From d7c2a2e549799ab12ece5439547beed3abc3e5fb Mon Sep 17 00:00:00 2001 From: Stephanie Baum Date: Mon, 3 Aug 2026 17:21:39 -0700 Subject: [PATCH 1/7] test(bdd): cover compute observability profile Add explicit kube-context secret setup and optional NVCA image overrides so local split-cluster installs exercise the compute profile with published multi-arch images. Relates to #522 Signed-off-by: Stephanie Baum --- .../helmfile.d/02-nvca.yaml.gotmpl | 27 +-- .../tests/observability-profile.sh | 8 + tests/bdd/dsl/kubectl.go | 18 ++ tests/bdd/dsl/kubectl_test.go | 22 +++ .../features/observability-compute.feature | 173 ++++++++++++++++++ tests/bdd/godog_test.go | 157 ++++++++++++++++ tests/bdd/steps/infra_steps.go | 34 +++- tests/bdd/steps/steps_test.go | 25 +++ 8 files changed, 448 insertions(+), 16 deletions(-) create mode 100644 tests/bdd/features/observability-compute.feature diff --git a/deploy/stacks/nvcf-compute-plane/helmfile.d/02-nvca.yaml.gotmpl b/deploy/stacks/nvcf-compute-plane/helmfile.d/02-nvca.yaml.gotmpl index 6641d259c..50def3244 100644 --- a/deploy/stacks/nvcf-compute-plane/helmfile.d/02-nvca.yaml.gotmpl +++ b/deploy/stacks/nvcf-compute-plane/helmfile.d/02-nvca.yaml.gotmpl @@ -87,8 +87,11 @@ helmDefaults: {{- if $environmentAgentMergeConfig }} {{- $agentMergeConfig = mergeOverwrite $agentMergeConfig ($environmentAgentMergeConfig | fromYaml | default dict) }} {{- end }} +{{- $nvcaOp := dig "nvcaOperator" dict .Values.global }} +{{- $selfManaged := dig "selfManaged" dict $nvcaOp }} +{{- $otelCollector := dig "otelCollector" dict $selfManaged }} +{{- $otelCollectorEnabled := dig "enabled" $computeObservabilityEnabled $otelCollector }} -{{- $selfManaged := dig "nvcaOperator" "selfManaged" dict .Values.global }} {{- $featureGateValues := dig "featureGateValues" list $selfManaged }} {{- $kaiSchedulerEnabled := dig "addons" "kaiScheduler" "enabled" false .Values }} {{- $dynamoOperatorEnabled := dig "addons" "dynamoOperator" "enabled" false .Values }} @@ -150,11 +153,9 @@ helmDefaults: releases: - name: nvca-operator - # Released chart from nvca-operator-deploy. The chart bakes its own - # image.tag + selfManaged.nvcaVersion (set by `make vendor-chart` from - # nvca-operator-deploy/.env), so no inline tag override is needed; the - # nvca + nvca-operator images are mirrored to the environment registry by - # regsync-configs. + # Released chart from nvca-operator-deploy. The chart supplies default + # image.tag and selfManaged.nvcaVersion values. Environments can override + # them when validating a newer mirrored NVCA build. chart: nvcf/helm-nvca-operator version: 1.14.0 namespace: nvca-operator @@ -166,10 +167,13 @@ releases: # read by the nvca-operator chart. - {{ $registrationValuesPath | quote }} # Resolve operator + nvca images through global.image.{registry,repository}. - # The chart's image.tag and selfManaged.nvcaVersion defaults supply the - # actual image tag; this block only overrides repository and pullPolicy. + # The chart defaults supply image versions unless the environment sets + # global.nvcaOperator.imageTag or selfManaged.nvcaVersion. - image: repository: {{ .Values.global.image.registry }}/{{ .Values.global.image.repository }}/nvca-operator + {{- with dig "imageTag" "" $nvcaOp }} + tag: {{ . | quote }} + {{- end }} pullPolicy: IfNotPresent nvcaImage: repositoryOverride: {{ .Values.global.image.registry }}/{{ .Values.global.image.repository }}/nvca @@ -191,11 +195,11 @@ releases: clusterSource: self-managed clusterName: {{ requiredEnv "CLUSTER_NAME" }} ncaId: {{ requiredEnv "NCA_ID" }} - {{- $selfManaged := dig "nvcaOperator" "selfManaged" dict .Values.global }} - {{- $otelCollector := dig "otelCollector" dict $selfManaged }} - {{- $otelCollectorEnabled := dig "enabled" $computeObservabilityEnabled $otelCollector }} selfManaged: identitySource: psat + {{- with dig "nvcaVersion" "" $selfManaged }} + nvcaVersion: {{ . | quote }} + {{- end }} {{- with dig "icmsServiceURL" "" $selfManaged }} icmsServiceURL: {{ . | quote }} {{- end }} @@ -251,7 +255,6 @@ releases: networkPolicy: {{ toYaml . | nindent 10 }} {{- end }} - {{- $nvcaOp := dig "nvcaOperator" dict .Values.global }} {{- if .Values.global.nodeSelector.enabled }} nodeSelector: key: {{ .Values.global.nodeSelector.key | quote }} diff --git a/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh b/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh index 32c2938b7..b42e1b992 100755 --- a/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh +++ b/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh @@ -75,6 +75,8 @@ for profile in default disabled control compute all; do done render_values compute "$work_dir/compute-overrides.yaml" \ + --state-values-set-string global.nvcaOperator.imageTag=3.1.0 \ + --state-values-set-string global.nvcaOperator.selfManaged.nvcaVersion=3.1.0 \ --state-values-set global.nvcaOperator.selfManaged.otelCollector.enabled=false \ --state-values-set-string global.nvcaOperator.selfManaged.otelCollector.imageRepository=registry.example.com/nvcf/collector \ --state-values-set-string global.nvcaOperator.selfManaged.otelCollector.imageTag=test-tag \ @@ -94,6 +96,12 @@ grep -Eq '^ imageRepository: "?registry\.example\.com/nvcf/collector"?$' \ grep -Eq '^ imageTag: "?test-tag"?$' \ "$work_dir/compute-overrides.yaml" || fail "explicit collector image tag was not preserved" +grep -Eq '^ tag: "?3\.1\.0"?$' \ + "$work_dir/compute-overrides.yaml" || + fail "explicit operator image tag was not preserved" +grep -Eq '^ nvcaVersion: "?3\.1\.0"?$' \ + "$work_dir/compute-overrides.yaml" || + fail "explicit NVCA version was not preserved" render_values control "$work_dir/control-overrides.yaml" \ --state-values-set global.nvcaOperator.selfManaged.otelCollector.enabled=true \ diff --git a/tests/bdd/dsl/kubectl.go b/tests/bdd/dsl/kubectl.go index b156d5f13..d25b6fb61 100644 --- a/tests/bdd/dsl/kubectl.go +++ b/tests/bdd/dsl/kubectl.go @@ -52,6 +52,24 @@ func ServiceMonitorExistenceCommand(namespace, kubeContext string, names []strin return strings.Join(args, " "), nil } +// KubectlApplyCommand builds a kubectl apply command for a manifest file. +// When kubeContext is set, the command always targets that context instead of +// relying on the caller's ambient kubeconfig selection. +func KubectlApplyCommand(manifestPath, kubeContext string) (string, error) { + manifestPath = strings.TrimSpace(manifestPath) + kubeContext = strings.TrimSpace(Interpolate(kubeContext)) + if manifestPath == "" { + return "", fmt.Errorf("manifest path is empty") + } + + args := []string{"kubectl"} + if kubeContext != "" { + args = append(args, "--context", quoteCommandArg(kubeContext)) + } + args = append(args, "apply", "-f", quoteCommandArg(manifestPath)) + return strings.Join(args, " "), nil +} + func quoteCommandArg(value string) string { if isCommandArgSafe(value) { return value diff --git a/tests/bdd/dsl/kubectl_test.go b/tests/bdd/dsl/kubectl_test.go index e951d03b2..29c5739a9 100644 --- a/tests/bdd/dsl/kubectl_test.go +++ b/tests/bdd/dsl/kubectl_test.go @@ -40,3 +40,25 @@ func TestServiceMonitorExistenceCommandRejectsEmptyNames(t *testing.T) { t.Fatal("expected empty names error") } } + +func TestKubectlApplyCommandTargetsExplicitContext(t *testing.T) { + got, err := KubectlApplyCommand("/tmp/bdd manifests/secret.yaml", "k3d-ncp-local-compute-1") + if err != nil { + t.Fatalf("build command: %v", err) + } + want := "kubectl --context k3d-ncp-local-compute-1 apply -f '/tmp/bdd manifests/secret.yaml'" + if got != want { + t.Fatalf("command = %q, want %q", got, want) + } +} + +func TestKubectlApplyCommandAllowsAmbientContext(t *testing.T) { + got, err := KubectlApplyCommand("/tmp/secret.yaml", "") + if err != nil { + t.Fatalf("build command: %v", err) + } + want := "kubectl apply -f /tmp/secret.yaml" + if got != want { + t.Fatalf("command = %q, want %q", got, want) + } +} diff --git a/tests/bdd/features/observability-compute.feature b/tests/bdd/features/observability-compute.feature new file mode 100644 index 000000000..d8110566a --- /dev/null +++ b/tests/bdd/features/observability-compute.feature @@ -0,0 +1,173 @@ +@observability @compute @ncp-local @multi-cluster @helmfile +Feature: Install local Helmfile observability with the compute profile + As a self-managed NVCF operator, + I want to install the compute observability profile on a local split-cluster + topology, + so that the compute plane exports workload and NVCA metrics without running + control-plane-only observability components. + + Background: + Given environment variable "NGC_API_KEY" is set + And environment variable "SAMPLE_NGC_ORG" is set + And environment variable "SAMPLE_NGC_TEAM" is set + And environment variable "NVCF_CLI" is set + And environment variable "REPO_ROOT" is set + # Helmfile pulls OCI charts during installation. Keep $NGC_API_KEY unbraced + # so the BDD runner does not expand it into command logs. + And command has succeeded: + """ + bash -c 'set -eo pipefail; printf %s "$NGC_API_KEY" | helm registry login nvcr.io --username "\$oauthtoken" --password-stdin' + """ + # Install only control-plane prerequisites on ncp-local-cp. Shared + # observability is installed separately on the compute cluster below. + And I copy the file "tests/bdd/fixtures/self-managed-local-bdd-multi.yaml" to "deploy/stacks/self-managed/environments/local-bdd-observability-compute.yaml" + And I update yaml file "deploy/stacks/self-managed/environments/local-bdd-observability-compute.yaml" with keys: + | global.imagePullSecrets[0].name | nvcr-pull-secret | + | global.helm.sources.repository | ${SAMPLE_NGC_ORG}/${SAMPLE_NGC_TEAM} | + | global.image.repository | ${SAMPLE_NGC_ORG}/${SAMPLE_NGC_TEAM} | + | api.env.NVCF_SIDECARS_LLM_ROUTER_CLIENT_IMAGE | nvcr.io/${SAMPLE_NGC_ORG}/${SAMPLE_NGC_TEAM}/stargate-client:0.2.0 | + | addons.llm.enabled | false | + | observability.profile | disabled | + # Configure the shared observability stack for compute-plane monitors. + And I copy the file "tests/bdd/fixtures/self-managed-local-bdd-multi.yaml" to "deploy/stacks/observability/environments/local-bdd-observability-compute.yaml" + And I update yaml file "deploy/stacks/observability/environments/local-bdd-observability-compute.yaml" with keys: + | global.imagePullSecrets[0].name | nvcr-pull-secret | + | global.helm.sources.repository | ${SAMPLE_NGC_ORG}/${SAMPLE_NGC_TEAM} | + | global.image.repository | ${SAMPLE_NGC_ORG}/${SAMPLE_NGC_TEAM} | + | observability.profile | compute | + # Configure NVCA to use the same compute observability profile. + # Use the collector built from this checkout's pinned collector version in + # the supplied test registry so the local arm64 and amd64 paths are valid. + And I copy the file "tests/bdd/fixtures/nvcf-compute-plane-local-bdd-multi.yaml" to "deploy/stacks/nvcf-compute-plane/environments/local-bdd-observability-compute.yaml" + And I update yaml file "deploy/stacks/nvcf-compute-plane/environments/local-bdd-observability-compute.yaml" with keys: + | global.imagePullSecrets[0].name | nvcr-pull-secret | + | global.helm.sources.repository | ${SAMPLE_NGC_ORG}/${SAMPLE_NGC_TEAM} | + | global.image.repository | ${SAMPLE_NGC_ORG}/${SAMPLE_NGC_TEAM} | + | global.nvcaOperator.imageTag | 3.1.0 | + | global.nvcaOperator.selfManaged.nvcaVersion | 3.1.0 | + | global.nvcaOperator.selfManaged.otelCollector.imageRepository | nvcr.io/${SAMPLE_NGC_ORG}/${SAMPLE_NGC_TEAM}/nvcf-otel-collector | + | global.nvcaOperator.selfManaged.otelCollector.imageTag | 0.157.8 | + | observability.profile | compute | + And I copy the file "deploy/stacks/self-managed/secrets/secrets.yaml.template" to "deploy/stacks/self-managed/secrets/local-bdd-observability-compute-secrets.yaml" + And I substitute "REPLACE_WITH_BASE64_DOCKER_CREDENTIAL" in file "deploy/stacks/self-managed/secrets/local-bdd-observability-compute-secrets.yaml" with