Helmfile live BDDs fail because register-cluster requires an unexported profile

[sbaum1994]

Describe the bug

The Helmfile live BDD features fail during compute-plane registration on a
fresh checkout after #1236 changed
deploy/stacks/nvcf-compute-plane/Makefile.dist.

The register-cluster target now requires
deploy/stacks/self-managed/out/control-plane-profile.yaml. The Helmfile BDDs
install the control plane directly with Helmfile but do not export that profile
before calling the target. They also continue to pass NVCF_CLI_CONFIG, which
the changed target no longer consumes, and rely on the target's removed
implicit nvcf-cli init behavior.

The following live feature files on main use the affected flow:

• tests/bdd/features/single-cluster-helmfile.feature
• tests/bdd/features/multi-cluster-helmfile.feature
• tests/bdd/features/observability-all.feature
• tests/bdd/features/observability-compute.feature
• tests/bdd/features/single-cluster-eks-helmfile.feature
• tests/bdd/features/multi-cluster-eks-helmfile.feature

The CLI-based single-cluster-up and multi-cluster-up features are not
affected because their install workflow already generates and consumes a
control-plane profile.

Steps or code to reproduce bug

The failure was reproduced from a fresh worktree combining main at
c52a0f1850a95a84f68ce8fbf66c3b9943f71097 with
#1075 at
9ac1c09d619cc13d9e7b03674179942d30486f12:

cd tests/bdd
BDD_CLEANUP_MODE=topology-single \
  go test -run '^TestSingleClusterHelmfileLLMPKI$' -count=1 -timeout 90m -v

The destructive cleanup, local cluster bootstrap, PKI render, full
control-plane install, OpenBao issuer readiness, and stargate certificate
readiness all succeeded. Registration then failed with:

ERROR: Generated control-plane profile not found at deploy/stacks/self-managed/out/control-plane-profile.yaml
       Export it with 'nvcf-cli self-hosted control-plane profile export' first.
make: *** [check-control-plane-profile] Error 1

The same missing-file precondition is present in the six main features listed
above: each calls make -C deploy/stacks/nvcf-compute-plane register-cluster
without first exporting a profile. A stale profile under out/ can mask the
problem, so reproduction should use a fresh worktree.

Expected behavior

Every Helmfile live BDD should pass from a fresh worktree and cluster. The
workflow should explicitly:

1. Install the selected control-plane Helmfile environment.
2. Export control-plane-profile.yaml from that same environment and explicit
   Kubernetes context.
3. Initialize CLI authentication through the selected CLI config without
   exposing the token in command logs.
4. Register the compute cluster from the exported profile.
5. Install NVCA and continue the workload assertions.

For the PKI feature in PR 1075, the exported profile should be the canonical
handoff for the OpenBao root CA, transport trust bundle, and fingerprint. The
profile-to-registration translation should be tested instead of maintaining a
second trust-bundle implementation in the BDD helper script.

Additional context

Suggested resolution:

• Update the affected Helmfile features to run control-plane profile export
  with their selected environment and control/compute contexts.
• Add an explicit nvcf-cli --config <path> init step where authentication is
  required.
• Restore optional NVCF_CLI_CONFIG propagation in the compute-plane
  register-cluster Make target, or replace it with another documented way to
  select the matching config-specific token state.
• Pass CONTROL_PLANE_PROFILE and COMPUTE_KUBE_CONTEXT explicitly from the
  BDDs.
• Update tests/bdd/AGENTS.md; its Helmfile section still says the path is
  values-only, has no profile, and that register-cluster runs init
  internally.
• Add Makefile tests proving explicit config and profile arguments reach
  nvcf-cli, plus wiring tests proving each feature exports a profile before
  registration.

Related changes:

• Registration contract change: fix(nvcf-compute-plane): use generated profile for registration #1236
• PKI BDD where the failure was observed: test(bdd): single-cluster PKI feature with a secured LLM invoke #1075

---

By submitting this issue, you agree to follow our
code of conduct and our
contributing guidelines.

[balajinvda]

🎉 This issue has been resolved in version nvcf-cli-v1.15.11 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