docs: Finish infra-controller rename accuracy pass

deploy/README.md

@@ -5,9 +5,9 @@ The `deploy/kustomization.yaml` file drives the top‑level deployment. Populate
 
 | Value | Description |
 | --- | --- |
-| `yourdockerregistry.com/path/to/nico-core` | Registry URL that hosts the NICo core (`nvmetal-nico`) image. |
+| `yourdockerregistry.com/path/to/nico-core` | Source image placeholder rewritten to `NICO_REGISTRY_PATH/nico-core` by `deploy/kustomization.yaml`. |
 | `NICO_REGISTRY_PATH` | URL to the registry that hosts all NICo components; shared path for component images. |
-| `NICO_TAG` | Version tag for the `nvmetal-nico` component. |
+| `NICO_TAG` | Version tag for the NICo Core (`nico-core`) image. |
 | `yourdockerregistry.com/path/to/boot-artifacts-aarch64` | Registry URL for the `boot-artifacts-aarch64` image. |
 | `BOOT_ARTIFACTS_AARCH64_TAG` | Version tag for the `boot-artifacts-aarch64` component. |
 | `yourdockerregistry.com/path/to/boot-artifacts-x86_64` | Registry URL for the `boot-artifacts-x86_64` image. |

docs/getting-started/quick-start.md

@@ -76,28 +76,32 @@ helm plugin install https://github.com/databus23/helm-diff
 
 ## Step 3 — Configure the Site
 
-Everything in this step must be done **before** running `setup.sh`. Skipping any item will either cause setup to fail or result in a deployment with incorrect site configuration that is hard to fix after the fact.
+Review this entire step **before** running `setup.sh` and complete every item that applies to your environment. Missing required values can cause setup to fail or produce an incorrectly configured deployment that is hard to fix afterward.
 
-### 3a. Set Required Environment Variables
+### 3a. Set Deployment Environment Variables
 
 ```bash
-export KUBECONFIG=/path/to/kubeconfig                 # cluster kubeconfig
-export REGISTRY_PULL_USERNAME=<registry-user>         # registry username
-export REGISTRY_PULL_SECRET=<registry-user-pass>      # registry username password
+# export KUBECONFIG=/path/to/kubeconfig                  # optional if the current kubectl context is correct
 export NICO_IMAGE_REGISTRY=my-registry.example.com/nico  # base registry for all NICo images
-export NICO_CORE_IMAGE_TAG=<nico-core-image-tag>      # e.g. v2025.12.30-rc1
-export NICO_REST_IMAGE_TAG=<nico-rest-image-tag>      # e.g. v1.0.4
+export NICO_CORE_IMAGE_TAG=<nico-core-image-tag>         # e.g. v2.0.0
+export NICO_REST_IMAGE_TAG=<nico-rest-image-tag>         # e.g. v2.0.0
+# Optional for authenticated registries:
+# export REGISTRY_PULL_USERNAME='$oauthtoken'            # default for NGC API-key auth
+# export REGISTRY_PULL_SECRET=<pull-secret-or-api-key>   # registry password or API key
 ```
 
 `NICO_IMAGE_REGISTRY` is used for both NICo Core (`<registry>/nvmetal-carbide`) and NICo REST (`<registry>/nico-rest-*`). Push all images to this registry before running setup.
 
+For authenticated NGC pulls, obtain an API key at [ngc.nvidia.com](https://ngc.nvidia.com) → **API Keys** → **Generate Personal Key**. You do not need to set `REGISTRY_PULL_SECRET` when images are public, preloaded, or an existing pull secret is configured in the values files.
+
 | Variable | Required | Description |
 |----------|----------|-------------|
-| `REGISTRY_PULL_SECRET` | **Yes** | Pull secret and API key for your image registry. Used to create the image pull secret for both NICo Core and NICo REST. |
-| `NICO_IMAGE_REGISTRY` | **Yes** | Base image registry for all NICo images (e.g. `my-registry.example.com/nico`). Used for NICo Core (`<registry>/nvmetal-carbide`) and NICo REST (`<registry>/nico-rest-*`). |
-| `NICO_CORE_IMAGE_TAG` | **Yes** | NICo Core image tag (e.g. `v2025.12.30`). |
-| `NICO_REST_IMAGE_TAG` | **Yes** | NICo REST image tag (e.g. `v1.0.4`). |
-| `KUBECONFIG` | **Yes** | Path to your cluster kubeconfig. |
+| `REGISTRY_PULL_SECRET` | No | Raw registry password or API key used to create image pull secrets. |
+| `REGISTRY_PULL_USERNAME` | No | Username for generated pull secrets. Defaults to `$oauthtoken`. |
+| `NICO_IMAGE_REGISTRY` | Unless `--skip-core --skip-rest` | Base image registry for all NICo images (e.g. `my-registry.example.com/nico`). Used for NICo Core (`<registry>/nvmetal-carbide`) and NICo REST (`<registry>/nico-rest-*`). |
+| `NICO_CORE_IMAGE_TAG` | Unless `--skip-core` | NICo Core image tag (e.g. `v2.0.0`). |
+| `NICO_REST_IMAGE_TAG` | Unless `--skip-rest` | NICo REST image tag (e.g. `v2.0.0`). |
+| `KUBECONFIG` | No | Path to the target cluster kubeconfig. Omit when the current `kubectl` context is already correct. |
 | `NICO_SITE_UUID` | No | Stable UUID for this site. If unset, `setup.sh` tries to reuse the UUID from a prior install (site-agent ConfigMap). If that fails, it adopts an existing REST site with the same name, or mints a UUID and seeds the site record itself. |
 
