# Per-variant hook lifecycle routes

**UNOFFICIAL/EXPERIMENTAL.** Generated by `scripts/generate-lifecycle-routes-by-variant.mjs`; do not hand-edit. Regenerate with `npm run lifecycle:routes-by-variant`.

Plain-English answer to *"what must happen before or after deployment, and who handles it?"* for each chart and built preset config. Every lifecycle step is named, assigned to an executor, and linked to evidence or remaining work. Derived from committed inputs only (the chart-level and exact-base routes in `data/lifecycle-route-actions/`, each base's `variant.yaml`, and the matrix's per-base disposition). The product does not auto-execute these routes yet (`automatic: false`); that, with a receipt, is the roadmap ([#688](https://github.com/confighub/helm-expt/issues/688)).

Charts: 17 · with a real per-variant delta: 6 (argo-cd/argo-workflows, bitnami/contour, gatekeeper/gatekeeper, kedacore/keda, kyverno/kyverno, prometheus-community/kube-prometheus-stack).

## argo-cd/argo-workflows

| Base | Hook (route) | After deploy, who runs it? | Per-base change |
| --- | --- | --- | --- |
| controller-default-reviewed@1.0.14 (package applies 8 CRDs first) | crd-install → `preflight-or-presync-crd-apply` | Prerequisite — run the generated package script before the workloads | packaged-action (the package carries the 8 CRDs and its generated script applies them before the workload; this base still needs its own live route receipt) |
| default@1.0.14 (package applies 8 CRDs first) | crd-install → `preflight-or-presync-crd-apply` | Handled — the generated package script applies the CRDs first | resolved (the package carries and applies the 8 CRDs before the workload (observed live)) |
| minimal-crds@1.0.14 | crd-install → `self-contained-crd-base` | Your applier — must apply CRDs before dependent objects | resolved (this base installs the required CRDs (observed live)) |

## bitnami/contour

| Base | Hook (route) | After deploy, who runs it? | Per-base change |
| --- | --- | --- | --- |
| legacy@21.1.4 | hook-phase → `preflight-or-presync` | Your delivery — a preflight step before apply (receipted) | — |

## gatekeeper/gatekeeper

| Base | Hook (route) | After deploy, who runs it? | Per-base change |
| --- | --- | --- | --- |
| default@3.22.2 | hook-phase → `preflight-or-presync` | Your delivery — a preflight step before apply (receipted) | — |
| default@3.22.2 | hook-phase → `upgrade-action-with-receipt` | Your delivery — a GitOps PreSync/PostSync or cub action (receipted) | — |

## kedacore/keda

| Base | Hook (route) | After deploy, who runs it? | Per-base change |
| --- | --- | --- | --- |
| no-crds@2.19.0 (package applies 6 CRDs first) | webhook-readiness → `webhook-readiness-observation` | Your delivery waits for the controller-created or operator-supplied certificate, then checks webhook readiness | — |

## kyverno/kyverno

| Base | Hook (route) | After deploy, who runs it? | Per-base change |
| --- | --- | --- | --- |
| default@3.8.1 | hook-delete-policy → `delete-cleanup-policy` | Your cluster — at uninstall, automatically | — |
| default@3.8.1 | hook-phase → `upgrade-action-with-receipt` | Your delivery — a GitOps PreSync/PostSync or cub action (receipted) | — |
| default@3.8.1 | hook-test → `explicit-test-check` | Opt-in check — run from CI or on demand (tests are explicit by design) | — |
| default@3.8.1 | hook-weight-ordering → `preserve-ordering` | Your applier — must apply CRDs before dependent objects | — |
| default@3.8.1 | target-facts → `target-facts-or-preflight` | Prerequisite — supply once (Secret / CRD / storage), like values | — |
| no-crds@3.8.1 (needs 22 CRDs) | hook-delete-policy → `delete-cleanup-policy` | Your cluster — at uninstall, automatically | — |
| no-crds@3.8.1 (needs 22 CRDs) | hook-delete-policy → `preserve-cleanup-policy` | Your cluster — at uninstall, automatically | — |
| no-crds@3.8.1 (needs 22 CRDs) | hook-phase → `upgrade-action-with-receipt` | Your delivery — a GitOps PreSync/PostSync or cub action (receipted) | — |
| no-crds@3.8.1 (needs 22 CRDs) | hook-test → `explicit-test-check` | Opt-in check — run from CI or on demand (tests are explicit by design) | — |
| no-crds@3.8.1 (needs 22 CRDs) | hook-weight-ordering → `preserve-ordering` | Your applier — must apply CRDs before dependent objects | reduced (CRD-first ordering is not needed in a base that installs no CRDs) |
| no-crds@3.8.1 (needs 22 CRDs) | target-facts → `target-facts-or-preflight` | Prerequisite — supply once (Secret / CRD / storage), like values | strengthened (this base needs 22 CRDs supplied before deploy (the default base installs them for you)) |

