ccluster-py 0.0.7__tar.gz → 0.0.9.dev129__tar.gz

{ccluster_py-0.0.7 → ccluster_py-0.0.9.dev129}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ccluster-py
-Version: 0.0.7
+Version: 0.0.9.dev129
 Summary: Pydantic models and a client for the ccluster.nvidia.com API and its Helm chart catalog
 License-Expression: Apache-2.0
 License-File: LICENSE
@@ -80,7 +80,9 @@ Every method takes the object's name by keyword.
 
 `apply_infraplane` applies a Secret named `<name>-credentials` in Argo CD's
 cluster-secret shape (`server`, and a `config` carrying the bearer token and the CA) and a
-`CCLInfraPlane` pointing at it;
+`CCLInfraPlane` pointing at it, with the cluster's `domain`. The operator writes that
+domain to the infra-plane cluster's `CCLClusterConfig`, and it cannot be changed once the
+CCLInfraPlane exists;
 `delete_infraplane` deletes the Secret and the CCLInfraPlane, the CCLInfraPlane first so
 the operator's finalizer removes the mirrored Argo CD Secret, and leaves the namespace.
 `ensure_namespace` creates the namespace, and is the only method that does: keeping it
@@ -102,6 +104,7 @@ client = CCLClient("tenant-a", api_client=api_client)
 client.ensure_namespace()
 plane = client.apply_infraplane(
     name="edge-1",
+    domain="edge-1.example.com",
     server="https://10.0.0.1:6443",
     bearer_token=open("token").read(),
     ca_cert=open("ca.crt").read(),
@@ -114,7 +117,7 @@ client.delete_infraplane(name="edge-1")
 Argo CD's special-cased in-cluster address, no ServiceAccount or token needed:
 
 ```python
-plane = client.apply_infraplane(name="ccluster-local")
+plane = client.apply_infraplane(name="ccluster-local", domain="local.example.com")
 ```
 
 From a workstation, pass an `ApiClient` built from your kubeconfig:
@@ -149,7 +152,7 @@ from ccluster.client import CCLClient, component_set_current_conditions
 
 client = CCLClient("tenant-a", api_client=api_client)   # api_client as above
 client.ensure_namespace()
-client.apply_infraplane(name="ccluster-local")
+client.apply_infraplane(name="ccluster-local", domain="local.example.com")
 cs = client.apply_component_set(
     name="local-base",
     components=[
@@ -171,8 +174,8 @@ raises `NotFoundError` for a missing set.
 
 `component_set_current_conditions` says why a set is not finished yet. It keys its
 conditions by type and drops the ones the operator computed from an older generation, so
-what is left is its verdict on the spec as it now stands — after a failed validation the
-other types still carry the previous generation's. `get_component_set` and
+what is left is its verdict on the spec as it now stands — after a failed validation
+`ComponentsApplied` still carries the previous generation's. `get_component_set` and
 `get_infraplane` read one object and return it as its model, or raise `NotFoundError`.
 
 ```python
@@ -185,7 +188,7 @@ if not client.is_component_set_finished(name="local-base"):
 ```
 
 A type is absent when the operator did not get far enough to write it: a set whose
-validation failed has no `Progressing` condition for this generation.
+validation failed has no `ComponentsApplied` condition for this generation.
 
 `Progressing=False` means every Application matches the operator's current desired spec,
 Argo CD's latest comparison was of that spec and reports `Healthy` and `Synced`, and no
@@ -193,7 +196,9 @@ operation for it is pending, running or failed.
 While rollout continues, the reason is `WaveSyncing`, or `WaveSyncFailed` when the last
 sync of a component's current spec failed. The operator does not retry a failed sync; a
 later successful sync of that Application in Argo CD clears `WaveSyncFailed` and resumes
-the rollout.
+the rollout. When validation failed and the component being waited on needs the operator
+to write its Application, the reason is the `Validated` condition's, such as
+`InfraPlaneNotFound`: the operator writes nothing until validation passes.
 Updates to already released components are not serialized by wave.
 
