fix(self-managed): restore Helmfile profile registration

deploy/stacks/nvcf-compute-plane/Makefile

@@ -240,6 +240,7 @@ help:
 	@echo "  NCA_ID             NCA identifier (default: $(NCA_ID))"
 	@echo "  CONTROL_PLANE_PROFILE  Generated control-plane profile (default:"
 	@echo "                         ../self-managed/out/control-plane-profile.yaml)"
+	@echo "  NVCF_CLI_CONFIG        Optional nvcf-cli config path for registration"
 	@echo "  COMPUTE_KUBE_CONTEXT   Optional kubeconfig context for registration and install"
 	@echo "  CLUSTER_REGION     Cluster region (default: $(CLUSTER_REGION))"
 	@echo ""

deploy/stacks/nvcf-compute-plane/Makefile.dist

@@ -269,6 +269,7 @@ clean:
 #   make register-cluster NVCF_CLI=/path/to/nvcf-cli
 NVCF_CLI_REPO ?= $(shell cd "$(MAKEFILE_DIR)/../../.." && pwd)/src/clis/nvcf-cli
 NVCF_CLI ?= $(NVCF_CLI_REPO)/nvcf-cli
+NVCF_CLI_CONFIG ?=
 CONTROL_PLANE_PROFILE ?= $(shell dirname "$(MAKEFILE_DIR)")/self-managed/out/control-plane-profile.yaml
 
 # --- Cluster Registration Settings ---
@@ -299,7 +300,9 @@ register-cluster: check-cluster-name check-control-plane-profile ensure-nvcf-cli
 	@echo ">>> Registering cluster '$(CLUSTER_NAME)' from the generated control-plane profile..."
 	$(if $(KUBECONFIG_FILE),@echo "    Kubeconfig:  $(KUBECONFIG_FILE)")
 	$(if $(COMPUTE_KUBE_CONTEXT),@echo "    Kube context: $(COMPUTE_KUBE_CONTEXT)")
-	@$(if $(KUBECONFIG_FILE),KUBECONFIG="$(KUBECONFIG_FILE)") "$(NVCF_CLI)" self-hosted \
+	@$(if $(KUBECONFIG_FILE),KUBECONFIG="$(KUBECONFIG_FILE)") "$(NVCF_CLI)" \
+		$(if $(NVCF_CLI_CONFIG),--config "$(NVCF_CLI_CONFIG)") \
+		self-hosted \
 		--compute-plane-stack "$(MAKEFILE_DIR)" \
 		compute-plane register \
 		--control-plane-profile "$(CONTROL_PLANE_PROFILE)" \
@@ -344,6 +347,7 @@ help:
 	@echo "  OUTPUT_DIR         Output and Helmfile handoff directory (default: ./out)"
 	@echo "  CONTROL_PLANE_PROFILE  Generated control-plane profile (default:"
 	@echo "                         ../self-managed/out/control-plane-profile.yaml)"
+	@echo "  NVCF_CLI_CONFIG        Optional nvcf-cli config path for registration"
 	@echo "  COMPUTE_KUBE_CONTEXT   Optional kubeconfig context for registration and install"
 	@echo "  CLUSTER_REGION     Cluster region (default: $(CLUSTER_REGION))"
 	@echo ""

deploy/stacks/nvcf-compute-plane/README.md

@@ -20,18 +20,22 @@ nvcf-cli self-hosted \
   --control-plane-stack ../self-managed \
   control-plane profile export
 
-# 2. Register the cluster with the generated profile.
+# 2. Initialize the CLI config used for registration.
+nvcf-cli --config <path-to-config> init
+
+# 3. Register the cluster with the generated profile.
 make register-cluster \
   CLUSTER_NAME=gpu-east \
-  CLUSTER_REGION=us-west-1
+  CLUSTER_REGION=us-west-1 \
+  NVCF_CLI_CONFIG=<path-to-config>
 
