apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "GitOpsRuntimeReview"
metadata:
  name: "nginx-existing-tls-ingress-argocd-ingress-health"
  chart: "bitnami/nginx"
  version: "24.0.2"
spec:
  base: "existing-tls-ingress"
  controller: "Argo CD"
  targetShape: "cub-managed kind proof cluster with target profile kind-ingress-nginx"
  receipt: "runs/live-helm-confighub-compare/bitnami-nginx-existing-tls-ingress/receipt.yaml"
  observedResult: "pass"
  targetProfile:
    name: "kind-ingress-nginx"
    provides:
      - "Ingress controller for ingressClassName=nginx"
      - "Ingress status.loadBalancer.ingress=localhost on kind"
  passed:
    - "regular Helm live leg reached the expected runtime state"
    - "ConfigHub direct-apply leg reached the expected runtime state"
    - "ConfigHub OCI/Argo leg reached the expected workload runtime state"
    - "Helm-vs-ConfigHub semantic parity passed for the OCI/Argo leg"
    - "Argo CD reported the application Synced"
    - "Argo CD reported the application Healthy"
    - "Deployment nginx became ready"
    - "target fact Secret nginx/nginx-ingress-tls was staged"
    - "Ingress nginx/nginx received status.loadBalancer.ingress=localhost"
  gitOpsCondition:
    sync: "Synced"
    health: "Healthy"
    healthResource:
      apiVersion: "networking.k8s.io/v1"
      kind: "Ingress"
      namespace: "nginx"
      name: "nginx"
  diagnosis:
    summary: "The previous watch row was target-fit, not parity. When the proof target includes the kind-ingress-nginx profile, the Ingress receives a localhost address and Argo reports Healthy."
    observedIngress:
      ingressClassName: "nginx"
      host: "nginx.example.test"
      tlsSecret: "nginx-ingress-tls"
      statusLoadBalancer:
        ingress:
          - hostname: "localhost"
    interpretation: "The existing-tls-ingress base is live-ready for the tested kind ingress target profile. Production support still depends on the target's real ingress controller, DNS, TLS trust, and edge policy."
  nextActions:
    - "Use kind-ingress-nginx for local live proof of this base when ingress behavior is part of the test."
    - "For production, replace the kind target profile with the target's real ingress controller, DNS, TLS, and edge policy evidence."
    - "Alternatively, use the http-clusterip base as the simple local proof path when ingress is not part of the target."
  notClaimed:
    - "This row does not prove external ingress reachability on a real load balancer."
    - "This row does not prove certificate trust from an outside client."
    - "This row does not generalize to every ingress-enabled chart without a matching target-topology receipt."