apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "TargetTopology"
metadata:
  name: "hashicorp-consul-2.0.0"
spec:
  chart: "hashicorp/consul@2.0.0"
  scope: "target shape required by each supported base after render parity has passed"
  bases:
    defaultControlPlane:
      variant: "default-control-plane"
      status: "single-node-compatible"
      reason: "the curated default base disables disruptive PDB behavior for local proof and has live parity on the standard proof target"
    secureMeshExistingSecrets:
      variant: "secure-mesh-existing-secrets"
      status: "target-fit-required"
      targetFit:
        minimumSchedulableNodes: 3
        requiresPersistentStorage: true
        requiresIngressController: true
        requiresGatewayPolicyReview: true
        reason: "the base renders three Consul server replicas with pod anti-affinity, mesh gateway, ingress gateway, terminating gateway, UI ingress, injector webhook, and ACL init Job"
      prerequisites:
        secrets:
          - "consul/consul-ca-cert tls.crt"
          - "consul/consul-server-cert tls.crt,tls.key"
          - "consul/consul-gossip-encryption-key key"
          - "consul/consul-bootstrap-acl-token token"
        secretContracts:
          - name: "consul-ca-cert"
            namespace: "consul"
            keys:
              - "tls.crt"
            contract: "CA certificate that signs consul-server-cert"
          - name: "consul-server-cert"
            namespace: "consul"
            keys:
              - "tls.crt"
              - "tls.key"
            contract: "server certificate and private key trusted by consul-ca-cert"
            caSecretName: "consul-ca-cert"
            requiredDNSNames:
              - "server.dc1.consul"
              - "consul-consul-server"
              - "consul-consul-server.consul"
              - "consul-consul-server.consul.svc"
              - "consul-consul-server.consul-helm"
              - "consul-consul-server.consul-helm.svc"
              - "consul-consul-server.consul-apply"
              - "consul-consul-server.consul-apply.svc"
              - "consul-consul-server.consul-oci"
              - "consul-consul-server.consul-oci.svc"
            failureMode: "A Secret can exist with tls.crt/tls.key and still fail runtime if the certificate lacks the DNS SANs Consul verifies during server RPC and ACL bootstrap."
          - name: "consul-gossip-encryption-key"
            namespace: "consul"
            keys:
              - "key"
            contract: "Consul gossip encryption key material"
          - name: "consul-bootstrap-acl-token"
            namespace: "consul"
            keys:
              - "token"
            contract: "ACL bootstrap token accepted by the Consul ACL init Job"
        policyReviews:
          - "CRD ownership"
          - "cluster RBAC"
          - "injector webhook readiness"
          - "ACL bootstrap lifecycle"
          - "namespace reference alignment"
          - "mesh, ingress, and terminating gateway exposure"
          - "UI ingress exposure"
      requiredReceipts:
        - "target-fit-observation-receipt"
        - "secret-preflight-receipt"
        - "webhook-readiness-receipt"
        - "gateway-policy-receipt"
        - "tls-san-preflight-receipt"
        - "namespace-reference-preflight-receipt"
  notProvenBy:
    - "one-node kind runtime readiness"
    - "render parity alone"
    - "presence of target Secret names without live Secret/preflight evidence"
    - "presence of tls.crt/tls.key without certificate SAN validation"
    - "generic namespace rewriting without proving Consul service DNS and Secret namespace references"