apiVersion: "catalog.confighub.com/v1alpha1" kind: "ApplyPolicyLiveReceipt" metadata: name: "helm-catalog-catalog-standard" spec: organization: "helm-catalog" profile: "catalog-standard" verifiedAt: "2026-07-30T13:28:35.489Z" filters: baseline: ref: "platform/helm-catalog-checks" displayName: "Catalog checks before apply" id: "305d4b12-fd04-43ad-8aeb-be53c34a1b36" where: "Space.Slug = 'platform' AND Slug ~ '^(aicr-training-images-pinned|aicr-training-secret-refs|digest-pinned-images|lifecycle-route-evidence|probes-declared|vet-placeholders|vet-schemas)$'" triggers: - ref: "platform/aicr-training-images-pinned" displayName: "Warn - AICR training image is not pinned by digest" functionName: "vet-cel" arguments: - name: "expression" value: "!has(r.apiVersion) || r.apiVersion != \"trainer.kubeflow.org/v1alpha1\" || !has(r.kind) || r.kind != \"ClusterTrainingRuntime\" || (has(r.spec) && has(r.spec.template) && has(r.spec.template.spec) && has(r.spec.template.spec.replicatedJobs) && size(r.spec.template.spec.replicatedJobs) > 0 && r.spec.template.spec.replicatedJobs.all(j, has(j.template) && has(j.template.spec) && has(j.template.spec.template) && has(j.template.spec.template.spec) && has(j.template.spec.template.spec.containers) && size(j.template.spec.template.spec.containers) > 0 && j.template.spec.template.spec.containers.all(c, has(c.image) && c.image.contains(\"@sha256:\"))))" description: "This catalog apply warning checks an AICR ClusterTrainingRuntime before apply. It reports a training image that is not pinned by digest, because the image could change without a configuration revision. It does not block apply. Pin the training image by digest or review and accept the warning." effect: "warn" validating: true - ref: "platform/aicr-training-secret-refs" displayName: "Block apply - AICR API key must use a Secret" functionName: "vet-cel" arguments: - name: "expression" value: "!has(r.apiVersion) || r.apiVersion != \"trainer.kubeflow.org/v1alpha1\" || !has(r.kind) || r.kind != \"ClusterTrainingRuntime\" || (has(r.spec) && has(r.spec.template) && has(r.spec.template.spec) && has(r.spec.template.spec.replicatedJobs) && r.spec.template.spec.replicatedJobs.all(j, has(j.template) && has(j.template.spec) && has(j.template.spec.template) && has(j.template.spec.template.spec) && has(j.template.spec.template.spec.containers) && j.template.spec.template.spec.containers.all(c, !has(c.env) || c.env.all(e, !has(e.name) || e.name != \"AI_API_KEY\" || (!has(e.value) && has(e.valueFrom) && has(e.valueFrom.secretKeyRef) && has(e.valueFrom.secretKeyRef.name) && e.valueFrom.secretKeyRef.name != \"\" && has(e.valueFrom.secretKeyRef.key) && e.valueFrom.secretKeyRef.key != \"\")))))" description: "This catalog apply gate blocks an AICR ClusterTrainingRuntime that writes AI_API_KEY directly into the object. Change the environment variable to refer to a named Kubernetes Secret and key, then try the apply again." effect: "block" validating: true - ref: "platform/digest-pinned-images" displayName: "Warn - workload image is not pinned by digest" functionName: "vet-cel" arguments: - name: "expression" value: "!has(r.kind) || !