<!-- Generated by npm run catalog:weirdness. Do not edit by hand. -->

# bitnami/nginx 24.0.2 Weirdness And Mitigations

This note records the Helm pain surfaced during catalog review and where the
current ConfigHub/cub installer proof absorbs it.

## Support Boundary

| Field | Value |
| --- | --- |
| Catalog status | catalog-supported |
| Support level | supported-for-declared-scopes |
| Supported scopes | local-test |
| Production readiness | production-review-ready |
| Variants in this note | http-clusterip, existing-tls-ingress |

Production support is not implied by this file. A chart can be supported for
local proof/demo use while still needing accepted scan, gate, lifecycle, and
operating-policy dispositions plus a final target-scoped support decision.

## Chart Notes

- Default chart rendering is nondeterministic because tls.autoGenerated creates fresh certificate material.
- http-clusterip disables TLS generation and keeps service exposure internal.
- existing-tls-ingress requires declared backend and ingress TLS Secrets instead of rendering generated certs.
- Supported bases pin the Bitnami NGINX image by digest instead of rendering the chart default latest tag.
- existing-tls-ingress adds explicit ingress host, ingress class, and TLS Secret reference.
- serverBlock, streamServerBlock, extraDeploy, git-clone, metrics, and sidecar slots are powerful extension surfaces; promoted variants keep them empty or disabled.

## Catalog Mitigations

- Supported for local-test and proof-demo usage through real cub installer and ConfigHub receipts.
- http-clusterip is the simplest low-friction happy path.
- existing-tls-ingress is supported when the declared TLS Secret target facts are satisfied.
- Production recommendation remains a separate decision; the production disposition lane records current review-ready or blocking state.

## Control Points

| Control point | Status | Mitigation / evidence |
| --- | --- | --- |
| source-lock | handled | source-lock.yaml |
| dependency-lock | handled | chart declares no subchart dependencies; the empty closure is recorded explicitly. |
| capability-profile | handled | Kubernetes API and version branches are bound to the named Kubernetes capability profile. |
| generated-facts | variant-controlled | The chart default auto-generates TLS material; promoted variants either disable TLS or require existing TLS Secrets before render. |
| target-facts | variant-controlled | The existing-tls-ingress variant declares backend and ingress TLS Secrets instead of rendering generated certs. |
| deployment-workload | scan-and-review | apps/v1\|Deployment\|nginx\|nginx |
| edge-ingress-policy | variant-controlled | networking.k8s.io/v1\|Ingress\|nginx\|nginx |
| network-policy | scan-and-review | networking.k8s.io/v1\|NetworkPolicy\|nginx\|nginx |
| availability-policy | scan-and-review | policy/v1\|PodDisruptionBudget\|nginx\|nginx |
| extension-slots | controlled-by-empty-defaults | serverBlock, streamServerBlock, extraDeploy, git-clone, metrics, and sidecar slots are empty or disabled in promoted variants. |
| installer-support-object | handled | v1\|Namespace\|\|nginx |

## Control Point Index

- availability-policy
- capability-profile
- dependency-lock
- deployment-workload
- edge-ingress-policy
- extension-slots
- generated-facts
- installer-support-object
- metrics-addon-policy
- network-policy
- raw-template-extension-slots
- source-lock
- static-site-supply-chain
- target-facts

## Proof Links

- Catalog map: [CATALOG.md](CATALOG.md)
- Machine index: [artifact-index.yaml](artifact-index.yaml)
- Helm plan: [helm-plan.yaml](helm-plan.yaml)
- Control points: [control-points.yaml](control-points.yaml)
- Chart dossier: [chart-dossier.yaml](chart-dossier.yaml)