fix(compute-plane): update observability defaults and coverage

deploy/helm/nvca-operator/nvca-operator/README.md

@@ -21,7 +21,7 @@ used in Kubernetes Clusters to run NVCF Workloads.
 | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- |
 | `otelCollector.enabled`                   | Enable OTel collector sidecar for K8s event collection                                                                                                                                                | `false`                    |
 | `otelCollector.imageRepository`           | (OPTIONAL) Image repository of OpenTelemetry Collector sidecar. If not specified, it will be calculated based on image.repository (stg vs prod).                                                      | `""`                       |
-| `otelCollector.imageTag`                  | Image tag of OpenTelemetry Collector sidecar.                                                                                                                                                         | `0.143.2`                  |
+| `otelCollector.imageTag`                  | Image tag of OpenTelemetry Collector sidecar.                                                                                                                                                         | `0.157.9`                  |
 | `otelCollector.resources.limits.cpu`      | CPU limit for the OTel collector container                                                                                                                                                            | `1000m`                    |
 | `otelCollector.resources.limits.memory`   | Memory limit for the OTel collector container                                                                                                                                                         | `1Gi`                      |
 | `otelCollector.resources.requests.cpu`    | CPU request for the OTel collector container                                                                                                                                                          | `200m`                     |
@@ -123,7 +123,7 @@ used in Kubernetes Clusters to run NVCF Workloads.
 | `helmManaged.imageCredHelper.imageTag`        | (REQUIRED) Image tag of "nvcf-image-credential-helper". Only override this if you know what you are doing.                                                                           | `0.10.2`   |
 | `helmManaged.otelCollector.enabled`           | Enable OTel collector sidecar for helm-managed clusters                                                                                                                              | `false`   |
 | `helmManaged.otelCollector.imageRepository`   | (OPTIONAL) Image repository of "otel-collector". Only override this if you know what you are doing. If not specified, it will be calculated based on image.repository.               | `""`      |
-| `helmManaged.otelCollector.imageTag`          | (REQUIRED) Image tag of "otel-collector". Only override this if you know what you are doing.                                                                                         | `0.143.2` |
+| `helmManaged.otelCollector.imageTag`          | (REQUIRED) Image tag of "otel-collector". Only override this if you know what you are doing.                                                                                         | `0.157.9` |
 
 ### Self Managed NVCF Backend Configuration
 
@@ -137,7 +137,7 @@ used in Kubernetes Clusters to run NVCF Workloads.
 | `selfManaged.imageCredHelper.imageTag`        | (REQUIRED) Image tag of "nvcf-image-credential-helper". Only override this if you know what you are doing.                                                                           | `0.10.2`                                    |
 | `selfManaged.otelCollector.enabled`           | Enable OTel collector sidecar for self-managed clusters                                                                                                                              | `false`                                    |
 | `selfManaged.otelCollector.imageRepository`   | (OPTIONAL) Image repository of "otel-collector". Only override this if you know what you are doing. If not specified, it will be calculated based on image.repository.               | `""`                                       |
-| `selfManaged.otelCollector.imageTag`          | (REQUIRED) Image tag of "otel-collector". Only override this if you know what you are doing.                                                                                         | `0.143.2`                                  |
+| `selfManaged.otelCollector.imageTag`          | (REQUIRED) Image tag of "otel-collector". Only override this if you know what you are doing.                                                                                         | `0.157.9`                                  |
 | `selfManaged.icmsServiceURL`                  | URL of the ICMS service for self-managed clusters. Override with the endpoint generated during cluster registration.                                                                 | `http://icms.example.invalid:8080`        |
 | `selfManaged.icmsServiceHostHeaderOverride`                 | Optional Host header override for selfManaged.icmsServiceURL.                                                                                                                       | `""`                                      |
 | `selfManaged.revalServiceURL`                 | URL of the ReVal service for self-managed clusters. Override with the endpoint generated during cluster registration.                                                                | `http://reval.example.invalid:8080`       |

deploy/helm/nvca-operator/nvca-operator/templates/deployment.yaml

@@ -154,7 +154,7 @@ spec:
         - name: OTEL_COLLECTOR_IMAGE_REPO
           value: {{ include "nvcaop.otelCollectorRepository" (dict "imageRepository" .Values.otelCollector.imageRepository "defaultRepository" .Values.image.repository) | quote }}
         - name: OTEL_COLLECTOR_IMAGE_TAG
-          value: {{ .Values.otelCollector.imageTag | default "0.143.2" | quote }}
+          value: {{ .Values.otelCollector.imageTag | default "0.157.9" | quote }}
         {{- if .Values.otelCollector.resources }}
         - name: OTEL_COLLECTOR_RESOURCES_B64
           value: {{ .Values.otelCollector.resources | toJson | b64enc | quote }}

