apiVersion: "catalog.confighub.com/v1alpha1"
kind: "BaseVariantRecord"
metadata:
  name: "gatekeeper-gatekeeper-3-22-2-default"
  labels:
    sourceType: "helm"
    component: "gatekeeper/gatekeeper"
    sourceVersion: "3.22.2"
    base: "default"
spec:
  source:
    type: "helm"
    name: "gatekeeper/gatekeeper"
    version: "3.22.2"
    record: "data/helm-render-intents/intents/gatekeeper-gatekeeper-3-22-2-default.yaml"
    packageOciRef: "oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/gatekeeper-gatekeeper:3.22.2"
  baseVariant:
    name: "default"
    revision: "r001"
    digest: "57649ce2ff654a2900d594b5aac09186f35e6349fd72d333922229b7d2c6e49a"
  configuration:
    format: "kubernetes-yaml"
    objects: "recipes/gatekeeper/gatekeeper/3.22.2/revisions/default/r001/rendered/release-objects.yaml"
    inventory: "recipes/gatekeeper/gatekeeper/3.22.2/revisions/default/r001/rendered/object-inventory.yaml"
    objectCount: 30
  inputs:
    fixedAtBuildTime:
      - "chart=gatekeeper/gatekeeper"
      - "version=3.22.2"
      - "base=default"
      - "valuesProfile=recipes/gatekeeper/gatekeeper/3.22.2/effective-values.yaml"
      - "namespace=default"
      - "releaseName=gatekeeper"
      - "capabilityProfile={\"apiVersions\":[],\"kubeVersion\":\"1.30.0\"}"
    installTime:
      []
    installTimeStatus: "not-yet-declared"
  routing:
    routes:
      -
        routeName: "preflight-or-presync"
        quirkClass: "hook-phase"
        lifecyclePhase: "preflight"
        actionKind: "run-preflight"
        executionMode: "user-executes"
        automatic: false
        whoRuns: "Your delivery — a preflight step before apply (receipted)"
        operatingDetails: "CRD and admission-webhook prerequisites must be checked before apply."
        command: "kubectl apply -f <preflight-job>; kubectl wait --for=condition=complete job/<name>"
        disposition: "observed"
        delta: "kept"
        reason: ""
        routeSourceVersion: "3.22.2"
        evidence:
          - "data/hook-lifecycle/receipts/gatekeeper-gatekeeper/default/latest.yaml"
          - "data/hook-lifecycle/top100-hooks.csv"
          - "recipes/gatekeeper/gatekeeper/3.22.2/helm-pain-report.yaml"
          - "runs/hook-lifecycle/gatekeeper-gatekeeper/default/latest/receipt.yaml"
        nextAction: ""
        evidenceRequired: "already has a live receipt; keep it fresh when chart, base, or cluster version changes"
        sourceDrift: ""
        gitOps:
          emitsControllerStep: true
          argoCd: "PreSync · sync-wave -1"
          flux: "apply before the release (Kustomization dependsOn)"
          argoCdSnippet: "metadata:\n  annotations:\n    argocd.argoproj.io/hook: PreSync\n    argocd.argoproj.io/hook-delete-policy: HookSucceeded\n    argocd.argoproj.io/sync-wave: \"-1\""
        runners:
          direct:
            implementation: "kubectl apply -f <preflight-job>; kubectl wait --for=condition=complete job/<name>"
            status: "evidence-linked"
            evidence:
              - "runs/hook-lifecycle/gatekeeper-gatekeeper/default/latest/receipt.yaml"
          argoCd:
            implementation: "PreSync · sync-wave -1"
            status: "mapping-only"
            evidence:
              []
          flux:
            implementation: "apply before the release (Kustomization dependsOn)"
            status: "mapping-only"
            evidence:
              []
      -
        routeName: "upgrade-action-with-receipt"
        quirkClass: "hook-phase"
        lifecyclePhase: "pre-apply"
        actionKind: "run-job"
        executionMode: "user-executes"
        automatic: false
        whoRuns: "Your delivery — a GitOps PreSync/PostSync or cub action (receipted)"
        operatingDetails: "The pinned rendered CRD route must be recorded as a target-aware operation before stronger upgrade claims."
        command: "kubectl apply -f <action-job>; kubectl wait --for=condition=complete job/<name>"
        disposition: "observed"
        delta: "kept"
        reason: ""
        routeSourceVersion: "3.22.2"
        evidence:
          - "data/hook-lifecycle/receipts/gatekeeper-gatekeeper/default/latest.yaml"
          - "data/hook-lifecycle/top100-hooks.csv"
          - "recipes/gatekeeper/gatekeeper/3.22.2/helm-pain-report.yaml"
          - "runs/hook-lifecycle/gatekeeper-gatekeeper/default/latest/receipt.yaml"
        nextAction: ""
        evidenceRequired: "already has a live receipt; keep it fresh when chart, base, or cluster version changes"
        sourceDrift: ""
        gitOps:
          emitsControllerStep: true
          argoCd: "PreSync"
          flux: "apply before the release (Kustomization dependsOn)"
          argoCdSnippet: "metadata:\n  annotations:\n    argocd.argoproj.io/hook: PreSync\n    argocd.argoproj.io/hook-delete-policy: HookSucceeded"
        runners:
          direct:
            implementation: "kubectl apply -f <action-job>; kubectl wait --for=condition=complete job/<name>"
            status: "evidence-linked"
            evidence:
              - "runs/hook-lifecycle/gatekeeper-gatekeeper/default/latest/receipt.yaml"
          argoCd:
            implementation: "PreSync"
            status: "mapping-only"
            evidence:
              []
          flux:
            implementation: "apply before the release (Kustomization dependsOn)"
            status: "mapping-only"
            evidence:
              []
    targetFacts:
      status: "none-declared-or-observed"
      declared:
        {}
      requirements:
        []
      actions:
        []
      coverage:
        state: "actionable-gap"
        reason: "This base has not recorded whether it needs a Secret, CRD, namespace, value, storage service, external API, or target topology."
        declarationSource: ""
        nextAction: "Review the base and record its target prerequisites, or add an explicit empty targetFacts declaration when none are required."
    sourceRecord: "data/helm-render-intents/intents/gatekeeper-gatekeeper-3-22-2-default.yaml"
  delivery:
    literalConfigOci:
      status: "not-published-in-this-record"
      note: "The installer package contains several preset configurations. A literal OCI bundle for this one base needs its own publication receipt."
    configHubReleaseOci:
      status: "not-recorded-for-this-base"
      note: "No current ConfigHub Space release OCI receipt is recorded for this exact base."
    argoCd: "not-recorded-for-this-base"
    flux: "not-recorded-for-this-base"
    direct: "not-recorded-for-this-base"
    historicalGitopsOciStatus: "yes"
  policy:
    profile: "catalog-standard"
    productionAdds:
      - "human-approval"
  evidence:
    renderParity: "yes"
    confighubScanOps: "yes"
    localKind: "yes"
    lifecycleObserved: "yes"
    gitopsOciLive: "yes"
    liveDualParity: "yes"
    twoClusterKind: "yes"
    variantPromotion: "proven"
  operations:
    resourceClass: "not-yet-classified"
    ownerClass: "not-yet-classified"
    changeCadence: "not-yet-classified"
status:
  level: "available"
  claim: "The Helm source record, committed rendered objects, revision digest, routes, target facts, and proof-lane statuses are indexed here."
  limits:
    - "This record does not claim that the base has been uploaded to a live ConfigHub Space."
    - "The small typed install-time surface is not yet complete for every Helm base."
    - "A multi-preset installer package OCI is not the same as a single literal configuration OCI."