-) diff --git a/api/v1alpha1/clusterpolicy_webhook.go b/api/v1alpha1/clusterpolicy_webhook.go index 0434913..51891a2 100644 --- a/api/v1alpha1/clusterpolicy_webhook.go +++ b/api/v1alpha1/clusterpolicy_webhook.go @@ -33,9 +33,9 @@ import ( // Default images used when no image is specified in the ClusterPolicy spec. // These match the pinned images shipped in the Helm chart values. const ( - DefaultDPImage = "docker.io/intel/intel-gpu-plugin:0.36.0@sha256:2db679be62b52ac985169084ca711cab6e6c59fe543ab2ddee58163d6f8d29e0" - DefaultDRAImage = "ghcr.io/intel/intel-resource-drivers-for-kubernetes/intel-gpu-resource-driver:v0.11.0@sha256:49f38fcbee4f98d748b537b1a728a12f39e56fd208c86dc3fa32ab2162c21197" - DefaultXPUImage = "ghcr.io/intel/xpumanager/xpumd:v2.1.0@sha256:67b492e40dd3c99a05abac67d45f480261b4521ed4415ff49f660f2db2691263" + DefaultDPImage = "docker.io/intel/intel-gpu-plugin:0.37.0@sha256:7001200071db10587fc31184eedda4f5cf291efba737adf85a8c80539f7fa5e1" + DefaultDRAImage = "ghcr.io/intel/intel-gpu-resource-driver:v0.12.0@sha256:5be06e1cf810c6091cec17ed78a775be64323f2084038c8840f283f643ce4207" + DefaultXPUImage = "ghcr.io/intel/xpumanager/xpumd:v2.2.0@sha256:fdefec8e5d93f76a1c7b4dda56001b7f3c2c15eae29bfbbc8971b900e6e74ae8" ) // SetupClusterPolicyWebhookWithManager registers the webhook for ClusterPolicy in the manager. diff --git a/charts/gpu-base-operator-policy/README.md b/charts/gpu-base-operator-policy/README.md index 3f89aa0..76e4bf2 100644 --- a/charts/gpu-base-operator-policy/README.md +++ b/charts/gpu-base-operator-policy/README.md @@ -37,16 +37,16 @@ See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_h | health.coreTemperatureThreshold | 88 | Core temperature threshold for health checks (°C). | | health.memoryTemperatureThreshold | 99 | Memory temperature threshold for health checks (°C). | | health.checkIntervalSeconds | 12 | Interval for health checks (seconds). | -| dp.plugin | intel/intel-gpu-plugin:0.36.0 | DP plugin image. | +| dp.plugin | intel/intel-gpu-plugin:0.37.0 | DP plugin image. | | dp.logLevel | 2 | DP log level. | | dp.byPathMode | single | DP by-path mounting mode | | dp.allowIDs | [] | Allowed PCI Device IDs | | dp.denyIDs | [] | Denied PCI Device IDs | -| dra.image | ghcr.io/intel/intel-resource-drivers-for-kubernetes/intel-gpu-resource-driver:v0.11.0 | DRA driver image. | +| dra.image | ghcr.io/intel/intel-gpu-resource-driver:v0.12.0 | DRA driver image. | | dra.logLevel | 2 | DRA log level. | | dra.podHealthCheck | true | Health check for DRA Pod. | | dra.manageBinding | false | Allow DRA plugin to manage device binding between xe/i915 and vfio drivers. Needed for dynamic switching between normal and KubeVirt workloads. | -| xpu.image | ghcr.io/intel/xpumanager/xpumd:v2.1.0 | XPU manager image. | +| xpu.image | ghcr.io/intel/xpumanager/xpumd:v2.2.0 | XPU manager image. | | xpu.logLevel | 2 | XPU manager log level. | | xpu.monitoringResource | monitoring | Monitoring resource for XPUMD with device plugin. | | xpu.configMapOverride | "" | Override the default XPUM configuration ConfigMap name. | diff --git a/charts/gpu-base-operator-policy/values.yaml b/charts/gpu-base-operator-policy/values.yaml index 0e5edd9..45531dc 100644 --- a/charts/gpu-base-operator-policy/values.yaml +++ b/charts/gpu-base-operator-policy/values.yaml @@ -12,7 +12,7 @@ health: checkIntervalSeconds: 12 dp: - plugin: