feat(self-managed): install the managed LLM PKI issuer

deploy/stacks/self-managed/environments/base.yaml

@@ -9,13 +9,13 @@ global:
   # =============================================================================
   # Helm Chart Sources Configuration
   # =============================================================================
-  # Option A — HTTP Helm repository (e.g. NGC public catalog):
+  # Option A: HTTP Helm repository (e.g. NGC public catalog):
   #   sources:
   #     url: "https://helm.ngc.nvidia.com/nvidia/nvcf"
   #     username: "$oauthtoken"
   #     password: "YOUR_NGC_API_KEY"
   #
-  # Option B — OCI registry (e.g. ECR or a private NGC org after mirroring):
+  # Option B: OCI registry (e.g. ECR or a private NGC org after mirroring):
   #   sources:
   #     registry: "nvcr.io"           # or <account>.dkr.ecr.<region>.amazonaws.com
   #     repository: "YOUR_ORG/YOUR_TEAM"
@@ -199,9 +199,14 @@ cassandra:
 
 certManager:
   # cert-manager controller required to reconcile Certificate resources for
-  # the self-managed PKI stack (ClusterIssuer/nvcf-openbao-pki + per-service
-  # Certificates land in subsequent MRs). The bundled helm-nvcf-cert-manager
-  # chart ships installCRDs=true by default.
+  # the self-managed PKI stack. Enabling addons.llm.pki with the managed
+  # issuer creates ClusterIssuer/nvcf-openbao-pki, which is cluster-scoped
+  # and has no namespace. The nvcf-pki Helm release that creates it and the
+  # cert-manager ServiceAccount it authenticates as both live in the
+  # cert-manager namespace. The bundled helm-nvcf-cert-manager chart ships
+  # installCRDs=true by default. Set this to false when cert-manager is
+  # installed outside this stack; that external installation must still
+  # provide ServiceAccount/cert-manager in the cert-manager namespace.
   enabled: true
 
 openbao:
@@ -252,23 +257,28 @@ addons:
   # LLM addon: gateway + request router (stargate) for LLM function invocation
   llm:
     enabled: false
-    # OpenBao-issued QUIC TLS certificate for the request router (Stargate).
-    # When enabled, the chart provisions an NVCF service-issuing PKI hierarchy
-    # in OpenBao via a Helm pre-install/pre-upgrade Job, requests a Certificate
-    # against the nvcf-openbao-pki ClusterIssuer, and mounts the resulting
-    # Secret into the request-router pod. Disabled by default; opt in per env.
+    # QUIC TLS certificate for the request router (Stargate). When enabled,
+    # the chart requests a Certificate from the configured issuer and mounts
+    # the resulting Secret. Managed mode also provisions the OpenBao
+    # service-issuing hierarchy and defaults to
+    # ClusterIssuer/nvcf-openbao-pki. Disabled by default; opt in per env.
     pki:
       enabled: false
-      # REQUIRED when enabled. Comma-separated DNS suffixes the OpenBao PKI
-      # role accepts. Typically the customer domain plus cluster.local for
-      # in-cluster service identity.
+      # REQUIRED for a managed issuer. Comma-separated DNS suffixes the
+      # OpenBao PKI role accepts. Typically the customer domain plus
+      # cluster.local for in-cluster service identity.
       allowedDomains: ""
       # REQUIRED when enabled. SANs requested on the issued certificate.
       dnsNames: []
       # Optional overrides; defaults are usually correct.
       # secretName: stargate-quic-tls
       # issuerKind: ClusterIssuer
       # issuerName: nvcf-openbao-pki
+      # Stack management defaults to true only for the default
+      # ClusterIssuer/nvcf-openbao-pki configuration. Set this explicitly to
+      # manage a custom ClusterIssuer. Leave it false for an external issuer.
+      # clusterIssuer:
+      #   enabled: true
       # namespace: vault-system
       # mountPath: /etc/stargate/tls
       # certPath: /etc/stargate/tls/tls.crt

