<!-- Generated by npm run catalog:index. Do not edit by hand. -->

# ConfigHub Helm Catalog

This is the top-level catalog for choosing a chart and a variant.

Use this page when you want to answer:

```text
What can I install?
Which variant should I start with?
Which variant needs existing Secrets or other target facts?
Where is the executable cub installer package?
Where are the proof receipts?
```

## How To Read This Catalog

```text
chart
  variant
    cub installer package base
    rendered objects
    receipts and checks
```

The root catalog is the entry point. The per-chart `CATALOG.md` is the
evidence folder. The `oci://` package ref is what users pass to
`cub installer setup --pull`. The `packages/` path is the repo source
for maintainers and proof scripts.

## Folder Map

```text
CATALOG.md
  Top-level chart and variant index.

recipes/<repo>/<chart>/<version>/CATALOG.md
  Per-chart recipe, variants, rendered objects, receipts, and status.

packages/<repo>/<chart>/<version>/
  Executable cub installer package with one base per variant.

runs/
  Receipts from live, ConfigHub, scan, and safe-ops proof runs.

data/
  Aggregate catalog, production disposition, top-500, and review data.
```

## Live-Tested Catalog Entries

These 20 charts have local kind live/e2e receipts and ConfigHub upload,
scan, and safe-ops proof receipts. Start with the first variant unless a
different variant matches your intent.

For exact base-variant readiness, including prerequisites and runtime
review rows, see [Top-20 Base Variant Readiness](data/top20-base-readiness/summary.md).
The `Start Base Status` column uses the same generated readiness labels.

### At A Glance

| Chart | Start With | Start Base Status | Evidence | Hard Gap | Variants | Installer OCI | Catalog |
| --- | --- | --- | --- | --- | --- | --- | --- |
| bitnami/redis@25.5.3 | reuse-existing-secret | render-only | live-helm-vs-confighub-parity | - | default, reuse-existing-secret | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-redis:25.5.3` | [CATALOG.md](recipes/bitnami/redis/25.5.3/CATALOG.md) |
| metrics-server/metrics-server@3.13.0 | default | start-here | live-helm-vs-confighub-parity | existing-secret (chart ships no Secret toggle) | default, external-tls-ca | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/metrics-server-metrics-server:3.13.0` | [CATALOG.md](recipes/metrics-server/metrics-server/3.13.0/CATALOG.md) |
| ingress-nginx/ingress-nginx@4.15.1 | internal-clusterip | start-here | live-helm-vs-confighub-parity | - | default, admission-disabled, internal-clusterip | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/ingress-nginx-ingress-nginx:4.15.1` | [CATALOG.md](recipes/ingress-nginx/ingress-nginx/4.15.1/CATALOG.md) |
| jetstack/cert-manager@v1.20.2 | crds-enabled | start-here | live-helm-vs-confighub-parity | - | default, crds-enabled | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/jetstack-cert-manager:v1.20.2` | [CATALOG.md](recipes/jetstack/cert-manager/v1.20.2/CATALOG.md) |
| external-secrets/external-secrets@2.5.0 | default | start-here | live-helm-vs-confighub-parity | - | default, no-crds | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/external-secrets-external-secrets:2.5.0` | [CATALOG.md](recipes/external-secrets/external-secrets/2.5.0/CATALOG.md) |
| argo-cd/argo-cd@9.5.15 | default | start-here | live-helm-vs-confighub-parity | ha (curated proof lane - bespoke teaching needed) | default, no-crds | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/argo-cd-argo-cd:9.5.15` | [CATALOG.md](recipes/argo-cd/argo-cd/9.5.15/CATALOG.md) |
| bitnami/postgresql@18.6.7 | existing-secret | render-only | live-helm-vs-confighub-parity | ha (curated proof lane - bespoke teaching needed) | static-passwords, existing-secret | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-postgresql:18.6.7` | [CATALOG.md](recipes/bitnami/postgresql/18.6.7/CATALOG.md) |
| bitnami/rabbitmq@16.0.14 | existing-secret | start-here | live-helm-vs-confighub-parity | ha (curated proof lane - bespoke teaching needed) | static-passwords, existing-secret | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-rabbitmq:16.0.14` | [CATALOG.md](recipes/bitnami/rabbitmq/16.0.14/CATALOG.md) |
| prometheus-community/kube-prometheus-stack@85.3.3 | default | render-only | live-helm-vs-confighub-parity | existing-secret (chart ships no Secret toggle) | default, no-crds | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-kube-prometheus-stack:85.3.3` | [CATALOG.md](recipes/prometheus-community/kube-prometheus-stack/85.3.3/CATALOG.md) |
| grafana/loki@7.0.0 | single-binary-filesystem | start-here | live-helm-vs-confighub-parity | - | single-binary-filesystem, simple-scalable-minio | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-loki:7.0.0` | [CATALOG.md](recipes/grafana/loki/7.0.0/CATALOG.md) |
| longhorn/longhorn@1.11.2 | default | start-here | live-helm-vs-confighub-parity | - | default, ui-ingress | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/longhorn-longhorn:1.11.2` | [CATALOG.md](recipes/longhorn/longhorn/1.11.2/CATALOG.md) |
| bitnami/mysql@14.0.3 | existing-secret | start-here | live-helm-vs-confighub-parity | ha (curated proof lane - bespoke teaching needed) | static-passwords, existing-secret | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-mysql:14.0.3` | [CATALOG.md](recipes/bitnami/mysql/14.0.3/CATALOG.md) |
| grafana/grafana@10.5.15 | existing-secret-ingress | start-here | live-helm-vs-confighub-parity | - | static-passwords, existing-secret-ingress | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-grafana:10.5.15` | [CATALOG.md](recipes/grafana/grafana/10.5.15/CATALOG.md) |
| hashicorp/vault@0.32.0 | default | start-here | live-helm-vs-confighub-parity | - | dev-mode, default, ha-raft-ui | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/hashicorp-vault:0.32.0` | [CATALOG.md](recipes/hashicorp/vault/0.32.0/CATALOG.md) |
| secrets-store-csi-driver/secrets-store-csi-driver@1.6.0 | default | start-here | live-helm-vs-confighub-parity | - | default, sync-secret-rotation | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/secrets-store-csi-driver-secrets-store-csi-driver:1.6.0` | [CATALOG.md](recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/CATALOG.md) |
| prometheus-community/prometheus@29.8.0 | server-only-ephemeral | render-only | live-helm-vs-confighub-parity | ha (curated proof lane - bespoke teaching needed) | default, server-only-ephemeral | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-prometheus:29.8.0` | [CATALOG.md](recipes/prometheus-community/prometheus/29.8.0/CATALOG.md) |
| bitnami/mongodb@19.0.7 | existing-secret-replicaset | render-only | live-helm-vs-confighub-parity | - | static-passwords, existing-secret-replicaset | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-mongodb:19.0.7` | [CATALOG.md](recipes/bitnami/mongodb/19.0.7/CATALOG.md) |
| bitnami/nginx@24.0.2 | http-clusterip | render-only | live-helm-vs-confighub-parity | existing-secret (chart ships no Secret toggle) | http-clusterip, existing-tls-ingress | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-nginx:24.0.2` | [CATALOG.md](recipes/bitnami/nginx/24.0.2/CATALOG.md) |
| grafana/tempo@1.24.4 | local-persistent | start-here | live-helm-vs-confighub-parity | ha (tempo single-binary chart; HA is the separate tempo-distributed chart) | local-persistent, s3-query-observability | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-tempo:1.24.4` | [CATALOG.md](recipes/grafana/tempo/1.24.4/CATALOG.md) |
| hashicorp/consul@2.0.0 | default-control-plane | start-here | live-helm-vs-confighub-parity | ha (curated proof lane - bespoke teaching needed) | default-control-plane, secure-mesh-existing-secrets | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/hashicorp-consul:2.0.0` | [CATALOG.md](recipes/hashicorp/consul/2.0.0/CATALOG.md) |

### Start Base Status Labels

| Status | Meaning |
| --- | --- |
| start-here | Best first catalog path today for the declared scope. |
| try-with-proof | Useful base with proof, but not every lane is complete. |
| lifecycle-observed | Lifecycle behavior has a committed observation receipt. |
| prerequisite-observed | Target prerequisites are explicit and have observation evidence. |
| runtime-watch | Render/parity evidence exists, but runtime behavior needs review or rerun. |
| runtime-review-needed | Runtime readiness needs inspection before broader claims. |
| target-prerequisite-needed | The target must provide a prerequisite such as CRDs, Secrets, or storage. |

### Chart Details

#### bitnami/redis@25.5.3

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: render-only
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2
Hard gap: -
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-redis:25.5.3`
Source package: [packages/bitnami/redis/25.5.3](packages/bitnami/redis/25.5.3)
Per-chart catalog: [CATALOG.md](recipes/bitnami/redis/25.5.3/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/bitnami/redis/25.5.3/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-redis:25.5.3 --base reuse-existing-secret --work-dir <tmp> --non-interactive --namespace redis
```

Variants:

##### default

When to use: Redis static password demo variant rendered from bitnami/redis@25.5.3
Readiness: render-only
Namespace: redis
Target facts: none
Package base: [packages/bitnami/redis/25.5.3/bases/default](packages/bitnami/redis/25.5.3/bases/default)
Variant file: [recipes/bitnami/redis/25.5.3/variants/default/variant.yaml](recipes/bitnami/redis/25.5.3/variants/default/variant.yaml)
Rendered objects: [recipes/bitnami/redis/25.5.3/revisions/default/r001/rendered/release-objects.yaml](recipes/bitnami/redis/25.5.3/revisions/default/r001/rendered/release-objects.yaml)
Helm equivalence: 14/14 objects matched
Receipts: [per-chart receipts](recipes/bitnami/redis/25.5.3/CATALOG.md)

##### reuse-existing-secret (recommended first)

When to use: Redis existing Secret default variant rendered from bitnami/redis@25.5.3
Readiness: render-only
Namespace: redis
Target facts: required Secret redis/redis-existing-secret keys redis-password
Package base: [packages/bitnami/redis/25.5.3/bases/reuse-existing-secret](packages/bitnami/redis/25.5.3/bases/reuse-existing-secret)
Variant file: [recipes/bitnami/redis/25.5.3/variants/reuse-existing-secret/variant.yaml](recipes/bitnami/redis/25.5.3/variants/reuse-existing-secret/variant.yaml)
Rendered objects: [recipes/bitnami/redis/25.5.3/revisions/reuse-existing-secret/r001/rendered/release-objects.yaml](recipes/bitnami/redis/25.5.3/revisions/reuse-existing-secret/r001/rendered/release-objects.yaml)
Helm equivalence: 13/13 objects matched
Receipts: [per-chart receipts](recipes/bitnami/redis/25.5.3/CATALOG.md)


#### metrics-server/metrics-server@3.13.0

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: start-here
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2
Hard gap: existing-secret (chart ships no Secret toggle)
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/metrics-server-metrics-server:3.13.0`
Source package: [packages/metrics-server/metrics-server/3.13.0](packages/metrics-server/metrics-server/3.13.0)
Per-chart catalog: [CATALOG.md](recipes/metrics-server/metrics-server/3.13.0/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/metrics-server/metrics-server/3.13.0/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/metrics-server-metrics-server:3.13.0 --base default --work-dir <tmp> --non-interactive --namespace kube-system
```

