Skip to content

Add configurable allocation policy (packed/distributed) for replicated and MIG resources - #1621

Merged
tariq1890 merged 1 commit into
NVIDIA:mainfrom
wkd-woo:feature/packed-allocation-policy
Jul 21, 2026
Merged

tariq1890 merged 1 commit into
NVIDIA:mainfrom
wkd-woo:feature/packed-allocation-policy

Conversation

@wkd-woo

@wkd-woo wkd-woo commented Feb 11, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Add --allocation-policy flag (ALLOCATION_POLICY env) with distributed (default) and packed options
  • packed mode bin-packs replicated/MIG devices onto fewest physical GPUs, freeing up remaining GPUs for full-GPU workloads
  • Default behavior (distributed) is unchanged — no breaking changes

Motivation

The current distributedAlloc was designed for time-slicing, where distributing replicas across physical GPUs avoids compute contention. However, MIG devices also fall into this code path simply because AlignedAllocationSupported() returns false for them — not because distributed allocation is the right strategy.

MIG instances are hardware-isolated partitions with dedicated SMs and memory. Packing them onto fewer physical GPUs has no performance penalty, and frees up remaining GPUs for full-GPU workloads:

┌─────────────────────────────────────────────────────────────────────┐
│                Distributed Allocation (current default)              │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  GPU 0            GPU 1            GPU 2            GPU 3           │
│  ┌──────────┐    ┌──────────┐    ┌──────────┐    ┌──────────┐      │
│  │ ████░░░░ │    │ ████░░░░ │    │ ████░░░░ │    │ ░░░░░░░░ │      │
│  │ MIG 1/5  │    │ MIG 1/5  │    │ MIG 1/5  │    │ MIG 0/5  │      │
│  └──────────┘    └──────────┘    └──────────┘    └──────────┘      │
│   ⚠ partial       ⚠ partial       ⚠ partial       ░ empty          │
│                                                                     │
│  → Full GPU request arrives: only 1 GPU available (GPU 3)           │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────────┐
│                    Packed Allocation (bin-packing)                   │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  GPU 0            GPU 1            GPU 2            GPU 3           │
│  ┌──────────┐    ┌──────────┐    ┌──────────┐    ┌──────────┐      │
│  │ ████████ │    │ ░░░░░░░░ │    │ ░░░░░░░░ │    │ ░░░░░░░░ │      │
│  │ MIG 3/5  │    │ MIG 0/5  │    │ MIG 0/5  │    │ MIG 0/5  │      │
│  └──────────┘    └──────────┘    └──────────┘    └──────────┘      │
│   ✓ packed         ★ free          ★ free          ★ free           │
│                                                                     │
│  → Full GPU request arrives: 3 GPUs available (GPU 1, 2, 3)        │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘

Relates to #491

Design

getPreferredAllocation
├─ Full GPU (AlignedAllocationSupported && no annotations)
│   └─ alignedAlloc (topology-based, unaffected by this change)
│
└─ MIG / time-slicing / MPS
├─ allocationPolicy=packed  → packedAlloc (new)
└─ allocationPolicy=distributed (default) → distributedAlloc (existing, unmodified)

Key decisions:

  • distributedAlloc is completely untouched — packedAlloc is a separate function following the existing alignedAlloc/distributedAlloc pattern
  • Full GPU nodes are unaffected — alignedAlloc is selected before allocationPolicy is ever checked, so setting packed on a full-GPU node has no effect
  • Flag applies uniformly — when packed is set, it applies to MIG, time-slicing, and MPS. Silently ignoring a user-set flag for specific device types would be inconsistent
  • Per-node config supported — works with existing config-manager + ConfigMap + node label (nvidia.com/device-plugin.config) mechanism via YAML config

Usage

CLI flag / Environment variable

--allocation-policy=packed
# or
ALLOCATION_POLICY=packed
Config file (per-node via ConfigMap + node label)

version: v1
flags:
  migStrategy: mixed
  plugin:
    allocationPolicy: packed

kubectl label node mig-node nvidia.com/device-plugin.config=mig-packed

Test plan

  • TestDistributedAlloc (6 cases) — existing distributed behavior regression
  • TestDistributedAllocIsDefault — default consistency verified over 10 iterations
  • TestPackedAlloc (6 cases) — bin-packing: same GPU priority, overflow to next GPU
  • TestPackedVsDistributedContrast — two strategies produce different results on same input
  • TestFullGPUNodeIgnoresAllocationPolicy (3 sub-cases) — full GPU / MIG / replicated branch path verification
    All existing internal/rm/ tests pass unchanged

@copy-pr-bot

copy-pr-bot Bot commented Feb 11, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@wkd-woo
wkd-woo force-pushed the feature/packed-allocation-policy branch from 421e3c9 to 6686d1a Compare February 11, 2026 09:06
@ottowhite

ottowhite commented Feb 15, 2026 •

Copy link
Copy Markdown

Hi! Very cool idea, I actually really want a very similar custom allocation policy for replicated (non-MIG) resources, but for enabling bin-packing replicas with topology-awareness.

For example, this would could enable the allocation of 1.6 GPUs to a single model, with two tensor parallel ranks across 2 GPUs, 0.8 GPUs allocated to each tensor parallel tank, and both within a single NVLink domain (see my pretty diagram for an example). This would avoid excessive communication overhead during matrix multiplications across both tensor parallel model ranks, while leaving the 0.4 GPUs left over to be allocated to a smaller model, decreasing latency and increasing throughput in (surprisingly common) multi-model deployment scenarios including RAG with LLMs + Embedding models.

image

I believe the implementation of this policy is essentially a composite between what you've implemented, and the alignedAlloc code path which uses go-gpuallocator (gaining topology-awareness through NVML). At present, any of the replicated resource code paths discard topology awareness in favour of evenly load balancing GPU fractions with the distributed allocation policy, which prevents the use-case that I'm after.

Would be great if you're interested in discussing this more. I wonder if it's possible to slip it in with this PR? Also happy to contribute if that helps.

Comment thread internal/rm/allocate.go Outdated
jid := AnnotatedID(candidates[j]).GetID()
idiff := replicas[iid].total - replicas[iid].available
jdiff := replicas[jid].total - replicas[jid].available
return idiff > jdiff

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Was the only change in this function and distributedAlloc the comparator between idiff and jdiff? Can we just pass in an enum and then have a condition on the enum to dictate this behavior? There is a lot of code duplication at the moment.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the review!

The duplication is intentional — I wanted distributedAlloc to stay completely untouched so reviewers can verify there's zero behavioral change just by looking at the diff.

On merging them: the two functions share the same structure because packed is just the inverse of distributed (flipped comparator). But as you mentioned with topology-aware bin-packing, a future policy would need NVML topology data and different sorting logic entirely — so I'd rather keep them separate now than merge and split again later.

That said, happy to extract the common setup (candidate filtering + replica counting) into a shared helper if that feels cleaner.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No problem :) to be honest I think it would actually be easier to review/maintain if you generalised the allocation function slightly.

It could be generalised to fractionalAlloc, taking an enum that allows distributedFractionPlacement or packedFractionPlacement policies. Then internally you just pick the comparator based on the policy.

What you suggested with pulling out the common helpers such as candidate filtering and replica counting is probably even better than the generalisation I suggested, as it enables the policies to be kept completely separate, and is more extensible in that it enables easier implementation of new policies again such as the topology-aware one.

When I was reviewing the code, I pulled up both distributedAlloc and packedAlloc side by side and was cross-checking for a while before I saw the flipped comparator. I expect other reviewers and contributors to go through a similar process. This is just my two cents though.

You've also improved the state of testing so that's an additional signal that this is functionally equivalent to what there was before.

In terms of the different topology-aware placement policy, I think it makes sense to keep it separate for now. But cool that you're opening this up and making it more configurable! I may build off of this myself.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ottowhite I've extracted prepareCandidates in the second commit.
Each policy function now only has its sorting logic, so the difference should be immediately visible

@ottowhite ottowhite Feb 17, 2026 •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking better! There's still quite a bit of duplication across both of the Alloc functions. What is common is that they're both greedy allocation algorithms (repeatedly evaluating and selecting the next best option, without looking further ahead). Could you extract this into another helper greedyDeviceAlloc or something similar that makes the difference between these two functions even clearer? Could pass in a candidate comparator. It will also be much clearer to extend with other greedy allocation policies. For example the one that I spoke about is another greedy allocation algorithm that happens to use topology-awareness in it's comparator.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree that we should have a map of comparator functions to choose from. And a helper function that keeps the common portion in one place.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done in 4afcd2e :) distributedAlloc/packedAlloc are gone — there is now a single greedyAlloc that takes a comparator, plus an allocationComparators map keyed by policy. The difference between the two policies ends up being just < vs > in the map. Unknown policies fall back to distributed (covered by a new test), and the existing tests pass unchanged.

@wkd-woo
wkd-woo force-pushed the feature/packed-allocation-policy branch 2 times, most recently from 8656ef3 to 2839bfc Compare February 17, 2026 12:22
@ottowhite

ottowhite commented Feb 17, 2026 •

Copy link
Copy Markdown

Also, is there a reason why the alignedAlloc happens to be in nvml_manager.go? It seems like just another allocation policy that would be more suited to be in allocate.go rather than there. I know this is not due to your code change but moving it there could improve the organisation of the code, and ease to extend with different allocation policies.

@wkd-woo

wkd-woo commented Feb 17, 2026

Copy link
Copy Markdown
Contributor Author

Thank @ottowhite for your review :)
On moving alignedAlloc — agreed it could improve organization, but I'd rather keep this PR focused on the new feature and not restructure existing code!

I'd like to hear from a maintainer at this point to see if the current direction works.

@ottowhite

Copy link
Copy Markdown

Fair enough! Though I think those refactors would be a minor improvement for organisation/extensibility, I think the testing is strong and implementation is solid.

LGTM!

Will be great to hear what the maintainers have to say. Also really keen on this feature and the more extensible policy opportunities that it opens up.

@ottowhite

ottowhite commented Feb 19, 2026 •

Copy link
Copy Markdown

Hey! By the way we're running your packedAlloc allocation policy and it's working for multi-GPU deployments. We will imminently be forking and building off it it.

@wkd-woo

wkd-woo commented Feb 25, 2026

Copy link
Copy Markdown
Contributor Author

Hi @elezar, just checking in to see if there's anything else needed from my side to move this forward. I'm happy to address any feedback :)

@wkd-woo

wkd-woo commented Jun 16, 2026

Copy link
Copy Markdown
Contributor Author

Hi @rajatchopra, could you take a look at this PR when you have a chance?
I'd appreciate your feedback.

