apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "InstallGate"
metadata:
  name: "cert-manager-default-r001"
spec:
  variantRevision: "../variant-revision.yaml"
  renderedObjectSetSHA256: "45029db19d75e578bec74b82a0476a6580d1f7193239a210bf4873156ac725ce"
  decision: "warn"
  allowedScopes:
    - "local-test"
  blockedScopes:
    - "production"
  reasons:
    - "Helm equivalence passed for default"
    - "CRD install/upgrade behavior needs explicit lifecycle policy before production"
    - "Admission webhook availability needs a fresh observation receipt after apply"
    - "Helm startup API check hook Job needs explicit lifecycle policy before production"
    - "Cluster-scoped RBAC needs production review"
    - "keeps webhook objects and excludes the Helm startup API check hook Job from the rendered revision"