chore(deps): update helm release node-feature-discovery to ~0.19.0

[red-hat-konflux]

This PR contains the following updates:

Package	Update	Change
node-feature-discovery	minor	~0.18.0 → ~0.19.0

---

Release Notes

kubernetes-sigs/node-feature-discovery (node-feature-discovery)

v0.19.0

Compare Source

Highlights

• Immediate node re-labeling after a node rebuild (#​2545): nfd-master detects a recreated Node via the surviving NodeFeature's owner-reference / pod-UID annotation and re-labels immediately instead of waiting for the periodic reconcile.
• Configurable NodeFeature owner references: -owner-refs / core.ownerRefs (pod, ds, node; default pod,ds) (#​2545).
• core.noPublishFeatures to slim published NodeFeature objects (#​2530; whitespace-trim fix #​2535).
• New x86-64 microarchitecture level labels cpu-cpuid.X86_64_V1..V4 (#​2490).
• nfd-topology-updater: per-pod lookups served from a node-scoped Pod informer, eliminating high-volume per-pod GETs at scale (#​2509). Requires an RBAC update — see Action Required.
• nfd-master reconciles only on NodeFeature/NodeFeatureRule/NodeFeatureGroup spec changes (#​2532); MatchInRegexp pattern compilation cached (#​2531).

Action Required / Behavior Changes

1. nfd-topology-updater RBAC (#​2509): the ClusterRole needs list+watch on pods (was get only). Helm and kustomize manifests ship the update, but deployments that bump only the image will crash-loop with pods is forbidden ... cannot list resource "pods" until the new RBAC is applied.
2. NodeFeatureRule templates (#​2507): env, expandenv and getHostByName were removed from the available template functions (security hardening). Templates using them now fail to parse (function "env" not defined); the rule is skipped and an error is logged.
3. Helm worker updateStrategy default (#​2519): now rollingUpdate: {maxUnavailable: "10%"} (was Kubernetes default 1). Note for type: OnDelete users: the chart's default rollingUpdate block is deep-merged into your values; the API server accepts and ignores it (verified on v1.30). Optionally set worker.updateStrategy.rollingUpdate: null for a clean spec.
4. resyncPeriod (nfd-master): drives both the informer resync and the (new in this release, #​2415) periodic full reconcile that re-applies labels and cleans up drift. Setting it to 0 disables this safety net entirely.
5. Node-rebuild re-labeling dependency (#​2545): immediate re-label requires pod in -owner-refs (default) or the POD_UID env set on the worker; with ds-only/empty owner refs and no POD_UID, re-labeling falls back to the periodic reconcile interval. -owner-refs=node is unaffected.

Fixes

• nfd-master: don't remove node labels when the NodeFeature cache is incomplete; add periodic reconciliation to clean up genuinely absent NodeFeatures (#​2415).
• nfd-master: prevent stop() panic and informer leak on init failure (#​2534).
• nfd-worker: trim whitespace in comma-separated command-line list values (#​2535).
• Helm: render post-delete prune job resources at container level so they actually apply (#​2515).

Other

• Container images cross-compile from $BUILDPLATFORM via tonistiigi/xx (#​2512).
• Reduced cognitive complexity refactors in nfd-master controller and nfd-worker config (#​2536); nfd-master command-line unit tests (#​2469); codecov upload non-fatal in CI verify (#​2527); template/custom-api input-validation hardening (#​2507).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[red-hat-konflux]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (~0.19.0). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.