## prometheus-community/kube-prometheus-stack

| Base | Hook (route) | After deploy, who runs it? | Per-base change |
| --- | --- | --- | --- |
| default@85.3.3 (package applies 10 CRDs first) | crd-install → `preflight-or-presync-crd-apply` | Handled — the generated package script applies the CRDs first | resolved (the package carries and applies the 10 CRDs before the workload (observed live)) |
| default@85.3.3 (package applies 10 CRDs first) | hook-delete-policy → `preserve-cleanup-policy` | Your delivery — an explicit, receipted step | — |
| default@85.3.3 (package applies 10 CRDs first) | hook-phase → `postsync-check-or-observation` | Your delivery — a post-apply check (receipted) | — |
| default@85.3.3 (package applies 10 CRDs first) | hook-phase → `preflight-or-presync` | Your delivery — a preflight step before apply (receipted) | — |
| default@85.3.3 (package applies 10 CRDs first) | hook-phase → `upgrade-action-with-receipt` | Not tested for this path | — |
| default@85.3.3 (package applies 10 CRDs first) | hook-weight-ordering → `preserve-ordering` | Your delivery — an explicit, receipted step | — |
| default@85.3.3 (package applies 10 CRDs first) | target-facts → `target-facts-or-preflight` | Handled — the recorded package script creates or checks this prerequisite | — |
| default@85.3.3 (package applies 10 CRDs first) | webhook-readiness → `webhook-readiness-observation` | Your delivery — an explicit, receipted step | — |
| no-crds@85.3.3 (package applies 10 CRDs first) | crd-install → `preflight-or-presync-crd-apply` | Handled — the generated package script applies the CRDs first | resolved (the package carries and applies the 10 CRDs before the workload (observed live)) |
| no-crds@85.3.3 (package applies 10 CRDs first) | hook-delete-policy → `preserve-cleanup-policy` | Your delivery — an explicit, receipted step | — |
| no-crds@85.3.3 (package applies 10 CRDs first) | hook-phase → `postsync-check-or-observation` | Your delivery — a post-apply check (receipted) | — |
| no-crds@85.3.3 (package applies 10 CRDs first) | hook-phase → `preflight-or-presync` | Your delivery — a preflight step before apply (receipted) | — |
| no-crds@85.3.3 (package applies 10 CRDs first) | hook-phase → `upgrade-action-with-receipt` | Your delivery — a GitOps PreSync/PostSync or cub action (receipted) | — |
| no-crds@85.3.3 (package applies 10 CRDs first) | hook-weight-ordering → `preserve-ordering` | Your delivery — an explicit, receipted step | — |
| no-crds@85.3.3 (package applies 10 CRDs first) | target-facts → `target-facts-or-preflight` | Handled — the recorded package script creates or checks this prerequisite | — |
| no-crds@85.3.3 (package applies 10 CRDs first) | webhook-readiness → `webhook-readiness-observation` | Your delivery — an explicit, receipted step | — |
| default@86.1.0 (package applies 10 CRDs first) | crd-install → `preflight-or-presync-crd-apply` | Handled — the generated package script applies the CRDs first | resolved (the package carries and applies the 10 CRDs before the workload (observed live)) |
| default@86.1.0 (package applies 10 CRDs first) | hook-delete-policy → `preserve-cleanup-policy` | Your delivery — an explicit, receipted step | — |
| default@86.1.0 (package applies 10 CRDs first) | hook-phase → `postsync-check-or-observation` | Your delivery — a post-apply check (receipted) | — |
| default@86.1.0 (package applies 10 CRDs first) | hook-phase → `preflight-or-presync` | Your delivery — a preflight step before apply (receipted) | — |
| default@86.1.0 (package applies 10 CRDs first) | hook-phase → `upgrade-action-with-receipt` | Not tested for this path | — |
| default@86.1.0 (package applies 10 CRDs first) | hook-weight-ordering → `preserve-ordering` | Your delivery — an explicit, receipted step | — |
| default@86.1.0 (package applies 10 CRDs first) | target-facts → `target-facts-or-preflight` | Handled — the recorded package script creates or checks this prerequisite | — |
| default@86.1.0 (package applies 10 CRDs first) | webhook-readiness → `webhook-readiness-observation` | Your delivery — an explicit, receipted step | — |
| no-crds@86.1.0 (package applies 10 CRDs first) | crd-install → `preflight-or-presync-crd-apply` | Handled — the generated package script applies the CRDs first | resolved (the package carries and applies the 10 CRDs before the workload (observed live)) |
| no-crds@86.1.0 (package applies 10 CRDs first) | hook-delete-policy → `preserve-cleanup-policy` | Your delivery — an explicit, receipted step | — |
| no-crds@86.1.0 (package applies 10 CRDs first) | hook-phase → `postsync-check-or-observation` | Your delivery — a post-apply check (receipted) | — |
| no-crds@86.1.0 (package applies 10 CRDs first) | hook-phase → `preflight-or-presync` | Your delivery — a preflight step before apply (receipted) | — |
| no-crds@86.1.0 (package applies 10 CRDs first) | hook-phase → `upgrade-action-with-receipt` | Your delivery — a GitOps PreSync/PostSync or cub action (receipted) | — |
| no-crds@86.1.0 (package applies 10 CRDs first) | hook-weight-ordering → `preserve-ordering` | Your delivery — an explicit, receipted step | — |
| no-crds@86.1.0 (package applies 10 CRDs first) | target-facts → `target-facts-or-preflight` | Handled — the recorded package script creates or checks this prerequisite | — |
| no-crds@86.1.0 (package applies 10 CRDs first) | webhook-readiness → `webhook-readiness-observation` | Your delivery — an explicit, receipted step | — |