 `delete_component_set` returns as soon as the delete is accepted. The operator's finalizer
@@ -223,7 +228,7 @@ ccluster init -cp kind-ccluster-cp
 context, with that control plane:
 
 ```bash
-ccluster register edge-1 -n tenant-a -ip kind-ccluster-ip \
+ccluster register edge-1 -n tenant-a -ip kind-ccluster-ip --domain edge-1.example.com \
     --server https://ccluster-ip-control-plane:6443
 ```
 
@@ -231,8 +236,9 @@ On the infra plane it creates the ServiceAccount `kube-system/ccluster-manager`,
 to `cluster-admin` (Argo CD installs CRDs and other cluster-scoped objects there, so it needs
 the same rights `argocd cluster add` grants), and reads the long-lived token the token
 controller writes into the Secret `kube-system/ccluster-manager-token`. On the control plane
-it creates the namespace if needed and calls `apply_infraplane` with that token and the
-cluster CA. Anyone who can read `<name>-credentials` there is cluster-admin on the infra
+it creates the namespace if needed and calls `apply_infraplane` with that token, the
+cluster CA and `--domain`. The control-plane operator uses the same token to write the
+domain to the infra plane's `CCLClusterConfig`. Anyone who can read `<name>-credentials` there is cluster-admin on the infra
 plane, so keep read access to that namespace's Secrets tight. Running it again reuses the
 same token.
 

{ccluster_py-0.0.7 → ccluster_py-0.0.9.dev129}/README.md

@@ -58,7 +58,9 @@ Every method takes the object's name by keyword.
 
 `apply_infraplane` applies a Secret named `<name>-credentials` in Argo CD's
 cluster-secret shape (`server`, and a `config` carrying the bearer token and the CA) and a
-`CCLInfraPlane` pointing at it;
+`CCLInfraPlane` pointing at it, with the cluster's `domain`. The operator writes that
+domain to the infra-plane cluster's `CCLClusterConfig`, and it cannot be changed once the
+CCLInfraPlane exists;
 `delete_infraplane` deletes the Secret and the CCLInfraPlane, the CCLInfraPlane first so
 the operator's finalizer removes the mirrored Argo CD Secret, and leaves the namespace.
 `ensure_namespace` creates the namespace, and is the only method that does: keeping it
@@ -80,6 +82,7 @@ client = CCLClient("tenant-a", api_client=api_client)
 client.ensure_namespace()
 plane = client.apply_infraplane(
     name="edge-1",
+    domain="edge-1.example.com",
     server="https://10.0.0.1:6443",
     bearer_token=open("token").read(),
     ca_cert=open("ca.crt").read(),
@@ -92,7 +95,7 @@ client.delete_infraplane(name="edge-1")
 Argo CD's special-cased in-cluster address, no ServiceAccount or token needed:
 
 ```python
-plane = client.apply_infraplane(name="ccluster-local")
+plane = client.apply_infraplane(name="ccluster-local", domain="local.example.com")
 ```
 
 From a workstation, pass an `ApiClient` built from your kubeconfig:
@@ -127,7 +130,7 @@ from ccluster.client import CCLClient, component_set_current_conditions
 
 client = CCLClient("tenant-a", api_client=api_client)   # api_client as above
 client.ensure_namespace()
-client.apply_infraplane(name="ccluster-local")
+client.apply_infraplane(name="ccluster-local", domain="local.example.com")
 cs = client.apply_component_set(
     name="local-base",
     components=[
@@ -149,8 +152,8 @@ raises `NotFoundError` for a missing set.
 
 `component_set_current_conditions` says why a set is not finished yet. It keys its
 conditions by type and drops the ones the operator computed from an older generation, so
-what is left is its verdict on the spec as it now stands — after a failed validation the
-other types still carry the previous generation's. `get_component_set` and
+what is left is its verdict on the spec as it now stands — after a failed validation
+`ComponentsApplied` still carries the previous generation's. `get_component_set` and
 `get_infraplane` read one object and return it as its model, or raise `NotFoundError`.
 
 ```python
@@ -163,7 +166,7 @@ if not client.is_component_set_finished(name="local-base"):
 ```
 
 A type is absent when the operator did not get far enough to write it: a set whose
-validation failed has no `Progressing` condition for this generation.
+validation failed has no `ComponentsApplied` condition for this generation.
 
 `Progressing=False` means every Application matches the operator's current desired spec,
 Argo CD's latest comparison was of that spec and reports `Healthy` and `Synced`, and no
@@ -171,7 +174,9 @@ operation for it is pending, running or failed.
 While rollout continues, the reason is `WaveSyncing`, or `WaveSyncFailed` when the last
 sync of a component's current spec failed. The operator does not retry a failed sync; a
 later successful sync of that Application in Argo CD clears `WaveSyncFailed` and resumes
-the rollout.
+the rollout. When validation failed and the component being waited on needs the operator
+to write its Application, the reason is the `Validated` condition's, such as
+`InfraPlaneNotFound`: the operator writes nothing until validation passes.
 Updates to already released components are not serialized by wave.
 