deploy/helm/nvca-operator/nvca-operator/values.schema.json

@@ -53,7 +53,7 @@
                 "imageTag": {
                     "type": "string",
                     "description": "Image tag of OpenTelemetry Collector sidecar.",
-                    "default": "0.143.2"
+                    "default": "0.157.9"
                 },
                 "resources": {
                     "type": "object",
@@ -627,7 +627,7 @@
                         "imageTag": {
                             "type": "string",
                             "description": "(REQUIRED) Image tag of \"otel-collector\". Only override this if you know what you are doing.",
-                            "default": "0.143.2"
+                            "default": "0.157.9"
                         }
                     }
                 }
@@ -693,7 +693,7 @@
                         "imageTag": {
                             "type": "string",
                             "description": "(REQUIRED) Image tag of \"otel-collector\". Only override this if you know what you are doing.",
-                            "default": "0.143.2"
+                            "default": "0.157.9"
                         }
                     }
                 },

deploy/helm/nvca-operator/nvca-operator/values.yaml

@@ -37,7 +37,7 @@ nvcaImage:
 otelCollector:
   enabled: false
   imageRepository: ""
-  imageTag: 0.143.2
+  imageTag: 0.157.9
   resources:
     limits:
       cpu: 1000m
@@ -291,7 +291,7 @@ helmManaged:
   otelCollector:
     enabled: false
     imageRepository: ""
-    imageTag: 0.143.2
+    imageTag: 0.157.9
 ## @section Self Managed NVCF Backend Configuration
 ## Only used when ngcConfig.clusterSource is "self-managed"
 ## All values below are under the 'selfManaged:' key, e.g. 'selfManaged.nvcaVersion'
@@ -315,7 +315,7 @@ selfManaged:
   otelCollector:
     enabled: false
     imageRepository: ""
-    imageTag: 0.143.2
+    imageTag: 0.157.9
   ## @param selfManaged.icmsServiceURL URL of the ICMS service for self-managed clusters. Override with the endpoint generated during cluster registration.
   icmsServiceURL: "http://icms.example.invalid:8080"
   ## @param selfManaged.icmsServiceHostHeaderOverride Optional Host header override for selfManaged.icmsServiceURL.

deploy/helm/nvca-operator/tests/release_image_manifest_test.sh

@@ -61,7 +61,7 @@ data:
       enabled: false
       imageConfig:
         repository: "nvcr.io/nvidia/nvcf-byoc/nvcf-otel-collector"
-        tag: "0.143.2"
+        tag: "0.157.9"
     placeholder:
       imageRepository: ""
       imageTag: "ignored"
@@ -84,7 +84,7 @@ expected_images=(
   "nvcr.io/nvidia/nvcf-byoc/nvca-operator:2.52.0-rc.5"
   "nvcr.io/nvidia/nvcf-byoc/nvca:2.52.0-rc.5"
   "nvcr.io/nvidia/nvcf-byoc/nvcf-image-credential-helper:0.5.0"
-  "nvcr.io/nvidia/nvcf-byoc/nvcf-otel-collector:0.143.2"
+  "nvcr.io/nvidia/nvcf-byoc/nvcf-otel-collector:0.157.9"
   "nvcr.io/nvidia/nvcf-byoc/samba:1.0.5"
 )
 