Variants:

##### default (recommended first)

When to use: metrics-server default variant rendered from metrics-server/metrics-server@3.13.0
Readiness: start-here
Namespace: kube-system
Target facts: none
Package base: [packages/metrics-server/metrics-server/3.13.0/bases/default](packages/metrics-server/metrics-server/3.13.0/bases/default)
Variant file: [recipes/metrics-server/metrics-server/3.13.0/variants/default/variant.yaml](recipes/metrics-server/metrics-server/3.13.0/variants/default/variant.yaml)
Rendered objects: [recipes/metrics-server/metrics-server/3.13.0/revisions/default/r001/rendered/release-objects.yaml](recipes/metrics-server/metrics-server/3.13.0/revisions/default/r001/rendered/release-objects.yaml)
Helm equivalence: 9/9 objects matched
Receipts: [per-chart receipts](recipes/metrics-server/metrics-server/3.13.0/CATALOG.md)

##### external-tls-ca

When to use: metrics-server external TLS with explicit CA variant rendered from metrics-server/metrics-server@3.13.0
Readiness: start-here
Namespace: kube-system
Target facts: required Secret kube-system/metrics-server-tls keys tls.crt,tls.key; required Value apiService.caBundle (pre-render)
Package base: [packages/metrics-server/metrics-server/3.13.0/bases/external-tls-ca](packages/metrics-server/metrics-server/3.13.0/bases/external-tls-ca)
Variant file: [recipes/metrics-server/metrics-server/3.13.0/variants/external-tls-ca/variant.yaml](recipes/metrics-server/metrics-server/3.13.0/variants/external-tls-ca/variant.yaml)
Rendered objects: [recipes/metrics-server/metrics-server/3.13.0/revisions/external-tls-ca/r001/rendered/release-objects.yaml](recipes/metrics-server/metrics-server/3.13.0/revisions/external-tls-ca/r001/rendered/release-objects.yaml)
Helm equivalence: 9/9 objects matched
Receipts: [per-chart receipts](recipes/metrics-server/metrics-server/3.13.0/CATALOG.md)


#### ingress-nginx/ingress-nginx@4.15.1

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: start-here
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 3/3; ConfigHub 3/3; local live 3/3; GitOps live 3/3; live parity 3/3
Hard gap: -
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/ingress-nginx-ingress-nginx:4.15.1`
Source package: [packages/ingress-nginx/ingress-nginx/4.15.1](packages/ingress-nginx/ingress-nginx/4.15.1)
Per-chart catalog: [CATALOG.md](recipes/ingress-nginx/ingress-nginx/4.15.1/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/ingress-nginx/ingress-nginx/4.15.1/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/ingress-nginx-ingress-nginx:4.15.1 --base internal-clusterip --work-dir <tmp> --non-interactive --namespace ingress-nginx
```

Variants:

##### default

When to use: ingress-nginx default variant rendered from ingress-nginx/ingress-nginx@4.15.1
Readiness: start-here
Namespace: ingress-nginx
Target facts: required Secret ingress-nginx/ingress-nginx-admission keys cert,key,ca
Package base: [packages/ingress-nginx/ingress-nginx/4.15.1/bases/default](packages/ingress-nginx/ingress-nginx/4.15.1/bases/default)
Variant file: [recipes/ingress-nginx/ingress-nginx/4.15.1/variants/default/variant.yaml](recipes/ingress-nginx/ingress-nginx/4.15.1/variants/default/variant.yaml)
Rendered objects: [recipes/ingress-nginx/ingress-nginx/4.15.1/revisions/default/r001/rendered/release-objects.yaml](recipes/ingress-nginx/ingress-nginx/4.15.1/revisions/default/r001/rendered/release-objects.yaml)
Helm equivalence: 11/11 objects matched
Receipts: [per-chart receipts](recipes/ingress-nginx/ingress-nginx/4.15.1/CATALOG.md)

##### admission-disabled

When to use: ingress-nginx admission webhook disabled variant rendered from ingress-nginx/ingress-nginx@4.15.1
Readiness: start-here
Namespace: ingress-nginx
Target facts: none
Package base: [packages/ingress-nginx/ingress-nginx/4.15.1/bases/admission-disabled](packages/ingress-nginx/ingress-nginx/4.15.1/bases/admission-disabled)
Variant file: [recipes/ingress-nginx/ingress-nginx/4.15.1/variants/admission-disabled/variant.yaml](recipes/ingress-nginx/ingress-nginx/4.15.1/variants/admission-disabled/variant.yaml)
Rendered objects: [recipes/ingress-nginx/ingress-nginx/4.15.1/revisions/admission-disabled/r001/rendered/release-objects.yaml](recipes/ingress-nginx/ingress-nginx/4.15.1/revisions/admission-disabled/r001/rendered/release-objects.yaml)
Helm equivalence: 9/9 objects matched
Receipts: [per-chart receipts](recipes/ingress-nginx/ingress-nginx/4.15.1/CATALOG.md)

##### internal-clusterip (recommended first)

When to use: ingress-nginx internal ClusterIP controller variant rendered from ingress-nginx/ingress-nginx@4.15.1
Readiness: start-here
Namespace: ingress-nginx
Target facts: none
Package base: [packages/ingress-nginx/ingress-nginx/4.15.1/bases/internal-clusterip](packages/ingress-nginx/ingress-nginx/4.15.1/bases/internal-clusterip)
Variant file: [recipes/ingress-nginx/ingress-nginx/4.15.1/variants/internal-clusterip/variant.yaml](recipes/ingress-nginx/ingress-nginx/4.15.1/variants/internal-clusterip/variant.yaml)
Rendered objects: [recipes/ingress-nginx/ingress-nginx/4.15.1/revisions/internal-clusterip/r001/rendered/release-objects.yaml](recipes/ingress-nginx/ingress-nginx/4.15.1/revisions/internal-clusterip/r001/rendered/release-objects.yaml)
Helm equivalence: 9/9 objects matched
Receipts: [per-chart receipts](recipes/ingress-nginx/ingress-nginx/4.15.1/CATALOG.md)


#### jetstack/cert-manager@v1.20.2

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: start-here
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2
Hard gap: -
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/jetstack-cert-manager:v1.20.2`
Source package: [packages/jetstack/cert-manager/v1.20.2](packages/jetstack/cert-manager/v1.20.2)
Per-chart catalog: [CATALOG.md](recipes/jetstack/cert-manager/v1.20.2/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/jetstack/cert-manager/v1.20.2/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/jetstack-cert-manager:v1.20.2 --base crds-enabled --work-dir <tmp> --non-interactive --namespace cert-manager
```

Variants:

##### default

When to use: cert-manager default variant rendered from jetstack/cert-manager@v1.20.2
Readiness: start-here
Namespace: cert-manager
Target facts: required CRD challenges.acme.cert-manager.io; required CRD orders.acme.cert-manager.io; required CRD certificaterequests.cert-manager.io; required CRD certificates.cert-manager.io; required CRD clusterissuers.cert-manager.io; required CRD issuers.cert-manager.io
Package base: [packages/jetstack/cert-manager/v1.20.2/bases/default](packages/jetstack/cert-manager/v1.20.2/bases/default)
Variant file: [recipes/jetstack/cert-manager/v1.20.2/variants/default/variant.yaml](recipes/jetstack/cert-manager/v1.20.2/variants/default/variant.yaml)
Rendered objects: [recipes/jetstack/cert-manager/v1.20.2/revisions/default/r001/rendered/release-objects.yaml](recipes/jetstack/cert-manager/v1.20.2/revisions/default/r001/rendered/release-objects.yaml)
Helm equivalence: 42/42 objects matched
Receipts: [per-chart receipts](recipes/jetstack/cert-manager/v1.20.2/CATALOG.md)

##### crds-enabled (recommended first)

When to use: cert-manager CRDs enabled variant rendered from jetstack/cert-manager@v1.20.2
Readiness: start-here
Namespace: cert-manager
Target facts: none
Package base: [packages/jetstack/cert-manager/v1.20.2/bases/crds-enabled](packages/jetstack/cert-manager/v1.20.2/bases/crds-enabled)
Variant file: [recipes/jetstack/cert-manager/v1.20.2/variants/crds-enabled/variant.yaml](recipes/jetstack/cert-manager/v1.20.2/variants/crds-enabled/variant.yaml)
Rendered objects: [recipes/jetstack/cert-manager/v1.20.2/revisions/crds-enabled/r001/rendered/release-objects.yaml](recipes/jetstack/cert-manager/v1.20.2/revisions/crds-enabled/r001/rendered/release-objects.yaml)
Helm equivalence: 48/48 objects matched
Receipts: [per-chart receipts](recipes/jetstack/cert-manager/v1.20.2/CATALOG.md)


#### external-secrets/external-secrets@2.5.0

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: start-here
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2
Hard gap: -
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/external-secrets-external-secrets:2.5.0`
Source package: [packages/external-secrets/external-secrets/2.5.0](packages/external-secrets/external-secrets/2.5.0)
Per-chart catalog: [CATALOG.md](recipes/external-secrets/external-secrets/2.5.0/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/external-secrets/external-secrets/2.5.0/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/external-secrets-external-secrets:2.5.0 --base default --work-dir <tmp> --non-interactive --namespace external-secrets
```

Variants:

##### default (recommended first)

When to use: external-secrets default variant rendered from external-secrets/external-secrets@2.5.0
Readiness: start-here
Namespace: external-secrets
Target facts: required Secret external-secrets/external-secrets-webhook
Package base: [packages/external-secrets/external-secrets/2.5.0/bases/default](packages/external-secrets/external-secrets/2.5.0/bases/default)
Variant file: [recipes/external-secrets/external-secrets/2.5.0/variants/default/variant.yaml](recipes/external-secrets/external-secrets/2.5.0/variants/default/variant.yaml)
Rendered objects: [recipes/external-secrets/external-secrets/2.5.0/revisions/default/r001/rendered/release-objects.yaml](recipes/external-secrets/external-secrets/2.5.0/revisions/default/r001/rendered/release-objects.yaml)
Helm equivalence: 42/42 objects matched
Receipts: [per-chart receipts](recipes/external-secrets/external-secrets/2.5.0/CATALOG.md)

##### no-crds

When to use: external-secrets CRDs disabled variant rendered from external-secrets/external-secrets@2.5.0
Readiness: start-here
Namespace: external-secrets
Target facts: required Secret external-secrets/external-secrets-webhook; required CRD acraccesstokens.generators.external-secrets.io; required CRD cloudsmithaccesstokens.generators.external-secrets.io; required CRD clusterexternalsecrets.external-secrets.io; required CRD clustergenerators.generators.external-secrets.io; required CRD clusterpushsecrets.external-secrets.io; required CRD clustersecretstores.external-secrets.io; required CRD ecrauthorizationtokens.generators.external-secrets.io; required CRD externalsecrets.external-secrets.io; required CRD fakes.generators.external-secrets.io; required CRD gcraccesstokens.generators.external-secrets.io; required CRD generatorstates.generators.external-secrets.io; required CRD githubaccesstokens.generators.external-secrets.io; required CRD grafanas.generators.external-secrets.io; required CRD mfas.generators.external-secrets.io; required CRD passwords.generators.external-secrets.io; required CRD pushsecrets.external-secrets.io; required CRD quayaccesstokens.generators.external-secrets.io; required CRD secretstores.external-secrets.io; required CRD sshkeys.generators.external-secrets.io; required CRD stssessiontokens.generators.external-secrets.io; required CRD uuids.generators.external-secrets.io; required CRD vaultdynamicsecrets.generators.external-secrets.io; required CRD webhooks.generators.external-secrets.io
Package base: [packages/external-secrets/external-secrets/2.5.0/bases/no-crds](packages/external-secrets/external-secrets/2.5.0/bases/no-crds)
Variant file: [recipes/external-secrets/external-secrets/2.5.0/variants/no-crds/variant.yaml](recipes/external-secrets/external-secrets/2.5.0/variants/no-crds/variant.yaml)
Rendered objects: [recipes/external-secrets/external-secrets/2.5.0/revisions/no-crds/r001/rendered/release-objects.yaml](recipes/external-secrets/external-secrets/2.5.0/revisions/no-crds/r001/rendered/release-objects.yaml)
Helm equivalence: 19/19 objects matched
Receipts: [per-chart receipts](recipes/external-secrets/external-secrets/2.5.0/CATALOG.md)


#### argo-cd/argo-cd@9.5.15

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: start-here
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 2/2; ConfigHub 2/2; local live 1/2; GitOps live 2/2; live parity 2/2
Hard gap: ha (curated proof lane - bespoke teaching needed)
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/argo-cd-argo-cd:9.5.15`
Source package: [packages/argo-cd/argo-cd/9.5.15](packages/argo-cd/argo-cd/9.5.15)
Per-chart catalog: [CATALOG.md](recipes/argo-cd/argo-cd/9.5.15/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/argo-cd/argo-cd/9.5.15/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/argo-cd-argo-cd:9.5.15 --base default --work-dir <tmp> --non-interactive --namespace argocd
```

