chore(bazel): remove references to the decommissioned remote cache

src/compute-plane-services/ess-agent/scripts/.bazel-remote-probe

@@ -2,37 +2,40 @@
 # SPDX-FileCopyrightText: Copyright (c) NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 #
-# Probe the nvcfbarn remote cache and export BAZEL_REMOTE_FLAGS with the
+# Probe the configured remote cache and export BAZEL_REMOTE_FLAGS with the
 # right --remote_cache + --tls_certificate flags, or empty if the cache is
 # unreachable / disabled. Source this file (do NOT execute it) so the
 # exported var is visible in the parent shell.
 #
 # Driven by four CI/CD variables; all default to safe values that fall back
 # to local-only cleanly:
 #   NVCF_BAZEL_REMOTE       "1" to enable, "0" to disable (default 1).
-#   NVCF_BAZEL_REMOTE_HOST  cache host (default nvcfbarn.nvidia.com).
+#   NVCF_BAZEL_REMOTE_HOST  cache host. Unset disables the cache (no default:
+#                           the previous default host was decommissioned).
 #   NVCF_BAZEL_REMOTE_PORT  cache port (443 for the TLS sidecar).
 #   NVCF_BAZEL_REMOTE_TLS   "1" to use grpcs:// + --tls_certificate (default 1).
 #   BAZEL_REMOTE_CA_PEM     File-type CI variable holding the cache's PEM cert.
 #                           Required when TLS=1.
 
 BAZEL_REMOTE_FLAGS=""
-if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ]; then
-  echo "[bazel-remote] NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}; remote cache disabled"
+if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ] || [ -z "${NVCF_BAZEL_REMOTE_HOST:-}" ]; then
+  echo "[bazel-remote] remote cache disabled (NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}, NVCF_BAZEL_REMOTE_HOST=${NVCF_BAZEL_REMOTE_HOST:-unset}); building local-only"
 else
-  host="${NVCF_BAZEL_REMOTE_HOST:-nvcfbarn.nvidia.com}"
+  host="${NVCF_BAZEL_REMOTE_HOST}"
   port="${NVCF_BAZEL_REMOTE_PORT:-443}"
   tls="${NVCF_BAZEL_REMOTE_TLS:-1}"
-  if [ "${tls}" = "1" ] && [ -z "${BAZEL_REMOTE_CA_PEM:-}" ]; then
+  if [ "${tls}" = "1" ] && [ ! -r "${BAZEL_REMOTE_CA_PEM:-}" ]; then
     # TLS requires a CA pem. grpcurl can probe with `-insecure`, but
     # Bazel's own gRPC client cannot: with `grpcs://` and no
     # `--tls_certificate` it tries the system trust store, which does
-    # not contain the nvcfbarn self-signed cert, and fails mid-build
+    # not contain the cache's self-signed cert, and fails mid-build
     # with "General OpenSslEngine problem". Skip the cache cleanly
     # instead of greenlighting an unusable URL. Hit on
     # dns-cache/nvcf-unbound!41; set BAZEL_REMOTE_CA_PEM (file-type CI
-    # variable) to enable.
-    echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset; remote cache disabled. Set the file-type CI variable to enable."
+    # variable) to enable. The test is -r, not -z: a variable set to a
+    # path that does not exist would otherwise reach the `cp` below and
+    # fail the job instead of cleanly declining the cache.
+    echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset or unreadable (${BAZEL_REMOTE_CA_PEM:-unset}); remote cache disabled. Set the file-type CI variable to enable."
   elif [ "${tls}" = "1" ] && [ ! -r "${BAZEL_REMOTE_CA_PEM}" ]; then
     # Env var is set but the file is missing or unreadable. Treat it
     # the same as unset and degrade to local-only rather than failing

