feat(self-managed): bump chart pins to the HA-enabled releases and icms 0.8.3

[shobham-nv]

TL;DR

Bump the self-managed stack's chart pins to the chart releases cut from #2052, and move the sis chart to icms image 0.8.3, which includes #2175. Without this, the stack's HA values for PodDisruptionBudgets, zone spread and rollout strategy are ignored by the old pinned charts, so services such as sis, notary-service and nvct-api run 2 replicas but get no PDB, no zone spread and the default 25%/25% rollout.

Additional Details

Stack pins (no template or values changes):

Release	From	To
cassandra	0.21.3	0.22.0
api-keys	1.8.0	1.9.0
sis	2.4.0	2.5.0
api	1.27.1	1.28.0
nvct-api	1.6.0	1.7.0
invocation-service	1.6.1	1.7.0
grpc-proxy	1.7.4	1.8.0
ratelimiter	1.2.1	1.3.0
ess-api	1.8.2	1.9.0
notary-service	1.6.0	1.7.0
admin-issuer-proxy	1.5.3	1.6.0
reval	1.4.1	1.5.0
nats-auth-callout-service	1.2.1	1.3.0
llm-api-gateway	1.4.3	1.5.0

• For every chart except llm-api-gateway, the only change between the old and new version is feat(self-managed): self-hosted control-plane high availability #2052.
• llm-api-gateway 1.5.0 also includes fix(llm-api-gateway): stop cutting off LLM responses after 60 seconds #2140 (stop cutting off LLM responses after 60 seconds) and test(llm-api-gateway): rely on stack defaults in BDD #1881 (test-only).
• NATS and OpenBao pins are unchanged: feat(self-managed): self-hosted control-plane high availability #2052 did not change those charts.
• sis chart (deploy/helm/icms/icms-api): icms image 0.7.2 → 0.8.3 in values.yaml (tag) and Chart.yaml (appVersion). 0.8.3 includes fix(icms): create NVCA NATS streams with the HA replica count #2175 (NVCA NATS streams at the HA replica count). It also includes the icms releases in between, notably GPU gating (feat(gpu-gating): Added gpu gating support in ICMS #2032, fix(icms-gpu-gating): Added gpu gating in cluster management API #2078) and the instance lookup backfill task (fix(icms): add instance lookup backfill task #1995).
• Follow-up: merging this releases a new sis chart carrying icms 0.8.3. The stack's sis pin stays at 2.5.0 here because that chart does not exist until this merges; a one-line follow-up moves the pin to it. Until then, QA can set sis.image.tag: "0.8.3".

For the Reviewer

Pin changes in helmfile.d/01-dependencies.yaml.gotmpl and helmfile.d/02-core.yaml.gotmpl, plus the icms image tag in the sis chart. Please confirm icms 0.8.3 (including GPU gating) is fine to ship in the self-managed stack.

For QA

• make -C deploy/stacks/self-managed test passes, including ha-value-wiring.sh and ha-chart-render.sh.
• make -C deploy/helm/icms lint passes, and helm template renders the sis container image as …:0.8.3.
• On an install with highAvailability.mode: preferred, kubectl get pdb -A should now also list sis, notary-service and nvct-api, and each replica-safe Deployment should show maxSurge: 1 / maxUnavailable: 0 and a topology.kubernetes.io/zone spread rule.

Issues

Relates to #2052

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO) compliance.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

Summary by CodeRabbit

• Chores
  • Updated deployment chart versions for core services, including the API, invocation, rate-limiting, and LLM gateway services.
  • Updated the Cassandra chart version used by self-managed deployments.
  • Updated the ICMS API chart and its default SIS image version to 0.8.3.
  • These changes update deployment configuration; no user-facing feature changes are included.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: NVIDIA/nvcf/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 746d323a-0f44-46b1-9bd4-130976f153b2

📥 Commits

Reviewing files that changed from the base of the PR and between 64ef8c6 and 68c16da.

📒 Files selected for processing (2)

• deploy/helm/icms/icms-api/Chart.yaml
• deploy/helm/icms/icms-api/values.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

📝 Walkthrough

Walkthrough

The change updates the Cassandra dependency and chart versions for self-managed core services. It also updates the ICMS API chart appVersion and default SIS image tag to 0.8.3.

Changes

Helm chart version updates

Layer / File(s)	Summary
Self-managed dependency and service chart versions deploy/stacks/self-managed/helmfile.d/01-dependencies.yaml.gotmpl, deploy/stacks/self-managed/helmfile.d/02-core.yaml.gotmpl	The Cassandra release version changed from 0.21.3 to 0.22.0. Chart versions changed for api-keys, sis, api, nvct-api, invocation-service, grpc-proxy, ratelimiter, ess-api, notary-service, admin-issuer-proxy, reval, nats-auth-callout-service, and llm-api-gateway.
ICMS API chart and image versions deploy/helm/icms/icms-api/Chart.yaml, deploy/helm/icms/icms-api/values.yaml	The chart appVersion and default sis.image.tag changed from 0.7.2 to 0.8.3.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 68c16

The self-managed SIS release uses the updated 0.8.3 image default, and the inspected HA wiring is consistent with the intended behavior. No concrete issue remains that blocks merging.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title uses the required Conventional Commits format, includes the required scope for a customer-impacting feat, and accurately describes the chart pin updates and icms 0.8.3 change.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[balajinvda]

🎉 This PR is included in deploy/helm/icms/v2.6.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[balajinvda]

This PR is included in version 1.29.1.

The release is available on GitHub release.