<!-- Generated by npm run catalog:weirdness. Do not edit by hand. -->

# bitnami/postgresql 18.6.7 Weirdness And Mitigations

This note records the Helm pain surfaced during catalog review and where the
current ConfigHub/cub installer proof absorbs it.

## Support Boundary

| Field | Value |
| --- | --- |
| Catalog status | catalog-supported |
| Support level | supported-for-declared-scopes |
| Supported scopes | local-test |
| Production readiness | production-review-ready |
| Variants in this note | static-passwords, existing-secret |

Production support is not implied by this file. A chart can be supported for
local proof/demo use while still needing accepted scan, gate, lifecycle, and
operating-policy dispositions plus a final target-scoped support decision.

## Chart Notes

- Default chart rendering is nondeterministic unless auth.postgresPassword is bound before render.
- static-passwords variant persists auth.postgresPassword as a generated fact and renders the Secret deterministically.
- existing-secret variant does not render a Secret and instead declares postgresql/postgresql-auth as a target fact.
- Supported bases pin the Bitnami PostgreSQL image by digest instead of rendering the chart default latest tag.
- Chart declares the Bitnami common dependency and records it in dependency-lock.yaml.
- Supported bases render no hook objects, and future hook-producing paths must map to lifecycle policy before production.
- PostgreSQL renders a StatefulSet with volumeClaimTemplates and needs storage/upgrade/rollback policy.
- initdb and extended configuration are template-powered extension slots; promoted variants keep them empty.

## Catalog Mitigations

- Supported for local-test and proof-demo usage through real cub installer and ConfigHub receipts.
- existing-secret is the package default. It renders no PostgreSQL Secret and is supported when the declared postgresql-auth target fact is satisfied.
- static-passwords is kept as an explicit demo path. It ships a fixed, shared demo password baked into the rendered Secret (base64) — identical on every install and readable from the manifest.
- Production recommendation remains a separate decision; the production disposition lane records current review-ready or blocking state.
- Target production review must choose storage class and database backup/restore mechanism before use.

## Control Points

| Control point | Status | Mitigation / evidence |
| --- | --- | --- |
| source-lock | handled | source-lock.yaml |
| dependency-lock | handled | chart declares the Bitnami common dependency; promoted variants lock its metadata. |
| capability-profile | handled | Kubernetes API and version branches are bound to the named Kubernetes capability profile. |
| generated-facts | variant-controlled | The static-passwords variant binds the generated password before render so Helm output is deterministic. |
| target-facts | variant-controlled | The existing-secret variant declares the target Secret instead of rendering one. |
| image-digest | handled | Supported bases pin the Bitnami PostgreSQL image by digest. |
| hook-policy | handled-for-render | The retained source scan records hook count 0 for this pinned chart version. Supported bases render no hook objects; future hook-producing paths must map to lifecycle policy before production. |
| stateful-workload | scan-and-review | apps/v1\|StatefulSet\|postgresql\|postgresql |
| pvc-policy | scan-and-review | StatefulSet volumeClaimTemplates need storage, retention, upgrade, and rollback policy. |
| tpl | controlled-by-empty-defaults | initdb and extended configuration slots use templating; promoted variants do not populate them. |
| installer-support-object | handled | v1\|Namespace\|\|postgresql |

## Control Point Index

- capability-profile
- dependency-lock
- generated-facts
- hook-lifecycle-policy
- hook-policy
- image-digest
- installer-support-object
- pvc-policy
- source-lock
- stateful-workload
- stateful-workload-policy
- target-facts
- tpl
- tpl-extension-slot

## Proof Links

- Catalog map: [CATALOG.md](CATALOG.md)
- Machine index: [artifact-index.yaml](artifact-index.yaml)
- Helm plan: [helm-plan.yaml](helm-plan.yaml)
- Control points: [control-points.yaml](control-points.yaml)
- Chart dossier: [chart-dossier.yaml](chart-dossier.yaml)