 `delete_component_set` returns as soon as the delete is accepted. The operator's finalizer
@@ -201,7 +206,7 @@ ccluster init -cp kind-ccluster-cp
 context, with that control plane:
 
 ```bash
-ccluster register edge-1 -n tenant-a -ip kind-ccluster-ip \
+ccluster register edge-1 -n tenant-a -ip kind-ccluster-ip --domain edge-1.example.com \
     --server https://ccluster-ip-control-plane:6443
 ```
 
@@ -209,8 +214,9 @@ On the infra plane it creates the ServiceAccount `kube-system/ccluster-manager`,
 to `cluster-admin` (Argo CD installs CRDs and other cluster-scoped objects there, so it needs
 the same rights `argocd cluster add` grants), and reads the long-lived token the token
 controller writes into the Secret `kube-system/ccluster-manager-token`. On the control plane
-it creates the namespace if needed and calls `apply_infraplane` with that token and the
-cluster CA. Anyone who can read `<name>-credentials` there is cluster-admin on the infra
+it creates the namespace if needed and calls `apply_infraplane` with that token, the
+cluster CA and `--domain`. The control-plane operator uses the same token to write the
+domain to the infra plane's `CCLClusterConfig`. Anyone who can read `<name>-credentials` there is cluster-admin on the infra
 plane, so keep read access to that namespace's Secrets tight. Running it again reuses the
 same token.
 

{ccluster_py-0.0.7 → ccluster_py-0.0.9.dev129}/pyproject.toml

@@ -1,10 +1,10 @@
 [build-system]
-requires = ["uv_build>=0.11,<0.12"]
+requires = ["uv_build>=0.11,<0.14"]
 build-backend = "uv_build"
 
 [project]
 name = "ccluster-py"
-version = "0.0.7"
+version = "0.0.9.dev129"
 description = "Pydantic models and a client for the ccluster.nvidia.com API and its Helm chart catalog"
 readme = "README.md"
 license = "Apache-2.0"

{ccluster_py-0.0.7 → ccluster_py-0.0.9.dev129}/pyproject.toml.orig

@@ -1,7 +1,7 @@
 # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 [build-system]
-requires = ["uv_build>=0.11,<0.12"]
+requires = ["uv_build>=0.11,<0.14"]
 build-backend = "uv_build"
 
 [project]
@@ -9,7 +9,7 @@ build-backend = "uv_build"
 # `ccluster` (src/ccluster).
 name = "ccluster-py"
 # Placeholder: the release version is the git tag, stamped in by `make python-build`.
-version = "0.0.7"
+version = "0.0.9.dev129"
 description = "Pydantic models and a client for the ccluster.nvidia.com API and its Helm chart catalog"
 readme = "README.md"
 license = "Apache-2.0"

{ccluster_py-0.0.7 → ccluster_py-0.0.9.dev129}/src/ccluster/catalogs/cluster_base/ingress_nginx/__init__.py

@@ -67,11 +67,6 @@ class Controller(BaseModel):
         extra="forbid",
         populate_by_name=True,
     )
-    service: Toggle | None = None
-    """
-    Service is shipped disabled; the gateway in front of the cluster is
-    expected to be provisioned out of band.
-    """
     metrics: Metrics | None = None
     """
     Metrics requires the kube-prometheus-stack CRDs. Disable it on a

{ccluster_py-0.0.7 → ccluster_py-0.0.9.dev129}/src/ccluster/catalogs/deployments/compute_deployment/__init__.py

@@ -64,6 +64,26 @@ class Resources(BaseModel):
     """
 