-# 3. Deploy the compute plane.
+# 4. Deploy the compute plane.
 make install \
   CLUSTER_NAME=gpu-east \
   HELMFILE_ENV=<env>
 ```
 
-Repeat steps 1-2 for each GPU cluster (see [this example](#multi-cluster-example)).
+Repeat steps 1 and 3 for each GPU cluster (see [this example](#multi-cluster-example)).
 The `CLUSTER_NAME` variable scopes all state to
 that cluster so multiple clusters can be managed from a single checkout.
 `register-cluster` writes `registration/<cluster>-register-values.yaml`.
@@ -43,7 +47,8 @@ By default, `register-cluster` reads
 `CONTROL_PLANE_PROFILE=/path/to/control-plane-profile.yaml` when the control
 and compute stacks are not sibling directories. The profile is the canonical
 handoff for account identity, service endpoints, Host overrides, and transport
-trust. The Makefile does not require a separate `nvcf-cli-local.yaml`.
+trust. Set `NVCF_CLI_CONFIG` when registration must use a non-default CLI
+config. The Makefile forwards the path to `nvcf-cli` but does not run `init`.
 
 `HELMFILE_ENV` maps to `environments/<env>.yaml`. Create that environment file
 with the artifact registry and any deployment-specific overrides before

deploy/stacks/nvcf-compute-plane/tests/register-cluster.sh

@@ -16,6 +16,8 @@ cp "${stack_dir}/Makefile.dist" "${test_dir}/compute-plane/Makefile"
 
 profile="${test_dir}/self-managed/out/control-plane-profile.yaml"
 printf 'generated-control-plane-profile\n' > "${profile}"
+cli_config="${test_dir}/nvcf cli config.yaml"
+printf 'base_http_url: http://api.example.test\n' > "${cli_config}"
 
 fake_cli="${test_dir}/bin/nvcf-cli"
 record="${test_dir}/cli-args"
@@ -48,10 +50,15 @@ FAKE_CLI_RECORD="${record}" make -C "${test_dir}/compute-plane" register-cluster
   CLUSTER_NAME=gpu-a \
   CLUSTER_REGION=us-east-1 \
   COMPUTE_KUBE_CONTEXT=compute-context \
+  NVCF_CLI_CONFIG="${cli_config}" \
   NVCF_CLI="${fake_cli}"
 
-mapfile -t args < "${record}"
+args=()
+while IFS= read -r arg; do
+  args+=("${arg}")
+done < "${record}"
 expected=(
+  --config "${cli_config}"
   self-hosted
   --compute-plane-stack "${test_dir}/compute-plane"
   compute-plane register
@@ -74,6 +81,16 @@ for i in "${!expected[@]}"; do
   fi
 done
 
+# The config override remains optional for callers that use the default CLI
+# config path or environment-based configuration.
+FAKE_CLI_RECORD="${record}" make -C "${test_dir}/compute-plane" register-cluster \
+  CLUSTER_NAME=gpu-a \
+  NVCF_CLI="${fake_cli}"
+if grep -Fxq -- '--config' "${record}"; then
+  echo "register-cluster unexpectedly passed --config without NVCF_CLI_CONFIG" >&2
+  exit 1
+fi
+
 values="${test_dir}/compute-plane/registration/gpu-a-register-values.yaml"
 grep -q '^clusterID: generated-id$' "${values}"
 

docs/user/cluster-management/self-managed.md

@@ -99,6 +99,7 @@ sequenceDiagram
   Operator->>CLI: profile export
   CLI->>CP: read selected environment
   CLI->>Profile: write generated profile
+  Operator->>CLI: init with selected config path
   Operator->>CLI: compute-plane register
   CLI->>Profile: read endpoints and trust
   CLI->>Compute: discover OIDC issuer and JWKS
@@ -171,6 +172,8 @@ nvcf-cli self-hosted \
   --control-plane-stack deploy/stacks/self-managed \
   --env <environment-name> \
   control-plane profile export
+
+nvcf-cli --config <path-to-cli-config> init
 ```
 
