apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "HelmPainReport"
metadata:
  name: "eks-aws-efa-k8s-device-plugin-v0.5.29"
spec:
  chart:
    name: "eks/aws-efa-k8s-device-plugin"
    version: "v0.5.29"
    source: "https://aws.github.io/eks-charts"
    digest: "078610ef669714f39be77d133674c7721fb3ca123213b3d6b16938c8c0d2e034"
  supportedScopeStatus: "no-unhandled-pain-points-for-supported-scopes"
  supportedScopes:
    []
  supportedVariants:
    []
  productionReadiness: "not-reviewed-for-production"
  notes:
    - "This package is the exact aws-efa-k8s-device-plugin@v0.5.29 chart, locked by archive URL and SHA-256."
    - "With chart defaults aws-efa-k8s-device-plugin@v0.5.29 renders 1 object as release aws-efa: one DaemonSet. It renders no CRD, no Secret, no RBAC and no Helm hook."
    - "The archive's Chart.yaml names the version v0.5.29 and the application version v0.5.20. The AICR Applications ask for 0.5.29, which Helm resolves to this archive; the archive SHA-256 equals the one the AICR v0.20.0 nested-render receipt records."
    - "The aicr-eks-training base renders 1 objects with the values the AICR v0.20.0 and AICR v1.0.0 EKS training entries supply (examples/aicr/eks-h100-training-kubeflow-v0-20-0/argocd-helm-bundle/002-aws-efa/values.yaml and examples/aicr/eks-h100-training-kubeflow-v1-0-0/argocd-helm-bundle/002-aws-efa/values.yaml): the full name set to aws-efa-k8s-device-plugin, the DaemonSet selected onto nodes labelled nvidia.com/gpu.present and tolerating every taint, the image named explicitly, resource requests set, and the container security context tightened. Its objects equal the AICR v0.20.0 nested render of the same archive, object for object. The AICR v1.0.0 entry retains these values and no render of this component, so this base is bound to the bundle's checksum list and its Application pin and is not compared with an AICR render."
    - "The DaemonSet carries no metadata.namespace, because the chart template leaves it to Helm. A flattened copy must be applied into kube-system."
    - "The chart contains no lookup, no .Capabilities branch, no generated credential, no hook and no subchart."
    - "The retained root proves exact source bytes, deterministic rendering, and deterministic ConfigHub installer packaging. It does not claim publication, live convergence, or production support."
  painPoints:
    -
      id: "source-lock"
      detectedPainPoint: "source-lock requires source-lock.yaml"
      evidence:
        - "source-lock.yaml"
      configHubHome: "source-lock"
      disposition: "absorbed-into-recipe"
      linkedReceipt: "source-lock.yaml"
      supportedVariantStatus: "handled"
    -
      id: "dependency-lock"
      detectedPainPoint: "dependency-lock requires dependency-lock.yaml"
      evidence:
        - "dependency-lock.yaml"
      configHubHome: "dependency-lock"
      disposition: "absorbed-into-recipe"
      linkedReceipt: "dependency-lock.yaml"
      supportedVariantStatus: "handled"
    -
      id: "capability-profile"
      detectedPainPoint: "capability-profile is detected in this chart and mapped to a ConfigHub control point"
      evidence:
        - "control-points.yaml"
      configHubHome: "capability-profile"
      disposition: "handled-by-capability-profile"
      linkedReceipt: "revisions/default/r001/receipts/render-receipt.yaml"
      supportedVariantStatus: "handled"
    -
      id: "lifecycle-policy"
      detectedPainPoint: "no base's render contains a Helm hook object, with or without --no-hooks"
      evidence:
        - "no-hooks"
      configHubHome: "lifecycle-policy"
      disposition: "handled-by-lifecycle-policy"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "handled"
    -
      id: "target-facts"
      detectedPainPoint: "this base needs no CRD on the target; the DaemonSet carries no namespace, so it must be applied into kube-system; the image is in a regional Amazon ECR registry that needs AWS credentials to pull"
      evidence:
        - "control-points.yaml"
      configHubHome: "target-fact-requirement"
      disposition: "handled-by-target-fact-values"
      linkedReceipt: "value-model.yaml"
      supportedVariantStatus: "review-required"
    -
      id: "catalog-coverage"
      detectedPainPoint: "exact source and deterministic package are retained; publication, live qualification and production support remain separate gates"
      evidence:
        - "control-points.yaml"
      configHubHome: "recipe"
      disposition: "needs-operator-decision"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "packaged-with-controls"
    -
      id: "scan-gate"
      detectedPainPoint: "Current scan gate is warn-production-blocked"
      evidence:
        - "helm-plan.yaml"
        - "scan receipts"
        - "install gates"
      configHubHome: "scan-gate"
      disposition: "handled-by-scan-or-gate"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "warn-production-blocked"
    -
      id: "value-model-diagnostics"
      detectedPainPoint: "Helm values can be unknown, dead, misspelled, shadowed, or ignored unless the values model records the analysis boundary."
      evidence:
        - "value-model.yaml"
      configHubHome: "value-model"
      disposition: "absorbed-into-value-model"
      linkedReceipt: "value-model.yaml"
      supportedVariantStatus: "unknown=not-exhaustively-checked-by-aicr-nested-charts-coverage-proof; dead=not-exhaustively-checked-by-aicr-nested-charts-coverage-proof; ignored=not-exhaustively-checked-by-aicr-nested-charts-coverage-proof"
  answerForSkepticalHelmUser: "eks/aws-efa-k8s-device-plugin@v0.5.29 maps its detected Helm pain to 8 ConfigHub control areas: source-lock, dependency-lock, capability-profile, lifecycle-policy, target-fact-requirement, recipe, scan-gate, value-model. No supported scopes are declared; production readiness remains not-reviewed-for-production."