apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "InstallGate"
metadata:
  name: "mongodb-existing-secret-replicaset-r001"
spec:
  variantRevision: "../variant-revision.yaml"
  renderedObjectSetSHA256: "b39a69abcab4c663d77a1176895385b5c864766a5ac19b16953d3cfd4597adcd"
  decision: "warn"
  allowedScopes:
    - "local-test"
  blockedScopes:
    - "production"
  reasons:
    - "Helm equivalence passed for existing-secret-replicaset"
    - "Generated credential handling needs explicit generated fact or target fact policy before production"
    - "The no-hooks lifecycle boundary is explicit; any future hook-producing path needs a separate lifecycle route before production"
    - "MongoDB Deployment/StatefulSet storage, upgrade, and rollback policy need production review"
    - "Replica-set topology, arbiter behavior, NetworkPolicy, and PDB need production review"
    - "requires target Secret mongodb/mongodb-auth with root password and MongoDB-valid replica-set key before apply"