@rajatchopra rajatchopra left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

Pending:

  • rebase after #1788 merges
  • squash commits

@tariq1890

Copy link
Copy Markdown
Contributor

@wkd-woo Please rebase your PR on top of the latest main.

@wkd-woo
wkd-woo force-pushed the feature/packed-allocation-policy branch from 4afcd2e to 59665d8 Compare July 1, 2026 03:12
@wkd-woo

wkd-woo commented Jul 1, 2026 •

Copy link
Copy Markdown
Contributor Author

@rajatchopra @tariq1890 Rebased onto latest main (now includes #1788) and squashed into a single commit as requested.

Heads-up — this was not a clean rebase, so this needs another look before merge. #1788 landed the day after your /lgtm and it touches the exact same allocation path this PR refactors, so I had to reconcile them by hand:

To keep both, I folded the tie-break into greedyAlloc as a secondary sort key applied only when the comparator ranks two GPUs equally:

 sort.Slice(candidates, func(i, j int) bool {
     iid := AnnotatedID(candidates[i]).GetID()
     jid := AnnotatedID(candidates[j]).GetID()
-    return preferred(replicas[iid], replicas[jid])
+    ri, rj := replicas[iid], replicas[jid]
+    if preferred(ri, rj) {
+        return true
+    }
+    if preferred(rj, ri) {
+        return false
+    }
+    // comparator ranks the two GPUs equally -> prefer the physical
+    // device touched least during this allocation
+    return pickedFrom[iid] < pickedFrom[jid]
 })

This is the only logic change beyond the code you approved. It's required rather than optional: without it, #1788's regression test now fails on this branch (both replicas stack onto GPU-0); with it, the distributed policy keeps spreading. It's a no-op for packed, whose comparator dominates once packing starts. All internal/rm tests pass (TestDistributedAlloc, TestPackedAlloc, TestDistributedAllocIsDefault, TestPackedVsDistributedContrast, TestFullGPUNodeIgnoresAllocationPolicy, and #1788's TestDistributedAlloc_PartiallyAllocated_...).

PTAL when you get a chance.

@wkd-woo

wkd-woo commented Jul 1, 2026

Copy link
Copy Markdown
Contributor Author

cc @tariq1890 — flagging for the merge: this was rebased onto main after #1788 with one small logic change beyond @rajatchopra's /lgtm (folded #1788's distributed-allocation tie-break into this PR's new greedyAlloc — details and diff in the comment above). It's a no-op for packed, and all internal/rm tests pass including #1788's regression test. Should be ready to merge once CI is green — thanks!

@rajatchopra

rajatchopra commented Jul 20, 2026 •

Copy link
Copy Markdown
Contributor

@wkd-woo >> To keep both, I folded the tie-break into greedyAlloc as a secondary sort key applied only when the comparator ranks two GPUs equally
That is good work resolving the conflicts. Thanks. Needs another benign rebase though.

@rajatchopra rajatchopra left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@wkd-woo
wkd-woo force-pushed the feature/packed-allocation-policy branch from 59665d8 to b2c3adf Compare July 20, 2026 08:09
@wkd-woo

wkd-woo commented Jul 20, 2026 •

Copy link
Copy Markdown
Contributor Author

@rajatchopra Rebased onto latest main. Clean, no conflicts, and all tests pass. Thanks!

cc. @tariq1890

Comment thread cmd/nvidia-device-plugin/main.go Outdated
case spec.AllocationPolicyDistributed:
case spec.AllocationPolicyPacked:
default:
return fmt.Errorf("invalid --allocation-policy option: %v", *config.Flags.Plugin.AllocationPolicy)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
return fmt.Errorf("invalid --allocation-policy option: %v", *config.Flags.Plugin.AllocationPolicy)
return fmt.Errorf("invalid --allocation-policy option: %s", *config.Flags.Plugin.AllocationPolicy)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍
Will Apply.

Comment thread internal/rm/allocate.go Outdated
// Get the set of candidate devices as the difference between available and required.
// replicaCount tracks the total and available replica counts for a physical GPU.
type replicaCount struct {
total, available int

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
total, available int
total int
available int

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍
Will Apply.

Comment thread cmd/nvidia-device-plugin/main.go Outdated
Name: "allocation-policy",
Value: spec.AllocationPolicyDistributed,
Usage: "the allocation policy for replicated and MIG resources:\n\t\t[distributed | packed]",
EnvVars: []string{"ALLOCATION_POLICY"},

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we come up with a more specific name here? The name ALLOCATION_POLICY does not lend itself to an allocation policy used for replicated and MIG devices.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about SHARED_DEVICES_ALLOCATION_POLICY?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed.

Will rename to SHARED_DEVICES_ALLOCATION_POLICY / --shared-devices-allocation-policy, and update the config field to match.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you !

Comment thread internal/rm/allocate.go Outdated
Comment on lines +123 to +127
if preferred(ri, rj) {
return true
}
if preferred(rj, ri) {
return false

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would this work?

Suggested change
if preferred(ri, rj) {
return true
}
if preferred(rj, ri) {
return false
if ri.allocated() != rj.allocated() {
return preferred(ri, rj)
}

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, that works. Both comparators only order by allocated(), so it comes out the same. I went with the two-way check to avoid assuming what the comparator compares, but with just these two policies that's probably overkill.
Will apply it, and add a small test on the comparators to cover that assumption.

@tariq1890

Copy link
Copy Markdown
Contributor

@wkd-woo Thank you very much for your patience with this PR and I appreciate all the work you've put in. Just a few more comments, but we are definitely looking to merge this and ensure that this lands in the next release of the device-plugin.

@wkd-woo
wkd-woo force-pushed the feature/packed-allocation-policy branch from b2c3adf to b8c575e Compare July 21, 2026 02:41
@wkd-woo

wkd-woo commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

@tariq1890 Applied all four in b8c575ef, tests pass 🙏

@tariq1890

Copy link
Copy Markdown
Contributor

Can you squash your commit history?

@wkd-woo
wkd-woo force-pushed the feature/packed-allocation-policy branch from 14e9131 to 196c7c0 Compare July 21, 2026 05:25
@wkd-woo

wkd-woo commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

@tariq1890 Squashed !

@tariq1890 tariq1890 added this to the v0.20.0 milestone Jul 21, 2026
@tariq1890

Copy link
Copy Markdown
Contributor

/ok to test 196c7c0

@tariq1890

tariq1890 commented Jul 21, 2026 •

Copy link
Copy Markdown
Contributor

@wkd-woo. Your commit is not signed. See here for context.

…d and MIG resources

The existing allocation spreads replicated devices evenly across
physical GPUs (distributed), which was designed for time-slicing where
workloads compete for shared compute. MIG instances, however, are
hardware-isolated and do not suffer from contention when packed onto the
same GPU.

This adds a --shared-devices-allocation-policy flag
(env: SHARED_DEVICES_ALLOCATION_POLICY) with two
options: "distributed" (default, preserving current behavior) and
"packed" (bin-packing onto the fewest physical GPUs). The packed policy
frees up entire GPUs for full-GPU workloads in mixed clusters. The flag
applies uniformly to all non-aligned allocation paths (MIG,
time-slicing, MPS) and can be configured per-node via ConfigMap and the
nvidia.com/device-plugin.config node label. Full-GPU nodes are
unaffected: alignedAlloc is selected before the policy is ever consulted.

Both policies share a single greedyAlloc helper that differs only in a
replicaComparator, selected from an allocationComparators map keyed by
policy (comparatorForPolicy falls back to distributed for unknown
values). This keeps the strategies expressed as a flipped comparator and
lets future policies be added as new map entries without duplicating the
selection loop. When the comparator ranks two physical GPUs equally, a
per-allocation pickedFrom tie-break rotates to the least-touched sibling,
preserving distribution across physical GPUs.

Relates to NVIDIA#491

Signed-off-by: wkd-woo <wkdwoos@gmail.com>
@wkd-woo
wkd-woo force-pushed the feature/packed-allocation-policy branch from 196c7c0 to 891d77f Compare July 21, 2026 17:13
@wkd-woo

wkd-woo commented Jul 21, 2026 •

Copy link
Copy Markdown
Contributor Author

@tariq1890 Signed the commit. Thank you for your patience.

@tariq1890

Copy link
Copy Markdown
Contributor

/ok to test 891d77f

@tariq1890
tariq1890 merged commit 88a79d7 into NVIDIA:main Jul 21, 2026
38 of 41 checks passed
jonathan-meiri pushed a commit to jonathan-meiri/k8s-device-plugin that referenced this pull request Jul 22, 2026
Follow-up on top of NVIDIA#1621, which introduced the shared greedyAlloc loop
with a pluggable replicaComparator (distributed vs packed). The loop
still sorts the full candidate slice inside the allocation loop, paying
O(n log n) per iteration for n iterations and giving O(n² log n) overall.

Since all annotated replicas from the same underlying physical device
share the same sort key, sorting at the replica granularity is wasted
work — only m (the number of distinct physical devices contributing
candidates) needs to be reordered.

Refactor greedyAlloc to bucket candidates by their underlying physical
device into a small gpuAllocState per device, holding a shared
*replicaCount, the pickedFrom counter, and the remaining candidate IDs.
A gpuPriorityQueue defers to the caller-supplied replicaComparator on
allocated() for primary ordering and to pickedFrom for the tie-break
(unchanged semantics). Each iteration pops the best device, takes one
of its remaining replicas, updates counters, and pushes it back if any
remain.

Total cost drops to O(n log m). Both allocation policies (distributed
and packed) benefit; no behavior change — the existing test suite
(TestDistributedAlloc, TestPackedAlloc, TestPackedVsDistributedContrast,
TestDistributedAlloc_PartiallyAllocated_DistributesAcrossDistinctGPUs,
etc.) passes unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: runatom-ai <258621014+runatom-ai@users.noreply.github.com>
Signed-off-by: Jonathan Meiri <33288957+Meiri28@users.noreply.github.com>
jonathan-meiri pushed a commit to jonathan-meiri/k8s-device-plugin that referenced this pull request Jul 26, 2026
Follow-up on top of NVIDIA#1621, which introduced the shared greedyAlloc loop
with a pluggable replicaComparator (distributed vs packed). The loop
still sorts the full candidate slice inside the allocation loop, paying
O(n log n) per iteration for n iterations and giving O(n² log n) overall.

Since all annotated replicas from the same underlying physical device
share the same sort key, sorting at the replica granularity is wasted
work — only m (the number of distinct physical devices contributing
candidates) needs to be reordered.