base64 of "$oauthtoken:${NGC_API_KEY}" + # Conflict precheck: single-cluster ncp-local claims host ports used by the + # split topology. From the repository root, run + # `make -C tools/ncp-local-cluster destroy CLUSTER_NAME=ncp-local` + # before retrying. + Given I run command "k3d cluster get ncp-local" + And the command exit code should be 1 + And multi-cluster ncp-local compute clusters are running: + | ncp-local-compute-1 | + # Write isolated kubeconfig files so installs and registration never rely + # on whichever context is current in the operator's default kubeconfig. + And command has succeeded: + """ + k3d kubeconfig merge ncp-local-cp --output ${REPO_ROOT}/tests/bdd/out/ncp-local-cp-kubeconfig.yaml --overwrite --kubeconfig-switch-context=false + """ + And command has succeeded: + """ + k3d kubeconfig merge ncp-local-compute-1 --output ${REPO_ROOT}/tests/bdd/out/ncp-local-compute-1-kubeconfig.yaml --overwrite --kubeconfig-switch-context=false + """ + And the "nvcr-pull-secret" image pull secret exists in namespaces using context "k3d-ncp-local-cp": + | cassandra-system | + | nats-system | + | nvcf | + | api-keys | + | ess | + | sis | + | vault-system | + | cert-manager | + And the "nvcr-pull-secret" image pull secret exists in namespaces using context "k3d-ncp-local-compute-1": + | monitoring | + | nvca-operator | + + Scenario: Compute profile installs shared infrastructure and compute monitors + When I run command: + """ + make -C deploy/stacks/self-managed install HELMFILE_ENV=local-bdd-observability-compute KUBECONFIG_FILE=${REPO_ROOT}/tests/bdd/out/ncp-local-cp-kubeconfig.yaml + """ + Then the command exit code should be 0 + + When I run command: + """ + make -C deploy/stacks/nvcf-compute-plane register-cluster CLUSTER_NAME=ncp-local-compute-1 KUBECONFIG_FILE=${REPO_ROOT}/tests/bdd/out/ncp-local-compute-1-kubeconfig.yaml NVCF_CLI=${NVCF_CLI} NVCF_CLI_CONFIG=${REPO_ROOT}/tests/bdd/fixtures/nvcf-cli-local.yaml + """ + Then the command exit code should be 0 + And file "deploy/stacks/nvcf-compute-plane/registration/ncp-local-compute-1-register-values.yaml" should exist + And yaml file "deploy/stacks/nvcf-compute-plane/registration/ncp-local-compute-1-register-values.yaml" key "clusterID" should not be empty + And yaml file "deploy/stacks/nvcf-compute-plane/registration/ncp-local-compute-1-register-values.yaml" key "clusterGroupID" should not be empty + + When I run command: + """ + make -C deploy/stacks/observability install HELMFILE_ENV=local-bdd-observability-compute KUBECONFIG_FILE=${REPO_ROOT}/tests/bdd/out/ncp-local-compute-1-kubeconfig.yaml + """ + Then the command exit code should be 0 + + When I run command: + """ + make -C deploy/stacks/nvcf-compute-plane install CLUSTER_NAME=ncp-local-compute-1 HELMFILE_ENV=local-bdd-observability-compute KUBECONFIG_FILE=${REPO_ROOT}/tests/bdd/out/ncp-local-compute-1-kubeconfig.yaml NVCF_CLI=${NVCF_CLI} NVCF_CLI_CONFIG=${REPO_ROOT}/tests/bdd/fixtures/nvcf-cli-local.yaml + """ + Then the command exit code should be 0 + + # Self-hosted NVCA intentionally creates an empty NGC service-key secret. + # The local compute-profile test supplies its existing NGC credential so + # the collector's bearer-token extension can start. Keep $NGC_API_KEY + # unbraced so the BDD runner does not expand it into command logs. + And command has succeeded: + """ + bash -c 'set -eo pipefail; printf %s "$NGC_API_KEY" | kubectl --context k3d-ncp-local-compute-1 create secret generic ngc-service-api-key --namespace nvca-system --from-file=ngc-service-api-key=/dev/stdin --dry-run=client -o yaml | kubectl --context k3d-ncp-local-compute-1 apply -f -' + """ + And command has succeeded: + """ + kubectl --context k3d-ncp-local-compute-1 delete pod --namespace nvca-system --selector app.kubernetes.io/name=nvca --wait=false + """ + + When I run command "helm list --all-namespaces --kube-context k3d-ncp-local-compute-1 -o json" + Then the json output should contain rows: + | name | namespace | status | + | prometheus-operator-crds | monitoring | deployed | + | opentelemetry-operator | monitoring | deployed | + | victoria-metrics | monitoring | deployed | + | otel-collector | monitoring | deployed | + | default-monitors | monitoring | deployed | + | nvca-operator | nvca-operator | deployed | + + When I run command "kubectl rollout status deployment/nvca-operator -n nvca-operator --context k3d-ncp-local-compute-1 --timeout=10m" + Then the command exit code should be 0 + When I run command "kubectl wait nvcfbackend ncp-local-compute-1 -n nvca-operator --context k3d-ncp-local-compute-1 --for=jsonpath={.status.agentStatus}=healthy --timeout=10m" + Then the command exit code should be 0 + + When I run command "kubectl get opentelemetrycollector nvcf-observability -n monitoring --context k3d-ncp-local-compute-1 -o jsonpath='{.spec.targetAllocator.enabled}'" + Then the command exit code should be 0 + And the command output should contain "true" + + Then these ServiceMonitors should exist in namespace "monitoring" using context "k3d-ncp-local-compute-1": + | name | + | nvcf-default-monitors-nvca | + + When I run command "kubectl get podmonitor/nvcf-default-monitors-dcgm podmonitor/nvcf-default-monitors-worker --namespace monitoring --context k3d-ncp-local-compute-1" + Then the command exit code should be 0 + + When I run command "kubectl get servicemonitor --namespace monitoring --context k3d-ncp-local-compute-1 -o name" + Then the command exit code should be 0 + And the command output should not contain "nvcf-default-monitors-state-metrics" + And the command output should not contain "nvcf-default-monitors-grpc-proxy" + And the command output should not contain "nvcf-default-monitors-llm-api-gateway" + And the command output should not contain "nvcf-default-monitors-invocation-service" + + When I run command: + """ + bash -c 'set -eo pipefail; helm get values nvca-operator --namespace nvca-operator --kube-context k3d-ncp-local-compute-1 -o json | jq -r ".selfManaged.otelCollector.enabled"' + """ + Then the command exit code should be 0 + And the command output should contain "true" + When I run command: + """ + bash -c 'set -eo pipefail; helm get values nvca-operator --namespace nvca-operator --kube-context k3d-ncp-local-compute-1 -o json | jq -r ".selfManaged.featureGateValues[]"' + """ + Then the command exit code should be 0 + And the command output should contain "BYOObservability" + + When I run command "helm status function-autoscaler --namespace nvcf --kube-context k3d-ncp-local-compute-1" + Then the command exit code should be 1 + And the command output should contain "release: not found" diff --git a/tests/bdd/godog_test.go b/tests/bdd/godog_test.go index cb58e54c8..09ca6b08e 100644 --- a/tests/bdd/godog_test.go +++ b/tests/bdd/godog_test.go @@ -564,6 +564,153 @@ func observabilityControlHelmListJSON() string { ]` } +// TestObservabilityComputeFeatureFileWiresToSteps runs the live-install +// observability-compute feature against a fake runner. It checks that every +// cluster operation is explicitly routed to the local control or compute +// cluster and that the compute profile verifies its releases and monitors. +func TestObservabilityComputeFeatureFileWiresToSteps(t *testing.T) { + const ( + registryLoginCommand = `bash -c 'set -eo pipefail; printf %s "$NGC_API_KEY" | helm registry login nvcr.io --username "\$oauthtoken" --password-stdin'` + serviceMonitorCommand = "kubectl get servicemonitor/nvcf-default-monitors-nvca" + + " --namespace monitoring --context k3d-ncp-local-compute-1" + podMonitorCommand = "kubectl get podmonitor/nvcf-default-monitors-dcgm" + + " podmonitor/nvcf-default-monitors-worker" + + " --namespace monitoring --context k3d-ncp-local-compute-1" + collectorEnabledCommand = `bash -c 'set -eo pipefail; helm get values nvca-operator --namespace nvca-operator --kube-context k3d-ncp-local-compute-1 -o json | jq -r ".selfManaged.otelCollector.enabled"'` + featureGatesCommand = `bash -c 'set -eo pipefail; helm get values nvca-operator --namespace nvca-operator --kube-context k3d-ncp-local-compute-1 -o json | jq -r ".selfManaged.featureGateValues[]"'` + serviceKeyCommand = `bash -c 'set -eo pipefail; printf %s "$NGC_API_KEY" |` + + ` kubectl --context k3d-ncp-local-compute-1 create secret generic ngc-service-api-key` + + ` --namespace nvca-system --from-file=ngc-service-api-key=/dev/stdin --dry-run=client -o yaml |` + + ` kubectl --context k3d-ncp-local-compute-1 apply -f -'` + restartNVCACommand = "kubectl --context k3d-ncp-local-compute-1 delete pod --namespace nvca-system --selector app.kubernetes.io/name=nvca --wait=false" + ) + t.Setenv("NGC_API_KEY", "test-key") + t.Setenv("SAMPLE_NGC_ORG", "test-org") + t.Setenv("SAMPLE_NGC_TEAM", "test-team") + t.Setenv("NVCF_CLI", "/usr/bin/nvcf-cli") + t.Setenv("REPO_ROOT", "/repo-root-placeholder") + suite := newWiringSuite(t, newFakeRunner(map[string]harness.Result{ + registryLoginCommand: {ExitCode: 0}, + "k3d cluster get ncp-local": {ExitCode: 1}, + serviceMonitorCommand: {ExitCode: 0}, + podMonitorCommand: {ExitCode: 0}, + collectorEnabledCommand: {ExitCode: 0, Stdout: "true\n"}, + featureGatesCommand: {ExitCode: 0, Stdout: "DynamicGPUDiscovery\nBYOObservability\n"}, + "helm list --all-namespaces --kube-context k3d-ncp-local-compute-1 -o json": { + ExitCode: 0, + Stdout: observabilityComputeHelmListJSON(), + }, + "kubectl get opentelemetrycollector nvcf-observability -n monitoring --context k3d-ncp-local-compute-1 -o jsonpath='{.spec.targetAllocator.enabled}'": { + ExitCode: 0, + Stdout: "true", + }, + "kubectl get servicemonitor --namespace monitoring --context k3d-ncp-local-compute-1 -o name": { + ExitCode: 0, + Stdout: "servicemonitor.monitoring.coreos.com/nvcf-default-monitors-nvca\n", + }, + "helm status function-autoscaler --namespace nvcf --kube-context k3d-ncp-local-compute-1": { + ExitCode: 1, + Stderr: "Error: release: not found\n", + }, + })) + seedHelmfileLocalBDDMultiFixture(t, suite.Config.RepoRoot) + seedComputePlaneLocalBDDMultiFixture(t, suite.Config.RepoRoot) + seedStackSecretsTemplate(t, suite.Config.RepoRoot) + writeMulticlusterComputeRegisterValues(t, suite.Config.RepoRoot, "nvcf-compute-plane", "ncp-local-compute-1") + + sc := steps.NewScenarioContext(suite) + featurePath := mustResolveFeaturePath(t, "observability-compute.feature") + var out strings.Builder + status := godog.TestSuite{ + Name: "observability-compute-wiring", + ScenarioInitializer: func(ctx *godog.ScenarioContext) { + steps.RegisterAll(ctx, sc) + }, + Options: &godog.Options{ + Format: "pretty", + Paths: []string{featurePath}, + Strict: true, + Output: &out, + }, + }.Run() + if status != 0 { + t.Fatalf("godog suite status = %d\n%s", status, out.String()) + } + + runs := suite.Runner.