Variants:

##### default (recommended first)

When to use: argo-cd default variant rendered from argo-cd/argo-cd@9.5.15
Readiness: start-here
Namespace: argocd
Target facts: required Secret argocd/argocd-redis keys auth
Package base: [packages/argo-cd/argo-cd/9.5.15/bases/default](packages/argo-cd/argo-cd/9.5.15/bases/default)
Variant file: [recipes/argo-cd/argo-cd/9.5.15/variants/default/variant.yaml](recipes/argo-cd/argo-cd/9.5.15/variants/default/variant.yaml)
Rendered objects: [recipes/argo-cd/argo-cd/9.5.15/revisions/default/r001/rendered/release-objects.yaml](recipes/argo-cd/argo-cd/9.5.15/revisions/default/r001/rendered/release-objects.yaml)
Helm equivalence: 49/49 objects matched
Receipts: [per-chart receipts](recipes/argo-cd/argo-cd/9.5.15/CATALOG.md)

##### no-crds

When to use: argo-cd CRDs disabled variant rendered from argo-cd/argo-cd@9.5.15
Readiness: render-only
Namespace: argocd
Target facts: required Secret argocd/argocd-redis keys auth; required CRD applications.argoproj.io; required CRD applicationsets.argoproj.io; required CRD appprojects.argoproj.io
Package base: [packages/argo-cd/argo-cd/9.5.15/bases/no-crds](packages/argo-cd/argo-cd/9.5.15/bases/no-crds)
Variant file: [recipes/argo-cd/argo-cd/9.5.15/variants/no-crds/variant.yaml](recipes/argo-cd/argo-cd/9.5.15/variants/no-crds/variant.yaml)
Rendered objects: [recipes/argo-cd/argo-cd/9.5.15/revisions/no-crds/r001/rendered/release-objects.yaml](recipes/argo-cd/argo-cd/9.5.15/revisions/no-crds/r001/rendered/release-objects.yaml)
Helm equivalence: 46/46 objects matched
Receipts: [per-chart receipts](recipes/argo-cd/argo-cd/9.5.15/CATALOG.md)


#### bitnami/postgresql@18.6.7

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: render-only
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2
Hard gap: ha (curated proof lane - bespoke teaching needed)
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-postgresql:18.6.7`
Source package: [packages/bitnami/postgresql/18.6.7](packages/bitnami/postgresql/18.6.7)
Per-chart catalog: [CATALOG.md](recipes/bitnami/postgresql/18.6.7/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/bitnami/postgresql/18.6.7/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-postgresql:18.6.7 --base existing-secret --work-dir <tmp> --non-interactive --namespace postgresql
```

Variants:

##### static-passwords

When to use: postgresql static password demo variant rendered from bitnami/postgresql@18.6.7
Readiness: render-only
Namespace: postgresql
Target facts: none
Package base: [packages/bitnami/postgresql/18.6.7/bases/static-passwords](packages/bitnami/postgresql/18.6.7/bases/static-passwords)
Variant file: [recipes/bitnami/postgresql/18.6.7/variants/static-passwords/variant.yaml](recipes/bitnami/postgresql/18.6.7/variants/static-passwords/variant.yaml)
Rendered objects: [recipes/bitnami/postgresql/18.6.7/revisions/static-passwords/r001/rendered/release-objects.yaml](recipes/bitnami/postgresql/18.6.7/revisions/static-passwords/r001/rendered/release-objects.yaml)
Helm equivalence: 7/7 objects matched
Receipts: [per-chart receipts](recipes/bitnami/postgresql/18.6.7/CATALOG.md)

##### existing-secret (recommended first)

When to use: postgresql existing Secret default variant rendered from bitnami/postgresql@18.6.7
Readiness: render-only
Namespace: postgresql
Target facts: required Secret postgresql/postgresql-auth keys postgres-password
Package base: [packages/bitnami/postgresql/18.6.7/bases/existing-secret](packages/bitnami/postgresql/18.6.7/bases/existing-secret)
Variant file: [recipes/bitnami/postgresql/18.6.7/variants/existing-secret/variant.yaml](recipes/bitnami/postgresql/18.6.7/variants/existing-secret/variant.yaml)
Rendered objects: [recipes/bitnami/postgresql/18.6.7/revisions/existing-secret/r001/rendered/release-objects.yaml](recipes/bitnami/postgresql/18.6.7/revisions/existing-secret/r001/rendered/release-objects.yaml)
Helm equivalence: 6/6 objects matched
Receipts: [per-chart receipts](recipes/bitnami/postgresql/18.6.7/CATALOG.md)


#### bitnami/rabbitmq@16.0.14

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: start-here
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2
Hard gap: ha (curated proof lane - bespoke teaching needed)
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-rabbitmq:16.0.14`
Source package: [packages/bitnami/rabbitmq/16.0.14](packages/bitnami/rabbitmq/16.0.14)
Per-chart catalog: [CATALOG.md](recipes/bitnami/rabbitmq/16.0.14/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/bitnami/rabbitmq/16.0.14/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-rabbitmq:16.0.14 --base existing-secret --work-dir <tmp> --non-interactive --namespace rabbitmq
```

Variants:

##### static-passwords

When to use: rabbitmq static password demo variant rendered from bitnami/rabbitmq@16.0.14
Readiness: start-here
Namespace: rabbitmq
Target facts: none
Package base: [packages/bitnami/rabbitmq/16.0.14/bases/static-passwords](packages/bitnami/rabbitmq/16.0.14/bases/static-passwords)
Variant file: [recipes/bitnami/rabbitmq/16.0.14/variants/static-passwords/variant.yaml](recipes/bitnami/rabbitmq/16.0.14/variants/static-passwords/variant.yaml)
Rendered objects: [recipes/bitnami/rabbitmq/16.0.14/revisions/static-passwords/r001/rendered/release-objects.yaml](recipes/bitnami/rabbitmq/16.0.14/revisions/static-passwords/r001/rendered/release-objects.yaml)
Helm equivalence: 10/10 objects matched
Receipts: [per-chart receipts](recipes/bitnami/rabbitmq/16.0.14/CATALOG.md)

##### existing-secret (recommended first)

When to use: rabbitmq existing Secret default variant rendered from bitnami/rabbitmq@16.0.14
Readiness: start-here
Namespace: rabbitmq
Target facts: required Secret rabbitmq/rabbitmq-auth keys rabbitmq-password; required Secret rabbitmq/rabbitmq-erlang-cookie keys rabbitmq-erlang-cookie
Package base: [packages/bitnami/rabbitmq/16.0.14/bases/existing-secret](packages/bitnami/rabbitmq/16.0.14/bases/existing-secret)
Variant file: [recipes/bitnami/rabbitmq/16.0.14/variants/existing-secret/variant.yaml](recipes/bitnami/rabbitmq/16.0.14/variants/existing-secret/variant.yaml)
Rendered objects: [recipes/bitnami/rabbitmq/16.0.14/revisions/existing-secret/r001/rendered/release-objects.yaml](recipes/bitnami/rabbitmq/16.0.14/revisions/existing-secret/r001/rendered/release-objects.yaml)
Helm equivalence: 9/9 objects matched
Receipts: [per-chart receipts](recipes/bitnami/rabbitmq/16.0.14/CATALOG.md)