 
+class SecretKeyRef(BaseModel):
+    """
+    SecretKeyRef selects one key of a Secret in the release namespace. Both fields are
+    required.
+    """
+
+    model_config = ConfigDict(
+        extra="forbid",
+        populate_by_name=True,
+    )
+    secret_name: Annotated[str, Field(alias="secretName")]
+    """
+    SecretName is the Secret's name.
+    """
+    key: str
+    """
+    Key is the key in the Secret's data.
+    """
+
+
 class VolumeMount(BaseModel):
     """
     VolumeMount mounts an existing PersistentVolumeClaim into the container. The chart
@@ -134,6 +154,15 @@ class Values(BaseModel):
     registry and adds it to the pod's imagePullSecrets, next to the namespace's
     ecr-image-pull secret.
     """
+    image_pull_secret_names: Annotated[
+        list[str] | None, Field(alias="imagePullSecretNames")
+    ] = None
+    """
+    ImagePullSecretNames are Secrets in the release namespace, added to the pod's
+    imagePullSecrets after the chart's own; a name already listed is skipped. The
+    chart never creates or reads them. The kubelet reads them on each pull, so a
+    Secret refreshed in place needs no pod restart.
+    """
     resources: ResourceRequirements
     """
     Resources are the container's limits and requests. Required.
@@ -149,6 +178,16 @@ class Values(BaseModel):
     """
     EnvVars are set in the container, after the chart's own variables.
     """
+    secret_env_vars: Annotated[
+        dict[str, SecretKeyRef] | None, Field(alias="secretEnvVars")
+    ] = None
+    """
+    SecretEnvVars set variables in the container from keys of Secrets in the release
+    namespace, after EnvVars. The chart never creates or reads the Secrets. The
+    container does not start until each Secret has its key, and keeps the values it
+    started with. A variable may not also be in EnvVars, or be one the chart sets
+    itself.
+    """
     dev_shm_size: Annotated[str | None, Field(alias="devShmSize")] = None
     """
     DevShmSize is the size of the /dev/shm tmpfs, as a Kubernetes quantity. The

{ccluster_py-0.0.7 → ccluster_py-0.0.9.dev129}/src/ccluster/catalogs/deployments/dynamo_deployment/__init__.py

@@ -197,6 +197,26 @@ class RolloutStrategy(BaseModel):
     """
 
 
+class SecretKeyRef(BaseModel):
+    """
+    SecretKeyRef selects one key of a Secret in the release namespace. Both fields are
+    required.
+    """
+
+    model_config = ConfigDict(
+        extra="forbid",
+        populate_by_name=True,
+    )
+    secret_name: Annotated[str, Field(alias="secretName")]
+    """
+    SecretName is the Secret's name.
+    """
+    key: str
+    """
+    Key is the key in the Secret's data.
+    """
+
+
 class VolumeMount(BaseModel):
     """
     VolumeMount mounts an existing PersistentVolumeClaim into the container. The chart
@@ -331,6 +351,15 @@ class Values(BaseModel):
     ImagePullSecret, when set, creates a dockerconfigjson Secret for ImageURL's
     registry and adds it to every pod's imagePullSecrets.
     """
+    image_pull_secret_names: Annotated[
+        list[str] | None, Field(alias="imagePullSecretNames")
+    ] = None
+    """
+    ImagePullSecretNames are Secrets in the release namespace, added to every pod's
+    imagePullSecrets after the chart's own; a name already listed is skipped. The
+    chart never creates or reads them. The kubelet reads them on each pull, so a
+    Secret refreshed in place needs no pod restart.
+    """
     domain: str
     """
     Domain is the DNS zone the deployment's hostname is created in. The Ingress
@@ -372,7 +401,7 @@ class Values(BaseModel):
     hf_token: Annotated[str | None, Field(alias="hfToken")] = None
     """
     HFToken is stored in a Secret and exposed to the Frontend and workers as
-    HF_TOKEN; gated models need it.
+    HF_TOKEN; gated models need it. SecretEnvVars may not also set HF_TOKEN.
     """
     env_vars: Annotated[dict[str, str] | None, Field(alias="envVars")] = None
     """
@@ -381,6 +410,17 @@ class Values(BaseModel):
     dropped. DYN_ROUTER_MODE is the one exception: it overrides the Frontend's
     default of kv.
     """
+    secret_env_vars: Annotated[
+        dict[str, SecretKeyRef] | None, Field(alias="secretEnvVars")
+    ] = None
+    """
+    SecretEnvVars set variables in the Frontend and every worker from keys of Secrets
+    in the release namespace, after EnvVars. The chart never creates or reads the
+    Secrets. A container does not start until each Secret has its key, and keeps the
+    values it started with. A variable may not also be in EnvVars, or be one the
+    chart sets itself. DYN_ROUTER_MODE overrides the Frontend's default of kv, as in
+    EnvVars.
+    """
     extra_argv: Annotated[list[str] | None, Field(alias="extraArgv")] = None
     """
     ExtraArgv are literal arguments appended to python3 -m dynamo.vllm on every

{ccluster_py-0.0.7 → ccluster_py-0.0.9.dev129}/src/ccluster/catalogs/deployments/inference_deployment/__init__.py

@@ -175,6 +175,26 @@ class RolloutStrategy(BaseModel):
     """
 
