feat(self-managed): add opt-in nvcf-ui addon to the self-managed stack

[vrv3814]

Why

The self-managed stack had no way to deploy the NVCF UI. Operators who want the
web UI had to wire the release, backend URLs, and health-monitor config by hand.
This adds a first-class, opt-in addon so the UI installs with the rest of the
control plane and its config tracks the stack's actual backend coordinates.

What changed

• helmfile.d/02-core.yaml.gotmpl: add the nvcf-ui release (chart
  nvcf/helm-nvcf-ui 1.0.2, namespace nvcf-ui), gated on
  addons.nvcfUi.enabled, needing nvcf/invocation-service. Bump the
  ingress gateway-routes chart from 1.13.4 to 1.15.0 to pick up the nvcf-ui
  route support.
• global.yaml.gotmpl: render the nvcfUi values block only when the addon is
  enabled. Backend URLs (nvcf-api, nvct-api, sis) and the control-plane health
  monitor component list are derived from the same
  ingress.gatewayApi.routes.<x>.backend coordinates gateway-routes uses, with
  dict defaults, so operator route overrides flow through. Health components for
  optional services (ratelimiter, llm, vanity-gateway, nats, openbao, cassandra,
  cert-manager, envoy-gateway) are included only when their feature is enabled.
  The openbao-migrations image tag floors at 0.16.2 and honors a newer operator
  override. Add the nvcf-ui HTTPRoute under nvcfGatewayRoutes, enabled by the
  same addon flag.
• environments/base.yaml: add the addons.nvcfUi.enabled: false default,
  the ingress...nvcfUi route override stub, and nvcf-ui to the openbao
  namespace list.

Customer Release Notes

Self-managed NVCF can now deploy the NVCF web UI as an opt-in addon. Set
addons.nvcfUi.enabled: true to install it.

Plan Summary

When enabled: one new Helm release (nvcf-ui in namespace nvcf-ui), one
openbao-migrations job, and one nvcf-ui HTTPRoute. Disabled by default, so
existing installs see no change.

Usage

Enable in your environment values:

addons:
  nvcfUi:
    enabled: true

Testing

Rendered the helmfile with the addon disabled (no-op) and enabled to confirm the
values block, route, and release template correctly. QA: recommend a full
self-managed install with addons.nvcfUi.enabled: true to validate the UI and
health monitor end to end.

Notes

Health-monitor component list and backend URLs are derived from the stack's
route backends rather than the chart defaults, so they stay correct under
operator route overrides.

References

<add a public NVIDIA/nvcf issue: Closes #NNN>

Related Pull Requests

None

Dependencies

Chart bumps only: nvcf/nvcf-gateway-routes 1.13.4 -> 1.15.0, new
nvcf/helm-nvcf-ui 1.0.2. No new third-party libraries.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1cabb46f-d6e4-43da-b453-0b8bf10e7aa1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch nvcf-ui-phase0

---

_{Comment @coderabbitai help to get the list of available commands.}