refactor(nvca): consolidate the operator chart, neutralise defaults, unify release versioning

.bazelignore

@@ -45,7 +45,11 @@ src/libraries/python
 # @stargate_crates from the nested module) do not resolve against the
 # umbrella root MODULE.bazel.
 src/libraries/ts
-deploy
+# deploy is deliberately NOT ignored. The nvca-operator chart lives there and
+# its storage-capability catalog is a data dependency of Go tests under src/.
+# An ignored directory contributes no files to the sandbox, so the tests fail
+# to read it. deploy contains no BUILD files, so leaving it loadable adds no
+# packages: `bazel query //...` reports the same target count either way.
 docs
 fern
 infra

.github/workflows/build-test.yml

@@ -107,20 +107,6 @@ jobs:
       - name: Lint and render every chart with a CI values file
         run: ./tools/ci/check-helm-charts
 
-      - name: Check NVCA Operator chart is synced with its monorepo source
-        # Pins the version fields to whatever is already committed in the
-        # vendored chart, so this only fails on real content drift between
-        # src/compute-plane-services/nvca/deployments/nvca-operator and
-        # deploy/helm/nvca-operator/nvca-operator, not on pending version bumps.
-        run: |
-          set -euo pipefail
-          cd deploy/helm/nvca-operator
-          NVCA_VERSION="$(yq '.selfManaged.nvcaVersion' nvca-operator/values.yaml)" \
-          NVCA_OPERATOR_VERSION="$(yq '.appVersion' nvca-operator/Chart.yaml)" \
-          NVCA_SHARED_STORAGE_IMAGE_TAG="$(yq '.selfManaged.sharedStorage.imageTag' nvca-operator/values.yaml)" \
-          NVCA_OTEL_COLLECTOR_IMAGE_TAG="$(yq '.otelCollector.imageTag' nvca-operator/values.yaml)" \
-            make check-vendor-chart
-
       - name: Test NVCA chart schema and defaults
         run: |
           make -C deploy/helm/nvca-operator test-default-ownership

AGENTS.md

@@ -217,7 +217,6 @@ public snapshot; still follow OSS Snapshot Hygiene manually before finishing.
 |-------|----------|---------|
 | `documentation-style` | `ai-tooling/dev/skills/` | Public docs, AGENTS, and skill-writing style |
 | `nvcf-explore-stack` | `ai-tooling/dev/skills/` | Navigate the self-hosted stack topology and dependency graph |
-| `nvca-chart-release` | `ai-tooling/dev/skills/` | Release NVCA Operator chart changes from monorepo source to the vendored Helm chart |
 | `nvca-self-managed-install` | `ai-tooling/dev/skills/` | Install or validate the NVCA Operator chart against a self-managed control plane |
 | `nvca-values-customization` | `ai-tooling/dev/skills/` | Customize NVCA Operator Helm chart values in the monorepo |
 | `nvcf-self-managed-cli` | `ai-tooling/user/skills/` | Install, operate, and manage self-managed NVCF through `nvcf-cli` |

BUILD.bazel

@@ -39,6 +39,18 @@ exports_files(
     visibility = [":java_notice_consumers"],
 )
 
+# The nvca-operator chart lives under deploy/, which is excluded from gazelle
+# and so has no package of its own. Its storage-capability catalog is consumed
+# by Go tests under src/, so it is exported from the root package here.
+filegroup(
+    name = "nvca-operator-storage-capability-catalog",
+    srcs = [
+        "deploy/helm/nvca-operator/nvca-operator/files/nvcf-storage-capabilities-v1alpha1.schema.json",
+        "deploy/helm/nvca-operator/nvca-operator/files/nvcf-storage-capabilities-v1alpha1.yaml",
+    ],
+    visibility = ["//visibility:public"],
+)
+
 # Gazelle manages only the native Go subtrees listed in go.work.bazel.
 # nv-boot-parent and Cloud Tasks are also owned by the root Bazel module, but
 # their checked-in Java BUILD files are maintained manually and remain outside
@@ -58,7 +70,7 @@ exports_files(
 # gazelle:exclude bazel-out
 # gazelle:exclude bazel-testlogs
 # gazelle:exclude ci
-# gazelle:exclude deploy
+# gazelle:exclude deploy  # keeps gazelle out; .bazelignore deliberately does not ignore it
 # gazelle:exclude docs
 # gazelle:exclude examples
 # gazelle:exclude fern