#### prometheus-community/kube-prometheus-stack@85.3.3

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: render-only
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2
Hard gap: existing-secret (chart ships no Secret toggle)
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-kube-prometheus-stack:85.3.3`
Source package: [packages/prometheus-community/kube-prometheus-stack/85.3.3](packages/prometheus-community/kube-prometheus-stack/85.3.3)
Per-chart catalog: [CATALOG.md](recipes/prometheus-community/kube-prometheus-stack/85.3.3/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/prometheus-community/kube-prometheus-stack/85.3.3/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-kube-prometheus-stack:85.3.3 --base default --work-dir <tmp> --non-interactive --namespace monitoring
```

Variants:

##### default (recommended first)

When to use: kube-prometheus-stack default with Grafana password bound variant rendered from prometheus-community/kube-prometheus-stack@85.3.3
Readiness: render-only
Namespace: monitoring
Target facts: required Secret monitoring/kube-prometheus-stack-admission keys ca,cert,key; required CRD alertmanagerconfigs.monitoring.coreos.com; required CRD alertmanagers.monitoring.coreos.com; required CRD podmonitors.monitoring.coreos.com; required CRD probes.monitoring.coreos.com; required CRD prometheusagents.monitoring.coreos.com; required CRD prometheuses.monitoring.coreos.com; required CRD prometheusrules.monitoring.coreos.com; required CRD scrapeconfigs.monitoring.coreos.com; required CRD servicemonitors.monitoring.coreos.com; required CRD thanosrulers.monitoring.coreos.com
Package base: [packages/prometheus-community/kube-prometheus-stack/85.3.3/bases/default](packages/prometheus-community/kube-prometheus-stack/85.3.3/bases/default)
Variant file: [recipes/prometheus-community/kube-prometheus-stack/85.3.3/variants/default/variant.yaml](recipes/prometheus-community/kube-prometheus-stack/85.3.3/variants/default/variant.yaml)
Rendered objects: [recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/default/r001/rendered/release-objects.yaml](recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/default/r001/rendered/release-objects.yaml)
Helm equivalence: 124/124 objects matched
Receipts: [per-chart receipts](recipes/prometheus-community/kube-prometheus-stack/85.3.3/CATALOG.md)

##### no-crds

When to use: kube-prometheus-stack CRDs disabled variant rendered from prometheus-community/kube-prometheus-stack@85.3.3
Readiness: render-only
Namespace: monitoring
Target facts: required Secret monitoring/kube-prometheus-stack-admission keys ca,cert,key; required CRD alertmanagerconfigs.monitoring.coreos.com; required CRD alertmanagers.monitoring.coreos.com; required CRD podmonitors.monitoring.coreos.com; required CRD probes.monitoring.coreos.com; required CRD prometheusagents.monitoring.coreos.com; required CRD prometheuses.monitoring.coreos.com; required CRD prometheusrules.monitoring.coreos.com; required CRD scrapeconfigs.monitoring.coreos.com; required CRD servicemonitors.monitoring.coreos.com; required CRD thanosrulers.monitoring.coreos.com
Package base: [packages/prometheus-community/kube-prometheus-stack/85.3.3/bases/no-crds](packages/prometheus-community/kube-prometheus-stack/85.3.3/bases/no-crds)
Variant file: [recipes/prometheus-community/kube-prometheus-stack/85.3.3/variants/no-crds/variant.yaml](recipes/prometheus-community/kube-prometheus-stack/85.3.3/variants/no-crds/variant.yaml)
Rendered objects: [recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/no-crds/r001/rendered/release-objects.yaml](recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/no-crds/r001/rendered/release-objects.yaml)
Helm equivalence: 114/114 objects matched
Receipts: [per-chart receipts](recipes/prometheus-community/kube-prometheus-stack/85.3.3/CATALOG.md)


#### grafana/loki@7.0.0

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: start-here
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2
Hard gap: -
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-loki:7.0.0`
Source package: [packages/grafana/loki/7.0.0](packages/grafana/loki/7.0.0)
Per-chart catalog: [CATALOG.md](recipes/grafana/loki/7.0.0/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/grafana/loki/7.0.0/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-loki:7.0.0 --base single-binary-filesystem --work-dir <tmp> --non-interactive --namespace loki
```

Variants:

##### single-binary-filesystem (recommended first)

When to use: loki single binary filesystem variant rendered from grafana/loki@7.0.0
Readiness: start-here
Namespace: loki
Target facts: none
Package base: [packages/grafana/loki/7.0.0/bases/single-binary-filesystem](packages/grafana/loki/7.0.0/bases/single-binary-filesystem)
Variant file: [recipes/grafana/loki/7.0.0/variants/single-binary-filesystem/variant.yaml](recipes/grafana/loki/7.0.0/variants/single-binary-filesystem/variant.yaml)
Rendered objects: [recipes/grafana/loki/7.0.0/revisions/single-binary-filesystem/r001/rendered/release-objects.yaml](recipes/grafana/loki/7.0.0/revisions/single-binary-filesystem/r001/rendered/release-objects.yaml)
Helm equivalence: 19/19 objects matched
Receipts: [per-chart receipts](recipes/grafana/loki/7.0.0/CATALOG.md)

##### simple-scalable-minio

When to use: loki simple scalable with MinIO variant rendered from grafana/loki@7.0.0
Readiness: start-here
Namespace: loki
Target facts: none
Package base: [packages/grafana/loki/7.0.0/bases/simple-scalable-minio](packages/grafana/loki/7.0.0/bases/simple-scalable-minio)
Variant file: [recipes/grafana/loki/7.0.0/variants/simple-scalable-minio/variant.yaml](recipes/grafana/loki/7.0.0/variants/simple-scalable-minio/variant.yaml)
Rendered objects: [recipes/grafana/loki/7.0.0/revisions/simple-scalable-minio/r001/rendered/release-objects.yaml](recipes/grafana/loki/7.0.0/revisions/simple-scalable-minio/r001/rendered/release-objects.yaml)
Helm equivalence: 33/33 objects matched
Receipts: [per-chart receipts](recipes/grafana/loki/7.0.0/CATALOG.md)


#### longhorn/longhorn@1.11.2

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: start-here
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2
Hard gap: -
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/longhorn-longhorn:1.11.2`
Source package: [packages/longhorn/longhorn/1.11.2](packages/longhorn/longhorn/1.11.2)
Per-chart catalog: [CATALOG.md](recipes/longhorn/longhorn/1.11.2/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/longhorn/longhorn/1.11.2/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/longhorn-longhorn:1.11.2 --base default --work-dir <tmp> --non-interactive --namespace longhorn-system
```

Variants:

##### default (recommended first)

When to use: Longhorn default storage control plane variant rendered from longhorn/longhorn@1.11.2
Readiness: start-here
Namespace: longhorn-system
Target facts: none
Package base: [packages/longhorn/longhorn/1.11.2/bases/default](packages/longhorn/longhorn/1.11.2/bases/default)
Variant file: [recipes/longhorn/longhorn/1.11.2/variants/default/variant.yaml](recipes/longhorn/longhorn/1.11.2/variants/default/variant.yaml)
Rendered objects: [recipes/longhorn/longhorn/1.11.2/revisions/default/r001/rendered/release-objects.yaml](recipes/longhorn/longhorn/1.11.2/revisions/default/r001/rendered/release-objects.yaml)
Helm equivalence: 41/41 objects matched
Receipts: [per-chart receipts](recipes/longhorn/longhorn/1.11.2/CATALOG.md)

##### ui-ingress

When to use: Longhorn UI ingress enabled variant rendered from longhorn/longhorn@1.11.2
Readiness: start-here
Namespace: longhorn-system
Target facts: none
Package base: [packages/longhorn/longhorn/1.11.2/bases/ui-ingress](packages/longhorn/longhorn/1.11.2/bases/ui-ingress)
Variant file: [recipes/longhorn/longhorn/1.11.2/variants/ui-ingress/variant.yaml](recipes/longhorn/longhorn/1.11.2/variants/ui-ingress/variant.yaml)
Rendered objects: [recipes/longhorn/longhorn/1.11.2/revisions/ui-ingress/r001/rendered/release-objects.yaml](recipes/longhorn/longhorn/1.11.2/revisions/ui-ingress/r001/rendered/release-objects.yaml)
Helm equivalence: 42/42 objects matched
Receipts: [per-chart receipts](recipes/longhorn/longhorn/1.11.2/CATALOG.md)


#### bitnami/mysql@14.0.3

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: start-here
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2
Hard gap: ha (curated proof lane - bespoke teaching needed)
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-mysql:14.0.3`
Source package: [packages/bitnami/mysql/14.0.3](packages/bitnami/mysql/14.0.3)
Per-chart catalog: [CATALOG.md](recipes/bitnami/mysql/14.0.3/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/bitnami/mysql/14.0.3/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-mysql:14.0.3 --base existing-secret --work-dir <tmp> --non-interactive --namespace mysql
```

Variants:

##### static-passwords

When to use: mysql static password demo variant rendered from bitnami/mysql@14.0.3
Readiness: start-here
Namespace: mysql
Target facts: none
Package base: [packages/bitnami/mysql/14.0.3/bases/static-passwords](packages/bitnami/mysql/14.0.3/bases/static-passwords)
Variant file: [recipes/bitnami/mysql/14.0.3/variants/static-passwords/variant.yaml](recipes/bitnami/mysql/14.0.3/variants/static-passwords/variant.yaml)
Rendered objects: [recipes/bitnami/mysql/14.0.3/revisions/static-passwords/r001/rendered/release-objects.yaml](recipes/bitnami/mysql/14.0.3/revisions/static-passwords/r001/rendered/release-objects.yaml)
Helm equivalence: 8/8 objects matched
Receipts: [per-chart receipts](recipes/bitnami/mysql/14.0.3/CATALOG.md)

##### existing-secret (recommended first)

When to use: mysql existing Secret default variant rendered from bitnami/mysql@14.0.3
Readiness: start-here
Namespace: mysql
Target facts: required Secret mysql/mysql-auth keys mysql-root-password,mysql-password,mysql-replication-password
Package base: [packages/bitnami/mysql/14.0.3/bases/existing-secret](packages/bitnami/mysql/14.0.3/bases/existing-secret)
Variant file: [recipes/bitnami/mysql/14.0.3/variants/existing-secret/variant.yaml](recipes/bitnami/mysql/14.0.3/variants/existing-secret/variant.yaml)
Rendered objects: [recipes/bitnami/mysql/14.0.3/revisions/existing-secret/r001/rendered/release-objects.yaml](recipes/bitnami/mysql/14.0.3/revisions/existing-secret/r001/rendered/release-objects.yaml)
Helm equivalence: 7/7 objects matched
Receipts: [per-chart receipts](recipes/bitnami/mysql/14.0.3/CATALOG.md)


#### grafana/grafana@10.5.15

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: start-here
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2
Hard gap: -
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-grafana:10.5.15`
Source package: [packages/grafana/grafana/10.5.15](packages/grafana/grafana/10.5.15)
Per-chart catalog: [CATALOG.md](recipes/grafana/grafana/10.5.15/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/grafana/grafana/10.5.15/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-grafana:10.5.15 --base existing-secret-ingress --work-dir <tmp> --non-interactive --namespace grafana
```

Variants:

##### static-passwords

When to use: grafana static password demo variant rendered from grafana/grafana@10.5.15
Readiness: start-here
Namespace: grafana
Target facts: none
Package base: [packages/grafana/grafana/10.5.15/bases/static-passwords](packages/grafana/grafana/10.5.15/bases/static-passwords)
Variant file: [recipes/grafana/grafana/10.5.15/variants/static-passwords/variant.yaml](recipes/grafana/grafana/10.5.15/variants/static-passwords/variant.yaml)
Rendered objects: [recipes/grafana/grafana/10.5.15/revisions/static-passwords/r001/rendered/release-objects.yaml](recipes/grafana/grafana/10.5.15/revisions/static-passwords/r001/rendered/release-objects.yaml)
Helm equivalence: 9/9 objects matched
Receipts: [per-chart receipts](recipes/grafana/grafana/10.5.15/CATALOG.md)

##### existing-secret-ingress (recommended first)

When to use: grafana existing Secret default variant rendered from grafana/grafana@10.5.15
Readiness: start-here
Namespace: grafana
Target facts: required Secret grafana/grafana-admin keys admin-user,admin-password
Package base: [packages/grafana/grafana/10.5.15/bases/existing-secret-ingress](packages/grafana/grafana/10.5.15/bases/existing-secret-ingress)
Variant file: [recipes/grafana/grafana/10.5.15/variants/existing-secret-ingress/variant.yaml](recipes/grafana/grafana/10.5.15/variants/existing-secret-ingress/variant.yaml)
Rendered objects: [recipes/grafana/grafana/10.5.15/revisions/existing-secret-ingress/r001/rendered/release-objects.yaml](recipes/grafana/grafana/10.5.15/revisions/existing-secret-ingress/r001/rendered/release-objects.yaml)
Helm equivalence: 9/9 objects matched
Receipts: [per-chart receipts](recipes/grafana/grafana/10.5.15/CATALOG.md)


#### hashicorp/vault@0.32.0

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: start-here
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 3/3; ConfigHub 3/3; local live 2/3; GitOps live 2/3; live parity 2/3
Hard gap: -
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/hashicorp-vault:0.32.0`
Source package: [packages/hashicorp/vault/0.32.0](packages/hashicorp/vault/0.32.0)
Per-chart catalog: [CATALOG.md](recipes/hashicorp/vault/0.32.0/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/hashicorp/vault/0.32.0/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/hashicorp-vault:0.32.0 --base default --work-dir <tmp> --non-interactive --namespace vault
```

