apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "GitOpsRuntimeReview"
metadata:
  name: "mongodb-existing-secret-replicaset-argocd-statefulset-sync"
  chart: "bitnami/mongodb"
  version: "19.0.7"
spec:
  base: "existing-secret-replicaset"
  controller: "Argo CD"
  targetShape: "cub-managed kind proof cluster with ConfigHub OCI source and staged mongodb-auth target fact Secret"
  receipt: "runs/live-helm-confighub-compare/bitnami-mongodb-existing-secret-replicaset/receipt.yaml"
  observedResult: "pass"
  passed:
    - "regular Helm live leg reached the expected runtime state"
    - "ConfigHub direct-apply leg reached the expected runtime state"
    - "ConfigHub OCI/Argo leg reached the expected workload runtime state"
    - "ConfigHub OCI/Argo Application reached Synced/Healthy"
    - "Helm-vs-ConfigHub semantic parity passed for the OCI/Argo leg"
    - "target fact Secret mongodb/mongodb-auth was staged with mongodb-root-password and mongodb-replica-set-key"
    - "MongoDB primary/secondary StatefulSet and arbiter StatefulSet became ready"
  gitOpsCondition:
    sync: "Synced"
    health: "Healthy"
    canonicalizationProfile: "k8s-zero-defaults"
  diagnosis:
    summary: "The desired OCI artifact materializes Kubernetes StatefulSet defaults that Argo otherwise reports as drift after server-side apply."
    materializedDefaultedFields:
      - "spec.persistentVolumeClaimRetentionPolicy"
      - "spec.revisionHistoryLimit"
      - "env.valueFrom.fieldRef.apiVersion"
      - "container port protocol defaults"
      - "terminationMessagePath and terminationMessagePolicy"
      - "spec.template.spec.restartPolicy"
      - "spec.template.spec.dnsPolicy"
      - "spec.template.spec.schedulerName"
      - "spec.template.spec.terminationGracePeriodSeconds"
      - "spec.template.spec.serviceAccount from serviceAccountName"
      - "secret defaultMode"
      - "volumeClaimTemplates apiVersion/kind/status/volumeMode defaults"
    interpretation: "This is GitOps/runtime canonicalization for Kubernetes API defaults. Semantic parity remains checked against the Helm render and passed for both direct apply and OCI/Argo."
  nextActions:
    - "Keep the canonicalization profile opt-in and receipt-bound for StatefulSet-heavy GitOps rows."
    - "Keep the existing Secret target-fact path explicit; ConfigHub does not silently invent MongoDB credentials for this base."
    - "Record separate production decisions for MongoDB backup, restore, storage class, retention, topology, and upgrade policy before claiming production support."
  notClaimed:
    - "This review does not prove production MongoDB backup, restore, storage class, retention, topology, or upgrade policy."
    - "This review does not generalize to every StatefulSet chart without a matching live receipt."