chore(deps): update nvidia-dcgm (patch)

[renovate]

This PR contains the following updates:

Package	Update	Change
dcgm-exporter	patch	4.8.2-1.azl3 → 4.8.2-3.azl3
dcgm-exporter	patch	4.8.2-ubuntu24.04u1 → 4.8.2-ubuntu24.04u3
dcgm-exporter	patch	4.8.2-ubuntu22.04u1 → 4.8.2-ubuntu22.04u3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[djsly]

AgentBaker Linux PR gate — E2E failure (mixed: 3 leaves shared infra; 1 ACL leaf likely on main)

• Run: 167166471 (failed)
• Failed: Run AgentBaker E2E → AzureCLI exit 1 (DONE 457 tests, 95 skipped, 5 failures in 1646.77s)

Group A — shared infra/test-fixture issue, NOT this PR (3 leaves):

• Test_Ubuntu2204Gen2_ImagePullIdentityBinding_NetworkIsolated/{default (6.57s), scriptless_nbc (0.00s)} — test_helpers.go:227 🔴 empty error, plus the parent container.
• Same sub-7s empty-error shape has now hit 5 unrelated PRs in 48h (this PR, #8600, #8330, #8654, #8653). Confirmed systemic — needs NodeSIG-dev / E2E-infra triage of the ImagePullIdentityBinding_NetworkIsolated private-cluster/ACR-private-endpoint precondition.

Group B — ACL FIPS TL leaf, very likely existing main regression (2 leaves):

• Test_ACLGen2FIPSTL/scriptless_nbc (265.83s) — validation.go:345 🔴: wireserver check "wireserver port 80 goalstate": unexpected curl exit code "0" (want 28 timeout or 7 refused) (plus root container).
• The test expects WireServer port 80 to be blocked (curl exit 28=timeout or 7=refused) but got 0 (HTTP 200 reachable). That's an ACL FIPS TL firewall/network policy assertion. This PR (nvidia-dcgm patch bump in parts/common/components.json) touches GPU package versions only and has no path to ACL networking. Strongly suggests an existing ACL FIPS TL regression on main, not caused by this PR.

Confidence: HIGH that this PR is not the cause of either failure group.

Recommended next action:

1. Rerun the failing job; do not block this PR on Group A.
2. NodeSIG-dev: file a tracker on the ACL FIPS TL wireserver-block regression in validation.go:345 (the test expectation flipped, or the ACL network policy unit shipped in the latest VHD no longer blocks WireServer); investigate against main head independently of any specific PR.
3. NodeSIG-dev / E2E-infra: triage the ImagePullIdentityBinding_NetworkIsolated fixture (sub-7s empty failures across multiple unrelated PRs).

Strongest alternative (less likely): transient ACR-private-endpoint outage for Group A + intermittent ACL firewall rule timing for Group B — refuted because each pattern is now reproducing deterministically on every recent PR build.

Posted by Clawpilot AgentBaker gate detective.

[surajssd]

Do not merge, until renovate also adds support for Azure Linux. Once this is merged: #8660 I don't have to manually say that we should not merge this.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[aks-node-assistant]

AgentBaker Linux PR gate — 236-failure run: shared cluster fleet outage continues (test-infra, NOT this PR)

• Run: 167422694 (failed)
• Failed task: Run AgentBaker E2E (full 60-minute timeout consumed)
• Test summary: DONE 402 tests, 95 skipped, 236 failures in ~3616s (~59% failure rate; 0 fwupd hits)

Same shared cluster fleet outage affecting every concurrent PR in this window: 123× get or create cluster: failed to wait for cluster abe2e-kubenet-v5-150ee to be ready: context deadline exceeded plus 36× ResourceGroupDeletionBlocked on shared MC RGs. Earlier overnight runs hit ~11 min; current runs consume the full 60-min E2E timeout, indicating the fleet is worse, not recovering.

