apiVersion: helm-expt.confighub.com/v1alpha1
kind: ProductionDispositionReceipt
metadata:
  name: ingress-nginx-scan-gate-warning-disposition
spec:
  chart: ingress-nginx/ingress-nginx
  version: "4.15.1"
  disposition: scan/gate warning disposition
  decision: accepted
  acceptedAt: "2026-06-09"
  scope:
    - local-test
    - production-review-input
  summary: The supported ingress-nginx bases have no high or critical rendered-object scan findings. The local scan warnings are cluster RBAC, admission webhook observation, and Helm-hook lifecycle policy; those concerns now have accepted production-review dispositions. The external kube-linter warnings are workload posture and probe-port review items. This disposition records them as explicit production review input rather than hidden Helm behavior.
  evidence:
    - path: data/external-scan-lane/review.csv
      claim: External kube-linter rows for both ingress-nginx bases record liveness/readiness port review, no-read-only-root-fs, and unset-memory-requirements warnings.
    - path: data/scan-disposition-workdown/workdown.csv
      claim: The generated scan disposition workdown routes ingress-nginx to harden-security-context and probe-port review before production support.
    - path: recipes/ingress-nginx/ingress-nginx/4.15.1/revisions/default/r001/receipts/scan-receipt.yaml
      claim: The default rendered-object scan has zero high or critical findings and records webhook, hook lifecycle, and cluster RBAC review points explicitly.
    - path: recipes/ingress-nginx/ingress-nginx/4.15.1/revisions/admission-disabled/r001/receipts/scan-receipt.yaml
      claim: The admission-disabled rendered-object scan has zero high or critical findings and records the remaining cluster RBAC review points explicitly.
    - path: data/production-disposition/receipts/ingress-nginx-ingress-nginx/cluster-rbac-review.yaml
      claim: Cluster-scoped RBAC has an accepted production-review disposition.
    - path: data/production-disposition/receipts/ingress-nginx-ingress-nginx/hook-and-lifecycle-phase-policy.yaml
      claim: The default base's admission certificate hook lifecycle is routed to explicit lifecycle policy before production use.
    - path: data/production-disposition/receipts/ingress-nginx-ingress-nginx/webhook-readiness-and-failure-policy.yaml
      claim: Admission webhook readiness and failure behavior has an accepted production-review disposition.
    - path: data/production-disposition/receipts/ingress-nginx-ingress-nginx/target-fact-preflight.yaml
      claim: The default base's admission Secret target fact has an accepted production-review disposition.
    - path: runs/live-kind-parity/ingress-nginx-ingress-nginx-admission-disabled/receipt.yaml
      claim: The admission-disabled base passes strict two-cluster live parity between regular Helm and cub installer apply.
    - path: runs/live-kind-parity/ingress-nginx-ingress-nginx-default/receipt.yaml
      claim: The default base passes semantic and workload parity when the admission Secret is staged as an installer target fact.
    - path: runs/live-helm-confighub-compare/ingress-nginx-ingress-nginx-admission-disabled/receipt.yaml
      claim: The admission-disabled base passes regular Helm and ConfigHub apply semantic parity; the Argo health row remains watch because controller runtime health is target-sensitive.
  affectedVariants:
    - default
    - admission-disabled
  acceptedWarnings:
    - admission-webhook-requires-observation
    - cluster-rbac-review
    - helm-hook-lifecycle-policy
    - liveness-port
    - no-read-only-root-fs
    - readiness-port
    - unset-memory-requirements
  variantCaveats:
    - "admission-disabled is the simpler first production-review base."
    - "default requires a chosen admission Secret source, freshness check, and webhook failure policy before production support."
    - "A hardened production base may add memory policy and securityContext posture where the upstream chart supports them."
  remainingProductionBlockers: []
  nextDecision: A production support decision should choose whether the supported ingress-nginx base includes admission webhooks, and should attach target runtime checks for controller health and admission behavior.