docker.io/intel/intel-gpu-plugin:0.36.0@sha256:2db679be62b52ac985169084ca711cab6e6c59fe543ab2ddee58163d6f8d29e0 + plugin: docker.io/intel/intel-gpu-plugin:0.37.0@sha256:7001200071db10587fc31184eedda4f5cf291efba737adf85a8c80539f7fa5e1 logLevel: 2 byPathMode: single # affinity: @@ -24,7 +24,7 @@ dp: # operator: DoesNotExist dra: - image: ghcr.io/intel/intel-resource-drivers-for-kubernetes/intel-gpu-resource-driver:v0.11.0@sha256:49f38fcbee4f98d748b537b1a728a12f39e56fd208c86dc3fa32ab2162c21197 + image: ghcr.io/intel/intel-gpu-resource-driver:v0.12.0@sha256:5be06e1cf810c6091cec17ed78a775be64323f2084038c8840f283f643ce4207 logLevel: 2 podHealthCheck: true manageBinding: false @@ -37,7 +37,7 @@ dra: # operator: DoesNotExist xpu: - image: ghcr.io/intel/xpumanager/xpumd:v2.1.0@sha256:67b492e40dd3c99a05abac67d45f480261b4521ed4415ff49f660f2db2691263 + image: ghcr.io/intel/xpumanager/xpumd:v2.2.0@sha256:fdefec8e5d93f76a1c7b4dda56001b7f3c2c15eae29bfbbc8971b900e6e74ae8 logLevel: 2 monitoringResource: monitoring configMapOverride: "" diff --git a/config/samples/base/clusterpolicy.yaml b/config/samples/base/clusterpolicy.yaml index dd04c46..7a4a531 100644 --- a/config/samples/base/clusterpolicy.yaml +++ b/config/samples/base/clusterpolicy.yaml @@ -15,7 +15,7 @@ spec: checkIntervalSeconds: 5 xpu: - image: ghcr.io/intel/xpumanager/xpumd:v2.1.0@sha256:67b492e40dd3c99a05abac67d45f480261b4521ed4415ff49f660f2db2691263 + image: ghcr.io/intel/xpumanager/xpumd:v2.2.0@sha256:fdefec8e5d93f76a1c7b4dda56001b7f3c2c15eae29bfbbc8971b900e6e74ae8 logLevel: 2 # Device Plugin monitoring resource. monitoringResource: monitoring diff --git a/config/samples/deviceplugin/clusterpolicy.yaml b/config/samples/deviceplugin/clusterpolicy.yaml index 2bfff51..d844d84 100644 --- a/config/samples/deviceplugin/clusterpolicy.yaml +++ b/config/samples/deviceplugin/clusterpolicy.yaml @@ -9,7 +9,7 @@ spec: coreTemperatureThreshold: 88 dp: - plugin: docker.io/intel/intel-gpu-plugin:0.36.0@sha256:2db679be62b52ac985169084ca711cab6e6c59fe543ab2ddee58163d6f8d29e0 + plugin: docker.io/intel/intel-gpu-plugin:0.37.0@sha256:7001200071db10587fc31184eedda4f5cf291efba737adf85a8c80539f7fa5e1 byPathMode: single logLevel: 4 diff --git a/config/samples/dra/clusterpolicy.yaml b/config/samples/dra/clusterpolicy.yaml index b28ea04..8a30ca5 100644 --- a/config/samples/dra/clusterpolicy.yaml +++ b/config/samples/dra/clusterpolicy.yaml @@ -12,6 +12,6 @@ spec: checkIntervalSeconds: 12 dra: - image: ghcr.io/intel/intel-resource-drivers-for-kubernetes/intel-gpu-resource-driver:v0.11.0@sha256:49f38fcbee4f98d748b537b1a728a12f39e56fd208c86dc3fa32ab2162c21197 + image: ghcr.io/intel/intel-gpu-resource-driver:v0.12.0@sha256:5be06e1cf810c6091cec17ed78a775be64323f2084038c8840f283f643ce4207 logLevel: 2 podHealthCheck: true From 2d8b02f58793dd99f2085e2664e95158569e29c3 Mon Sep 17 00:00:00 2001 From: Tuomas Katila Date: Fri, 18 Sep 2026 09:54:15 +0300 Subject: [PATCH 2/3] update nfd to 0.19 Signed-off-by: Tuomas Katila --- charts/gpu-base-operator/Chart.yaml | 2 +- config/nfd/base/kustomization.