src/compute-plane-services/nvca/scripts/.bazel-remote-probe

@@ -1,36 +1,39 @@
 #!/usr/bin/env bash
 #
-# Probe the nvcfbarn remote cache and export BAZEL_REMOTE_FLAGS with the
+# Probe the configured remote cache and export BAZEL_REMOTE_FLAGS with the
 # right --remote_cache + --tls_certificate flags, or empty if the cache is
 # unreachable / disabled. Source this file (do NOT execute it) so the
 # exported var is visible in the parent shell.
 #
 # Driven by four CI/CD variables; all default to safe values that fall back
 # to local-only cleanly:
 #   NVCF_BAZEL_REMOTE       "1" to enable, "0" to disable (default 1).
-#   NVCF_BAZEL_REMOTE_HOST  cache host (default nvcfbarn.nvidia.com).
+#   NVCF_BAZEL_REMOTE_HOST  cache host. Unset disables the cache (no default:
+#                           the previous default host was decommissioned).
 #   NVCF_BAZEL_REMOTE_PORT  cache port (443 for the TLS sidecar).
 #   NVCF_BAZEL_REMOTE_TLS   "1" to use grpcs:// + --tls_certificate (default 1).
 #   BAZEL_REMOTE_CA_PEM     File-type CI variable holding the cache's PEM cert.
 #                           Required when TLS=1.
 
 BAZEL_REMOTE_FLAGS=""
-if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ]; then
-  echo "[bazel-remote] NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}; remote cache disabled"
+if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ] || [ -z "${NVCF_BAZEL_REMOTE_HOST:-}" ]; then
+  echo "[bazel-remote] remote cache disabled (NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}, NVCF_BAZEL_REMOTE_HOST=${NVCF_BAZEL_REMOTE_HOST:-unset}); building local-only"
 else
-  host="${NVCF_BAZEL_REMOTE_HOST:-nvcfbarn.nvidia.com}"
+  host="${NVCF_BAZEL_REMOTE_HOST}"
   port="${NVCF_BAZEL_REMOTE_PORT:-443}"
   tls="${NVCF_BAZEL_REMOTE_TLS:-1}"
-  if [ "${tls}" = "1" ] && [ -z "${BAZEL_REMOTE_CA_PEM:-}" ]; then
+  if [ "${tls}" = "1" ] && [ ! -r "${BAZEL_REMOTE_CA_PEM:-}" ]; then
     # TLS requires a CA pem. grpcurl can probe with `-insecure`, but
     # Bazel's own gRPC client cannot: with `grpcs://` and no
     # `--tls_certificate` it tries the system trust store, which does
-    # not contain the nvcfbarn self-signed cert, and fails mid-build
+    # not contain the cache's self-signed cert, and fails mid-build
     # with "General OpenSslEngine problem". Skip the cache cleanly
     # instead of greenlighting an unusable URL. Hit on
     # dns-cache/nvcf-unbound!41; set BAZEL_REMOTE_CA_PEM (file-type CI
-    # variable) to enable.
-    echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset; remote cache disabled. Set the file-type CI variable to enable."
+    # variable) to enable. The test is -r, not -z: a variable set to a
+    # path that does not exist would otherwise reach the `cp` below and
+    # fail the job instead of cleanly declining the cache.
+    echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset or unreadable (${BAZEL_REMOTE_CA_PEM:-unset}); remote cache disabled. Set the file-type CI variable to enable."
   else
     probe_args=(-d '{"instance_name":""}')
     cache_url="grpc://${host}:${port}"

src/compute-plane-services/nvsnap/.bazelrc

@@ -42,21 +42,20 @@ build:release --stamp
 #    a second pipeline on the same runner skips work the first one
 #    already did. Devs benefit too; the path is gitignored.
 #
-# 2. Remote cache (opt-in via --config=remote). Points at nvcfbarn,
-#    the team Buildbarn at NVIDIA. Default is OFF in this repo
-#    because the nvsnap project has no probe wired yet -- enabling
-#    --config=remote on a runner that cannot reach nvcfbarn fails
-#    the build hard (Bazel's initial GetCapabilities RPC is not
-#    covered by --remote_local_fallback). CI sets
+# 2. Remote cache (opt-in via --config=remote). The caller supplies the
+#    endpoint with --remote_cache; this file carries only the policy and
+#    tuning flags. Default is OFF in this repo because the nvsnap project
+#    has no probe wired yet -- enabling --config=remote on a runner that
+#    cannot reach the cache fails the build hard (Bazel's initial
+#    GetCapabilities RPC is not covered by --remote_local_fallback). CI sets
 #    --config=remote-write explicitly in .gitlab-ci.yml; devs and
 #    ad-hoc builds stay on disk-only.
 build --disk_cache=.bazel-cache/disk
 build --repository_cache=.bazel-cache/repo
 