ai-tooling/dev/skills/nvca-values-customization/SKILL.md

@@ -23,37 +23,35 @@ Use this skill from `deploy/helm/nvca-operator`.
 
 ## Values Flow
 
+Two install paths, and only one of them renders values from a stack.
+
 ```text
-src/compute-plane-services/nvca/deployments/nvca-operator/   source chart
-  -> scripts/ci_vendor_nvca_operator_chart                   applies self-managed defaults
-  -> nvca-operator/values.yaml                               vendored chart values
-  -> scripts/render_values_from_stack_env.sh                 stack-aware generated values
-  -> make install or make install-from-stack                 optional additional overrides
+nvca-operator/values.yaml                        the chart's own defaults
+  -> make install values=<path>                  the values file, used directly
+
+stack environment
+  -> scripts/render_values_from_stack_env.sh     stack-aware generated values
+  -> make install-from-stack                     the generated values
 ```
 
+Either accepts `additional_values=<path>` for further overrides.
+
 ## Permanent Defaults
 
-For defaults that every self-managed deployment should receive, edit
-`scripts/ci_vendor_nvca_operator_chart` and re-vendor:
+Edit `nvca-operator/values.yaml` directly. There is one chart and no vendoring
+step, so that file is the source of truth.
 
-```bash
-make vendor-chart
-git diff nvca-operator/values.yaml
-```
-
-The vendoring script already applies defaults such as:
+Only defaults that suit every consumer belong there. Values tied to one
+deployment are supplied by whoever installs the chart:
 
-- `ngcConfig.clusterSource = "self-managed"`
-- `ngcConfig.serviceKey = "dummy-api-key"`
-- `image.tag` remains empty so templates use the published chart version
-- `selfManaged.nvcaVersion = "$NVCA_VERSION"`
-- `generateImagePullSecret = false`
-- `selfManaged.sharedStorage.imageTag = "$NVCA_SHARED_STORAGE_IMAGE_TAG"`
-- `nameOverride = "nvca-operator"`
-- `fullnameOverride = "nvca-operator"`
+- the compute-plane stack sets them under
+  `deploy/stacks/nvcf-compute-plane/`, including `nameOverride`,
+  `fullnameOverride` and `selfManaged.nvcaVersion`
+- an ngc-managed install passes `ngcConfig.serviceKey` and the `helmManaged.*`
+  values on the command line
 
-Do not edit `nvca-operator/values.yaml` directly for a permanent default. The
-next vendor run will overwrite it.
+`image.tag` ships empty so templates fall back to `appVersion`, which the
+release stamps at packaging time.
 
 ## Deploy-time Overrides
 
@@ -69,19 +67,6 @@ make install-from-stack \
 Use deploy-time overrides for secrets, credentials, cluster-specific IDs, and
 temporary validation changes.
 
