feat(nvca): configure transport TLS mount path

[mikeyrcamp]

Customer Summary

Managed NVCA deployments can isolate router transport trust from the cluster-wide certificate path, avoiding admission-time mount collisions while retaining the existing default behavior.

TL;DR

Adds operatorConfig.workload.transportTLS.installedBundleMountPath. When omitted, NVCA continues using /etc/ssl/certs; dev2 uses /nvcf/transport-tls for the router CA.

Additional Details

• Propagates the Helm value through operator configuration and generated agent configuration.
• Mounts nvcf-trust-merged-certs at the configured path and derives STARGATE_TLS_CERT_PATH as <path>/ca-certificates.crt.
• Leaves installer output at /merged-certs/ca-certificates.crt and general/proxy trust at /etc/ssl/certs.
• Rejects invalid, reserved, root, noncanonical, conflicting, and overlapping mount paths.
• Covers regular Pods, initial MiniService workloads, Helm rendering, config rollout, last-good configuration preservation, and Kyverno/webhook admission composition.

For the Reviewer

This is the v3.1 source PR. PR #672 contains the corresponding main-line change. The only backport resolution adjusted Bazel dependency labels to the release branch convention; behavior is unchanged.

For QA

Passed:

• go test ./internal/transporttls ./pkg/operator/reconcile ./pkg/nvca ./internal/miniservice -count=1
• ./scripts/lint_helm.sh
• Focused Bazel transport-TLS test in the standalone NVCA workspace.
• Managed dev2 rollout with operatorConfig.workload.transportTLS.installedBundleMountPath=/nvcf/transport-tls.
• New API-created LLM workload: trust installer exited 0, both certificate mounts were present, proxy variables remained on /etc/ssl/certs, Pylon set STARGATE_TLS_CERT_PATH=/nvcf/transport-tls/ca-certificates.crt, and the reverse tunnel connected without UnknownIssuer.

For the dev test, the byocdev image was pre-pulled temporarily onto both GPU nodes because API-issued workload credentials currently authorize only the staging registry. The temporary DaemonSet and credential were removed. Cold-node validation requires staging publication or an API-issued byocdev pull credential.

Tickets

• NVCF-10306

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• main

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: eb19c61b-5378-43e3-bba0-0bb796e3a528

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[mikeyrcamp]

Superseded by #718, which consolidates the transport-TLS work on current main.