build(deps): bump sigs.k8s.io/kueue from 0.18.2 to 0.18.3

[dependabot]

Bumps sigs.k8s.io/kueue from 0.18.2 to 0.18.3.

Release notes

Sourced from sigs.k8s.io/kueue's releases.

v0.18.3

Changes since v0.18.2:

Actions Required Before Upgrading

(No, really, you MUST read this before you upgrade)

• Minor releases: Review the .0 release notes for each new minor version you cross; see: v0.17.0, v0.18.0.

• Patch releases: Review the patch release notes leading up to this version, but only within this minor release line; see: v0.18.1, v0.18.2.

• RayJob: Fixed a bug where the Ray job submitter container's resources were not counted against quota when submissionMode: SidecarMode was used, causing the head PodSet to be under-counted. The head PodSet now includes the submitter sidecar (KubeRay's default 500m CPU / 200Mi memory).

  After upgrading, RayJobs using submissionMode: SidecarMode reserve the submitter sidecar's resources (default 500m CPU / 200Mi memory) on the head. ClusterQueues sized without this headroom may fail to admit such RayJobs; increase the affected ClusterQueue's CPU/memory quota accordingly. (#12726, @​kevin85421)

Changes by Kind

Bug or Regression

• AFS: Fixed ConsumedResources CPU truncating to zero when the sampling interval guard was bypassed by informer cache lag during initialization. (#12691, @​sohankunkerkar)
• AFS: Fixed a race where a sampling tick running concurrently with workload settlement could persist a skewed ConsumedResources value in LocalQueue fair-sharing status. (#12940, @​apullo777)
• AFS: Fixed consumed-resources cache initialization and warm-start recovery so LocalQueue usage is not over-counted during cache seeding, and persisted historical usage is preserved after manager restarts when workload settlement runs before LocalQueue reconciliation. (#12891, @​apullo777)
• CLI: Fix --dry-run flag being silently ignored in kueuectl resume/stop localqueue and clusterqueue subcommands. (#12624, @​carterpewpew)
• DRA: Fix an integer overflow in device-count quota accounting where a ResourceClaimTemplate with very large device counts could be admitted over quota and leave a negative used-quota in the ClusterQueue status. (#12901, @​thc1006)
• DRA: Fixed incorrect quota charging for invalid driver-published device counters by clamping them to the non-negative int64 range before computing quota charges. (#12947, @​thc1006)
• DRA: fixed a potential int64 overflow in the counter-based device quota charge computation that could under-count quota when a driver publishes very large counter values. (#12928, @​thc1006)
• ElasticJobsViaWorkloadSlices: Fix workload slice misordering that could finish a correctly-admitted elastic workload slice when 3+ slices were created within the same second. (#12964, @​mimowo)
• ElasticJobsViaWorkloadSlices: Fixed a bug where scaling a Job below its accumulated succeeded count could permanently wedge the Workload reconciler and leak quota. (#12959, @​Shreesha001)
• ElasticJobsViaWorkloadSlices: Fixed a bug where worker pods of an elastic job could be ungated after scale up, past the ClusterQueue quota; ungating is now capped to the replicas granted quota across the workload-slice chain. (#12045, @​mcochner)
• Helm: Fix helm chart failing to install with a manager CrashLoopBackoff when cert-manager integration is enabled. (#12878, @​meln5674)
• Kueue-populator: Fixed a bug where an error creating a LocalQueue was logged but not returned from Reconcile, preventing controller-runtime from retrying. LocalQueue creation failures are now aggregated and returned so the request is requeued. (#12905, @​NasitSony)
• KueueViz: Fixed a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the KueueViz Backend by strictly validating WebSocket Origin headers to prevent unauthorized cross-origin data extraction. (#12875, @​Vaishnav88sk)
