apiVersion: helm-expt.confighub.com/v1alpha1
kind: HelmCatalogDemoReadme
metadata:
  name: readme
  labels:
    app.kubernetes.io/part-of: helm-catalog
    helm-expt.confighub.com/space: "byo-nginx-ai-values-24-0-2-reviewed"
    helm-expt.confighub.com/readme-kind: "source"
spec:
  space: "byo-nginx-ai-values-24-0-2-reviewed"
  title: "Bring your own Helm values"
  summary: "A supplied NGINX values file is rendered and reviewed before it becomes a ConfigHub base variant."
  sourcePath: "data/helm-catalog-readmes/spaces/byo-nginx-ai-values-24-0-2-reviewed/README.md"
  links:
    - label: "Bring-your-own review"
      url: "https://github.com/confighub/helm-expt/blob/main/data/byo-helm-values-review/summary.md"
    - label: "Proposed values"
      url: "https://github.com/confighub/helm-expt/blob/main/examples/byo-helm-values/ai-values.yaml"
    - label: "Reviewed values"
      url: "https://github.com/confighub/helm-expt/blob/main/examples/byo-helm-values/reviewed-values.yaml"
    - label: "Reviewed Kubernetes objects"
      url: "https://github.com/confighub/helm-expt/blob/main/data/byo-helm-values-review/reviewed-render.yaml"
    - label: "Local OCI round-trip receipt"
      url: "https://github.com/confighub/helm-expt/blob/main/runs/byo-helm-values-proof/receipt.yaml"
    - label: "Public OCI receipt"
      url: "https://github.com/confighub/helm-expt/blob/main/runs/byo-helm-values-proof/public-oci-receipt.yaml"
    - label: "ConfigHub import receipt"
      url: "https://github.com/confighub/helm-expt/blob/main/runs/byo-helm-values-proof/confighub-upload-receipt.yaml"
    - label: "First deployment result"
      url: "https://github.com/confighub/helm-expt/blob/main/data/byo-helm-values-deploy-proof/summary.md"
    - label: "Development-to-staging promotion"
      url: "https://github.com/confighub/helm-expt/blob/main/data/byo-helm-values-promotion-proof/summary.md"
    - label: "Promoted staging deployment"
      url: "https://github.com/confighub/helm-expt/blob/main/data/byo-helm-values-staging-deploy-proof/summary.md"
    - label: "NGINX chart page"
      url: "https://confighub.github.io/helm-expt/site/charts/bitnami-nginx-24-0-2.html"
  markdown: |-
    <!-- Generated by npm run helm-catalog-readmes. Do not edit by hand. -->

    # Bring your own Helm values

    A supplied NGINX values file is rendered and reviewed before it becomes a ConfigHub base variant.

    Start here when you open this Space in Hub. This page explains the problem this example is meant to show, what to inspect, why it matters, and where the evidence lives.

    ## Why this example exists

    A values file from a person or coding agent can look reasonable while producing changes that are hard to spot in templates.

    This example renders first, compares the result with the checked catalog configuration, fixes the concrete problems, and keeps the requested change.

    ## What this example shows

    - The proposed values asked for three replicas but also embedded an old API key, exposed a LoadBalancer, removed the image digest, and weakened three container security settings.
    - The reviewed values keep the three replicas, restore the checked defaults, and refer to an existing Secret instead of storing the key in the Deployment.
    - The five reviewed Kubernetes objects are published as one literal configuration OCI and imported into this Space without rerendering the chart.
    - The Space uses the five catalog checks: schema, placeholder, and lifecycle-route checks can block an apply; image-digest and workload-probe checks report warnings.
    - A live test supplied the required Secret separately, published the configuration from ConfigHub, and brought all three NGINX replicas up through Argo CD.

    ## Where each setting comes from

    | Place | What this Space records |
    | --- | --- |
    | Starting configuration | The reviewed Helm values request three replicas and safe object settings. The linked proposed and reviewed values files show exactly what changed before import. |
    | ConfigHub changes | This base contains the five reviewed objects imported from OCI. It has no later environment edit; development and staging changes live in their own Spaces. |
    | Install work | The `nginx/ai-provider-credentials` Secret must be supplied separately. Its value is not stored in the public package or this Space. |
    | Live cluster | A throwaway Argo CD run observed three ready replicas. That observation checks the reviewed base; it does not set the replica count. |

    If an upstream change and a local ConfigHub revision touch the same field, review the overlap before promotion.

    ## What to inspect in Hub

    - This README.
    - The configuration Unit to see all five reviewed Kubernetes objects together.
    - The Space annotations to see the public OCI source and digest.

    ## Evidence and source

    - [Bring-your-own review](https://github.com/confighub/helm-expt/blob/main/data/byo-helm-values-review/summary.md)
    - [Proposed values](https://github.com/confighub/helm-expt/blob/main/examples/byo-helm-values/ai-values.yaml)
    - [Reviewed values](https://github.com/confighub/helm-expt/blob/main/examples/byo-helm-values/reviewed-values.yaml)
    - [Reviewed Kubernetes objects](https://github.com/confighub/helm-expt/blob/main/data/byo-helm-values-review/reviewed-render.yaml)
    - [Local OCI round-trip receipt](https://github.com/confighub/helm-expt/blob/main/runs/byo-helm-values-proof/receipt.yaml)
    - [Public OCI receipt](https://github.com/confighub/helm-expt/blob/main/runs/byo-helm-values-proof/public-oci-receipt.yaml)
    - [ConfigHub import receipt](https://github.com/confighub/helm-expt/blob/main/runs/byo-helm-values-proof/confighub-upload-receipt.yaml)
    - [First deployment result](https://github.com/confighub/helm-expt/blob/main/data/byo-helm-values-deploy-proof/summary.md)
    - [Development-to-staging promotion](https://github.com/confighub/helm-expt/blob/main/data/byo-helm-values-promotion-proof/summary.md)
    - [Promoted staging deployment](https://github.com/confighub/helm-expt/blob/main/data/byo-helm-values-staging-deploy-proof/summary.md)
    - [NGINX chart page](https://confighub.github.io/helm-expt/site/charts/bitnami-nginx-24-0-2.html)

    ## Limits

    - The API key in the proposed values is deliberately fake.
    - The reviewed Deployment requires the `nginx/ai-provider-credentials` Secret. The Secret was supplied separately for the live test and its value was not recorded.
    - The reviewed and promoted staging configurations each ran on one throwaway kind cluster with Argo CD. Flux, rollback, chart upgrade, and a fleet rollout have not run for this configuration.