(*fakeRunner).runs + for _, command := range []string{ + registryLoginCommand, + serviceMonitorCommand, + podMonitorCommand, + collectorEnabledCommand, + featureGatesCommand, + serviceKeyCommand, + restartNVCACommand, + } { + if !commandRanExactly(runs, command) { + t.Fatalf("exact command was never invoked: %s", command) + } + } + for _, target := range []string{ + "self-managed install HELMFILE_ENV=local-bdd-observability-compute KUBECONFIG_FILE=/repo-root-placeholder/tests/bdd/out/ncp-local-cp-kubeconfig.yaml", + "observability install HELMFILE_ENV=local-bdd-observability-compute KUBECONFIG_FILE=/repo-root-placeholder/tests/bdd/out/ncp-local-compute-1-kubeconfig.yaml", + "nvcf-compute-plane install CLUSTER_NAME=ncp-local-compute-1 HELMFILE_ENV=local-bdd-observability-compute", + } { + if !commandRanThatContains(runs, target) { + t.Fatalf("profile install command was never invoked: %s", target) + } + } + for _, run := range runs { + if strings.HasPrefix(run, "kubectl apply -f ") { + t.Fatalf("manifest apply relied on the ambient kube context: %s", run) + } + if strings.Contains(run, "test-key") { + t.Fatalf("NGC API key leaked into command arguments: %s", run) + } + } + + for _, stack := range []string{"self-managed", "observability", "nvcf-compute-plane"} { + environmentPath := filepath.Join(suite.Config.RepoRoot, "deploy", "stacks", stack, "environments", "local-bdd-observability-compute.yaml") + profile, found, err := dsl.ReadYAMLKey(environmentPath, "observability.profile") + if err != nil { + t.Fatalf("read %s observability profile: %v", stack, err) + } + want := "compute" + if stack == "self-managed" { + want = "disabled" + } + if !found || profile != want { + t.Fatalf("%s observability profile = %q, found = %t; want %q", stack, profile, found, want) + } + } + computeEnvironmentPath := filepath.Join(suite.Config.RepoRoot, "deploy", "stacks", "nvcf-compute-plane", "environments", "local-bdd-observability-compute.yaml") + for key, want := range map[string]string{ + "global.nvcaOperator.imageTag": "3.1.0", + "global.nvcaOperator.selfManaged.nvcaVersion": "3.1.0", + "global.nvcaOperator.selfManaged.otelCollector.imageRepository": "nvcr.io/test-org/test-team/nvcf-otel-collector", + "global.nvcaOperator.selfManaged.otelCollector.imageTag": "0.157.8", + } { + got, found, err := dsl.ReadYAMLKey(computeEnvironmentPath, key) + if err != nil { + t.Fatalf("read compute-profile override %s: %v", key, err) + } + if !found || got != want { + t.Fatalf("compute-profile override %s = %q, found = %t; want %q", key, got, found, want) + } + } +} + +func observabilityComputeHelmListJSON() string { + return `[ +{"name":"prometheus-operator-crds","namespace":"monitoring","status":"deployed"}, +{"name":"opentelemetry-operator","namespace":"monitoring","status":"deployed"}, +{"name":"victoria-metrics","namespace":"monitoring","status":"deployed"}, +{"name":"otel-collector","namespace":"monitoring","status":"deployed"}, +{"name":"default-monitors","namespace":"monitoring","status":"deployed"}, +{"name":"nvca-operator","namespace":"nvca-operator","status":"deployed"} +]` +} + // TestMultiClusterHelmfileFeatureFileWiresToSteps runs // multi-cluster-helmfile.feature against a fake runner. The same // fixture seeds and canned helm-list outputs cover the scenarios; @@ -1281,6 +1428,16 @@ func TestObservabilityControl(t *testing.T) { runLiveFeature(t, "observability-control.feature") } +// TestObservabilityCompute is the live entry point for the compute +// observability profile on the local split-cluster topology. Skipped under +// -short. +func TestObservabilityCompute(t *testing.T) { + if testing.Short() { + t.Skip("live run skipped under -short") + } + runLiveFeature(t, "observability-compute.feature") +} + // TestSingleClusterHelmfileUpstreamImages is the live entry point for the // focused Docker Hub supporting-image override feature. Skipped under -short. func TestSingleClusterHelmfileUpstreamImages(t *testing.T) { diff --git a/tests/bdd/steps/infra_steps.go b/tests/bdd/steps/infra_steps.go index d8d770537..c24e73bd5 100644 --- a/tests/bdd/steps/infra_steps.go +++ b/tests/bdd/steps/infra_steps.go @@ -47,6 +47,7 @@ func registerInfraSteps(ctx *godog.ScenarioContext, sc *ScenarioContext) { ctx.Step(`^a single-cluster ncp-local cluster is running$`, sc.singleClusterIsRunning) ctx.Step(`^multi-cluster ncp-local compute clusters are running:$`, sc.multiClusterComputeRunning) ctx.Step(`^the "([^"]*)" image pull secret exists in namespaces:$`, sc.pullSecretInNamespaces) + ctx.Step(`^the "([^"]*)" image pull secret exists in namespaces using context "([^"]*)":$`, sc.pullSecretInNamespacesUsingContext) } func (sc *ScenarioContext) singleClusterIsRunning(ctx context.Context) error { @@ -89,6 +90,27 @@ func (sc *ScenarioContext) multiClusterComputeRunning(ctx context.Context, table // versions decompose the resources into argv during processing, which // can re-expose the API key. func (sc *ScenarioContext) pullSecretInNamespaces(ctx context.Context, secretName string, table *godog.Table) error { + return sc.pullSecretInNamespacesAtContext(ctx, secretName, "", table) +} + +func (sc *ScenarioContext) pullSecretInNamespacesUsingContext( + ctx context.Context, + secretName, + kubeContext string, + table *godog.Table, +) error { + if strings.TrimSpace(kubeContext) == "" { + return fmt.Errorf("kube context is empty") + } + return sc.pullSecretInNamespacesAtContext(ctx, secretName, kubeContext, table) +} + +func (sc *ScenarioContext) pullSecretInNamespacesAtContext( + ctx context.Context, + secretName, + kubeContext string, + table *godog.Table, +) error { if table == nil || len(table.Rows) == 0 { return fmt.Errorf("namespaces table is empty") } @@ -105,14 +127,14 @@ func (sc *ScenarioContext) pullSecretInNamespaces(ctx context.Context, secretNam if err != nil { return fmt.Errorf("ensure namespace %s: %w", ns, err) } - if err := sc.applyManifest(ctx, nsBody); err != nil { + if err := sc.applyManifest(ctx, nsBody, kubeContext); err != nil { return fmt.Errorf("ensure namespace %s: %w", ns, err) } secretBody, err := dsl.DockerConfigJSONSecretManifest(secretName, ns, apiKey) if err != nil { return fmt.Errorf("build pull secret manifest in %s: %w", ns, err) } - if err := sc.applyManifest(ctx, secretBody); err != nil { + if err := sc.applyManifest(ctx, secretBody, kubeContext); err != nil { return fmt.Errorf("apply pull secret in %s: %w", ns, err) } } @@ -123,7 +145,7 @@ func (sc *ScenarioContext) pullSecretInNamespaces(ctx context.Context, secretNam // runs kubectl apply against it. Routing through OutDir (rather than // /tmp) means failed runs leave the artifacts in the run directory // alongside command logs for post-mortem inspection. -func (sc *ScenarioContext) applyManifest(ctx context.Context, body []byte) error { +func (sc *ScenarioContext) applyManifest(ctx context.Context, body []byte, kubeContext string) error { dir := sc.Suite.Config.OutDir if dir == "" { dir = os.TempDir() @@ -143,6 +165,10 @@ func (sc *ScenarioContext) applyManifest(ctx context.Context, body []byte) error if err := file.Close(); err != nil { return fmt.Errorf("close manifest: %w", err) } - _, err = sc.Suite.Runner.Run(ctx, fmt.Sprintf("kubectl apply -f %s", path)) + command, err := dsl.KubectlApplyCommand(path, kubeContext) + if err != nil { + return err + } + _, err = sc.Suite.Runner.Run(ctx, command) return err } diff --git a/tests/bdd/steps/steps_test.go b/tests/bdd/steps/steps_test.go index de9655982..ec01a9868 100644 --- a/tests/bdd/steps/steps_test.go +++ b/tests/bdd/steps/steps_test.go @@ -544,6 +544,31 @@ func TestPullSecretInNamespacesKeepsAPIKeyOutOfArgv(t *testing.T) { } } +func TestPullSecretInNamespacesUsingContextTargetsEveryApply(t *testing.T) { + sc, fake := newScenarioContext(t) + t.Setenv("NGC_API_KEY", "super-secret-token") + table := singleColumnTable(t, []string{"monitoring", "nvca-operator"}) + if err := sc.pullSecretInNamespacesUsingContext( + context.Background(), + "nvcr-pull-secret", + "k3d-ncp-local-compute-1", + table, + ); err != nil { + t.Fatalf("apply: %v", err) + } + if len(fake.runs) != 4 { + t.Fatalf("runs = %d, want 4 (2 namespaces x (ns manifest + secret manifest))", len(fake.runs)) + } + for _, run := range fake.runs { + if !strings.HasPrefix(run.command, "kubectl --context k3d-ncp-local-compute-1 apply -f ") { + t.Fatalf("command does not target compute context: %q", run.command) + } + if strings.Contains(run.command, "super-secret-token") { + t.Fatalf("api key leaked into argv: %q", run.command) + } + } +} + func TestPullSecretInNamespacesRequiresAPIKey(t *testing.T) { sc, _ := newScenarioContext(t) t.Setenv("NGC_API_KEY", "") From 59ccebd175a9d4c817120d98584f6525e521d238 Mon Sep 17 00:00:00 2001 From: Stephanie Baum Date: Mon, 3 Aug 2026 23:53:24 -0700 Subject: [PATCH 2/7] fix(compute-plane): bump NVCA defaults to 3.1.0 Make the compute-plane stack own the operator and backend versions instead of overriding them in the live BDD. Remove the redundant Stargate and collector tag overrides. Relates to #522 Signed-off-by: Stephanie Baum --- .../nvcf-compute-plane/environments/base.yaml | 2 ++ .../helmfile.d/02-nvca.yaml.gotmpl | 8 +++----- .../helm-nvca-operator/templates/deployment.yaml | 4 ++-- .../templates/pre-delete-cleanup-job.yaml | 2 +- .../templates/self-managed-nvcfbackend-cm.yaml | 4 ++-- .../tests/observability-profile.sh | 6 ++---- tests/bdd/dsl/kubectl.go | 1 + tests/bdd/features/observability-compute.feature | 16 +++++----------- tests/bdd/godog_test.go | 3 --- 9 files changed, 18 insertions(+), 28 deletions(-) diff --git a/deploy/stacks/nvcf-compute-plane/environments/base.yaml b/deploy/stacks/nvcf-compute-plane/environments/base.yaml index 5d38f46db..1378a9213 100644 --- a/deploy/stacks/nvcf-compute-plane/environments/base.yaml +++ b/deploy/stacks/nvcf-compute-plane/environments/base.yaml @@ -31,7 +31,9 @@ global: # NVCA Operator Configuration # ============================================================================= nvcaOperator: + imageTag: "3.1.0" selfManaged: + nvcaVersion: "3.1.0" # ICMS (SIS) service URL — required; set per environment. icmsServiceURL: "" icmsServiceHostHeaderOverride: "" diff --git a/deploy/stacks/nvcf-compute-plane/helmfile.d/02-nvca.yaml.gotmpl b/deploy/stacks/nvcf-compute-plane/helmfile.d/02-nvca.yaml.gotmpl index 50def3244..90ef07dda 100644 --- a/deploy/stacks/nvcf-compute-plane/helmfile.d/02-nvca.yaml.gotmpl +++ b/deploy/stacks/nvcf-compute-plane/helmfile.d/02-nvca.yaml.gotmpl @@ -153,9 +153,8 @@ helmDefaults: releases: - name: nvca-operator - # Released chart from nvca-operator-deploy. The chart supplies default - # image.tag and selfManaged.nvcaVersion values. Environments can override - # them when validating a newer mirrored NVCA build. + # Released chart from nvca-operator-deploy. Compute-plane base values own + # the operator and NVCA versions used by this stack. chart: nvcf/helm-nvca-operator version: 1.14.0 namespace: nvca-operator @@ -167,8 +166,7 @@ releases: # read by the nvca-operator chart. - {{ $registrationValuesPath | quote }} # Resolve operator + nvca images through global.image.{registry,repository}. - # The chart defaults supply image versions unless the environment sets - # global.nvcaOperator.imageTag or selfManaged.nvcaVersion. + # Compute-plane base values supply their image versions. - image: repository: {{ .Values.global.image.registry }}/{{ .Values.global.image.repository }}/nvca-operator {{- with dig "imageTag" "" $nvcaOp }} diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/deployment.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/deployment.yaml index ab7ef6c9d..ab4c1f226 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/deployment.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/deployment.yaml @@ -117,7 +117,7 @@ spec: - --nvca-cache-mount-options-enabled - --nvca-cache-mount-options - "ro,norecovery,nouuid" - image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.0.4 + image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.1.0 imagePullPolicy: IfNotPresent securityContext: # Set here so openbao injection can copy it upon injection @@ -163,7 +163,7 @@ spec: cpu: "1000m" memory: "4Gi" - name: nvca-mirror - image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.0.4 + image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.1.0 imagePullPolicy: IfNotPresent securityContext: runAsUser: 1000 diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/pre-delete-cleanup-job.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/pre-delete-cleanup-job.yaml index ceb98517e..be5dda5f7 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/pre-delete-cleanup-job.