-# Read-only remote cache profile. Pulls hits from nvcfbarn but does
-# not upload. Layer on top of this with --config=remote-write to
+# Read-only remote cache profile. Pulls hits but does not upload. Supply
+# the endpoint with --remote_cache; layer --config=remote-write on top to
 # also write back results.
-build:remote --remote_cache=grpc://nvcfbarn.nvidia.com:8980
 build:remote --remote_upload_local_results=false
 build:remote --remote_cache_compression
 build:remote --remote_local_fallback

src/control-plane-services/function-autoscaler/scripts/.bazel-remote-probe

@@ -2,37 +2,40 @@
 # SPDX-FileCopyrightText: Copyright (c) NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 #
-# Probe the nvcfbarn remote cache and export BAZEL_REMOTE_FLAGS with the
+# Probe the configured remote cache and export BAZEL_REMOTE_FLAGS with the
 # right --remote_cache + --tls_certificate flags, or empty if the cache is
 # unreachable / disabled. Source this file (do NOT execute it) so the
 # exported var is visible in the parent shell.
 #
 # Driven by four CI/CD variables; all default to safe values that fall back
 # to local-only cleanly:
 #   NVCF_BAZEL_REMOTE       "1" to enable, "0" to disable (default 1).
-#   NVCF_BAZEL_REMOTE_HOST  cache host (default nvcfbarn.nvidia.com).
+#   NVCF_BAZEL_REMOTE_HOST  cache host. Unset disables the cache (no default:
+#                           the previous default host was decommissioned).
 #   NVCF_BAZEL_REMOTE_PORT  cache port (443 for the TLS sidecar).
 #   NVCF_BAZEL_REMOTE_TLS   "1" to use grpcs:// + --tls_certificate (default 1).
 #   BAZEL_REMOTE_CA_PEM     File-type CI variable holding the cache's PEM cert.
 #                           Required when TLS=1.
 
 BAZEL_REMOTE_FLAGS=""
-if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ]; then
-  echo "[bazel-remote] NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}; remote cache disabled"
+if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ] || [ -z "${NVCF_BAZEL_REMOTE_HOST:-}" ]; then
+  echo "[bazel-remote] remote cache disabled (NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}, NVCF_BAZEL_REMOTE_HOST=${NVCF_BAZEL_REMOTE_HOST:-unset}); building local-only"
 else
-  host="${NVCF_BAZEL_REMOTE_HOST:-nvcfbarn.nvidia.com}"
+  host="${NVCF_BAZEL_REMOTE_HOST}"
   port="${NVCF_BAZEL_REMOTE_PORT:-443}"
   tls="${NVCF_BAZEL_REMOTE_TLS:-1}"
-  if [ "${tls}" = "1" ] && [ -z "${BAZEL_REMOTE_CA_PEM:-}" ]; then
+  if [ "${tls}" = "1" ] && [ ! -r "${BAZEL_REMOTE_CA_PEM:-}" ]; then
     # TLS requires a CA pem. grpcurl can probe with `-insecure`, but
     # Bazel's own gRPC client cannot: with `grpcs://` and no
     # `--tls_certificate` it tries the system trust store, which does
-    # not contain the nvcfbarn self-signed cert, and fails mid-build
+    # not contain the cache's self-signed cert, and fails mid-build
     # with "General OpenSslEngine problem". Skip the cache cleanly
     # instead of greenlighting an unusable URL. Hit on
     # dns-cache/nvcf-unbound!41; set BAZEL_REMOTE_CA_PEM (file-type CI
-    # variable) to enable.
-    echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset; remote cache disabled. Set the file-type CI variable to enable."
+    # variable) to enable. The test is -r, not -z: a variable set to a
+    # path that does not exist would otherwise reach the `cp` below and
+    # fail the job instead of cleanly declining the cache.
+    echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset or unreadable (${BAZEL_REMOTE_CA_PEM:-unset}); remote cache disabled. Set the file-type CI variable to enable."
   elif [ "${tls}" = "1" ] && [ ! -r "${BAZEL_REMOTE_CA_PEM}" ]; then
     # Env var is set but the file is missing or unreadable. Treat it
     # the same as unset and degrade to local-only rather than failing

