apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "HelmRenderIntent"
metadata:
  name: "kyverno-kyverno-3-8-1-no-crds"
  labels:
    component: "kyverno/kyverno"
    chart: "kyverno/kyverno"
    version: "3.8.1"
    base: "no-crds"
    catalogLayer: "F2b"
spec:
  component: "kyverno/kyverno"
  chart:
    name: "kyverno/kyverno"
    version: "3.8.1"
    sourceRepository: "https://kyverno.github.io/kyverno/"
    sourceContent: ""
  baseVariant: "no-crds"
  renderInputs:
    recipe: "recipes/kyverno/kyverno/3.8.1"
    variant: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
    revision: "recipes/kyverno/kyverno/3.8.1/revisions/no-crds/r001/variant-revision.yaml"
    packageBase: "packages/kyverno/kyverno/3.8.1/bases/no-crds"
    installerPackageOciRef: "oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/kyverno-kyverno:3.8.1"
    sourceLock: "recipes/kyverno/kyverno/3.8.1/source-lock.yaml"
    namespace: "default"
    releaseName: "kyverno"
    valuesProfile: "recipes/kyverno/kyverno/3.8.1/effective-values-no-crds.yaml"
    capabilityProfile:
      apiVersions:
        []
      kubeVersion: "1.30.0"
    hookPolicy: "no-hooks"
  renderOutput:
    renderedObjects: "recipes/kyverno/kyverno/3.8.1/revisions/no-crds/r001/rendered/release-objects.yaml"
    objectInventory: "recipes/kyverno/kyverno/3.8.1/revisions/no-crds/r001/rendered/object-inventory.yaml"
    revision: "recipes/kyverno/kyverno/3.8.1/revisions/no-crds/r001/variant-revision.yaml"
    packageBase: "packages/kyverno/kyverno/3.8.1/bases/no-crds"
  evidence:
    renderParity: "yes"
    confighubScanOps: "yes"
    localKind: "yes"
    lifecycleObserved: "todo"
    gitopsOciLive: "yes"
    liveDualParity: "yes"
    twoClusterKind: "yes"
    variantPromotion: "proven"
  lifecycle:
    routeContract: "yes"
    routeCount: "6"
    dispositions: "observed:6"
    executionModes: "target-owned:3; user-executes:3"
    safeAutomatic: "0/6"
    contractPath: "data/lifecycle-routes/summary.md"
    jsonPath: "data/lifecycle-routes/routes.json"
    variantRoutes:
      -
        routeName: "delete-cleanup-policy"
        quirkClass: "hook-delete-policy"
        lifecyclePhase: "observe"
        actionKind: "accept-target-policy"
        executionMode: "target-owned"
        automatic: false
        whoRuns: "Your cluster — at uninstall, automatically"
        operatingDetails: ""
        command: ""
        disposition: "observed"
        delta: "kept"
        reason: ""
        routeSourceVersion: "3.8.1"
        evidence:
          - "data/hook-lifecycle/receipt-index.csv"
          - "data/hook-lifecycle/receipts/kyverno-kyverno/default/latest.yaml"
        nextAction: ""
        evidenceRequired: "already has a live receipt; keep it fresh when chart, base, or cluster version changes"
        sourceDrift: ""
        gitOps:
          emitsControllerStep: false
          argoCd: "none — your cluster handles it"
          flux: "none — your cluster handles it"
          argoCdSnippet: ""
        runners:
          direct:
            implementation: "Your cluster — at uninstall, automatically"
            status: "not-run"
            evidence:
              []
          argoCd:
            implementation: "none — your cluster handles it"
            status: "mapping-only"
            evidence:
              []
          flux:
            implementation: "none — your cluster handles it"
            status: "mapping-only"
            evidence:
              []
      -
        routeName: "preserve-cleanup-policy"
        quirkClass: "hook-delete-policy"
        lifecyclePhase: "observe"
        actionKind: "accept-target-policy"
        executionMode: "target-owned"
        automatic: false
        whoRuns: "Your cluster — at uninstall, automatically"
        operatingDetails: ""
        command: ""
        disposition: "observed"
        delta: "kept"
        reason: ""
        routeSourceVersion: "3.8.1"
        evidence:
          - "data/hook-lifecycle/receipt-index.csv"
          - "data/hook-lifecycle/receipts/kyverno-kyverno/default/latest.yaml"
        nextAction: ""
        evidenceRequired: "already has a live receipt; keep it fresh when chart, base, or cluster version changes"
        sourceDrift: ""
        gitOps:
          emitsControllerStep: false
          argoCd: "none — your cluster handles it"
          flux: "none — your cluster handles it"
          argoCdSnippet: ""
        runners:
          direct:
            implementation: "Your cluster — at uninstall, automatically"
            status: "not-run"
            evidence:
              []
          argoCd:
            implementation: "none — your cluster handles it"
            status: "mapping-only"
            evidence:
              []
          flux:
            implementation: "none — your cluster handles it"
            status: "mapping-only"