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/pre-delete-cleanup-job.yaml @@ -52,7 +52,7 @@ spec: fsGroup: 1010 containers: - name: cleanup - image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.0.4 + image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.1.0 imagePullPolicy: IfNotPresent securityContext: runAsUser: 1000 diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml index b108005c9..2ddad9b2c 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml @@ -20,7 +20,7 @@ metadata: name: nvcfbackend-self-managed namespace: nvca-operator annotations: - release-artifact-nvca-image: "nvcr.io/0651155215864979/ncp-dev/nvca:3.0.4" + release-artifact-nvca-image: "nvcr.io/0651155215864979/ncp-dev/nvca:3.1.0" release-artifact-nvcf-image-credential-helper-image: "nvcr.io/0651155215864979/ncp-dev/nvcf-image-credential-helper:0.10.2" release-artifact-samba-image: "nvcr.io/0651155215864979/ncp-dev/samba:1.0.5" labels: @@ -37,7 +37,7 @@ data: clusterDescription: "ncp-local" clusterGroupName: "nvcf-default" ncaID: "nvcf-default" - nvcaVersion: "3.0.4" + nvcaVersion: "3.1.0" oAuthClientId: "" cloudProvider: "NCP" region: "us-west-1" diff --git a/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh b/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh index b42e1b992..c99eeb12d 100755 --- a/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh +++ b/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh @@ -75,8 +75,6 @@ for profile in default disabled control compute all; do done render_values compute "$work_dir/compute-overrides.yaml" \ - --state-values-set-string global.nvcaOperator.imageTag=3.1.0 \ - --state-values-set-string global.nvcaOperator.selfManaged.nvcaVersion=3.1.0 \ --state-values-set global.nvcaOperator.selfManaged.otelCollector.enabled=false \ --state-values-set-string global.nvcaOperator.selfManaged.otelCollector.imageRepository=registry.example.com/nvcf/collector \ --state-values-set-string global.nvcaOperator.selfManaged.otelCollector.imageTag=test-tag \ @@ -98,10 +96,10 @@ grep -Eq '^ imageTag: "?test-tag"?$' \ fail "explicit collector image tag was not preserved" grep -Eq '^ tag: "?3\.1\.0"?$' \ "$work_dir/compute-overrides.yaml" || - fail "explicit operator image tag was not preserved" + fail "compute-plane operator image tag default was not preserved" grep -Eq '^ nvcaVersion: "?3\.1\.0"?$' \ "$work_dir/compute-overrides.yaml" || - fail "explicit NVCA version was not preserved" + fail "compute-plane NVCA version default was not preserved" render_values control "$work_dir/control-overrides.yaml" \ --state-values-set global.nvcaOperator.selfManaged.otelCollector.enabled=true \ diff --git a/tests/bdd/dsl/kubectl.go b/tests/bdd/dsl/kubectl.go index d25b6fb61..5716cc4dd 100644 --- a/tests/bdd/dsl/kubectl.go +++ b/tests/bdd/dsl/kubectl.go @@ -55,6 +55,7 @@ func ServiceMonitorExistenceCommand(namespace, kubeContext string, names []strin // KubectlApplyCommand builds a kubectl apply command for a manifest file. // When kubeContext is set, the command always targets that context instead of // relying on the caller's ambient kubeconfig selection. +// For example: kubectl --context k3d-ncp-local-compute-1 apply -f secret.yaml. func KubectlApplyCommand(manifestPath, kubeContext string) (string, error) { manifestPath = strings.TrimSpace(manifestPath) kubeContext = strings.TrimSpace(Interpolate(kubeContext)) diff --git a/tests/bdd/features/observability-compute.feature b/tests/bdd/features/observability-compute.feature index d8110566a..4b11d6496 100644 --- a/tests/bdd/features/observability-compute.feature +++ b/tests/bdd/features/observability-compute.feature @@ -22,12 +22,11 @@ Feature: Install local Helmfile observability with the compute profile # observability is installed separately on the compute cluster below. And I copy the file "tests/bdd/fixtures/self-managed-local-bdd-multi.yaml" to "deploy/stacks/self-managed/environments/local-bdd-observability-compute.yaml" And I update yaml file "deploy/stacks/self-managed/environments/local-bdd-observability-compute.yaml" with keys: - | global.imagePullSecrets[0].name | nvcr-pull-secret | - | global.helm.sources.repository | ${SAMPLE_NGC_ORG}/${SAMPLE_NGC_TEAM} | - | global.image.repository | ${SAMPLE_NGC_ORG}/${SAMPLE_NGC_TEAM} | - | api.env.NVCF_SIDECARS_LLM_ROUTER_CLIENT_IMAGE | nvcr.io/${SAMPLE_NGC_ORG}/${SAMPLE_NGC_TEAM}/stargate-client:0.2.0 | - | addons.llm.enabled | false | - | observability.profile | disabled | + | global.imagePullSecrets[0].name | nvcr-pull-secret | + | global.helm.sources.repository | ${SAMPLE_NGC_ORG}/${SAMPLE_NGC_TEAM} | + | global.image.repository | ${SAMPLE_NGC_ORG}/${SAMPLE_NGC_TEAM} | + | addons.llm.enabled | false | + | observability.profile | disabled | # Configure the shared observability stack for compute-plane monitors. And I copy the file "tests/bdd/fixtures/self-managed-local-bdd-multi.yaml" to "deploy/stacks/observability/environments/local-bdd-observability-compute.yaml" And I update yaml file "deploy/stacks/observability/environments/local-bdd-observability-compute.yaml" with keys: @@ -36,17 +35,12 @@ Feature: Install local Helmfile observability with the compute profile | global.image.repository | ${SAMPLE_NGC_ORG}/${SAMPLE_NGC_TEAM} | | observability.profile | compute | # Configure NVCA to use the same compute observability profile. - # Use the collector built from this checkout's pinned collector version in - # the supplied test registry so the local arm64 and amd64 paths are valid. And I copy the file "tests/bdd/fixtures/nvcf-compute-plane-local-bdd-multi.yaml" to "deploy/stacks/nvcf-compute-plane/environments/local-bdd-observability-compute.yaml" And I update yaml file "deploy/stacks/nvcf-compute-plane/environments/local-bdd-observability-compute.yaml" with keys: | global.imagePullSecrets[0].name | nvcr-pull-secret | | global.helm.sources.repository | ${SAMPLE_NGC_ORG}/${SAMPLE_NGC_TEAM} | | global.image.repository | ${SAMPLE_NGC_ORG}/${SAMPLE_NGC_TEAM} | - | global.nvcaOperator.imageTag | 3.1.0 | - | global.nvcaOperator.selfManaged.nvcaVersion | 3.1.0 | | global.nvcaOperator.selfManaged.otelCollector.imageRepository | nvcr.io/${SAMPLE_NGC_ORG}/${SAMPLE_NGC_TEAM}/nvcf-otel-collector | - | global.nvcaOperator.selfManaged.otelCollector.imageTag | 0.157.8 | | observability.profile | compute | And I copy the file "deploy/stacks/self-managed/secrets/secrets.yaml.template" to "deploy/stacks/self-managed/secrets/local-bdd-observability-compute-secrets.yaml" And I substitute "REPLACE_WITH_BASE64_DOCKER_CREDENTIAL" in file "deploy/stacks/self-managed/secrets/local-bdd-observability-compute-secrets.yaml" with base64 of "$oauthtoken:${NGC_API_KEY}" diff --git a/tests/bdd/godog_test.go b/tests/bdd/godog_test.go index 09ca6b08e..c91997d6c 100644 --- a/tests/bdd/godog_test.go +++ b/tests/bdd/godog_test.go @@ -685,10 +685,7 @@ func TestObservabilityComputeFeatureFileWiresToSteps(t *testing.T) { } computeEnvironmentPath := filepath.Join(suite.Config.RepoRoot, "deploy", "stacks", "nvcf-compute-plane", "environments", "local-bdd-observability-compute.yaml") for key, want := range map[string]string{ - "global.nvcaOperator.imageTag": "3.1.0", - "global.nvcaOperator.selfManaged.nvcaVersion": "3.1.0", "global.nvcaOperator.selfManaged.otelCollector.imageRepository": "nvcr.io/test-org/test-team/nvcf-otel-collector", - "global.nvcaOperator.selfManaged.otelCollector.imageTag": "0.157.8", } { got, found, err := dsl.ReadYAMLKey(computeEnvironmentPath, key) if err != nil { From 1fdb274ac77e6dc0731de30ab0677cfc336a6839 Mon Sep 17 00:00:00 2001 From: Stephanie Baum Date: Tue, 4 Aug 2026 22:16:36 -0700 Subject: [PATCH 3/7] fix(nvca-operator): update collector default to 0.157.9 Use the latest published multi-architecture NVCF OTel collector. Keep the source and release charts, schema, tests, and compute-plane compatibility default aligned. Relates-to: #522 Signed-off-by: Stephanie Baum --- .../nvca-operator/nvca-operator/README.md | 6 +++--- .../nvca-operator/templates/deployment.yaml | 2 +- .../nvca-operator/values.schema.json | 6 +++--- .../nvca-operator/nvca-operator/values.yaml | 6 +++--- .../tests/release_image_manifest_test.sh | 4 ++-- .../self_managed_nvca_image_reference_test.sh | 19 +++++++++++++++++++ deploy/stacks/nvcf-compute-plane/README.md | 5 +++-- .../nvcf-compute-plane/environments/base.yaml | 2 ++ .../self-managed-nvcfbackend-cm.yaml | 2 +- .../tests/observability-profile.sh | 11 +++++++++++ .../nvca/deployments/nvca-operator/README.md | 6 +++--- .../nvca-operator/templates/deployment.yaml | 2 +- .../nvca-operator/values.schema.json | 6 +++--- .../deployments/nvca-operator/values.yaml | 6 +++--- 14 files changed, 58 insertions(+), 25 deletions(-) diff --git a/deploy/helm/nvca-operator/nvca-operator/README.md b/deploy/helm/nvca-operator/nvca-operator/README.md index 1d88ef652..44aa27326 100644 --- a/deploy/helm/nvca-operator/nvca-operator/README.md +++ b/deploy/helm/nvca-operator/nvca-operator/README.md @@ -21,7 +21,7 @@ used in Kubernetes Clusters to run NVCF Workloads. | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | | `otelCollector.enabled` | Enable OTel collector sidecar for K8s event collection | `false` | | `otelCollector.imageRepository` | (OPTIONAL) Image repository of OpenTelemetry Collector sidecar. If not specified, it will be calculated based on image.repository (stg vs prod). | `""` | -| `otelCollector.imageTag` | Image tag of OpenTelemetry Collector sidecar. | `0.143.2` | +| `otelCollector.imageTag` | Image tag of OpenTelemetry Collector sidecar. | `0.157.9` | | `otelCollector.resources.limits.cpu` | CPU limit for the OTel collector container | `1000m` | | `otelCollector.resources.limits.memory` | Memory limit for the OTel collector container | `1Gi` | | `otelCollector.resources.requests.cpu` | CPU request for the OTel collector container | `200m` | @@ -129,7 +129,7 @@ used in Kubernetes Clusters to run NVCF Workloads. | `helmManaged.imageCredHelper.imageTag` | (REQUIRED) Image tag of "nvcf-image-credential-helper". Only override this if you know what you are doing. | `0.10.2` | | `helmManaged.otelCollector.enabled` | Enable OTel collector sidecar for helm-managed clusters | `false` | | `helmManaged.otelCollector.imageRepository` | (OPTIONAL) Image repository of "otel-collector". Only override this if you know what you are doing. If not specified, it will be calculated based on image.repository. | `""` | -| `helmManaged.otelCollector.imageTag` | (REQUIRED) Image tag of "otel-collector". Only override this if you know what you are doing. | `0.143.2` | +| `helmManaged.otelCollector.imageTag` | (REQUIRED) Image tag of "otel-collector". Only override this if you know what you are doing. | `0.157.9` | ### Self Managed NVCF Backend Configuration @@ -143,7 +143,7 @@ used in Kubernetes Clusters to run NVCF Workloads. | `selfManaged.imageCredHelper.imageTag` | (REQUIRED) Image tag of "nvcf-image-credential-helper". Only override this if you know what you are doing. | `0.10.2` | | `selfManaged.otelCollector.enabled` | Enable OTel collector sidecar for self-managed clusters | `false` | | `selfManaged.otelCollector.imageRepository` | (OPTIONAL) Image repository of "otel-collector". Only override this if you know what you are doing. If not specified, it will be calculated based on image.repository. | `""` | -| `selfManaged.otelCollector.imageTag` | (REQUIRED) Image tag of "otel-collector". Only override this if you know what you are doing. | `0.143.2` | +| `selfManaged.otelCollector.imageTag` | (REQUIRED) Image tag of "otel-collector". Only override this if you know what you are doing. | `0.157.9` | | `selfManaged.icmsServiceURL` | URL of the ICMS service for self-managed clusters. Override with the endpoint generated during cluster registration. | `http://icms.example.invalid:8080` | | `selfManaged.icmsServiceHostHeaderOverride` | Optional Host header override for selfManaged.icmsServiceURL. | `""` | | `selfManaged.revalServiceURL` | URL of the ReVal service for self-managed clusters. Override with the endpoint generated during cluster registration. | `http://reval.example.invalid:8080` | diff --git a/deploy/helm/nvca-operator/nvca-operator/templates/deployment.yaml b/deploy/helm/nvca-operator/nvca-operator/templates/deployment.yaml index 5b5c7e62c..fbc8e8907 100644 --- a/deploy/helm/nvca-operator/nvca-operator/templates/deployment.yaml +++ b/deploy/helm/nvca-operator/nvca-operator/templates/deployment.yaml @@ -154,7 +154,7 @@ spec: - name: OTEL_COLLECTOR_IMAGE_REPO value: {{ include "nvcaop.otelCollectorRepository" (dict "imageRepository" .Values.otelCollector.imageRepository "defaultRepository" .Values.image.repository) | quote }} - name: OTEL_COLLECTOR_IMAGE_TAG - value: {{ .Values.otelCollector.imageTag | default "0.143.2" | quote }} + value: {{ .Values.otelCollector.imageTag | default "0.157.9" | quote }} {{- if .Values.otelCollector.resources }} - name: OTEL_COLLECTOR_RESOURCES_B64 value: {{ .Values.otelCollector.resources | toJson | b64enc | quote }} diff --git a/deploy/helm/nvca-operator/nvca-operator/values.schema.json b/deploy/helm/nvca-operator/nvca-operator/values.schema.json index 8ffcf2fa5..f726ac171 100644 --- a/deploy/helm/nvca-operator/nvca-operator/values.schema.json +++ b/deploy/helm/nvca-operator/nvca-operator/values.schema.json @@ -53,7 +53,7 @@ "imageTag": { "type": "string", "description": "Image tag of OpenTelemetry Collector sidecar.", - "default": "0.143.2" + "default": "0.157.9" }, "resources": { "type": "object", @@ -688,7 +688,7 @@ "imageTag": { "type": "string", "description": "(REQUIRED) Image tag of \"otel-collector\". Only override this if you know what you are doing.", - "default": "0.143.2" + "default": "0.157.9" } } } @@ -754,7 +754,7 @@ "imageTag": { "type": "string", "description": "(REQUIRED) Image tag of \"otel-collector\". Only override this if you know what you are doing.", - "default": "0.143.2" + "default": "0.157.9" } } }, diff --git a/deploy/helm/nvca-operator/nvca-operator/values.yaml b/deploy/helm/nvca-operator/nvca-operator/values.yaml index 066440118..c8c49799e 100644 --- a/deploy/helm/nvca-operator/nvca-operator/values.yaml +++ b/deploy/helm/nvca-operator/nvca-operator/values.yaml @@ -37,7 +37,7 @@ nvcaImage: otelCollector: enabled: false imageRepository: "" - imageTag: 0.143.2 + imageTag: 0.157.9 resources: limits: cpu: 1000m @@ -311,7 +311,7 @@ helmManaged: otelCollector: enabled: false imageRepository: "" - imageTag: 0.143.2 + imageTag: 0.157.9 ## @section Self Managed NVCF Backend Configuration ## Only used when ngcConfig.clusterSource is "self-managed" ## All values below are under the 'selfManaged:' key, e.g. 'selfManaged.nvcaVersion' @@ -335,7 +335,7 @@ selfManaged: otelCollector: enabled: false imageRepository: "" - imageTag: 0.143.2 + imageTag: 0.157.9 ## @param selfManaged.icmsServiceURL URL of the ICMS service for self-managed clusters. Override with the endpoint generated during cluster registration. icmsServiceURL: "http://icms.example.invalid:8080" ## @param selfManaged.icmsServiceHostHeaderOverride Optional Host header override for selfManaged.icmsServiceURL. diff --git a/deploy/helm/nvca-operator/tests/release_image_manifest_test.sh b/deploy/helm/nvca-operator/tests/release_image_manifest_test.sh index 362c65d5d..8ecf2056f 100755 --- a/deploy/helm/nvca-operator/tests/release_image_manifest_test.sh +++ b/deploy/helm/nvca-operator/tests/release_image_manifest_test.sh @@ -66,7 +66,7 @@ data: enabled: false imageConfig: repository: "nvcr.io/nvidia/nvcf-byoc/nvcf-otel-collector" - tag: "0.143.2" + tag: "0.157.9" placeholder: imageRepository: "" imageTag: "ignored" @@ -89,7 +89,7 @@ expected_images=( "nvcr.io/nvidia/nvcf-byoc/nvca-operator:2.52.0-rc.5" "nvcr.io/nvidia/nvcf-byoc/nvca:2.52.0-rc.5" "nvcr.io/nvidia/nvcf-byoc/nvcf-image-credential-helper:0.5.0" - "nvcr.io/nvidia/nvcf-byoc/nvcf-otel-collector:0.143.2" + "nvcr.io/nvidia/nvcf-byoc/nvcf-otel-collector:0.157.9" "nvcr.io/nvidia/nvcf-byoc/samba:1.0.5" "nvcr.io/nvidia/nvcf-byoc/byoo-otel-collector:0.157.11" ) diff --git a/deploy/helm/nvca-operator/tests/self_managed_nvca_image_reference_test.sh b/deploy/helm/nvca-operator/tests/self_managed_nvca_image_reference_test.sh index afc75c9dd..9fa79c668 100755 --- a/deploy/helm/nvca-operator/tests/self_managed_nvca_image_reference_test.sh +++ b/deploy/helm/nvca-operator/tests/self_managed_nvca_image_reference_test.sh @@ -261,6 +261,25 @@ if ! grep -Fxq "${stage_byoo_function_image}" "${stage_image_manifest}"; then exit 1 fi +otel_collector_tag="$( + yq -r 'select(.kind == "Deployment" and .metadata.name == "nvca-operator") | .spec.template.spec.containers[] | select(.name == "nvca-operator") | .env[] | select(.name == "OTEL_COLLECTOR_IMAGE_TAG") | .value' \ + "${manifest}" +)" +backend_otel_collector_tag="$( + yq -r 'select(.kind == "ConfigMap" and .metadata.name == "nvcfbackend-self-managed") | .data."cluster-dto.yaml" | from_yaml | .otelCollector.imageConfig.tag' \ + "${manifest}" +)" + +if [[ "${otel_collector_tag}" != "0.157.9" ]]; then + echo "expected operator collector default 0.157.9, got ${otel_collector_tag}" >&2 + exit 1 +fi + +if [[ "${backend_otel_collector_tag}" != "0.157.9" ]]; then + echo "expected self-managed backend collector default 0.157.9, got ${backend_otel_collector_tag}" >&2 + exit 1 +fi + expected_annotations=( "release-artifact-nvca-image: \"${nvca_image_repository}:${nvca_version}\"" "release-artifact-nvcf-image-credential-helper-image: \"${image_credential_helper_repository}:${image_credential_helper_tag}\"" diff --git a/deploy/stacks/nvcf-compute-plane/README.md b/deploy/stacks/nvcf-compute-plane/README.md index 811a48cc3..fd88c9efd 100644 --- a/deploy/stacks/nvcf-compute-plane/README.md +++ b/deploy/stacks/nvcf-compute-plane/README.md @@ -68,8 +68,9 @@ global: ## Chart and Image Sources The stack pins the NVCA operator chart in -`helmfile.d/02-nvca.yaml.gotmpl`. The chart supplies the default NVCA, -NVCA operator, image credential helper, and shared storage image tags. +`helmfile.d/02-nvca.yaml.gotmpl`. Compute-plane base values supply the tested +NVCA, NVCA operator, and OTel collector image tags. The chart supplies the +image credential helper and shared storage image tags. Use `global.helm.sources` for chart repository location and `global.image` for container image repository location. The stack rewrites repositories through diff --git a/deploy/stacks/nvcf-compute-plane/environments/base.yaml b/deploy/stacks/nvcf-compute-plane/environments/base.yaml index 1378a9213..55e645f66 100644 --- a/deploy/stacks/nvcf-compute-plane/environments/base.yaml +++ b/deploy/stacks/nvcf-compute-plane/environments/base.yaml @@ -34,6 +34,8 @@ global: imageTag: "3.1.0" selfManaged: nvcaVersion: "3.1.0" + otelCollector: + imageTag: "0.157.9" # ICMS (SIS) service URL — required; set per environment. icmsServiceURL: "" icmsServiceHostHeaderOverride: "" diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml index 2ddad9b2c..edb66a010 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml @@ -70,7 +70,7 @@ data: enabled: true imageConfig: repository: "nvcr.io/nvidia/nvcf-byoc/nvcf-otel-collector" - tag: "0.143.2" + tag: "0.157.9" agent: natsURL: "nats://nats.nats-system.svc.cluster.local:4222" helmReValStageOAuthTokenURL: "" diff --git a/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh b/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh index c99eeb12d..a4c31eb6f 100755 --- a/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh +++ b/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh @@ -49,6 +49,14 @@ collector_enabled() { ' "$1" } +collector_image_tag() { + awk ' + /^selfManaged:$/ { self_managed = 1; next } + self_managed && /^ otelCollector:$/ { collector = 1; next } + collector && /^ imageTag:/ { gsub(/"/, "", $2); print $2; exit } + ' "$1" +} + has_byoo_gate() { grep -q '^[[:space:]]*- BYOObservability$' "$1" } @@ -74,6 +82,9 @@ for profile in default disabled control compute all; do esac done +test "$(collector_image_tag "$work_dir/compute.yaml")" = "0.157.9" || + fail "compute profile did not use collector image tag 0.157.9" + render_values compute "$work_dir/compute-overrides.yaml" \ --state-values-set global.nvcaOperator.selfManaged.otelCollector.enabled=false \ --state-values-set-string global.nvcaOperator.selfManaged.otelCollector.imageRepository=registry.example.com/nvcf/collector \ diff --git a/src/compute-plane-services/nvca/deployments/nvca-operator/README.md b/src/compute-plane-services/nvca/deployments/nvca-operator/README.md index a8637e3bf..2c09bda31 100644 --- a/src/compute-plane-services/nvca/deployments/nvca-operator/README.md +++ b/src/compute-plane-services/nvca/deployments/nvca-operator/README.md @@ -21,7 +21,7 @@ used in Kubernetes Clusters to run NVCF Workloads. | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | | `otelCollector.enabled` | Enable OTel collector sidecar for K8s event collection | `false` | | `otelCollector.imageRepository` | (OPTIONAL) Image repository of OpenTelemetry Collector sidecar. If not specified, it will be calculated based on image.repository (stg vs prod). | `""` | -| `otelCollector.imageTag` | Image tag of OpenTelemetry Collector sidecar. | `0.143.2` | +| `otelCollector.imageTag` | Image tag of OpenTelemetry Collector sidecar. | `0.157.9` | | `otelCollector.resources.limits.cpu` | CPU limit for the OTel collector container | `1000m` | | `otelCollector.resources.limits.memory` | Memory limit for the OTel collector container | `1Gi` | | `otelCollector.resources.requests.cpu` | CPU request for the OTel collector container | `200m` | @@ -129,7 +129,7 @@ used in Kubernetes Clusters to run NVCF Workloads. | `helmManaged.imageCredHelper.imageTag` | (REQUIRED) Image tag of "nvcf-image-credential-helper". Only override this if you know what you are doing. | `0.10.2` | | `helmManaged.otelCollector.enabled` | Enable OTel collector sidecar for helm-managed clusters | `false` | | `helmManaged.otelCollector.imageRepository` | (OPTIONAL) Image repository of "otel-collector". Only override this if you know what you are doing. If not specified, it will be calculated based on image.repository. | `""` | -| `helmManaged.otelCollector.imageTag` | (REQUIRED) Image tag of "otel-collector". Only override this if you know what you are doing. | `0.143.2` | +| `helmManaged.otelCollector.imageTag` | (REQUIRED) Image tag of "otel-collector". Only override this if you know what you are doing. | `0.157.9` | ### Self Managed NVCF Backend Configuration @@ -143,7 +143,7 @@ used in Kubernetes Clusters to run NVCF Workloads. | `selfManaged.imageCredHelper.imageTag` | (REQUIRED) Image tag of "nvcf-image-credential-helper". Only override this if you know what you are doing. | `0.10.2` | | `selfManaged.otelCollector.enabled` | Enable OTel collector sidecar for self-managed clusters | `false` | | `selfManaged.otelCollector.imageRepository` | (OPTIONAL) Image repository of "otel-collector". Only override this if you know what you are doing. If not specified, it will be calculated based on image.repository. | `""` | -| `selfManaged.otelCollector.imageTag` | (REQUIRED) Image tag of "otel-collector". Only override this if you know what you are doing. | `0.143.2` | +| `selfManaged.otelCollector.imageTag` | (REQUIRED) Image tag of "otel-collector". Only override this if you know what you are doing. | `0.157.9` | | `selfManaged.icmsServiceURL` | URL of the SIS/ICMS service for self-managed clusters. Required when ngcConfig.clusterSource is "self-managed". | `""` | | `selfManaged.icmsServiceHostHeaderOverride` | Optional Host header override for selfManaged.icmsServiceURL. | `""` | | `selfManaged.revalServiceURL` | URL of the ReVal service for self-managed clusters. Required when ngcConfig.clusterSource is "self-managed". | `""` | diff --git a/src/compute-plane-services/nvca/deployments/nvca-operator/templates/deployment.yaml b/src/compute-plane-services/nvca/deployments/nvca-operator/templates/deployment.yaml index 5b5c7e62c..fbc8e8907 