fix(nvca): add workload-config opt-out for NVLink ComputeDomain allocation #5475
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: Copyright (c) NVIDIA CORPORATION & AFFILIATES. All rights reserved. | |
| # SPDX-License-Identifier: Apache-2.0 | |
| name: build-test | |
| on: | |
| push: | |
| branches: [main, 'release-**'] | |
| pull_request: | |
| branches: [main, 'release-**'] | |
| merge_group: | |
| types: [checks_requested] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: build-test-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| docs: | |
| name: docs | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| fetch-tags: true | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: tools/go-toolchain/go.mod | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '24' | |
| - name: Run docs validation | |
| run: ./tools/ci/check-docs | |
| - name: Check latest stack release | |
| continue-on-error: true | |
| env: | |
| DOC_VERSION_SYNC_GITHUB_TOKEN: ${{ github.token }} | |
| run: ./tools/ci/check-doc-version-current-release | |
| go-lib-codegen: | |
| name: go-lib codegen | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: tools/go-toolchain/go.mod | |
| - name: Run go-lib codegen freshness check | |
| run: ./tools/ci/check-go-codegen src/libraries/go/lib --install k8s.io/code-generator/cmd/deepcopy-gen@v0.34.2 --command 'make codegen-update' | |
| helm-charts: | |
| name: helm charts | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| # Pinned and checksum-verified rather than floating latest, so a chart | |
| # that renders today keeps rendering the same way tomorrow. helmfile | |
| # v1.2.0+ processes helmfile.d/ in parallel and breaks the ordering the | |
| # self-managed stack relies on, so stay on v1.1.x. deploy/stacks | |
| # requires helm v3.x. | |
| - name: Install helm and helmfile (pinned, checksum-verified) | |
| env: | |
| HELM_VERSION: "3.21.4" | |
| HELM_SHA256: "61f88ab166748cb19604d7884cb100ae9ccb13804ddeb98e08af167eacbb6a14" | |
| HELMFILE_VERSION: "1.1.9" | |
| HELMFILE_SHA256: "ee71196bb12460905b8cbe0ef67b28db51ef681b777cc212d8c0956475b51905" | |
| run: | | |
| set -euo pipefail | |
| cd "${RUNNER_TEMP}" | |
| curl -sSL --retry 3 -o helm.tar.gz \ | |
| "https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz" | |
| echo "${HELM_SHA256} helm.tar.gz" | sha256sum -c - | |
| tar xzf helm.tar.gz linux-amd64/helm | |
| curl -sSL --retry 3 -o helmfile.tar.gz \ | |
| "https://github.com/helmfile/helmfile/releases/download/v${HELMFILE_VERSION}/helmfile_${HELMFILE_VERSION}_linux_amd64.tar.gz" | |
| echo "${HELMFILE_SHA256} helmfile.tar.gz" | sha256sum -c - | |
| tar xzf helmfile.tar.gz helmfile | |
| mkdir -p "${RUNNER_TEMP}/bin" | |
| mv linux-amd64/helm helmfile "${RUNNER_TEMP}/bin/" | |
| echo "${RUNNER_TEMP}/bin" >> "${GITHUB_PATH}" | |
| - name: Check tool versions | |
| run: | | |
| set -euo pipefail | |
| helm version --short | |
| helmfile --version | |
| - name: Test the chart mapping guard | |
| run: bash tools/ci/test-check-helm-charts | |
| - name: Lint and render every chart with a CI values file | |
| run: ./tools/ci/check-helm-charts | |
| - name: Check NVCA Operator chart is synced with its monorepo source | |
| # Pins the version fields to whatever is already committed in the | |
| # vendored chart, so this only fails on real content drift between | |
| # src/compute-plane-services/nvca/deployments/nvca-operator and | |
| # deploy/helm/nvca-operator/nvca-operator, not on pending version bumps. | |
| run: | | |
| set -euo pipefail | |
| cd deploy/helm/nvca-operator | |
| NVCA_VERSION="$(yq '.selfManaged.nvcaVersion' nvca-operator/values.yaml)" \ | |
| NVCA_OPERATOR_VERSION="$(yq '.appVersion' nvca-operator/Chart.yaml)" \ | |
| NVCA_SHARED_STORAGE_IMAGE_TAG="$(yq '.selfManaged.sharedStorage.imageTag' nvca-operator/values.yaml)" \ | |
| NVCA_OTEL_COLLECTOR_IMAGE_TAG="$(yq '.otelCollector.imageTag' nvca-operator/values.yaml)" \ | |
| make check-vendor-chart | |
| - name: Test NVCA default ownership | |
| run: | | |
| make -C deploy/helm/nvca-operator test-default-ownership | |
| make -C deploy/stacks/nvcf-compute-plane test-nvca-default-ownership | |
| - name: Run self-managed Helmfile render tests | |
| run: make -C deploy/stacks/self-managed test | |
| - name: Run observability Helmfile profile tests | |
| run: make -C deploy/stacks/observability test | |
| - name: Test OpenBao auto-unseal retry behavior | |
| run: bash deploy/helm/openbao/tests/auto-unseal-sidecar.sh | |
| - name: Test OpenBao plugin catalog refresh hook | |
| run: bash deploy/helm/openbao/tests/plugin-catalog-refresh-hook.sh | |
| - name: Test ReVal authorization configuration | |
| run: bash deploy/helm/helm-reval/tests/auth-config.sh | |
| - name: Check for uncommitted helm dependency artifacts | |
| run: | | |
| set -euo pipefail | |
| if [ -n "$(git status --porcelain)" ]; then | |
| echo "ERROR: the checks left the working tree dirty:" >&2 | |
| git status --porcelain >&2 | |
| exit 1 | |
| fi | |
| # git status alone would miss a fetched subchart archive, since | |
| # .gitignore covers them. Look for the files themselves. | |
| leftover="$(git status --porcelain --ignored=matching -- 'deploy/helm/*/*/charts/*.tgz')" | |
| if [ -n "${leftover}" ]; then | |
| echo "ERROR: the checks left fetched subchart archives behind:" >&2 | |
| echo "${leftover}" >&2 | |
| exit 1 | |
| fi | |
| go-tools: | |
| name: Go tools | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| fetch-tags: true | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: tools/go-toolchain/go.mod | |
| - name: Run ncp-local-cluster Makefile tests | |
| run: | | |
| make -C tools/ncp-local-cluster test-cluster-lifecycle-make | |
| make -C tools/ncp-local-cluster test-multicluster-make | |
| make -C tools/ncp-local-cluster test-gateway-timeout-compatibility | |
| # The repo tooling modules carry tests that no workflow ran, so a pull | |
| # request could break them and still go green. tools/docs-version-sync | |
| # reached main with three failing tests that way. | |
| - name: Test the checker | |
| run: tools/ci/test-check-go-tools | |
| - name: Build, vet, and test the Go modules under tools/ | |
| run: tools/ci/check-go-tools | |
| github-release-helper: | |
| name: GitHub release helper | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Run release helper tests | |
| run: python3 tools/ci/test-github-release.py | |
| - name: Test stack pin branch refresh | |
| run: bash tools/ci/test-prepare-stack-pin-branch | |
| - name: Check Go toolchain declarations agree | |
| run: tools/ci/check-go-version | |
| - name: Check nested Bazel module inventory | |
| run: | | |
| bash tools/ci/test-check-nested-modules | |
| bash tools/ci/check-nested-modules | |
| - name: Check BUILD files match their sources | |
| run: | | |
| bash tools/ci/test-check-gazelle | |
| bash tools/ci/check-gazelle |