apiVersion: helm-expt.confighub.com/v1alpha1
kind: ProductionDispositionReceipt
metadata:
  name: grafana-target-fact-preflight
spec:
  chart: grafana/grafana
  version: "10.5.15"
  disposition: target fact preflight
  decision: accepted
  acceptedAt: "2026-06-09"
  scope:
    - local-test
    - production-review-input
  summary: >-
    The existing-secret-ingress base externalizes Grafana administrator
    credentials into a declared target Secret, grafana/grafana-admin, with
    admin-user and admin-password keys. The installer package records this as an
    external requirement and the live parity receipt proves the required Secret
    was staged in both regular Helm and cub installer clusters. This accepts the
    target-fact preflight model for the proof scope.
  evidence:
    - path: packages/grafana/grafana/10.5.15/installer.yaml
      claim: The installer package declares externalRequires for Secret grafana/grafana-admin with admin-user and admin-password keys.
    - path: packages/grafana/grafana/10.5.15/collector/target-facts.sh
      claim: The package includes a collector entrypoint for target-fact bindings and live checks.
    - path: recipes/grafana/grafana/10.5.15/variants/existing-secret-ingress/variant.yaml
      claim: The variant records grafana/grafana-admin as a required Secret target fact.
    - path: recipes/grafana/grafana/10.5.15/effective-values-existing-secret-ingress.yaml
      claim: The effective values bind admin.existingSecret, userKey, and passwordKey to the target Secret.
    - path: recipes/grafana/grafana/10.5.15/revisions/existing-secret-ingress/r001/receipts/helm-equivalence-receipt.yaml
      claim: The existing-secret-ingress base is Helm-equivalent without rendering a Grafana Secret.
    - path: runs/live-kind-parity/grafana-grafana-existing-secret-ingress/receipt.yaml
      claim: The live parity receipt records the required grafana-admin Secret staged for both the regular Helm and cub installer apply legs.
    - path: runs/grafana-confighub-proof/latest/confighub-proof-receipt.yaml
      claim: The ConfigHub proof receipt records the existing-secret-ingress target fact requirement and suggested kubectl source.
  affectedVariants:
    - existing-secret-ingress
  acceptedPolicy:
    requiredSecret: grafana/grafana-admin must exist with admin-user and admin-password keys before apply.
    productionRule: The target Secret owner, rotation policy, and freshness evidence must be supplied by the production target.
  remainingProductionBlockers:
    - scan/gate warning disposition
  nextDecision: Resolve the remaining workload scan warnings and record target-specific Secret ownership before final support.