 
+class SecretKeyRef(BaseModel):
+    """
+    SecretKeyRef selects one key of a Secret in the release namespace. Both fields are
+    required.
+    """
+
+    model_config = ConfigDict(
+        extra="forbid",
+        populate_by_name=True,
+    )
+    secret_name: Annotated[str, Field(alias="secretName")]
+    """
+    SecretName is the Secret's name.
+    """
+    key: str
+    """
+    Key is the key in the Secret's data.
+    """
+
+
 class VolumeMount(BaseModel):
     """
     VolumeMount mounts an existing PersistentVolumeClaim into the container. The chart
@@ -245,6 +265,15 @@ class Values(BaseModel):
     registry and adds it to the pod's imagePullSecrets, next to the namespace's
     ecr-image-pull secret.
     """
+    image_pull_secret_names: Annotated[
+        list[str] | None, Field(alias="imagePullSecretNames")
+    ] = None
+    """
+    ImagePullSecretNames are Secrets in the release namespace, added to the pod's
+    imagePullSecrets after the chart's own; a name already listed is skipped. The
+    chart never creates or reads them. The kubelet reads them on each pull, so a
+    Secret refreshed in place needs no pod restart.
+    """
     resources: ResourceRequirements
     """
     Resources are the container's limits and requests. Required.
@@ -260,6 +289,16 @@ class Values(BaseModel):
     """
     EnvVars are set in the container, after the chart's own variables.
     """
+    secret_env_vars: Annotated[
+        dict[str, SecretKeyRef] | None, Field(alias="secretEnvVars")
+    ] = None
+    """
+    SecretEnvVars set variables in the container from keys of Secrets in the release
+    namespace, after EnvVars. The chart never creates or reads the Secrets. The
+    container does not start until each Secret has its key, and keeps the values it
+    started with. A variable may not also be in EnvVars, or be one the chart sets
+    itself.
+    """
     dev_shm_size: Annotated[str | None, Field(alias="devShmSize")] = None
     """
     DevShmSize is the size of the /dev/shm tmpfs, as a Kubernetes quantity. The
@@ -354,7 +393,7 @@ class Values(BaseModel):
     hf_token: Annotated[str | None, Field(alias="hfToken")] = None
     """
     HFToken is rendered as the HF_TOKEN environment variable, after EnvVars, so it
-    wins over a token set there.
+    wins over a token set there. SecretEnvVars may not also set HF_TOKEN.
     """
     enable_node_model_cache: Annotated[
         bool | None, Field(alias="enableNodeModelCache")

{ccluster_py-0.0.7 → ccluster_py-0.0.9.dev129}/src/ccluster/catalogs/deployments/job_deployment/__init__.py

@@ -90,6 +90,26 @@ class Resources(BaseModel):
     """
 
 
+class SecretKeyRef(BaseModel):
+    """
+    SecretKeyRef selects one key of a Secret in the release namespace. Both fields are
+    required.
+    """
+
+    model_config = ConfigDict(
+        extra="forbid",
+        populate_by_name=True,
+    )
+    secret_name: Annotated[str, Field(alias="secretName")]
+    """
+    SecretName is the Secret's name.
+    """
+    key: str
+    """
+    Key is the key in the Secret's data.
+    """
+
+
 class VolumeMount(BaseModel):
     """
     VolumeMount mounts an existing PersistentVolumeClaim into the container. The chart
@@ -160,6 +180,15 @@ class Values(BaseModel):
     registry and adds it to the pod's imagePullSecrets, next to the namespace's
     ecr-image-pull secret.
     """
+    image_pull_secret_names: Annotated[
+        list[str] | None, Field(alias="imagePullSecretNames")
+    ] = None
+    """
+    ImagePullSecretNames are Secrets in the release namespace, added to the pod's
+    imagePullSecrets after the chart's own; a name already listed is skipped. The
+    chart never creates or reads them. The kubelet reads them on each pull, so a
+    Secret refreshed in place needs no pod restart.
+    """
     resources: ResourceRequirements
     """
     Resources are the container's limits and requests. Required.
@@ -175,6 +204,16 @@ class Values(BaseModel):
     """
     EnvVars are set in the container, after the chart's own variables.
     """
+    secret_env_vars: Annotated[
+        dict[str, SecretKeyRef] | None, Field(alias="secretEnvVars")
+    ] = None
+    """
+    SecretEnvVars set variables in the container from keys of Secrets in the release
+    namespace, after EnvVars. The chart never creates or reads the Secrets. The
+    container does not start until each Secret has its key, and keeps the values it
+    started with. A variable may not also be in EnvVars, or be one the chart sets
+    itself.
+    """
     dev_shm_size: Annotated[str | None, Field(alias="devShmSize")] = None
     """
     DevShmSize is the size of the /dev/shm tmpfs, as a Kubernetes quantity. The