100644 --- a/src/compute-plane-services/nvca/deployments/nvca-operator/templates/deployment.yaml +++ b/src/compute-plane-services/nvca/deployments/nvca-operator/templates/deployment.yaml @@ -154,7 +154,7 @@ spec: - name: OTEL_COLLECTOR_IMAGE_REPO value: {{ include "nvcaop.otelCollectorRepository" (dict "imageRepository" .Values.otelCollector.imageRepository "defaultRepository" .Values.image.repository) | quote }} - name: OTEL_COLLECTOR_IMAGE_TAG - value: {{ .Values.otelCollector.imageTag | default "0.143.2" | quote }} + value: {{ .Values.otelCollector.imageTag | default "0.157.9" | quote }} {{- if .Values.otelCollector.resources }} - name: OTEL_COLLECTOR_RESOURCES_B64 value: {{ .Values.otelCollector.resources | toJson | b64enc | quote }} diff --git a/src/compute-plane-services/nvca/deployments/nvca-operator/values.schema.json b/src/compute-plane-services/nvca/deployments/nvca-operator/values.schema.json index cf685ae5d..7611b31b5 100644 --- a/src/compute-plane-services/nvca/deployments/nvca-operator/values.schema.json +++ b/src/compute-plane-services/nvca/deployments/nvca-operator/values.schema.json @@ -53,7 +53,7 @@ "imageTag": { "type": "string", "description": "Image tag of OpenTelemetry Collector sidecar.", - "default": "0.143.2" + "default": "0.157.9" }, "resources": { "type": "object", @@ -688,7 +688,7 @@ "imageTag": { "type": "string", "description": "(REQUIRED) Image tag of \"otel-collector\". Only override this if you know what you are doing.", - "default": "0.143.2" + "default": "0.157.9" } } } @@ -754,7 +754,7 @@ "imageTag": { "type": "string", "description": "(REQUIRED) Image tag of \"otel-collector\". Only override this if you know what you are doing.", - "default": "0.143.2" + "default": "0.157.9" } } }, diff --git a/src/compute-plane-services/nvca/deployments/nvca-operator/values.yaml b/src/compute-plane-services/nvca/deployments/nvca-operator/values.yaml index 10662637b..4b7a262a6 100644 --- a/src/compute-plane-services/nvca/deployments/nvca-operator/values.yaml +++ b/src/compute-plane-services/nvca/deployments/nvca-operator/values.yaml @@ -39,7 +39,7 @@ nvcaImage: otelCollector: enabled: false imageRepository: "" - imageTag: 0.143.2 + imageTag: 0.157.9 resources: limits: cpu: 1000m @@ -333,7 +333,7 @@ helmManaged: otelCollector: enabled: false imageRepository: "" - imageTag: 0.143.2 + imageTag: 0.157.9 ## @section Self Managed NVCF Backend Configuration ## Only used when ngcConfig.clusterSource is "self-managed" @@ -358,7 +358,7 @@ selfManaged: otelCollector: enabled: false imageRepository: "" - imageTag: 0.143.2 + imageTag: 0.157.9 ## @param selfManaged.icmsServiceURL URL of the SIS/ICMS service for self-managed clusters. Required when ngcConfig.clusterSource is "self-managed". icmsServiceURL: "" ## @param selfManaged.icmsServiceHostHeaderOverride Optional Host header override for selfManaged.icmsServiceURL. From 41ff4abb0e8c4bc27028178e252b84a865cf63e3 Mon Sep 17 00:00:00 2001 From: Stephanie Baum Date: Wed, 5 Aug 2026 00:19:21 -0700 Subject: [PATCH 4/7] test(compute-plane): harden observability review coverage Compare rendered collector values to their configured sources and use sentinel overrides for version routing. Keep the BDD wiring assertion focused on the destructive NVCA restart command. Relates-to: #522 Signed-off-by: Stephanie Baum --- .../self_managed_nvca_image_reference_test.sh | 14 ++++---- deploy/stacks/nvcf-compute-plane/README.md | 4 ++- .../tests/observability-profile.sh | 32 ++++++++++++------- tests/bdd/godog_test.go | 23 ++----------- 4 files changed, 34 insertions(+), 39 deletions(-) diff --git a/deploy/helm/nvca-operator/tests/self_managed_nvca_image_reference_test.sh b/deploy/helm/nvca-operator/tests/self_managed_nvca_image_reference_test.sh index 9fa79c668..6026f8570 100755 --- a/deploy/helm/nvca-operator/tests/self_managed_nvca_image_reference_test.sh +++ b/deploy/helm/nvca-operator/tests/self_managed_nvca_image_reference_test.sh @@ -261,22 +261,24 @@ if ! grep -Fxq "${stage_byoo_function_image}" "${stage_image_manifest}"; then exit 1 fi -otel_collector_tag="$( +expected_operator_otel_collector_tag="$(yq -r '.otelCollector.imageTag' "${repo_root}/nvca-operator/values.yaml")" +expected_backend_otel_collector_tag="$(yq -r '.selfManaged.otelCollector.imageTag' "${repo_root}/nvca-operator/values.yaml")" +rendered_operator_otel_collector_tag="$( yq -r 'select(.kind == "Deployment" and .metadata.name == "nvca-operator") | .spec.template.spec.containers[] | select(.name == "nvca-operator") | .env[] | select(.name == "OTEL_COLLECTOR_IMAGE_TAG") | .value' \ "${manifest}" )" -backend_otel_collector_tag="$( +rendered_backend_otel_collector_tag="$( yq -r 'select(.kind == "ConfigMap" and .metadata.name == "nvcfbackend-self-managed") | .data."cluster-dto.yaml" | from_yaml | .otelCollector.imageConfig.tag' \ "${manifest}" )" -if [[ "${otel_collector_tag}" != "0.157.9" ]]; then - echo "expected operator collector default 0.157.9, got ${otel_collector_tag}" >&2 +if [[ "${rendered_operator_otel_collector_tag}" != "${expected_operator_otel_collector_tag}" ]]; then + echo "expected rendered operator collector tag ${expected_operator_otel_collector_tag}, got ${rendered_operator_otel_collector_tag}" >&2 exit 1 fi -if [[ "${backend_otel_collector_tag}" != "0.157.9" ]]; then - echo "expected self-managed backend collector default 0.157.9, got ${backend_otel_collector_tag}" >&2 +if [[ "${rendered_backend_otel_collector_tag}" != "${expected_backend_otel_collector_tag}" ]]; then + echo "expected rendered self-managed collector tag ${expected_backend_otel_collector_tag}, got ${rendered_backend_otel_collector_tag}" >&2 exit 1 fi diff --git a/deploy/stacks/nvcf-compute-plane/README.md b/deploy/stacks/nvcf-compute-plane/README.md index fd88c9efd..a38172da7 100644 --- a/deploy/stacks/nvcf-compute-plane/README.md +++ b/deploy/stacks/nvcf-compute-plane/README.md @@ -74,7 +74,9 @@ image credential helper and shared storage image tags. Use `global.helm.sources` for chart repository location and `global.image` for container image repository location. The stack rewrites repositories through -those global values, while chart defaults supply the tested image tags. +those global values. Chart defaults provide fallback versions for values the +compute-plane stack does not override. + Only set `global.nvcaOperator.selfManaged.imageCredHelper.imageTag` when pinning a tested replacement helper image. diff --git a/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh b/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh index a4c31eb6f..658d0185e 100755 --- a/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh +++ b/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh @@ -57,6 +57,20 @@ collector_image_tag() { ' "$1" } +operator_image_tag() { + awk ' + /^image:$/ { image = 1; next } + image && /^ tag:/ { gsub(/"/, "", $2); print $2; exit } + ' "$1" +} + +nvca_version() { + awk ' + /^selfManaged:$/ { self_managed = 1; next } + self_managed && /^ nvcaVersion:/ { gsub(/"/, "", $2); print $2; exit } + ' "$1" +} + has_byoo_gate() { grep -q '^[[:space:]]*- BYOObservability$' "$1" } @@ -82,10 +96,9 @@ for profile in default disabled control compute all; do esac done -test "$(collector_image_tag "$work_dir/compute.yaml")" = "0.157.9" || - fail "compute profile did not use collector image tag 0.157.9" - render_values compute "$work_dir/compute-overrides.yaml" \ + --state-values-set-string global.nvcaOperator.imageTag=operator-test-tag \ + --state-values-set-string global.nvcaOperator.selfManaged.nvcaVersion=nvca-test-tag \ --state-values-set global.nvcaOperator.selfManaged.otelCollector.enabled=false \ --state-values-set-string global.nvcaOperator.selfManaged.otelCollector.imageRepository=registry.example.com/nvcf/collector \ --state-values-set-string global.nvcaOperator.selfManaged.otelCollector.imageTag=test-tag \ @@ -102,15 +115,12 @@ grep -q '^[[:space:]]*- -BYOObservability$' \ grep -Eq '^ imageRepository: "?registry\.example\.com/nvcf/collector"?$' \ "$work_dir/compute-overrides.yaml" || fail "explicit collector image repository was not preserved" -grep -Eq '^ imageTag: "?test-tag"?$' \ - "$work_dir/compute-overrides.yaml" || +test "$(collector_image_tag "$work_dir/compute-overrides.yaml")" = "test-tag" || fail "explicit collector image tag was not preserved" -grep -Eq '^ tag: "?3\.1\.0"?$' \ - "$work_dir/compute-overrides.yaml" || - fail "compute-plane operator image tag default was not preserved" -grep -Eq '^ nvcaVersion: "?3\.1\.0"?$' \ - "$work_dir/compute-overrides.yaml" || - fail "compute-plane NVCA version default was not preserved" +test "$(operator_image_tag "$work_dir/compute-overrides.yaml")" = "operator-test-tag" || + fail "operator image tag override was not preserved" +test "$(nvca_version "$work_dir/compute-overrides.yaml")" = "nvca-test-tag" || + fail "NVCA version override was not preserved" render_values control "$work_dir/control-overrides.yaml" \ --state-values-set global.nvcaOperator.selfManaged.otelCollector.enabled=true \ diff --git a/tests/bdd/godog_test.go b/tests/bdd/godog_test.go index c91997d6c..8941dce54 100644 --- a/tests/bdd/godog_test.go +++ b/tests/bdd/godog_test.go @@ -638,27 +638,8 @@ func TestObservabilityComputeFeatureFileWiresToSteps(t *testing.T) { } runs := suite.Runner.(*fakeRunner).runs - for _, command := range []string{ - registryLoginCommand, - serviceMonitorCommand, - podMonitorCommand, - collectorEnabledCommand, - featureGatesCommand, - serviceKeyCommand, - restartNVCACommand, - } { - if !commandRanExactly(runs, command) { - t.Fatalf("exact command was never invoked: %s", command) - } - } - for _, target := range []string{ - "self-managed install HELMFILE_ENV=local-bdd-observability-compute KUBECONFIG_FILE=/repo-root-placeholder/tests/bdd/out/ncp-local-cp-kubeconfig.yaml", - "observability install HELMFILE_ENV=local-bdd-observability-compute KUBECONFIG_FILE=/repo-root-placeholder/tests/bdd/out/ncp-local-compute-1-kubeconfig.yaml", - "nvcf-compute-plane install CLUSTER_NAME=ncp-local-compute-1 HELMFILE_ENV=local-bdd-observability-compute", - } { - if !commandRanThatContains(runs, target) { - t.Fatalf("profile install command was never invoked: %s", target) - } + if !commandRanThatContains(runs, "kubectl --context k3d-ncp-local-compute-1 delete pod --namespace nvca-system") { + t.Fatal("NVCA restart command was never invoked") } for _, run := range runs { if strings.HasPrefix(run, "kubectl apply -f ") { From 6423d3714c11cef2b7477d84d10b75da84b1b304 Mon Sep 17 00:00:00 2001 From: Stephanie Baum Date: Wed, 5 Aug 2026 00:44:12 -0700 Subject: [PATCH 5/7] test(bdd): stop asserting BYO observability Keep compute-profile coverage focused on collector enablement and the installed monitor resources. Relates-to: NVIDIA/nvcf#522 Signed-off-by: Stephanie Baum --- .../tests/observability-profile.sh | 23 ++----------------- .../features/observability-compute.feature | 6 ----- tests/bdd/godog_test.go | 2 -- 3 files changed, 2 insertions(+), 29 deletions(-) diff --git a/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh b/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh index 658d0185e..88dd0af67 100755 --- a/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh +++ b/deploy/stacks/nvcf-compute-plane/tests/observability-profile.sh @@ -71,10 +71,6 @@ nvca_version() { ' "$1" } -has_byoo_gate() { - grep -q '^[[:space:]]*- BYOObservability$' "$1" -} - for profile in default disabled control compute all; do values="$work_dir/$profile.yaml" render_values "$profile" "$values" @@ -83,15 +79,10 @@ for profile in default disabled control compute all; do default|compute|all) test "$(collector_enabled "$values")" = "true" || fail "$profile profile did not enable the NVCA collector" - has_byoo_gate "$values" || - fail "$profile profile did not enable BYOObservability" ;; disabled|control) test "$(collector_enabled "$values")" = "false" || fail "$profile profile enabled the NVCA collector" - if has_byoo_gate "$values"; then - fail "$profile profile enabled BYOObservability" - fi ;; esac done @@ -101,17 +92,10 @@ render_values compute "$work_dir/compute-overrides.yaml" \ --state-values-set-string global.nvcaOperator.selfManaged.nvcaVersion=nvca-test-tag \ --state-values-set global.nvcaOperator.selfManaged.otelCollector.enabled=false \ --state-values-set-string global.nvcaOperator.selfManaged.otelCollector.imageRepository=registry.example.com/nvcf/collector \ - --state-values-set-string global.nvcaOperator.selfManaged.otelCollector.imageTag=test-tag \ - --state-values-set-string 'global.nvcaOperator.selfManaged.featureGateValues[0]=-BYOObservability' + --state-values-set-string global.nvcaOperator.selfManaged.otelCollector.imageTag=test-tag test "$(collector_enabled "$work_dir/compute-overrides.yaml")" = "false" || fail "explicit collector disable did not override the compute profile" -if has_byoo_gate "$work_dir/compute-overrides.yaml"; then - fail "explicit BYOObservability disable did not override the compute profile" -fi -grep -q '^[[:space:]]*- -BYOObservability$' \ - "$work_dir/compute-overrides.yaml" || - fail "explicit BYOObservability disable was not preserved" grep -Eq '^ imageRepository: "?registry\.example\.com/nvcf/collector"?