-## Adding .env Inputs
-
-For version-like values that the vendoring script needs, add a variable to
-`.env`, require it in `scripts/ci_vendor_nvca_operator_chart`, and re-vendor:
-
-```bash
-MY_NEW_CONFIG=some-value
-```
-
-```bash
-update_yaml_key ".myConfig = \"${MY_NEW_CONFIG:?MY_NEW_CONFIG is not set}\"" "${TARGET_DIR}/values.yaml"
-```
-
 ## Validation
 
 ```bash

deploy/helm/nvca-operator/Makefile

@@ -44,7 +44,7 @@ OCI_REGISTRY_NAMESPACE ?= <your-org>
 CHART_NAME := $(shell yq -r .name $(helm_dir)/Chart.yaml)
 CHART_VERSION := $(shell yq -r .version $(helm_dir)/Chart.yaml)
 
-.PHONY: install uninstall status lint template validate clean package push-oci sync-chart check-synced-chart render-values-from-stack install-from-stack test-render-values test-vendor-chart-image-tag test-build-release-assets test-release-image-manifest test-release-artifact-permissions test-package-release-assets test-attach-release-assets test-release-sbom-wrapper test-self-managed-nvca-image-reference test-otel-collector-compatibility test-image-pull-secret-defaults test-pod-disruption-budget test-first-class-byoo-values test-first-class-storage-worker-values test-default-ownership test-resource-quantity-schema
+.PHONY: install uninstall status lint template validate clean package push-oci render-values-from-stack install-from-stack test-render-values test-build-release-assets test-release-image-manifest test-release-artifact-permissions test-package-release-assets test-attach-release-assets test-release-sbom-wrapper test-self-managed-nvca-image-reference test-otel-collector-compatibility test-image-pull-secret-defaults test-pod-disruption-budget test-first-class-byoo-values test-first-class-storage-worker-values test-default-ownership test-resource-quantity-schema
 
 install:
 ifndef values
@@ -92,9 +92,6 @@ install-from-stack: render-values-from-stack
 test-render-values:
 	@bash ./tests/render_values_from_stack_env_test.sh
 
-test-vendor-chart-image-tag:
-	@bash ./tests/vendor_chart_image_tag_test.sh
-
 test-build-release-assets:
 	@bash ./tests/build_release_assets_test.sh
 
@@ -191,25 +188,3 @@ push-oci:
 	@echo "[push-oci] Cleaning up temporary package directory..."
 	@rm -rf ./packaged-charts
 	@echo "[push-oci] Cleanup complete."
-
-# Sync NVCA Operator chart from monorepo source chart
-vendor-chart:
-	@echo "🚀 [vendor-chart] Vendor NVCA Operator chart from local monorepo source..."
-	@./scripts/ci_vendor_nvca_operator_chart
-	@echo "🎉 [vendor-chart] Vendor complete. Deployments available in $(helm_dir)/"
-
-check-vendor-chart: vendor-chart
-	@echo "🚀 [check-vendor-chart] Checking if chart is synced..."
-	@if ! git diff --ignore-space-at-eol --exit-code -- .; then \
-		echo ""; \
-		echo "❌ [check-vendor-chart] Chart is NOT synced with source chart!"; \
-		echo ""; \
-		echo "📋 To fix this issue:"; \
-		echo "   1. Run: make vendor-chart"; \
-		echo "   2. Review and commit the changes"; \
-		echo "   3. Update your merge request"; \
-		echo ""; \
-		echo "💡 This ensures your deployment matches the monorepo source NVCA Operator chart."; \
-		exit 1; \
-	fi
-	@echo "🎉 [check-vendor-chart] Chart is synced."

deploy/helm/nvca-operator/README.md

@@ -10,24 +10,15 @@ The default chart values do not set the required image registry and repository.
 
 ## Chart Layout
 
-This subtree intentionally keeps a release chart even though the NVCA source
-tree also contains a source chart:
-
-- `src/compute-plane-services/nvca/deployments/nvca-operator` is the source
-  chart kept next to the operator and agent code. Use it when chart behavior is
-  coupled to NVCA code changes.
-- `deploy/helm/nvca-operator/nvca-operator` is the NVCF release chart for
-  self-managed deployments. `make vendor-chart` regenerates it from the source