{ccluster_py-0.0.7 → ccluster_py-0.0.9.dev129}/src/ccluster/cli.py

@@ -111,6 +111,12 @@ def init(control_plane: str) -> None:
     required=True,
     help="Kubeconfig context of the infra-plane cluster to register.",
 )
+@click.option(
+    "--domain",
+    required=True,
+    help="The infra-plane cluster's DNS domain, written to its CCLClusterConfig. "
+    "Cannot be changed once registered.",
+)
 @click.option(
     "--server",
     default=None,
@@ -121,6 +127,7 @@ def register(
     name: str,
     namespace: str,
     infra_plane: str,
+    domain: str,
     server: str | None,
 ) -> None:
     """Register a cluster with the control plane.
@@ -128,8 +135,9 @@ def register(
     The control plane is the one saved by ccluster init. On the infra plane, creates the
     ServiceAccount kube-system/ccluster-manager, binds it to cluster-admin, and reads its
     long-lived token. On the control plane, applies the Secret NAME-credentials carrying
-    that token and the cluster CA, and the CCLInfraPlane NAME pointing at it. Re-running
-    reuses the same token.
+    that token and the cluster CA, and the CCLInfraPlane NAME pointing at it with the given
+    domain. The control-plane operator then writes the domain to the infra plane's
+    CCLClusterConfig. Re-running reuses the same token.
 
     Pass --server when the kubeconfig's address is not reachable from the control plane,
     for example a kind cluster, whose kubeconfig points at 127.0.0.1.
@@ -145,7 +153,7 @@ def register(
         client = CCLClient(namespace, api_client=control_api)
         client.ensure_namespace()
         plane = client.apply_infraplane(
-            name=name, server=server, bearer_token=token, ca_cert=ca_cert
+            name=name, domain=domain, server=server, bearer_token=token, ca_cert=ca_cert
         )
     click.echo(
         f"Registered CCLInfraPlane {plane.metadata.namespace}/{plane.metadata.name} "

{ccluster_py-0.0.7 → ccluster_py-0.0.9.dev129}/src/ccluster/client.py

@@ -180,16 +180,24 @@ class CCLClient:
         self,
         *,
         name: str,
+        domain: str,
         server: str | None = None,
         bearer_token: str | None = None,
         ca_cert: str | bytes | None = None,
     ) -> CCLInfraPlane:
         """Create or update the CCLInfraPlane called name, for the cluster at server.
 
-        Server-side applies a Secret named "<name>-credentials" in Argo CD's
-        cluster-secret shape, then a CCLInfraPlane pointing at it. ca_cert is the API
-        server's CA certificate in PEM. The call returns as soon as both objects are
-        applied; it does not wait for the operator to report Available.
+        domain is the cluster's DNS domain. The operator writes it to the cluster's
+        CCLClusterConfig, and it cannot be changed once the CCLInfraPlane exists.
+
+        Server-side applies the CCLInfraPlane, then the Secret named "<name>-credentials"
+        it points at, in Argo CD's cluster-secret shape. The plane goes first so that a
+        domain the API server rejects - malformed, or changed on an existing plane - fails
+        the call before the credentials are written: the operator acts on a changed
+        Secret at once, so new credentials under the old domain would retarget the
+        existing plane. ca_cert is the API server's CA certificate in PEM. The call
+        returns as soon as both objects are applied; it does not wait for the operator to
+        report Available.
 
         server, bearer_token and ca_cert are all optional. With none given, this
         registers the cluster the operator itself runs in: server defaults to Argo CD's
@@ -204,6 +212,13 @@ class CCLClient:
             ca_cert = ca_cert.encode()
         secret_name = _credentials_secret_name(name)
 
+        plane = CCLInfraPlane(
+            metadata=ObjectMeta(name=name, namespace=self.namespace),
+            spec=CCLInfraPlaneSpec(
+                cluster_credentials_ref=LocalObjectReference(name=secret_name),
+                domain=domain,
+            ),
+        )
         cluster_config = ClusterConfig(
             bearer_token=bearer_token,
             tls_client_config=TLSClientConfig(
@@ -222,15 +237,11 @@ class CCLClient:
                 ),
             },
         )
-        self._apply(self._discovery.secret_gvr, secret)
-
-        plane = CCLInfraPlane(
-            metadata=ObjectMeta(name=name, namespace=self.namespace),
-            spec=CCLInfraPlaneSpec(cluster_credentials_ref=LocalObjectReference(name=secret_name)),
-        )
-        return CCLInfraPlane.model_validate(
+        applied = CCLInfraPlane.model_validate(
             self._apply_object(self._discovery.infra_plane_gvr, plane)
         )
+        self._apply(self._discovery.secret_gvr, secret)
+        return applied
 
     def delete_infraplane(self, *, name: str) -> None:
         """Remove the CCLInfraPlane called name and its credentials Secret.

