apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "InstallGate"
metadata:
  name: "consul-default-control-plane-r001"
spec:
  variantRevision: "../variant-revision.yaml"
  renderedObjectSetSHA256: "7efa3e8b59c702c8b8fa744a0ff91198e09ad8ba0fb93a86b50c3fd9e39d29f7"
  decision: "warn"
  allowedScopes:
    - "local-test"
  blockedScopes:
    - "production"
  reasons:
    - "Helm equivalence passed for default-control-plane"
    - "Consul TLS, ACL, gossip, gateway, CRD, and UI posture are explicit variant choices"
    - "Helm hook behavior needs explicit lifecycle policy before production"
    - "Consul CRDs, cluster RBAC, injector webhooks, StatefulSet storage, gateway topology, UI ingress, ACL init Job, and extension slots need production review"
    - "uses chart-default Consul control-plane posture; TLS and ACLs are disabled and must be policy-reviewed before production"