fix(stack): use upstream third-party artifacts

[sbaum1994]

TL;DR

Resolve three observability charts and the cert-manager ACME solver image directly from their public upstream distributions. The pinned versions do not change.

Additional Details

Why

The stack currently routes these off-the-shelf artifacts through nvidia/nvcf, but the pinned chart versions are not present in the public NVCF Helm index and remain listed as publication pending. Each exact version is already published by its upstream project, so requiring an NVIDIA mirror blocks installation without adding stack-specific content.

What changed

• Resolve opentelemetry-operator 0.122.0 from the OpenTelemetry Helm repository.
• Resolve prometheus-operator-crds 31.0.1 from the Prometheus Community Helm repository.
• Resolve victoria-metrics-single 0.45.0 from the VictoriaMetrics Helm repository.
• Let the vendored cert-manager chart use its default quay.io/jetstack/cert-manager-acmesolver:v1.20.2 image.
• Expose an independent chartRepository override for each upstream chart, including HTTPS credentials and OCI repositories.
• Preserve an explicit certManager.acmesolver.image override for private or disconnected mirrors.
• Add regression coverage for the chart aliases, versions, source overrides, upstream ACME solver default, and private-mirror behavior.

The merged direct-upstream docs-sync support records these resolved repositories from the next stack inventories, so a future version sync will show the upstream distributions instead of adding these artifacts to publication pending.

Customer Release Notes

The observability stack now downloads three third-party charts from their upstream Helm repositories by default. The self-managed stack now downloads the cert-manager ACME solver image from quay.io/jetstack by default. Each source can be redirected to a private mirror.

Plan Summary

No Kubernetes resources or dependency versions change. Only artifact source values and their defaults change. Environments with restricted egress can redirect each chart and the ACME solver image to private mirrors.

Usage

No configuration is needed for connected installations. For an OCI mirror, authenticate Helm to the registry and set the per-artifact sources in the environment values:

prometheusOperatorCrds:
  chartRepository:
    url: nvcr.io/YOUR_ORG/YOUR_TEAM
    oci: true

opentelemetryOperator:
  chartRepository:
    url: nvcr.io/YOUR_ORG/YOUR_TEAM
    oci: true

victoriaMetrics:
  chartRepository:
    url: nvcr.io/YOUR_ORG/YOUR_TEAM
    oci: true

certManager:
  acmesolver:
    image:
      repository: nvcr.io/YOUR_ORG/YOUR_TEAM/cert-manager-acmesolver
      tag: v1.20.2

Each chart repository can be configured independently. For an authenticated HTTPS Helm repository, set url, username, and password, and leave oci false.

Testing

• deploy/stacks/self-managed/tests/image-override-wiring.sh
• Full observability all profile render with Helmfile
• Helmfile state render with all three chart sources redirected to an OCI mirror
• helm show chart for all three exact upstream chart versions
• go test ./... in tools/docs-version-sync
• git diff --check

The full observability profile rendered all three upstream charts successfully. The broader profile-defaults.sh test also reached and passed the new chart-source assertions, then encountered its existing macOS Bash 3 empty-array failure in the unrelated mode matrix.

Notes

QA is needed. Verify one connected install can fetch all four upstream artifacts and one mirrored install can redirect all four sources. No architecture diagram update is needed because component interactions and data flow are unchanged.

For the Reviewer

Please focus on the per-component chartRepository handling in 01-observability.yaml.gotmpl and the conditional ACME solver override in global.yaml.gotmpl.

For QA

1. Install the observability all profile and confirm the three chart releases become ready.
2. Install the self-managed stack and confirm the cert-manager controller uses quay.io/jetstack/cert-manager-acmesolver:v1.20.2 for HTTP-01 solver pods.
3. Repeat with each chartRepository and certManager.acmesolver.image.repository set to a test mirror. Confirm the three charts and solver image resolve from that mirror.

Issues

Relates to #1845

References

• https://open-telemetry.github.io/opentelemetry-helm-charts
• https://prometheus-community.github.io/helm-charts
• https://victoriametrics.github.io/helm-charts
• https://quay.io/repository/jetstack/cert-manager-acmesolver

Related Pull Requests

• fix(docs): reconcile published and upstream artifacts #1907

Dependencies

No dependency versions were added or updated. This changes distribution sources for existing Apache-2.0 dependencies. License review remains unchanged, and no NOTICE update is required.

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO) compliance.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

Summary by CodeRabbit

• Deployment Updates

  • Observability components now use configurable public upstream Helm repositories for Prometheus Operator CRDs, OpenTelemetry Operator, and VictoriaMetrics, with support for OCI repositories and credentials.
  • Cert-manager’s ACME solver uses the upstream image by default, while supporting repository, tag, digest, and pull-policy overrides for mirrored or private installations.

• Documentation

  • Added guidance on the default ACME solver image and configuring private image mirrors.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c7c51ef9-a2eb-438a-84ee-d2a383d98959

📥 Commits

Reviewing files that changed from the base of the PR and between b90ca8e and 687de71.

📒 Files selected for processing (4)

• deploy/stacks/observability/environments/base.yaml
• deploy/stacks/observability/helmfile.d/01-observability.yaml.gotmpl
• deploy/stacks/observability/tests/profile-defaults.sh
• deploy/stacks/self-managed/environments/base.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• deploy/stacks/self-managed/environments/base.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

📝 Walkthrough

Walkthrough

The observability releases now use configurable public or mirrored Helm repositories. Cert-manager retains the upstream ACME solver image by default and supports conditional image overrides with expanded rendering tests.

Changes

Observability upstream charts

Layer / File(s)	Summary
Configurable observability chart sources deploy/stacks/observability/environments/base.yaml, deploy/stacks/observability/helmfile.d/01-observability.yaml.gotmpl	Added component-specific repository URLs, OCI settings, optional credentials, and validation. The three releases now use their public chart repository names.
Observability repository source validation deploy/stacks/observability/tests/profile-defaults.sh	Added Helmfile profile builds and checks for default public repositories and mirrored OCI repository settings.

Cert-manager ACME solver image wiring

Layer / File(s)	Summary
ACME solver override rendering deploy/stacks/self-managed/environments/base.yaml, deploy/stacks/self-managed/global.yaml.gotmpl	Documented the upstream ACME solver image. The template emits repository, tag, digest, and pull policy only when overrides are configured.
ACME solver override validation deploy/stacks/self-managed/tests/image-override-wiring.sh	Added coverage for defaults, full and partial overrides, empty values, public catalogs, and mirrored installations.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 687de

The chart-source and ACME solver wiring changes have no identified merge-blocking risk.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files. (3 skipped: 3…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows Conventional Commits syntax with the required scoped fix type. It accurately describes the primary change: using upstream third-party artifacts.

Full details: Docstring Coverage

Explanation

Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files. (3 skipped: 3 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/stack-upstream-off-shelf-artifacts

---

_{Comment @coderabbitai help to get the list of available commands.}

[balajinvda]

🎉 This PR is included in deploy/stacks/self-managed/v0.20.4 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[balajinvda]

🎉 This PR is included in deploy/stacks/observability/v0.2.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