deploy/stacks/self-managed/global.yaml.gotmpl

@@ -865,24 +865,56 @@ llmRequestRouter:
        should not be punished with confusing required errors during render. */ -}}
   {{- if and (dig "addons" "llm" "enabled" false .Values) (dig "addons" "llm" "pki" "enabled" false .Values) }}
   {{- $secretName := dig "addons" "llm" "pki" "secretName" "stargate-quic-tls" .Values }}
-  {{- $allowedDomains := required "addons.llm.pki.allowedDomains is required when addons.llm.pki.enabled is true" (dig "addons" "llm" "pki" "allowedDomains" "" .Values) }}
+  {{- /* dig only falls back for a missing path, so explicit null, empty, and
+       wrongly typed values reach these checks. Reject them instead of coercing
+       them: a malformed management flag that silently resolves to false skips
+       the nvcf-pki release in 01-dependencies.yaml.gotmpl while the block
+       below still renders a Certificate referencing the default issuer. Keep
+       this contract identical to the dependency stage. */ -}}
+  {{- $issuerKind := dig "addons" "llm" "pki" "issuerKind" "ClusterIssuer" .Values }}
+  {{- $issuerName := dig "addons" "llm" "pki" "issuerName" "nvcf-openbao-pki" .Values }}
+  {{- if not (kindIs "string" $issuerKind) }}
+  {{- fail "addons.llm.pki.issuerKind must be the string \"ClusterIssuer\" or \"Issuer\"" }}
+  {{- end }}
+  {{- if not (has $issuerKind (list "ClusterIssuer" "Issuer")) }}
+  {{- fail (printf "addons.llm.pki.issuerKind must be exactly \"ClusterIssuer\" or \"Issuer\", got %q" $issuerKind) }}
+  {{- end }}
+  {{- if not (kindIs "string" $issuerName) }}
+  {{- fail "addons.llm.pki.issuerName must be a string" }}
+  {{- end }}
+  {{- if not (regexMatch "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$" $issuerName) }}
+  {{- fail (printf "addons.llm.pki.issuerName must be a lowercase RFC 1123 DNS subdomain, got %q" $issuerName) }}
+  {{- end }}
+  {{- if gt (len $issuerName) 253 }}
+  {{- fail "addons.llm.pki.issuerName must be at most 253 characters" }}
+  {{- end }}
+  {{- $managedIssuer := and (eq $issuerKind "ClusterIssuer") (eq $issuerName "nvcf-openbao-pki") }}
+  {{- $pkiValues := dig "addons" "llm" "pki" dict .Values }}
+  {{- if kindIs "map" $pkiValues }}
+  {{- $clusterIssuerValues := dig "clusterIssuer" dict $pkiValues }}
+  {{- if and (kindIs "map" $clusterIssuerValues) (hasKey $clusterIssuerValues "enabled") }}
+  {{- /* index, not get: helmfile overrides sprig's get with a path-based
+       signature that rejects a map as its first argument. */ -}}
+  {{- $manageSetting := index $clusterIssuerValues "enabled" }}
+  {{- if not (kindIs "bool" $manageSetting) }}
+  {{- fail (printf "addons.llm.pki.clusterIssuer.enabled must be a YAML boolean, true or false. Quoted strings, null, and empty values are rejected. Got %q" (toString $manageSetting)) }}
+  {{- end }}
+  {{- $managedIssuer = $manageSetting }}
+  {{- end }}
+  {{- end }}
+  {{- if and $managedIssuer (ne $issuerKind "ClusterIssuer") }}
+  {{- fail "addons.llm.pki.clusterIssuer management supports only issuerKind=ClusterIssuer" }}
+  {{- end }}
   {{- $dnsNames := dig "addons" "llm" "pki" "dnsNames" (list) .Values }}