 When the LLM add-on is disabled, the generated profile and registration values
@@ -186,12 +189,16 @@ cluster explicitly when the kubeconfig contains multiple contexts.
 make -C deploy/stacks/nvcf-compute-plane register-cluster \
   CLUSTER_NAME=<gpu-cluster-name> \
   CLUSTER_REGION=<region> \
-  CONTROL_PLANE_PROFILE=deploy/stacks/self-managed/out/control-plane-profile.yaml \
-  KUBECONFIG_FILE=<gpu-cluster-kubeconfig> \
+  CONTROL_PLANE_PROFILE="$(pwd)/deploy/stacks/self-managed/out/control-plane-profile.yaml" \
+  KUBECONFIG_FILE=<absolute-path-to-gpu-cluster-kubeconfig> \
   COMPUTE_KUBE_CONTEXT=<gpu-cluster-context> \
-  NVCF_CLI=<path-to-nvcf-cli>
+  NVCF_CLI=<absolute-path-to-nvcf-cli> \
+  NVCF_CLI_CONFIG=<absolute-path-to-cli-config>
 ```
 
+`NVCF_CLI_CONFIG` is optional when the default CLI config is correct. The Make
+target forwards a configured path to registration but does not run `init`.
+
 The target writes
 `registration/<gpu-cluster-name>-register-values.yaml`. It carries the cluster
 identity and endpoints:
@@ -384,7 +391,7 @@ make -C deploy/stacks/nvcf-compute-plane install \
   CLUSTER_NAME=<gpu-cluster-name> \
   HELMFILE_ENV=<environment-name> \
   NCA_ID=<nca-id> \
-  KUBECONFIG_FILE=<gpu-cluster-kubeconfig> \
+  KUBECONFIG_FILE=<absolute-path-to-gpu-cluster-kubeconfig> \
   COMPUTE_KUBE_CONTEXT=<gpu-cluster-context>
 ```
 
@@ -598,16 +605,17 @@ the refreshed values:
 make -C deploy/stacks/nvcf-compute-plane register-cluster \
   CLUSTER_NAME=<gpu-cluster-name> \
   CLUSTER_REGION=<region> \
-  CONTROL_PLANE_PROFILE=deploy/stacks/self-managed/out/control-plane-profile.yaml \
-  KUBECONFIG_FILE=<gpu-cluster-kubeconfig> \
+  CONTROL_PLANE_PROFILE="$(pwd)/deploy/stacks/self-managed/out/control-plane-profile.yaml" \
+  KUBECONFIG_FILE=<absolute-path-to-gpu-cluster-kubeconfig> \
   COMPUTE_KUBE_CONTEXT=<gpu-cluster-context> \
-  NVCF_CLI=<path-to-nvcf-cli>
+  NVCF_CLI=<absolute-path-to-nvcf-cli> \
+  NVCF_CLI_CONFIG=<absolute-path-to-cli-config>
 
 make -C deploy/stacks/nvcf-compute-plane install \
   CLUSTER_NAME=<gpu-cluster-name> \
   HELMFILE_ENV=<environment-name> \
   NCA_ID=<nca-id> \
-  KUBECONFIG_FILE=<gpu-cluster-kubeconfig> \
+  KUBECONFIG_FILE=<absolute-path-to-gpu-cluster-kubeconfig> \
   COMPUTE_KUBE_CONTEXT=<gpu-cluster-context>
 ```
 

docs/user/csp-end-to-end-example-installation.md

@@ -516,11 +516,20 @@ Register, then install:
 ```bash
 kubectl config use-context "${CONTROL_PLANE_CONTEXT}"
 
+"${NVCF_CLI}" --config "${NVCF_CLI_CONFIG}" self-hosted \
+  --control-plane-stack deploy/stacks/self-managed \
+  --env "${HELMFILE_ENV}" \
+  control-plane profile export \
+  --cluster-name "${CLUSTER_NAME}" \
+  --region "${CLUSTER_REGION}"
+
+"${NVCF_CLI}" --config "${NVCF_CLI_CONFIG}" init
+
 make -C deploy/stacks/nvcf-compute-plane register-cluster \
   CLUSTER_NAME="${CLUSTER_NAME}" \
-  NCA_ID=nvcf-default \
   CLUSTER_REGION="${CLUSTER_REGION}" \
-  ICMS_URL="http://${GATEWAY_ADDR}" \
+  CONTROL_PLANE_PROFILE="$(pwd)/deploy/stacks/self-managed/out/control-plane-profile.yaml" \
+  COMPUTE_KUBE_CONTEXT="${CONTROL_PLANE_CONTEXT}" \
   NVCF_CLI="${NVCF_CLI}" \
   NVCF_CLI_CONFIG="${NVCF_CLI_CONFIG}"
 