            evidence:
              []
      -
        routeName: "upgrade-action-with-receipt"
        quirkClass: "hook-phase"
        lifecyclePhase: "pre-apply"
        actionKind: "run-job"
        executionMode: "user-executes"
        automatic: false
        whoRuns: "Your delivery — a GitOps PreSync/PostSync or cub action (receipted)"
        operatingDetails: ""
        command: "kubectl apply -f <action-job>; kubectl wait --for=condition=complete job/<name>"
        disposition: "observed"
        delta: "kept"
        reason: ""
        routeSourceVersion: "3.8.1"
        evidence:
          - "data/hook-lifecycle/receipt-index.csv"
          - "data/hook-lifecycle/receipts/kyverno-kyverno/default/latest.yaml"
        nextAction: ""
        evidenceRequired: "already has a live receipt; keep it fresh when chart, base, or cluster version changes"
        sourceDrift: ""
        gitOps:
          emitsControllerStep: true
          argoCd: "PreSync"
          flux: "apply before the release (Kustomization dependsOn)"
          argoCdSnippet: "metadata:\n  annotations:\n    argocd.argoproj.io/hook: PreSync\n    argocd.argoproj.io/hook-delete-policy: HookSucceeded"
        runners:
          direct:
            implementation: "kubectl apply -f <action-job>; kubectl wait --for=condition=complete job/<name>"
            status: "not-run"
            evidence:
              []
          argoCd:
            implementation: "PreSync"
            status: "mapping-only"
            evidence:
              []
          flux:
            implementation: "apply before the release (Kustomization dependsOn)"
            status: "mapping-only"
            evidence:
              []
      -
        routeName: "explicit-test-check"
        quirkClass: "hook-test"
        lifecyclePhase: "observe"
        actionKind: "run-test"
        executionMode: "user-executes"
        automatic: false
        whoRuns: "Opt-in check — run from CI or on demand (tests are explicit by design)"
        operatingDetails: ""
        command: "# run the chart's test/check (helm test equivalent)"
        disposition: "observed"
        delta: "kept"
        reason: ""
        routeSourceVersion: "3.8.1"
        evidence:
          - "data/hook-lifecycle/receipt-index.csv"
          - "data/hook-lifecycle/receipts/kyverno-kyverno/default/latest.yaml"
        nextAction: ""
        evidenceRequired: "already has a live receipt; keep it fresh when chart, base, or cluster version changes"
        sourceDrift: ""
        gitOps:
          emitsControllerStep: true
          argoCd: "PostSync test Job (Argo has no native helm test)"
          flux: "HelmRelease .spec.test.enable=true"
          argoCdSnippet: "metadata:\n  annotations:\n    argocd.argoproj.io/hook: PostSync\n    argocd.argoproj.io/hook-delete-policy: HookSucceeded"
        runners:
          direct:
            implementation: "# run the chart's test/check (helm test equivalent)"
            status: "not-run"
            evidence:
              []
          argoCd:
            implementation: "PostSync test Job (Argo has no native helm test)"
            status: "mapping-only"
            evidence:
              []
          flux:
            implementation: "HelmRelease .spec.test.enable=true"
            status: "mapping-only"
            evidence:
              []
      -
        routeName: "preserve-ordering"
        quirkClass: "hook-weight-ordering"
        lifecyclePhase: "pre-apply"
        actionKind: "preserve-ordering"
        executionMode: "target-owned"
        automatic: false
        whoRuns: "Your applier — must apply CRDs before dependent objects"
        operatingDetails: ""
        command: ""
        disposition: "observed"
        delta: "reduced"
        reason: "CRD-first ordering is not needed in a base that installs no CRDs"
        routeSourceVersion: "3.8.1"
        evidence:
          - "data/hook-lifecycle/receipt-index.csv"
          - "data/hook-lifecycle/receipts/kyverno-kyverno/default/latest.yaml"
        nextAction: ""
        evidenceRequired: "already has a live receipt; keep it fresh when chart, base, or cluster version changes"
        sourceDrift: ""
        gitOps:
          emitsControllerStep: false
          argoCd: "no extra hook — keep CRDs before dependent objects"
          flux: "no extra hook — make sure CRDs are applied before workloads"
          argoCdSnippet: ""
        runners:
          direct:
            implementation: "Your applier — must apply CRDs before dependent objects"
            status: "not-run"
            evidence:
              []
          argoCd:
            implementation: "no extra hook — keep CRDs before dependent objects"
            status: "mapping-only"
            evidence:
              []
          flux:
            implementation: "no extra hook — make sure CRDs are applied before workloads"