Variants:

##### dev-mode

When to use: vault dev server without init/unseal variant rendered from hashicorp/vault@0.32.0
Readiness: start-here
Namespace: vault
Target facts: none
Package base: [packages/hashicorp/vault/0.32.0/bases/dev-mode](packages/hashicorp/vault/0.32.0/bases/dev-mode)
Variant file: [recipes/hashicorp/vault/0.32.0/variants/dev-mode/variant.yaml](recipes/hashicorp/vault/0.32.0/variants/dev-mode/variant.yaml)
Rendered objects: [recipes/hashicorp/vault/0.32.0/revisions/dev-mode/r001/rendered/release-objects.yaml](recipes/hashicorp/vault/0.32.0/revisions/dev-mode/r001/rendered/release-objects.yaml)
Helm equivalence: 11/11 objects matched
Receipts: [per-chart receipts](recipes/hashicorp/vault/0.32.0/CATALOG.md)

##### default (recommended first)

When to use: vault default server with injector variant rendered from hashicorp/vault@0.32.0
Readiness: start-here
Namespace: vault
Target facts: none
Package base: [packages/hashicorp/vault/0.32.0/bases/default](packages/hashicorp/vault/0.32.0/bases/default)
Variant file: [recipes/hashicorp/vault/0.32.0/variants/default/variant.yaml](recipes/hashicorp/vault/0.32.0/variants/default/variant.yaml)
Rendered objects: [recipes/hashicorp/vault/0.32.0/revisions/default/r001/rendered/release-objects.yaml](recipes/hashicorp/vault/0.32.0/revisions/default/r001/rendered/release-objects.yaml)
Helm equivalence: 12/12 objects matched
Receipts: [per-chart receipts](recipes/hashicorp/vault/0.32.0/CATALOG.md)

##### ha-raft-ui

When to use: vault HA Raft with UI variant rendered from hashicorp/vault@0.32.0
Readiness: runtime-watch
Namespace: vault
Target facts: topology minSchedulableNodes=3
Package base: [packages/hashicorp/vault/0.32.0/bases/ha-raft-ui](packages/hashicorp/vault/0.32.0/bases/ha-raft-ui)
Variant file: [recipes/hashicorp/vault/0.32.0/variants/ha-raft-ui/variant.yaml](recipes/hashicorp/vault/0.32.0/variants/ha-raft-ui/variant.yaml)
Rendered objects: [recipes/hashicorp/vault/0.32.0/revisions/ha-raft-ui/r001/rendered/release-objects.yaml](recipes/hashicorp/vault/0.32.0/revisions/ha-raft-ui/r001/rendered/release-objects.yaml)
Helm equivalence: 18/18 objects matched
Receipts: [per-chart receipts](recipes/hashicorp/vault/0.32.0/CATALOG.md)


#### secrets-store-csi-driver/secrets-store-csi-driver@1.6.0

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: start-here
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2
Hard gap: -
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/secrets-store-csi-driver-secrets-store-csi-driver:1.6.0`
Source package: [packages/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0](packages/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0)
Per-chart catalog: [CATALOG.md](recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/secrets-store-csi-driver-secrets-store-csi-driver:1.6.0 --base default --work-dir <tmp> --non-interactive --namespace kube-system
```

Variants:

##### default (recommended first)

When to use: secrets-store-csi-driver default Linux driver variant rendered from secrets-store-csi-driver/secrets-store-csi-driver@1.6.0
Readiness: start-here
Namespace: kube-system
Target facts: none
Package base: [packages/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/bases/default](packages/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/bases/default)
Variant file: [recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/variants/default/variant.yaml](recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/variants/default/variant.yaml)
Rendered objects: [recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/revisions/default/r001/rendered/release-objects.yaml](recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/revisions/default/r001/rendered/release-objects.yaml)
Helm equivalence: 10/10 objects matched
Receipts: [per-chart receipts](recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/CATALOG.md)

##### sync-secret-rotation

When to use: secrets-store-csi-driver sync Secret and rotation variant rendered from secrets-store-csi-driver/secrets-store-csi-driver@1.6.0
Readiness: start-here
Namespace: kube-system
Target facts: none
Package base: [packages/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/bases/sync-secret-rotation](packages/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/bases/sync-secret-rotation)
Variant file: [recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/variants/sync-secret-rotation/variant.yaml](recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/variants/sync-secret-rotation/variant.yaml)
Rendered objects: [recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/revisions/sync-secret-rotation/r001/rendered/release-objects.yaml](recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/revisions/sync-secret-rotation/r001/rendered/release-objects.yaml)
Helm equivalence: 12/12 objects matched
Receipts: [per-chart receipts](recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/CATALOG.md)


#### prometheus-community/prometheus@29.8.0

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: render-only
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2
Hard gap: ha (curated proof lane - bespoke teaching needed)
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-prometheus:29.8.0`
Source package: [packages/prometheus-community/prometheus/29.8.0](packages/prometheus-community/prometheus/29.8.0)
Per-chart catalog: [CATALOG.md](recipes/prometheus-community/prometheus/29.8.0/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/prometheus-community/prometheus/29.8.0/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-prometheus:29.8.0 --base server-only-ephemeral --work-dir <tmp> --non-interactive --namespace monitoring
```

Variants:

##### default

When to use: prometheus default monitoring stack variant rendered from prometheus-community/prometheus@29.8.0
Readiness: render-only
Namespace: monitoring
Target facts: none
Package base: [packages/prometheus-community/prometheus/29.8.0/bases/default](packages/prometheus-community/prometheus/29.8.0/bases/default)
Variant file: [recipes/prometheus-community/prometheus/29.8.0/variants/default/variant.yaml](recipes/prometheus-community/prometheus/29.8.0/variants/default/variant.yaml)
Rendered objects: [recipes/prometheus-community/prometheus/29.8.0/revisions/default/r001/rendered/release-objects.yaml](recipes/prometheus-community/prometheus/29.8.0/revisions/default/r001/rendered/release-objects.yaml)
Helm equivalence: 23/23 objects matched
Receipts: [per-chart receipts](recipes/prometheus-community/prometheus/29.8.0/CATALOG.md)

##### server-only-ephemeral (recommended first)

When to use: prometheus server only without persistence variant rendered from prometheus-community/prometheus@29.8.0
Readiness: render-only
Namespace: monitoring
Target facts: none
Package base: [packages/prometheus-community/prometheus/29.8.0/bases/server-only-ephemeral](packages/prometheus-community/prometheus/29.8.0/bases/server-only-ephemeral)
Variant file: [recipes/prometheus-community/prometheus/29.8.0/variants/server-only-ephemeral/variant.yaml](recipes/prometheus-community/prometheus/29.8.0/variants/server-only-ephemeral/variant.yaml)
Rendered objects: [recipes/prometheus-community/prometheus/29.8.0/revisions/server-only-ephemeral/r001/rendered/release-objects.yaml](recipes/prometheus-community/prometheus/29.8.0/revisions/server-only-ephemeral/r001/rendered/release-objects.yaml)
Helm equivalence: 6/6 objects matched
Receipts: [per-chart receipts](recipes/prometheus-community/prometheus/29.8.0/CATALOG.md)


#### bitnami/mongodb@19.0.7

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: render-only
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2
Hard gap: -
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-mongodb:19.0.7`
Source package: [packages/bitnami/mongodb/19.0.7](packages/bitnami/mongodb/19.0.7)
Per-chart catalog: [CATALOG.md](recipes/bitnami/mongodb/19.0.7/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/bitnami/mongodb/19.0.7/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-mongodb:19.0.7 --base existing-secret-replicaset --work-dir <tmp> --non-interactive --namespace mongodb
```

Variants:

##### static-passwords

When to use: mongodb static password demo variant rendered from bitnami/mongodb@19.0.7
Readiness: render-only
Namespace: mongodb
Target facts: none
Package base: [packages/bitnami/mongodb/19.0.7/bases/static-passwords](packages/bitnami/mongodb/19.0.7/bases/static-passwords)
Variant file: [recipes/bitnami/mongodb/19.0.7/variants/static-passwords/variant.yaml](recipes/bitnami/mongodb/19.0.7/variants/static-passwords/variant.yaml)
Rendered objects: [recipes/bitnami/mongodb/19.0.7/revisions/static-passwords/r001/rendered/release-objects.yaml](recipes/bitnami/mongodb/19.0.7/revisions/static-passwords/r001/rendered/release-objects.yaml)
Helm equivalence: 8/8 objects matched
Receipts: [per-chart receipts](recipes/bitnami/mongodb/19.0.7/CATALOG.md)

##### existing-secret-replicaset (recommended first)

When to use: mongodb existing Secret default variant rendered from bitnami/mongodb@19.0.7
Readiness: render-only
Namespace: mongodb
Target facts: required Secret mongodb/mongodb-auth keys mongodb-root-password,mongodb-replica-set-key
Package base: [packages/bitnami/mongodb/19.0.7/bases/existing-secret-replicaset](packages/bitnami/mongodb/19.0.7/bases/existing-secret-replicaset)
Variant file: [recipes/bitnami/mongodb/19.0.7/variants/existing-secret-replicaset/variant.yaml](recipes/bitnami/mongodb/19.0.7/variants/existing-secret-replicaset/variant.yaml)
Rendered objects: [recipes/bitnami/mongodb/19.0.7/revisions/existing-secret-replicaset/r001/rendered/release-objects.yaml](recipes/bitnami/mongodb/19.0.7/revisions/existing-secret-replicaset/r001/rendered/release-objects.yaml)
Helm equivalence: 10/10 objects matched
Receipts: [per-chart receipts](recipes/bitnami/mongodb/19.0.7/CATALOG.md)


#### bitnami/nginx@24.0.2

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: render-only
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 2/2; ConfigHub 2/2; local live 2/2; GitOps live 2/2; live parity 2/2
Hard gap: existing-secret (chart ships no Secret toggle)
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-nginx:24.0.2`
Source package: [packages/bitnami/nginx/24.0.2](packages/bitnami/nginx/24.0.2)
Per-chart catalog: [CATALOG.md](recipes/bitnami/nginx/24.0.2/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/bitnami/nginx/24.0.2/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-nginx:24.0.2 --base http-clusterip --work-dir <tmp> --non-interactive --namespace nginx
```

Variants:

##### http-clusterip (recommended first)

When to use: nginx plain HTTP ClusterIP variant rendered from bitnami/nginx@24.0.2
Readiness: render-only
Namespace: nginx
Target facts: none
Package base: [packages/bitnami/nginx/24.0.2/bases/http-clusterip](packages/bitnami/nginx/24.0.2/bases/http-clusterip)
Variant file: [recipes/bitnami/nginx/24.0.2/variants/http-clusterip/variant.yaml](recipes/bitnami/nginx/24.0.2/variants/http-clusterip/variant.yaml)
Rendered objects: [recipes/bitnami/nginx/24.0.2/revisions/http-clusterip/r001/rendered/release-objects.yaml](recipes/bitnami/nginx/24.0.2/revisions/http-clusterip/r001/rendered/release-objects.yaml)
Helm equivalence: 5/5 objects matched
Receipts: [per-chart receipts](recipes/bitnami/nginx/24.0.2/CATALOG.md)