Refactor greedyAlloc to bucket candidates by their underlying physical
device into a small gpuAllocState per device, holding a shared
*replicaCount, the pickedFrom counter, and the remaining candidate IDs.
A gpuPriorityQueue defers to the caller-supplied replicaComparator on
allocated() for primary ordering and to pickedFrom for the tie-break
(unchanged semantics). Each iteration pops the best device, takes one
of its remaining replicas, updates counters, and pushes it back if any
remain.

Total cost drops to O(n log m). Both allocation policies (distributed
and packed) benefit; no behavior change — the existing test suite
(TestDistributedAlloc, TestPackedAlloc, TestPackedVsDistributedContrast,
TestDistributedAlloc_PartiallyAllocated_DistributesAcrossDistinctGPUs,
etc.) passes unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: runatom-ai <258621014+runatom-ai@users.noreply.github.com>
Signed-off-by: Jonathan Meiri <33288957+Meiri28@users.noreply.github.com>
jonathan-meiri pushed a commit to jonathan-meiri/k8s-device-plugin that referenced this pull request Jul 28, 2026
Follow-up on top of NVIDIA#1621, which introduced the shared greedyAlloc loop
with a pluggable replicaComparator (distributed vs packed). The loop
still sorts the full candidate slice inside the allocation loop, paying
O(n log n) per iteration for n iterations and giving O(n² log n) overall.

Since all annotated replicas from the same underlying physical device
share the same sort key, sorting at the replica granularity is wasted
work — only m (the number of distinct physical devices contributing
candidates) needs to be reordered.

Refactor greedyAlloc to bucket candidates by their underlying physical
device into a small gpuAllocState per device, holding a shared
*replicaCount, the pickedFrom counter, and the remaining candidate IDs.
A gpuPriorityQueue defers to the caller-supplied replicaComparator on
allocated() for primary ordering and to pickedFrom for the tie-break
(unchanged semantics). Each iteration pops the best device, takes one
of its remaining replicas, updates counters, and pushes it back if any
remain.

Total cost drops to O(n log m). Both allocation policies (distributed
and packed) benefit; no behavior change — the existing test suite
(TestDistributedAlloc, TestPackedAlloc, TestPackedVsDistributedContrast,
TestDistributedAlloc_PartiallyAllocated_DistributesAcrossDistinctGPUs,
etc.) passes unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: runatom-ai <258621014+runatom-ai@users.noreply.github.com>
Signed-off-by: Jonathan Meiri <33288957+Meiri28@users.noreply.github.com>
jonathan-meiri pushed a commit to jonathan-meiri/k8s-device-plugin that referenced this pull request Aug 2, 2026
Follow-up on top of NVIDIA#1621, which introduced the shared greedyAlloc loop
with a pluggable replicaComparator (distributed vs packed). The loop
still sorts the full candidate slice inside the allocation loop, paying
O(n log n) per iteration for n iterations and giving O(n² log n) overall.

Since all annotated replicas from the same underlying physical device
share the same sort key, sorting at the replica granularity is wasted
work — only m (the number of distinct physical devices contributing
candidates) needs to be reordered.

Refactor greedyAlloc to bucket candidates by their underlying physical
device into a small gpuAllocState per device, holding a shared
*replicaCount, the pickedFrom counter, and the remaining candidate IDs.
A gpuPriorityQueue defers to the caller-supplied replicaComparator on
allocated() for primary ordering and to pickedFrom for the tie-break
(unchanged semantics). Each iteration pops the best device, takes one
of its remaining replicas, updates counters, and pushes it back if any
remain.

Total cost drops to O(n log m). Both allocation policies (distributed
and packed) benefit; no behavior change — the existing test suite
(TestDistributedAlloc, TestPackedAlloc, TestPackedVsDistributedContrast,
TestDistributedAlloc_PartiallyAllocated_DistributesAcrossDistinctGPUs,
etc.) passes unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: runatom-ai <258621014+runatom-ai@users.noreply.github.com>
Signed-off-by: Jonathan Meiri <33288957+Meiri28@users.noreply.github.com>
jonathan-meiri pushed a commit to jonathan-meiri/k8s-device-plugin that referenced this pull request Aug 6, 2026
Follow-up on top of NVIDIA#1621, which introduced the shared greedyAlloc loop
with a pluggable replicaComparator (distributed vs packed). The loop
still sorts the full candidate slice inside the allocation loop, paying
O(n log n) per iteration for n iterations and giving O(n² log n) overall.

Since all annotated replicas from the same underlying physical device
share the same sort key, sorting at the replica granularity is wasted
work — only m (the number of distinct physical devices contributing
candidates) needs to be reordered.

Refactor greedyAlloc to bucket candidates by their underlying physical
device into a small gpuAllocState per device, holding a shared
*replicaCount, the pickedFrom counter, and the remaining candidate IDs.
A gpuPriorityQueue defers to the caller-supplied replicaComparator on
allocated() for primary ordering and to pickedFrom for the tie-break
(unchanged semantics). Each iteration pops the best device, takes one
of its remaining replicas, updates counters, and pushes it back if any
remain.

Total cost drops to O(n log m). Both allocation policies (distributed
and packed) benefit; no behavior change — the existing test suite
(TestDistributedAlloc, TestPackedAlloc, TestPackedVsDistributedContrast,
TestDistributedAlloc_PartiallyAllocated_DistributesAcrossDistinctGPUs,
etc.) passes unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: runatom-ai <258621014+runatom-ai@users.noreply.github.com>
Signed-off-by: Jonathan Meiri <33288957+Meiri28@users.noreply.github.com>
jonathan-meiri pushed a commit to jonathan-meiri/k8s-device-plugin that referenced this pull request Aug 12, 2026
Follow-up on top of NVIDIA#1621, which introduced the shared greedyAlloc loop
with a pluggable replicaComparator (distributed vs packed). The loop
still sorts the full candidate slice inside the allocation loop, paying
O(n log n) per iteration for n iterations and giving O(n² log n) overall.

Since all annotated replicas from the same underlying physical device
share the same sort key, sorting at the replica granularity is wasted
work — only m (the number of distinct physical devices contributing
candidates) needs to be reordered.

Refactor greedyAlloc to bucket candidates by their underlying physical
device into a small gpuAllocState per device, holding a shared
*replicaCount, the pickedFrom counter, and the remaining candidate IDs.
A gpuPriorityQueue defers to the caller-supplied replicaComparator on
allocated() for primary ordering and to pickedFrom for the tie-break
(unchanged semantics). Each iteration pops the best device, takes one
of its remaining replicas, updates counters, and pushes it back if any
remain.

Total cost drops to O(n log m). Both allocation policies (distributed
and packed) benefit; no behavior change — the existing test suite
(TestDistributedAlloc, TestPackedAlloc, TestPackedVsDistributedContrast,
TestDistributedAlloc_PartiallyAllocated_DistributesAcrossDistinctGPUs,
etc.) passes unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: runatom-ai <258621014+runatom-ai@users.noreply.github.com>
Signed-off-by: Jonathan Meiri <33288957+Meiri28@users.noreply.github.com>
jonathan-meiri pushed a commit to jonathan-meiri/k8s-device-plugin that referenced this pull request Sep 1, 2026
Follow-up on top of NVIDIA#1621, which introduced the shared greedyAlloc loop
with a pluggable replicaComparator (distributed vs packed). The loop
still sorts the full candidate slice inside the allocation loop, paying
O(n log n) per iteration for n iterations and giving O(n² log n) overall.

Since all annotated replicas from the same underlying physical device
share the same sort key, sorting at the replica granularity is wasted
work — only m (the number of distinct physical devices contributing
candidates) needs to be reordered.

Refactor greedyAlloc to bucket candidates by their underlying physical
device into a small gpuAllocState per device, holding a shared
*replicaCount, the pickedFrom counter, and the remaining candidate IDs.
A gpuPriorityQueue defers to the caller-supplied replicaComparator on
allocated() for primary ordering and to pickedFrom for the tie-break
(unchanged semantics). Each iteration pops the best device, takes one
of its remaining replicas, updates counters, and pushes it back if any
remain.

Total cost drops to O(n log m). Both allocation policies (distributed
and packed) benefit; no behavior change — the existing test suite
(TestDistributedAlloc, TestPackedAlloc, TestPackedVsDistributedContrast,
TestDistributedAlloc_PartiallyAllocated_DistributesAcrossDistinctGPUs,
etc.) passes unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: runatom-ai <258621014+runatom-ai@users.noreply.github.com>
Signed-off-by: Jonathan Meiri <33288957+Meiri28@users.noreply.github.com>
jonathan-meiri pushed a commit to jonathan-meiri/k8s-device-plugin that referenced this pull request Sep 3, 2026
Follow-up on top of NVIDIA#1621, which introduced the shared greedyAlloc loop
with a pluggable replicaComparator (distributed vs packed). The loop
still sorts the full candidate slice inside the allocation loop, paying
O(n log n) per iteration for n iterations and giving O(n² log n) overall.

Since all annotated replicas from the same underlying physical device
share the same sort key, sorting at the replica granularity is wasted
work — only m (the number of distinct physical devices contributing
candidates) needs to be reordered.

Refactor greedyAlloc to bucket candidates by their underlying physical
device into a small gpuAllocState per device, holding a shared
*replicaCount, the pickedFrom counter, and the remaining candidate IDs.
A gpuPriorityQueue defers to the caller-supplied replicaComparator on
allocated() for primary ordering and to pickedFrom for the tie-break
(unchanged semantics). Each iteration pops the best device, takes one
of its remaining replicas, updates counters, and pushes it back if any
remain.

Total cost drops to O(n log m). Both allocation policies (distributed
and packed) benefit; no behavior change — the existing test suite
(TestDistributedAlloc, TestPackedAlloc, TestPackedVsDistributedContrast,
TestDistributedAlloc_PartiallyAllocated_DistributesAcrossDistinctGPUs,
etc.) passes unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: runatom-ai <258621014+runatom-ai@users.noreply.github.com>
Signed-off-by: Jonathan Meiri <33288957+Meiri28@users.noreply.github.com>
tariq1890 added a commit that referenced this pull request Sep 15, 2026
* fix: handle dangling symlink in config-manager updateSymlink

Signed-off-by: yoonhyunwoo <yjs88zerg@gmail.com>
(cherry picked from commit 1a69452)

* fix: address review feedback on config-manager symlink handling

Wrap errors with %w instead of %v/%s so callers can unwrap them, and
drop the redundant quoting since logs are already emitted in JSON.

