<!-- Generated by npm run catalog:weirdness. Do not edit by hand. -->

# hashicorp/vault 0.32.0 Weirdness And Mitigations

This note records the Helm pain surfaced during catalog review and where the
current ConfigHub/cub installer proof absorbs it.

## Support Boundary

| Field | Value |
| --- | --- |
| Catalog status | catalog-supported |
| Support level | supported-for-declared-scopes |
| Supported scopes | local-test |
| Production readiness | production-review-ready |
| Variants in this note | dev-mode, default, ha-raft-ui |

Production support is not implied by this file. A chart can be supported for
local proof/demo use while still needing accepted scan, gate, lifecycle, and
operating-policy dispositions plus a final target-scoped support decision.

## Chart Notes

- The chart renders deterministically under pinned Helm, chart version, kube version, and values.
- The default variant keeps the chart defaults: standalone Vault server, injector webhook, and TLS disabled in the rendered Vault config.
- The ha-raft-ui variant enables integrated Raft HA and the UI Service as deliberate variant-controlled outputs.
- The dev-mode variant uses the upstream chart's dev server path for local proof and demos; it starts without init/unseal and is not a production support claim.
- The chart does not initialize or unseal Vault; init/unseal and recovery material are operating controls, not hidden render inputs.
- operating-policy.yaml records the post-render procedure required before default and HA bases can be called ready.
- The HA Raft variant needs a target that can schedule three Vault server replicas; one-node kind is useful for object parity but not for HA readiness.
- Injector webhook, cluster RBAC, TLS posture, storage, and service exposure are scan/gate review points.
- extra environment, Secret, volume, plugin, init, and sidecar extension slots are powerful config surfaces; promoted variants keep them empty.

## Catalog Mitigations

- Supported for local-test and proof-demo usage through real cub installer and ConfigHub receipts.
- default is the simplest local Vault chart path and the safer first production-review base.
- ha-raft-ui is supported as a richer HA/Raft/UI proof, but has target-sensitive service-selector and runtime caveats.
- RBAC, injector webhook, extension slots, storage/init/unseal/recovery, TLS posture, service exposure, and scan/gate warnings are recorded as production review input.
- Production recommendation remains a separate decision; Vault needs explicit init/unseal, recovery material, TLS, backup/restore, and live observation procedures before support.

## Control Points

| Control point | Status | Mitigation / evidence |
| --- | --- | --- |
| source-lock | handled | source-lock.yaml |
| dependency-lock | handled | chart declares no subchart dependencies; the empty closure is recorded explicitly. |
| capability-profile | handled | Kubernetes API and version branches are bound to the named Kubernetes capability profile. |
| stateful-workload | scan-and-review | apps/v1\|StatefulSet\|vault\|vault |
| admission-webhook | scan-and-review | admissionregistration.k8s.io/v1\|MutatingWebhookConfiguration\|\|vault-agent-injector-cfg |
| service-exposure | variant-controlled | v1\|Service\|vault\|vault-ui |
| tls-posture | scan-and-review | v1\|ConfigMap\|vault\|vault-config |
| cluster-rbac | scan-and-review | rbac.authorization.k8s.io/v1\|ClusterRole\|\|vault-agent-injector-clusterrole |
| operate-policy | policy-required | Vault init, unseal, seal migration, recovery material, and freshness evidence are post-render operating controls. |
| target-topology | target-review | The ha-raft-ui base renders three Vault server replicas. A one-node kind target is useful for object parity, but HA live readiness needs a target that can schedule the declared topology plus an init/unseal operating path. |
| extension-slots | controlled-by-empty-defaults | extra environment, Secret, volume, plugin, init, and sidecar slots are empty in promoted variants. |
| installer-support-object | handled | v1\|Namespace\|\|vault |

## Control Point Index

- admission-webhook
- capability-profile
- cluster-rbac
- dependency-lock
- extension-slots
- installer-support-object
- operate-policy
- rbac-review
- secret-extension-slots
- service-exposure
- source-lock
- stateful-workload
- target-topology
- tls-posture

## Proof Links

- Catalog map: [CATALOG.md](CATALOG.md)
- Machine index: [artifact-index.yaml](artifact-index.yaml)
- Helm plan: [helm-plan.yaml](helm-plan.yaml)
- Control points: [control-points.yaml](control-points.yaml)
- Chart dossier: [chart-dossier.yaml](chart-dossier.yaml)