• KueueViz: Fixed a Denial of Service vulnerability where an oversized WebSocket frame could exhaust backend memory (OOM). Connections now enforce an 8 KiB read limit. (#12704, @​ABHIGYAN-MOHANTA)
• KueueViz: Fixed dashboard crash caused by missing optional chaining on flavor.resources (#12668, @​ABHIGYAN-MOHANTA)
• KueueViz: Improved workloads dashboard performance by avoiding repeated Pod list operations per Workload (#12857, @​cryo-zd)
• KueueViz: backend includes HTTP server timeouts (ReadHeaderTimeout, ReadTimeout, WriteTimeout, IdleTimeout) to prevent connection resource exhaustion. (#12866, @​ABHIGYAN-MOHANTA)
• KueueViz: frontend container image now runs as a non-root user (node) to adhere to the principle of least privilege. (#12702, @​ABHIGYAN-MOHANTA)
• LeaderWorkerSet: Fixed a bug where a LeaderWorkerSet with a negative or excessively large spec.replicas could crash the Kueue controller during reconciliation and MultiKueue workload processing. Kueue now rejects spec.replicas values that are negative or greater than 1000000 (#12755, @​reruno)
• MultiKueue: Fixed a bug where obsolete remote Workloads could remain on temporarily unavailable worker clusters when the manager Workload lost its reservation or was deleted. Kueue now retries cleanup after worker clusters reconnect. (#11515, @​vamsikrishna-siddu)
• MultiKueue: Fixed a data race where reconnecting a remote cluster could swap the remote client while other goroutines were reading it, which could crash-loop the controller manager. (#12612, @​apullo777)
• MultiKueue: Fixed custom jobs using external-framework adapters being repeatedly created and deleted on worker clusters when source-cluster metadata was copied to the remote object. (#12677, @​apullo777)
• Observability: Fixed LocalQueue gauge metrics not being reported after a LocalQueue starts matching the configured metrics selector. (#12903, @​ikchifo)
• PodGroup integration: Fixed a bug that allowed Workloads corresponding to PodGroups with the WaitingForReplacementPods=True condition to be re-admitted immediately. (#12872, @​mbobrovskyi)
• ProvisioningRequest: Fix a bug where ProvisioningRequest owned by finished or evicted Workloads are not cleaned up. The CleanupProvisioningRequestsOnEviction feature gate allows cleanup on eviction to be enabled by default. (#12632, @​MatteoFari)
• RayJob: Fix the integration controller dropping Kueue admission placement constraints (nodeSelector, tolerations, nodeAffinity) for the submitter pod when submitterPodTemplate is not explicitly set and submissionMode is K8sJobMode. (#12696, @​carterpewpew)
• RayService: Fixed a bug where deleting a Kueue-managed RayService with GCS fault tolerance enabled left KubeRay's Redis cleanup Job suspended forever, leaking the RayCluster's Redis metadata namespace. Kueue now defers finalizing the RayService's Workload until the cleanup Job completes. (#12778, @​kevin85421)
• ResourceTransformations: Fixed a bug where milli-valued quantities were rounded before resource transformation multiplication. For example, multiplying 300m CPU by 1000

... (truncated)

Commits

• afd60c3 Prepare release v0.18.3 (#12968)
• d8cedf6 Semi-automated cherry pick of #12931: Fix elastic stress-job flake caused by ...
• a5884f7 [release-0.18] Fix elastic job scale-down issue with stale reclaimable pods (...
• d3799f7 Automated cherry pick of #12953: Fix milli value handling in resource transfo...
• 3e59f37 dra: clamp driver counter values to [0, MaxInt64] before charging quota (#12947)
• d11a694 call DeleteWorkload when a pending workload transitions to WorkloadOnHold (#1...
• 32e17f2 [release-0.18] Clamp AFS tick status computation and cover future LastUpdate ...
• b517ce2 build(deps): bump github.com/ray-project/kuberay/ray-operator (#12937)
• 8ad5795 Fix shouldn't re-admit workload with WaitingForReplacementPods=True test case...
• 3e6efae Fix AFS cache initialization and warm-start recovery (#12891) (#12932)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)