Cross-PR pattern this morning: PR #8652 build 167419663, PR #8679 build 167421198, PR #8294 build 167422687, and concurrent PRs all hit identical 236-fail / cluster-not-ready signature.

Build-vs-test: test-infra (shared cluster fleet outage), NOT product, NOT PR-caused.
This PR's exposure check: nvidia-dcgm renovate patch bump (GPU monitoring). No path to shared test cluster lifecycle.
Confidence: HIGH that PR #8659 is not the cause.

Recommended next action / owner: ⚠️ E2E infra / NodeSIG-dev — urgent shared cluster fleet restoration required (abe2e-kubenet-v5-*, abe2e-latest-kubernetes-version-v2-*, abe2e-azure-networkisolated-v2-*, abe2e-azure-v4-*, abe2e-azure-bootstrapprofile-cache-v2-*); clear ResourceGroupDeletionBlocked locks. PR gate is effectively offline until restored. PR author: rerun once fleet recovers.

Posted by Clawpilot AgentBaker gate detective.

[aks-node-assistant]

AgentBaker Linux PR gate — 3 distinct E2E failures, all test-infra / shared-cluster (NOT this PR)

• Run: 167493131
• Failed job: Run AgentBaker E2E (all VHD builds passed)
• Failed scenarios: Test_AzureLinux_Skip_Binary_Cleanup/{default,scriptless_nbc}, Test_AzureLinuxV3_CustomSysctls/default, Test_Ubuntu2204_HTTPSProxy_PrivateDNS/{default,scriptless_nbc} (5 subtests across 3 scenarios)

Detective summary — two independent signatures

(1) wireserver-blocking-validator-assertion — both AzureLinux scenarios on shared cluster abe2e-kubenet-v5-150ee:

🔴 FAIL: wireserver check "wireserver port 80 goalstate":
        unexpected curl exit code "0" (want 28 timeout or 7 refused)

The validator asserts that the node's iptables rule blocks egress to 168.63.129.16:80. iptables shows the DROP rule is present (DROP ... 168.63.129.16 tcp dpt:80), but the test's curl still returns exit 0 — the rule isn't taking effect for the test's connection (likely matched against a stale conntrack/TIME_WAIT entry; logs show pre-existing 168.63.129.16 flows in conntrack). This is the same signature as build 167348372; second occurrence. Wiki: wireserver-blocking-validator-assertion.

(2) httpsproxy-fixture-proxy-unreachable — both HTTPSProxy_PrivateDNS subtests on shared cluster abe2e-azure-network-v4-ce2ad:

VMExtensionProvisioningError ... vmssCSE exit 99
W: Failed to fetch https://packages.microsoft.com/ubuntu/22.04/prod/dists/jammy/InRelease
   Could not connect to 10.14.0.193:8888 (10.14.0.193). - connect (111: Connection refused)

The CSE retries apt-get update 10 times against the scenario's HTTP proxy at 10.14.0.193:8888; the proxy endpoint refuses every attempt and CSE exits 99. The proxy is part of the test fixture (private DNS / HTTPS proxy scenario infra), not anything this PR touches. New signature.

Classification: Test infrastructure / shared-cluster issues. Neither failure is reachable from changes in PR #8659 (renovate nvidia-dcgm patch — does not touch wireserver/iptables, CSE, apt sources, or the proxy fixture).

Confidence: High for both (multiple subtests, identical signatures, no PR-relevant changed files, all VHD builds passed).

Strongest alternative theory: Recent change to aks-node CSE / iptables wiring that lets the wireserver block "miss" — less likely because the rule is present and counters match expected DROP behavior in the chain dump; the leak is at the conntrack/TIME_WAIT layer pre-dating the validator's curl. For the proxy: a transient ARM/MMS issue affecting 10.14.0.193. Less likely than fixture-side because the proxy is the only target refusing connections; the cluster, the VM, the AKS extension framework, and the AKS managed runtime all succeeded.

