build(deps): Bump NVIDIA/holodeck from 0.2.18 to 0.3.1

[dependabot]

Bumps NVIDIA/holodeck from 0.2.18 to 0.3.1.

Release notes

Sourced from NVIDIA/holodeck's releases.

v0.3.1 - Patch Release

Critical fixes for HA cluster NLB hairpin routing and VPC cleanup.

Bug Fixes

• HA NLB hairpin routing (#746, #762) — Control-plane nodes now use localhost:6443 for kubectl instead of the NLB endpoint, avoiding AWS NLB hairpin/loopback timeouts where a registered target connects through the NLB and gets routed back to itself.
• NLB internal scheme (#760) — NLB uses internal scheme to keep traffic within the VPC.
• NLB cleanup in periodic VPC cleaner (#762) — DeleteVPCResources now deletes NLB listeners, target groups, and load balancers before attempting subnet/IGW/VPC deletion, preventing DependencyViolation errors from NLB-owned ENIs.

CI

• Periodic cleanup update (#758) — Uses latest holodeck binary and supports manual dispatch.

Full Changelog

NVIDIA/holodeck@v0.3.0...v0.3.1

v0.3.0

Holodeck v0.3.0

A major release with production-grade cluster networking, custom templates, RPM distribution support, ARM64 improvements, and comprehensive CI/CD enhancements.

Highlights

• Production-Grade Cluster Networking — Private subnets, NAT gateways, separate security groups, SSM transport, and NLB support for HA clusters (#720–#728)
• Custom Templates — User-defined provisioning templates with full lifecycle phase support (#701–#706)
• RPM Support — First-class support for Rocky Linux 9, Amazon Linux 2023, and Fedora 42 across all runtime stacks (#676–#681)
• ARM64 Support — Automatic architecture inference from instance type, cross-validation, and runtime arch detection (#661–#669)
• Multi-Source Installation — Install NVIDIA drivers and container runtimes from package, runfile, or git sources (#635–#637)
• E2E Test Tiering — Smoke tests (pre-merge) and full suite (post-merge) for faster CI feedback (#740)
• Coverage Threshold Gate — 40% minimum unit test coverage enforced in CI (#754)

Bug Fixes

• Fixed node name newline injection in cluster mode (#757)
• Fixed NAT Gateway race condition (#735)
• Fixed API server verification before NLB switch (#721)
• Numerous SSH, security, and AWS provider fixes

See the full CHANGELOG for all changes.

Changelog

Sourced from NVIDIA/holodeck's changelog.

[v0.3.1] - 2026-03-31

Bug Fixes

• fix: HA NLB hairpin routing (#746, #762) — Control-plane nodes now use localhost:6443 for kubectl instead of the NLB endpoint, avoiding AWS NLB hairpin/loopback timeouts where a registered target connects through the NLB and gets routed back to itself.
• fix: switch HA NLB to internal scheme (#760) — NLB uses internal scheme to keep traffic within the VPC.
• fix: NLB cleanup in periodic VPC cleaner (#762) — DeleteVPCResources now deletes NLB listeners, target groups, and load balancers before attempting subnet/IGW/VPC deletion, preventing DependencyViolation errors from NLB-owned ENIs.

CI

• ci: update periodic cleanup to v0.3.0 and add manual trigger (#758) — Periodic cleanup workflow uses the latest holodeck binary and supports manual dispatch.

[v0.3.0] - 2026-03-30

Features

Production-Grade Cluster Networking (#720–#728)

A complete overhaul of multi-node cluster networking for production workloads:

• Add cluster networking cache constants and struct fields (#720, @​ArangoGutierrez)
• Add public subnet for cluster mode (#723, @​ArangoGutierrez)
• Add Transport abstraction for SSH connections (#724, @​ArangoGutierrez)
• Separate control-plane and worker security groups (#725, @​ArangoGutierrez)
• Cleanup dual security groups on cluster delete (#726, @​ArangoGutierrez)
• Wire SSM transport for private-subnet cluster nodes (#727, @​ArangoGutierrez)
• Wire cluster networking — private subnets, NAT, hostForNode, real tests (#728, @​ArangoGutierrez)
• Add ELBv2/NLB support for HA clusters (#614, @​ArangoGutierrez)

Custom Templates (#701–#706)

User-defined provisioning templates with full lifecycle phase support:

• Add CustomTemplate type and TemplatePhase enum to API (#701, @​ArangoGutierrez)
• Implement custom template loader and executor (#702, @​ArangoGutierrez)
• Add custom template input validation (#703, @​ArangoGutierrez)
• Integrate custom templates into dependency resolver (#706, @​ArangoGutierrez)

RPM Support (#676–#681, #693)

First-class support for RPM-based Linux distributions including Rocky Linux 9, Amazon Linux 2023, and Fedora 42 across all runtime stacks (Docker, containerd, CRI-O):

• Add RPM support to Docker template (#677, @​ArangoGutierrez)
• Add RPM support to NVIDIA driver template (#676, @​ArangoGutierrez)
• Add RPM support to Kubernetes templates (#678, @​ArangoGutierrez)
• Add RPM support to kernel template (#681, @​ArangoGutierrez)
• Add RPM support to CRI-O template (#680, @​ArangoGutierrez)
• Add RPM support to container-toolkit package template (#679, @​ArangoGutierrez)
• Add RPM docs, e2e validation, and Fedora 42 support (#693, @​ArangoGutierrez)
• Add DNF/YUM package manager support to provisioner

... (truncated)

Commits

• 4600c5a release: bump version to v0.3.1 (#763)
• 41454b9 fix: HA NLB hairpin routing and cleanup (#746) (#762)
• cd30218 fix: switch HA NLB to internal scheme to fix hairpin routing (#746) (#760)
• e3e086c ci: update periodic cleanup to v0.3.0 and add manual trigger (#758)
• df97ea3 release: bump version to v0.3.0 (#755)
• 177a186 fix: use grep -w for exact IP matching in cluster node configuration (#757)
• 2f61797 ci: add coverage threshold gate (40% minimum) (#754)
• f3b6498 test: add custom templates E2E test (#753)
• 779c6cc chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2...
• 603fe98 chore(deps): Bump github.com/aws/aws-sdk-go-v2/config (#744)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.