-  chart and then applies the release-specific defaults, chart name
-  `helm-nvca-operator`, version metadata, self-managed placeholder endpoints,
-  image defaults, supplemental image metadata, and license headers.
-- Keeping both charts avoids a release chart that must reach back into the NVCA
-  source tree at publish time, while still making behavior changes start beside
-  the code they ship with.
-
-Do not edit the vendored chart copy in isolation for source chart behavior.
-Make the source chart change first, run `make vendor-chart`, and commit the
-resulting release chart diff.
+`deploy/helm/nvca-operator/nvca-operator` is the only chart. Edit it directly.
+
+It is published on two lanes from this one source. The NGC lane renames it to
+`nvca-operator` and injects the control-plane endpoints that cannot live in a
+public repository. The OCI lane publishes it as `helm-nvca-operator`, which the
+compute-plane stack pins.
+
+The chart ships neutral defaults: values that belong to a particular deployment
+are supplied by whoever installs it, not shipped as published defaults.
 
 Example:
 

deploy/helm/nvca-operator/nvca-operator/values.yaml

@@ -347,7 +347,7 @@ webhook:
 ##     - "self-managed": Cluster configuration managed by the self-hosted compute plane
 ngcConfig:
   username: '$oauthtoken'
-  serviceKey: "dummy-api-key"
+  serviceKey: ""
   serviceKeySecretName: "ngc-service-key"
   serviceKeySecretKeyName: "ngcServiceKey"
   apiURL: https://api.ngc.nvidia.com
@@ -403,7 +403,7 @@ helmManaged:
 ## All values below are under the 'selfManaged:' key, e.g. 'selfManaged.nvcaVersion'
 selfManaged:
   ## @param selfManaged.nvcaVersion (REQUIRED) Version of the NVCFBackend to use
-  nvcaVersion: "3.12.7"
+  nvcaVersion: ""
   ## @param selfManaged.featureGateValues (Optional) List of feature gates to enable. Defaults to ["DynamicGPUDiscovery"] if not specified.
   featureGateValues: ["DynamicGPUDiscovery"]
   ## @param selfManaged.gpuManualInstanceConfigB64 (Optional) Base64 encoded GPU manual instance configuration. Leave blank if not required.
@@ -425,19 +425,19 @@ selfManaged:
     imageRepository: ""
     imageTag: 0.160.0-nv-0.2.5
   ## @param selfManaged.icmsServiceURL URL of the ICMS service for self-managed clusters. Override with the endpoint generated during cluster registration.
-  icmsServiceURL: "http://icms.example.invalid:8080"
+  icmsServiceURL: ""
   ## @param selfManaged.icmsServiceHostHeaderOverride Optional Host header override for selfManaged.icmsServiceURL.
   icmsServiceHostHeaderOverride: ""
   ## @param selfManaged.revalServiceURL URL of the ReVal service for self-managed clusters. Override with the endpoint generated during cluster registration.
-  revalServiceURL: "http://reval.example.invalid:8080"
+  revalServiceURL: ""
   ## @param selfManaged.revalServiceHostHeaderOverride Optional Host header override for selfManaged.revalServiceURL.
   revalServiceHostHeaderOverride: ""
   ## @param selfManaged.natsURL URL of the NATS service for self-managed clusters. Override with the endpoint generated during cluster registration.
-  natsURL: "nats://nats.example.invalid:4222"
+  natsURL: ""
   ## @param selfManaged.natsHostOverride Optional TLS SNI host override for selfManaged.natsURL when using a tls or wss NATS URL.
   natsHostOverride: ""
   sharedStorage:
-    imageTag: 1.0.5
+    imageTag: ""
 ## @section Node Selector Configuration
 ## @param nodeSelector.key Node-selector Label key
 ## @param nodeSelector.value Node-selector Label value
@@ -573,5 +573,5 @@ clusterValidator:
     limits:
       cpu: 200m
       memory: 128Mi
-nameOverride: nvca-operator
-fullnameOverride: nvca-operator
+nameOverride: ""
+fullnameOverride: ""