 ### 3b. Set your Site Name
@@ -277,7 +281,7 @@ The `preflight.sh` script checks the following:
 
 | Category | Checks |
 |----------|--------|
-| Environment variables | Required vars are set; no `https://` prefix on registry; version tags start with `v`; UUID is valid if set; KUBECONFIG path exists if set |
+| Environment variables | Conditional image variables are set; registry has no URL scheme; UUID is valid if set; KUBECONFIG path exists if set |
 | Required tools | `helm`, `helmfile`, `kubectl`, `jq`, `ssh-keygen` are in PATH |
 | `values/metallb-config.yaml` | File exists; YAML is valid; at least one IPAddressPool defined; exactly one advertisement mode active (BGP or L2, not both); example placeholder hostnames not still present |
 | Cluster reachability | `kubectl` can reach the API server. |
@@ -303,6 +307,19 @@ cd helm-prereqs/
 ./setup.sh -y     # non-interactive — deploys everything
 ```
 
+You can combine common options as needed:
+
+| Option | Effect |
+|--------|--------|
+| `--core-values <file>` | Use site-specific NICo Core values for Phase 6. |
+| `--debug` | Enable shell tracing. This may print secrets, so protect the logs. |
+| `--metallb-config <path>` | Use a site-specific MetalLB manifest file or kustomize directory. |
+| `--site-overlay <dir>` | Apply a site kustomize overlay after Phase 6. |
+| `--skip-core` | Skip the Phase 6 NICo Core Helm release. |
+| `--skip-flow` | Skip Phase 7h NICo Flow. Also set `flow.enabled=false` in `helm-prereqs/values.yaml` to omit Flow prerequisites. |
+| `--skip-rest` | Skip all Phase 7 NICo REST phases. |
+| `-y` | Accept setup prompts automatically. |
+
 The `setup.sh` script installs all prerequisites and NICo components in sequential phases:
 
 <Anchor id="setup-script-phases"/>
@@ -318,29 +335,32 @@ The `setup.sh` script installs all prerequisites and NICo components in sequenti
 | 4 | Vault init + unseal + SSH host key |
 | 5 | external-secrets + nico-prereqs + nico-pg-cluster |
 | 6 | **NICo Core** (nico helm release) |
-| 7a-7h | **NICo REST** full stack (postgres, Keycloak, Temporal, nico-rest, site-agent) |
+| 7a-7g | **NICo REST** base stack (source and CA setup, PostgreSQL, Keycloak, Temporal, REST services) |
+| 7h | **NICo Flow** (Flow, PSM, and NSM), unless `--skip-flow` is used |
+| 7i | **NICo REST site-agent** |
 
 The following components are deployed:
 
-```
+```text
 local-path-provisioner     (raw manifest - StorageClasses for Vault + PostgreSQL PVCs)
 metallb                    (metallb/metallb 0.14.5 - LoadBalancer IPs via BGP or L2)
 postgres-operator          (zalando/postgres-operator 1.10.1 - manages nico-pg-cluster)
 cert-manager               (jetstack/cert-manager v1.17.1)
 vault                      (hashicorp/vault 0.25.0, 3-node HA Raft, TLS)
 external-secrets           (external-secrets/external-secrets 0.14.3)
-nico-prereqs            (this Helm chart - nico-system namespace)
+nico-prereqs               (this Helm chart - nico-system namespace)
 NICo Core                  (../helm - nico-core.yaml values)
-NICo REST                  (rest-api/helm/charts/nico-rest)
-  ├── nico-rest-ca-issuer ClusterIssuer (cert-manager.io)
+NICo REST                  (../helm/rest/nico-rest)
+  ├── nico-rest-ca-issuer   (ClusterIssuer - cert-manager.io)
   ├── postgres StatefulSet  (temporal + keycloak databases)
   ├── keycloak              (dev OIDC IdP, nico-dev realm)
   ├── temporal              (temporal-helm/temporal, mTLS)
-  ├── nico-rest          (API, cert-manager, workflow, site-manager)
-  └── nico-rest-site-agent (StatefulSet, bootstrap via site-manager)
+  └── nico-rest             (API, cert-manager, workflow, site-manager)
+NICo Flow                  (../helm/charts/nico-flow - Flow, PSM, and NSM)
+NICo REST site-agent       (../helm/rest/nico-rest-site-agent - StatefulSet, bootstrap via site-manager)
 ```
 
-For manual phase-by-phase installation, re-running individual phases, or debugging failures, refer to the [Reference Installation](../installation-options/reference-install.md) guide.
+For manual phase-by-phase installation, re-running individual phases, or debugging failures, refer to the [Reference Installation](installation-options/reference-install.md) guide.
 
