apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "InstallGate"
metadata:
  name: "consul-secure-mesh-existing-secrets-r001"
spec:
  variantRevision: "../variant-revision.yaml"
  renderedObjectSetSHA256: "0acc8c339c2965446b754c3a9c948c4f154ca6e47b074ddc3b8d315e2cb7c468"
  decision: "warn"
  allowedScopes:
    - "local-test"
  blockedScopes:
    - "production"
  reasons:
    - "Helm equivalence passed for secure-mesh-existing-secrets"
    - "Consul TLS, ACL, gossip, gateway, CRD, and UI posture are explicit variant choices"
    - "Helm hook behavior needs explicit lifecycle policy before production"
    - "Consul CRDs, cluster RBAC, injector webhooks, StatefulSet storage, gateway topology, UI ingress, ACL init Job, and extension slots need production review"
    - "requires target Secrets for CA, server certificate, gossip key, and ACL bootstrap token before apply"