docs: DPU CA configuration options#3685
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (5)
Summary by CodeRabbit
WalkthroughThe documentation adds non-DPF and DPF bootstrap CA source configuration, embedded and mounted artifact behavior, certificate-chain requirements, rotation guidance, and Day 0 verification steps. ChangesBootstrap CA trust
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai full_review, thanks! |
|
🐇 ✅ Action performedFull review finished. |
|
🌿 Preview your docs: https://nvidia-preview-pull-request-3685.docs.buildwithfern.com/infra-controller |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/provisioning/ip-and-network-configuration.md`:
- Line 294: Update the nico-pxe.nico row to distinguish fixed DNS
hostname/record behavior from bootstrap-CA configuration. State that the
hostname remains fixed for consumers, while DPF URL overrides and mounted Secret
or ConfigMap options configure only the bootstrap-CA source or endpoint.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: d62cf9d9-d748-4930-8304-8a88eab35bfb
📒 Files selected for processing (6)
book/src/configuration/configurability.mdcrates/api-core/src/cfg/README.mddocs/bootable_artifacts.mddocs/dpu-management/dpu_configuration.mddocs/manuals/dpf.mddocs/provisioning/ip-and-network-configuration.md
|
@coderabbitai full_review, thanks! |
|
🐇 ✅ Action performedFull review finished. |
|
Caution Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted. Error details |
|
@coderabbitai full_review, thanks! |
|
🐇 ✅ Action performedFull review finished. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/provisioning/ip-and-network-configuration.md`:
- Around line 338-344: Update the DPF provisioning paragraph near the references
to dpf.dpu_agent_bootstrap_ca to include the supported complete URL-override
mode, consistent with the table. Alternatively, link directly to the
authoritative DPF configuration section documenting that mode, while preserving
the existing legacy download and mounted Secret/ConfigMap guidance.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 80eb61f5-0f12-4454-8ebb-09d95ba0cb5b
📒 Files selected for processing (5)
book/src/configuration/configurability.mddocs/bootable_artifacts.mddocs/dpu-management/dpu_configuration.mddocs/manuals/dpf.mddocs/provisioning/ip-and-network-configuration.md
|
@coderabbitai full_review, thanks! |
|
🐇 ✅ Action performedFull review finished. |
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@book/src/configuration/configurability.md`:
- Around line 575-580: Standardize the operator-facing restart target name from
“nico-api” to “carbide-api” in the bootstrap CA notes at
book/src/configuration/configurability.md lines 575-580 and docs/manuals/dpf.md
lines 723-725, preserving the surrounding deployment and rotation guidance.
In `@docs/manuals/dpf.md`:
- Around line 723-729: Update the mounted-CA rotation procedure in the DPF
documentation to require creating a new versioned CA object, changing
[dpf.dpu_agent_bootstrap_ca].name, and restarting nico-api. Instruct operators
to wait for DPF reconciliation and init-container re-execution, verify the new
bundle is installed, then remove the old root and object only after successful
validation.
In `@docs/provisioning/ip-and-network-configuration.md`:
- Around line 422-423: Update the embedded trust-boundary checklist near “For
non-DPF embedded” to explicitly require Secure Boot or an equivalent trusted,
integrity-verified boot chain before enabling embedded CA trust, while
preserving the existing requirement for site-specific artifacts built with
BOOTSTRAP_CA_PATH.
- Around line 360-364: Update the intermediate-rotation guidance in the TLS
server authentication section to qualify that clients avoid bundle replacement
only when every replacement intermediate chains to the pinned root; state that
operators must update the pinned bundle when that condition is not met.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 02e1af8e-9d88-4c47-9cde-058577897f4d
📒 Files selected for processing (5)
book/src/configuration/configurability.mddocs/bootable_artifacts.mddocs/dpu-management/dpu_configuration.mddocs/manuals/dpf.mddocs/provisioning/ip-and-network-configuration.md
|
@coderabbitai full_review, thanks! |
|
🐇 ✅ Action performedFull review finished. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/provisioning/ip-and-network-configuration.md`:
- Around line 427-428: Expand the DPF mounted verification checklist to inspect
every DPU agent pod, confirming the projected bundle exists at
/opt/forge/forge_root.pem and that the pod successfully completes the NICo API
TLS handshake. Retain the existing Secret/ConfigMap and key checks, and state
the verification must cover every target DPU cluster.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 3216a926-1d95-4ad8-ba5d-9475af1b1782
📒 Files selected for processing (5)
book/src/configuration/configurability.mddocs/bootable_artifacts.mddocs/dpu-management/dpu_configuration.mddocs/manuals/dpf.mddocs/provisioning/ip-and-network-configuration.md
🚧 Files skipped from review as they are similar to previous changes (3)
- book/src/configuration/configurability.md
- docs/dpu-management/dpu_configuration.md
- docs/manuals/dpf.md
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/bootable_artifacts.md`:
- Around line 45-47: Require verification that every DPU installed the overlap
bundle and successfully authenticated to NICo before retiring the old root.
Apply this gate in docs/bootable_artifacts.md lines 45-47 and
book/src/configuration/configurability.md lines 571-573 after reprovisioning and
before building the bundle without the old root; in
docs/dpu-management/dpu_configuration.md lines 76-81, define “migrate the fleet”
as verified bundle installation and successful API authentication across all
DPUs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: d0b4dd05-1bc9-4e57-9be4-e6aa7de0eb89
📒 Files selected for processing (5)
book/src/configuration/configurability.mddocs/bootable_artifacts.mddocs/dpu-management/dpu_configuration.mddocs/manuals/dpf.mddocs/provisioning/ip-and-network-configuration.md
Operators can choose how DPUs receive the CA bundle used to authenticate NICo. This collects every supported deployment path and the safe migration steps in one place. Primary callouts are: - Documents the backward-compatible legacy download, site-specific embedded BFB, and operator-mounted bundle modes. - Shows Helm, environment-variable, site configuration, and DPF examples. - Explains staged rollout, root rotation, certificate-chain verification, and the remaining boot-chain trust boundary. This supports NVIDIA#3571 Signed-off-by: Chet Nichols III <chetn@nvidia.com>
|
@coderabbitai full_review, thanks! |
|
🐇 ✅ ✅ Action performedFull review finished. |
1 participant
Operators need one end-to-end reference for choosing how DPUs receive the CA
bundle used to authenticate NICo. This moves the operator guidance out of #3588
so the code can merge independently while technical writer review continues.
This documents the backward-compatible legacy path, non-DPF embedded and
mounted modes, DPF legacy and mounted modes, deployment examples, staged
rollout, root rotation, certificate-chain verification, and the remaining boot
chain trust boundary.
Merge order: #3588 first, this documentation PR second. The pages describe the
product surface introduced by #3588.
Related issues
Type of Change
Breaking Changes
Documentation only. It does not change configuration defaults or runtime
behavior.
Testing
Unit tests added/updated
Integration tests added/updated
Manual testing performed
No testing required (docs, internal refactor, etc.)
git diff --checkRelative link targets and generated heading anchors verified
Every documented key, enum value, path, Helm value, and default cross-checked
against feat: make DPU bootstrap CA configurable #3588
Changed lines reviewed against the NVIDIA documentation style guide
Additional Notes
The split includes the five operator-facing Markdown files from #3588.
Embedded comments, CLI help, Helm values comments, validation messages, and the
CI-enforced configuration reference remain with the code because they are
implementation contracts.
docs/observability/core_metrics.mdis intentionally untouched.