<!-- Generated by npm run catalog:weirdness. Do not edit by hand. -->

# bitnami/redis 25.5.3 Weirdness And Mitigations

This note records the Helm pain surfaced during catalog review and where the
current ConfigHub/cub installer proof absorbs it.

## Support Boundary

| Field | Value |
| --- | --- |
| Catalog status | catalog-supported |
| Support level | supported-for-declared-scopes |
| Supported scopes | local-test |
| Production readiness | production-review-ready |
| Variants in this note | default, reuse-existing-secret |

Production support is not implied by this file. A chart can be supported for
local proof/demo use while still needing accepted scan, gate, lifecycle, and
operating-policy dispositions plus a final target-scoped support decision.

## Chart Notes

- Redis is stateful; PVC and credential behavior require explicit variant policy.
- Bitnami Redis can generate credentials unless a password/existing secret path is provided.
- Supported bases pin the Bitnami Redis image by digest instead of rendering the chart default latest tag.
- Default and reuse-existing-secret are the first proof variants; HA is a later slice.

## Catalog Mitigations

- First deliberately supported catalog entry.
- reuse-existing-secret is the package default. It renders no Redis Secret and requires redis/redis-existing-secret key redis-password before apply.
- The base named default is kept as an explicit demo path. It ships a fixed, shared demo password baked into the rendered Secret (base64 confighub-redis-password) — identical on every install and readable from the manifest.
- Production recommendation remains a separate decision; the production disposition lane records current review-ready or blocking state.
- Both variants are Helm-equivalent through cub installer setup.

## Control Points

| Control point | Status | Mitigation / evidence |
| --- | --- | --- |
| source-lock | handled | source-lock.yaml |
| dependency-lock | handled | dependency-lock.yaml |
| generated-facts | handled-for-default-proof | auth.password is bound before render and owned by revisions/default/r001/receipts/generated-fact-receipt.yaml. |
| target-facts | required-for-reuse-existing-secret | variants/reuse-existing-secret/variant.yaml |
| capability-profile | handled | recorded in control-points.yaml |
| hook-policy | handled | no-hooks |
| secret-handling | handled | cub installer separates one rendered Secret from uploaded manifests. |
| image-digest | handled | recorded in control-points.yaml |
| installer-support-object | handled | v1\|Namespace\|\|redis |

## Control Point Index

- capability-profile
- dependency-lock
- generated-facts
- hook-policy
- image-digest
- installer-support-object
- secret-handling
- source-lock
- target-facts

## Proof Links

- Catalog map: [CATALOG.md](CATALOG.md)
- Machine index: [artifact-index.yaml](artifact-index.yaml)
- Helm plan: [helm-plan.yaml](helm-plan.yaml)
- Control points: [control-points.yaml](control-points.yaml)
- Chart dossier: [chart-dossier.yaml](chart-dossier.yaml)