nvca-self-managed-install

# NVCA Self-Managed Install Use `deploy/helm/nvca-operator` as the install surface for NVCA Operator chart validation. Do not add NVCA back into the stack Helmfile just to test this chart. ## Source of Truth - Control-plane deployment: `deploy/stacks/self-managed` - NVCA chart and install workflow: `deploy/helm/nvca-operator` - NVCA source images and source chart: `src/compute-plane-services/nvca` - Cluster prerequisites: use the public `nvcf-self-managed-prerequisite` skill - Full stack install and teardown: use the public `nvcf-self-managed-installation` skill ## Instructions Run from `deploy/helm/nvca-operator`: ```bash make render-values-from-stack \ stack_env=local \ stack_repo=../../../deploy/stacks/self-managed ``` Inspect the generated file under `bin/`, then install or upgrade. The render also sets the values the control-plane validator role needs from the stack: `clusterValidator.gatewayNames` from the wired `ingress.gatewayApi.gateways`, `clusterValidator.storageClass` from `global.storageClass`, and `clusterValidator.externalComponents` from the quorum components the stack disables. It rewrites them on every render, empty included, so an upgrade does not keep a stale value from the release. On a registry other than NGC (`nvcr.io` or a subdomain) it also sets `clusterValidator.nodeToNodeProbeImage` to `busybox:1.36` under the stack's repository, so mirror that image there. It keeps a probe image the release already sets, and sets none when `networkChecks.enforcement.testImage` is set: ```bash make install-from-stack \ stack_env=local \ stack_repo=../../../deploy/stacks/self-managed ``` ## Optional Inputs - `additional_values=override.yml` for one-off overrides - `NCA_ID=<value>` to set the primary account ID explicitly - `CLUSTER_NAME=<value>` and `CLUSTER_ID=<value>` to preserve or pin cluster identity - `IMAGE_PULL_SECRET_NAME=<secret>` to attach a pre-created image pull secret - `NODE_TO_NODE_PROBE_IMAGE=<image>` to pick the node-to-node probe image; it must be pullable without an image pull secret ## Existing Release Reuse If `nvca-operator` is already installed in the `nvca-operator` namespace, the render helper reuses current release values first, then overlays repository paths derived from the stack environment file. Use this to preserve cluster IDs and operator settings during upgrades. ## Safety Before creating, deleting, or reusing local k3d clusters, read the local-dev safety guidance in `docs/dev/local-development.md` from the repo root. Do not delete clusters or Helm releases without explicit user approval.