apiVersion: "catalog.confighub.com/v1alpha1"
kind: "BaseVariantRecord"
metadata:
  name: "hashicorp-consul-2-0-0-secure-mesh-existing-secrets"
  labels:
    sourceType: "helm"
    component: "hashicorp/consul"
    sourceVersion: "2.0.0"
    base: "secure-mesh-existing-secrets"
spec:
  source:
    type: "helm"
    name: "hashicorp/consul"
    version: "2.0.0"
    record: "data/helm-render-intents/intents/hashicorp-consul-2-0-0-secure-mesh-existing-secrets.yaml"
    packageOciRef: "oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/hashicorp-consul:2.0.0"
  baseVariant:
    name: "secure-mesh-existing-secrets"
    revision: "r001"
    digest: "f1c903c0195ac960a1108142730b10044eeba6c0ad8649c743b483a4c88976d3"
  configuration:
    format: "kubernetes-yaml"
    objects: "recipes/hashicorp/consul/2.0.0/revisions/secure-mesh-existing-secrets/r001/rendered/release-objects.yaml"
    inventory: "recipes/hashicorp/consul/2.0.0/revisions/secure-mesh-existing-secrets/r001/rendered/object-inventory.yaml"
    objectCount: 97
  inputs:
    fixedAtBuildTime:
      - "chart=hashicorp/consul"
      - "version=2.0.0"
      - "base=secure-mesh-existing-secrets"
      - "valuesProfile=recipes/hashicorp/consul/2.0.0/effective-values-secure-mesh-existing-secrets.yaml"
      - "namespace=consul"
      - "releaseName=consul"
      - "capabilityProfile={\"apiVersions\":[],\"kubeVersion\":\"1.30.0\"}"
    installTime:
      -
        name: "consul-ca-cert"
        type: "requiredSecrets"
        required: true
        details:
          keys:
            - "tls.crt"
          name: "consul-ca-cert"
          namespace: "consul"
          purpose: "Consul TLS CA certificate; must sign consul-server-cert"
      -
        name: "consul-server-cert"
        type: "requiredSecrets"
        required: true
        details:
          caSecretName: "consul-ca-cert"
          keys:
            - "tls.crt"
            - "tls.key"
          name: "consul-server-cert"
          namespace: "consul"
          purpose: "Consul server TLS certificate and private key; certificate SANs must cover server.dc1.consul and rendered consul-consul-server service DNS names"
          requiredDNSNames:
            - "server.dc1.consul"
            - "consul-consul-server"
            - "consul-consul-server.consul"
            - "consul-consul-server.consul.svc"
            - "consul-consul-server.consul-helm"
            - "consul-consul-server.consul-helm.svc"
            - "consul-consul-server.consul-apply"
            - "consul-consul-server.consul-apply.svc"
            - "consul-consul-server.consul-oci"
            - "consul-consul-server.consul-oci.svc"
      -
        name: "consul-gossip-encryption-key"
        type: "requiredSecrets"
        required: true
        details:
          keys:
            - "key"
          name: "consul-gossip-encryption-key"
          namespace: "consul"
          purpose: "Consul gossip encryption key"
      -
        name: "consul-bootstrap-acl-token"
        type: "requiredSecrets"
        required: true
        details:
          keys:
            - "token"
          name: "consul-bootstrap-acl-token"
          namespace: "consul"
          purpose: "Consul ACL bootstrap token"
      -
        name: "requiredTopology-1"
        type: "requiredTopology"
        required: true
        details:
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
          minimumSchedulableNodes: 3
          purpose: "Consul secure mesh renders three server replicas with anti-affinity and gateway workloads."
    installTimeStatus: "partly-declared"
  routing:
    routes:
      []
    targetFacts:
      status: "declared-target-facts"
      declared:
        requiredSecrets:
          -
            keys:
              - "tls.crt"
            name: "consul-ca-cert"
            namespace: "consul"
            purpose: "Consul TLS CA certificate; must sign consul-server-cert"
          -
            caSecretName: "consul-ca-cert"
            keys:
              - "tls.crt"
              - "tls.key"
            name: "consul-server-cert"
            namespace: "consul"
            purpose: "Consul server TLS certificate and private key; certificate SANs must cover server.dc1.consul and rendered consul-consul-server service DNS names"
            requiredDNSNames:
              - "server.dc1.consul"
              - "consul-consul-server"
              - "consul-consul-server.consul"
              - "consul-consul-server.consul.svc"
              - "consul-consul-server.consul-helm"
              - "consul-consul-server.consul-helm.svc"
              - "consul-consul-server.consul-apply"
              - "consul-consul-server.consul-apply.svc"
              - "consul-consul-server.consul-oci"
              - "consul-consul-server.consul-oci.svc"
          -
            keys:
              - "key"
            name: "consul-gossip-encryption-key"
            namespace: "consul"
            purpose: "Consul gossip encryption key"
          -
            keys:
              - "token"
            name: "consul-bootstrap-acl-token"
            namespace: "consul"
            purpose: "Consul ACL bootstrap token"
        requiredTopology:
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
          minimumSchedulableNodes: 3
          purpose: "Consul secure mesh renders three server replicas with anti-affinity and gateway workloads."