{ccluster_py-0.0.7 → ccluster_py-0.0.9.dev129}/src/ccluster/v1alpha1/cclclusterconfig.py

@@ -102,6 +102,32 @@ class Condition(BaseModel):
     """
 
 
+class LoadBalancer(BaseModel):
+    """
+    LoadBalancerStatus is the address of a LoadBalancer Service labelled
+    ccluster.nvidia.com/loadbalancer. ip and hostname are both empty until the cloud
+    provider assigns one.
+    """
+
+    model_config = ConfigDict(
+        populate_by_name=True,
+    )
+    hostname: str | None = None
+    """
+    hostname is the LoadBalancer's DNS name, set by cloud providers whose load
+    balancers are addressed by name rather than by IP: the first hostname the Service
+    reports.
+    """
+    ip: str | None = None
+    """
+    ip is the LoadBalancer's IP address: the first IP the Service reports.
+    """
+    name: Annotated[str, Field(max_length=63, min_length=1)]
+    """
+    name is the Service's ccluster.nvidia.com/loadbalancer label value.
+    """
+
+
 class CCLClusterConfigStatus(BaseModel):
     """
     status defines the observed state of CCLClusterConfig
@@ -112,7 +138,8 @@ class CCLClusterConfigStatus(BaseModel):
     )
     conditions: list[Condition] | None = None
     """
-    conditions represent the current state of the CCLClusterConfig resource.
+    conditions represent the current state of the infra-plane cluster's
+    CCLClusterConfig.
 
     Condition types reported by the infra-plane operator:
       - "Verified": every catalogs/cluster_base component is installed in this
@@ -121,7 +148,17 @@ class CCLClusterConfigStatus(BaseModel):
 
     The status of each condition is one of True, False, or Unknown.
     """
+    load_balancers: Annotated[
+        list[LoadBalancer] | None, Field(alias="loadBalancers")
+    ] = None
+    """
+    loadBalancers are the cluster's LoadBalancer Services labelled
+    ccluster.nvidia.com/loadbalancer, one per label value, as the infra-plane operator
+    last observed them. A value carried by more than one Service is left out and
+    reported in the Verified condition.
+    """
     observed_generation: Annotated[int | None, Field(alias="observedGeneration")] = None
     """
-    observedGeneration is the .metadata.generation the conditions were computed from.
+    observedGeneration is the CCLClusterConfig's .metadata.generation the conditions
+    were computed from.
     """

{ccluster_py-0.0.7 → ccluster_py-0.0.9.dev129}/src/ccluster/v1alpha1/cclcomponentset.py

@@ -211,7 +211,7 @@ class CCLComponentSetStatus(BaseModel):
     ] = None
     """
     componentSyncs reports the latest observed Application state for each released
-    component.
+    component, judged against the spec at status.observedGeneration.
     """
     conditions: list[Condition] | None = None
     """
@@ -229,5 +229,8 @@ class CCLComponentSetStatus(BaseModel):
     """
     observed_generation: Annotated[int | None, Field(alias="observedGeneration")] = None
     """
-    observedGeneration is the .metadata.generation the conditions were computed from.
+    observedGeneration is the .metadata.generation of the spec the operator last
+    reconciled. componentSyncs always describes this generation. A condition can be
+    older, as its own observedGeneration says: ComponentsApplied is not rewritten on a
+    pass that fails validation.
     """

{ccluster_py-0.0.7 → ccluster_py-0.0.9.dev129}/src/ccluster/v1alpha1/cclinfraplane.py

@@ -64,6 +64,20 @@ class CCLInfraPlaneSpec(BaseModel):
     referenced Secret holds. See
     https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#clusters
     """
+    domain: Annotated[
+        str,
+        Field(
+            max_length=253,
+            min_length=1,
+            pattern="^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?)+$",
+        ),
+    ]
+    """
+    domain is the infra-plane cluster's DNS domain. The control-plane operator writes it
+    to the CCLClusterConfig singleton on that cluster, which the infra-plane operator
+    verifies the cluster against. It must be a lowercase DNS name of at least two labels,
+    each at most 63 characters, and it cannot be changed once set.
+    """
 
 
 class Status(Enum):
@@ -133,6 +147,78 @@ class Condition(BaseModel):
     """
 