deploy/helm/nvca-operator/tests/self_managed_nvca_image_reference_test.sh

@@ -79,6 +79,26 @@ image_credential_helper_repository="$(yq -r '.selfManaged.imageCredHelper.imageR
 image_credential_helper_tag="$(yq -r '.selfManaged.imageCredHelper.imageTag' "${repo_root}/nvca-operator/values.yaml")"
 samba_repository="$(yq -r '.selfManaged.sharedStorage.imageRepository' "${repo_root}/values.release-sbom.yaml")"
 samba_tag="$(yq -r '.selfManaged.sharedStorage.imageTag' "${repo_root}/nvca-operator/values.yaml")"
+expected_operator_otel_collector_tag="$(yq -r '.otelCollector.imageTag' "${repo_root}/nvca-operator/values.yaml")"
+expected_backend_otel_collector_tag="$(yq -r '.selfManaged.otelCollector.imageTag' "${repo_root}/nvca-operator/values.yaml")"
+rendered_operator_otel_collector_tag="$(
+  yq -r 'select(.kind == "Deployment" and .metadata.name == "nvca-operator") | .spec.template.spec.containers[] | select(.name == "nvca-operator") | .env[] | select(.name == "OTEL_COLLECTOR_IMAGE_TAG") | .value' \
+    "${manifest}"
+)"
+rendered_backend_otel_collector_tag="$(
+  yq -r 'select(.kind == "ConfigMap" and .metadata.name == "nvcfbackend-self-managed") | .data."cluster-dto.yaml" | from_yaml | .otelCollector.imageConfig.tag' \
+    "${manifest}"
+)"
+
+if [[ "${rendered_operator_otel_collector_tag}" != "${expected_operator_otel_collector_tag}" ]]; then
+  echo "expected rendered operator collector tag ${expected_operator_otel_collector_tag}, got ${rendered_operator_otel_collector_tag}" >&2
+  exit 1
+fi
+
+if [[ "${rendered_backend_otel_collector_tag}" != "${expected_backend_otel_collector_tag}" ]]; then
+  echo "expected rendered self-managed collector tag ${expected_backend_otel_collector_tag}, got ${rendered_backend_otel_collector_tag}" >&2
+  exit 1
+fi
 
 expected_annotations=(
   "release-artifact-nvca-image: \"${nvca_image_repository}:${nvca_version}\""

deploy/stacks/nvcf-compute-plane/README.md

@@ -68,12 +68,15 @@ global:
 ## Chart and Image Sources
 
 The stack pins the NVCA operator chart in
-`helmfile.d/02-nvca.yaml.gotmpl`. The chart supplies the default NVCA,
-NVCA operator, image credential helper, and shared storage image tags.
+`helmfile.d/02-nvca.yaml.gotmpl`. Compute-plane base values supply the tested
+NVCA, NVCA operator, and OTel collector image tags. The chart supplies the
+image credential helper and shared storage image tags.
 
 Use `global.helm.sources` for chart repository location and `global.image` for
 container image repository location. The stack rewrites repositories through
-those global values, while chart defaults supply the tested image tags.
+those global values. Chart defaults provide fallback versions for values the
+compute-plane stack does not override.
+
 Only set `global.nvcaOperator.selfManaged.imageCredHelper.imageTag` when
 pinning a tested replacement helper image.
 

deploy/stacks/nvcf-compute-plane/environments/base.yaml

@@ -31,7 +31,11 @@ global:
   # NVCA Operator Configuration
   # =============================================================================
   nvcaOperator:
+    imageTag: "3.1.0"
     selfManaged:
+      nvcaVersion: "3.1.0"
+      otelCollector:
+        imageTag: "0.157.9"
       # ICMS (SIS) service URL — required; set per environment.
       icmsServiceURL: ""
       icmsServiceHostHeaderOverride: ""

deploy/stacks/nvcf-compute-plane/helmfile.d/02-nvca.yaml.gotmpl

@@ -75,15 +75,16 @@ helmDefaults:
 {{- if $environmentAgentMergeConfig }}
 {{- $agentMergeConfig = mergeOverwrite $agentMergeConfig ($environmentAgentMergeConfig | fromYaml | default dict) }}
 {{- end }}
+{{- $nvcaOp := dig "nvcaOperator" dict .Values.global }}
+{{- $selfManaged := dig "selfManaged" dict $nvcaOp }}
+{{- $otelCollector := dig "otelCollector" dict $selfManaged }}
+{{- $otelCollectorEnabled := dig "enabled" $computeObservabilityEnabled $otelCollector }}
 
 releases:
 
