fix(compute-plane): update observability defaults and coverage

deploy/helm/nvca-operator/nvca-operator/README.md

@@ -21,7 +21,7 @@ used in Kubernetes Clusters to run NVCF Workloads.
 | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- |
 | `otelCollector.enabled`                   | Enable OTel collector sidecar for K8s event collection                                                                                                                                                | `false`                    |
 | `otelCollector.imageRepository`           | (OPTIONAL) Image repository of OpenTelemetry Collector sidecar. If not specified, it will be calculated based on image.repository (stg vs prod).                                                      | `""`                       |
-| `otelCollector.imageTag`                  | Image tag of OpenTelemetry Collector sidecar.                                                                                                                                                         | `0.143.2`                  |
+| `otelCollector.imageTag`                  | Image tag of OpenTelemetry Collector sidecar.                                                                                                                                                         | `0.157.9`                  |
 | `otelCollector.resources.limits.cpu`      | CPU limit for the OTel collector container                                                                                                                                                            | `1000m`                    |
 | `otelCollector.resources.limits.memory`   | Memory limit for the OTel collector container                                                                                                                                                         | `1Gi`                      |
 | `otelCollector.resources.requests.cpu`    | CPU request for the OTel collector container                                                                                                                                                          | `200m`                     |
@@ -129,7 +129,7 @@ used in Kubernetes Clusters to run NVCF Workloads.
 | `helmManaged.imageCredHelper.imageTag`        | (REQUIRED) Image tag of "nvcf-image-credential-helper". Only override this if you know what you are doing.                                                                           | `0.10.2`   |
 | `helmManaged.otelCollector.enabled`           | Enable OTel collector sidecar for helm-managed clusters                                                                                                                              | `false`   |
 | `helmManaged.otelCollector.imageRepository`   | (OPTIONAL) Image repository of "otel-collector". Only override this if you know what you are doing. If not specified, it will be calculated based on image.repository.               | `""`      |
-| `helmManaged.otelCollector.imageTag`          | (REQUIRED) Image tag of "otel-collector". Only override this if you know what you are doing.                                                                                         | `0.143.2` |
+| `helmManaged.otelCollector.imageTag`          | (REQUIRED) Image tag of "otel-collector". Only override this if you know what you are doing.                                                                                         | `0.157.9` |
 
 ### Self Managed NVCF Backend Configuration
 
@@ -143,7 +143,7 @@ used in Kubernetes Clusters to run NVCF Workloads.
 | `selfManaged.imageCredHelper.imageTag`        | (REQUIRED) Image tag of "nvcf-image-credential-helper". Only override this if you know what you are doing.                                                                           | `0.10.2`                                    |
 | `selfManaged.otelCollector.enabled`           | Enable OTel collector sidecar for self-managed clusters                                                                                                                              | `false`                                    |
 | `selfManaged.otelCollector.imageRepository`   | (OPTIONAL) Image repository of "otel-collector". Only override this if you know what you are doing. If not specified, it will be calculated based on image.repository.               | `""`                                       |
-| `selfManaged.otelCollector.imageTag`          | (REQUIRED) Image tag of "otel-collector". Only override this if you know what you are doing.                                                                                         | `0.143.2`                                  |
+| `selfManaged.otelCollector.imageTag`          | (REQUIRED) Image tag of "otel-collector". Only override this if you know what you are doing.                                                                                         | `0.157.9`                                  |
 | `selfManaged.icmsServiceURL`                  | URL of the ICMS service for self-managed clusters. Override with the endpoint generated during cluster registration.                                                                 | `http://icms.example.invalid:8080`        |
 | `selfManaged.icmsServiceHostHeaderOverride`                 | Optional Host header override for selfManaged.icmsServiceURL.                                                                                                                       | `""`                                      |
 | `selfManaged.revalServiceURL`                 | URL of the ReVal service for self-managed clusters. Override with the endpoint generated during cluster registration.                                                                | `http://reval.example.invalid:8080`       |