$' \ "$work_dir/compute-overrides.yaml" || fail "explicit collector image repository was not preserved" @@ -123,13 +107,10 @@ test "$(nvca_version "$work_dir/compute-overrides.yaml")" = "nvca-test-tag" || fail "NVCA version override was not preserved" render_values control "$work_dir/control-overrides.yaml" \ - --state-values-set global.nvcaOperator.selfManaged.otelCollector.enabled=true \ - --state-values-set-string 'global.nvcaOperator.selfManaged.featureGateValues[0]=BYOObservability' + --state-values-set global.nvcaOperator.selfManaged.otelCollector.enabled=true test "$(collector_enabled "$work_dir/control-overrides.yaml")" = "true" || fail "explicit collector enable did not override the control profile" -has_byoo_gate "$work_dir/control-overrides.yaml" || - fail "explicit BYOObservability enable did not override the control profile" if render_values invalid "$work_dir/invalid.yaml" \ >"$work_dir/invalid.log" 2>&1; then diff --git a/tests/bdd/features/observability-compute.feature b/tests/bdd/features/observability-compute.feature index 4b11d6496..097687f6d 100644 --- a/tests/bdd/features/observability-compute.feature +++ b/tests/bdd/features/observability-compute.feature @@ -155,12 +155,6 @@ Feature: Install local Helmfile observability with the compute profile """ Then the command exit code should be 0 And the command output should contain "true" - When I run command: - """ - bash -c 'set -eo pipefail; helm get values nvca-operator --namespace nvca-operator --kube-context k3d-ncp-local-compute-1 -o json | jq -r ".selfManaged.featureGateValues[]"' - """ - Then the command exit code should be 0 - And the command output should contain "BYOObservability" When I run command "helm status function-autoscaler --namespace nvcf --kube-context k3d-ncp-local-compute-1" Then the command exit code should be 1 diff --git a/tests/bdd/godog_test.go b/tests/bdd/godog_test.go index 8941dce54..4df0ee295 100644 --- a/tests/bdd/godog_test.go +++ b/tests/bdd/godog_test.go @@ -577,7 +577,6 @@ func TestObservabilityComputeFeatureFileWiresToSteps(t *testing.T) { " podmonitor/nvcf-default-monitors-worker" + " --namespace monitoring --context k3d-ncp-local-compute-1" collectorEnabledCommand = `bash -c 'set -eo pipefail; helm get values nvca-operator --namespace nvca-operator --kube-context k3d-ncp-local-compute-1 -o json | jq -r ".selfManaged.otelCollector.enabled"'` - featureGatesCommand = `bash -c 'set -eo pipefail; helm get values nvca-operator --namespace nvca-operator --kube-context k3d-ncp-local-compute-1 -o json | jq -r ".selfManaged.featureGateValues[]"'` serviceKeyCommand = `bash -c 'set -eo pipefail; printf %s "$NGC_API_KEY" |` + ` kubectl --context k3d-ncp-local-compute-1 create secret generic ngc-service-api-key` + ` --namespace nvca-system --from-file=ngc-service-api-key=/dev/stdin --dry-run=client -o yaml |` + @@ -595,7 +594,6 @@ func TestObservabilityComputeFeatureFileWiresToSteps(t *testing.T) { serviceMonitorCommand: {ExitCode: 0}, podMonitorCommand: {ExitCode: 0}, collectorEnabledCommand: {ExitCode: 0, Stdout: "true\n"}, - featureGatesCommand: {ExitCode: 0, Stdout: "DynamicGPUDiscovery\nBYOObservability\n"}, "helm list --all-namespaces --kube-context k3d-ncp-local-compute-1 -o json": { ExitCode: 0, Stdout: observabilityComputeHelmListJSON(), From 955a1b3d1a9f6189edc45dd179322522e8e68afd Mon Sep 17 00:00:00 2001 From: Stephanie Baum Date: Mon, 10 Aug 2026 23:26:42 -0700 Subject: [PATCH 6/7] fix(compute-plane): bump NVCA defaults to 3.2.0 Use the published multi-architecture NVCA operator and backend images. Make the self-managed chart regression select its cluster source explicitly after latest main changed the chart default. Relates-to: NVIDIA/nvcf#522 Signed-off-by: Stephanie Baum --- deploy/stacks/nvcf-compute-plane/environments/base.yaml | 4 ++-- .../helm-nvca-operator/templates/deployment.yaml | 4 ++-- .../helm-nvca-operator/templates/pre-delete-cleanup-job.yaml | 2 +- .../templates/self-managed-nvcfbackend-cm.yaml | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/deploy/stacks/nvcf-compute-plane/environments/base.yaml b/deploy/stacks/nvcf-compute-plane/environments/base.yaml index 55e645f66..91556dce8 100644 --- a/deploy/stacks/nvcf-compute-plane/environments/base.yaml +++ b/deploy/stacks/nvcf-compute-plane/environments/base.yaml @@ -31,9 +31,9 @@ global: # NVCA Operator Configuration # ============================================================================= nvcaOperator: - imageTag: "3.1.0" + imageTag: "3.2.0" selfManaged: - nvcaVersion: "3.1.0" + nvcaVersion: "3.2.0" otelCollector: imageTag: "0.157.9" # ICMS (SIS) service URL — required; set per environment. diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/deployment.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/deployment.yaml index ab4c1f226..ed6656fee 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/deployment.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/deployment.yaml @@ -117,7 +117,7 @@ spec: - --nvca-cache-mount-options-enabled - --nvca-cache-mount-options - "ro,norecovery,nouuid" - image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.1.0 + image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.2.0 imagePullPolicy: IfNotPresent securityContext: # Set here so openbao injection can copy it upon injection @@ -163,7 +163,7 @@ spec: cpu: "1000m" memory: "4Gi" - name: nvca-mirror - image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.1.0 + image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.2.0 imagePullPolicy: IfNotPresent securityContext: runAsUser: 1000 diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/pre-delete-cleanup-job.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/pre-delete-cleanup-job.yaml index be5dda5f7..7ffb72f51 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/pre-delete-cleanup-job.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/pre-delete-cleanup-job.yaml @@ -52,7 +52,7 @@ spec: fsGroup: 1010 containers: - name: cleanup - image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.1.0 + image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.2.0 imagePullPolicy: IfNotPresent securityContext: runAsUser: 1000 diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml index edb66a010..a42dc7724 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml @@ -20,7 +20,7 @@ metadata: name: nvcfbackend-self-managed namespace: nvca-operator annotations: - release-artifact-nvca-image: "nvcr.io/0651155215864979/ncp-dev/nvca:3.1.0" + release-artifact-nvca-image: "nvcr.io/0651155215864979/ncp-dev/nvca:3.2.0" release-artifact-nvcf-image-credential-helper-image: "nvcr.io/0651155215864979/ncp-dev/nvcf-image-credential-helper:0.10.2" release-artifact-samba-image: "nvcr.io/0651155215864979/ncp-dev/samba:1.0.5" labels: @@ -37,7 +37,7 @@ data: clusterDescription: "ncp-local" clusterGroupName: "nvcf-default" ncaID: "nvcf-default" - nvcaVersion: "3.1.0" + nvcaVersion: "3.2.0" oAuthClientId: "" cloudProvider: "NCP" region: "us-west-1" From e7143e0e6d7c17d4854432ed49225dffed880212 Mon Sep 17 00:00:00 2001 From: Stephanie Baum Date: Wed, 12 Aug 2026 15:18:11 -0700 Subject: [PATCH 7/7] fix(compute-plane): use NVCA Operator chart 1.19.0 Update helm-nvca-operator from 1.14.0 to 1.19.0 so the chart invokes the NVCA Operator 3.2.0 binaries directly instead of relying on the removed /tini wrapper. Add rendered entrypoint coverage and refresh the chart goldens. No third-party license or NOTICE changes. Fixes #799 Signed-off-by: Stephanie Baum --- deploy/stacks/nvcf-compute-plane/Makefile | 8 +++-- .../helmfile.d/02-nvca.yaml.gotmpl | 2 +- .../templates/agent-config-merge-cm.yaml | 2 +- .../chart-defaults-nvcfbackend-cm.yaml | 2 +- .../crds/nvidia.io_nvcfbackends_crd.yaml | 2 +- .../custom-annotations-configmap.yaml | 2 +- .../custom-network-policies-configmap.yaml | 2 +- .../templates/deployment.yaml | 10 +++--- .../gpu-profiling-config-configmap.yaml | 2 +- .../helm-managed-nvcfbackend-cm.yaml | 2 +- .../templates/ngc-service-key.yaml | 2 +- .../templates/operator-config-cm.yaml | 36 +++++++++++++++++++ .../templates/pre-delete-cleanup-job.yaml | 4 +-- .../templates/pre-delete-cleanup-rbac.yaml | 6 ++-- .../templates/rbac_allowed_extra_types.yaml | 4 +-- .../helm-nvca-operator/templates/role.yaml | 2 +- .../templates/role_binding.yaml | 2 +- .../helm-nvca-operator/templates/sa.yaml | 2 +- .../self-managed-nvcfbackend-cm.yaml | 8 +---- .../templates/shutdown-sentinel.yaml | 2 +- .../tests/nvca-entrypoints.sh | 30 ++++++++++++++++ 21 files changed, 97 insertions(+), 35 deletions(-) create mode 100644 deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/operator-config-cm.yaml create mode 100755 deploy/stacks/nvcf-compute-plane/tests/nvca-entrypoints.sh diff --git a/deploy/stacks/nvcf-compute-plane/Makefile b/deploy/stacks/nvcf-compute-plane/Makefile index f318f0f1f..55fadecbc 100644 --- a/deploy/stacks/nvcf-compute-plane/Makefile +++ b/deploy/stacks/nvcf-compute-plane/Makefile @@ -60,7 +60,7 @@ include Makefile.dist -include helmfile-docker.mk # --- Development-Only Targets --- -.PHONY: dist clean-dist ensure-helm ensure-helmfile ensure-binaries render-local test-observability-profile test-local generate-golden +.PHONY: dist clean-dist ensure-helm ensure-helmfile ensure-binaries render-local test-observability-profile test-nvca-entrypoints test-local generate-golden # --- Binary Management (Development Only) --- ensure-helm: @@ -172,7 +172,10 @@ render-local: dist test-observability-profile: @tests/observability-profile.sh -test-local: test-observability-profile render-local +test-nvca-entrypoints: render-local + @tests/nvca-entrypoints.sh "$(DIST_DIR)/out" + +test-local: test-observability-profile test-nvca-entrypoints @echo ">>> Comparing $(DIST_DIR)/out against golden $(GOLDEN_LOCAL_DIR)..." @if ! tests/compare-golden.sh "$(GOLDEN_LOCAL_DIR)" "$(DIST_DIR)/out"; then \ echo ""; \ @@ -222,6 +225,7 @@ help: @echo "" @echo "Testing Targets:" @echo " test-observability-profile Verify NVCA observability profile defaults" + @echo " test-nvca-entrypoints Verify rendered NVCA images use available entrypoints" @echo " test-local Render the local env and diff against golden testdata" @echo " generate-golden Render the local env and update golden testdata" @echo "" diff --git a/deploy/stacks/nvcf-compute-plane/helmfile.d/02-nvca.yaml.gotmpl b/deploy/stacks/nvcf-compute-plane/helmfile.d/02-nvca.yaml.gotmpl index 90ef07dda..3c8df0c04 100644 --- a/deploy/stacks/nvcf-compute-plane/helmfile.d/02-nvca.yaml.gotmpl +++ b/deploy/stacks/nvcf-compute-plane/helmfile.d/02-nvca.yaml.gotmpl @@ -156,7 +156,7 @@ releases: # Released chart from nvca-operator-deploy. Compute-plane base values own # the operator and NVCA versions used by this stack. chart: nvcf/helm-nvca-operator - version: 1.14.0 + version: 1.19.0 namespace: nvca-operator values: - ../global.yaml.gotmpl diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/agent-config-merge-cm.