release: align remaining self-managed image and chart pins

[sbaum1994]

Summary

Align the latest released NVCF images with the self-managed control-plane, observability-plane, and compute-plane stack inventories. The current work is split into exactly three accountable units: inventory coverage, chart/image production, and stack consumption.

The latest comparison covers 36 released NVCF images against the inventory attached to self-managed stack 0.16.2:

• 17 image versions already match.
• 10 images are behind and require chart or stack pin updates.
• 9 images are not represented in the attached inventory and need an explicit inclusion or exclusion decision.

The attached self-managed inventory contains 50 images and 34 charts across all three planes. The standalone observability and compute-plane releases currently have no attached inventory assets.

Active child issues

• release: reconcile Pulse images missing from stack inventories #1831 — reconcile the nine images missing from stack inventories and add plane-scoped release assets.
• release: update chart image pins to current remediated releases #1832 — update and publish the chart/image pairs for the ten behind images.
• release: consume remediated chart releases in self-managed stacks #1833 — consume the published charts and direct image pins in the three stacks, then validate the replacement inventories.

Ten image versions behind

Self-managed control plane

• cassandra:5.0.8-nv-2.0.1 -> 5.0.9-nv-2.0.5
• nvcf-cassandra-migrations:0.17.5 -> 0.17.6
• nvcf-openbao:2.5.5-nv-1.3.1 -> 2.6.2-nv-1.3.4
• nvcf-openbao-migrations:0.19.1 -> 0.19.5
• icms-service-oss:0.7.1 -> 0.7.2
• stargate:0.16.2 -> 0.18.0

Observability plane

• nvcf-function-autoscaler:1.21.5 -> 1.21.6

Compute plane

• nvca:3.5.2 -> 3.8.0
• nvca-operator:3.6.0 -> 3.8.0
• nvcf-image-credential-helper:0.10.2 -> 0.11.1

The Cassandra 0.21.3 and OpenBao 0.32.6 source chart tags already contain their target images, but their chart packages and images must be independently pullable before the stack consumes them. Function Autoscaler, SIS/ICMS, LLM Request Router, and NVCA need newer chart releases carrying the target image versions.

Nine images not represented

• nvcf-unbound:0.10.2
• byoo-otel-collector:0.160.0-nv-0.2.5
• nvcf-otel-collector:0.160.0-nv-0.2.5
• llm-api-gateway-rate-limit-sync-worker:0.14.2
• nvcf-event-ledger:0.15.2
• nvcf-worker-task-oss:1.1.2
• pylon:0.18.0
• cluster-validator:3.8.0
• tools:3.8.0

Pylon is known to be a conditional self-managed runtime pin and therefore represents an inventory completeness gap. The remaining images require a decision based on whether the released stack can actually deploy them, including disabled-by-default and optional paths.

Vulnerability status

• The latest comparison's six Critical findings are confined to nvcf-unbound:0.10.2, which is not in the current stack inventory.
• The target OpenBao and OpenBao-migrations images have no Critical or High findings in the latest comparison.
• The other target image versions retain only CVE-2026-85091, which currently has no fix and remains within SLA. A version bump cannot clear that residual until a fixed base package is available.
• The comparison is not evidence that an older released digest contains the same findings. Final status requires validation of the replacement digests produced by release: consume remediated chart releases in self-managed stacks #1833.

Prior completed work

• release: bump native self-managed chart image pins #1782 completed the previous native chart image-pin batch.
• release: consume remaining self-managed chart releases in stacks #1783 completed the previous self-managed stack-consumption batch.
• release: publish approved OpenBao images and chart #1788 completed the prior OpenBao selection work.
• The state-metrics requirements formerly tracked by release: publish state-metrics chart with image 1.24.0 #1787 are carried forward explicitly by release: update chart image pins to current remediated releases #1832 and release: consume remediated chart releases in self-managed stacks #1833; release: publish state-metrics chart with image 1.24.0 #1787 is closed as superseded.

Required order

1. Classify the nine inventory omissions in release: reconcile Pulse images missing from stack inventories #1831.
2. Update and publish the chart/image pairs in release: update chart image pins to current remediated releases #1832.
3. Consume only published, pullable chart releases in release: consume remediated chart releases in self-managed stacks #1833.
4. Generate and attach self-managed, observability, and compute-plane inventories.
5. Validate the newly published image digests and record any no-fix residuals.

Acceptance criteria

• All nine unrepresented images have an explicit inventory disposition.
• All ten behind image pins resolve to their target versions in the correct stack release.
• The carried-forward state-metrics work is complete.
• Each of the three stack releases attaches a machine-readable image/chart inventory.
• Replacement-digest validation reports no fix-available Critical or High finding, with no-fix findings tracked separately through SLA and fix availability.
• release: reconcile Pulse images missing from stack inventories #1831, release: update chart image pins to current remediated releases #1832, and release: consume remediated chart releases in self-managed stacks #1833 are complete.

Source locations

• Stack chart pins: deploy/stacks/self-managed/helmfile.d/
• Self-managed direct image pins: deploy/stacks/self-managed/global.yaml.gotmpl and environments/base.yaml
• Compute-plane pins: deploy/stacks/nvcf-compute-plane/
• Chart-owned image pins: deploy/helm/
• GitHub release configuration: tools/ci/github-release-subprojects.json

[sbaum1994]

Status refreshed after #1734 merged. Closed completed child issues #1782 and #1783. The parent remains open for #1787 (state-metrics) and #1788 (OpenBao); each follow-up now owns its chart release, later stack pin update, and final inventory validation.