apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "Variant"
metadata:
  name: "no-crds"
  labels:
    confighub.io/chart: "jetstack/trust-manager"
    confighub.io/version: "v0.22.1"
    confighub.io/variant: "no-crds"
spec:
  recipe: "../../recipe.yaml"
  namespace: "default"
  releaseName: "trust-manager"
  valuesProfile: "../../effective-values-no-crds.yaml"
  capabilityProfile:
    kubeVersion: "1.30.0"
    apiVersions:
      []
  hookPolicy: "no-hooks"
  targetFacts:
    requiredNamespaces:
      -
        name: "cert-manager"
        purpose: "trust-manager uses cert-manager as the default trust namespace and regular Helm does not create it for the no-crds base"
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
    requiredCRDs:
      -
        name: "bundles.trust.cert-manager.io"
        sourceVariant: "default"
        purpose: "trust-manager CRD managed outside this no-crds base"
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
      -
        name: "certificates.cert-manager.io"
        sourcePath: "../../cert-manager/v1.20.2/revisions/crds-enabled/r001/rendered/release-objects.yaml"
        sourceVariant: "jetstack/cert-manager@v1.20.2/crds-enabled"
        purpose: "cert-manager Certificate CRD required by trust-manager certificate.yaml"
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
      -
        name: "issuers.cert-manager.io"
        sourcePath: "../../cert-manager/v1.20.2/revisions/crds-enabled/r001/rendered/release-objects.yaml"
        sourceVariant: "jetstack/cert-manager@v1.20.2/crds-enabled"
        purpose: "cert-manager Issuer CRD required by trust-manager certificate.yaml"
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"
    requiredSecrets:
      -
        namespace: "default"
        name: "trust-manager-tls"
        keys:
          - "tls.crt"
          - "tls.key"
        purpose: "trust-manager admission webhook TLS material normally produced by the rendered cert-manager Certificate lifecycle"
        deliveryLanes:
          - "regularHelm"
          - "cubInstallerApply"
          - "configHubKubectlApply"
          - "configHubOciArgo"