fix(self-managed): forward remote Watch discovery

Signed-off-by: Mike Camp <mcamp@nvidia.com>

Author: mikeyrcamp

deploy/stacks/self-managed/environments/base.yaml

@@ -314,6 +314,12 @@ addons:
         # window; Kubernetes cannot mutate one workload kind into the other.
         kind: Deployment
 
+      discovery:
+        # Recursive Watch endpoints require an explicit HTTPS URI. Plaintext
+        # HTTP is available only through the development-only opt-in below.
+        remoteWatchUrls: []
+        allowInsecureRemoteWatchHttp: false
+
       # Authority and SNI aware backend router. A worker holds one registration
       # stream and one reverse QUIC tunnel per router replica, and each must
       # reach the specific replica named by the gRPC authority or QUIC SNI, so

deploy/stacks/self-managed/global.yaml.gotmpl

@@ -878,6 +878,10 @@ llmRequestRouter:
   replicaCount: {{ dig "addons" "llm" "requestRouter" "replicaCount" 3 .Values }}
   workload:
     kind: {{ dig "addons" "llm" "requestRouter" "workload" "kind" "Deployment" .Values | quote }}
+  discovery:
+    remoteWatchUrls:
+      {{- toYaml (dig "addons" "llm" "requestRouter" "discovery" "remoteWatchUrls" (list) .Values) | nindent 6 }}
+    allowInsecureRemoteWatchHttp: {{ dig "addons" "llm" "requestRouter" "discovery" "allowInsecureRemoteWatchHttp" false .Values }}
   service:
     grpcPort: {{ $llmRequestRouterGrpcPort }}
   {{- if .Values.global.imagePullSecrets }}

deploy/stacks/self-managed/tests/llm-router-local-chart.sh

@@ -31,6 +31,8 @@ test "$actual" = "$chart_path" || {
   --environment default \
   --state-values-set addons.llm.enabled=true \
   --state-values-set-string "addons.llm.requestRouter.chartPath=$chart_path" \
+  --state-values-set-string 'addons.llm.requestRouter.discovery.remoteWatchUrls[0]=https://region-b.example.invalid:50071' \
+  --state-values-set addons.llm.requestRouter.discovery.allowInsecureRemoteWatchHttp=true \
   --state-values-set ingress.gatewayApi.gateways.shared.name=shared-gw \
   --state-values-set ingress.gatewayApi.gateways.shared.namespace=envoy-gateway-system \
   --state-values-set ingress.gatewayApi.gateways.grpc.name=grpc-gw \
@@ -51,6 +53,18 @@ test "$default_workload_kind" = "Deployment" || {
   exit 1
 }
 
+remote_watch_url="$(yq -r '.llmRequestRouter.discovery.remoteWatchUrls[0]' "$values_file")"
+test "$remote_watch_url" = "https://region-b.example.invalid:50071" || {
+  echo "llm-router-local-chart: expected remote Watch URL forwarding, got ${remote_watch_url:-missing}" >&2
+  exit 1
+}
+
+allow_insecure_remote_watch_http="$(yq -r '.llmRequestRouter.discovery.allowInsecureRemoteWatchHttp' "$values_file")"
+test "$allow_insecure_remote_watch_http" = "true" || {
+  echo "llm-router-local-chart: expected development HTTP opt-in forwarding, got ${allow_insecure_remote_watch_http:-missing}" >&2
+  exit 1
+}
+
 (cd "$stack_dir" && HELMFILE_ENV=base helmfile \
   --file helmfile.d/02-core.yaml.gotmpl \
   --environment default \

docs/user/llm-function-enablement.md

@@ -243,6 +243,25 @@ both to use the in-cluster backend-router Service. Helmfile rendering rejects a
 partial override. The gRPC worker address normally uses the same TCP endpoint
 as `pylonGrpcDialAddress`.
 
+To recursively discover request routers in another region, set explicit remote
+Watch dial URIs on the self-managed operator surface:
+
+```yaml
+addons:
+  llm:
+    requestRouter:
+      discovery:
+        remoteWatchUrls:
+          - https://region-b-watch.example.com:50071
+```
+
+Each URI must use `https://`. Development-only plaintext endpoints require an
+explicit `http://` URI and
+`addons.llm.requestRouter.discovery.allowInsecureRemoteWatchHttp: true`.
+Scheme-less and unsupported endpoints are rejected rather than defaulting to
+plaintext. The dial hostname selects TLS SNI; identities advertised by the
+remote Watch response remain the HTTP/2 authorities used for registration.
+
 The scheme-less `global.workerEndpoints.llmRequestRouterAddress` in this
 example is the self-managed profile's initial `host:port` input. The
 `pylonGrpcDialAddress` override requires an explicit `http://` or `https://`