packages: update nvidia-k8s-device-plugin to v0.18.0

With this update, we add a patch to disable `enable-cuda-compat` oci hook as nvidia-k8s-device-plugin
doesn't provide any config option to drop it from the CDI spec as suggested in
https://www.wiz.io/blog/nvidia-ai-vulnerability-cve-2025-23266-nvidiascape

Signed-off-by: Piyush Jena <[email protected]>

Author: piyush-jena

packages/nvidia-k8s-device-plugin/1001-Ensure-that-generated-CDI-specs-do-not-contain-enabl.patch

@@ -0,0 +1,36 @@
+From 0ae23f93ef41d348a489e9dd2fbc76ef0468005e Mon Sep 17 00:00:00 2001
+From: Evan Lezar <[email protected]>
+Date: Mon, 10 Mar 2025 14:44:45 +0200
+Subject: [PATCH] Ensure that generated CDI specs do not contain
+ enable-cuda-compat hooks
+
+Signed-off-by: Evan Lezar <[email protected]>
+---
+ internal/cdi/cdi.go | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/internal/cdi/cdi.go b/internal/cdi/cdi.go
+index 2b3761d9..810e4395 100644
+--- a/internal/cdi/cdi.go
++++ b/internal/cdi/cdi.go
+@@ -126,6 +126,8 @@ func New(infolib info.Interface, nvmllib nvml.Interface, devicelib device.Interf
+ 		nvcdi.WithDeviceNamers(deviceNamer),
+ 		nvcdi.WithVendor(c.vendor),
+ 		nvcdi.WithClass("gpu"),
++		// TODO: This should be removed once the use of a NVIDIA Container Toolkit >= v1.17.5 is commonplace.
++		nvcdi.WithDisabledHook(nvcdi.HookEnableCudaCompat),
+ 	)
+ 	if err != nil {
+ 		return nil, fmt.Errorf("failed to create nvcdi library: %v", err)
+@@ -154,6 +156,8 @@ func New(infolib info.Interface, nvmllib nvml.Interface, devicelib device.Interf
+ 			nvcdi.WithDevRoot(c.devRoot),
+ 			nvcdi.WithVendor(c.vendor),
+ 			nvcdi.WithMode(mode),
++			// TODO: This should be removed once the use of a NVIDIA Container Toolkit >= v1.17.5 is commonplace.
++			nvcdi.WithDisabledHook(nvcdi.HookEnableCudaCompat),
+ 		)
+ 		if err != nil {
+ 			return nil, fmt.Errorf("failed to create nvcdi library: %v", err)
+-- 
+2.51.0
+

packages/nvidia-k8s-device-plugin/Cargo.toml

@@ -12,9 +12,9 @@ path = "../packages.rs"
 releases-url = "https://github.com/NVIDIA/k8s-device-plugin/releases"
 
 [[package.metadata.build-package.external-files]]
-url = "https://github.com/NVIDIA/k8s-device-plugin/archive/v0.17.3/v0.17.3.tar.gz"
-path = "k8s-device-plugin-0.17.3.tar.gz"
-sha512 = "18715703dfce6a6e986295dfbdc78180dd5c30566db2b44abc7fc030e6981ada5fd411488564594454a840c3c67b933e0c7e849c2938aa837ac32dd41b3a0140"
+url = "https://github.com/NVIDIA/k8s-device-plugin/archive/v0.18.0/v0.18.0.tar.gz"
+path = "k8s-device-plugin-0.18.0.tar.gz"
+sha512 = "4da24e4e75667209bc1b1ec98cf9895fe0af182934c3867c60ebed154f73d4703d23ff72f44edc2fb2d07cc14c42bb4c19e274628cbbee045ef6b6e1e7b2f0d8"
 
 [build-dependencies]
 glibc = { path = "../glibc" }

packages/nvidia-k8s-device-plugin/nvidia-k8s-device-plugin.spec

@@ -2,7 +2,7 @@
 %global gorepo k8s-device-plugin
 %global goimport %{goproject}/%{gorepo}
 
-%global gover 0.17.3
+%global gover 0.18.0
 %global rpmver %{gover}
 
 Name: %{_cross_os}nvidia-k8s-device-plugin
@@ -18,6 +18,8 @@ Source2: nvidia-k8s-device-plugin-conf
 Source3: nvidia-k8s-device-plugin-exec-start-conf
 Source4: nvidia-k8s-device-plugin-mig-conf
 
+Patch0001: 1001-Ensure-that-generated-CDI-specs-do-not-contain-enabl.patch
+
 BuildRequires: %{_cross_os}glibc-devel
 Requires: %{name}(binaries)