   {{- if eq (len $dnsNames) 0 }}
   {{- fail "addons.llm.pki.dnsNames must contain at least one DNS name when addons.llm.pki.enabled is true" }}
   {{- end }}
-  {{- /* Provisioning hook reuses the same image the k8s-openbao chart drives;
-       fall back to openbao.migrations.image.tag so operators set the version
-       in one place. */ -}}
-  {{- $pkiImageTag := dig "addons" "llm" "pki" "image" "tag" (dig "openbao" "migrations" "image" "tag" "" .Values) .Values }}
-  {{- if not $pkiImageTag }}
-  {{- fail "addons.llm.pki.image.tag (or openbao.migrations.image.tag) is required when addons.llm.pki.enabled is true" }}
-  {{- end }}
   certificate:
     enabled: true
     secretName: {{ $secretName | quote }}
     issuerRef:
-      kind: {{ dig "addons" "llm" "pki" "issuerKind" "ClusterIssuer" .Values | quote }}
-      name: {{ dig "addons" "llm" "pki" "issuerName" "nvcf-openbao-pki" .Values | quote }}
+      kind: {{ $issuerKind | quote }}
+      name: {{ $issuerName | quote }}
     dnsNames:
       {{- toYaml $dnsNames | nindent 6 }}
   tls:
@@ -891,6 +923,15 @@ llmRequestRouter:
     certPath: {{ dig "addons" "llm" "pki" "certPath" "/etc/stargate/tls/tls.crt" .Values | quote }}
     keyPath: {{ dig "addons" "llm" "pki" "keyPath" "/etc/stargate/tls/tls.key" .Values | quote }}
     quicInsecure: false
+  {{- if $managedIssuer }}
+  {{- $allowedDomains := required "addons.llm.pki.allowedDomains is required when addons.llm.pki.clusterIssuer management is enabled" (dig "addons" "llm" "pki" "allowedDomains" "" .Values) }}
+  {{- /* Provisioning hook reuses the same image the k8s-openbao chart drives;
+       fall back to openbao.migrations.image.tag so operators set the version
+       in one place. */ -}}
+  {{- $pkiImageTag := dig "addons" "llm" "pki" "image" "tag" (dig "openbao" "migrations" "image" "tag" "" .Values) .Values }}
+  {{- if not $pkiImageTag }}
+  {{- fail "addons.llm.pki.image.tag (or openbao.migrations.image.tag) is required when addons.llm.pki.clusterIssuer management is enabled" }}
+  {{- end }}
   pki:
     enabled: true
     namespace: {{ dig "addons" "llm" "pki" "namespace" "vault-system" .Values | quote }}
@@ -905,6 +946,7 @@ llmRequestRouter:
       {{- toYaml .Values.global.imagePullSecrets | nindent 6 }}
     {{- end }}
   {{- end }}
+  {{- end }}
   {{- with dig "llmRequestRouter" "podDisruptionBudget" dict .Values }}
   podDisruptionBudget:
     {{- toYaml . | nindent 4 }}
@@ -992,7 +1034,7 @@ vanityGateway:
 {{- if dig "addons" "nvcfUi" "enabled" false .Values }}
 {{/* Shared backend coordinates for the services the nvcf-ui proxies to and
      the control-plane health monitor probes. Read the same way gateway-routes
-     is fed — from ingress.gatewayApi.routes.<x>.backend — so the config URLs and
+     is fed from ingress.gatewayApi.routes.<x>.backend so the config URLs and
      component endpoints track any operator override; the dict defaults fill the
      usual case where a route pins no explicit backend. merge lets a partial
      override (e.g. namespace only) keep the remaining default fields. */}}

