build(deps): bump sigs.k8s.io/kueue from 0.18.3 to 0.19.0

[dependabot]

Bumps sigs.k8s.io/kueue from 0.18.3 to 0.19.0.

Release notes

Sourced from sigs.k8s.io/kueue's releases.

v0.19.0

Changes since v0.18.0:

Actions Required Before Upgrading

(No, really, you MUST read this before you upgrade)

• Minor releases: Review the .0 release notes for each new minor version you cross; see: v0.17.0, v0.18.0.

• If you maintain an in-house integration you will need to modify the code to pass the k8s context when calling the RestorePodSetsInfo function. (#13114, @​ivnovakov)

• KueuePopulator Helm: helm uninstall removes the ClusterQueue, ResourceFlavor, Topology, ConfigMap, and RBAC created by the chart, which previously leaked after uninstall.

If you installed a previous version of the kueue-populator chart, its ConfigMap and RBAC (*-kueue-hook-* ServiceAccount/ClusterRole/ClusterRoleBinding and the *-kueue-resources ConfigMap) were created as Helm hooks and are not adopted by the new release. Delete them manually before upgrading to avoid helm upgrade/install ownership conflicts. (#12402, @​kevin85421)

• MultiKueue: Fixed a security vulnerability in locationType=Path kubeconfig handling that could allow users with MultiKueueCluster create or update access to make the controller read arbitrary files. Kueue now validates path-based kubeconfigs to stay under /etc/multikueue/kubeconfigs.

If you use locationType=Path, plan to move kubeconfig files under /etc/multikueue/kubeconfigs, or switch to locationType=Secret or ClusterProfile. This prepares your setup for future releases where MultiKueueKubeConfigPathValidation is expected to be enabled by default. (#12223, @​kannon92)

• RayCluster: Fixed a bug where the Ray autoscaler sidecar container's resources were not counted against quota when in-tree autoscaling was enabled, causing the head PodSet to be under-counted. The head PodSet now includes the autoscaler sidecar (KubeRay's default 500m CPU / 512Mi memory, or spec.autoscalerOptions.resources when set).

users with autoscaling-enabled RayClusters may need to increase their ClusterQueue CPU quota by 500m and memory quota by 512Mi per head pod to avoid admission failures after upgrading. (#12405, @​kevin85421)

• RayJob: Fixed a bug where the Ray job submitter container's resources were not counted against quota when submissionMode: SidecarMode was used, causing the head PodSet to be under-counted. The head PodSet now includes the submitter sidecar (KubeRay's default 500m CPU / 200Mi memory).

After upgrading, RayJobs using submissionMode: SidecarMode reserve the submitter sidecar's resources (default 500m CPU / 200Mi memory) on the head. ClusterQueues sized without this headroom may fail to admit such RayJobs; increase the affected ClusterQueue's CPU/memory quota accordingly. (#12454, @​kevin85421)

• TAS: A negative subGroupCount on a Workload now produces an admission warning.

Starting with the 0.20 release, a negative subGroupCount will be rejected at the API level. (#13101, @​reruno)

• WaitForPodsReady is now enabled by default. New Kueue installations and existing installations that do not explicitly configure waitForPodsReady will use the default WaitForPodsReady configuration (30 minute timeout, 30 minute recovery timeout). (#11855, @​amirialy)

Changes by Kind

Deprecation

• DRA: Remove the deprecated DynamicResourceAllocation feature gate. Use KueueDRAIntegration instead. (#12258, @​kshalot)
• MultiKueue: Added accessProviders as the preferred ClusterProfile field for configuring cluster access providers. The existing credentialsProviders field remains supported but is deprecated and cannot be used together with accessProviders. (#12011, @​kahirokunn)

API Change

• Use SchemeGroupVersion instead of GroupVersion in the API.

  If your code references the GroupVersion variable from the API, update it to use SchemeGroupVersion instead. (#12738, @​mbobrovskyi)

Feature

... (truncated)

Commits

• 911a822 Prepare release v0.19.0 (#13352)
• 32e58e8 DRA: Fix validations for capacity qualified names (#13348)
• 366dde7 Pin to a full-length commit SHA. (#13350)
• 32184c9 test: move WAS e2e to the scheduling.k8s.io/v1beta1 PodGroup API (#13336)
• e56ed76 Use common hack helpers for populator cluster lifecycle (#13324)
• a263700 fix: using AdmissionFairSharing, should preempt a workload from LQ with highe...
• 4ce0b76 test: write race detector reports to artifacts via GORACE log_path (#13333)
• ddea572 build(deps): bump google.golang.org/grpc in /hack/tools (#13330)
• 7af452c build(deps-dev): bump fast-uri in /cmd/kueueviz/frontend (#13329)
• a94a00a Inject the Link to the new published release (#13328)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)