(r.kind in [\"Deployment\", \"StatefulSet\", \"DaemonSet\", \"ReplicaSet\", \"Job\"]) || (has(r.spec) && has(r.spec.template) && has(r.spec.template.spec) && has(r.spec.template.spec.containers) && r.spec.template.spec.containers.all(c, has(c.image) && c.image.contains(\"@sha256:\")))" description: "This catalog apply warning checks the exact Kubernetes objects stored in ConfigHub before apply. It reports an ordinary workload image that is not pinned by digest, because the image could change without a configuration revision. It does not block apply. Pin the image by digest or review and accept the warning." effect: "warn" validating: true - ref: "platform/lifecycle-route-evidence" displayName: "Block apply - lifecycle route needs evidence" functionName: "vet-cel" arguments: - name: "expression" value: "!has(r.kind) || r.kind != \"LifecycleRoute\" || (has(r.spec) && has(r.spec.chart) && r.spec.chart != \"\" && has(r.spec.version) && r.spec.version != \"\" && has(r.spec.base) && r.spec.base != \"\" && has(r.spec.routeName) && r.spec.routeName != \"\" && has(r.spec.executionMode) && r.spec.executionMode in [\"product-executes\", \"user-executes\", \"target-owned\", \"not-yet-executable\"] && has(r.spec.automatic) && has(r.spec.disposition) && has(r.spec.evidence) && size(r.spec.evidence) > 0 && (!r.spec.automatic || r.spec.disposition == \"observed\"))" description: "This catalog apply gate checks a recorded LifecycleRoute before apply. It blocks a route that omits its chart, version, preset, executor, disposition, or evidence, and a route cannot claim automatic execution without an observed receipt. Complete the route or mark the work as not yet automatic. This gate does not discover missing hooks or CRDs when no route was recorded." effect: "block" validating: true - ref: "platform/probes-declared" displayName: "Warn - workload health probes are missing" functionName: "vet-cel" arguments: - name: "expression" value: "!has(r.kind) || !(r.kind in [\"Deployment\", \"StatefulSet\", \"DaemonSet\", \"ReplicaSet\"]) || (has(r.spec) && has(r.spec.template) && has(r.spec.template.spec) && has(r.spec.template.spec.containers) && r.spec.template.spec.containers.all(c, has(c.livenessProbe) && has(c.readinessProbe)))" description: "This catalog apply warning checks the exact Kubernetes objects stored in ConfigHub before apply. It reports a long-running workload container that has no readiness or liveness probe. It does not block apply. Add suitable probes or review and accept the warning." effect: "warn" validating: true - ref: "platform/vet-placeholders" displayName: "Block apply - replace unfinished placeholders" functionName: "vet-placeholders" arguments: [] description: "This catalog apply gate blocks ConfigHub apply while unresolved placeholders remain. Replace each placeholder with the real value or the correct target-owned Secret reference, then try the apply again." effect: "block" validating: true - ref: "platform/vet-schemas" displayName: "Block apply - Kubernetes schema must be valid" functionName: "vet-schemas" arguments: [] description: "This catalog apply gate checks the exact Kubernetes objects stored in ConfigHub and blocks apply when data fails its declared schema. Correct the reported field or type, then try the apply again." effect: "block" validating: true approvalRequired: ref: "platform/helm-catalog-prod-gates" displayName: "Catalog checks and approval before apply" id: "8784a447-0e4d-4471-b924-eae5377778a2" where: "Space.Slug = 'platform' AND Slug ~ '^(aicr-training-images-pinned|aicr-training-secret-refs|digest-pinned-images|lifecycle-route-evidence|probes-declared|require-approval|vet-placeholders|vet-schemas)$'" triggers: - ref: "platform/aicr-training-images-pinned" displayName: "Warn - AICR training image is not pinned by digest" functionName: "vet-cel" arguments: - name: "expression" value: "!has(r.apiVersion) || r.apiVersion != \"trainer.kubeflow.org/v1alpha1\" || !has(r.kind) || r.kind != \"ClusterTrainingRuntime\" || (has(r.spec) && has(r.spec.template) && has(r.spec.template.spec) && has(r.spec.template.spec.replicatedJobs) && size(r.spec.template.spec.replicatedJobs) > 0 && r.spec.template.spec.replicatedJobs.all(j, has(j.template) && has(j.template.spec) && has(j.template.spec.template) && has(j.template.spec.template.spec) && has(j.template.spec.template.spec.containers) && size(j.template.spec.template.spec.containers) > 0 && j.template.spec.template.spec.containers.all(c, has(c.image) && c.image.contains(\"@sha256:\"))))" description: "This catalog apply warning checks an AICR ClusterTrainingRuntime before apply. It reports a training image that is not pinned by digest, because the image could change without a configuration revision. It does not block apply. Pin the training image by digest or review and accept the warning." effect: "warn" validating: true - ref: "platform/aicr-training-secret-refs" displayName: "Block apply - AICR API key must use a Secret" functionName: "vet-cel" arguments: - name: "expression" value: "!has(r.apiVersion) || r.apiVersion != \"trainer.kubeflow.org/v1alpha1\" || !has(r.kind) || r.kind != \"ClusterTrainingRuntime\" || (has(r.spec) && has(r.spec.template) && has(r.spec.template.spec) && has(r.spec.template.spec.replicatedJobs) && r.spec.template.spec.replicatedJobs.all(j, has(j.template) && has(j.template.spec) && has(j.template.spec.template) && has(j.template.spec.template.spec) && has(j.template.spec.template.spec.containers) && j.template.spec.template.spec.containers.all(c, !has(c.env) || c.env.all(e, !has(e.name) || e.name != \"AI_API_KEY\" || (!has(e.value) && has(e.valueFrom) && has(e.valueFrom.secretKeyRef) && has(e.valueFrom.secretKeyRef.name) && e.valueFrom.secretKeyRef.name != \"\" && has(e.valueFrom.secretKeyRef.key) && e.valueFrom.secretKeyRef.key != \"\")))))" description: "This catalog apply gate blocks an AICR ClusterTrainingRuntime that writes AI_API_KEY directly into the object. Change the environment variable to refer to a named Kubernetes Secret and key, then try the apply again." effect: "block" validating: true - ref: "platform/digest-pinned-images" displayName: "Warn - workload image is not pinned by digest" functionName: "vet-cel" arguments: - name: "expression" value: "!has(r.kind) || !(r.kind in [\"Deployment\", \"StatefulSet\", \"DaemonSet\", \"ReplicaSet\", \"Job\"]) || (has(r.spec) && has(r.spec.template) && has(r.spec.template.spec) && has(r.spec.template.spec.containers) && r.spec.template.spec.containers.all(c, has(c.image) && c.image.contains(\"@sha256:\")))" description: "This catalog apply warning checks the exact Kubernetes objects stored in ConfigHub before apply. It reports an ordinary workload image that is not pinned by digest, because the image could change without a configuration revision. It does not block apply. Pin the image by digest or review and accept the warning." effect: "warn" validating: true - ref: "platform/lifecycle-route-evidence" displayName: "Block apply - lifecycle route needs evidence" functionName: "vet-cel" arguments: - name: "expression" value: "!has(r.kind) || r.kind != \"LifecycleRoute\" || (has(r.spec) && has(r.spec.chart) && r.spec.chart != \"\" && has(r.spec.version) && r.spec.version != \"\" && has(r.spec.base) && r.spec.base != \"\" && has(r.spec.routeName) && r.spec.routeName != \"\" && has(r.spec.executionMode) && r.spec.executionMode in [\"product-executes\", \"user-executes\", \"target-owned\", \"not-yet-executable\"] && has(r.spec.automatic) && has(r.spec.disposition) && has(r.spec.evidence) && size(r.spec.evidence) > 0 && (!r.spec.automatic || r.spec.disposition == \"observed\"))" description: "This catalog apply gate checks a recorded LifecycleRoute before apply. It blocks a route that omits its chart, version, preset, executor, disposition, or evidence, and a route cannot claim automatic execution without an observed receipt. Complete the route or mark the work as not yet automatic. This gate does not discover missing hooks or CRDs when no route was recorded." effect: "block" validating: true - ref: "platform/probes-declared" displayName: "Warn - workload health probes are missing" functionName: "vet-cel" arguments: - name: "expression" value: "!has(r.kind) || !