   - name: nvca-operator
-    # Released chart from nvca-operator-deploy. The chart bakes its own
-    # image.tag + selfManaged.nvcaVersion (set by `make vendor-chart` from
-    # nvca-operator-deploy/.env), so no inline tag override is needed; the
-    # nvca + nvca-operator images are mirrored to the environment registry by
-    # regsync-configs.
+    # Released chart from nvca-operator-deploy. Compute-plane base values own
+    # the operator and NVCA versions used by this stack.
     chart: nvcf/helm-nvca-operator
     version: 1.14.0
     namespace: nvca-operator
@@ -95,10 +96,12 @@ releases:
       # read by the nvca-operator chart.
       - {{ $registrationValuesPath | quote }}
       # Resolve operator + nvca images through global.image.{registry,repository}.
-      # The chart's image.tag and selfManaged.nvcaVersion defaults supply the
-      # actual image tag; this block only overrides repository and pullPolicy.
+      # Compute-plane base values supply their image versions.
       - image:
           repository: {{ .Values.global.image.registry }}/{{ .Values.global.image.repository }}/nvca-operator
+          {{- with dig "imageTag" "" $nvcaOp }}
+          tag: {{ . | quote }}
+          {{- end }}
           pullPolicy: IfNotPresent
         nvcaImage:
           repositoryOverride: {{ .Values.global.image.registry }}/{{ .Values.global.image.repository }}/nvca
@@ -112,11 +115,11 @@ releases:
         {{- end }}
         clusterName: {{ requiredEnv "CLUSTER_NAME" }}
         ncaId: {{ requiredEnv "NCA_ID" }}
-        {{- $selfManaged := dig "nvcaOperator" "selfManaged" dict .Values.global }}
-        {{- $otelCollector := dig "otelCollector" dict $selfManaged }}
-        {{- $otelCollectorEnabled := dig "enabled" $computeObservabilityEnabled $otelCollector }}
         selfManaged:
           identitySource: psat
+          {{- with dig "nvcaVersion" "" $selfManaged }}
+          nvcaVersion: {{ . | quote }}
+          {{- end }}
           {{- with dig "icmsServiceURL" "" $selfManaged }}
           icmsServiceURL: {{ . | quote }}
           {{- end }}
@@ -170,7 +173,6 @@ releases:
         networkPolicy:
 {{ toYaml . | nindent 10 }}
         {{- end }}
-        {{- $nvcaOp := dig "nvcaOperator" dict .Values.global }}
         {{- if .Values.global.nodeSelector.enabled -}}
         nodeSelector:
           key: {{ .Values.global.nodeSelector.key }}

deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-8e61e521-nvca-operator/helm-nvca-operator/templates/deployment.yaml

@@ -117,7 +117,7 @@ spec:
           - --nvca-cache-mount-options-enabled
           - --nvca-cache-mount-options
           - "ro,norecovery,nouuid"
-        image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.0.4
+        image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.1.0
         imagePullPolicy: IfNotPresent
         securityContext:
           # Set here so openbao injection can copy it upon injection
@@ -163,7 +163,7 @@ spec:
             cpu: "1000m"
             memory: "4Gi"
       - name: nvca-mirror
-        image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.0.4
+        image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.1.0
         imagePullPolicy: IfNotPresent
         securityContext:
           runAsUser: 1000

deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-8e61e521-nvca-operator/helm-nvca-operator/templates/pre-delete-cleanup-job.yaml

@@ -52,7 +52,7 @@ spec:
         fsGroup: 1010
       containers:
       - name: cleanup
-        image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.0.4
+        image: nvcr.io/0651155215864979/ncp-dev/nvca-operator:3.1.0
         imagePullPolicy: IfNotPresent
         securityContext:
           runAsUser: 1000

deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-8e61e521-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml

@@ -20,7 +20,7 @@ metadata:
   name: nvcfbackend-self-managed
   namespace: nvca-operator
   annotations:
-    release-artifact-nvca-image: "nvcr.io/0651155215864979/ncp-dev/nvca:3.0.4"
+    release-artifact-nvca-image: "nvcr.io/0651155215864979/ncp-dev/nvca:3.1.0"
     release-artifact-nvcf-image-credential-helper-image: "nvcr.io/0651155215864979/ncp-dev/nvcf-image-credential-helper:0.10.2"
     release-artifact-samba-image: "nvcr.io/0651155215864979/ncp-dev/samba:1.0.5"
   labels:
@@ -37,7 +37,7 @@ data:
     clusterDescription: "ncp-local"
     clusterGroupName: "nvcf-default"
     ncaID: "nvcf-default"
-    nvcaVersion: "3.0.4"
+    nvcaVersion: "3.1.0"
     oAuthClientId: ""
     cloudProvider: "NCP"
     region: "us-west-1"
@@ -70,7 +70,7 @@ data:
       enabled: true
       imageConfig:
         repository: "nvcr.io/nvidia/nvcf-byoc/nvcf-otel-collector"
-        tag: "0.143.2"
+        tag: "0.157.9"
     agent:
       natsURL: "nats://nats.nats-system.svc.cluster.local:4222"
       helmReValStageOAuthTokenURL: ""