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/gpu-base-operator/Chart.yaml b/charts/gpu-base-operator/Chart.yaml index 82f0757..d885036 100644 --- a/charts/gpu-base-operator/Chart.yaml +++ b/charts/gpu-base-operator/Chart.yaml @@ -11,7 +11,7 @@ dependencies: condition: nfd.install tags: - nfd - version: ~0.18 + version: ~0.19 repository: https://kubernetes-sigs.github.io/node-feature-discovery/charts - name: kueue diff --git a/config/nfd/base/kustomization.yaml b/config/nfd/base/kustomization.yaml index ca53d8c..3693e0b 100644 --- a/config/nfd/base/kustomization.yaml +++ b/config/nfd/base/kustomization.yaml @@ -1,7 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- "https://github.com/kubernetes-sigs/node-feature-discovery/deployment/overlays/default?ref=v0.18.2" +- "https://github.com/kubernetes-sigs/node-feature-discovery/deployment/overlays/default?ref=v0.19.0" configMapGenerator: - name: nfd-worker-conf behavior: replace From 12c52a41a37c0a1592723dbb3d35bec0d1f5f7e4 Mon Sep 17 00:00:00 2001 From: Tuomas Katila Date: Fri, 18 Sep 2026 11:35:58 +0300 Subject: [PATCH 3/3] workflow: set cosing to use workflow id + use both sign modes It was previously using personal ID, not the workflow. Generate both .sig and bundle signatures. Signed-off-by: Tuomas Katila --- .github/workflows/build-push-common.yaml | 10 +++++++++- .github/workflows/build-push-public.yaml | 1 + .github/workflows/build-push-self-hosted.yaml | 1 + 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-push-common.yaml b/.github/workflows/build-push-common.yaml index ccecf2d..bfc3e32 100644 --- a/.github/workflows/build-push-common.yaml +++ b/.github/workflows/build-push-common.yaml @@ -19,6 +19,7 @@ jobs: pull-requests: read # for golangci/golangci-lint-action to fetch pull requests contents: read packages: write + id-token: write # for cosign to get an OIDC token from Actions runs-on: ${{ inputs.runner }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 @@ -54,8 +55,15 @@ jobs: - name: Install cosign if: ${{ steps.gentag.outputs.TAG != 'devel' }} uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 #v4.1.2 + with: + # Pinned: the legacy-format sign below relies on --new-bundle-format, + # which is deprecated in cosign v3.1+ and goes away in v4. + cosign-release: 'v3.0.6' - name: Keyless image sign if: ${{ steps.gentag.outputs.TAG != 'devel' }} run: | - cosign sign --yes ${{ steps.digest.outputs.image_sha }} + cosign sign --yes --oidc-provider=github-actions ${{ steps.digest.outputs.image_sha }} + # Also sign in the legacy format: sigstore policy-controller cannot verify + # plain image signatures in the new bundle format yet. + cosign sign --yes --oidc-provider=github-actions --new-bundle-format=false ${{ steps.digest.outputs.image_sha }} diff --git a/.github/workflows/build-push-public.yaml b/.github/workflows/build-push-public.yaml index 18689a1..f6fd755 100644 --- a/.github/workflows/build-push-public.yaml +++ b/.github/workflows/build-push-public.yaml @@ -15,6 +15,7 @@ jobs: pull-requests: read # for golangci/golangci-lint-action to fetch pull requests contents: read packages: write + id-token: write # for cosign to get an OIDC token from Actions uses: "./.github/workflows/build-push-common.yaml" with: runner: ubuntu-24.04 diff --git a/.github/workflows/build-push-self-hosted.yaml b/.github/workflows/build-push-self-hosted.yaml index 8bf05b4..54d6626 100644 --- a/.github/workflows/build-push-self-hosted.yaml +++ b/.github/workflows/build-push-self-hosted.yaml @@ -17,6 +17,7 @@ jobs: pull-requests: read # for golangci/golangci-lint-action to fetch pull requests contents: read packages: write + id-token: write # for cosign to get an OIDC token from Actions uses: "./.github/workflows/build-push-common.yaml" with: runner: self-hosted