Split TestUpdateSymlinkDanglingDestination into independent subtests
that each set up their own state via a shared fixture helper, so
either case passes when run in isolation rather than depending on
execution order.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
(cherry picked from commit 4855607)

* perf(rm): replace per-iteration sort in greedyAlloc with a min-heap

Follow-up on top of #1621, which introduced the shared greedyAlloc loop
with a pluggable replicaComparator (distributed vs packed). The loop
still sorts the full candidate slice inside the allocation loop, paying
O(n log n) per iteration for n iterations and giving O(n² log n) overall.

Since all annotated replicas from the same underlying physical device
share the same sort key, sorting at the replica granularity is wasted
work — only m (the number of distinct physical devices contributing
candidates) needs to be reordered.

Refactor greedyAlloc to bucket candidates by their underlying physical
device into a small gpuAllocState per device, holding a shared
*replicaCount, the pickedFrom counter, and the remaining candidate IDs.
A gpuPriorityQueue defers to the caller-supplied replicaComparator on
allocated() for primary ordering and to pickedFrom for the tie-break
(unchanged semantics). Each iteration pops the best device, takes one
of its remaining replicas, updates counters, and pushes it back if any
remain.

Total cost drops to O(n log m). Both allocation policies (distributed
and packed) benefit; no behavior change — the existing test suite
(TestDistributedAlloc, TestPackedAlloc, TestPackedVsDistributedContrast,
TestDistributedAlloc_PartiallyAllocated_DistributesAcrossDistinctGPUs,
etc.) passes unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: runatom-ai <258621014+runatom-ai@users.noreply.github.com>
Signed-off-by: Jonathan Meiri <33288957+Meiri28@users.noreply.github.com>
(cherry picked from commit c3b47c6)

* test(rm): add BenchmarkGreedyAlloc

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: runatom-ai <258621014+runatom-ai@users.noreply.github.com>
Signed-off-by: Jonathan Meiri <33288957+Meiri28@users.noreply.github.com>
(cherry picked from commit 498aba4)

* Go Modernize changes (#1996)

* Go Modernize changes and add modernize to the lint rules

---------

Signed-off-by: Karthikeyan Valliyurnatt <kvalliyurnat@nvidia.com>
(cherry picked from commit ad5bc6c)

* validate vGPU capability record lengths (#1994)

(cherry picked from commit 4edf2b6)

* include component-specific DaemonSet selector labels to avoid selector overlap

Changes include:
- opt-in Helm setting to include component-specific DaemonSet selector labels to avoid selector overlap across device-plugin, GFD, and MPS control daemon
- disabled by default to avoid breaking upgrades (DaemonSet selectors are immutable and enabling requires DaemonSet recreation)

Signed-off-by: Rahul Sharma <rahulsharm@nvidia.com>
(cherry picked from commit 0e3ff25)

---------

Signed-off-by: yoonhyunwoo <yjs88zerg@gmail.com>
Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
Signed-off-by: Jonathan Meiri <33288957+Meiri28@users.noreply.github.com>
Signed-off-by: Karthikeyan Valliyurnatt <kvalliyurnat@nvidia.com>
Signed-off-by: Rahul Sharma <rahulsharm@nvidia.com>
Co-authored-by: yoonhyunwoo <yjs88zerg@gmail.com>
Co-authored-by: Abrar Shivani <ashivani@nvidia.com>
Co-authored-by: Jonathan Meiri <33288957+Meiri28@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: runatom-ai <258621014+runatom-ai@users.noreply.github.com>
Co-authored-by: Karthikeyan Valliyurnatt <135071014+kvalliyurnatt@users.noreply.github.com>
Co-authored-by: Rahul Sharma <rahulsharm@nvidia.com>
Superkooka added a commit to Superkooka/infra-gitops that referenced this pull request Sep 19, 2026
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | minor | `v1.19.x` → `1.21.x` |
| [longhorn](https://github.com/longhorn/longhorn) ([source](https://github.com/longhorn/charts)) | minor | `v1.11.1` → `1.12.1` |
| [nvidia-device-plugin](https://github.com/NVIDIA/k8s-device-plugin) | minor | `0.17.0` → `0.20.0` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/6) for more information.

---

### Release Notes

<details>
<summary>cert-manager/cert-manager (cert-manager)</summary>

### [`v1.21.2`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.2)

[Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.1...v1.21.2)

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.2 fixes controller and webhook panics, data races, ACME renewal and HTTP-01 solver bugs, and a Gateway API dnsNames bug. It stops the ACME and Vault issuers copying untrusted HTTP response bodies into status conditions and Events, and tightens ambient AWS credential use for namespaced Vault Issuers. It also updates Go and several dependencies to fix reported security vulnerabilities.

All users should upgrade.

#### Changes by Kind

##### Bug or Regression

- ACME Issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events. Only ACME problem documents are surfaced (bounded in length); other responses are reported by HTTP status code alone, with the full error available in the controller logs. ([#&#8203;9239](https://github.com/cert-manager/cert-manager/issues/9239), [@&#8203;FelixPhipps](https://github.com/FelixPhipps))
- Cap ACME server response bodies at 16 MiB to guard against unbounded-body denial-of-service. ([#&#8203;9222](https://github.com/cert-manager/cert-manager/issues/9222), [@&#8203;FelixPhipps](https://github.com/FelixPhipps))
- De-duplicate dnsNames when multiple Gateway/ListenerSet listeners share a Secret ([#&#8203;9234](https://github.com/cert-manager/cert-manager/issues/9234), [@&#8203;speer](https://github.com/speer))
- Fix certificate renewal windows using February 29 cron schedules across non-leap century years. ([#&#8203;9240](https://github.com/cert-manager/cert-manager/issues/9240), [@&#8203;wieghx](https://github.com/wieghx))
- Fix validating webhook panics when AdmissionReview requests omit optional fields, by routing identity, approval, and resource validation on the always-present Resource/SubResource fields and denying (rather than silently allowing) requests with an unset or mismatched resource. As a side effect, validation is now also enforced for equivalent-converted requests on non-v1 API versions, which previously could skip validation. ([#&#8203;9235](https://github.com/cert-manager/cert-manager/issues/9235), [@&#8203;lunarwhite](https://github.com/lunarwhite))
- Fixed HTTP-01 solver cleanup so that a solver ingress, pod or service that has already been deleted no longer fails the cleanup with a NotFound error. ([#&#8203;9278](https://github.com/cert-manager/cert-manager/issues/9278), [@&#8203;arpitjain099](https://github.com/arpitjain099))
- Fixed a bug where `replaces` field was being populated for the wrong issuer on issuer changes ([#&#8203;9236](https://github.com/cert-manager/cert-manager/issues/9236), [@&#8203;hjoshi123](https://github.com/hjoshi123))
- Fixed a data race in the ACME HTTP-01 self-check that could occur when custom DNS servers were configured. ([#&#8203;9313](https://github.com/cert-manager/cert-manager/issues/9313), [@&#8203;shashankvarma499](https://github.com/shashankvarma499))
- Fixed a panic in the certificates-issuing controller when a CertificateRequest has a failure time set but no Ready condition. ([#&#8203;9238](https://github.com/cert-manager/cert-manager/issues/9238), [@&#8203;thc1006](https://github.com/thc1006))
- Fixed a race in pkg/scheduler where the cleanup of a fired timer could cancel a newer timer scheduled for the same object, silently dropping a rescheduled poll. ([#&#8203;9312](https://github.com/cert-manager/cert-manager/issues/9312), [@&#8203;shashankvarma499](https://github.com/shashankvarma499))
- Fixed an issue where the body of a non-Vault HTTP response from `spec.vault.server` could be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted. ([#&#8203;9262](https://github.com/cert-manager/cert-manager/issues/9262), [@&#8203;FelixPhipps](https://github.com/FelixPhipps))
- Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects ([#&#8203;9314](https://github.com/cert-manager/cert-manager/issues/9314), [@&#8203;KR-Ravindra](https://github.com/KR-Ravindra))
- The ACME HTTP-01 self-check no longer reflects the fetched response body in `Challenge.status.reason`, preventing disclosure of internal response contents reachable via redirects. The response is still available in the controller's debug logs. ([#&#8203;9232](https://github.com/cert-manager/cert-manager/issues/9232), [@&#8203;FelixPhipps](https://github.com/FelixPhipps))
- The `vault` issuer no longer authenticates to Vault using the cert-manager controller's ambient AWS credentials for AWS IAM auth on a namespaced `Issuer`, unless ambient credentials are explicitly enabled via `--issuer-ambient-credentials`. `ClusterIssuer` and explicit `serviceAccountRef` (IRSA) configurations are unaffected. ([#&#8203;9231](https://github.com/cert-manager/cert-manager/issues/9231), [@&#8203;FelixPhipps](https://github.com/FelixPhipps))

##### Other (Cleanup or Flake)

- Upgrade Go to 1.26.6, which includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages. ([#&#8203;9151](https://github.com/cert-manager/cert-manager/issues/9151), [@&#8203;wallrj](https://github.com/wallrj))
- Upgrade Go to 1.26.8. ([#&#8203;9323](https://github.com/cert-manager/cert-manager/issues/9323), [@&#8203;wallrj](https://github.com/wallrj))
- Bump `google.golang.org/grpc` to v1.83.2 to fix reported security vulnerabilities ([#&#8203;9255](https://github.com/cert-manager/cert-manager/issues/9255), [#&#8203;9317](https://github.com/cert-manager/cert-manager/issues/9317))
- Bump `golang.org/x/crypto` to v0.56.0 to fix reported security vulnerabilities ([#&#8203;9265](https://github.com/cert-manager/cert-manager/issues/9265))

### [`v1.21.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.1)

[Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1)

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.1 fixes a controller panic for Certificates with `spec.renewal.policy: Disabled`, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at `Ready=False` (`InvalidSolver`) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities.

All users should upgrade.

#### Changes by Kind

##### Bug or Regression

- Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled ([#&#8203;9038](https://github.com/cert-manager/cert-manager/issues/9038), [@&#8203;sklirg](https://github.com/sklirg))
- Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created ([#&#8203;9083](https://github.com/cert-manager/cert-manager/issues/9083), [@&#8203;SebTardif](https://github.com/SebTardif))
- Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. ([#&#8203;9037](https://github.com/cert-manager/cert-manager/issues/9037), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark))
- Fixed the commented Gateway API config example in the Helm chart values to use `gatewayAPI.enabled` instead of the invalid `gatewayAPI.enable`. ([#&#8203;9012](https://github.com/cert-manager/cert-manager/issues/9012), [@&#8203;mateenali66](https://github.com/mateenali66))

##### Other (Cleanup or Flake)

- Bump `golang.org/x/text` to v0.40.0 to fix a reported security vulnerability ([#&#8203;9039](https://github.com/cert-manager/cert-manager/issues/9039), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark))
- Bump `google.golang.org/grpc` to v1.82.1 to fix a reported security vulnerability ([#&#8203;9063](https://github.com/cert-manager/cert-manager/issues/9063))
- Bump `github.com/google/cel-go` to v0.29.0 to fix a reported security vulnerability ([#&#8203;9072](https://github.com/cert-manager/cert-manager/issues/9072))
- Bump `go.opentelemetry.io/otel` to v1.44.0 to fix a reported security vulnerability ([#&#8203;9073](https://github.com/cert-manager/cert-manager/issues/9073))
- Update distroless base images ([#&#8203;9000](https://github.com/cert-manager/cert-manager/issues/9000), [#&#8203;9025](https://github.com/cert-manager/cert-manager/issues/9025))

### [`v1.21.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0)

[Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.4...v1.21.0)

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading.

