apiVersion: helm-expt.confighub.com/v1alpha1
kind: HelmCatalogDemoReadme
metadata:
  name: readme
  labels:
    app.kubernetes.io/part-of: helm-catalog
    helm-expt.confighub.com/space: "sveltos-kyverno-fleet-3-8-1-staging"
    helm-expt.confighub.com/readme-kind: "fleet"
spec:
  space: "sveltos-kyverno-fleet-3-8-1-staging"
  title: "Sveltos Kyverno fleet"
  summary: "ConfigHub approves a pilot Sveltos ClusterProfile and one selector expansion. Argo CD reconciles the two OCI revisions, then Sveltos installs Kyverno on one staging cluster and later on both."
  sourcePath: "data/helm-catalog-readmes/spaces/sveltos-kyverno-fleet-3-8-1-staging/README.md"
  links:
    - label: "Sveltos example guide"
      url: "https://github.com/confighub/helm-expt/blob/main/docs/demo/sveltos/kyverno-fleet.md"
    - label: "ClusterProfile source"
      url: "https://github.com/confighub/helm-expt/blob/main/examples/sveltos/kyverno-fleet/clusterprofile.yaml"
    - label: "Pilot ClusterProfile source"
      url: "https://github.com/confighub/helm-expt/blob/main/examples/sveltos/kyverno-fleet/clusterprofile-pilot.yaml"
    - label: "First live receipt"
      url: "https://github.com/confighub/helm-expt/blob/main/examples/sveltos/kyverno-fleet/live-receipt.yaml"
    - label: "OCI delivery summary"
      url: "https://github.com/confighub/helm-expt/blob/main/data/sveltos-oci-delivery-proof/summary.md"
    - label: "OCI delivery receipt"
      url: "https://github.com/confighub/helm-expt/blob/main/runs/sveltos-oci-delivery-proof/receipt.yaml"
    - label: "Pinned source versions"
      url: "https://github.com/confighub/helm-expt/blob/main/examples/sveltos/kyverno-fleet/source-lock.yaml"
    - label: "Apply policy and live assignments"
      url: "https://github.com/confighub/helm-expt/blob/main/data/apply-policy-profiles/summary.md"
  markdown: |-
    <!-- Generated by npm run helm-catalog-readmes. Do not edit by hand. -->

    # Sveltos Kyverno fleet

    ConfigHub approves a pilot Sveltos ClusterProfile and one selector expansion. Argo CD reconciles the two OCI revisions, then Sveltos installs Kyverno on one staging cluster and later on both.

    Start here when you open this Space in Hub. This page explains the problem this example is meant to show, what to inspect, why it matters, and where the evidence lives.

    ## Why this example exists

    A fleet tool can place and reconcile configuration, but teams still need a shared record of what each cluster group should run and how that record changed.

    This example separates the reviewed configuration in ConfigHub from the controller that enforces it on selected clusters.

    ## What this example shows

    - The `ClusterProfile` selects clusters labeled `environment=staging` and installs Kyverno chart 3.8.1 with three admission-controller replicas.
    - ConfigHub stores the exact reviewed profile and its revision history.
    - The pilot profile adds `rollout=pilot`, so only one of the two staging clusters is selected at first.
    - A live runner proved that both the pilot and expanded revisions were blocked before approval, packaged from approved ConfigHub data, and reconciled by Argo CD at different OCI digests.
    - Sveltos installed Kyverno on the pilot first, then on both clusters, and restored the replica count after it was changed by hand on each target.
    - This Space requires approval before apply because it changes cluster-wide admission policy.

    ## Where each setting comes from

    | Place | What this Space records |
    | --- | --- |
    | Starting configuration | Open the upstream Space or source link named on this page. That is the configuration this Space started from. |
    | ConfigHub changes | Open Unit revision history. It records changes made after the starting configuration was saved. |
    | Install work | Use the linked chart or route evidence for required Secrets, CRDs, hooks, setup jobs, and target facts. |
    | Live cluster | Use target observations to compare the cluster with the reviewed Units. A live-only edit is drift until it is recorded or removed. |

    If an upstream change and a local ConfigHub revision touch the same field, review the overlap before promotion.

    ## What to inspect in Hub

    - This README.
    - The `clusterprofile` Unit to inspect the source Sveltos will reconcile.
    - The OCI delivery receipt to see approval, package comparison, Argo CD, Sveltos, the workload, and cleanup.

    ## Evidence and source

    - [Sveltos example guide](https://github.com/confighub/helm-expt/blob/main/docs/demo/sveltos/kyverno-fleet.md)
    - [ClusterProfile source](https://github.com/confighub/helm-expt/blob/main/examples/sveltos/kyverno-fleet/clusterprofile.yaml)
    - [Pilot ClusterProfile source](https://github.com/confighub/helm-expt/blob/main/examples/sveltos/kyverno-fleet/clusterprofile-pilot.yaml)
    - [First live receipt](https://github.com/confighub/helm-expt/blob/main/examples/sveltos/kyverno-fleet/live-receipt.yaml)
    - [OCI delivery summary](https://github.com/confighub/helm-expt/blob/main/data/sveltos-oci-delivery-proof/summary.md)
    - [OCI delivery receipt](https://github.com/confighub/helm-expt/blob/main/runs/sveltos-oci-delivery-proof/receipt.yaml)
    - [Pinned source versions](https://github.com/confighub/helm-expt/blob/main/examples/sveltos/kyverno-fleet/source-lock.yaml)
    - [Apply policy and live assignments](https://github.com/confighub/helm-expt/blob/main/data/apply-policy-profiles/summary.md)

    ## Limits

    - The portable OCI used a temporary registry, and Sveltos was installed directly as a pinned prerequisite.
    - The test used two local kind clusters; it did not test a large fleet or a failed-target pause.
    - The receipt proves this Kyverno profile and drift test, not every Sveltos feature.