apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "HelmPainReport"
metadata:
  name: "bitnami-nginx-24.0.4"
spec:
  chart:
    name: "bitnami/nginx"
    version: "24.0.4"
    source: "https://charts.bitnami.com/bitnami"
    digest: "6040ee8d0da1aa514388845941d85b78cd38908eb375b2c551fbefbd1f3397d9"
  supportedScopeStatus: "no-unhandled-pain-points-for-supported-scopes"
  supportedScopes:
    []
  supportedVariants:
    []
  productionReadiness: "not-reviewed-for-production"
  notes:
    - "Default chart rendering is nondeterministic because tls.autoGenerated creates fresh certificate material."
    - "http-clusterip disables TLS generation and keeps service exposure internal."
    - "existing-tls-ingress requires declared backend and ingress TLS Secrets instead of rendering generated certs."
    - "Supported bases pin the Bitnami NGINX image by digest instead of rendering the chart default latest tag."
    - "existing-tls-ingress adds explicit ingress host, ingress class, and TLS Secret reference."
    - "serverBlock, streamServerBlock, extraDeploy, git-clone, metrics, and sidecar slots are powerful extension surfaces; promoted variants keep them empty or disabled."
  painPoints:
    -
      id: "source-lock"
      detectedPainPoint: "source-lock requires source-lock.yaml"
      evidence:
        - "source-lock.yaml"
      configHubHome: "source-lock"
      disposition: "absorbed-into-recipe"
      linkedReceipt: "source-lock.yaml"
      supportedVariantStatus: "handled"
    -
      id: "dependency-lock"
      detectedPainPoint: "chart declares no subchart dependencies; the empty closure is recorded explicitly."
      evidence:
        - "dependency-lock.yaml"
      configHubHome: "dependency-lock"
      disposition: "absorbed-into-recipe"
      linkedReceipt: "dependency-lock.yaml"
      supportedVariantStatus: "handled"
    -
      id: "capability-profile"
      detectedPainPoint: "Kubernetes API and version branches are bound to the named Kubernetes capability profile."
      evidence:
        - "control-points.yaml"
      configHubHome: "capability-profile"
      disposition: "handled-by-capability-profile"
      linkedReceipt: "revisions/http-clusterip/r001/receipts/render-receipt.yaml"
      supportedVariantStatus: "handled"
    -
      id: "generated-facts"
      detectedPainPoint: "The chart default auto-generates TLS material; promoted variants either disable TLS or require existing TLS Secrets before render."
      evidence:
        - "tls.autoGenerated / genCA / genSignedCert"
      configHubHome: "generated-fact"
      disposition: "handled-by-generated-facts"
      linkedReceipt: "value-model.yaml"
      supportedVariantStatus: "variant-controlled"
    -
      id: "target-facts"
      detectedPainPoint: "The existing-tls-ingress variant declares backend and ingress TLS Secrets instead of rendering generated certs."
      evidence:
        - "tls.existingSecret / ingress.extraTls"
      configHubHome: "target-fact-requirement"
      disposition: "handled-by-target-fact-values"
      linkedReceipt: "value-model.yaml"
      supportedVariantStatus: "variant-controlled"
    -
      id: "deployment-workload"
      detectedPainPoint: "deployment-workload affects apps/v1|Deployment|nginx|nginx"
      evidence:
        - "apps/v1|Deployment|nginx|nginx"
      configHubHome: "recipe"
      disposition: "handled-by-scan-or-gate"
      linkedReceipt: "revisions/http-clusterip/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "scan-and-review"
    -
      id: "edge-ingress-policy"
      detectedPainPoint: "edge-ingress-policy affects networking.k8s.io/v1|Ingress|nginx|nginx"
      evidence:
        - "networking.k8s.io/v1|Ingress|nginx|nginx"
      configHubHome: "recipe"
      disposition: "needs-operator-decision"
      linkedReceipt: "revisions/http-clusterip/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "variant-controlled"
    -
      id: "network-policy"
      detectedPainPoint: "network-policy affects networking.k8s.io/v1|NetworkPolicy|nginx|nginx"
      evidence:
        - "networking.k8s.io/v1|NetworkPolicy|nginx|nginx"
      configHubHome: "recipe"
      disposition: "handled-by-scan-or-gate"
      linkedReceipt: "revisions/http-clusterip/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "scan-and-review"
    -
      id: "availability-policy"
      detectedPainPoint: "availability-policy affects policy/v1|PodDisruptionBudget|nginx|nginx"
      evidence:
        - "policy/v1|PodDisruptionBudget|nginx|nginx"
      configHubHome: "recipe"
      disposition: "handled-by-scan-or-gate"
      linkedReceipt: "revisions/http-clusterip/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "scan-and-review"
    -
      id: "extension-slots"
      detectedPainPoint: "serverBlock, streamServerBlock, extraDeploy, git-clone, metrics, and sidecar slots are empty or disabled in promoted variants."
      evidence:
        - "control-points.yaml"
      configHubHome: "extension-slot"
      disposition: "needs-operator-decision"
      linkedReceipt: "revisions/http-clusterip/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "controlled-by-empty-defaults"
    -
      id: "installer-support-object"
      detectedPainPoint: "installer-support-object affects v1|Namespace||nginx"
      evidence:
        - "v1|Namespace||nginx"
      configHubHome: "recipe"
      disposition: "absorbed-into-recipe"
      linkedReceipt: "revisions/http-clusterip/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "handled"
    -
      id: "scan-gate"
      detectedPainPoint: "Current scan gate is warn-production-blocked"
      evidence:
        - "helm-plan.yaml"
        - "scan receipts"
        - "install gates"
      configHubHome: "scan-gate"
      disposition: "handled-by-scan-or-gate"
      linkedReceipt: "revisions/http-clusterip/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "warn-production-blocked"
    -
      id: "value-model-diagnostics"
      detectedPainPoint: "Helm values can be unknown, dead, misspelled, shadowed, or ignored unless the values model records the analysis boundary."
      evidence:
        - "value-model.yaml"
      configHubHome: "value-model"
      disposition: "absorbed-into-value-model"
      linkedReceipt: "value-model.yaml"
      supportedVariantStatus: "unknown=not-checked; dead=not-checked; ignored=not-checked"
  answerForSkepticalHelmUser: "bitnami/nginx@24.0.4 maps its detected Helm pain to 9 ConfigHub control areas: source-lock, dependency-lock, capability-profile, generated-fact, target-fact-requirement, recipe, extension-slot, scan-gate, value-model. Supported scopes have explicit variants, receipts, scans/gates, and control-point dispositions; production readiness remains not-reviewed-for-production."