deploy/helm/nvca-operator/nvca-operator/templates/deployment.yaml

@@ -154,7 +154,7 @@ spec:
         - name: OTEL_COLLECTOR_IMAGE_REPO
           value: {{ include "nvcaop.otelCollectorRepository" (dict "imageRepository" .Values.otelCollector.imageRepository "defaultRepository" .Values.image.repository) | quote }}
         - name: OTEL_COLLECTOR_IMAGE_TAG
-          value: {{ .Values.otelCollector.imageTag | default "0.143.2" | quote }}
+          value: {{ .Values.otelCollector.imageTag | default "0.157.9" | quote }}
         {{- if .Values.otelCollector.resources }}
         - name: OTEL_COLLECTOR_RESOURCES_B64
           value: {{ .Values.otelCollector.resources | toJson | b64enc | quote }}

deploy/helm/nvca-operator/nvca-operator/values.schema.json

@@ -53,7 +53,7 @@
                 "imageTag": {
                     "type": "string",
                     "description": "Image tag of OpenTelemetry Collector sidecar.",
-                    "default": "0.143.2"
+                    "default": "0.157.9"
                 },
                 "resources": {
                     "type": "object",
@@ -688,7 +688,7 @@
                         "imageTag": {
                             "type": "string",
                             "description": "(REQUIRED) Image tag of \"otel-collector\". Only override this if you know what you are doing.",
-                            "default": "0.143.2"
+                            "default": "0.157.9"
                         }
                     }
                 }
@@ -754,7 +754,7 @@
                         "imageTag": {
                             "type": "string",
                             "description": "(REQUIRED) Image tag of \"otel-collector\". Only override this if you know what you are doing.",
-                            "default": "0.143.2"
+                            "default": "0.157.9"
                         }
                     }
                 },

deploy/helm/nvca-operator/nvca-operator/values.yaml

@@ -37,7 +37,7 @@ nvcaImage:
 otelCollector:
   enabled: false
   imageRepository: ""
-  imageTag: 0.143.2
+  imageTag: 0.157.9
   resources:
     limits:
       cpu: 1000m
@@ -311,7 +311,7 @@ helmManaged:
   otelCollector:
     enabled: false
     imageRepository: ""
-    imageTag: 0.143.2
+    imageTag: 0.157.9
 ## @section Self Managed NVCF Backend Configuration
 ## Only used when ngcConfig.clusterSource is "self-managed"
 ## All values below are under the 'selfManaged:' key, e.g. 'selfManaged.nvcaVersion'
@@ -335,7 +335,7 @@ selfManaged:
   otelCollector:
     enabled: false
     imageRepository: ""
-    imageTag: 0.143.2
+    imageTag: 0.157.9
   ## @param selfManaged.icmsServiceURL URL of the ICMS service for self-managed clusters. Override with the endpoint generated during cluster registration.
   icmsServiceURL: "http://icms.example.invalid:8080"
   ## @param selfManaged.icmsServiceHostHeaderOverride Optional Host header override for selfManaged.icmsServiceURL.

deploy/helm/nvca-operator/tests/release_image_manifest_test.sh

@@ -66,7 +66,7 @@ data:
       enabled: false
       imageConfig:
         repository: "nvcr.io/nvidia/nvcf-byoc/nvcf-otel-collector"
-        tag: "0.143.2"
+        tag: "0.157.9"
     placeholder:
       imageRepository: ""
       imageTag: "ignored"
@@ -89,7 +89,7 @@ expected_images=(
   "nvcr.io/nvidia/nvcf-byoc/nvca-operator:2.52.0-rc.5"
   "nvcr.io/nvidia/nvcf-byoc/nvca:2.52.0-rc.5"
   "nvcr.io/nvidia/nvcf-byoc/nvcf-image-credential-helper:0.5.0"
-  "nvcr.io/nvidia/nvcf-byoc/nvcf-otel-collector:0.143.2"
+  "nvcr.io/nvidia/nvcf-byoc/nvcf-otel-collector:0.157.9"
   "nvcr.io/nvidia/nvcf-byoc/samba:1.0.5"
   "nvcr.io/nvidia/nvcf-byoc/byoo-otel-collector:0.157.11"
 )

deploy/helm/nvca-operator/tests/self_managed_nvca_image_reference_test.sh

@@ -261,6 +261,27 @@ if ! grep -Fxq "${stage_byoo_function_image}" "${stage_image_manifest}"; then
   exit 1
 fi
 
