fix(nico-api): add carbide-api.forge to default cert SANs (DPU heartbeat during carbide→nico rename)

[kirson-git]

Problem

On a v0.10.3 deployment, BlueField DPUs never heartbeat and stay stuck at WaitingForNetworkConfig. Root cause: the forge-dpu-agent binary still dials the API by the legacy name carbide-api.forge (carbide→nico rename gap), but the generated nico-api serving cert doesn't include that SAN → the agent rejects the cert (TLS BadCertificate) and never connects.

Fix

Add carbide-api.forge to the default nico-api certificate extraDnsNames so DPU heartbeat works out-of-the-box during the rename transition. (The chart already supports extraDnsNames; this just makes the legacy name a default while the binary still uses it.)

Validation

Applied on a live 2× XE9680 + BlueField-3 lab — DPUs went from WaitingForNetworkConfig/HeartbeatTimeout to Healthy after the cert included this SAN.

Related: #2823 (carbide→nico rename gaps).

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ca294471-8796-45fe-b2c7-7852c7bfa970

📥 Commits

Reviewing files that changed from the base of the PR and between 40c7ca4 and bd13d2a.

📒 Files selected for processing (1)

• helm/charts/nico-api/values.yaml

---

Summary by CodeRabbit

• Chores
  • Updated certificate configuration to ensure service connectivity is maintained during infrastructure updates.

Walkthrough

The certificate.extraDnsNames field in helm/charts/nico-api/values.yaml is updated from an empty list to include the legacy DNS name carbide-api.forge. Inline comments document that this Subject Alternative Name is required for forge-dpu-agent TLS compatibility during the carbide-to-nico service rename.

Changes

TLS SAN Backward Compatibility

Layer / File(s)	Summary
Add legacy SAN to certificate values helm/charts/nico-api/values.yaml	certificate.extraDnsNames is changed from an empty list to include carbide-api.forge, with comments noting the dependency on this SAN by forge-dpu-agent to prevent TLS rejection and heartbeat loss during the rename.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related issues

• carbide→nico rename gaps: binary/CLI still dial carbide-api.forge[-system] (DPU heartbeat cert SAN, admin-cli default endpoint) #2823: This PR directly implements the workaround described in the issue by adding carbide-api.forge to certificate.extraDnsNames, resolving the DPU heartbeat TLS certificate failure caused by the carbide→nico service rename.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and specifically summarizes the primary change: adding a legacy DNS name to certificate SANs to resolve DPU heartbeat failures during a system rename.
Description check	✅ Passed	The description provides clear context on the problem, root cause, fix, and validation, directly relating to the changeset in the values.yaml configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[kensimon]

/ok to test bd13d2a

[kensimon]

@kirson-git please add a signed-off-by on your commit (git commit --amend -s) and re-push.

[github-actions]

🔍 Container Scan Summary

Service	Total	Critical	High	Medium	Low	Other
boot-artifacts-aarch64	3	0	0	3	0	0
boot-artifacts-x86_64	3	0	0	3	0	0
forge-admin-cli-x86_64	265	6	24	98	7	130
machine-validation-runner	717	32	188	267	36	194
machine_validation	717	32	188	267	36	194
machine_validation-aarch64	717	32	188	267	36	194
nvmetal-carbide	717	32	188	267	36	194
TOTAL	3139	134	776	1172	151	906

Per-CVE detail lives in the per-service grype-* artifacts (JSON + SARIF). Severity counts only — no CVE IDs published here.

[osu]

/ok to test 6a5f214

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pull-request-2825.docs.buildwithfern.com/infra-controller

[osu]

/ok to test

[copy-pr-bot]

/ok to test

@osu, there was an error processing your request: E1

See the following link for more information: https://docs.gha-runners.nvidia.com/cpr/e/1/

[osu]

/ok to test a32a1c0