apiVersion: helm-expt.confighub.com/v1alpha1
kind: HelmPlan
metadata:
  name: bitnami-redis-25.5.3
spec:
  readiness:
    status: usable-with-controls
    chart: bitnami/redis
    version: 25.5.3
    variants:
      - default
      - reuse-existing-secret
    helmObjectsByVariant:
      default: 14
      reuse-existing-secret: 13
    cubInstallObjectsByVariant:
      default: 15
      reuse-existing-secret: 14
    helmMatchByVariant:
      default: "14/14"
      reuse-existing-secret: "13/13"
    scanGate: warn-production-blocked
    nextAction: resolve or waive local scan findings, then publish through ConfigHub OCI
  reports:
    painReport: helm-pain-report.yaml
    valuesDiagnostics: values-diagnostics.yaml
    valueSourceMap: value-source-map.yaml
  painPointSummary:
    status: no-unhandled-pain-points-for-default-proof-path
    handled:
      - generated credential risk -> generated fact receipt
      - target Secret requirement -> target facts
      - Kubernetes capability branching -> named capability profile
      - Helm hooks -> no-hooks lifecycle policy for render proof
      - rendered Secret handling -> cub installer secret separation
      - mutable image findings -> image.digest in effective values
      - ignored value risk -> values diagnostics
  receipts:
    - helm-pain-report.yaml
    - values-diagnostics.yaml
    - value-source-map.yaml
    - revisions/default/r001/receipts/helm-equivalence-receipt.yaml
    - revisions/default/r001/receipts/generated-fact-receipt.yaml
    - revisions/default/r001/receipts/render-receipt.yaml
    - revisions/default/r001/receipts/scan-receipt.yaml
    - revisions/default/r001/receipts/install-gate.yaml
    - revisions/reuse-existing-secret/r001/receipts/helm-equivalence-receipt.yaml
    - revisions/reuse-existing-secret/r001/receipts/render-receipt.yaml
    - revisions/reuse-existing-secret/r001/receipts/scan-receipt.yaml
    - revisions/reuse-existing-secret/r001/receipts/install-gate.yaml
    - diffs/default-to-reuse-existing-secret.yaml
    - operations/default-to-reuse-existing-secret/upgrade-simulation-receipt.yaml
    - operations/reuse-existing-secret-to-default/rollback-simulation-receipt.yaml