@@ -571,11 +580,21 @@ Register with the compute context active, then install onto the compute cluster:
 ```bash
 kubectl config use-context "${COMPUTE_CONTEXT}"
 
+"${NVCF_CLI}" --config "${NVCF_CLI_CONFIG}" self-hosted \
+  --control-plane-stack deploy/stacks/self-managed \
+  --env "${HELMFILE_ENV}" \
+  --control-plane-context "${CONTROL_PLANE_CONTEXT}" \
+  --compute-plane-context "${COMPUTE_CONTEXT}" \
+  control-plane profile export \
+  --region "${CLUSTER_REGION}"
+
+"${NVCF_CLI}" --config "${NVCF_CLI_CONFIG}" init
+
 make -C deploy/stacks/nvcf-compute-plane register-cluster \
   CLUSTER_NAME="${CLUSTER_NAME}" \
-  NCA_ID=nvcf-default \
   CLUSTER_REGION="${CLUSTER_REGION}" \
-  ICMS_URL="http://${GATEWAY_ADDR}" \
+  CONTROL_PLANE_PROFILE="$(pwd)/deploy/stacks/self-managed/out/control-plane-profile.yaml" \
+  COMPUTE_KUBE_CONTEXT="${COMPUTE_CONTEXT}" \
   KUBECONFIG_FILE="${COMPUTE_KUBECONFIG}" \
   NVCF_CLI="${NVCF_CLI}" \
   NVCF_CLI_CONFIG="${NVCF_CLI_CONFIG}"
@@ -589,10 +608,10 @@ make -C deploy/stacks/nvcf-compute-plane install \
 ```
 
 <Info>
-`make register-cluster` runs `nvcf-cli init` (mints the admin token) and then
-`cluster register`, and writes
-`registration/${CLUSTER_NAME}-register-values.yaml`. `make install` consumes
-that file. If you skip `register-cluster`, `make install` fails with a
+Profile export captures the installed control plane's endpoints and trust.
+Run `nvcf-cli init` explicitly before registration. `make register-cluster`
+writes `registration/${CLUSTER_NAME}-register-values.yaml`, and `make install`
+consumes that file. If you skip registration, installation fails with a
 "Registration values not found" error.
 </Info>
 

docs/user/helmfile-installation.md

@@ -1290,8 +1290,10 @@ Helmfile target the GPU cluster instead of the control-plane cluster.
 For a complete Amazon EKS example, see the
 [CSP End-to-End Example](./csp-end-to-end-example-installation.md).
 
-The compute-plane Makefile runs `nvcf-cli init` before `cluster register`. Point
-`NVCF_CLI_CONFIG` at a CLI config that can reach the control-plane gateway.
+Export the installed control-plane environment before registration. For a
+split-cluster deployment, pass both contexts so the profile contains
+compute-reachable endpoints and reads trust from the control-plane cluster.
+Omit both context flags for a single-cluster deployment.
 
 ```yaml title="nvcf-cli-gpu-register.yaml"
 base_http_url: "http://<GATEWAY_ADDR>"
@@ -1310,18 +1312,31 @@ api_keys_owner_id: "svc@nvcf-api.local"
 client_id: "<nca-id>"
 ```
 
+```bash
+nvcf-cli --config <path-to-nvcf-cli-gpu-register.yaml> self-hosted \
+  --control-plane-stack deploy/stacks/self-managed \
+  --env <environment-name> \
+  --control-plane-context <control-plane-context> \
+  --compute-plane-context <gpu-cluster-context> \
+  control-plane profile export \
+  --cluster-name <control-plane-cluster-name> \
+  --region <region>
+
+nvcf-cli --config <path-to-nvcf-cli-gpu-register.yaml> init
+```
+
 Run the compute-plane target from the repository root. The target writes
 `deploy/stacks/nvcf-compute-plane/registration/<gpu-cluster-name>-register-values.yaml`.
 
 ```bash
 make -C deploy/stacks/nvcf-compute-plane register-cluster \
   CLUSTER_NAME=<gpu-cluster-name> \
-  NCA_ID=<nca-id> \
   CLUSTER_REGION=<region> \
-  ICMS_URL="http://<GATEWAY_ADDR>" \
-  KUBECONFIG_FILE=<gpu-cluster-kubeconfig> \
-  NVCF_CLI=<path-to-nvcf-cli> \
-  NVCF_CLI_CONFIG=<path-to-nvcf-cli-gpu-register.yaml>
+  CONTROL_PLANE_PROFILE="$(pwd)/deploy/stacks/self-managed/out/control-plane-profile.yaml" \
+  KUBECONFIG_FILE=<absolute-path-to-gpu-cluster-kubeconfig> \
+  COMPUTE_KUBE_CONTEXT=<gpu-cluster-context> \
+  NVCF_CLI=<absolute-path-to-nvcf-cli> \
+  NVCF_CLI_CONFIG=<absolute-path-to-nvcf-cli-gpu-register.yaml>
 ```
 