+expected_operator_otel_collector_tag="$(yq -r '.otelCollector.imageTag' "${repo_root}/nvca-operator/values.yaml")"
+expected_backend_otel_collector_tag="$(yq -r '.selfManaged.otelCollector.imageTag' "${repo_root}/nvca-operator/values.yaml")"
+rendered_operator_otel_collector_tag="$(
+  yq -r 'select(.kind == "Deployment" and .metadata.name == "nvca-operator") | .spec.template.spec.containers[] | select(.name == "nvca-operator") | .env[] | select(.name == "OTEL_COLLECTOR_IMAGE_TAG") | .value' \
+    "${manifest}"
+)"
+rendered_backend_otel_collector_tag="$(
+  yq -r 'select(.kind == "ConfigMap" and .metadata.name == "nvcfbackend-self-managed") | .data."cluster-dto.yaml" | from_yaml | .otelCollector.imageConfig.tag' \
+    "${manifest}"
+)"
+
+if [[ "${rendered_operator_otel_collector_tag}" != "${expected_operator_otel_collector_tag}" ]]; then
+  echo "expected rendered operator collector tag ${expected_operator_otel_collector_tag}, got ${rendered_operator_otel_collector_tag}" >&2
+  exit 1
+fi
+
+if [[ "${rendered_backend_otel_collector_tag}" != "${expected_backend_otel_collector_tag}" ]]; then
+  echo "expected rendered self-managed collector tag ${expected_backend_otel_collector_tag}, got ${rendered_backend_otel_collector_tag}" >&2
+  exit 1
+fi
+
 expected_annotations=(
   "release-artifact-nvca-image: \"${nvca_image_repository}:${nvca_version}\""
   "release-artifact-nvcf-image-credential-helper-image: \"${image_credential_helper_repository}:${image_credential_helper_tag}\""

deploy/stacks/nvcf-compute-plane/Makefile

@@ -60,7 +60,7 @@ include Makefile.dist
 -include helmfile-docker.mk
 
 # --- Development-Only Targets ---
-.PHONY: dist clean-dist ensure-helm ensure-helmfile ensure-binaries render-local test-observability-profile test-local generate-golden
+.PHONY: dist clean-dist ensure-helm ensure-helmfile ensure-binaries render-local test-observability-profile test-nvca-entrypoints test-local generate-golden
 
 # --- Binary Management (Development Only) ---
 ensure-helm:
@@ -172,7 +172,10 @@ render-local: dist
 test-observability-profile:
 	@tests/observability-profile.sh
 
-test-local: test-observability-profile render-local
+test-nvca-entrypoints: render-local
+	@tests/nvca-entrypoints.sh "$(DIST_DIR)/out"
+
+test-local: test-observability-profile test-nvca-entrypoints
 	@echo ">>> Comparing $(DIST_DIR)/out against golden $(GOLDEN_LOCAL_DIR)..."
 	@if ! tests/compare-golden.sh "$(GOLDEN_LOCAL_DIR)" "$(DIST_DIR)/out"; then \
 		echo ""; \
@@ -222,6 +225,7 @@ help:
 	@echo ""
 	@echo "Testing Targets:"
 	@echo "  test-observability-profile  Verify NVCA observability profile defaults"
+	@echo "  test-nvca-entrypoints       Verify rendered NVCA images use available entrypoints"
 	@echo "  test-local         Render the local env and diff against golden testdata"
 	@echo "  generate-golden    Render the local env and update golden testdata"
 	@echo ""