      requirements:
        -
          category: "secret"
          name: "consul/consul-ca-cert"
          namespace: "consul"
          requiredBefore: "apply"
          freshness:
            policy: "recheck-before-apply"
            maxAge: "one-apply"
          purpose: "Consul TLS CA certificate; must sign consul-server-cert"
          check: ""
          declarationPath: "recipes/hashicorp/consul/2.0.0/variants/secure-mesh-existing-secrets/variant.yaml"
          sourceVariant: ""
          sourcePath: ""
          deliveryLanes:
            []
          evidence:
            - "recipes/hashicorp/consul/2.0.0/variants/secure-mesh-existing-secrets/variant.yaml"
        -
          category: "secret"
          name: "consul/consul-server-cert"
          namespace: "consul"
          requiredBefore: "apply"
          freshness:
            policy: "recheck-before-apply"
            maxAge: "one-apply"
          purpose: "Consul server TLS certificate and private key; certificate SANs must cover server.dc1.consul and rendered consul-consul-server service DNS names"
          check: ""
          declarationPath: "recipes/hashicorp/consul/2.0.0/variants/secure-mesh-existing-secrets/variant.yaml"
          sourceVariant: ""
          sourcePath: ""
          deliveryLanes:
            []
          evidence:
            - "recipes/hashicorp/consul/2.0.0/variants/secure-mesh-existing-secrets/variant.yaml"
        -
          category: "secret"
          name: "consul/consul-gossip-encryption-key"
          namespace: "consul"
          requiredBefore: "apply"
          freshness:
            policy: "recheck-before-apply"
            maxAge: "one-apply"
          purpose: "Consul gossip encryption key"
          check: ""
          declarationPath: "recipes/hashicorp/consul/2.0.0/variants/secure-mesh-existing-secrets/variant.yaml"
          sourceVariant: ""
          sourcePath: ""
          deliveryLanes:
            []
          evidence:
            - "recipes/hashicorp/consul/2.0.0/variants/secure-mesh-existing-secrets/variant.yaml"
        -
          category: "secret"
          name: "consul/consul-bootstrap-acl-token"
          namespace: "consul"
          requiredBefore: "apply"
          freshness:
            policy: "recheck-before-apply"
            maxAge: "one-apply"
          purpose: "Consul ACL bootstrap token"
          check: ""
          declarationPath: "recipes/hashicorp/consul/2.0.0/variants/secure-mesh-existing-secrets/variant.yaml"
          sourceVariant: ""
          sourcePath: ""
          deliveryLanes:
            []
          evidence:
            - "recipes/hashicorp/consul/2.0.0/variants/secure-mesh-existing-secrets/variant.yaml"
        -
          category: "topology"
          name: "target topology"
          namespace: ""
          requiredBefore: "apply"
          freshness:
            policy: "recheck-before-apply"
            maxAge: "one-apply"
          purpose: "Consul secure mesh renders three server replicas with anti-affinity and gateway workloads."
          check: ""
          declarationPath: "recipes/hashicorp/consul/2.0.0/variants/secure-mesh-existing-secrets/variant.yaml"
          sourceVariant: ""
          sourcePath: ""
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
          evidence:
            - "recipes/hashicorp/consul/2.0.0/variants/secure-mesh-existing-secrets/variant.yaml"
      actions:
        []
      coverage:
        state: "attached"
        reason: "5 target prerequisites declared by this base."
        declarationSource: "recipes/hashicorp/consul/2.0.0/variants/secure-mesh-existing-secrets/variant.yaml"
        nextAction: ""
    sourceRecord: "data/helm-render-intents/intents/hashicorp-consul-2-0-0-secure-mesh-existing-secrets.yaml"
  delivery:
    literalConfigOci:
      status: "not-published-in-this-record"
      note: "The installer package contains several preset configurations. A literal OCI bundle for this one base needs its own publication receipt."
    configHubReleaseOci:
      status: "not-recorded-for-this-base"
      note: "No current ConfigHub Space release OCI receipt is recorded for this exact base."
    argoCd: "not-recorded-for-this-base"
    flux: "not-recorded-for-this-base"
    direct: "not-recorded-for-this-base"
    historicalGitopsOciStatus: "no"
  policy:
    profile: "catalog-standard"
    productionAdds:
      - "human-approval"
  evidence:
    renderParity: "yes"
    confighubScanOps: "yes"
    localKind: "no"
    lifecycleObserved: "todo"
    gitopsOciLive: "no"
    liveDualParity: "watch"
    twoClusterKind: "yes"
    variantPromotion: "proven"
  operations:
    resourceClass: "not-yet-classified"
    ownerClass: "not-yet-classified"
    changeCadence: "not-yet-classified"
status:
  level: "available"
  claim: "The Helm source record, committed rendered objects, revision digest, routes, target facts, and proof-lane statuses are indexed here."
  limits:
    - "This record does not claim that the base has been uploaded to a live ConfigHub Space."
    - "The small typed install-time surface is not yet complete for every Helm base."
    - "A multi-preset installer package OCI is not the same as a single literal configuration OCI."