apiVersion: "catalog.confighub.com/v1alpha1"
kind: "BaseVariantRecord"
metadata:
  name: "kubara-local-platform-v0-12-0-base"
  labels:
    sourceType: "kubara"
    component: "kubara-local-platform"
    sourceVersion: "v0.12.0"
    base: "base"
spec:
  source:
    type: "kubara"
    name: "local-platform"
    version: "v0.12.0"
    record: "examples/kubara/local-platform/generation-receipt.yaml"
    packageOciRef: ""
  baseVariant:
    name: "base"
    revision: "generated-v0.12.0"
    digest: "sha256:b5cc98615a93c708870ecc80d92af488e7a7e517c8da8c8af0bc3b6ae5bfdf54"
  configuration:
    format: "kubara-argocd-bootstrap-yaml"
    objects: "examples/kubara/local-platform/rendered/release-objects.yaml"
    inventory: "examples/kubara/local-platform/rendered/object-inventory.json"
    objectCount: 77
  inputs:
    fixedAtBuildTime:
      - "cluster=test-cluster"
      - "stage=local"
      - "clusterType=hub"
      - "enabledServices=argocd,cert-manager,external-secrets,homer-dashboard,kube-prometheus-stack,metrics-server,traefik"
      - "helmKubeVersion=1.34.0"
      - "releaseName=kubara-platform"
      - "namespace=argocd"
    installTime:
      - "Argo CD target cluster"
      - "External Secrets ClusterExternalSecret CRD"
      - "ClusterSecretStore=test-cluster-local"
      - "remote image-pull key when private images are used"
      - "approved handling for argocd-secret and cluster-kubernetes.default.svc"
    installTimeStatus: "declared-not-live-checked"
  routing:
    routes:
      -
        action: "apply the CRDs first and wait for Established before applying Argo CD custom resources"
        id: "argocd-crds-first"
        objects:
          - "customresourcedefinitions.apiextensions.k8s.io/applications.argoproj.io"
          - "customresourcedefinitions.apiextensions.k8s.io/applicationsets.argoproj.io"
          - "customresourcedefinitions.apiextensions.k8s.io/appprojects.argoproj.io"
        reason: "Argo CD custom resources cannot be applied until their three CRDs exist and report Established."
        status: "recorded-not-live"
      -
        action: "apply the hook RBAC and Job, wait for the Job to complete, record the result, then continue"
        id: "argocd-redis-secret-init"
        objects:
          - "serviceaccounts/kubara-platform-argocd-redis-secret-init"
          - "roles.rbac.authorization.k8s.io/kubara-platform-argocd-redis-secret-init"
          - "rolebindings.rbac.authorization.k8s.io/kubara-platform-argocd-redis-secret-init"
          - "jobs.batch/kubara-platform-argocd-redis-secret-init"
        reason: "The upstream Argo CD chart marks four resources as a Helm pre-install and pre-upgrade hook so a Job can create the Redis Secret before Argo CD starts."
        status: "recorded-not-live"
      -
        action: "check the CRD and Secret-store facts before applying the ClusterExternalSecret"
        id: "external-secrets-crd"
        objects:
          - "clusterexternalsecrets.external-secrets.io/image-pull-secret-ces"
        reason: "The render contains a ClusterExternalSecret, so the External Secrets CRD must exist before that object can be applied."
        status: "recorded-not-live"
        targetFacts:
          - "external-secrets.io/v1 ClusterExternalSecret is served"
          - "ClusterSecretStore test-cluster-local exists"
          - "remote key test-cluster/local/cluster_secrets/docker_config exists when a private image pull Secret is required"
      -
        action: "create or bind these two Secrets through the approved Secret path before applying the remaining objects"
        id: "rendered-secrets"
        objects:
          - "secrets/argocd-secret"
          - "secrets/cluster-kubernetes.default.svc"
        reason: "cub variant upload does not upload rendered Secret objects, including Secrets whose current data is not sensitive."
        status: "recorded-not-live"
    targetFacts:
      clusterName: "test-cluster"
      clusterType: "hub"
      requiredApis:
        - "apiextensions.k8s.io/v1"
        - "external-secrets.io/v1"
      requiredSecretStore: "test-cluster-local"
    sourceRecord: "examples/kubara/local-platform/route-intent.yaml"
  delivery:
    literalConfigOci:
      status: "local-only"
      localDigest: "sha256:b5cc98615a93c708870ecc80d92af488e7a7e517c8da8c8af0bc3b6ae5bfdf54"
      localLayout: "examples/kubara/local-platform/oci-layout"
      localPush: "pass"
      localPull: "pass"
      publicPush: "not-run"
      publicPull: "not-run"
      plannedRef: "oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/kubara-local-platform-config:0.12.0"
    configHubReleaseOci:
      status: "not-run"
    argoCd: "not-run"
    flux: "not-applicable-to-this-base"
  policy:
    profile: "catalog-standard"
    productionAdds:
      - "human-approval"
    normalSet: "approvalRequired"
    approvalReason: "system-configuration"
  evidence:
    generationReceipt: "examples/kubara/local-platform/generation-receipt.yaml"
    sourceLock: "examples/kubara/local-platform/source-lock.yaml"
    generatedChecksums: "examples/kubara/local-platform/generated/checksums.txt"
    renderedChecksums: "examples/kubara/local-platform/rendered/checksums.txt"
    routeIntent: "examples/kubara/local-platform/route-intent.yaml"
    localOciManifest: "examples/kubara/local-platform/local-config-oci-manifest.json"
    configHubUploadReceipt: "examples/kubara/local-platform/confighub-upload-receipt.yaml"
  operations:
    changeCadence: "planned-platform-release"
    ownerClass: "platform-team"
    resourceClass: "system-configuration"
    classificationSource: "config-catalog/operational-class-examples.yaml"
    classificationReason: "This configuration changes cluster-wide platform behavior, so every environment requires approval and rollout starts with one test cluster."
    liveSpace: "kubara-local-platform-v0-12-0"
    target:
      ownerClass: "platform-team"
      scope: "cluster"
      selection: "Select one test cluster first; expand only after the platform configuration and its dependent service are healthy."
    gates:
      normalSet: "approvalRequired"
      productionSet: "approvalRequired"
    rollout:
      limit: "One kind cluster and one downstream service passed; a multi-cluster wave has not run."
      method: "pilot-cluster-then-platform-wave"
      sequence:
        - "test cluster"
        - "selected fleet wave"
      status: "single-cluster-observed"
status:
  level: "partial"
  claim: "Kubara v0.12.0 generated the committed platform source and 77 literal Argo CD bootstrap objects. The routes for 3 CRDs, 4 Helm hook resources, 2 Secrets, and the External Secrets prerequisite are recorded beside the base."
  limits:
    - "The literal OCI artifact is local until the public push and anonymous pull receipts pass."
    - "The recorded routes have not been executed on a live target."
    - "No live Argo CD reconciliation or downstream platform health is claimed."
    - "This base records the generated Argo CD bootstrap and platform assignments; it does not claim that every downstream service chart has been flattened into this one object set."