apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "HelmPainReport"
metadata:
  name: "aws-controllers-k8s-iam-chart-1.7.3"
spec:
  chart:
    name: "aws-controllers-k8s/iam-chart"
    version: "1.7.3"
    source: "oci://public.ecr.aws/aws-controllers-k8s"
    digest: "598f87feacd5fc04403e37bda75ba6e56170f43778986ac411702d6207a82730"
  supportedScopeStatus: "no-unhandled-pain-points-for-supported-scopes"
  supportedScopes:
    []
  supportedVariants:
    []
  productionReadiness: "not-reviewed-for-production"
  notes:
    - "Both bases render exactly 19 objects with identical object inventories; the only rendered difference is the Deployment environment block, where AWS_REGION, DELETION_POLICY and the credentials mount change."
    - "Nine CRDs ship from the chart's crds/ directory: seven iam.services.k8s.aws kinds (groups, instanceprofiles, openidconnectproviders, policies, roles, servicelinkedroles, users) plus the shared services.k8s.aws fieldexports and iamroleselectors."
    - "The whole release runs one image, public.ecr.aws/aws-controllers-k8s/iam-controller:1.7.3, and appVersion equals the chart version."
    - "The chart has zero helm hooks, zero test hooks, zero lookups, zero generated secrets, zero webhook configs and zero subcharts; the CRDs are the single flattening companion this chart needs."
    - "The ServiceAccount name is fixed at ack-iam-controller and does not derive from the release name."
    - "The chart's one weird thing is that FEATURE_GATES always renders because the default featureGates map is non-empty, and the iamroleselectors CRD installs even while its IAMRoleSelector gate is false."
    - "The default base renders AWS_REGION with an empty value; the controller must get a region from somewhere at runtime, which is why the eks-inference base carries the confighubplaceholder sentinel instead of a guess."
    - "At installScope cluster the RBAC set is two ClusterRoles, two ClusterRoleBindings, three namespaced Roles (reader, writer, configmaps-cache) and one RoleBinding in ack-system."
    - "The eks-inference base mounts the aws-creds Secret volume read-only at /var/run/secrets/aws with AWS_PROFILE default; AWS_SHARED_CREDENTIALS_FILE points at /var/run/secrets/aws/credentials (mount path plus the credentials key). The Secret itself is never rendered."
  painPoints:
    -
      id: "source-lock"
      detectedPainPoint: "pins the exact artifact oci://public.ecr.aws/aws-controllers-k8s/iam-chart with packageSHA256 598f87feacd5fc04403e37bda75ba6e56170f43778986ac411702d6207a82730; resolution is artifact-addressed. Reproduction requires HELM_EXPT_CHART_ARTIFACT_URL and HELM_EXPT_CHART_ARTIFACT_SHA256 exported at generate and verify time."
      evidence:
        - "source-lock.yaml"
      configHubHome: "source-lock"
      disposition: "absorbed-into-recipe"
      linkedReceipt: "source-lock.yaml"
      supportedVariantStatus: "handled"
    -
      id: "dependency-lock"
      detectedPainPoint: "the chart has zero subcharts and zero subchart conditions, so the dependency lock records an empty dependency list"
      evidence:
        - "dependency-lock.yaml"
      configHubHome: "dependency-lock"
      disposition: "absorbed-into-recipe"
      linkedReceipt: "dependency-lock.yaml"
      supportedVariantStatus: "handled"
    -
      id: "capability-profile"
      detectedPainPoint: "both variants pin kubeVersion 1.31.0 with an empty apiVersions list; no template consults .Capabilities, so the profile is a pin rather than a behavior switch"
      evidence:
        - "control-points.yaml"
      configHubHome: "capability-profile"
      disposition: "handled-by-capability-profile"
      linkedReceipt: "revisions/default/r001/receipts/render-receipt.yaml"
      supportedVariantStatus: "handled"
    -
      id: "lifecycle-policy"
      detectedPainPoint: "the chart renders zero helm hooks and zero test hooks; the render drops --no-hooks so any future hook would surface in the rendered objects instead of being silently skipped"
      evidence:
        - "hooks-rendered-visible"
      configHubHome: "lifecycle-policy"
      disposition: "handled-by-lifecycle-policy"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "handled"
    -
      id: "crd-policy"
      detectedPainPoint: "nine CRDs ship from the chart's crds/ directory. Both flattening verdicts land on flatten-with-routes with one route, the CRD ordering declaration; the eks-inference producer already emits exactly this as the crds/controller split at Argo sync waves -20 and -10. Never present this chart as flatten-clean without the route."
      evidence:
        - "control-points.yaml"
      configHubHome: "recipe"
      disposition: "needs-operator-decision"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "route-required"
    -
      id: "namespace"
      detectedPainPoint: "both bases target ack-system with releaseName ack-iam; the chart creates no Namespace object, so the installer's default support object v1|Namespace||ack-system covers it"
      evidence:
        - "control-points.yaml"
      configHubHome: "recipe"
      disposition: "absorbed-into-recipe"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "handled-by-installer"
    -
      id: "credentials-secrets"
      detectedPainPoint: "the chart generates no Secrets and renders none in either base. The eks-inference base references the external Secret ack-system/aws-creds (key credentials); the Deployment mounts the Secret volume read-only at /var/run/secrets/aws and AWS_SHARED_CREDENTIALS_FILE points at /var/run/secrets/aws/credentials, so the Secret must exist before the controller pod starts. The default base carries no credential reference at all."
      evidence:
        - "control-points.yaml"
      configHubHome: "recipe"
      disposition: "needs-operator-decision"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "required-target-fact-for-eks-inference"
    -
      id: "extension-slots"
      detectedPainPoint: "deployment.extraEnvVars, extraVolumes, extraVolumeMounts, tolerations, affinity, strategy, annotations and labels are all empty at the audited values; the templates wire them through but nothing in either rendered revision exercises them"
      evidence:
        - "control-points.yaml"
      configHubHome: "extension-slot"
      disposition: "needs-operator-decision"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "unused-in-audited-bases"
    -
      id: "scan-gate"
      detectedPainPoint: "Current scan gate is warn-production-blocked"
      evidence:
        - "helm-plan.yaml"
        - "scan receipts"
        - "install gates"
      configHubHome: "scan-gate"
      disposition: "handled-by-scan-or-gate"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "warn-production-blocked"
    -
      id: "value-model-diagnostics"
      detectedPainPoint: "Helm values can be unknown, dead, misspelled, shadowed, or ignored unless the values model records the analysis boundary."
      evidence:
        - "value-model.yaml"
      configHubHome: "value-model"
      disposition: "absorbed-into-value-model"
      linkedReceipt: "value-model.yaml"
      supportedVariantStatus: "unknown=deployment.extraEnvVars, extraVolumes, extraVolumeMounts, tolerations, affinity, strategy, resourceTags, reconcile resync tuning, enableCARM, enableCrossNamespace and the remaining feature gates stay at chart defaults in both audited bases; not exhaustively checked; dead=not-checked; ignored=not-checked"
  answerForSkepticalHelmUser: "aws-controllers-k8s/iam-chart@1.7.3 maps its detected Helm pain to 8 ConfigHub control areas: source-lock, dependency-lock, capability-profile, lifecycle-policy, recipe, extension-slot, scan-gate, value-model. No supported scopes are declared; production readiness remains not-reviewed-for-production."