 Install the NVCA operator on that GPU cluster. The `install` target copies the
@@ -1333,7 +1348,7 @@ make -C deploy/stacks/nvcf-compute-plane install \
   CLUSTER_NAME=<gpu-cluster-name> \
   HELMFILE_ENV=<environment-name> \
   NCA_ID=<nca-id> \
-  KUBECONFIG_FILE=<gpu-cluster-kubeconfig>
+  KUBECONFIG_FILE=<absolute-path-to-gpu-cluster-kubeconfig>
 ```
 
 Verify the operator and backend on the GPU cluster:

docs/user/local-development/multi-cluster-helmfile.md

@@ -201,15 +201,32 @@ done
 ## Step 9: Register the compute cluster
 
 ```bash
+$(pwd)/nvcf-cli \
+  --config $(pwd)/tests/bdd/fixtures/nvcf-cli-local.yaml \
+  self-hosted \
+  --control-plane-stack deploy/stacks/self-managed \
+  --env local-bdd \
+  --control-plane-context k3d-ncp-local-cp \
+  --compute-plane-context k3d-ncp-local-compute-1 \
+  control-plane profile export \
+  --cluster-name ncp-local-cp
+
+$(pwd)/nvcf-cli \
+  --config $(pwd)/tests/bdd/fixtures/nvcf-cli-local.yaml \
+  init
+
 make -C deploy/stacks/nvcf-compute-plane register-cluster \
   CLUSTER_NAME=ncp-local-compute-1 \
+  CONTROL_PLANE_PROFILE=$(pwd)/deploy/stacks/self-managed/out/control-plane-profile.yaml \
+  COMPUTE_KUBE_CONTEXT=k3d-ncp-local-compute-1 \
   NVCF_CLI=$(pwd)/nvcf-cli \
   NVCF_CLI_CONFIG=$(pwd)/tests/bdd/fixtures/nvcf-cli-local.yaml
 ```
 
 <Note>
-`make register-cluster` runs `nvcf-cli init` internally before
-`cluster register`, so this flow does not need a separate `init` step.
+The profile export uses both contexts to capture compute-reachable endpoints
+and control-plane trust. Run `nvcf-cli init` explicitly. The Make target
+forwards `NVCF_CLI_CONFIG` to registration but does not initialize it.
 </Note>
 
 The target writes the registration handoff file to

docs/user/local-development/single-cluster-helmfile.md

@@ -176,16 +176,30 @@ When this succeeds, the following helm releases are deployed:
 ## Step 7: Register the cluster
 
 ```bash
+$(pwd)/nvcf-cli \
+  --config $(pwd)/tests/bdd/fixtures/nvcf-cli-local.yaml \
+  self-hosted \
+  --control-plane-stack deploy/stacks/self-managed \
+  --env local-bdd \
+  control-plane profile export \
+  --cluster-name ncp-local
+
+$(pwd)/nvcf-cli \
+  --config $(pwd)/tests/bdd/fixtures/nvcf-cli-local.yaml \
+  init
+
 make -C deploy/stacks/nvcf-compute-plane register-cluster \
   CLUSTER_NAME=ncp-local \
+  CONTROL_PLANE_PROFILE=$(pwd)/deploy/stacks/self-managed/out/control-plane-profile.yaml \
+  COMPUTE_KUBE_CONTEXT=k3d-ncp-local \
   NVCF_CLI=$(pwd)/nvcf-cli \
   NVCF_CLI_CONFIG=$(pwd)/tests/bdd/fixtures/nvcf-cli-local.yaml
 ```
 
 <Note>
-`make register-cluster` runs `nvcf-cli init` internally before
-`cluster register`, so the Helmfile flow does not need a separate `init`
-step (unlike the CLI flow).
+The profile export captures the installed control plane's endpoints and trust
+material. Run `nvcf-cli init` explicitly. The Make target forwards
+`NVCF_CLI_CONFIG` to registration but does not initialize it.
 </Note>
 
 The target writes the registration handoff file to