##### existing-tls-ingress

When to use: nginx existing TLS with ingress variant rendered from bitnami/nginx@24.0.2
Readiness: render-only
Namespace: nginx
Target facts: required Secret nginx/nginx-backend-tls keys tls.crt,tls.key,ca.crt; required Secret nginx/nginx-ingress-tls keys tls.crt,tls.key
Package base: [packages/bitnami/nginx/24.0.2/bases/existing-tls-ingress](packages/bitnami/nginx/24.0.2/bases/existing-tls-ingress)
Variant file: [recipes/bitnami/nginx/24.0.2/variants/existing-tls-ingress/variant.yaml](recipes/bitnami/nginx/24.0.2/variants/existing-tls-ingress/variant.yaml)
Rendered objects: [recipes/bitnami/nginx/24.0.2/revisions/existing-tls-ingress/r001/rendered/release-objects.yaml](recipes/bitnami/nginx/24.0.2/revisions/existing-tls-ingress/r001/rendered/release-objects.yaml)
Helm equivalence: 6/6 objects matched
Receipts: [per-chart receipts](recipes/bitnami/nginx/24.0.2/CATALOG.md)


#### grafana/tempo@1.24.4

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: start-here
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 2/2; ConfigHub 2/2; local live 1/2; GitOps live 1/2; live parity 1/2
Hard gap: ha (tempo single-binary chart; HA is the separate tempo-distributed chart)
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-tempo:1.24.4`
Source package: [packages/grafana/tempo/1.24.4](packages/grafana/tempo/1.24.4)
Per-chart catalog: [CATALOG.md](recipes/grafana/tempo/1.24.4/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/grafana/tempo/1.24.4/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-tempo:1.24.4 --base local-persistent --work-dir <tmp> --non-interactive --namespace tempo
```

Variants:

##### local-persistent (recommended first)

When to use: tempo local persistent single-binary variant rendered from grafana/tempo@1.24.4
Readiness: start-here
Namespace: tempo
Target facts: none
Package base: [packages/grafana/tempo/1.24.4/bases/local-persistent](packages/grafana/tempo/1.24.4/bases/local-persistent)
Variant file: [recipes/grafana/tempo/1.24.4/variants/local-persistent/variant.yaml](recipes/grafana/tempo/1.24.4/variants/local-persistent/variant.yaml)
Rendered objects: [recipes/grafana/tempo/1.24.4/revisions/local-persistent/r001/rendered/release-objects.yaml](recipes/grafana/tempo/1.24.4/revisions/local-persistent/r001/rendered/release-objects.yaml)
Helm equivalence: 4/4 objects matched
Receipts: [per-chart receipts](recipes/grafana/tempo/1.24.4/CATALOG.md)

##### s3-query-observability

When to use: tempo S3 query and observability variant rendered from grafana/tempo@1.24.4
Readiness: runtime-watch
Namespace: tempo
Target facts: required Secret tempo/tempo-s3-credentials keys access_key,secret_key; required CRD servicemonitors.monitoring.coreos.com; required S3CompatibleObjectStore tempo/tempo-object-store; required Value tempo.storage.trace.s3.endpoint (pre-render); required Value tempo.storage.trace.s3.bucket (pre-render); required Value tempo.storage.trace.s3.region (pre-render)
Package base: [packages/grafana/tempo/1.24.4/bases/s3-query-observability](packages/grafana/tempo/1.24.4/bases/s3-query-observability)
Variant file: [recipes/grafana/tempo/1.24.4/variants/s3-query-observability/variant.yaml](recipes/grafana/tempo/1.24.4/variants/s3-query-observability/variant.yaml)
Rendered objects: [recipes/grafana/tempo/1.24.4/revisions/s3-query-observability/r001/rendered/release-objects.yaml](recipes/grafana/tempo/1.24.4/revisions/s3-query-observability/r001/rendered/release-objects.yaml)
Helm equivalence: 8/8 objects matched
Receipts: [per-chart receipts](recipes/grafana/tempo/1.24.4/CATALOG.md)


#### hashicorp/consul@2.0.0

Status: catalog-supported
Production readiness: production-review-ready
Start base readiness: start-here
Strongest evidence: live-helm-vs-confighub-parity
Proof lanes: render parity 2/2; ConfigHub 2/2; local live 1/2; GitOps live 1/2; live parity 1/2
Hard gap: ha (curated proof lane - bespoke teaching needed)
Installer package OCI: `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/hashicorp-consul:2.0.0`
Source package: [packages/hashicorp/consul/2.0.0](packages/hashicorp/consul/2.0.0)
Per-chart catalog: [CATALOG.md](recipes/hashicorp/consul/2.0.0/CATALOG.md)
Helm pain report: [helm-pain-report.yaml](recipes/hashicorp/consul/2.0.0/helm-pain-report.yaml)

Start here:

