refactor(nvca): consolidate the operator chart, neutralise defaults, unify release versioning

.bazelignore

@@ -45,7 +45,11 @@ src/libraries/python
 # @stargate_crates from the nested module) do not resolve against the
 # umbrella root MODULE.bazel.
 src/libraries/ts
-deploy
+# deploy is deliberately NOT ignored. The nvca-operator chart lives there and
+# its storage-capability catalog is a data dependency of Go tests under src/.
+# An ignored directory contributes no files to the sandbox, so the tests fail
+# to read it. deploy contains no BUILD files, so leaving it loadable adds no
+# packages: `bazel query //...` reports the same target count either way.
 docs
 fern
 infra

.github/workflows/build-test.yml

@@ -107,20 +107,6 @@ jobs:
       - name: Lint and render every chart with a CI values file
         run: ./tools/ci/check-helm-charts
 
-      - name: Check NVCA Operator chart is synced with its monorepo source
-        # Pins the version fields to whatever is already committed in the
-        # vendored chart, so this only fails on real content drift between
-        # src/compute-plane-services/nvca/deployments/nvca-operator and
-        # deploy/helm/nvca-operator/nvca-operator, not on pending version bumps.
-        run: |
-          set -euo pipefail
-          cd deploy/helm/nvca-operator
-          NVCA_VERSION="$(yq '.selfManaged.nvcaVersion' nvca-operator/values.yaml)" \
-          NVCA_OPERATOR_VERSION="$(yq '.appVersion' nvca-operator/Chart.yaml)" \
-          NVCA_SHARED_STORAGE_IMAGE_TAG="$(yq '.selfManaged.sharedStorage.imageTag' nvca-operator/values.yaml)" \
-          NVCA_OTEL_COLLECTOR_IMAGE_TAG="$(yq '.otelCollector.imageTag' nvca-operator/values.yaml)" \
-            make check-vendor-chart
-
       - name: Test NVCA default ownership
         run: |
           make -C deploy/helm/nvca-operator test-default-ownership

AGENTS.md

@@ -217,7 +217,6 @@ public snapshot; still follow OSS Snapshot Hygiene manually before finishing.
 |-------|----------|---------|
 | `documentation-style` | `ai-tooling/dev/skills/` | Public docs, AGENTS, and skill-writing style |
 | `nvcf-explore-stack` | `ai-tooling/dev/skills/` | Navigate the self-hosted stack topology and dependency graph |
-| `nvca-chart-release` | `ai-tooling/dev/skills/` | Release NVCA Operator chart changes from monorepo source to the vendored Helm chart |
 | `nvca-self-managed-install` | `ai-tooling/dev/skills/` | Install or validate the NVCA Operator chart against a self-managed control plane |
 | `nvca-values-customization` | `ai-tooling/dev/skills/` | Customize NVCA Operator Helm chart values in the monorepo |
 | `nvcf-self-managed-cli` | `ai-tooling/user/skills/` | Install, operate, and manage self-managed NVCF through `nvcf-cli` |

BUILD.bazel

@@ -39,6 +39,18 @@ exports_files(
     visibility = [":java_notice_consumers"],
 )
 
+# The nvca-operator chart lives under deploy/, which is excluded from gazelle
+# and so has no package of its own. Its storage-capability catalog is consumed
+# by Go tests under src/, so it is exported from the root package here.
+filegroup(
+    name = "nvca-operator-storage-capability-catalog",
+    srcs = [
+        "deploy/helm/nvca-operator/nvca-operator/files/nvcf-storage-capabilities-v1alpha1.schema.json",
+        "deploy/helm/nvca-operator/nvca-operator/files/nvcf-storage-capabilities-v1alpha1.yaml",
+    ],
+    visibility = ["//visibility:public"],
+)
+
 # Gazelle manages only the native Go subtrees listed in go.work.bazel.
 # nv-boot-parent and Cloud Tasks are also owned by the root Bazel module, but
 # their checked-in Java BUILD files are maintained manually and remain outside
@@ -58,7 +70,7 @@ exports_files(
 # gazelle:exclude bazel-out
 # gazelle:exclude bazel-testlogs
 # gazelle:exclude ci
-# gazelle:exclude deploy
+# gazelle:exclude deploy  # keeps gazelle out; .bazelignore deliberately does not ignore it
 # gazelle:exclude docs
 # gazelle:exclude examples
 # gazelle:exclude fern

deploy/helm/nvca-operator/Makefile

@@ -44,7 +44,7 @@ OCI_REGISTRY_NAMESPACE ?= <your-org>
 CHART_NAME := $(shell yq -r .name $(helm_dir)/Chart.yaml)
 CHART_VERSION := $(shell yq -r .version $(helm_dir)/Chart.yaml)
 