(r.kind in [\"Deployment\", \"StatefulSet\", \"DaemonSet\", \"ReplicaSet\"]) || (has(r.spec) && has(r.spec.template) && has(r.spec.template.spec) && has(r.spec.template.spec.containers) && r.spec.template.spec.containers.all(c, has(c.livenessProbe) && has(c.readinessProbe)))" description: "This catalog apply warning checks the exact Kubernetes objects stored in ConfigHub before apply. It reports a long-running workload container that has no readiness or liveness probe. It does not block apply. Add suitable probes or review and accept the warning." effect: "warn" validating: true - ref: "platform/require-approval" displayName: "Block apply - approval is required" functionName: "vet-approvedby" arguments: - name: "num-approvers" value: "1" description: "This catalog apply gate is used only for production and system configuration. It blocks ConfigHub apply until one person approves the exact revision. Approve that revision after review, then try the apply again." effect: "block" validating: true - ref: "platform/vet-placeholders" displayName: "Block apply - replace unfinished placeholders" functionName: "vet-placeholders" arguments: [] description: "This catalog apply gate blocks ConfigHub apply while unresolved placeholders remain. Replace each placeholder with the real value or the correct target-owned Secret reference, then try the apply again." effect: "block" validating: true - ref: "platform/vet-schemas" displayName: "Block apply - Kubernetes schema must be valid" functionName: "vet-schemas" arguments: [] description: "This catalog apply gate checks the exact Kubernetes objects stored in ConfigHub and blocks apply when data fails its declared schema. Correct the reported field or type, then try the apply again." effect: "block" validating: true definitionSpace: ref: "platform" whereTrigger: "Slug = '__no-policy-space-trigger__'" triggerFilterID: null spaces: baseline: - "argo-cd-argo-cd-9-5-15-default" - "argo-cd-argo-cd-9-5-15-no-crds" - "bitnami-mysql-14-0-3-existing-secret" - "bitnami-mysql-14-0-3-static-passwords" - "bitnami-nginx-24-0-2-existing-tls-ingress" - "bitnami-nginx-24-0-2-http-clusterip" - "bitnami-nginx-fleet-dev" - "bitnami-nginx-fleet-staging" - "bitnami-rabbitmq-16-0-14-existing-secret" - "bitnami-rabbitmq-16-0-14-static-passwords" - "bitnami-redis-25-5-3-default" - "bitnami-redis-25-5-3-reuse-existing-secret" - "byo-nginx-ai-values-24-0-2-development" - "byo-nginx-ai-values-24-0-2-reviewed" - "byo-nginx-ai-values-24-0-2-staging" - "existing-oci-nginx-replicas-4" - "grafana-grafana-10-5-15-existing-secret-ingress" - "grafana-grafana-10-5-15-static-passwords" - "hashicorp-vault-0-32-0-default" - "hashicorp-vault-0-32-0-dev-mode" - "hashicorp-vault-0-32-0-ha-raft-ui" - "hashicorp-vault-demo-base" - "hashicorp-vault-env-dev" - "hashicorp-vault-env-staging" - "hook-probe-base" - "ingress-nginx-ingress-nginx-4-15-1-admission-disabled" - "ingress-nginx-ingress-nginx-4-15-1-default" - "ingress-nginx-ingress-nginx-4-15-1-internal-clusterip" - "plain-yaml-acme-web-base" - "prometheus-community-kube-prometheus-stack-85-3-3-no-crds" - "prometheus-community-prometheus-29-8-0-default" - "prometheus-community-prometheus-29-8-0-server-only-ephemeral" - "route-sketch-kube-prometheus-stack" approvalRequired: - "aicr-eks-h100-training-kubeflow-v0-14-0-argocd" - "aicr-eks-h100-training-kubeflow-v0-14-0-argocd-development" - "aicr-eks-h100-training-kubeflow-v0-14-0-argocd-staging" - "bitnami-nginx-fleet-prod-eu" - "bitnami-nginx-fleet-prod-us" - "bitnami-redis-prod" - "hashicorp-vault-env-prod" - "kubara-local-platform-v0-12-0" - "sveltos-kyverno-fleet-3-8-1-staging" approvalReasons: production: - "bitnami-nginx-fleet-prod-eu" - "bitnami-nginx-fleet-prod-us" - "bitnami-redis-prod" - "hashicorp-vault-env-prod" systemConfiguration: - "aicr-eks-h100-training-kubeflow-v0-14-0-argocd" - "aicr-eks-h100-training-kubeflow-v0-14-0-argocd-development" - "aicr-eks-h100-training-kubeflow-v0-14-0-argocd-staging" - "kubara-local-platform-v0-12-0" - "sveltos-kyverno-fleet-3-8-1-staging" sourceTypes: helm: - "byo-nginx-ai-values-24-0-2-development" - "byo-nginx-ai-values-24-0-2-reviewed" - "byo-nginx-ai-values-24-0-2-staging" aicr: - "aicr-eks-h100-training-kubeflow-v0-14-0-argocd" - "aicr-eks-h100-training-kubeflow-v0-14-0-argocd-development" - "aicr-eks-h100-training-kubeflow-v0-14-0-argocd-staging" cub-installer: - "argo-cd-argo-cd-9-5-15-default" - "argo-cd-argo-cd-9-5-15-no-crds" - "bitnami-mysql-14-0-3-existing-secret" - "bitnami-mysql-14-0-3-static-passwords" - "bitnami-nginx-24-0-2-existing-tls-ingress" - "bitnami-nginx-24-0-2-http-clusterip" - "bitnami-nginx-fleet-dev" - "bitnami-nginx-fleet-prod-eu" - "bitnami-nginx-fleet-prod-us" - "bitnami-nginx-fleet-staging" - "bitnami-rabbitmq-16-0-14-existing-secret" - "bitnami-rabbitmq-16-0-14-static-passwords" - "bitnami-redis-25-5-3-default" - "bitnami-redis-25-5-3-reuse-existing-secret" - "bitnami-redis-prod" - "grafana-grafana-10-5-15-existing-secret-ingress" - "grafana-grafana-10-5-15-static-passwords" - "hashicorp-vault-0-32-0-default" - "hashicorp-vault-0-32-0-dev-mode" - "hashicorp-vault-0-32-0-ha-raft-ui" - "hashicorp-vault-demo-base" - "hashicorp-vault-env-dev" - "hashicorp-vault-env-prod" - "hashicorp-vault-env-staging" - "ingress-nginx-ingress-nginx-4-15-1-admission-disabled" - "ingress-nginx-ingress-nginx-4-15-1-default" - "ingress-nginx-ingress-nginx-4-15-1-internal-clusterip" - "prometheus-community-kube-prometheus-stack-85-3-3-no-crds" - "prometheus-community-prometheus-29-8-0-default" - "prometheus-community-prometheus-29-8-0-server-only-ephemeral" kubara: - "kubara-local-platform-v0-12-0" sveltos: - "sveltos-kyverno-fleet-3-8-1-staging" rendered-config: - "existing-oci-nginx-replicas-4" - "hook-probe-base" - "plain-yaml-acme-web-base" - "route-sketch-kube-prometheus-stack" operationalExamples: nginx-user-workload: space: "bitnami-nginx-24-0-2-http-clusterip" labels: ResourceClass: "user-workload" OwnerClass: "application-team" ChangeCadence: "application-release" OperationalClassExample: "nginx-user-workload" policySet: "baseline" prometheus-system-service: space: "prometheus-community-kube-prometheus-stack-85-3-3-no-crds" labels: ResourceClass: "system-service" OwnerClass: "platform-service-team" ChangeCadence: "planned-service-release" OperationalClassExample: "prometheus-system-service" policySet: "baseline" kubara-system-configuration: space: "kubara-local-platform-v0-12-0" labels: ResourceClass: "system-configuration" OwnerClass: "platform-team" ChangeCadence: "planned-platform-release" OperationalClassExample: "kubara-system-configuration" policySet: "approvalRequired" excluded: - "bitnami-redis-27-0-0-default-pilot-live-20260705" - "bitnami-redis-base" - "bitnami-redis-staging" - "default" - "platform" status: result: "pass" findings: [] limits: - "This receipt checks live filter definitions, selected Triggers, and Space assignments." - "It does not claim that a deliberately invalid configuration was applied."