```sh
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/hashicorp-consul:2.0.0 --base default-control-plane --work-dir <tmp> --non-interactive --namespace consul
```

Variants:

##### default-control-plane (recommended first)

When to use: consul default control plane variant rendered from hashicorp/consul@2.0.0
Readiness: start-here
Namespace: consul
Target facts: none
Package base: [packages/hashicorp/consul/2.0.0/bases/default-control-plane](packages/hashicorp/consul/2.0.0/bases/default-control-plane)
Variant file: [recipes/hashicorp/consul/2.0.0/variants/default-control-plane/variant.yaml](recipes/hashicorp/consul/2.0.0/variants/default-control-plane/variant.yaml)
Rendered objects: [recipes/hashicorp/consul/2.0.0/revisions/default-control-plane/r001/rendered/release-objects.yaml](recipes/hashicorp/consul/2.0.0/revisions/default-control-plane/r001/rendered/release-objects.yaml)
Helm equivalence: 68/68 objects matched
Receipts: [per-chart receipts](recipes/hashicorp/consul/2.0.0/CATALOG.md)

##### secure-mesh-existing-secrets

When to use: consul secure mesh with existing Secrets variant rendered from hashicorp/consul@2.0.0
Readiness: runtime-watch
Namespace: consul
Target facts: required Secret consul/consul-ca-cert keys tls.crt; required Secret consul/consul-server-cert keys tls.crt,tls.key; required Secret consul/consul-gossip-encryption-key keys key; required Secret consul/consul-bootstrap-acl-token keys token; topology minSchedulableNodes=3
Package base: [packages/hashicorp/consul/2.0.0/bases/secure-mesh-existing-secrets](packages/hashicorp/consul/2.0.0/bases/secure-mesh-existing-secrets)
Variant file: [recipes/hashicorp/consul/2.0.0/variants/secure-mesh-existing-secrets/variant.yaml](recipes/hashicorp/consul/2.0.0/variants/secure-mesh-existing-secrets/variant.yaml)
Rendered objects: [recipes/hashicorp/consul/2.0.0/revisions/secure-mesh-existing-secrets/r001/rendered/release-objects.yaml](recipes/hashicorp/consul/2.0.0/revisions/secure-mesh-existing-secrets/r001/rendered/release-objects.yaml)
Helm equivalence: 97/97 objects matched
Receipts: [per-chart receipts](recipes/hashicorp/consul/2.0.0/CATALOG.md)


## Full Proof Index (110 Entries)

The rows below include the live-tested top 20, proof-grade recipe/package
artifacts, and any retained newer chart-version candidates. `catalog-supported`
means reviewed variants for the declared scope. `catalog-candidate` means
a newer or richer candidate is visible for review but is not the supported
catalog version. `proof-grade` means machine-verified artifacts that still
need catalog promotion review before support is claimed.

| Chart | Status | Bucket | Evidence | Start With | Package OCI | Hard Gap | Catalog |
| --- | --- | --- | --- | --- | --- | --- | --- |
| bitnami/redis@25.5.3 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | reuse-existing-secret | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-redis:25.5.3` | - | [CATALOG.md](recipes/bitnami/redis/25.5.3/CATALOG.md) |
| metrics-server/metrics-server@3.13.0 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/metrics-server-metrics-server:3.13.0` | existing-secret (chart ships no Secret toggle) | [CATALOG.md](recipes/metrics-server/metrics-server/3.13.0/CATALOG.md) |
| ingress-nginx/ingress-nginx@4.15.1 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | internal-clusterip | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/ingress-nginx-ingress-nginx:4.15.1` | - | [CATALOG.md](recipes/ingress-nginx/ingress-nginx/4.15.1/CATALOG.md) |
| jetstack/cert-manager@v1.20.2 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | crds-enabled | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/jetstack-cert-manager:v1.20.2` | - | [CATALOG.md](recipes/jetstack/cert-manager/v1.20.2/CATALOG.md) |
| external-secrets/external-secrets@2.5.0 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/external-secrets-external-secrets:2.5.0` | - | [CATALOG.md](recipes/external-secrets/external-secrets/2.5.0/CATALOG.md) |
| argo-cd/argo-cd@9.5.15 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/argo-cd-argo-cd:9.5.15` | ha (curated proof lane - bespoke teaching needed) | [CATALOG.md](recipes/argo-cd/argo-cd/9.5.15/CATALOG.md) |
| bitnami/postgresql@18.6.7 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | existing-secret | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-postgresql:18.6.7` | ha (curated proof lane - bespoke teaching needed) | [CATALOG.md](recipes/bitnami/postgresql/18.6.7/CATALOG.md) |
| bitnami/rabbitmq@16.0.14 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | existing-secret | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-rabbitmq:16.0.14` | ha (curated proof lane - bespoke teaching needed) | [CATALOG.md](recipes/bitnami/rabbitmq/16.0.14/CATALOG.md) |
| prometheus-community/kube-prometheus-stack@85.3.3 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-kube-prometheus-stack:85.3.3` | existing-secret (chart ships no Secret toggle) | [CATALOG.md](recipes/prometheus-community/kube-prometheus-stack/85.3.3/CATALOG.md) |
| grafana/loki@7.0.0 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | single-binary-filesystem | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-loki:7.0.0` | - | [CATALOG.md](recipes/grafana/loki/7.0.0/CATALOG.md) |
| longhorn/longhorn@1.11.2 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/longhorn-longhorn:1.11.2` | - | [CATALOG.md](recipes/longhorn/longhorn/1.11.2/CATALOG.md) |
| bitnami/mysql@14.0.3 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | existing-secret | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-mysql:14.0.3` | ha (curated proof lane - bespoke teaching needed) | [CATALOG.md](recipes/bitnami/mysql/14.0.3/CATALOG.md) |
| grafana/grafana@10.5.15 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | existing-secret-ingress | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-grafana:10.5.15` | - | [CATALOG.md](recipes/grafana/grafana/10.5.15/CATALOG.md) |
| hashicorp/vault@0.32.0 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/hashicorp-vault:0.32.0` | - | [CATALOG.md](recipes/hashicorp/vault/0.32.0/CATALOG.md) |
| secrets-store-csi-driver/secrets-store-csi-driver@1.6.0 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/secrets-store-csi-driver-secrets-store-csi-driver:1.6.0` | - | [CATALOG.md](recipes/secrets-store-csi-driver/secrets-store-csi-driver/1.6.0/CATALOG.md) |
| prometheus-community/prometheus@29.8.0 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | server-only-ephemeral | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-prometheus:29.8.0` | ha (curated proof lane - bespoke teaching needed) | [CATALOG.md](recipes/prometheus-community/prometheus/29.8.0/CATALOG.md) |
| bitnami/mongodb@19.0.7 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | existing-secret-replicaset | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-mongodb:19.0.7` | - | [CATALOG.md](recipes/bitnami/mongodb/19.0.7/CATALOG.md) |
| bitnami/nginx@24.0.2 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | http-clusterip | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-nginx:24.0.2` | existing-secret (chart ships no Secret toggle) | [CATALOG.md](recipes/bitnami/nginx/24.0.2/CATALOG.md) |
| grafana/tempo@1.24.4 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | local-persistent | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-tempo:1.24.4` | ha (tempo single-binary chart; HA is the separate tempo-distributed chart) | [CATALOG.md](recipes/grafana/tempo/1.24.4/CATALOG.md) |
| hashicorp/consul@2.0.0 | catalog-supported | try-from-public-catalog | live-helm-vs-confighub-parity | default-control-plane | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/hashicorp-consul:2.0.0` | ha (curated proof lane - bespoke teaching needed) | [CATALOG.md](recipes/hashicorp/consul/2.0.0/CATALOG.md) |
| aqua/trivy-operator@0.32.1 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/aqua-trivy-operator:0.32.1` | - | [CATALOG.md](recipes/aqua/trivy-operator/0.32.1/CATALOG.md) |
| argo-cd/argo-cd@9.5.17 | catalog-candidate | - | - | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/argo-cd-argo-cd:9.5.17` | - | [CATALOG.md](recipes/argo-cd/argo-cd/9.5.17/CATALOG.md) |
| argo-cd/argo-events@2.4.21 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/argo-cd-argo-events:2.4.21` | - | [CATALOG.md](recipes/argo-cd/argo-events/2.4.21/CATALOG.md) |
| argo-cd/argo-rollouts@2.40.9 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/argo-cd-argo-rollouts:2.40.9` | - | [CATALOG.md](recipes/argo-cd/argo-rollouts/2.40.9/CATALOG.md) |
| argo-cd/argo-workflows@1.0.14 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/argo-cd-argo-workflows:1.0.14` | - | [CATALOG.md](recipes/argo-cd/argo-workflows/1.0.14/CATALOG.md) |
| argo-cd/argocd-image-updater@1.2.2 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/argo-cd-argocd-image-updater:1.2.2` | no-crds (template-baked CRDs; no clean chart toggle yet) | [CATALOG.md](recipes/argo-cd/argocd-image-updater/1.2.2/CATALOG.md) |
| autoscaler/cluster-autoscaler@9.57.0 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/autoscaler-cluster-autoscaler:9.57.0` | - | [CATALOG.md](recipes/autoscaler/cluster-autoscaler/9.57.0/CATALOG.md) |
| autoscaler/vertical-pod-autoscaler@0.9.0 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/autoscaler-vertical-pod-autoscaler:0.9.0` | - | [CATALOG.md](recipes/autoscaler/vertical-pod-autoscaler/0.9.0/CATALOG.md) |
| aws-ebs-csi-driver/aws-ebs-csi-driver@2.60.1 | proof-grade | needs-useful-variant | in-confighub-proof | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/aws-ebs-csi-driver-aws-ebs-csi-driver:2.60.1` | - | [CATALOG.md](recipes/aws-ebs-csi-driver/aws-ebs-csi-driver/2.60.1/CATALOG.md) |
| bitnami/apache@11.4.29 | proof-grade | limitation-decision-first | local-kubernetes-live | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-apache:11.4.29` | existing-secret (chart ships no Secret toggle) | [CATALOG.md](recipes/bitnami/apache/11.4.29/CATALOG.md) |
| bitnami/contour@21.1.4 | proof-grade | limitation-decision-first | two-cluster-kind-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-contour:21.1.4` | existing-secret (chart ships no Secret toggle) | [CATALOG.md](recipes/bitnami/contour/21.1.4/CATALOG.md) |
| bitnami/elasticsearch@22.1.6 | proof-grade | limitation-decision-first | local-kubernetes-live | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-elasticsearch:22.1.6` | existing-secret (chart ships no Secret toggle) | [CATALOG.md](recipes/bitnami/elasticsearch/22.1.6/CATALOG.md) |
| bitnami/memcached@8.5.5 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-memcached:8.5.5` | existing-secret (chart ships no Secret toggle) | [CATALOG.md](recipes/bitnami/memcached/8.5.5/CATALOG.md) |
| bitnami/mongodb@19.0.9 | catalog-candidate | - | - | existing-secret-replicaset | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-mongodb:19.0.9` | - | [CATALOG.md](recipes/bitnami/mongodb/19.0.9/CATALOG.md) |
| bitnami/mongodb@19.1.0 | catalog-candidate | - | - | existing-secret-replicaset | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-mongodb:19.1.0` | - | [CATALOG.md](recipes/bitnami/mongodb/19.1.0/CATALOG.md) |
| bitnami/nginx@24.0.4 | catalog-candidate | - | - | http-clusterip | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-nginx:24.0.4` | - | [CATALOG.md](recipes/bitnami/nginx/24.0.4/CATALOG.md) |
| bitnami/nginx@25.0.0 | catalog-candidate | - | - | http-clusterip | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-nginx:25.0.0` | - | [CATALOG.md](recipes/bitnami/nginx/25.0.0/CATALOG.md) |
| bitnami/opensearch@2.0.10 | proof-grade | promote-after-review | local-kubernetes-live | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-opensearch:2.0.10` | - | [CATALOG.md](recipes/bitnami/opensearch/2.0.10/CATALOG.md) |
| bitnami/phpmyadmin@20.0.0 | proof-grade | limitation-decision-first | local-kubernetes-live | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-phpmyadmin:20.0.0` | existing-secret (chart ships no Secret toggle) | [CATALOG.md](recipes/bitnami/phpmyadmin/20.0.0/CATALOG.md) |
| bitnami/postgresql@18.6.10 | catalog-candidate | - | - | existing-secret | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-postgresql:18.6.10` | - | [CATALOG.md](recipes/bitnami/postgresql/18.6.10/CATALOG.md) |
| bitnami/postgresql@18.7.0 | catalog-candidate | - | - | existing-secret | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-postgresql:18.7.0` | - | [CATALOG.md](recipes/bitnami/postgresql/18.7.0/CATALOG.md) |
| bitnami/redis@27.0.0 | catalog-candidate | - | - | reuse-existing-secret | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-redis:27.0.0` | - | [CATALOG.md](recipes/bitnami/redis/27.0.0/CATALOG.md) |
| bitnami/spark@10.0.3 | proof-grade | limitation-decision-first | local-kubernetes-live | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-spark:10.0.3` | existing-secret (chart ships no Secret toggle) | [CATALOG.md](recipes/bitnami/spark/10.0.3/CATALOG.md) |
| bitnami/zookeeper@13.8.7 | proof-grade | limitation-decision-first | local-kubernetes-live | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-zookeeper:13.8.7` | existing-secret (chart ships no Secret toggle) | [CATALOG.md](recipes/bitnami/zookeeper/13.8.7/CATALOG.md) |
| cloudnative-pg/cloudnative-pg@0.28.2 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/cloudnative-pg-cloudnative-pg:0.28.2` | - | [CATALOG.md](recipes/cloudnative-pg/cloudnative-pg/0.28.2/CATALOG.md) |
| coredns/coredns@1.45.2 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/coredns-coredns:1.45.2` | - | [CATALOG.md](recipes/coredns/coredns/1.45.2/CATALOG.md) |
