apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "InstallGate"
metadata:
  name: "nginx-existing-tls-ingress-r001"
spec:
  variantRevision: "../variant-revision.yaml"
  renderedObjectSetSHA256: "cb5cdb64d2f05a0f3e2b2d07facc3d08705f86b3a34a3f52c891bdbd28d44e8f"
  decision: "warn"
  allowedScopes:
    - "local-test"
  blockedScopes:
    - "production"
  reasons:
    - "Helm equivalence passed for existing-tls-ingress"
    - "Default generated TLS is either disabled or replaced by explicit target Secret requirements"
    - "Helm hook behavior needs explicit lifecycle policy before production"
    - "NGINX deployment, NetworkPolicy, PDB, service exposure, ingress, and extension slots need production review"
    - "requires target Secrets nginx/nginx-backend-tls and nginx/nginx-ingress-tls before apply"