src/control-plane-services/helm-reval/scripts/.bazel-remote-probe

@@ -1,36 +1,39 @@
 #!/usr/bin/env bash
 #
-# Probe the nvcfbarn remote cache and export BAZEL_REMOTE_FLAGS with the
+# Probe the configured remote cache and export BAZEL_REMOTE_FLAGS with the
 # right --remote_cache + --tls_certificate flags, or empty if the cache is
 # unreachable / disabled. Source this file (do NOT execute it) so the
 # exported var is visible in the parent shell.
 #
 # Driven by four CI/CD variables; all default to safe values that fall back
 # to local-only cleanly:
 #   NVCF_BAZEL_REMOTE       "1" to enable, "0" to disable (default 1).
-#   NVCF_BAZEL_REMOTE_HOST  cache host (default nvcfbarn.nvidia.com).
+#   NVCF_BAZEL_REMOTE_HOST  cache host. Unset disables the cache (no default:
+#                           the previous default host was decommissioned).
 #   NVCF_BAZEL_REMOTE_PORT  cache port (443 for the TLS sidecar).
 #   NVCF_BAZEL_REMOTE_TLS   "1" to use grpcs:// + --tls_certificate (default 1).
 #   BAZEL_REMOTE_CA_PEM     File-type CI variable holding the cache's PEM cert.
 #                           Required when TLS=1.
 
 BAZEL_REMOTE_FLAGS=""
-if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ]; then
-  echo "[bazel-remote] NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}; remote cache disabled"
+if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ] || [ -z "${NVCF_BAZEL_REMOTE_HOST:-}" ]; then
+  echo "[bazel-remote] remote cache disabled (NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}, NVCF_BAZEL_REMOTE_HOST=${NVCF_BAZEL_REMOTE_HOST:-unset}); building local-only"
 else
-  host="${NVCF_BAZEL_REMOTE_HOST:-nvcfbarn.nvidia.com}"
+  host="${NVCF_BAZEL_REMOTE_HOST}"
   port="${NVCF_BAZEL_REMOTE_PORT:-443}"
   tls="${NVCF_BAZEL_REMOTE_TLS:-1}"
-  if [ "${tls}" = "1" ] && [ -z "${BAZEL_REMOTE_CA_PEM:-}" ]; then
+  if [ "${tls}" = "1" ] && [ ! -r "${BAZEL_REMOTE_CA_PEM:-}" ]; then
     # TLS requires a CA pem. grpcurl can probe with `-insecure`, but
     # Bazel's own gRPC client cannot: with `grpcs://` and no
     # `--tls_certificate` it tries the system trust store, which does
-    # not contain the nvcfbarn self-signed cert, and fails mid-build
+    # not contain the cache's self-signed cert, and fails mid-build
     # with "General OpenSslEngine problem". Skip the cache cleanly
     # instead of greenlighting an unusable URL. Hit on
     # dns-cache/nvcf-unbound!41; set BAZEL_REMOTE_CA_PEM (file-type CI
-    # variable) to enable.
-    echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset; remote cache disabled. Set the file-type CI variable to enable."
+    # variable) to enable. The test is -r, not -z: a variable set to a
+    # path that does not exist would otherwise reach the `cp` below and
+    # fail the job instead of cleanly declining the cache.
+    echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset or unreadable (${BAZEL_REMOTE_CA_PEM:-unset}); remote cache disabled. Set the file-type CI variable to enable."
   else
     probe_args=(-d '{"instance_name":""}')
     cache_url="grpc://${host}:${port}"

