Deps update q3 2026

.github/workflows/build-push-common.yaml

@@ -19,6 +19,7 @@ jobs:
       pull-requests: read # for golangci/golangci-lint-action to fetch pull requests
       contents: read
       packages: write
+      id-token: write # for cosign to get an OIDC token from Actions
     runs-on: ${{ inputs.runner }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
@@ -54,8 +55,15 @@ jobs:
       - name: Install cosign
         if: ${{ steps.gentag.outputs.TAG != 'devel' }}
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 #v4.1.2
+        with:
+          # Pinned: the legacy-format sign below relies on --new-bundle-format,
+          # which is deprecated in cosign v3.1+ and goes away in v4.
+          cosign-release: 'v3.0.6'
       - name: Keyless image sign
         if: ${{ steps.gentag.outputs.TAG != 'devel' }}
         run: |
-          cosign sign --yes ${{ steps.digest.outputs.image_sha }}
+          cosign sign --yes --oidc-provider=github-actions ${{ steps.digest.outputs.image_sha }}
+          # Also sign in the legacy format: sigstore policy-controller cannot verify
+          # plain image signatures in the new bundle format yet.
+          cosign sign --yes --oidc-provider=github-actions --new-bundle-format=false ${{ steps.digest.outputs.image_sha }}
 

.github/workflows/build-push-public.yaml

@@ -15,6 +15,7 @@ jobs:
       pull-requests: read # for golangci/golangci-lint-action to fetch pull requests
       contents: read
       packages: write
+      id-token: write # for cosign to get an OIDC token from Actions
     uses: "./.github/workflows/build-push-common.yaml"
     with:
       runner: ubuntu-24.04

.github/workflows/build-push-self-hosted.yaml

@@ -17,6 +17,7 @@ jobs:
       pull-requests: read # for golangci/golangci-lint-action to fetch pull requests
       contents: read
       packages: write
+      id-token: write # for cosign to get an OIDC token from Actions
     uses: "./.github/workflows/build-push-common.yaml"
     with:
       runner: self-hosted

api/v1alpha1/clusterpolicy_webhook.go

@@ -33,9 +33,9 @@ import (
 // Default images used when no image is specified in the ClusterPolicy spec.
 // These match the pinned images shipped in the Helm chart values.
 const (
-	DefaultDPImage  = "docker.io/intel/intel-gpu-plugin:0.36.0@sha256:2db679be62b52ac985169084ca711cab6e6c59fe543ab2ddee58163d6f8d29e0"
-	DefaultDRAImage = "ghcr.io/intel/intel-resource-drivers-for-kubernetes/intel-gpu-resource-driver:v0.11.0@sha256:49f38fcbee4f98d748b537b1a728a12f39e56fd208c86dc3fa32ab2162c21197"
-	DefaultXPUImage = "ghcr.io/intel/xpumanager/xpumd:v2.1.0@sha256:67b492e40dd3c99a05abac67d45f480261b4521ed4415ff49f660f2db2691263"
+	DefaultDPImage  = "docker.io/intel/intel-gpu-plugin:0.37.0@sha256:7001200071db10587fc31184eedda4f5cf291efba737adf85a8c80539f7fa5e1"
+	DefaultDRAImage = "ghcr.io/intel/intel-gpu-resource-driver:v0.12.0@sha256:5be06e1cf810c6091cec17ed78a775be64323f2084038c8840f283f643ce4207"
+	DefaultXPUImage = "ghcr.io/intel/xpumanager/xpumd:v2.2.0@sha256:fdefec8e5d93f76a1c7b4dda56001b7f3c2c15eae29bfbbc8971b900e6e74ae8"
 )
 
 // SetupClusterPolicyWebhookWithManager registers the webhook for ClusterPolicy in the manager.

charts/gpu-base-operator-policy/README.md

@@ -37,16 +37,16 @@ See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_h
 | health.coreTemperatureThreshold | 88 | Core temperature threshold for health checks (°C). |
 | health.memoryTemperatureThreshold | 99 | Memory temperature threshold for health checks (°C). |
 | health.checkIntervalSeconds | 12 | Interval for health checks (seconds). |
-| dp.plugin | intel/intel-gpu-plugin:0.36.0 | DP plugin image. |
+| dp.plugin | intel/intel-gpu-plugin:0.37.0 | DP plugin image. |
 | dp.logLevel | 2 | DP log level. |
 | dp.byPathMode | single | DP by-path mounting mode |
 | dp.allowIDs | [] | Allowed PCI Device IDs |
 | dp.denyIDs | [] | Denied PCI Device IDs |
-| dra.image | ghcr.io/intel/intel-resource-drivers-for-kubernetes/intel-gpu-resource-driver:v0.11.0 | DRA driver image. |
+| dra.image | ghcr.io/intel/intel-gpu-resource-driver:v0.12.0 | DRA driver image. |
 | dra.logLevel | 2 | DRA log level. |
 | dra.podHealthCheck | true | Health check for DRA Pod. |
 | dra.manageBinding | false | Allow DRA plugin to manage device binding between xe/i915 and vfio drivers. Needed for dynamic switching between normal and KubeVirt workloads. |
-| xpu.image | ghcr.io/intel/xpumanager/xpumd:v2.1.0 | XPU manager image. |
+| xpu.image | ghcr.io/intel/xpumanager/xpumd:v2.2.0 | XPU manager image. |
 | xpu.logLevel | 2 | XPU manager log level. |
 | xpu.monitoringResource | monitoring | Monitoring resource for XPUMD with device plugin. |
 | xpu.configMapOverride | "" | Override the default XPUM configuration ConfigMap name. |

