apiVersion: "catalog.confighub.com/v1alpha1" kind: "BaseVariantRecord" metadata: name: "nvidia-nodewright-v0-19-0-default" labels: sourceType: "helm" component: "nvidia/nodewright" sourceVersion: "v0.19.0" base: "default" spec: source: type: "helm" name: "nvidia/nodewright" version: "v0.19.0" record: "data/helm-render-intents/intents/nvidia-nodewright-v0-19-0-default.yaml" packageOciRef: "oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/nvidia-nodewright:v0.19.0@sha256:58195953ff73a8e8b55b92b44504655b0cbfcee1b1196ac7730776c244136358" selection: name: "default" kind: "catalog-preset" provider: "Config Workshop" record: "data/helm-render-intents/intents/nvidia-nodewright-v0-19-0-default.yaml" baseVariant: name: "default" revision: "r001" digest: "b3aa28cd2cb8f36f050525102b0519dde1f8e9512ea9fe58128ce20dc2a22875" digestRole: "helm-variant-revision" digestRecord: "recipes/nvidia/nodewright/v0.19.0/revisions/default/r001/variant-revision.yaml" configuration: format: "kubernetes-yaml" objects: "recipes/nvidia/nodewright/v0.19.0/revisions/default/r001/rendered/release-objects.yaml" inventory: "recipes/nvidia/nodewright/v0.19.0/revisions/default/r001/rendered/object-inventory.yaml" objectCount: 20 digest: "4d5e785228886b5681a54f46eb442bb8983d6b908d95e625c0c9ceb045b39430" digestRole: "canonical-object-set" digestRecord: "recipes/nvidia/nodewright/v0.19.0/revisions/default/r001/variant-revision.yaml" processing: sourceIntent: status: "recorded" record: "data/helm-render-intents/intents/nvidia-nodewright-v0-19-0-default.yaml" materialization: method: "helm-render" status: "captured" outputDigest: "4d5e785228886b5681a54f46eb442bb8983d6b908d95e625c0c9ceb045b39430" record: "recipes/nvidia/nodewright/v0.19.0/revisions/default/r001/variant-revision.yaml" flattening: status: "decided" verdict: "flatten-with-routes" action: "retain-exact-objects-with-routes" scope: "nvidia/nodewright@v0.19.0/default; recheck after source, lifecycle-sensitive variant, destination, or delivery-runtime changes" record: "recipes/nvidia/nodewright/v0.19.0/publication/flattening-safety-verdict.yaml" boundaries: - "Helm rendered the pinned chart and values into the exact objects retained by this base." assessment: stages: - id: "inspection" question: "What do I have?" answer: "Inspect the helm source, choices, locks, and any existing output before selecting a destination." requiredInputs: - "The chart and values, a rendered object set, or a package that contains them" catalogMatchRequired: false sourceIntentRequired: false destinationAccessRequired: false deploymentRequired: false evidenceState: "completed" resultState: "available" records: - "data/helm-render-intents/intents/nvidia-nodewright-v0-19-0-default.yaml" - "recipes/nvidia/nodewright/v0.19.0/revisions/default/r001/rendered/release-objects.yaml" - "recipes/nvidia/nodewright/v0.19.0/revisions/default/r001/rendered/object-inventory.yaml" nextAction: "Inspect or compare the source and exact files before choosing a destination." - id: "materialization" question: "What will it produce?" answer: "Run the recorded Helm render step to produce the exact Kubernetes objects for this configuration." requiredInputs: - "The pinned chart, version, values, namespace, release name, and render capabilities" catalogMatchRequired: false sourceIntentRequired: true destinationAccessRequired: false deploymentRequired: false evidenceState: "completed" resultState: "pass" records: - "data/helm-render-intents/intents/nvidia-nodewright-v0-19-0-default.yaml" - "recipes/nvidia/nodewright/v0.19.0/revisions/default/r001/variant-revision.yaml" nextAction: "Review the exact object set and its digest." - id: "destination" question: "Can this destination accept it?" answer: "The destination has not been checked for this exact configuration. A recorded source or render result is not a destination pass." requiredInputs: - "The exact candidate configuration" - "The selected destination and its current APIs, prerequisites, policies, credentials, controllers, and hardware facts" catalogMatchRequired: false sourceIntentRequired: true destinationAccessRequired: true deploymentRequired: false evidenceState: "not-run" resultState: "not-run" records: - "data/helm-render-intents/intents/nvidia-nodewright-v0-19-0-default.yaml" nextAction: "Choose a destination and check its APIs, prerequisites, policies, credentials, controllers, and hardware before apply." - id: "post-deployment" question: "Did it work?" answer: "No post-deployment result is recorded for this exact configuration. Publication, upload, or rendering is not proof that it ran correctly." requiredInputs: - "The exact delivered revision and destination" - "Live controller, resource, health, runtime, drift, and rollback observations required by the claim" catalogMatchRequired: false sourceIntentRequired: true destinationAccessRequired: true deploymentRequired: true evidenceState: "not-run" resultState: "not-run" records: [] nextAction: "Deliver the exact revision, then record controller, resource, health, runtime, drift, and rollback results separately." inputs: fixedAtBuildTime: - "chart=nvidia/nodewright" - "version=v0.19.0" - "base=default" - "valuesProfile=recipes/nvidia/nodewright/v0.19.0/effective-values.yaml" - "namespace=nodewright" - "releaseName=nodewright-operator" - "capabilityProfile={\"apiVersions\":[],\"kubeVersion\":\"1.31.0\"}" installTime: - name: "deploymentpolicies.nodewright.nvidia.com" type: "requiredCRDs" required: true details: applyMode: "server-side" deliveryLanes: - "regularHelm" - "cubInstallerApply" - "configHubKubectlApply" - "configHubOciArgo" name: "deploymentpolicies.nodewright.nvidia.com" purpose: "CRD included in this base and applied before the operator that reconciles it" sourceVariant: "default" packageSource: "package://prerequisites/target-facts/default-crds.yaml" packagePath: "packages/nvidia/nodewright/v0.19.0/prerequisites/target-facts/default-crds.yaml" - name: "deploymentpolicies.skyhook.nvidia.com" type: "requiredCRDs" required: true details: applyMode: "server-side" deliveryLanes: - "regularHelm" - "cubInstallerApply" - "configHubKubectlApply" - "configHubOciArgo" name: "deploymentpolicies.skyhook.nvidia.com" purpose: "CRD included in this base and applied before the operator that reconciles it" sourceVariant: "default" packageSource: "package://prerequisites/target-facts/default-crds.yaml" packagePath: "packages/nvidia/nodewright/v0.19.0/prerequisites/target-facts/default-crds.yaml" - name: "nodewrights.nodewright.nvidia.com" type: "requiredCRDs" required: true details: applyMode: "server-side" deliveryLanes: - "regularHelm" - "cubInstallerApply" - "configHubKubectlApply" - "configHubOciArgo" name: "nodewrights.nodewright.nvidia.com" purpose: "CRD included in this base and applied before the operator that reconciles it" sourceVariant: "default" packageSource: "package://prerequisites/target-facts/default-crds.yaml" packagePath: "packages/nvidia/nodewright/v0.19.0/prerequisites/target-facts/default-crds.yaml" - name: "skyhooks.skyhook.nvidia.com" type: "requiredCRDs" required: true details: applyMode: "server-side" deliveryLanes: - "regularHelm" - "cubInstallerApply" - "configHubKubectlApply" - "configHubOciArgo" name: "skyhooks.skyhook.nvidia.com" purpose: "CRD included in this base and applied before the operator that reconciles it" sourceVariant: "default" packageSource: "package://prerequisites/target-facts/default-crds.yaml" packagePath: "packages/nvidia/nodewright/v0.19.0/prerequisites/target-facts/default-crds.yaml" installTimeStatus: "partly-declared" lifecycle: requirements: status: "recorded" items: - id: "lifecycle-action-pre-upgrade" origin: "base" type: "lifecycle-action" detail: "Before an upgrade, delete the operator Deployment if its selector would change. A Deployment's selector is immutable. This Job compares the live controller-manager Deployment's selector with the one the new chart renders and deletes the Deployment when they differ, so the upgrade can create it again. It runs with its own ServiceAccount, Role and RoleBinding. A workflow that applies a newer base over an older one must run these four objects first, wait for the Job to complete, then delete them; otherwise the apply fails on the immutable field." - id: "lifecycle-action-pre-delete" origin: "base" type: "lifecycle-action" detail: "Before a delete, remove the custom resources and the webhook