#### Known Issues

- **Controller crash-loops when a Certificate sets `renewal.policy: Disabled`**: the new Certificate renewal policies feature ([#&#8203;8258](https://github.com/cert-manager/cert-manager/issues/8258)) causes a nil pointer dereference panic in the trigger controller whenever a Certificate's `spec.renewal.policy` is set to `Disabled` — `pki.RenewalTime()` returns `(nil, nil)` for that policy, but the caller unconditionally dereferences the result. This crashes the controller process (crash-loop) for any cluster with such a Certificate. **Workaround**: do not set `renewal.policy: Disabled` on any Certificate until this is fixed; remove the field (or set a different policy) from any Certificate that already has it, and restart the controller if it is currently crash-looping. See [#&#8203;9031](https://github.com/cert-manager/cert-manager/issues/9031) for details.
- **Log spam for non-cert-manager-labelled Secret events**: the typed predicates refactoring ([#&#8203;8407](https://github.com/cert-manager/cert-manager/issues/8407)) causes `filteredEventHandler` type assertion failures (`"OnAdd missing Object"`, `"OnUpdate missing ObjectOld"`, `"OnDelete missing Object"`) for every non-cert-manager-labelled Secret event, multiplied by 7 certificate sub-controllers. **This is cosmetic only** — the affected controllers only need events from cert-manager-labelled Secrets (which arrive via the typed informer); the metadata informer events were always filtered out by predicates in previous versions. Issuer and ClusterIssuer controllers are not affected. See [#&#8203;8994](https://github.com/cert-manager/cert-manager/issues/8994) for details.
- **Issuer/ClusterIssuer can get stuck at `Ready: False, Reason: InvalidSolver` and never self-correct**: new eager validation of ACME solver Secrets ([#&#8203;8255](https://github.com/cert-manager/cert-manager/issues/8255)) means an Issuer/ClusterIssuer referencing a solver Secret (e.g. a DNS01 provider credential) that doesn't exist yet will correctly report `Ready: False`, but creating the missing Secret afterwards does not trigger re-reconciliation — the controller's Secret-watch logic was never updated to recognise solver Secrets. It will only recover on the next 10-hour informer resync, a change to the Issuer/ClusterIssuer's own spec, or a controller restart. **Workaround**: after creating the missing Secret, make a trivial edit to the Issuer/ClusterIssuer spec (or delete and recreate it) to force reconciliation. See [#&#8203;9036](https://github.com/cert-manager/cert-manager/issues/9036) for details and a fix proposal.

#### Major Themes

##### Default `tokenrequest` RBAC removed from Helm chart

> ⚠️ Breaking change

The Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024.

If you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended — see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation).

##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole

> ⚠️ Potentially breaking change

The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers.

This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly.

##### Metrics port name and path Helm values removed

> ⚠️ Breaking change

The Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. ([#&#8203;8952](https://github.com/cert-manager/cert-manager/issues/8952))

##### ACME and Certificate Management

- **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#&#8203;8798](https://github.com/cert-manager/cert-manager/issues/8798))
- **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#&#8203;8858](https://github.com/cert-manager/cert-manager/issues/8858))
- **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#&#8203;8422](https://github.com/cert-manager/cert-manager/issues/8422))
- **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#&#8203;8258](https://github.com/cert-manager/cert-manager/issues/8258))
- **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#&#8203;8893](https://github.com/cert-manager/cert-manager/issues/8893))
- **Modern2026 [PKCS#12](https://github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#&#8203;8841](https://github.com/cert-manager/cert-manager/issues/8841))
- **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#&#8203;8464](https://github.com/cert-manager/cert-manager/issues/8464))

##### Gateway API and cainjector

- **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: "true"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#&#8203;8749](https://github.com/cert-manager/cert-manager/issues/8749))
- **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#&#8203;8727](https://github.com/cert-manager/cert-manager/issues/8727))
- **Additional listener protocols**: configurable listener protocols beyond the default set. ([#&#8203;8683](https://github.com/cert-manager/cert-manager/issues/8683))
- **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#&#8203;8732](https://github.com/cert-manager/cert-manager/issues/8732))
- **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#&#8203;8583](https://github.com/cert-manager/cert-manager/issues/8583))
- **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#&#8203;8692](https://github.com/cert-manager/cert-manager/issues/8692))
- **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#&#8203;8614](https://github.com/cert-manager/cert-manager/issues/8614))

##### Deployment and Observability

- **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#&#8203;8808](https://github.com/cert-manager/cert-manager/issues/8808), [#&#8203;8779](https://github.com/cert-manager/cert-manager/issues/8779))
- **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#&#8203;8791](https://github.com/cert-manager/cert-manager/issues/8791), [#&#8203;8976](https://github.com/cert-manager/cert-manager/issues/8976))
- **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#&#8203;8523](https://github.com/cert-manager/cert-manager/issues/8523))
- **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#&#8203;8761](https://github.com/cert-manager/cert-manager/issues/8761))

##### Notable Bug Fixes

- **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#&#8203;8947](https://github.com/cert-manager/cert-manager/issues/8947))
- **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#&#8203;8610](https://github.com/cert-manager/cert-manager/issues/8610))
- **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#&#8203;8760](https://github.com/cert-manager/cert-manager/issues/8760))
- **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#&#8203;8803](https://github.com/cert-manager/cert-manager/issues/8803))
- **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#&#8203;8930](https://github.com/cert-manager/cert-manager/issues/8930))
- **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#&#8203;8255](https://github.com/cert-manager/cert-manager/issues/8255))

#### Community

As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved.

A special thanks to:

- [@&#8203;Copilot](https://github.com/Copilot)
- [@&#8203;FelixPhipps](https://github.com/FelixPhipps)
- [@&#8203;Peac36](https://github.com/Peac36)
- [@&#8203;SebTardif](https://github.com/SebTardif)
- [@&#8203;apkatsikas](https://github.com/apkatsikas)
- [@&#8203;bitloi](https://github.com/bitloi)
- [@&#8203;dap0am](https://github.com/dap0am)
- [@&#8203;figaw](https://github.com/figaw)
- [@&#8203;immanuwell](https://github.com/immanuwell)
- [@&#8203;jabbrwcky](https://github.com/jabbrwcky)
- [@&#8203;jnohlgard](https://github.com/jnohlgard)
- [@&#8203;jsoref](https://github.com/jsoref)
- [@&#8203;ltwongaa](https://github.com/ltwongaa)
- [@&#8203;lunarwhite](https://github.com/lunarwhite)
- [@&#8203;mateenali66](https://github.com/mateenali66)
- [@&#8203;onurmicoogullari](https://github.com/onurmicoogullari)
- [@&#8203;putongyong](https://github.com/putongyong)
- [@&#8203;seanorama](https://github.com/seanorama)
- [@&#8203;texasich](https://github.com/texasich)

for their contributions, comments and support!

Also, thanks to the cert-manager maintainer team for their help in this release:

- [@&#8203;SgtCoDFish](https://github.com/SgtCoDFish)
- [@&#8203;ThatsMrTalbot](https://github.com/ThatsMrTalbot)
- [@&#8203;erikgb](https://github.com/erikgb)
- [@&#8203;hjoshi123](https://github.com/hjoshi123)
- [@&#8203;inteon](https://github.com/inteon)
- [@&#8203;maelvls](https://github.com/maelvls)
- [@&#8203;munnerz](https://github.com/munnerz)
- [@&#8203;wallrj](https://github.com/wallrj)
- [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark)

And finally, thanks to the cert-manager steering committee for their feedback in this release cycle:

- [@&#8203;FlorianLiebhart](https://github.com/FlorianLiebhart)
- [@&#8203;TrilokGeer](https://github.com/TrilokGeer)
- [@&#8203;ianarsenault](https://github.com/ianarsenault)
- [@&#8203;ssyno](https://github.com/ssyno)

#### Changes since v1.20.0

##### Feature

- Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#&#8203;8808](https://github.com/cert-manager/cert-manager/issues/8808), [@&#8203;FelixPhipps](https://github.com/FelixPhipps))
- Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#&#8203;8893](https://github.com/cert-manager/cert-manager/issues/8893), [@&#8203;lunarwhite](https://github.com/lunarwhite))
- Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#&#8203;8858](https://github.com/cert-manager/cert-manager/issues/8858), [@&#8203;wallrj](https://github.com/wallrj))
- Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#&#8203;8791](https://github.com/cert-manager/cert-manager/issues/8791), [@&#8203;jsoref](https://github.com/jsoref))
- Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#&#8203;8976](https://github.com/cert-manager/cert-manager/issues/8976), [@&#8203;erikgb](https://github.com/erikgb))
- Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#&#8203;8761](https://github.com/cert-manager/cert-manager/issues/8761), [@&#8203;lunarwhite](https://github.com/lunarwhite))
- Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#&#8203;8523](https://github.com/cert-manager/cert-manager/issues/8523), [@&#8203;dap0am](https://github.com/dap0am))
- Added ARI support through the ACMEUseARI feature gate. ([#&#8203;8798](https://github.com/cert-manager/cert-manager/issues/8798), [@&#8203;hjoshi123](https://github.com/hjoshi123))
- Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#&#8203;8422](https://github.com/cert-manager/cert-manager/issues/8422), [@&#8203;bitloi](https://github.com/bitloi))
- Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#&#8203;8727](https://github.com/cert-manager/cert-manager/issues/8727), [@&#8203;hjoshi123](https://github.com/hjoshi123))
- Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#&#8203;8683](https://github.com/cert-manager/cert-manager/issues/8683), [@&#8203;ThatsMrTalbot](https://github.com/ThatsMrTalbot))
- Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#&#8203;8841](https://github.com/cert-manager/cert-manager/issues/8841), [@&#8203;seanorama](https://github.com/seanorama))
- Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#&#8203;8614](https://github.com/cert-manager/cert-manager/issues/8614), [@&#8203;figaw](https://github.com/figaw))
- Disabled client side rate-limiting if AP\&F is enabled. ([#&#8203;8757](https://github.com/cert-manager/cert-manager/issues/8757), [@&#8203;hjoshi123](https://github.com/hjoshi123))
- Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#&#8203;8779](https://github.com/cert-manager/cert-manager/issues/8779), [@&#8203;FelixPhipps](https://github.com/FelixPhipps))
- Adding certificate renewal policies ([#&#8203;8258](https://github.com/cert-manager/cert-manager/issues/8258), [@&#8203;hjoshi123](https://github.com/hjoshi123))
- Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#&#8203;8692](https://github.com/cert-manager/cert-manager/issues/8692), [@&#8203;erikgb](https://github.com/erikgb))
- Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#&#8203;8927](https://github.com/cert-manager/cert-manager/issues/8927), [@&#8203;jabbrwcky](https://github.com/jabbrwcky))
- Promote the CAInjectorMerging feature gate to GA ([#&#8203;8583](https://github.com/cert-manager/cert-manager/issues/8583), [@&#8203;Copilot](https://github.com/Copilot))
- When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#&#8203;8749](https://github.com/cert-manager/cert-manager/issues/8749), [@&#8203;apkatsikas](https://github.com/apkatsikas))