 ## Step 5 — Verify the Site Controller
 
@@ -507,7 +527,7 @@ kubectl get pods -n temporal
 kubectl get certificate core-grpc-client-site-agent-certs -n nico-rest
 ```
 
-For troubleshooting common issues, refer to the [Reference Installation — Troubleshooting](../installation-options/reference-install.md#troubleshooting) guide.
+For troubleshooting common issues, refer to the [Reference Installation — Troubleshooting](installation-options/reference-install.md#troubleshooting) guide.
 
 ## Step 6 — Connect the OOB Network
 
@@ -521,7 +541,7 @@ Configure the out-of-band network to relay BMC DHCP requests to the NICo DHCP se
    kubectl logs -n nico-system -l app.kubernetes.io/name=nico-dhcp --tail=20
    ```
 
-For detailed OOB network requirements, refer to the [BMC and Out-of-Band Setup](../prerequisites/bmc-oob-setup.md) guide.
+For detailed OOB network requirements, refer to the [BMC and Out-of-Band Setup](prerequisites/bmc-oob-setup.md) guide.
 
 ## Step 7 — Discover Your First Host
 

helm-prereqs/README.md

@@ -182,6 +182,7 @@ It supports these common deployment modes:
 | `-y` | Non-interactive mode; accept setup prompts automatically. |
 | `--skip-core` | Install prerequisites and REST, but skip the NICo Core Helm release. |
 | `--skip-rest` | Install prerequisites and Core, but skip all REST phases and REST repo checks. |
+| `--skip-flow` | Skip NICo Flow in Phase 7h. You can also set `flow.enabled=false` in `values.yaml` to omit Flow prerequisites. |
 | `--skip-core --skip-rest` | Infrastructure-only run; image tags, image registry, and REST repo are not required. |
 | `--core-values <file>` | Use site-specific Core values instead of `helm-prereqs/values/nico-core.yaml`. |
 | `--metallb-config <path>` | Use a site-specific MetalLB manifest file or kustomize directory. |
@@ -194,15 +195,15 @@ existing imagePullSecrets in values.
 
 ## What gets deployed
 
-```
+```text
 local-path-provisioner     (raw manifest - StorageClasses for Vault + PostgreSQL PVCs)
 metallb                    (metallb/metallb 0.14.5 - LoadBalancer IPs via BGP or L2)
 postgres-operator          (zalando/postgres-operator 1.10.1 - manages nico-pg-cluster)
 cert-manager               (jetstack/cert-manager v1.17.1)
 vault                      (hashicorp/vault 0.25.0, 3-node HA Raft, TLS)
 external-secrets           (external-secrets/external-secrets 0.14.3)
-nico-prereqs            (this Helm chart - nico-system namespace)
-NICo Core      (../helm - nico-core.yaml values)
+nico-prereqs               (this Helm chart - nico-system namespace)
+NICo Core                  (../helm - nico-core.yaml values)
   ├── nico-api              (Deployment - gRPC/REST API, requires PostgreSQL + Vault)
   ├── nico-bmc-proxy        (Deployment - authenticating Redfish proxy)
   ├── nico-dhcp             (Deployment - Kea DHCP, advertises hook params to DPUs)
@@ -212,13 +213,14 @@ NICo Core      (../helm - nico-core.yaml values)
   ├── nico-pxe              (Deployment - HTTP PXE boot)
   ├── nico-ssh-console-rs   (Deployment - SSH console proxy)
   └── unbound               (Deployment - .forge zone DNS, opt-in)
-NICo REST      (rest-api/helm/charts/nico-rest)
-  ├── nico-rest-ca-issuer ClusterIssuer (cert-manager.io)
+NICo REST                  (../helm/rest/nico-rest)
+  ├── nico-rest-ca-issuer   (ClusterIssuer - cert-manager.io)
   ├── postgres StatefulSet  (temporal + keycloak + NICo databases)
   ├── keycloak              (dev OIDC IdP, nico-dev realm)
   ├── temporal              (temporal-helm/temporal, mTLS)
-  ├── nico-rest          (API, cert-manager, workflow, site-manager)
-  └── nico-rest-site-agent (StatefulSet, bootstrap via site-manager)
+  └── nico-rest             (API, cert-manager, workflow, site-manager)
+NICo Flow                  (../helm/charts/nico-flow - Flow, PSM, and NSM)
+NICo REST site-agent       (../helm/rest/nico-rest-site-agent - StatefulSet, bootstrap via site-manager)
 ```
 
 ## DPU compatibility DNS (`.forge` zone) — REQUIRED for DPU bring-up

helm-prereqs/setup.sh

@@ -552,6 +552,8 @@ fi
 #      7e. Temporal namespace + TLS certs (issued by the NICo REST CA issuer)
 #      7f. Temporal helm chart
 #      7g. NICo REST helm chart (API, cert-manager, workflow, site-manager)
+#      7h. NICo Flow (Flow, PSM, NSM)
+#      7i. NICo REST site-agent
 # ---------------------------------------------------------------------------
 echo ""
 _SETUP_PHASE="[7/7] NICo REST"