Recommended next action / owner:

• Wireserver-blocking validator: SIG Node Lifecycle test-code owner — make the validator tolerate pre-existing conntrack entries (curl with --local-port / fresh tuple), or flush conntrack for 168.63.129.16 before the curl probe. Pattern is now seen on two distinct PR runs and one cluster fixture.
• HTTPSProxy fixture: AgentBaker E2E test-infra — the proxy mirror behind 10.14.0.193:8888 on shared cluster abe2e-azure-network-v4-ce2ad is unreachable; check the proxy pod/daemon health on that fixture.
• No PR change required. Recommend rerun of the failed leg only.

Evidence used: failed task log (5 === FAIL markers across 3 distinct scenarios on 2 distinct shared clusters), all VHD builds succeeded, no changed file in PR #8659 touches wireserver/CSE/proxy code.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[aks-node-assistant]

AgentBaker Linux gate detective

Run: https://msazure.visualstudio.com/CloudNativeCompute/_build/results?buildId=168659199
Failed job/stage/task: Run AgentBaker E2E
First failing step/test: NetworkIsolated cluster reuse of abe2e-azure-networkisolated-v3-d6cc9

RCA: This is the recurring NetworkIsolated shared-cluster cleanup flake. E2E found existing cluster �be2e-azure-networkisolated-v3-d6cc9 already Failed/Deleting and failed before PR-specific scenario validation. Prior evidence for this same cluster shows ResourceGroupDeletionBlocked / InUseNetworkSecurityGroupCannotBeDeleted on �be2e-networkisolated-securityGroup still attached to the shared VNET subnet.

Confidence: High. Corroborated by timeline/status, Run AgentBaker E2E log 538, unrelated PRs hitting the same cluster/signature, and the existing repair item #38506740.

Strongest alternative: the nvidia-dcgm Renovate payload caused E2E provisioning; less likely because the failure occurs while acquiring a pre-existing shared NetworkIsolated cluster already in bad lifecycle state.

Recommended owner/action: AgentBaker E2E test-infra owner: clean/quarantine �be2e-azure-networkisolated-v3-d6cc9, remove the stuck NSG/subnet association, and harden shared-cluster cleanup/retry.

Wiki signature:
etworkisolated-shared-cluster-delete-blocked-inuse-nsg (source of truth)

[aks-node-assistant]

AgentBaker Linux gate detective

Run: https://msazure.visualstudio.com/CloudNativeCompute/_build/results?buildId=168575141
Failed job/stage/task: $(System.Collections.Hashtable.job)
First failing step/test: $(System.Collections.Hashtable.first)

RCA: E2E infra failure: multiple shared clusters were already Failed/Deleting and cleanup was blocked by ResourceGroupDeletionBlocked / InUseRouteTableCannotBeDeleted on route table abe2e-fw-rt. This is not caused by the nvidia-dcgm Renovate change.

Confidence: High for the primary signature. Corroborated by timeline/status, focused failed logs, associated changes, and the flakiness wiki before publishing.

Strongest alternative: nvidia-dcgm package update caused E2E failure; less likely because the failure is pre-validation shared-cluster lifecycle state across unrelated clusters.

Recommended owner/action: AgentBaker E2E test-infra: clean stale shared clusters and unblock route table dependencies.

Wiki signature: $(System.Collections.Hashtable.sig) (source of truth)

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[aks-node-assistant]