##### Bug or Regression

- **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#&#8203;7213](https://github.com/cert-manager/cert-manager/issues/7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#&#8203;8931](https://github.com/cert-manager/cert-manager/issues/8931), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark))
- ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#&#8203;8760](https://github.com/cert-manager/cert-manager/issues/8760), [@&#8203;texasich](https://github.com/texasich))
- Add dns issuer secrets validation before marking it as ready ([#&#8203;8255](https://github.com/cert-manager/cert-manager/issues/8255), [@&#8203;Peac36](https://github.com/Peac36))
- Add missing issuer finalizer RBAC to the order controller to support owner references ([#&#8203;8654](https://github.com/cert-manager/cert-manager/issues/8654), [@&#8203;erikgb](https://github.com/erikgb))
- ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#&#8203;8822](https://github.com/cert-manager/cert-manager/issues/8822), [@&#8203;lunarwhite](https://github.com/lunarwhite))
- Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#&#8203;8808](https://github.com/cert-manager/cert-manager/issues/8808). ([#&#8203;8843](https://github.com/cert-manager/cert-manager/issues/8843), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark))
- Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#&#8203;8651](https://github.com/cert-manager/cert-manager/issues/8651), [@&#8203;mateenali66](https://github.com/mateenali66))
- Fix webhook serving certificate not being renewed after system suspend. ([#&#8203;8464](https://github.com/cert-manager/cert-manager/issues/8464), [@&#8203;Peac36](https://github.com/Peac36))
- Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#&#8203;8962](https://github.com/cert-manager/cert-manager/issues/8962), [@&#8203;hjoshi123](https://github.com/hjoshi123))
- Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#&#8203;8947](https://github.com/cert-manager/cert-manager/issues/8947), [@&#8203;ThatsMrTalbot](https://github.com/ThatsMrTalbot))
- Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#&#8203;8619](https://github.com/cert-manager/cert-manager/issues/8619), [@&#8203;hjoshi123](https://github.com/hjoshi123))
- Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#&#8203;8610](https://github.com/cert-manager/cert-manager/issues/8610), [@&#8203;onurmicoogullari](https://github.com/onurmicoogullari))
- Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#&#8203;8821](https://github.com/cert-manager/cert-manager/issues/8821), [@&#8203;wallrj](https://github.com/wallrj))
- Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#&#8203;8803](https://github.com/cert-manager/cert-manager/issues/8803), [@&#8203;SebTardif](https://github.com/SebTardif))
- Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#&#8203;8813](https://github.com/cert-manager/cert-manager/issues/8813), [@&#8203;immanuwell](https://github.com/immanuwell))
- Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#&#8203;8753](https://github.com/cert-manager/cert-manager/issues/8753), [@&#8203;FelixPhipps](https://github.com/FelixPhipps))
- Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#&#8203;8664](https://github.com/cert-manager/cert-manager/issues/8664), [@&#8203;jnohlgard](https://github.com/jnohlgard))
- Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#&#8203;8958](https://github.com/cert-manager/cert-manager/issues/8958), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark))
- Remove issuer owner reference from challenges blocking challenge garbage collection ([#&#8203;8743](https://github.com/cert-manager/cert-manager/issues/8743), [@&#8203;erikgb](https://github.com/erikgb))
- Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#&#8203;8577](https://github.com/cert-manager/cert-manager/issues/8577), [@&#8203;putongyong](https://github.com/putongyong))
- Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#&#8203;8930](https://github.com/cert-manager/cert-manager/issues/8930), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark))

##### Other (Cleanup or Flake)

- API cleanup: removed deprecated ObjectReference ([#&#8203;8625](https://github.com/cert-manager/cert-manager/issues/8625), [@&#8203;inteon](https://github.com/inteon))
- Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#&#8203;8952](https://github.com/cert-manager/cert-manager/issues/8952), [@&#8203;erikgb](https://github.com/erikgb))
- The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#&#8203;8732](https://github.com/cert-manager/cert-manager/issues/8732), [@&#8203;ThatsMrTalbot](https://github.com/ThatsMrTalbot))
- Update base images to Debian 13 ([#&#8203;8849](https://github.com/cert-manager/cert-manager/issues/8849), [@&#8203;ltwongaa](https://github.com/ltwongaa))

### [`v1.20.4`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.4)

[Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.3...v1.20.4)

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This patch release updates Go and several dependencies to fix reported security vulnerabilities, and fixes a bug where ingress-shim removed the applyset label from cached Ingress and Gateway objects.

All users should upgrade.

> \[!NOTE]
> **Security scanners still report three `golang.org/x/crypto` findings.** None of them affects cert-manager and we do not plan to fix them in the 1.20 line.
>
> - [CVE-2026-56855](https://nvd.nist.gov/vuln/detail/CVE-2026-56855) and [CVE-2026-78662](https://nvd.nist.gov/vuln/detail/CVE-2026-78662) are deadlocks in the `golang.org/x/crypto/ssh` connection multiplexer, triggered by a malicious SSH peer after a connection is established. cert-manager never opens an SSH connection. Only the controller links the `ssh` package, through `vcert`, which uses it to format a public key. The fix, `golang.org/x/crypto` v0.56.0, requires Go language version 1.26, which we will not adopt in a patch release. `govulncheck` confirms the vulnerable functions are not called.
> - [GO-2026-5932](https://pkg.go.dev/vuln/GO-2026-5932) marks `golang.org/x/crypto/openpgp` as unmaintained. cert-manager does not import that package and there is no fixed version.
>
> cert-manager 1.21 already uses `golang.org/x/crypto` v0.56.0, so upgrade to 1.21 if you need a clean scan.

#### Changes by Kind

##### Bug or Regression

- Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects ([#&#8203;9315](https://github.com/cert-manager/cert-manager/issues/9315), [@&#8203;KR-Ravindra](https://github.com/KR-Ravindra))

##### Other (Cleanup or Flake)

- Update Go to 1.26.5 and then 1.26.6, which include security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages ([#&#8203;8995](https://github.com/cert-manager/cert-manager/issues/8995), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark); [#&#8203;9152](https://github.com/cert-manager/cert-manager/issues/9152), [@&#8203;wallrj](https://github.com/wallrj))
- Bump `golang.org/x/net` to v0.58.0, `golang.org/x/text` to v0.41.0 and `golang.org/x/crypto` to v0.55.0 to fix [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600), [CVE-2026-56852](https://nvd.nist.gov/vuln/detail/CVE-2026-56852) and [CVE-2026-56854](https://nvd.nist.gov/vuln/detail/CVE-2026-56854) ([#&#8203;9040](https://github.com/cert-manager/cert-manager/issues/9040), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark))
- Bump `google.golang.org/grpc` to v1.83.2 to fix [CVE-2026-84304](https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc), [CVE-2026-84445](https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj), [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) and [one further advisory](https://github.com/advisories/GHSA-hrxh-6v49-42gf) ([#&#8203;9062](https://github.com/cert-manager/cert-manager/issues/9062), [#&#8203;9257](https://github.com/cert-manager/cert-manager/issues/9257), [#&#8203;9316](https://github.com/cert-manager/cert-manager/issues/9316))
- Bump `github.com/google/cel-go` to v0.30.0 to fix [a reported vulnerability](https://github.com/advisories/GHSA-gcjh-h69q-9w9g) ([#&#8203;9070](https://github.com/cert-manager/cert-manager/issues/9070), [#&#8203;9186](https://github.com/cert-manager/cert-manager/issues/9186))
- Bump `software.sslmate.com/src/go-pkcs12` to v0.7.2 to fix [a reported vulnerability](https://github.com/advisories/GHSA-mpwr-8vm7-h73f) ([#&#8203;8988](https://github.com/cert-manager/cert-manager/issues/8988))
- Bump `golang.org/x/mod`, `go.opentelemetry.io/otel` and `go.etcd.io/etcd/client/pkg/v3` to versions flagged by security scanners ([#&#8203;9143](https://github.com/cert-manager/cert-manager/issues/9143), [#&#8203;9071](https://github.com/cert-manager/cert-manager/issues/9071), [#&#8203;9185](https://github.com/cert-manager/cert-manager/issues/9185))
- Update the distroless base images ([#&#8203;8991](https://github.com/cert-manager/cert-manager/issues/8991), [#&#8203;9024](https://github.com/cert-manager/cert-manager/issues/9024), [#&#8203;9055](https://github.com/cert-manager/cert-manager/issues/9055), [#&#8203;9325](https://github.com/cert-manager/cert-manager/issues/9325))
- The release staging process now signs `metadata.json` with cosign so the publish step can verify its authenticity ([#&#8203;9090](https://github.com/cert-manager/cert-manager/issues/9090), [@&#8203;FelixPhipps](https://github.com/FelixPhipps))

### [`v1.20.3`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.3)

[Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.2...v1.20.3)

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This patch release fixes a security issue ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258), HIGH) where the default `cert-manager-edit` aggregate ClusterRole granted namespace users permission to create ACME `Challenge` and `Order` resources directly. A user who could create a `Challenge` referencing a `ClusterIssuer` could supply attacker-controlled solver configuration while cert-manager loaded credentials from the `ClusterIssuer`'s namespace, bypassing Issuer solver selectors (`dnsZones`, `dnsNames`, `matchLabels`). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint.

This release also removes the issuer owner reference from Challenges which was blocking Challenge garbage collection, and updates Go to fix reported CVEs.