charts/gpu-base-operator-policy/values.yaml

@@ -12,7 +12,7 @@ health:
   checkIntervalSeconds: 12
 
 dp:
-  plugin: docker.io/intel/intel-gpu-plugin:0.36.0@sha256:2db679be62b52ac985169084ca711cab6e6c59fe543ab2ddee58163d6f8d29e0
+  plugin: docker.io/intel/intel-gpu-plugin:0.37.0@sha256:7001200071db10587fc31184eedda4f5cf291efba737adf85a8c80539f7fa5e1
   logLevel: 2
   byPathMode: single
 # affinity:
@@ -24,7 +24,7 @@ dp:
 #           operator: DoesNotExist
 
 dra:
-  image: ghcr.io/intel/intel-resource-drivers-for-kubernetes/intel-gpu-resource-driver:v0.11.0@sha256:49f38fcbee4f98d748b537b1a728a12f39e56fd208c86dc3fa32ab2162c21197
+  image: ghcr.io/intel/intel-gpu-resource-driver:v0.12.0@sha256:5be06e1cf810c6091cec17ed78a775be64323f2084038c8840f283f643ce4207
   logLevel: 2
   podHealthCheck: true
   manageBinding: false
@@ -37,7 +37,7 @@ dra:
 #           operator: DoesNotExist
 
 xpu:
-  image: ghcr.io/intel/xpumanager/xpumd:v2.1.0@sha256:67b492e40dd3c99a05abac67d45f480261b4521ed4415ff49f660f2db2691263
+  image: ghcr.io/intel/xpumanager/xpumd:v2.2.0@sha256:fdefec8e5d93f76a1c7b4dda56001b7f3c2c15eae29bfbbc8971b900e6e74ae8
   logLevel: 2
   monitoringResource: monitoring
   configMapOverride: ""

charts/gpu-base-operator/Chart.yaml

@@ -11,7 +11,7 @@ dependencies:
     condition: nfd.install
     tags:
       - nfd
-    version: ~0.18
+    version: ~0.19
     repository: https://kubernetes-sigs.github.io/node-feature-discovery/charts
 
   - name: kueue

config/nfd/base/kustomization.yaml

@@ -1,7 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- "https://github.com/kubernetes-sigs/node-feature-discovery/deployment/overlays/default?ref=v0.18.2"
+- "https://github.com/kubernetes-sigs/node-feature-discovery/deployment/overlays/default?ref=v0.19.0"
 configMapGenerator:
 - name: nfd-worker-conf
   behavior: replace

config/samples/base/clusterpolicy.yaml

@@ -15,7 +15,7 @@ spec:
     checkIntervalSeconds: 5
 
   xpu:
-    image: ghcr.io/intel/xpumanager/xpumd:v2.1.0@sha256:67b492e40dd3c99a05abac67d45f480261b4521ed4415ff49f660f2db2691263
+    image: ghcr.io/intel/xpumanager/xpumd:v2.2.0@sha256:fdefec8e5d93f76a1c7b4dda56001b7f3c2c15eae29bfbbc8971b900e6e74ae8
     logLevel: 2
     # Device Plugin monitoring resource.
     monitoringResource: monitoring

config/samples/deviceplugin/clusterpolicy.yaml

@@ -9,7 +9,7 @@ spec:
     coreTemperatureThreshold: 88
 
   dp:
-    plugin: docker.io/intel/intel-gpu-plugin:0.36.0@sha256:2db679be62b52ac985169084ca711cab6e6c59fe543ab2ddee58163d6f8d29e0
+    plugin: docker.io/intel/intel-gpu-plugin:0.37.0@sha256:7001200071db10587fc31184eedda4f5cf291efba737adf85a8c80539f7fa5e1
     byPathMode: single
 
     logLevel: 4

config/samples/dra/clusterpolicy.yaml

@@ -12,6 +12,6 @@ spec:
     checkIntervalSeconds: 12
 
   dra:
-    image: ghcr.io/intel/intel-resource-drivers-for-kubernetes/intel-gpu-resource-driver:v0.11.0@sha256:49f38fcbee4f98d748b537b1a728a12f39e56fd208c86dc3fa32ab2162c21197
+    image: ghcr.io/intel/intel-gpu-resource-driver:v0.12.0@sha256:5be06e1cf810c6091cec17ed78a775be64323f2084038c8840f283f643ce4207
     logLevel: 2
     podHealthCheck: true