apiVersion: helm-expt.confighub.com/v1alpha1
kind: HookLifecycleRouteReceipt
metadata:
  name: kedacore-keda-no-crds-webhook-certificate-route
spec:
  chart: kedacore/keda
  version: 2.19.0
  base: no-crds
  result: observed
  selectedAt: "2026-07-28"
  observedAt: "2026-07-28T14:20:01Z"
  route:
    summary: KEDA creates its own webhook certificate Secret after the operator starts, so delivery must wait for that handoff before judging the remaining pods.
    phases:
      - hookTypes: [post-install, post-upgrade]
        action: webhook-readiness-observation
        reason: The operator mounts kedaorg-certs as optional, starts certificate rotation, and creates the Secret used by the webhook and metrics API pods.
  evidence:
    - path: recipes/kedacore/keda/2.19.0/variants/no-crds/variant.yaml
      claim: The preset records the six CRDs that must exist before the no-crds workload is applied.
    - path: recipes/kedacore/keda/2.19.0/revisions/no-crds/r001/rendered/release-objects.yaml
      claim: The rendered operator enables certificate rotation and mounts kedaorg-certs as optional while the dependent pods require it.
    - path: runs/live-kind-parity/kedacore-keda-no-crds/receipt.yaml
      claim: Separate kind clusters proved Helm and cub both converged, the certificate Secret was generated, the APIService answered, and the objects remained semantically equivalent.
  execution:
    helmHooksExecutedByHarness: false
    runtimeObserved: true
    observedRoute:
      route: webhook-readiness-observation
      result: pass
      receipts:
        - runs/live-kind-parity/kedacore-keda-no-crds/receipt.yaml
      generatedSecret: kedaorg-certs
      apiService: v1beta1.external.metrics.k8s.io
      apiServiceQuery: pass
      semanticParity: pass
    notes:
      - This receipt applies only to KEDA 2.19.0 with the no-crds preset and certificates.autoGenerated left enabled.
      - Users do not create kedaorg-certs for this route; the KEDA operator creates and rotates it.
      - The packaged CRDs are applied and established before the workload objects.
      - A cert-manager configuration is a different route and needs its own preset and receipt.
  remainingWork:
    - Prove the same certificate handoff through the Argo CD and Flux OCI delivery paths.
    - Refresh the receipt when the chart, preset config, package, or supported target changes.