feat(nvca): configure Secret-backed workload transport trust

[mikeyrcamp]

Why

Managed NVCA deployments need a chart-owned, rotation-aware way to supply a workload transport CA bundle from a Kubernetes Secret. The raw agent configuration overlay is not an appropriate configuration surface for this managed trust source.

What changed

• Added operatorConfig.workload.transportTLS Helm values and the chart-owned nvca-operator-config ConfigMap.
• Resolved the selected release-namespace Secret in the operator, validated certificate-only PEM, and emitted the existing bundle-mode transport-TLS configuration.
• Computed the canonical trust-bundle fingerprint or verified the configured pin.
• Rejected conflicts with agentConfig.mergeConfig and preserved the last-good generated agent configuration on invalid input.
• Triggered reconciliation when the operator ConfigMap changes; Secret rotation is picked up by the existing backend sync.
• Centralized the chart ConfigMap-to-nvcaconfig.Config mapping in nvca_config_mapper.go, with setup and rollout comparison sharing one desired agent-ConfigMap builder.
• Updated the source and released charts, schemas, documentation, and Helm render coverage.

Customer Release Notes

Managed NVCA Operator deployments can configure workload transport trust from a Kubernetes Secret.

Usage

Configure a release-namespace Secret such as nvcf-trust:

operatorConfig:
  workload:
    transportTLS:
      trustBundle:
        secretKeyRef:
          name: nvcf-trust
          key: ca.crt
      fingerprint: "" # optional; empty computes it

The Secret is not mounted into the operator and no CRD or RBAC changes are required.

Testing

• Focused Bazel mapper, reconciliation, source-conflict, rotation, and rollout-parity tests
• Source Helm lint/render regression suite, including default, configured, and reuse-values rendering
• Released-chart Helm lint and configured render
• Scoped golangci-lint with 0 issues
• Built and side-loaded the operator image into Kind, then verified ConfigMap-triggered reconciliation and downstream bundle-mode agent configuration

Versioning

Chart defaults remain pinned to 3.0.4. The Kind validation side-loaded the locally built operator under the cluster's existing 3.1.0 image reference.

References

Relates to #50 and #658.

Related Pull Requests

None.

Dependencies

None.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• main

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 503b865a-b60a-46f4-98e3-3c7d555dfed0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}