## Charts without a per-variant delta yet

These charts have hook routes but no built variant set that changes the hook behavior (single base, or candidate/blocked with no built variants). Routes are chart-level.

- `airflow-helm/airflow` — No built recipe variants yet — routes shown are chart-level. Per-variant hook deltas are named in the chart's pain report but have no built base to attach to.
- `apache-airflow/airflow` — No built recipe variants yet — routes shown are chart-level. Per-variant hook deltas are named in the chart's pain report but have no built base to attach to.
- `bitnami/kafka` — No built recipe variants yet — routes shown are chart-level. Per-variant hook deltas are named in the chart's pain report but have no built base to attach to.
- `bitnami/minio` — No built recipe variants yet — routes shown are chart-level. Per-variant hook deltas are named in the chart's pain report but have no built base to attach to.
- `bitnami/thanos` — No built recipe variants yet — routes shown are chart-level. Per-variant hook deltas are named in the chart's pain report but have no built base to attach to.
- `datadog/datadog` — No built recipe variants yet — routes shown are chart-level. Per-variant hook deltas are named in the chart's pain report but have no built base to attach to.
- `fluent/fluent-bit` — One built base — its hook routes do not differ by variant.
- `gitlab/gitlab` — No built recipe variants yet — routes shown are chart-level. Per-variant hook deltas are named in the chart's pain report but have no built base to attach to.
- `k8s-dashboard/kubernetes-dashboard` — No built recipe variants yet — routes shown are chart-level. Per-variant hook deltas are named in the chart's pain report but have no built base to attach to.
- `kong/kong` — No built recipe variants yet — routes shown are chart-level. Per-variant hook deltas are named in the chart's pain report but have no built base to attach to.
- `projectcalico/tigera-operator` — One built base — its hook routes do not differ by variant.