apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "ControlPoints"
metadata:
  name: "bitnami-nginx-24.0.2"
spec:
  points:
    -
      category: "source-lock"
      status: "handled"
      evidence: "source-lock.yaml"
    -
      category: "dependency-lock"
      status: "handled"
      evidence: "dependency-lock.yaml"
      note: "chart declares no subchart dependencies; the empty closure is recorded explicitly."
    -
      category: "capability-profile"
      status: "handled"
      kubeVersion: "1.30.0"
      note: "Kubernetes API and version branches are bound to the named Kubernetes capability profile."
    -
      category: "generated-facts"
      status: "variant-controlled"
      evidence: "tls.autoGenerated / genCA / genSignedCert"
      note: "The chart default auto-generates TLS material; promoted variants either disable TLS or require existing TLS Secrets before render."
    -
      category: "target-facts"
      status: "variant-controlled"
      evidence: "tls.existingSecret / ingress.extraTls"
      note: "The existing-tls-ingress variant declares backend and ingress TLS Secrets instead of rendering generated certs."
    -
      category: "deployment-workload"
      status: "scan-and-review"
      object: "apps/v1|Deployment|nginx|nginx"
    -
      category: "edge-ingress-policy"
      status: "variant-controlled"
      object: "networking.k8s.io/v1|Ingress|nginx|nginx"
    -
      category: "network-policy"
      status: "scan-and-review"
      object: "networking.k8s.io/v1|NetworkPolicy|nginx|nginx"
    -
      category: "availability-policy"
      status: "scan-and-review"
      object: "policy/v1|PodDisruptionBudget|nginx|nginx"
    -
      category: "extension-slots"
      status: "controlled-by-empty-defaults"
      note: "serverBlock, streamServerBlock, extraDeploy, git-clone, metrics, and sidecar slots are empty or disabled in promoted variants."
    -
      category: "installer-support-object"
      status: "handled"
      object: "v1|Namespace||nginx"