 
+class LoadBalancer(BaseModel):
+    """
+    LoadBalancerStatus is the address of a LoadBalancer Service labelled
+    ccluster.nvidia.com/loadbalancer. ip and hostname are both empty until the cloud
+    provider assigns one.
+    """
+
+    model_config = ConfigDict(
+        populate_by_name=True,
+    )
+    hostname: str | None = None
+    """
+    hostname is the LoadBalancer's DNS name, set by cloud providers whose load
+    balancers are addressed by name rather than by IP: the first hostname the Service
+    reports.
+    """
+    ip: str | None = None
+    """
+    ip is the LoadBalancer's IP address: the first IP the Service reports.
+    """
+    name: Annotated[str, Field(max_length=63, min_length=1)]
+    """
+    name is the Service's ccluster.nvidia.com/loadbalancer label value.
+    """
+
+
+class CCLClusterConfigStatus(BaseModel):
+    """
+    clusterConfig is the status of the CCLClusterConfig singleton on the infra-plane
+    cluster, copied verbatim whenever it changes there. It is what the infra-plane
+    operator reports about the cluster; ClusterConfigApplied says whether the copy is
+    current. Its conditions and observedGeneration are the infra-plane operator's, and
+    refer to the CCLClusterConfig, not to this CCLInfraPlane.
+    """
+
+    model_config = ConfigDict(
+        populate_by_name=True,
+    )
+    conditions: list[Condition] | None = None
+    """
+    conditions represent the current state of the infra-plane cluster's
+    CCLClusterConfig.
+
+    Condition types reported by the infra-plane operator:
+      - "Verified": every catalogs/cluster_base component is installed in this
+        cluster and configured for it. When False, the message names the charts
+        that failed verification.
+
+    The status of each condition is one of True, False, or Unknown.
+    """
+    load_balancers: Annotated[
+        list[LoadBalancer] | None, Field(alias="loadBalancers")
+    ] = None
+    """
+    loadBalancers are the cluster's LoadBalancer Services labelled
+    ccluster.nvidia.com/loadbalancer, one per label value, as the infra-plane operator
+    last observed them. A value carried by more than one Service is left out and
+    reported in the Verified condition.
+    """
+    observed_generation: Annotated[int | None, Field(alias="observedGeneration")] = None
+    """
+    observedGeneration is the CCLClusterConfig's .metadata.generation the conditions
+    were computed from.
+    """
+
+
+class Condition1(Condition):
+    """
+    Condition contains details for one aspect of the current state of this API Resource.
+    """
+
+
 class CCLInfraPlaneStatus(BaseModel):
     """
     status defines the observed state of CCLInfraPlane
@@ -141,15 +227,26 @@ class CCLInfraPlaneStatus(BaseModel):
     model_config = ConfigDict(
         populate_by_name=True,
     )
-    conditions: list[Condition] | None = None
+    cluster_config: Annotated[
+        CCLClusterConfigStatus | None,
+        Field(alias="clusterConfig", title="CCLClusterConfigStatus"),
+    ] = None
+    """
+    clusterConfig is the status of the CCLClusterConfig singleton on the infra-plane
+    cluster, copied verbatim whenever it changes there. It is what the infra-plane
+    operator reports about the cluster; ClusterConfigApplied says whether the copy is
+    current. Its conditions and observedGeneration are the infra-plane operator's, and
+    refer to the CCLClusterConfig, not to this CCLInfraPlane.
+    """
+    conditions: list[Condition1] | None = None
     """
     conditions represent the current state of the CCLInfraPlane resource.
-    Each condition has a unique type and reflects the status of a specific aspect of the resource.
 
-    Standard condition types include:
-    - "Available": the resource is fully functional
-    - "Progressing": the resource is being created or updated
-    - "Degraded": the resource failed to reach or maintain its desired state
+    Condition types reported by the control-plane operator:
+      - "Available": the namespace's Argo CD AppProject exists and the cluster
+        Secret has been mirrored into the Argo CD namespace.
+      - "ClusterConfigApplied": the CCLClusterConfig singleton on the infra-plane
+        cluster carries this CCLInfraPlane's domain.
 
     The status of each condition is one of True, False, or Unknown.
     """