AgentBaker Linux gate detective

Run: https://msazure.visualstudio.com/CloudNativeCompute/_build/results?buildId=168775762
Failed job/stage/task: Run AgentBaker E2E
Summary: E2E emitted slow node/pod readiness warnings and then failed with the same broad node-readiness timeout class (kube.go:199 / panic.go:694) seen across unrelated PRs.
Likely cause/signature: known shared E2E cluster/fleet readiness flake, shared-cluster-fleet-outage.
Confidence: medium-high.
Strongest alternative: PR #8659's nvidia-dcgm update caused node readiness regressions; less likely because the concurrent burst spans unrelated dependency PRs and scenario families.
Recommended next action/owner: E2E shared-cluster infra owners; continue repair item https://msazure.visualstudio.com/CloudNativeCompute/_workitems/edit/38373323.
Wiki: shared-cluster-fleet-outage — https://dev.azure.com/msazure/09706533-03bf-4b43-9a9b-b49c75429646/_wiki/wikis/ed4a85e9-1085-4151-a39b-2753523eba2b?pagePath=%2FAKS%2FSIGs%20and%20Teams%2FAKS%20Components%2FSIG%3A%20Node%20Lifecycle%2FAI%20Agent%20Knowledge%2FAgentBaker%20Gate%20PR%20Pipeline%20Flakiness

[aks-node-assistant]

AgentBaker Linux gate detective

Run: https://msazure.visualstudio.com/CloudNativeCompute/_build/results?buildId=168796845
Failed job/stage/task: Run AgentBaker E2E
Summary: E2E hit the same shared dual-stack cluster/fleet outage: �be2e-azure-overlay-dualstack-v6-4a24b was unexpectedly Deleting, with additional slow pod readiness and NetworkUnavailable=True / Waiting for cloud routes symptoms. Concurrent CIS regressions are separate.
Likely cause/signature: shared-cluster-fleet-outage.
Confidence: high.
Strongest alternative: PR #8659's nvidia-dcgm update caused the failure; less likely because failures are non-GPU, cross-scenario, and match unrelated PRs in the same wave.
Recommended next action/owner: E2E shared-cluster infra owners; continue repair item https://msazure.visualstudio.com/CloudNativeCompute/_workitems/edit/38373323.
Wiki: shared-cluster-fleet-outage — https://dev.azure.com/msazure/09706533-03bf-4b43-9a9b-b49c75429646/_wiki/wikis/ed4a85e9-1085-4151-a39b-2753523eba2b?pagePath=%2FAKS%2FSIGs%20and%20Teams%2FAKS%20Components%2FSIG%3A%20Node%20Lifecycle%2FAI%20Agent%20Knowledge%2FAgentBaker%20Gate%20PR%20Pipeline%20Flakiness

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[aks-node-assistant]

AgentBaker Linux gate detective

Run: https://msazure.visualstudio.com/CloudNativeCompute/_build/results?buildId=168928859
Failed job/stage/task: Run AgentBaker E2E
Summary: E2E failed in Test_Ubuntu2204_HTTPSProxy_PrivateDNS/default with preparing AKS node failed /
unning scenario failed. In the same outage window this most closely matches the known shared fleet/node-readiness signature.
Likely cause/signature: probable shared-cluster-fleet-outage.
Confidence: medium; the fetched excerpt did not include explicit deleting/missing node-RG lines for this exact run.
Strongest alternative: PR #8659's nvidia-dcgm update caused the failure; less likely because the failing scenario is HTTPSProxy/PrivateDNS, not DCGM-specific, and neighboring runs show shared infra failures.
Recommended next action/owner: E2E shared-cluster infra owners; continue repair item https://msazure.visualstudio.com/CloudNativeCompute/_workitems/edit/38373323.
Wiki: shared-cluster-fleet-outage — https://dev.azure.com/msazure/09706533-03bf-4b43-9a9b-b49c75429646/_wiki/wikis/ed4a85e9-1085-4151-a39b-2753523eba2b?pagePath=%2FAKS%2FSIGs%20and%20Teams%2FAKS%20Components%2FSIG%3A%20Node%20Lifecycle%2FAI%20Agent%20Knowledge%2FAgentBaker%20Gate%20PR%20Pipeline%20Flakiness

[aks-node-assistant]

