feat(nvca): configure Secret-backed workload transport trust

[mikeyrcamp]

Why

PR #655 landed on the NVCA 3.1 release branch, but the same Secret-backed workload transport trust support is not present on main. Bringing the change forward keeps the development and release lines aligned and gives managed NVCA deployments a chart-owned, rotation-aware trust source.

What changed

• Cherry-picked PR feat(nvca): configure Secret-backed workload transport trust #655's Secret-backed workload transport trust implementation onto current main.
• Added operatorConfig.workload.transportTLS values and the chart-owned nvca-operator-config ConfigMap to both NVCA Operator chart copies.
• Resolves and validates the release-namespace Secret, computes or verifies the trust-bundle fingerprint, and emits the existing bundle-mode agent configuration.
• Preserves last-known-good configuration on invalid input and reconciles operator ConfigMap changes.
• Adapted the reconcile Bazel dependency label to the monorepo-qualified path used on main.

Customer Release Notes

Managed NVCA Operator deployments can configure workload transport trust from a Kubernetes Secret.

Plan Summary

The chart adds an operator configuration ConfigMap with empty, backward-compatible defaults. When configured, the operator reads an existing release-namespace Secret. The change adds no CRD fields, Secret mounts, RBAC permissions, or new third-party dependencies.

Usage

Configure a release-namespace Secret such as nvcf-trust:

operatorConfig:
  workload:
    transportTLS:
      trustBundle:
        secretKeyRef:
          name: nvcf-trust
          key: ca.crt
      fingerprint: "" # optional; empty computes it

Testing

Passed:

• git diff --check origin/main...HEAD
• Focused Bazel tests covering the mapper, Secret resolution, validation, source conflicts, rotation, ConfigMap reconciliation, and rollout parity
• bash src/compute-plane-services/nvca/scripts/lint_helm.sh
• helm lint --strict deploy/helm/nvca-operator/nvca-operator --set ngcConfig.serviceKey=fakekey
• Packaged-chart render of templates/operator-config-cm.yaml

The unfiltered Bazel target compiled successfully, but its local macOS run stops in the pre-existing TestAgent helper because go-mpatch cannot patch os.Exit on this host. The PR-specific filtered tests pass. No additional manual QA is needed for this cherry-pick; PR #655 includes the original Kind integration validation, and Linux CI will run the full required suite.

Notes

The source change applied cleanly except for pkg/operator/reconcile/BUILD.bazel, where main uses monorepo-qualified Bazel labels. The resolution retains all current main entries and adds only PR #655's new source files, tests, and internal/transporttls dependency.

References

Relates to #658.

Related Pull Requests

• feat(nvca): configure Secret-backed workload transport trust #655

Dependencies

None. No license review or NOTICE update is required.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e0d1d901-279b-4826-b845-15f8a8754c16

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}