feat(self-managed): provision the OpenBao ClusterIssuer for LLM TLS

[mikeyrcamp]

Problem

The self-managed stack can enable PKI for the LLM request router and render a
cert-manager Certificate that references the nvcf-openbao-pki
ClusterIssuer. The stack also installs cert-manager by default and provisions
the corresponding OpenBao signing role, but it does not currently create that
ClusterIssuer.

As a result, the Helm render can succeed while the request-router certificate
remains unissued at runtime because its referenced issuer does not exist.

Expected behavior

When self-managed LLM PKI is enabled, the stack should:

• consume a versioned helm-nvcf-pki chart maintained under deploy/helm;
• create the nvcf-openbao-pki ClusterIssuer;
• configure it for the current OpenBao service-issuing PKI role;
• authenticate using the cert-manager ServiceAccount identity;
• depend on OpenBao and, when the stack manages cert-manager, on that release;
• continue to support an externally managed cert-manager installation;
• preserve the existing PKI-disabled behavior;
• fail rendering when required issuer configuration is missing; and
• include render tests for enabled, disabled, external-controller, and invalid
  configurations.

Security considerations

• Do not embed credentials, tokens, environment-specific endpoints, or private
  deployment values in the chart.
• Keep the issuer name distinct from other certificate authorities.
• Keep the OpenBao signing path and authentication role least-privileged.
• Ensure test output and committed fixtures contain no secrets.

Coordination

PR #483 adds a separate compute-plane webhook PKI. The self-managed LLM issuer
should use distinct resource names and avoid creating conflicting ownership of
shared cert-manager resources.

Acceptance criteria

• A rendered PKI-enabled self-managed stack contains exactly one
  ClusterIssuer named nvcf-openbao-pki.
• Its signing path matches the current OpenBao service-issuing role used by the
  LLM PKI migration.
• The issuer release depends on OpenBao and additionally depends on cert-manager
  when the stack owns the cert-manager release.
• The external cert-manager mode renders without depending on a disabled Helm
  release.
• The request-router Certificate references the same issuer name.
• The default PKI-disabled path does not render the issuer.
• The chart is published before a self-managed stack version that pins it is
  promoted.
• No sensitive values are introduced into public files, fixtures, logs, or
  generated artifacts.

[balajinvda]

🎉 This issue has been resolved in version nvcf-cli-v1.15.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