            status: "mapping-only"
            evidence:
              []
      -
        routeName: "target-facts-or-preflight"
        quirkClass: "target-facts"
        lifecyclePhase: "preflight"
        actionKind: "stage-target-facts"
        executionMode: "user-executes"
        automatic: false
        whoRuns: "Prerequisite — supply once (Secret / CRD / storage), like values"
        operatingDetails: ""
        command: "# create the required target facts (Secret/StorageClass/etc.) before apply"
        disposition: "observed"
        delta: "strengthened"
        reason: "this base needs 22 CRDs supplied before deploy (the default base installs them for you)"
        routeSourceVersion: "3.8.1"
        evidence:
          - "data/hook-lifecycle/receipt-index.csv"
          - "data/hook-lifecycle/receipts/kyverno-kyverno/default/latest.yaml"
        nextAction: ""
        evidenceRequired: "already has a live receipt; keep it fresh when chart, base, or cluster version changes"
        sourceDrift: ""
        gitOps:
          emitsControllerStep: false
          argoCd: "none — supply the inputs before sync"
          flux: "none — supply the inputs before sync"
          argoCdSnippet: ""
        runners:
          direct:
            implementation: "# create the required target facts (Secret/StorageClass/etc.) before apply"
            status: "not-run"
            evidence:
              []
          argoCd:
            implementation: "none — supply the inputs before sync"
            status: "mapping-only"
            evidence:
              []
          flux:
            implementation: "none — supply the inputs before sync"
            status: "mapping-only"
            evidence:
              []
    coverage:
      state: "attached"
      reason: "6 lifecycle routes attached for this exact chart version and base."
      evidence:
        - "data/lifecycle-routes/summary.md"
        - "data/lifecycle-routes/routes.json"
      nextAction: ""
  targetFacts:
    status: "declared-target-facts"
    declared:
      requiredCRDs:
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "cleanuppolicies.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "clustercleanuppolicies.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "clusterpolicies.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "globalcontextentries.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "policies.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "policyexceptions.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "updaterequests.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "clusterephemeralreports.reports.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "ephemeralreports.reports.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "clusterpolicyreports.wgpolicyk8s.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "policyreports.wgpolicyk8s.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "deletingpolicies.policies.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "generatingpolicies.policies.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "imagevalidatingpolicies.policies.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "mutatingpolicies.policies.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "namespaceddeletingpolicies.policies.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "namespacedgeneratingpolicies.policies.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "namespacedimagevalidatingpolicies.policies.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "namespacedmutatingpolicies.policies.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "namespacedvalidatingpolicies.policies.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "policyexceptions.policies.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        -
          deliveryLanes:
            - "regularHelm"
            - "cubInstallerApply"
            - "configHubKubectlApply"
            - "configHubOciArgo"
          name: "validatingpolicies.policies.kyverno.io"
          purpose: "Kyverno CRD managed outside this no-crds base"
          sourceVariant: "default"
          packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
          packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
    requirements:
      -
        category: "crd"
        name: "cleanuppolicies.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "clustercleanuppolicies.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "clusterpolicies.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "globalcontextentries.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "policies.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "policyexceptions.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "updaterequests.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "clusterephemeralreports.reports.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "ephemeralreports.reports.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "clusterpolicyreports.wgpolicyk8s.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "policyreports.wgpolicyk8s.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "deletingpolicies.policies.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "generatingpolicies.policies.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "imagevalidatingpolicies.policies.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "mutatingpolicies.policies.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "namespaceddeletingpolicies.policies.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "namespacedgeneratingpolicies.policies.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "namespacedimagevalidatingpolicies.policies.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "namespacedmutatingpolicies.policies.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "namespacedvalidatingpolicies.policies.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "policyexceptions.policies.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
      -
        category: "crd"
        name: "validatingpolicies.policies.kyverno.io"
        namespace: ""
        requiredBefore: "apply"
        freshness:
          policy: "recheck-before-apply"
          maxAge: "one-apply"
        purpose: "Kyverno CRD managed outside this no-crds base"
        check: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packageSource: "package://prerequisites/target-facts/no-crds-crds.yaml"
        packagePath: "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
        declarationPath: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
        sourceVariant: "default"
        sourcePath: ""
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
        evidence:
          - "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
          - "packages/kyverno/kyverno/3.8.1/prerequisites/target-facts/no-crds-crds.yaml"
    actions:
      []
    coverage:
      state: "attached"
      reason: "22 target prerequisites declared by this base."
      declarationSource: "recipes/kyverno/kyverno/3.8.1/variants/no-crds/variant.yaml"
      nextAction: ""
  settingSources:
    helmValues:
      status: "recorded"
      valuesProfile: "recipes/kyverno/kyverno/3.8.1/effective-values-no-crds.yaml"
      controls: "base-render"
    configHubChanges:
      status: "none-in-catalog-base"
      controls: "post-render-fields"
      recordsAfterUpload:
        - "Unit revisions"
        - "derived variants"
        - "promotion receipts"
    installWork:
      status: "recorded"
      controls: "prerequisites-and-lifecycle"
      targetRequirementCount: 22
      lifecycleRouteCount: 6
    liveCluster:
      status: "observation-only"
      controls: "observed-state"
    overlapPolicy: "review-required"
  provenance:
    matrixRowKind: "base"
    catalogLayer: "F2b"
    customizationLayer: "F2b rendered standard fork"
    rowStatus: "real"
    githubRecipeUrl: "https://github.com/confighub/helm-expt/tree/main/recipes/kyverno/kyverno/3.8.1"
    githubPackageBaseUrl: "https://github.com/confighub/helm-expt/tree/main/packages/kyverno/kyverno/3.8.1/bases/no-crds"
    fullModelPath:
      - "chart/version: kyverno/kyverno@3.8.1"
      - "recipe: recipes/kyverno/kyverno/3.8.1"
      - "base variant: no-crds"
      - "render intent: data/helm-render-intents/intents/kyverno-kyverno-3-8-1-no-crds.yaml"
      - "rendered revision: recipes/kyverno/kyverno/3.8.1/revisions/no-crds/r001/variant-revision.yaml"
      - "full rendered YAML: recipes/kyverno/kyverno/3.8.1/revisions/no-crds/r001/rendered/release-objects.yaml"
      - "installer package OCI: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/kyverno-kyverno:3.8.1"
      - "package base: packages/kyverno/kyverno/3.8.1/bases/no-crds"
      - "ConfigHub Units: created when the package is uploaded"
      - "managed variants: created after upload with cub variant create/promote"
      - "targets and observations: recorded by the live lanes when run"
status:
  disposition: "real-base-render-intent"
  claim: "This intent describes a committed real base variant and its render inputs. It is not a claim that every live delivery lane is green."
  limits:
    - "Candidate and custom-discussion rows are not emitted as runnable render intents."
    - "Declared target facts are copied from the base variant. Observed action records appear only when committed failure evidence exists; their absence does not erase the declaration."
    - "Missing lifecycle route data is not treated as proof that no route is needed."
    - "ConfigHub server objects and managed variants are created after upload. This file records the render intent, not a live server object."