All users should upgrade.

> \[!WARNING]
> **Potentially breaking change:** The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io`. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate → CertificateRequest → Order → Challenge flow), you will need to grant those permissions explicitly.

#### Changes by Kind

##### Bug or Regression

- Security (HIGH): Remove Challenge `create` and Order `create`, `patch`, `update` verbs from the `cert-manager-edit` aggregate ClusterRole ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). ([#&#8203;8940](https://github.com/cert-manager/cert-manager/issues/8940), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark))
- Remove issuer owner reference from challenges blocking challenge garbage collection ([#&#8203;8759](https://github.com/cert-manager/cert-manager/issues/8759), [@&#8203;cert-manager-bot](https://github.com/cert-manager-bot))

##### Other (Cleanup or Flake)

- Bump go to 1.26.3, other deps to fix several govulncheck issues ([#&#8203;8789](https://github.com/cert-manager/cert-manager/issues/8789), [@&#8203;SgtCoDFish](https://github.com/SgtCoDFish))
- Update Go to `v1.26.4` to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 ([#&#8203;8926](https://github.com/cert-manager/cert-manager/issues/8926), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark))

### [`v1.20.2`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.2)

[Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.1...v1.20.2)

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.20.2 fixes invalid YAML generated in the Helm chart when both `webhook.config`
and `webhook.volumes` are defined, and bumps Go to 1.26.2 along with dependencies
to address reported vulnerabilities.

#### Changes by Kind

##### Bug or Regression

- Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#&#8203;8665](https://github.com/cert-manager/cert-manager/issues/8665), [@&#8203;cert-manager-bot](https://github.com/cert-manager-bot))

##### Other (Cleanup or Flake)

- Bump go dependencies with reported vulnerabilities ([#&#8203;8704](https://github.com/cert-manager/cert-manager/issues/8704), [@&#8203;erikgb](https://github.com/erikgb))
- Bump go to 1.26.2 ([#&#8203;8703](https://github.com/cert-manager/cert-manager/issues/8703), [@&#8203;erikgb](https://github.com/erikgb))

### [`v1.20.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.1)

[Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.0...v1.20.1)

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.20.1 fixes an issue for OpenShift users that has to do with the finalizer RBAC, bumps gRPC to address a reported non-affecting vulnerability, and fixes a duplicate `parentRef` bug when both issuer config and annotations are present (Gateway API).

##### Bug or Regression

- Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#&#8203;8658](https://github.com/cert-manager/cert-manager/issues/8658), [@&#8203;hjoshi123](https://github.com/hjoshi123))
- Add missing issuer finalizer RBAC to the order controller to support owner references. This was preventing OpenShift users from being able to upgrade to v1.20.0. ([#&#8203;8655](https://github.com/cert-manager/cert-manager/issues/8655), [@&#8203;erikgb](https://github.com/erikgb))
- Bump google.golang.org/grpc to fix vulnerability reported by scanners. This isn't a vulnerability that affects cert-manager, but we are bumping it because it is reported by scanners. ([#&#8203;8657](https://github.com/cert-manager/cert-manager/issues/8657), [@&#8203;erikgb](https://github.com/erikgb))

### [`v1.20.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.0)

[Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.19.6...v1.20.0)

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.20.0 adds alpha support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta.

#### Changes by Kind

##### Feature

- Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. ([#&#8203;8370](https://github.com/cert-manager/cert-manager/issues/8370), [@&#8203;jcpunk](https://github.com/jcpunk))
- Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} ([#&#8203;8256](https://github.com/cert-manager/cert-manager/issues/8256), [@&#8203;tareksha](https://github.com/tareksha))
- Added support for specifying `imagePullSecrets` in the `startupapicheck-job` Helm template to enable pulling images from private registries. ([#&#8203;8186](https://github.com/cert-manager/cert-manager/issues/8186), [@&#8203;mathieu-clnk](https://github.com/mathieu-clnk))
- Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. ([#&#8203;8355](https://github.com/cert-manager/cert-manager/issues/8355), [@&#8203;dancmeyers](https://github.com/dancmeyers))
- Added `parentRef` override annotations on the Certificate resource. ([#&#8203;8518](https://github.com/cert-manager/cert-manager/issues/8518), [@&#8203;hjoshi123](https://github.com/hjoshi123))
- Added support for azure private zones for dns01 issuer. ([#&#8203;8494](https://github.com/cert-manager/cert-manager/issues/8494), [@&#8203;hjoshi123](https://github.com/hjoshi123))
- Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. ([#&#8203;7642](https://github.com/cert-manager/cert-manager/issues/7642), [@&#8203;robertlestak](https://github.com/robertlestak))
- Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget ([#&#8203;7728](https://github.com/cert-manager/cert-manager/issues/7728), [@&#8203;jcpunk](https://github.com/jcpunk))
- For Venafi provider, read `venafi.cert-manager.io/custom-fields` annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. ([#&#8203;8301](https://github.com/cert-manager/cert-manager/issues/8301), [@&#8203;k0da](https://github.com/k0da))
- Improve error message when CA issuers are misconfigured to use a clashing secret name ([#&#8203;8374](https://github.com/cert-manager/cert-manager/issues/8374), [@&#8203;majiayu000](https://github.com/majiayu000))
- Introduce a new Ingress annotation `acme.cert-manager.io/http01-ingress-ingressclassname` to override `http01.ingress.ingressClassName` field in HTTP-01 challenge solvers. ([#&#8203;8244](https://github.com/cert-manager/cert-manager/issues/8244), [@&#8203;lunarwhite](https://github.com/lunarwhite))
- Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#&#8203;8195](https://github.com/cert-manager/cert-manager/issues/8195), [@&#8203;StingRayZA](https://github.com/StingRayZA))
- Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. ([#&#8203;8228](https://github.com/cert-manager/cert-manager/issues/8228), [@&#8203;terinjokes](https://github.com/terinjokes))
- Added experimental `XListenerSets` feature gate ([#&#8203;8394](https://github.com/cert-manager/cert-manager/issues/8394), [@&#8203;hjoshi123](https://github.com/hjoshi123))

##### Documentation

- Add GWAPI documentation to NOTES.TXT in helm chart ([#&#8203;8353](https://github.com/cert-manager/cert-manager/issues/8353), [@&#8203;jaxels10](https://github.com/jaxels10))

##### Bug or Regression

- Adds logs for cases when acme server returns us a fatal error in the order controller ([#&#8203;8199](https://github.com/cert-manager/cert-manager/issues/8199), [@&#8203;Peac36](https://github.com/Peac36))
- Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#&#8203;8160](https://github.com/cert-manager/cert-manager/issues/8160), [@&#8203;inteon](https://github.com/inteon))
- Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. ([#&#8203;8232](https://github.com/cert-manager/cert-manager/issues/8232), [@&#8203;eleanor-merry](https://github.com/eleanor-merry))
- Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. ([#&#8203;8456](https://github.com/cert-manager/cert-manager/issues/8456), [@&#8203;tkna](https://github.com/tkna))
- Fix unregulated retries with the DigitalOcean DNS-01 solver
  Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging ([#&#8203;8221](https://github.com/cert-manager/cert-manager/issues/8221), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark))
- Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#&#8203;8403](https://github.com/cert-manager/cert-manager/issues/8403), [@&#8203;calm329](https://github.com/calm329))
- Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#&#8203;8424](https://github.com/cert-manager/cert-manager/issues/8424), [@&#8203;SlashNephy](https://github.com/SlashNephy))
- Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. ([#&#8203;8443](https://github.com/cert-manager/cert-manager/issues/8443), [@&#8203;alviss7](https://github.com/alviss7))
- Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#&#8203;8173](https://github.com/cert-manager/cert-manager/issues/8173), [@&#8203;erikgb](https://github.com/erikgb))
- Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#&#8203;8469](https://github.com/cert-manager/cert-manager/issues/8469), [@&#8203;SgtCoDFish](https://github.com/SgtCoDFish))
- Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#&#8203;8290](https://github.com/cert-manager/cert-manager/issues/8290), [@&#8203;octo-sts](https://github.com/octo-sts)\[bot])
- When Prometheus monitoring is enabled, the metrics label is now set to the intended value of `cert-manager`. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). ([#&#8203;8162](https://github.com/cert-manager/cert-manager/issues/8162), [@&#8203;LiquidPL](https://github.com/LiquidPL))

##### Other (Cleanup or Flake)

- Promoted the OtherNames feature to Beta and enabled it by default ([#&#8203;8288](https://github.com/cert-manager/cert-manager/issues/8288), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark))
- Promoting `XListenerSets` feature gate to `ListenerSets` ([#&#8203;8501](https://github.com/cert-manager/cert-manager/issues/8501), [@&#8203;hjoshi123](https://github.com/hjoshi123))
- Rebranding of the Venafi Issuer to CyberArk ([#&#8203;8215](https://github.com/cert-manager/cert-manager/issues/8215), [@&#8203;iossifbenbassat123](https://github.com/iossifbenbassat123))
- Switched to SSA for challenge finalizer updates ([#&#8203;8519](https://github.com/cert-manager/cert-manager/issues/8519), [@&#8203;inteon](https://github.com/inteon))
- The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) ([#&#8203;8408](https://github.com/cert-manager/cert-manager/issues/8408), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark))
- The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. ([#&#8203;8287](https://github.com/cert-manager/cert-manager/issues/8287), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark))
- Update cert-manager's ACME client, forked from golang/x/crypto ([#&#8203;8268](https://github.com/cert-manager/cert-manager/issues/8268), [@&#8203;SgtCoDFish](https://github.com/SgtCoDFish))
- Use the latest version of Kyverno (1.16.2) in the best-practice installation tests ([#&#8203;8389](https://github.com/cert-manager/cert-manager/issues/8389), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark))
- We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. ([#&#8203;8426](https://github.com/cert-manager/cert-manager/issues/8426), [@&#8203;hjoshi123](https://github.com/hjoshi123))

</details>

<details>
<summary>longhorn/charts (longhorn)</summary>

### [`v1.12.1`](https://github.com/longhorn/charts/releases/tag/longhorn-1.12.1)

[Compare Source](https://github.com/longhorn/charts/compare/longhorn-1.12.0...longhorn-1.12.1)

Longhorn is a distributed block storage system for Kubernetes.

### [`v1.12.0`](https://github.com/longhorn/charts/releases/tag/longhorn-1.12.0)

[Compare Source](https://github.com/longhorn/charts/compare/longhorn-1.11.3...longhorn-1.12.0)

Longhorn is a distributed block storage system for Kubernetes.