| crossplane-stable/crossplane@2.3.1 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/crossplane-stable-crossplane:2.3.1` | - | [CATALOG.md](recipes/crossplane-stable/crossplane/2.3.1/CATALOG.md) |
| descheduler/descheduler@0.36.0 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/descheduler-descheduler:0.36.0` | - | [CATALOG.md](recipes/descheduler/descheduler/0.36.0/CATALOG.md) |
| dex/dex@0.24.0 | proof-grade | needs-useful-variant | in-confighub-proof | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/dex-dex:0.24.0` | - | [CATALOG.md](recipes/dex/dex/0.24.0/CATALOG.md) |
| elastic/eck-operator@3.4.0 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/elastic-eck-operator:3.4.0` | - | [CATALOG.md](recipes/elastic/eck-operator/3.4.0/CATALOG.md) |
| elastic/filebeat@8.5.1 | proof-grade | promote-after-review | in-confighub-proof | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/elastic-filebeat:8.5.1` | - | [CATALOG.md](recipes/elastic/filebeat/8.5.1/CATALOG.md) |
| elastic/kibana@8.5.1 | proof-grade | needs-useful-variant | in-confighub-proof | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/elastic-kibana:8.5.1` | - | [CATALOG.md](recipes/elastic/kibana/8.5.1/CATALOG.md) |
| elastic/logstash@8.5.1 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/elastic-logstash:8.5.1` | - | [CATALOG.md](recipes/elastic/logstash/8.5.1/CATALOG.md) |
| elastic/metricbeat@8.5.1 | proof-grade | needs-useful-variant | in-confighub-proof | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/elastic-metricbeat:8.5.1` | - | [CATALOG.md](recipes/elastic/metricbeat/8.5.1/CATALOG.md) |
| external-dns/external-dns@1.21.1 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/external-dns-external-dns:1.21.1` | - | [CATALOG.md](recipes/external-dns/external-dns/1.21.1/CATALOG.md) |
| fairwinds-stable/goldilocks@10.3.0 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/fairwinds-stable-goldilocks:10.3.0` | existing-secret (chart ships no Secret toggle) | [CATALOG.md](recipes/fairwinds-stable/goldilocks/10.3.0/CATALOG.md) |
| fairwinds-stable/vpa@4.11.0 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/fairwinds-stable-vpa:4.11.0` | - | [CATALOG.md](recipes/fairwinds-stable/vpa/4.11.0/CATALOG.md) |
| falcosecurity/falco@9.0.0 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/falcosecurity-falco:9.0.0` | - | [CATALOG.md](recipes/falcosecurity/falco/9.0.0/CATALOG.md) |
| falcosecurity/falcosidekick@0.13.1 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/falcosecurity-falcosidekick:0.13.1` | - | [CATALOG.md](recipes/falcosecurity/falcosidekick/0.13.1/CATALOG.md) |
| fluent/fluent-bit@0.57.6 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/fluent-fluent-bit:0.57.6` | - | [CATALOG.md](recipes/fluent/fluent-bit/0.57.6/CATALOG.md) |
| fluent/fluentd@0.5.3 | proof-grade | needs-useful-variant | two-cluster-kind-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/fluent-fluentd:0.5.3` | - | [CATALOG.md](recipes/fluent/fluentd/0.5.3/CATALOG.md) |
| gatekeeper/gatekeeper@3.22.2 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/gatekeeper-gatekeeper:3.22.2` | - | [CATALOG.md](recipes/gatekeeper/gatekeeper/3.22.2/CATALOG.md) |
| gitlab/gitlab-runner@0.89.0 | proof-grade | needs-useful-variant | in-confighub-proof | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/gitlab-gitlab-runner:0.89.0` | - | [CATALOG.md](recipes/gitlab/gitlab-runner/0.89.0/CATALOG.md) |
| grafana/alloy@1.8.2 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-alloy:1.8.2` | - | [CATALOG.md](recipes/grafana/alloy/1.8.2/CATALOG.md) |
| grafana/promtail@6.17.1 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-promtail:6.17.1` | - | [CATALOG.md](recipes/grafana/promtail/6.17.1/CATALOG.md) |
| grafana/pyroscope@2.0.2 | proof-grade | limitation-decision-first | two-cluster-kind-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-pyroscope:2.0.2` | existing-secret (chart ships no Secret toggle) | [CATALOG.md](recipes/grafana/pyroscope/2.0.2/CATALOG.md) |
| grafana/rollout-operator@0.49.0 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/grafana-rollout-operator:0.49.0` | - | [CATALOG.md](recipes/grafana/rollout-operator/0.49.0/CATALOG.md) |
| haproxytech/kubernetes-ingress@1.52.0 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/haproxytech-kubernetes-ingress:1.52.0` | - | [CATALOG.md](recipes/haproxytech/kubernetes-ingress/1.52.0/CATALOG.md) |
| hashicorp/terraform@1.1.2 | proof-grade | promote-after-review | in-confighub-proof | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/hashicorp-terraform:1.1.2` | - | [CATALOG.md](recipes/hashicorp/terraform/1.1.2/CATALOG.md) |
| istio/gateway@1.30.0 | proof-grade | promote-after-review | in-confighub-proof | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/istio-gateway:1.30.0` | - | [CATALOG.md](recipes/istio/gateway/1.30.0/CATALOG.md) |
| istio/istiod@1.30.0 | proof-grade | needs-useful-variant | in-confighub-proof | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/istio-istiod:1.30.0` | - | [CATALOG.md](recipes/istio/istiod/1.30.0/CATALOG.md) |
| jaegertracing/jaeger-operator@2.57.0 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/jaegertracing-jaeger-operator:2.57.0` | - | [CATALOG.md](recipes/jaegertracing/jaeger-operator/2.57.0/CATALOG.md) |
| jaegertracing/jaeger@4.8.0 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/jaegertracing-jaeger:4.8.0` | existing-secret (chart ships no Secret toggle) | [CATALOG.md](recipes/jaegertracing/jaeger/4.8.0/CATALOG.md) |
| jetstack/cert-manager-csi-driver@v0.14.0 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/jetstack-cert-manager-csi-driver:v0.14.0` | - | [CATALOG.md](recipes/jetstack/cert-manager-csi-driver/v0.14.0/CATALOG.md) |
| jetstack/trust-manager@v0.22.1 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/jetstack-trust-manager:v0.22.1` | - | [CATALOG.md](recipes/jetstack/trust-manager/v0.22.1/CATALOG.md) |
| kedacore/keda@2.19.0 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/kedacore-keda:2.19.0` | - | [CATALOG.md](recipes/kedacore/keda/2.19.0/CATALOG.md) |
| kyverno/kyverno-policies@3.8.0 | proof-grade | needs-useful-variant | local-kubernetes-live | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/kyverno-kyverno-policies:3.8.0` | - | [CATALOG.md](recipes/kyverno/kyverno-policies/3.8.0/CATALOG.md) |
| kyverno/kyverno@3.8.1 | proof-grade | limitation-decision-first | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/kyverno-kyverno:3.8.1` | existing-secret (chart ships no Secret toggle) | [CATALOG.md](recipes/kyverno/kyverno/3.8.1/CATALOG.md) |
| linkerd/linkerd-crds@1.8.0 | proof-grade | needs-useful-variant | two-cluster-kind-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/linkerd-linkerd-crds:1.8.0` | - | [CATALOG.md](recipes/linkerd/linkerd-crds/1.8.0/CATALOG.md) |
| minio-operator/operator@7.1.1 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/minio-operator-operator:7.1.1` | no-crds (template-baked CRDs; no clean chart toggle yet) | [CATALOG.md](recipes/minio-operator/operator/7.1.1/CATALOG.md) |
| minio-operator/tenant@7.1.1 | proof-grade | needs-useful-variant | two-cluster-kind-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/minio-operator-tenant:7.1.1` | - | [CATALOG.md](recipes/minio-operator/tenant/7.1.1/CATALOG.md) |
| nats/nack@0.34.0 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/nats-nack:0.34.0` | - | [CATALOG.md](recipes/nats/nack/0.34.0/CATALOG.md) |
| nats/nats@2.14.0 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/nats-nats:2.14.0` | - | [CATALOG.md](recipes/nats/nats/2.14.0/CATALOG.md) |
| nats/surveyor@0.20.9 | proof-grade | promote-after-review | in-confighub-proof | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/nats-surveyor:0.20.9` | - | [CATALOG.md](recipes/nats/surveyor/0.20.9/CATALOG.md) |
| nfs-subdir-external-provisioner/nfs-subdir-external-provisioner@4.0.18 | proof-grade | needs-useful-variant | in-confighub-proof | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/nfs-subdir-external-provisioner-nfs-subdir-external-provisioner:4.0.18` | - | [CATALOG.md](recipes/nfs-subdir-external-provisioner/nfs-subdir-external-provisioner/4.0.18/CATALOG.md) |
| open-telemetry/opentelemetry-operator@0.114.0 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/open-telemetry-opentelemetry-operator:0.114.0` | - | [CATALOG.md](recipes/open-telemetry/opentelemetry-operator/0.114.0/CATALOG.md) |
| opencost/opencost@2.5.21 | proof-grade | needs-useful-variant | in-confighub-proof | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/opencost-opencost:2.5.21` | - | [CATALOG.md](recipes/opencost/opencost/2.5.21/CATALOG.md) |
| percona/pg-operator@3.0.0 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/percona-pg-operator:3.0.0` | - | [CATALOG.md](recipes/percona/pg-operator/3.0.0/CATALOG.md) |
| percona/psmdb-operator@1.22.0 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/percona-psmdb-operator:1.22.0` | - | [CATALOG.md](recipes/percona/psmdb-operator/1.22.0/CATALOG.md) |
| percona/pxc-operator@1.19.1 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/percona-pxc-operator:1.19.1` | - | [CATALOG.md](recipes/percona/pxc-operator/1.19.1/CATALOG.md) |
| projectcalico/tigera-operator@v3.32.0 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/projectcalico-tigera-operator:v3.32.0` | - | [CATALOG.md](recipes/projectcalico/tigera-operator/v3.32.0/CATALOG.md) |
| prometheus-community/alertmanager@1.37.0 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-alertmanager:1.37.0` | - | [CATALOG.md](recipes/prometheus-community/alertmanager/1.37.0/CATALOG.md) |
| prometheus-community/kube-prometheus-stack@86.1.0 | catalog-candidate | - | - | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-kube-prometheus-stack:86.1.0` | - | [CATALOG.md](recipes/prometheus-community/kube-prometheus-stack/86.1.0/CATALOG.md) |
| prometheus-community/kube-state-metrics@7.4.0 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-kube-state-metrics:7.4.0` | - | [CATALOG.md](recipes/prometheus-community/kube-state-metrics/7.4.0/CATALOG.md) |
| prometheus-community/prometheus-adapter@5.3.0 | proof-grade | not-ready | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-prometheus-adapter:5.3.0` | - | [CATALOG.md](recipes/prometheus-community/prometheus-adapter/5.3.0/CATALOG.md) |
| prometheus-community/prometheus-blackbox-exporter@11.10.0 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-prometheus-blackbox-exporter:11.10.0` | - | [CATALOG.md](recipes/prometheus-community/prometheus-blackbox-exporter/11.10.0/CATALOG.md) |
| prometheus-community/prometheus-node-exporter@4.55.0 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-prometheus-node-exporter:4.55.0` | - | [CATALOG.md](recipes/prometheus-community/prometheus-node-exporter/4.55.0/CATALOG.md) |
| prometheus-community/prometheus-operator-crds@29.0.0 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-prometheus-operator-crds:29.0.0` | - | [CATALOG.md](recipes/prometheus-community/prometheus-operator-crds/29.0.0/CATALOG.md) |
| prometheus-community/prometheus-pushgateway@3.6.0 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-prometheus-pushgateway:3.6.0` | - | [CATALOG.md](recipes/prometheus-community/prometheus-pushgateway/3.6.0/CATALOG.md) |
| prometheus-community/prometheus@29.9.0 | catalog-candidate | - | - | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/prometheus-community-prometheus:29.9.0` | - | [CATALOG.md](recipes/prometheus-community/prometheus/29.9.0/CATALOG.md) |
| rook-release/rook-ceph-cluster@v1.19.5 | proof-grade | needs-useful-variant | local-kubernetes-live | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/rook-release-rook-ceph-cluster:v1.19.5` | - | [CATALOG.md](recipes/rook-release/rook-ceph-cluster/v1.19.5/CATALOG.md) |
| rook-release/rook-ceph@v1.19.5 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/rook-release-rook-ceph:v1.19.5` | no-crds (template-baked CRDs; no clean chart toggle yet) | [CATALOG.md](recipes/rook-release/rook-ceph/v1.19.5/CATALOG.md) |
| runix/pgadmin4@1.62.0 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/runix-pgadmin4:1.62.0` | - | [CATALOG.md](recipes/runix/pgadmin4/1.62.0/CATALOG.md) |
| sealed-secrets/sealed-secrets@2.18.6 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/sealed-secrets-sealed-secrets:2.18.6` | - | [CATALOG.md](recipes/sealed-secrets/sealed-secrets/2.18.6/CATALOG.md) |
| stakater/reloader@2.2.12 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/stakater-reloader:2.2.12` | - | [CATALOG.md](recipes/stakater/reloader/2.2.12/CATALOG.md) |
| strimzi/strimzi-kafka-operator@1.0.0 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/strimzi-strimzi-kafka-operator:1.0.0` | - | [CATALOG.md](recipes/strimzi/strimzi-kafka-operator/1.0.0/CATALOG.md) |
| traefik/traefik@40.2.0 | proof-grade | limitation-decision-first | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/traefik-traefik:40.2.0` | existing-secret (chart ships no Secret toggle) | [CATALOG.md](recipes/traefik/traefik/40.2.0/CATALOG.md) |
| velero/velero@12.0.1 | proof-grade | promote-after-review | in-confighub-proof | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/velero-velero:12.0.1` | - | [CATALOG.md](recipes/velero/velero/12.0.1/CATALOG.md) |
| vm/victoria-logs-single@0.12.5 | proof-grade | needs-useful-variant | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/vm-victoria-logs-single:0.12.5` | - | [CATALOG.md](recipes/vm/victoria-logs-single/0.12.5/CATALOG.md) |
| vm/victoria-metrics-single@0.39.0 | proof-grade | promote-after-review | live-helm-vs-confighub-parity | default | `oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/vm-victoria-metrics-single:0.39.0` | - | [CATALOG.md](recipes/vm/victoria-metrics-single/0.39.0/CATALOG.md) |