AgentBaker Linux gate detective

Run: https://msazure.visualstudio.com/CloudNativeCompute/_build/results?buildId=168921966
Failed job/stage/task: Run AgentBaker E2E / Test_Version_Consistency_GPU_Managed_Components
Summary: GPU managed component version consistency failed immediately after this PR's nvidia-dcgm update; pod readiness warning appears secondary.
Likely cause/signature: gpu-managed-components-version-consistency-nvidia-dcgm.
Confidence: high.
Strongest alternative: infra/pod readiness flake; less likely because the first semantic failure is version consistency and aligns with the PR change.
Recommended next action/owner: GPU managed-components owner: align DCGM version references/expected metadata/test data.
Wiki: gpu-managed-components-version-consistency-nvidia-dcgm — https://dev.azure.com/msazure/09706533-03bf-4b43-9a9b-b49c75429646/_wiki/wikis/ed4a85e9-1085-4151-a39b-2753523eba2b?pagePath=%2FAKS%2FSIGs%20and%20Teams%2FAKS%20Components%2FSIG%3A%20Node%20Lifecycle%2FAI%20Agent%20Knowledge%2FAgentBaker%20Gate%20PR%20Pipeline%20Flakiness

[aks-node-assistant]

AgentBaker Linux gate detective

Run: https://msazure.visualstudio.com/CloudNativeCompute/_build/results?buildId=168889354
Failed job/stage/task: Run AgentBaker E2E / Test_Ubuntu2404Gen2/scriptless_nbc
Summary: Node became Ready but retained NetworkUnavailable=True / Waiting for cloud routes; later pod exec to kubelet :10250 returned 502 Bad Gateway. LocalDNS exporter validation passed.
Likely cause/signature: shared-cluster-fleet-outage.
Confidence: high.
Strongest alternative: LocalDNS exporter failed-unit issue; less likely because exporter validation passed and final failure is kubelet proxy/network route related.
Recommended next action/owner: E2E/fleet infra owner; continue repair item https://msazure.visualstudio.com/CloudNativeCompute/_workitems/edit/38373323.
Wiki: shared-cluster-fleet-outage — https://dev.azure.com/msazure/09706533-03bf-4b43-9a9b-b49c75429646/_wiki/wikis/ed4a85e9-1085-4151-a39b-2753523eba2b?pagePath=%2FAKS%2FSIGs%20and%20Teams%2FAKS%20Components%2FSIG%3A%20Node%20Lifecycle%2FAI%20Agent%20Knowledge%2FAgentBaker%20Gate%20PR%20Pipeline%20Flakiness

[aks-node-assistant]

AgentBaker Linux gate detective

Run: https://msazure.visualstudio.com/CloudNativeCompute/_build/results?buildId=168868981
Failed job/stage/task: Run AgentBaker E2E / Test_Version_Consistency_GPU_Managed_Components
Summary: GPU managed component version consistency failed immediately after this PR's nvidia-dcgm update. HTTPSProxy and pod readiness signals appear secondary.
Likely cause/signature: gpu-managed-components-version-consistency-nvidia-dcgm.
Confidence: high.
Strongest alternative: infra/pod readiness flake; less likely because the first semantic failure is version consistency and aligns with the PR change.
Recommended next action/owner: GPU managed-components owner: align DCGM expected versions/metadata/test data.
Wiki: gpu-managed-components-version-consistency-nvidia-dcgm — https://dev.azure.com/msazure/09706533-03bf-4b43-9a9b-b49c75429646/_wiki/wikis/ed4a85e9-1085-4151-a39b-2753523eba2b?pagePath=%2FAKS%2FSIGs%20and%20Teams%2FAKS%20Components%2FSIG%3A%20Node%20Lifecycle%2FAI%20Agent%20Knowledge%2FAgentBaker%20Gate%20PR%20Pipeline%20Flakiness

[aks-node-assistant]

@C:\Users\SYLVAI~1\AppData\Local\Temp\ab-gate-pr8659-169034678-comment.md

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[aks-node-assistant]

@C:\Users\SYLVAI~1\AppData\Local\Temp\ab-gate-pr8659-169061016-comment.md