deploy/stacks/self-managed/helmfile.d/01-dependencies.yaml.gotmpl

@@ -6,6 +6,57 @@ environments:
 
 ---
 
+{{- $llmEnabled := dig "addons" "llm" "enabled" false .Values }}
+{{- $pkiEnabled := dig "addons" "llm" "pki" "enabled" false .Values }}
+{{- $llmPkiActive := and $llmEnabled $pkiEnabled }}
+{{- $issuerKind := dig "addons" "llm" "pki" "issuerKind" "ClusterIssuer" .Values }}
+{{- $issuerName := dig "addons" "llm" "pki" "issuerName" "nvcf-openbao-pki" .Values }}
+{{- $manageIssuer := false }}
+{{- if $llmPkiActive }}
+{{- /* dig only falls back for a missing path, so explicit null, empty, and
+     wrongly typed values reach these checks. Reject them instead of coercing
+     them: a malformed management flag that silently resolves to false skips
+     the nvcf-pki release while global.yaml.gotmpl still renders a Certificate
+     referencing ClusterIssuer/nvcf-openbao-pki, which is the dangling-issuer
+     failure this stack exists to prevent. */ -}}
+{{- if not (kindIs "string" $issuerKind) }}
+{{- fail "addons.llm.pki.issuerKind must be the string \"ClusterIssuer\" or \"Issuer\"" }}
+{{- end }}
+{{- if not (has $issuerKind (list "ClusterIssuer" "Issuer")) }}
+{{- fail (printf "addons.llm.pki.issuerKind must be exactly \"ClusterIssuer\" or \"Issuer\", got %q" $issuerKind) }}
+{{- end }}
+{{- if not (kindIs "string" $issuerName) }}
+{{- fail "addons.llm.pki.issuerName must be a string" }}
+{{- end }}
+{{- if not (regexMatch "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$" $issuerName) }}
+{{- fail (printf "addons.llm.pki.issuerName must be a lowercase RFC 1123 DNS subdomain, got %q" $issuerName) }}
+{{- end }}
+{{- if gt (len $issuerName) 253 }}
+{{- fail "addons.llm.pki.issuerName must be at most 253 characters" }}
+{{- end }}
+{{- $manageIssuer = and (eq $issuerKind "ClusterIssuer") (eq $issuerName "nvcf-openbao-pki") }}
+{{- $pkiValues := dig "addons" "llm" "pki" dict .Values }}
+{{- if kindIs "map" $pkiValues }}
+{{- $clusterIssuerValues := dig "clusterIssuer" dict $pkiValues }}
+{{- if and (kindIs "map" $clusterIssuerValues) (hasKey $clusterIssuerValues "enabled") }}
+{{- /* index, not get: helmfile overrides sprig's get with a path-based
+     signature that rejects a map as its first argument. */ -}}
+{{- $manageSetting := index $clusterIssuerValues "enabled" }}
+{{- if not (kindIs "bool" $manageSetting) }}
+{{- fail (printf "addons.llm.pki.clusterIssuer.enabled must be a YAML boolean, true or false. Quoted strings, null, and empty values are rejected. Got %q" (toString $manageSetting)) }}
+{{- end }}
+{{- $manageIssuer = $manageSetting }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- $managedIssuer := and $llmPkiActive $manageIssuer }}
+{{- if and $managedIssuer (ne $issuerKind "ClusterIssuer") }}
+{{- fail "addons.llm.pki.clusterIssuer management supports only issuerKind=ClusterIssuer" }}
+{{- end }}
+{{- if and $managedIssuer (not (dig "openbao" "enabled" true .Values)) }}
+{{- fail "openbao.enabled must be true when addons.llm.pki.clusterIssuer management is enabled" }}
+{{- end }}
+
 repositories:
   - name: nvcf
 {{- if dig "global" "helm" "sources" "url" "" .Values }}
@@ -64,6 +115,34 @@ releases:
     needs:
       - nats-system/nats
 
+{{- if $managedIssuer }}
+  - name: nvcf-pki
+    chart: nvcf/helm-nvcf-pki
+    version: 0.1.0
+    namespace: cert-manager
+    values:
+      - clusterIssuer:
+          enabled: true
+          name: {{ $issuerName | quote }}
+          server: "http://openbao-server.vault-system.svc.cluster.local:8200"
+          path: "services/all/pki/nvcf-service-issuing/sign/nvcf-service-server"
+          auth:
+            mountPath: "/v1/auth/jwt"
+            role: "cert-manager"
+            serviceAccount:
+              name: "cert-manager"
+              audience: "http://openbao-server.vault-system.svc.cluster.local:8200"
+    wait: true
+    waitForJobs: true
+    labels:
+      release-group: dependencies
+    needs:
+      - vault-system/openbao-server
+{{- if dig "certManager" "enabled" true .Values }}
+      - cert-manager/cert-manager
+{{- end }}
+{{- end }}
+
   - name: cassandra
     version: 0.17.0
     condition: cassandra.enabled # From defaults.yaml or env overrides