deploy/stacks/nvcf-compute-plane/README.md

@@ -68,12 +68,15 @@ global:
 ## Chart and Image Sources
 
 The stack pins the NVCA operator chart in
-`helmfile.d/02-nvca.yaml.gotmpl`. The chart supplies the default NVCA,
-NVCA operator, image credential helper, and shared storage image tags.
+`helmfile.d/02-nvca.yaml.gotmpl`. Compute-plane base values supply the tested
+NVCA, NVCA operator, and OTel collector image tags. The chart supplies the
+image credential helper and shared storage image tags.
 
 Use `global.helm.sources` for chart repository location and `global.image` for
 container image repository location. The stack rewrites repositories through
-those global values, while chart defaults supply the tested image tags.
+those global values. Chart defaults provide fallback versions for values the
+compute-plane stack does not override.
+
 Only set `global.nvcaOperator.selfManaged.imageCredHelper.imageTag` when
 pinning a tested replacement helper image.
 

deploy/stacks/nvcf-compute-plane/environments/base.yaml

@@ -31,7 +31,11 @@ global:
   # NVCA Operator Configuration
   # =============================================================================
   nvcaOperator:
+    imageTag: "3.2.0"
     selfManaged:
+      nvcaVersion: "3.2.0"
+      otelCollector:
+        imageTag: "0.157.9"
       # ICMS (SIS) service URL — required; set per environment.
       icmsServiceURL: ""
       icmsServiceHostHeaderOverride: ""

deploy/stacks/nvcf-compute-plane/helmfile.d/02-nvca.yaml.gotmpl

@@ -87,8 +87,11 @@ helmDefaults:
 {{- if $environmentAgentMergeConfig }}
 {{- $agentMergeConfig = mergeOverwrite $agentMergeConfig ($environmentAgentMergeConfig | fromYaml | default dict) }}
 {{- end }}
+{{- $nvcaOp := dig "nvcaOperator" dict .Values.global }}
+{{- $selfManaged := dig "selfManaged" dict $nvcaOp }}
+{{- $otelCollector := dig "otelCollector" dict $selfManaged }}
+{{- $otelCollectorEnabled := dig "enabled" $computeObservabilityEnabled $otelCollector }}
 
-{{- $selfManaged := dig "nvcaOperator" "selfManaged" dict .Values.global }}
 {{- $featureGateValues := dig "featureGateValues" list $selfManaged }}
 {{- $kaiSchedulerEnabled := dig "addons" "kaiScheduler" "enabled" false .Values }}
 {{- $dynamoOperatorEnabled := dig "addons" "dynamoOperator" "enabled" false .Values }}
@@ -150,13 +153,10 @@ helmDefaults:
 releases:
 