-.PHONY: install uninstall status lint template validate clean package push-oci sync-chart check-synced-chart render-values-from-stack install-from-stack test-render-values test-vendor-chart-image-tag test-build-release-assets test-release-image-manifest test-release-artifact-permissions test-package-release-assets test-attach-release-assets test-release-sbom-wrapper test-self-managed-nvca-image-reference test-otel-collector-compatibility test-image-pull-secret-defaults test-pod-disruption-budget test-first-class-byoo-values test-first-class-storage-worker-values test-default-ownership
+.PHONY: install uninstall status lint template validate clean package push-oci render-values-from-stack install-from-stack test-render-values test-build-release-assets test-release-image-manifest test-release-artifact-permissions test-package-release-assets test-attach-release-assets test-release-sbom-wrapper test-self-managed-nvca-image-reference test-otel-collector-compatibility test-image-pull-secret-defaults test-pod-disruption-budget test-first-class-byoo-values test-first-class-storage-worker-values test-default-ownership
 
 install:
 ifndef values
@@ -92,9 +92,6 @@ install-from-stack: render-values-from-stack
 test-render-values:
 	@bash ./tests/render_values_from_stack_env_test.sh
 
-test-vendor-chart-image-tag:
-	@bash ./tests/vendor_chart_image_tag_test.sh
-
 test-build-release-assets:
 	@bash ./tests/build_release_assets_test.sh
 
@@ -188,25 +185,3 @@ push-oci:
 	@echo "[push-oci] Cleaning up temporary package directory..."
 	@rm -rf ./packaged-charts
 	@echo "[push-oci] Cleanup complete."
-
-# Sync NVCA Operator chart from monorepo source chart
-vendor-chart:
-	@echo "🚀 [vendor-chart] Vendor NVCA Operator chart from local monorepo source..."
-	@./scripts/ci_vendor_nvca_operator_chart
-	@echo "🎉 [vendor-chart] Vendor complete. Deployments available in $(helm_dir)/"
-
-check-vendor-chart: vendor-chart
-	@echo "🚀 [check-vendor-chart] Checking if chart is synced..."
-	@if ! git diff --ignore-space-at-eol --exit-code -- .; then \
-		echo ""; \
-		echo "❌ [check-vendor-chart] Chart is NOT synced with source chart!"; \
-		echo ""; \
-		echo "📋 To fix this issue:"; \
-		echo "   1. Run: make vendor-chart"; \
-		echo "   2. Review and commit the changes"; \
-		echo "   3. Update your merge request"; \
-		echo ""; \
-		echo "💡 This ensures your deployment matches the monorepo source NVCA Operator chart."; \
-		exit 1; \
-	fi
-	@echo "🎉 [check-vendor-chart] Chart is synced."

deploy/helm/nvca-operator/nvca-operator/values.yaml

@@ -347,7 +347,7 @@ webhook:
 ##     - "self-managed": Cluster configuration managed by the self-hosted compute plane
 ngcConfig:
   username: '$oauthtoken'
-  serviceKey: "dummy-api-key"
+  serviceKey: ""
   serviceKeySecretName: "ngc-service-key"
   serviceKeySecretKeyName: "ngcServiceKey"
   apiURL: https://api.ngc.nvidia.com
@@ -403,7 +403,7 @@ helmManaged:
 ## All values below are under the 'selfManaged:' key, e.g. 'selfManaged.nvcaVersion'
 selfManaged:
   ## @param selfManaged.nvcaVersion (REQUIRED) Version of the NVCFBackend to use
-  nvcaVersion: "3.10.0"
+  nvcaVersion: ""
   ## @param selfManaged.featureGateValues (Optional) List of feature gates to enable. Defaults to ["DynamicGPUDiscovery"] if not specified.
   featureGateValues: ["DynamicGPUDiscovery"]
   ## @param selfManaged.gpuManualInstanceConfigB64 (Optional) Base64 encoded GPU manual instance configuration. Leave blank if not required.
@@ -425,19 +425,19 @@ selfManaged:
     imageRepository: ""
     imageTag: 0.160.0-nv-0.2.5
   ## @param selfManaged.icmsServiceURL URL of the ICMS service for self-managed clusters. Override with the endpoint generated during cluster registration.
-  icmsServiceURL: "http://icms.example.invalid:8080"
+  icmsServiceURL: ""
   ## @param selfManaged.icmsServiceHostHeaderOverride Optional Host header override for selfManaged.icmsServiceURL.
   icmsServiceHostHeaderOverride: ""
   ## @param selfManaged.revalServiceURL URL of the ReVal service for self-managed clusters. Override with the endpoint generated during cluster registration.
-  revalServiceURL: "http://reval.example.invalid:8080"
+  revalServiceURL: ""
   ## @param selfManaged.revalServiceHostHeaderOverride Optional Host header override for selfManaged.revalServiceURL.
   revalServiceHostHeaderOverride: ""
   ## @param selfManaged.natsURL URL of the NATS service for self-managed clusters. Override with the endpoint generated during cluster registration.
-  natsURL: "nats://nats.example.invalid:4222"
+  natsURL: ""
   ## @param selfManaged.natsHostOverride Optional TLS SNI host override for selfManaged.natsURL when using a tls or wss NATS URL.
   natsHostOverride: ""
   sharedStorage:
-    imageTag: 1.0.5
+    imageTag: ""
 ## @section Node Selector Configuration
 ## @param nodeSelector.key Node-selector Label key
 ## @param nodeSelector.value Node-selector Label value
@@ -573,5 +573,5 @@ clusterValidator:
     limits:
       cpu: 200m
       memory: 128Mi
-nameOverride: nvca-operator
-fullnameOverride: nvca-operator
+nameOverride: ""
+fullnameOverride: ""