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/agent-config-merge-cm.yaml index 9bd33f45b..3388b4ad6 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/agent-config-merge-cm.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/agent-config-merge-cm.yaml @@ -21,7 +21,7 @@ metadata: name: agent-config-merge namespace: nvca-operator labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/chart-defaults-nvcfbackend-cm.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/chart-defaults-nvcfbackend-cm.yaml index 0088b7176..613885f87 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/chart-defaults-nvcfbackend-cm.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/chart-defaults-nvcfbackend-cm.yaml @@ -21,7 +21,7 @@ metadata: name: nvcfbackend-chart-defaults namespace: nvca-operator labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/crds/nvidia.io_nvcfbackends_crd.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/crds/nvidia.io_nvcfbackends_crd.yaml index 8f3fdee20..916846e8c 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/crds/nvidia.io_nvcfbackends_crd.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/crds/nvidia.io_nvcfbackends_crd.yaml @@ -20,7 +20,7 @@ kind: CustomResourceDefinition metadata: name: nvcfbackends.nvcf.nvidia.io labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/custom-annotations-configmap.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/custom-annotations-configmap.yaml index a5c467108..fb644a364 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/custom-annotations-configmap.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/custom-annotations-configmap.yaml @@ -21,7 +21,7 @@ metadata: name: nvca-namespace-pod-annotations namespace: nvca-operator labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/custom-network-policies-configmap.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/custom-network-policies-configmap.yaml index 440343268..913c76b2e 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/custom-network-policies-configmap.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/custom-network-policies-configmap.yaml @@ -21,7 +21,7 @@ metadata: name: nvcf-custom-network-policies namespace: nvca-operator labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/deployment.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/deployment.yaml index ed6656fee..e3a930a19 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/deployment.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/deployment.yaml @@ -21,7 +21,7 @@ metadata: name: nvca-operator namespace: nvca-operator labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" @@ -92,8 +92,6 @@ spec: fieldRef: fieldPath: metadata.namespace args: - - /tini - - -- - /usr/bin/nvca-operator - --nca-id - "nvcf-default" @@ -117,6 +115,10 @@ spec: - --nvca-cache-mount-options-enabled - --nvca-cache-mount-options - "ro,norecovery,nouuid" + - --function-env-overrides-b64 + - "eyJCWU9PX09URUxfQ09MTEVDVE9SX0NPTlRBSU5FUiI6Im52Y3IuaW8vbnZpZGlhL252Y2YtYnlvYy9ieW9vLW90ZWwtY29sbGVjdG9yOjAuMTU3LjExIn0=" + - --task-env-overrides-b64 + - "eyJCWU9PX09URUxfQ09MTEVDVE9SX0NPTlRBSU5FUiI6Im52Y3IuaW8vbnZpZGlhL252Y2YtYnlvYy9ieW9vLW90ZWwtY29sbGVjdG9yOjAuMTU3LjExIn0=" image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.2.0 imagePullPolicy: IfNotPresent securityContext: @@ -173,8 +175,6 @@ spec: drop: - "ALL" args: - - /tini - - -- - /usr/bin/nvca-mirror - run - --target-namespace diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/gpu-profiling-config-configmap.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/gpu-profiling-config-configmap.yaml index bef516f26..452945a71 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/gpu-profiling-config-configmap.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/gpu-profiling-config-configmap.yaml @@ -25,7 +25,7 @@ metadata: name: nvca-gpu-profiling-config namespace: nvca-operator labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/helm-managed-nvcfbackend-cm.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/helm-managed-nvcfbackend-cm.yaml index b7833c6ee..6e1b97d43 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/helm-managed-nvcfbackend-cm.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/helm-managed-nvcfbackend-cm.yaml @@ -21,7 +21,7 @@ metadata: name: nvcfbackend-helm-managed namespace: nvca-operator labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/ngc-service-key.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/ngc-service-key.yaml index c958823f0..2af756f0d 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/ngc-service-key.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/ngc-service-key.yaml @@ -20,7 +20,7 @@ kind: Secret metadata: name: ngc-service-key labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/operator-config-cm.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/operator-config-cm.yaml new file mode 100644 index 000000000..e907f97f5 --- /dev/null +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/operator-config-cm.yaml @@ -0,0 +1,36 @@ +--- +# Source: helm-nvca-operator/templates/operator-config-cm.yaml +# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: v1 +kind: ConfigMap +metadata: + name: nvca-operator-config + namespace: nvca-operator + labels: + helm.sh/chart: helm-nvca-operator-1.19.0 + app.kubernetes.io/name: nvca-operator + app.kubernetes.io/instance: nvca-operator + app.kubernetes.io/version: "3.0.4" + app.kubernetes.io/managed-by: Helm +data: + config.yaml: | + workload: + transportTLS: + trustBundle: + secretKeyRef: + name: "" + key: "ca.crt" + fingerprint: "" diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/pre-delete-cleanup-job.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/pre-delete-cleanup-job.yaml index 7ffb72f51..f10565602 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/pre-delete-cleanup-job.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/pre-delete-cleanup-job.yaml @@ -21,7 +21,7 @@ metadata: name: nvca-operator-pre-delete-cleanup namespace: nvca-operator labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" @@ -62,8 +62,6 @@ spec: drop: - "ALL" args: - - /tini - - -- - /usr/bin/nvca-operator-cleanup - --namespace - "nvca-operator" diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/pre-delete-cleanup-rbac.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/pre-delete-cleanup-rbac.yaml index de1ac0eee..99c6a855d 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/pre-delete-cleanup-rbac.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/pre-delete-cleanup-rbac.yaml @@ -21,7 +21,7 @@ metadata: name: nvca-operator-pre-delete-cleanup namespace: nvca-operator labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" @@ -39,7 +39,7 @@ kind: ClusterRole metadata: name: nvca-operator-pre-delete-cleanup labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" @@ -140,7 +140,7 @@ kind: ClusterRoleBinding metadata: name: nvca-operator-pre-delete-cleanup labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/rbac_allowed_extra_types.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/rbac_allowed_extra_types.yaml index 7193c1c8f..2d4fce5e8 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/rbac_allowed_extra_types.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/rbac_allowed_extra_types.yaml @@ -19,7 +19,7 @@ kind: ClusterRole metadata: name: nvca-operator-allowed-extra-types labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" @@ -71,7 +71,7 @@ kind: ClusterRoleBinding metadata: name: nvca-operator-allowed-extra-types labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/role.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/role.yaml index 0cef7b44d..cf26b41dc 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/role.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/role.yaml @@ -20,7 +20,7 @@ kind: ClusterRole metadata: name: nvca-operator labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/role_binding.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/role_binding.yaml index 4349e046d..2b9f2b387 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/role_binding.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/role_binding.yaml @@ -20,7 +20,7 @@ kind: ClusterRoleBinding metadata: name: nvca-operator labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/sa.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/sa.yaml index 843a4fd12..bedb80d7e 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/sa.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/sa.yaml @@ -21,7 +21,7 @@ metadata: name: nvca-operator namespace: nvca-operator labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml index a42dc7724..938aefb80 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml @@ -24,7 +24,7 @@ metadata: release-artifact-nvcf-image-credential-helper-image: "nvcr.io/0651155215864979/ncp-dev/nvcf-image-credential-helper:0.10.2" release-artifact-samba-image: "nvcr.io/0651155215864979/ncp-dev/samba:1.0.5" labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" @@ -53,12 +53,6 @@ data: icmsServiceURL: "http://api.sis.svc.cluster.local:8080" miniService: helmReValServiceURL: "http://reval.nvcf.svc.cluster.local:8080" - transportTls: - trustMode: "system" - trustBundleConfigMapName: "nvcf-transport-trust-bundle" - trustBundleKey: "nvcf-ca-bundle.pem" - trustBundleFingerprint: "" - installerImage: "" imageCredentialHelper: imageConfig: repository: "nvcr.io/0651155215864979/ncp-dev/nvcf-image-credential-helper" diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/shutdown-sentinel.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/shutdown-sentinel.yaml index ed54651d7..282c59a3e 100644 --- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/shutdown-sentinel.yaml +++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/shutdown-sentinel.yaml @@ -21,7 +21,7 @@ metadata: name: nvca-operator-shutdown-sentinel namespace: nvca-operator labels: - helm.sh/chart: helm-nvca-operator-1.14.0 + helm.sh/chart: helm-nvca-operator-1.19.0 app.kubernetes.io/name: nvca-operator app.kubernetes.io/instance: nvca-operator app.kubernetes.io/version: "3.0.4" diff --git a/deploy/stacks/nvcf-compute-plane/tests/nvca-entrypoints.sh b/deploy/stacks/nvcf-compute-plane/tests/nvca-entrypoints.sh new file mode 100755 index 000000000..dc04e1b0f --- /dev/null +++ b/deploy/stacks/nvcf-compute-plane/tests/nvca-entrypoints.sh @@ -0,0 +1,30 @@ +#!/usr/bin/env bash +set -euo pipefail + +render_dir="${1:?rendered manifest directory is required}" +template_dir="$render_dir/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates" +deployment="$template_dir/deployment.yaml" +cleanup_job="$template_dir/pre-delete-cleanup-job.yaml" + +fail() { + echo "nvca-entrypoints: $*" >&2 + exit 1 +} + +for manifest in "$deployment" "$cleanup_job"; do + test -f "$manifest" || fail "missing rendered manifest: $manifest" +done + +for binary in nvca-operator nvca-mirror; do + grep -Fq -- "- /usr/bin/$binary" "$deployment" || + fail "deployment does not invoke /usr/bin/$binary directly" +done + +grep -Fq -- '- /usr/bin/nvca-operator-cleanup' "$cleanup_job" || + fail "cleanup job does not invoke /usr/bin/nvca-operator-cleanup directly" + +if grep -Fq -- '- /tini' "$deployment" "$cleanup_job"; then + fail "rendered NVCA containers still depend on /tini" +fi + +echo "nvca-entrypoints: all checks passed"