   - name: nvca-operator
-    # Released chart from nvca-operator-deploy. The chart bakes its own
-    # image.tag + selfManaged.nvcaVersion (set by `make vendor-chart` from
-    # nvca-operator-deploy/.env), so no inline tag override is needed; the
-    # nvca + nvca-operator images are mirrored to the environment registry by
-    # regsync-configs.
+    # Released chart from nvca-operator-deploy. Compute-plane base values own
+    # the operator and NVCA versions used by this stack.
     chart: nvcf/helm-nvca-operator
-    version: 1.14.0
+    version: 1.19.0
     namespace: nvca-operator
     values:
       - ../global.yaml.gotmpl
@@ -166,10 +166,12 @@ releases:
       # read by the nvca-operator chart.
       - {{ $registrationValuesPath | quote }}
       # Resolve operator + nvca images through global.image.{registry,repository}.
-      # The chart's image.tag and selfManaged.nvcaVersion defaults supply the
-      # actual image tag; this block only overrides repository and pullPolicy.
+      # Compute-plane base values supply their image versions.
       - image:
           repository: {{ .Values.global.image.registry }}/{{ .Values.global.image.repository }}/nvca-operator
+          {{- with dig "imageTag" "" $nvcaOp }}
+          tag: {{ . | quote }}
+          {{- end }}
           pullPolicy: IfNotPresent
         nvcaImage:
           repositoryOverride: {{ .Values.global.image.registry }}/{{ .Values.global.image.repository }}/nvca
@@ -191,11 +193,11 @@ releases:
           clusterSource: self-managed
         clusterName: {{ requiredEnv "CLUSTER_NAME" }}
         ncaId: {{ requiredEnv "NCA_ID" }}
-        {{- $selfManaged := dig "nvcaOperator" "selfManaged" dict .Values.global }}
-        {{- $otelCollector := dig "otelCollector" dict $selfManaged }}
-        {{- $otelCollectorEnabled := dig "enabled" $computeObservabilityEnabled $otelCollector }}
         selfManaged:
           identitySource: psat
+          {{- with dig "nvcaVersion" "" $selfManaged }}
+          nvcaVersion: {{ . | quote }}
+          {{- end }}
           {{- with dig "icmsServiceURL" "" $selfManaged }}
           icmsServiceURL: {{ . | quote }}
           {{- end }}
@@ -251,7 +253,6 @@ releases:
         networkPolicy:
 {{ toYaml . | nindent 10 }}
         {{- end }}
-        {{- $nvcaOp := dig "nvcaOperator" dict .Values.global }}
         {{- if .Values.global.nodeSelector.enabled }}
         nodeSelector:
           key: {{ .Values.global.nodeSelector.key | quote }}

deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/agent-config-merge-cm.yaml

@@ -21,7 +21,7 @@ metadata:
   name: agent-config-merge
   namespace: nvca-operator
   labels:
-    helm.sh/chart: helm-nvca-operator-1.14.0
+    helm.sh/chart: helm-nvca-operator-1.19.0
     app.kubernetes.io/name: nvca-operator
     app.kubernetes.io/instance: nvca-operator
     app.kubernetes.io/version: "3.0.4"

deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/chart-defaults-nvcfbackend-cm.yaml

@@ -21,7 +21,7 @@ metadata:
   name: nvcfbackend-chart-defaults
   namespace: nvca-operator
   labels:
-    helm.sh/chart: helm-nvca-operator-1.14.0
+    helm.sh/chart: helm-nvca-operator-1.19.0
     app.kubernetes.io/name: nvca-operator
     app.kubernetes.io/instance: nvca-operator
     app.kubernetes.io/version: "3.0.4"

deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/crds/nvidia.io_nvcfbackends_crd.yaml

@@ -20,7 +20,7 @@ kind: CustomResourceDefinition
 metadata:
   name: nvcfbackends.nvcf.nvidia.io
   labels:
-    helm.sh/chart: helm-nvca-operator-1.14.0
+    helm.sh/chart: helm-nvca-operator-1.19.0
     app.kubernetes.io/name: nvca-operator
     app.kubernetes.io/instance: nvca-operator
     app.kubernetes.io/version: "3.0.4"

deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/custom-annotations-configmap.yaml

@@ -21,7 +21,7 @@ metadata:
   name: nvca-namespace-pod-annotations
   namespace: nvca-operator
   labels:
-    helm.sh/chart: helm-nvca-operator-1.14.0
+    helm.sh/chart: helm-nvca-operator-1.19.0
     app.kubernetes.io/name: nvca-operator
     app.kubernetes.io/instance: nvca-operator
     app.kubernetes.io/version: "3.0.4"

deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/custom-network-policies-configmap.yaml

@@ -21,7 +21,7 @@ metadata:
   name: nvcf-custom-network-policies
   namespace: nvca-operator
   labels:
-    helm.sh/chart: helm-nvca-operator-1.14.0
+    helm.sh/chart: helm-nvca-operator-1.19.0
     app.kubernetes.io/name: nvca-operator
     app.kubernetes.io/instance: nvca-operator
     app.kubernetes.io/version: "3.0.4"