### [`v1.11.3`](https://github.com/longhorn/charts/releases/tag/longhorn-1.11.3)

[Compare Source](https://github.com/longhorn/charts/compare/longhorn-1.11.2...longhorn-1.11.3)

Longhorn is a distributed block storage system for Kubernetes.

### [`v1.11.2`](https://github.com/longhorn/charts/releases/tag/longhorn-1.11.2)

[Compare Source](https://github.com/longhorn/charts/compare/longhorn-1.11.1...longhorn-1.11.2)

Longhorn is a distributed block storage system for Kubernetes.

</details>

<details>
<summary>NVIDIA/k8s-device-plugin (nvidia-device-plugin)</summary>

### [`v0.20.0`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0200)

[Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.19.3...v0.20.0)

- Add configurable packed/distributed allocation policy for replicated and MIG resources ([#&#8203;1621](https://github.com/NVIDIA/k8s-device-plugin/issues/1621))
- Prefer distinct physical GPUs when breaking distributed-allocation ties ([#&#8203;1788](https://github.com/NVIDIA/k8s-device-plugin/issues/1788))
- Fix MIG resource matching so profiles with suffixes such as `-me`, `+me.all`, and `+gfx` are exposed as separate Kubernetes resources ([#&#8203;1807](https://github.com/NVIDIA/k8s-device-plugin/issues/1807))
- Surface NVML errors when MIG device placement cannot be determined ([#&#8203;1899](https://github.com/NVIDIA/k8s-device-plugin/issues/1899))
- Add support for the Rubin architecture family ([#&#8203;1909](https://github.com/NVIDIA/k8s-device-plugin/issues/1909))
- Bump NVIDIA go-nvlib to v0.12.0 ([#&#8203;1911](https://github.com/NVIDIA/k8s-device-plugin/issues/1911))
- Update the Node Feature Discovery chart to v0.19.0 and use OCI artifacts ([#&#8203;1922](https://github.com/NVIDIA/k8s-device-plugin/issues/1922))
- Add third-party notices and a generator ([#&#8203;1950](https://github.com/NVIDIA/k8s-device-plugin/issues/1950))
- Bump NVIDIA Container Toolkit to v1.20.0 ([#&#8203;1958](https://github.com/NVIDIA/k8s-device-plugin/issues/1958))
- Add OCI standard image labels ([#&#8203;1961](https://github.com/NVIDIA/k8s-device-plugin/issues/1961))

### [`v0.19.3`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0193)

[Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.19.2...v0.19.3)

- bump nvcr.io/nvidia/distroless/go to v4.0.8-dev ([#&#8203;1852](https://github.com/NVIDIA/k8s-device-plugin/issues/1852))
- revert default enablement of features mofed, gdrcopy and mofed ([#&#8203;1837](https://github.com/NVIDIA/k8s-device-plugin/issues/1837))
- bump golang version to 1.26.4 ([#&#8203;1828](https://github.com/NVIDIA/k8s-device-plugin/issues/1828))
- bump golang.org/x/net to v0.56.0 ([#&#8203;1867](https://github.com/NVIDIA/k8s-device-plugin/issues/1867))

### [`v0.19.2`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0192)

[Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.19.1...v0.19.2)

- Bump golang version to 1.26.3 ([#&#8203;1754](https://github.com/NVIDIA/k8s-device-plugin/issues/1754))
- Bump nvidia/distroless/go to v4.0.6-dev ([#&#8203;1806](https://github.com/NVIDIA/k8s-device-plugin/issues/1806))
- Bump nvidia-container-toolkit to v1.19.1 ([#&#8203;1798](https://github.com/NVIDIA/k8s-device-plugin/issues/1798))
- Always use a dedicated service account in the helm chart ([#&#8203;1804](https://github.com/NVIDIA/k8s-device-plugin/issues/1804))

### [`v0.19.1`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0191)

[Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.19.0...v0.19.1)

- wsl: report a single "all" device to kubelet ([#&#8203;1699](https://github.com/NVIDIA/k8s-device-plugin/issues/1699))
- Fix CDI spec generation to respect driver root for Tegra CSV files ([#&#8203;1701](https://github.com/NVIDIA/k8s-device-plugin/issues/1701))
- Bump golang from 1.26.1 to 1.26.2 ([#&#8203;1704](https://github.com/NVIDIA/k8s-device-plugin/issues/1704))

* Bump nvidia/distroless/go from v4.0.3-dev to v4.0.4-dev ([#&#8203;1702](https://github.com/NVIDIA/k8s-device-plugin/issues/1702))
* Bump google.golang.org/grpc from 1.79.1 to 1.79.3 ([#&#8203;1711](https://github.com/NVIDIA/k8s-device-plugin/issues/1711))
* Bump the k8s.io dependencies to v1.35.4 ([#&#8203;1710](https://github.com/NVIDIA/k8s-device-plugin/issues/1710))

### [`v0.19.0`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0190)

[Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.18.2...v0.19.0)

- Add --sleep-interval=infinite support to GFD for running as a pod ([#&#8203;1603](https://github.com/NVIDIA/k8s-device-plugin/issues/1603))
- Fix image tag in static deployment ([#&#8203;1604](https://github.com/NVIDIA/k8s-device-plugin/issues/1604))
- Add ownerReference to NodeFeature CRs for garbage collection ([#&#8203;1597](https://github.com/NVIDIA/k8s-device-plugin/issues/1597))
- Change default value for gds, gdrcopy and mofed flags ([#&#8203;1550](https://github.com/NVIDIA/k8s-device-plugin/issues/1550))
- Fix healthchecking on old devices ([#&#8203;1562](https://github.com/NVIDIA/k8s-device-plugin/issues/1562))
- Enable NodeFeature API by default in GFD ([#&#8203;1504](https://github.com/NVIDIA/k8s-device-plugin/issues/1504))
- Build multiarch images on native GitHub runners ([#&#8203;1468](https://github.com/NVIDIA/k8s-device-plugin/issues/1468))

### [`v0.18.2`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0182)

[Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.18.1...v0.18.2)

- Ensure that cdi.FeatureFlags are passed to CDI library
- Fix race condition in config-manager when label is unset
- Fix nested container use cases by ensuring that IPC sockets are not mounted readonly
- Bump NVIDIA Container Toolkit to v1.18.2
- Bump distroless base image to v3.2.2-dev

### [`v0.18.1`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0181)

[Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.18.0...v0.18.1)

- Allow CDI feature flags to be set
- Pass driver root to nvinfo.New in device plugin main
- Bump NVIDIA Container Toolkit to v1.18.1
- Bump distroless base image to v3.2.1-dev
- Bump github.com/opencontainers/selinux from 1.12.0 to 1.13.1 ([#&#8203;1506](https://github.com/NVIDIA/k8s-device-plugin/issues/1506))

### [`v0.18.0`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0180)

[Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.17.4...v0.18.0)

- Rename getHealthCheckXids and clarify documentation
- Add support for explicitly enabling XIDs in health checks
- Deduplicate requested device IDs
- Check for nil before reading boolean config values
- Make gated modes (GDS, MOFED, GDRCOPY) optional in CDI
- Add support for setting gdrcopyEnabled
- Ignore errors getting device memory using NVML
- Ensure that directory volumes have Directory type
- Switch to plain golang image for builds
- Remove unneeded intermediate container
- Update CI definitions
- Switch to distroless golang image
- Update README.md with RuntimeClass
- Pass a single context throughout the device-plugin method call stack ([#&#8203;1284](https://github.com/NVIDIA/k8s-device-plugin/issues/1284))
- Remove internal logger in favour of klog ([#&#8203;1277](https://github.com/NVIDIA/k8s-device-plugin/issues/1277))
- Remove FAIL\_ON\_INIT\_ERROR from static examples
- Detect blackwell architecture
- Updated .release:staging to stage device-plugin images in nvstaging
- Use MiB instead of MB for gpu-memory
- Ignore XID error 109
- Update README.md adjust set docker runtime default
- Remove nvidia.com/gpu.imex-domain label
- Fix containerd runc config error when creating a kind cluster
- Use stable nividia-container-toolkit repo when creating a kind cluster
- Switch to context package in go stdlib
- Raise a warning instead of an error if GPU mode labeler fails
- Add ada-lovelace architecture label for compute capability 8.9
- Ensure FAIL\_ON\_INIT\_ERROR boolean env is quoted
- Honor fail-on-init-error when no resources are found
- Enable hostPID in the mps-control-daemon pod ([#&#8203;1045](https://github.com/NVIDIA/k8s-device-plugin/issues/1045))

### [`v0.17.4`](https://github.com/NVIDIA/k8s-device-plugin/releases/tag/v0.17.4)

[Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.17.3...v0.17.4)

#### What's Changed

- Bump slackapi/slack-github-action from 2.1.0 to 2.1.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1317](https://github.com/NVIDIA/k8s-device-plugin/pull/1317)
- Bump github.com/NVIDIA/go-nvlib from 0.7.2 to 0.7.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1346](https://github.com/NVIDIA/k8s-device-plugin/pull/1346)
- Bump golang from 1.23.11 to 1.23.12 in /deployments/devel by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1355](https:/…
dd-octo-sts Bot pushed a commit to DataDog/k8s-device-plugin that referenced this pull request Sep 23, 2026
Follow-up on top of NVIDIA#1621, which introduced the shared greedyAlloc loop
with a pluggable replicaComparator (distributed vs packed). The loop
still sorts the full candidate slice inside the allocation loop, paying
O(n log n) per iteration for n iterations and giving O(n² log n) overall.

Since all annotated replicas from the same underlying physical device
share the same sort key, sorting at the replica granularity is wasted
work — only m (the number of distinct physical devices contributing
candidates) needs to be reordered.

Refactor greedyAlloc to bucket candidates by their underlying physical
device into a small gpuAllocState per device, holding a shared
*replicaCount, the pickedFrom counter, and the remaining candidate IDs.
A gpuPriorityQueue defers to the caller-supplied replicaComparator on
allocated() for primary ordering and to pickedFrom for the tie-break
(unchanged semantics). Each iteration pops the best device, takes one
of its remaining replicas, updates counters, and pushes it back if any
remain.

Total cost drops to O(n log m). Both allocation policies (distributed
and packed) benefit; no behavior change — the existing test suite
(TestDistributedAlloc, TestPackedAlloc, TestPackedVsDistributedContrast,
TestDistributedAlloc_PartiallyAllocated_DistributesAcrossDistinctGPUs,
etc.) passes unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: runatom-ai <258621014+runatom-ai@users.noreply.github.com>
Signed-off-by: Jonathan Meiri <33288957+Meiri28@users.noreply.github.com>
(cherry picked from commit c3b47c6)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants