apiVersion: helm-expt.confighub.com/v1alpha1
kind: ProductionDispositionReceipt
metadata:
  name: jetstack-cert-manager-extension-slot-provenance-and-scan-policy
spec:
  chart: jetstack/cert-manager
  version: "v1.20.2"
  disposition: extension slot provenance and scan policy
  decision: accepted
  acceptedAt: "2026-06-09"
  scope:
    - local-test
    - production-review-input
  summary: cert-manager exposes extraObjects as a tpl-powered extension slot. The supported bases keep that slot empty. This disposition accepts the current base inputs while requiring any populated extraObjects content to become a reviewed installer base with render parity, scan, and lifecycle evidence.
  evidence:
    - path: recipes/jetstack/cert-manager/v1.20.2/control-points.yaml
      claim: The recipe records tpl as controlled-by-empty-defaults and notes that extraObjects uses tpl.
    - path: recipes/jetstack/cert-manager/v1.20.2/value-model.yaml
      claim: The value model records extraObjects as an empty extension slot.
    - path: recipes/jetstack/cert-manager/v1.20.2/effective-values.yaml
      claim: The default effective values do not populate extraObjects.
    - path: recipes/jetstack/cert-manager/v1.20.2/effective-values-crds-enabled.yaml
      claim: The crds-enabled effective values do not populate extraObjects.
    - path: recipes/jetstack/cert-manager/v1.20.2/revisions/default/r001/receipts/helm-equivalence-receipt.yaml
      claim: The default base is Helm-equivalent with the empty extension slot.
    - path: recipes/jetstack/cert-manager/v1.20.2/revisions/crds-enabled/r001/receipts/helm-equivalence-receipt.yaml
      claim: The crds-enabled base is Helm-equivalent with the empty extension slot.
  affectedVariants:
    - default
    - crds-enabled
  acceptedPolicy:
    currentBases: extraObjects is empty in both supported bases.
    populatedSlotRule: Any extraObjects content creates a new reviewed installer base rather than an untracked post-render edit.
  remainingProductionBlockers: []
  nextDecision: A production support decision can keep extraObjects disabled or add a separate reviewed base for specific extra objects.