configurations. Two Jobs run while the operator is still there. One deletes every custom resource of the operator's kinds, so the operator can release their finalizers. The other deletes the mutating and validating webhook configurations and the certificate Secret the operator created. Both use the controller-manager ServiceAccount. A flattened delete that skips them can leave custom resources stuck on finalizers and a webhook configuration pointing at a Service that no longer exists." - id: "deploymentpolicies.nodewright.nvidia.com" origin: "base" type: "target-fact" detail: "CRD included in this base and applied before the operator that reconciles it" - id: "deploymentpolicies.skyhook.nvidia.com" origin: "base" type: "target-fact" detail: "CRD included in this base and applied before the operator that reconciles it" - id: "nodewrights.nodewright.nvidia.com" origin: "base" type: "target-fact" detail: "CRD included in this base and applied before the operator that reconciles it" - id: "skyhooks.skyhook.nvidia.com" origin: "base" type: "target-fact" detail: "CRD included in this base and applied before the operator that reconciles it" - id: "prune-protection" origin: "base" type: "lifecycle-action" detail: "Helm was asked to keep these objects when the release goes away. A reconciler that prunes anything absent from its desired state will delete them instead, and for a custom resource definition that takes every resource of that kind with it. This route protects 2 objects. The rule when one leaves the desired state is to leave in place and report, never delete." records: - "data/certified-bundles/routes/catalog/nvidia-nodewright-v0.19.0-default/prune-protection.yaml" - "data/helm-render-intents/intents/nvidia-nodewright-v0-19-0-default.yaml" - "packages/nvidia/nodewright/v0.19.0/prerequisites/nodewright-lifecycle/default/pre-delete.yaml" - "packages/nvidia/nodewright/v0.19.0/prerequisites/nodewright-lifecycle/default/pre-upgrade.yaml" - "packages/nvidia/nodewright/v0.19.0/prerequisites/nodewright-lifecycle/lifecycle-actions.yaml" routeIntent: status: "recorded" routes: - id: "crd-ordering" requirementRefs: - "deploymentpolicies.nodewright.nvidia.com" - "deploymentpolicies.skyhook.nvidia.com" - "nodewrights.nodewright.nvidia.com" - "skyhooks.skyhook.nvidia.com" phase: "pre-apply" proposedActor: "delivery workflow" proposedMechanism: "Install and establish the 4 CRDs before the operator starts. The operator Deployment watches these custom resources as soon as it starts. The bundle holds exactly the CRDs this base renders. No object in the base is an instance of them, so nothing is rejected if they arrive late, but the operator cannot work until they are established." automatic: false status: "requires-destination-resolution" sourceStatus: "recorded-not-run" supportedRuntimes: [] checks: [] evidence: - "packages/nvidia/nodewright/v0.19.0/prerequisites/target-facts/default-crds.yaml" - "packages/nvidia/nodewright/v0.19.0/prerequisites/nodewright-lifecycle/lifecycle-actions.yaml" - id: "lifecycle-action-pre-upgrade" requirementRefs: - "lifecycle-action-pre-upgrade" phase: "destination-resolution" proposedActor: "delivery workflow" proposedMechanism: "Before an upgrade, delete the operator Deployment if its selector would change. A Deployment's selector is immutable. This Job compares the live controller-manager Deployment's selector with the one the new chart renders and deletes the Deployment when they differ, so the upgrade can create it again. It runs with its own ServiceAccount, Role and RoleBinding. A workflow that applies a newer base over an older one must run these four objects first, wait for the Job to complete, then delete them; otherwise the apply fails on the immutable field." automatic: false status: "requires-destination-resolution" sourceStatus: "recorded-not-run" supportedRuntimes: [] checks: [] evidence: - "packages/nvidia/nodewright/v0.19.0/prerequisites/nodewright-lifecycle/lifecycle-actions.yaml" - "packages/nvidia/nodewright/v0.19.0/prerequisites/nodewright-lifecycle/default/pre-upgrade.yaml" - id: "lifecycle-action-pre-delete" requirementRefs: - "lifecycle-action-pre-delete" phase: "destination-resolution" proposedActor: "delivery workflow" proposedMechanism: "Before a delete, remove the custom resources and the webhook configurations. Two Jobs run while the operator is still there. One deletes every custom resource of the operator's kinds, so the operator can release their finalizers. The other deletes the mutating and validating webhook configurations and the certificate Secret the operator created. Both use the controller-manager ServiceAccount. A flattened delete that skips them can leave custom resources stuck on finalizers and a webhook configuration pointing at a Service that no longer exists." automatic: false status: "requires-destination-resolution" sourceStatus: "recorded-not-run" supportedRuntimes: [] checks: [] evidence: - "packages/nvidia/nodewright/v0.19.0/prerequisites/nodewright-lifecycle/lifecycle-actions.yaml" - "packages/nvidia/nodewright/v0.19.0/prerequisites/nodewright-lifecycle/default/pre-delete.yaml" - id: "prune-protection" requirementRefs: - "prune-protection" phase: "destination-resolution" proposedActor: "selected applier" proposedMechanism: "Helm was asked to keep these objects when the release goes away. A reconciler that prunes anything absent from its desired state will delete them instead, and for a custom resource definition that takes every resource of that kind with it. This route protects 2 objects. The rule when one leaves the desired state is to leave in place and report, never delete." automatic: false status: "requires-destination-resolution" sourceStatus: "recorded-not-run" supportedRuntimes: - "Argo CD" - "Flux" - "cub-direct applier" checks: [] evidence: - "data/certified-bundles/routes/catalog/nvidia-nodewright-v0.19.0-default/prune-protection.yaml" records: - "data/certified-bundles/routes/catalog/nvidia-nodewright-v0.19.0-default/prune-protection.yaml" - "data/helm-render-intents/intents/nvidia-nodewright-v0-19-0-default.yaml" - "packages/nvidia/nodewright/v0.19.0/prerequisites/nodewright-lifecycle/default/pre-delete.yaml" - "packages/nvidia/nodewright/v0.19.0/prerequisites/nodewright-lifecycle/default/pre-upgrade.yaml" - "packages/nvidia/nodewright/v0.19.0/prerequisites/nodewright-lifecycle/lifecycle-actions.yaml" - "packages/nvidia/nodewright/v0.19.0/prerequisites/target-facts/default-crds.yaml" targetFacts: status: "recorded" declared: requiredCRDs: - applyMode: "server-side" deliveryLanes: - "regularHelm" - "cubInstallerApply" - "configHubKubectlApply" - "configHubOciArgo" name: "deploymentpolicies.nodewright.nvidia.com" purpose: "CRD included in this base and applied before the operator that reconciles it" sourceVariant: "default" packageSource: "package://prerequisites/target-facts/default-crds.yaml" packagePath: "packages/nvidia/nodewright/v0.19.0/prerequisites/target-facts/default-crds.yaml" - applyMode: "server-side" deliveryLanes: - "regularHelm" - "cubInstallerApply" - "configHubKubectlApply" - "configHubOciArgo" name: "deploymentpolicies.skyhook.nvidia.com" purpose: "CRD included in this base and applied before the operator that reconciles it" sourceVariant: "default" packageSource: "package://prerequisites/target-facts/default-crds.yaml" packagePath: "packages/nvidia/nodewright/v0.19.0/prerequisites/target-facts/default-crds.yaml" - applyMode: "server-side" deliveryLanes: - "regularHelm" - "cubInstallerApply" - "configHubKubectlApply" - "configHubOciArgo" name: "nodewrights.nodewright.nvidia.com" purpose: "CRD included in this base and applied before the operator that reconciles it" sourceVariant: "default" packageSource: "package://prerequisites/target-facts/default-crds.yaml" packagePath: "packages/nvidia/nodewright/v0.19.0/prerequisites/target-facts/default-crds.yaml" - applyMode: "server-side" deliveryLanes: - "regularHelm" - "cubInstallerApply" - "configHubKubectlApply" - "configHubOciArgo" name: "skyhooks.skyhook.nvidia.com" purpose: "CRD included in this base and applied before the operator that reconciles it" sourceVariant: "default" packageSource: "package://prerequisites/target-facts/default-crds.yaml" packagePath: "packages/nvidia/nodewright/v0.19.0/prerequisites/target-facts/default-crds.yaml" requirementRefs: - "deploymentpolicies.nodewright.nvidia.com" - "deploymentpolicies.skyhook.nvidia.com" - "nodewrights.nodewright.nvidia.com" - "skyhooks.skyhook.nvidia.com" records: - "data/helm-render-intents/intents/nvidia-nodewright-v0-19-0-default.yaml" resolution: status: "awaits-variant-and-target" rule: "Re-resolve after a lifecycle-sensitive variant change, destination assignment, or delivery-runtime change; bind the result to the exact configuration digest." records: [] ownership: status: "partly-declared" sourceControlled: - "Fields produced from the recorded chart values and render context" variantControlled: - "Post-render object fields recorded in ConfigHub after upload" targetSupplied: - "deploymentpolicies.nodewright.nvidia.com" - "deploymentpolicies.skyhook.nvidia.com" - "nodewrights.nodewright.nvidia.com" - "skyhooks.skyhook.nvidia.com" deliveryProtected: [] records: - "data/helm-render-intents/intents/nvidia-nodewright-v0-19-0-default.yaml" rule: "Re-evaluate ownership when the source, variant, destination, or delivery behavior changes; overlapping source and variant edits require review." delivery: literalConfigOci: status: "published-with-receipt" observedReference: "oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bundles/catalog-nvidia-nodewright-v0-19-0-default:latest@sha256:b5de5d26d39008c01262754429053128d668f75de4e72cad607c0365d638414c" manifestDigest: "sha256:b5de5d26d39008c01262754429053128d668f75de4e72cad607c0365d638414c" layerDigest: "sha256:923fdfd077f38a57c0bab44125703abb8d2d31769b86ae15389533bfc39731c7" objectSetSha256: "sha256:4d5e785228886b5681a54f46eb442bb8983d6b908d95e625c0c9ceb045b39430" receipt: "data/certified-bundles/receipts/catalog/nodewright-v0.19.0-default/receipt.yaml" receiptSha256: "sha256:d313b2c0dc4de1c8dbe58a4f2c1a113e1a1923aca224d4d9cc79eeecdbdeb4aa" publicationReceipt: "runs/certified-bundles/catalog-nvidia-nodewright-v0-19-0-default/publication-receipt.yaml" publicationReceiptSha256: "sha256:03f4d5d9ffbafa6a57183c081e9f2742fb9f6e8007da168aa879cf5643f2e424" routes: - path: "data/certified-bundles/routes/catalog/nvidia-nodewright-v0.19.0-default/crd-ordering.yaml" sha256: "sha256:dc1622f6379018f0d1a9ac7cccb2df56d83d56f2b372851cdb166d9b450adec0" role: "route: crd-ordering" - path: "data/certified-bundles/routes/catalog/nvidia-nodewright-v0.19.0-default/prune-protection.yaml" sha256: "sha256:717c08d94e1689f00a068842f4b224a14fbdce1edf971a918b16146bc60347c8" role: "route: resource-policy-keep" - path: "data/certified-bundles/routes/catalog/nvidia-nodewright-v0.19.0-default/lifecycle-action-pre-upgrade.yaml" sha256: "sha256:096efd9e08e6eed7f58fdb65788ffc2916cca62dc520b0e88669c35472b211db" role: "route: plan-step lifecycle-action-pre-upgrade" - path: "data/certified-bundles/routes/catalog/nvidia-nodewright-v0.19.0-default/lifecycle-action-pre-delete.yaml" sha256: "sha256:70232574566fb05bbebb97a455db9d4a7cdad5f73682f6141495c1f96e4773cc" role: "route: plan-step lifecycle-action-pre-delete" note: "The receipt and publication receipt declare these route files; this binding does not prove a remote pullback or route execution." configHubReleaseOci: status: "not-recorded-for-this-base" note: "No current ConfigHub Space release OCI receipt is recorded for this exact base." argoCd: "not-recorded-for-this-base" flux: "not-recorded-for-this-base" direct: "not-recorded-for-this-base" historicalGitopsOciStatus: "todo" policy: profile: "catalog-standard" productionAdds: - "workflow-approval" evidence: renderParity: "yes" confighubScanOps: "todo" localKind: "todo" lifecycleObserved: "n/a" gitopsOciLive: "todo" liveDualParity: "todo" twoClusterKind: "todo" variantPromotion: "missing-confighub-proof" operations: resourceClass: "not-yet-classified" ownerClass: "not-yet-classified" changeCadence: "not-yet-classified" status: level: "available" claim: "The Helm source record, committed rendered objects, revision digest, routes, target facts, and proof-lane statuses are indexed here." limits: - "This record does not claim that the base has been uploaded to a live ConfigHub Space." - "The inputs still required at installation are not yet fully recorded for every Helm configuration." - "A multi-preset installer package OCI is not the same as a single literal configuration OCI."