src/invocation-plane-services/grpc-proxy/proxy/geo/BUILD.bazel

@@ -74,10 +74,12 @@ go_test(
     local = True,
     # external: testcontainers spins up the localstack Docker container,
     # so the test's effective inputs (Docker daemon, localstack image
-    # tag) live outside Bazel's hermetic action hash. `local = True`
-    # forces local-only execution but does NOT bypass result caching;
-    # the `external` tag is what stops nvcfbarn from pinning a green
-    # forever. requires-docker is kept so callers can filter out
+    # tag) live outside Bazel's hermetic action hash. `local = True` forces
+    # local, unsandboxed execution and, measured on Bazel 9.1.1, also stops
+    # the result being reused from the disk/remote cache. It does not disable
+    # every cache: the `external` tag is what prevents Bazel reusing a
+    # previously cached test result. requires-docker is kept so callers
+    # can filter out
     # docker-needing tests with --test_tag_filters=-requires-docker.
     tags = [
         "external",

src/invocation-plane-services/http-invocation/scripts/.bazel-remote-probe

@@ -2,37 +2,40 @@
 # SPDX-FileCopyrightText: Copyright (c) NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 #
-# Probe the nvcfbarn remote cache and export BAZEL_REMOTE_FLAGS with the
+# Probe the configured remote cache and export BAZEL_REMOTE_FLAGS with the
 # right --remote_cache + --tls_certificate flags, or empty if the cache is
 # unreachable / disabled. Source this file (do NOT execute it) so the
 # exported var is visible in the parent shell.
 #
 # Driven by four CI/CD variables; all default to safe values that fall back
 # to local-only cleanly:
 #   NVCF_BAZEL_REMOTE       "1" to enable, "0" to disable (default 1).
-#   NVCF_BAZEL_REMOTE_HOST  cache host (default nvcfbarn.nvidia.com).
+#   NVCF_BAZEL_REMOTE_HOST  cache host. Unset disables the cache (no default:
+#                           the previous default host was decommissioned).
 #   NVCF_BAZEL_REMOTE_PORT  cache port (443 for the TLS sidecar).
 #   NVCF_BAZEL_REMOTE_TLS   "1" to use grpcs:// + --tls_certificate (default 1).
 #   BAZEL_REMOTE_CA_PEM     File-type CI variable holding the cache's PEM cert.
 #                           Required when TLS=1.
 
 BAZEL_REMOTE_FLAGS=""
-if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ]; then
-  echo "[bazel-remote] NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}; remote cache disabled"
+if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ] || [ -z "${NVCF_BAZEL_REMOTE_HOST:-}" ]; then
+  echo "[bazel-remote] remote cache disabled (NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}, NVCF_BAZEL_REMOTE_HOST=${NVCF_BAZEL_REMOTE_HOST:-unset}); building local-only"
 else
-  host="${NVCF_BAZEL_REMOTE_HOST:-nvcfbarn.nvidia.com}"
+  host="${NVCF_BAZEL_REMOTE_HOST}"
   port="${NVCF_BAZEL_REMOTE_PORT:-443}"
   tls="${NVCF_BAZEL_REMOTE_TLS:-1}"
-  if [ "${tls}" = "1" ] && [ -z "${BAZEL_REMOTE_CA_PEM:-}" ]; then
+  if [ "${tls}" = "1" ] && [ ! -r "${BAZEL_REMOTE_CA_PEM:-}" ]; then
     # TLS requires a CA pem. grpcurl can probe with `-insecure`, but
     # Bazel's own gRPC client cannot: with `grpcs://` and no
     # `--tls_certificate` it tries the system trust store, which does
-    # not contain the nvcfbarn self-signed cert, and fails mid-build
+    # not contain the cache's self-signed cert, and fails mid-build
     # with "General OpenSslEngine problem". Skip the cache cleanly
     # instead of greenlighting an unusable URL. Hit on
     # dns-cache/nvcf-unbound!41; set BAZEL_REMOTE_CA_PEM (file-type CI
-    # variable) to enable.
-    echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset; remote cache disabled. Set the file-type CI variable to enable."
+    # variable) to enable. The test is -r, not -z: a variable set to a
+    # path that does not exist would otherwise reach the `cp` below and
+    # fail the job instead of cleanly declining the cache.
+    echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset or unreadable (${BAZEL_REMOTE_CA_PEM:-unset}); remote cache disabled. Set the file-type CI variable to enable."
   elif [ "${tls}" = "1" ] && [ ! -r "${BAZEL_REMOTE_CA_PEM}" ]; then
     # Env var is set but the file is missing or unreadable. Treat it
     # the same as unset and degrade to local-only rather than failing