apiVersion: "helm-expt.confighub.com/v1alpha1" kind: "HelmPainReport" metadata: name: "nvidia-gpu-operator-v26.7.1" spec: chart: name: "nvidia/gpu-operator" version: "v26.7.1" source: "https://helm.ngc.nvidia.com/nvidia" digest: "fdce4cba07db5ddb6dfd0bdf61276a44c24136f2b193bc6ebc81dd1b0f049777" supportedScopeStatus: "no-unhandled-pain-points-for-supported-scopes" supportedScopes: [] supportedVariants: [] productionReadiness: "not-reviewed-for-production" notes: - "This package is the exact gpu-operator@v26.7.1 chart from the NGC Helm repository, locked by archive URL and SHA-256." - "With the release name gpu-operator in namespace gpu-operator: default renders 27 objects (8 CRDs) and 9 Helm hook objects; driver-580.105.08 renders 27 objects (8 CRDs) and 9 Helm hook objects; driver-580.126.20 renders 27 objects (8 CRDs) and 9 Helm hook objects; preinstalled-driver renders 27 objects (8 CRDs) and 9 Helm hook objects; preinstalled-driver-and-toolkit renders 27 objects (8 CRDs) and 9 Helm hook objects; external-nfd renders 12 objects (5 CRDs) and 5 Helm hook objects; aicr-eks-training renders 13 objects (5 CRDs) and 5 Helm hook objects." - "The chart vendors one dependency, node-feature-discovery 0.19.0, gated by nfd.enabled." - "driver.version lands at ClusterPolicy cluster-policy /spec/driver/version and nowhere else in the rendered objects. Rendering the locked archive twice with only driver.version changed, on 2026-10-07, changed that one field and nothing else, hook objects included." - "The driver bases (driver-580.105.08, driver-580.126.20) change only driver.version, to a driver version that is the chart default of another held chart version. Each differs from the default base at ClusterPolicy /spec/driver/version and nowhere else, and the proof checks that. They show what a driver change does to the rendered objects. Driver support for this chart version and for any operating system was not checked: nobody here checked NVIDIA's support matrix, a driver image for any operating system, or a running node." - "The preinstalled-driver, preinstalled-driver-and-toolkit and external-nfd bases are deployment scenarios NVIDIA's GPU Operator documentation describes. The first two change only ClusterPolicy fields (/spec/driver/enabled, and /spec/toolkit/enabled), so every other object equals the default base. external-nfd removes the 15 node-feature-discovery objects, three of them CRDs, and the post-delete prune hook, and changes no object that stays." - "The retained root proves exact source bytes, deterministic rendering, and deterministic ConfigHub installer packaging. It does not claim publication, live convergence, GPU scheduling, or production support." - "The aicr-eks-training base renders with the bytes of examples/aicr/eks-h100-training-kubeflow-v1-0-0/argocd-helm-bundle/009-gpu-operator/values.yaml, the values the AICR v1.0.0 recipe supplies to its gpu-operator Application, which pins chart 26.7.1. The values bytes match the bundle's own checksum list. That example retains no nested render of this component, so this base is not compared with an AICR render." painPoints: - id: "source-lock" detectedPainPoint: "source-lock requires source-lock.yaml" evidence: - "source-lock.yaml" configHubHome: "source-lock" disposition: "absorbed-into-recipe" linkedReceipt: "source-lock.yaml" supportedVariantStatus: "handled" - id: "dependency-lock" detectedPainPoint: "dependency-lock requires dependency-lock.yaml" evidence: - "dependency-lock.yaml" configHubHome: "dependency-lock" disposition: "absorbed-into-recipe" linkedReceipt: "dependency-lock.yaml" supportedVariantStatus: "handled" - id: "capability-profile" detectedPainPoint: "the packaged chart has one .Capabilities check, in templates/validations.yaml, and it runs only when gpuCluster.deployCR is true; no base sets it, so the render does not depend on the pinned Kubernetes version or API list" evidence: - "control-points.yaml" configHubHome: "capability-profile" disposition: "handled-by-capability-profile" linkedReceipt: "revisions/default/r001/receipts/render-receipt.yaml" supportedVariantStatus: "handled" - id: "lifecycle-policy" detectedPainPoint: "the bases are rendered with --no-hooks; default renders 27 objects (8 CRDs) and 9 Helm hook objects; driver-580.105.08 renders 27 objects (8 CRDs) and 9 Helm hook objects; driver-580.126.20 renders 27 objects (8 CRDs) and 9 Helm hook objects; preinstalled-driver renders 27 objects (8 CRDs) and 9 Helm hook objects; preinstalled-driver-and-toolkit renders 27 objects (8 CRDs) and 9 Helm hook objects; external-nfd renders 12 objects (5 CRDs) and 5 Helm hook objects; aicr-eks-training renders 13 objects (5 CRDs) and 5 Helm hook objects. The hook objects are packaged under prerequisites/gpu-operator-lifecycle with a lifecycle-actions.yaml record, and nothing runs them automatically. No hook has been run on a cluster for this entry." evidence: - "no-hooks" configHubHome: "lifecycle-policy" disposition: "handled-by-lifecycle-policy" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "attention-required" - id: "crd-lifecycle" detectedPainPoint: "the bases include their CRDs, and each base records them as target facts with a packaged CRD bundle so they can be established before the ClusterPolicy object is applied" evidence: - "control-points.yaml" configHubHome: "lifecycle-policy" disposition: "handled-by-lifecycle-policy" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "review-required" - id: "operator-managed-operands" detectedPainPoint: "the ClusterPolicy object tells the operator which driver, container toolkit, device plugin, DCGM and validator workloads to create on GPU nodes. Those privileged DaemonSets are created at run time and appear in no render." evidence: - "control-points.yaml" configHubHome: "recipe" disposition: "needs-operator-decision" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "review-required" - id: "catalog-coverage" detectedPainPoint: "exact source and deterministic package are retained; publication, live qualification and production support remain separate gates" evidence: - "control-points.yaml" configHubHome: "recipe" disposition: "needs-operator-decision" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "packaged-with-controls" - id: "installer-support-object" detectedPainPoint: "installer-support-object affects v1|Namespace||gpu-operator" evidence: - "v1|Namespace||gpu-operator" configHubHome: "recipe" disposition: "absorbed-into-recipe" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "handled" - id: "scan-gate" detectedPainPoint: "Current scan gate is warn-production-blocked" evidence: - "helm-plan.yaml" - "scan receipts" - "install gates" configHubHome: "scan-gate" disposition: "handled-by-scan-or-gate" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "warn-production-blocked" - id: "value-model-diagnostics" detectedPainPoint: "Helm values can be unknown, dead, misspelled, shadowed, or ignored unless the values model records the analysis boundary." evidence: - "value-model.yaml" configHubHome: "value-model" disposition: "absorbed-into-value-model" linkedReceipt: "value-model.yaml" supportedVariantStatus: "unknown=not-exhaustively-checked-by-nvidia-gpu-stack-coverage-proof; dead=not-exhaustively-checked-by-nvidia-gpu-stack-coverage-proof; ignored=not-exhaustively-checked-by-nvidia-gpu-stack-coverage-proof" answerForSkepticalHelmUser: "nvidia/gpu-operator@v26.7.1 maps its detected Helm pain to 7 ConfigHub control areas: source-lock, dependency-lock, capability-profile, lifecycle-policy, recipe, scan-gate, value-model. No supported scopes are declared; production readiness remains not-reviewed-for-production."