apiVersion: "helm-expt.confighub.com/v1alpha1" kind: "HelmPainReport" metadata: name: "nvidia-k8s-nim-operator-3.1.2" spec: chart: name: "nvidia/k8s-nim-operator" version: "3.1.2" source: "https://helm.ngc.nvidia.com/nvidia" digest: "ebb31e27b4a62d22ac10a24083ff21a340e48030b1ac4c1e7b99b24318f8f92a" supportedScopeStatus: "no-unhandled-pain-points-for-supported-scopes" supportedScopes: [] supportedVariants: [] productionReadiness: "not-reviewed-for-production" notes: - "This package is the exact k8s-nim-operator@3.1.2 chart, locked by archive URL and SHA-256." - "With chart defaults k8s-nim-operator@3.1.2 renders 17 objects as release k8s-nim-operator in namespace nvidia-nim: nine CRDs from the chart's crds directory, the operator Deployment, its ServiceAccount, RBAC and a metrics Service. It renders no Secret and no instance of its own custom resources." - "The same values also render four Helm hook objects, all pre-upgrade: a Job that applies the CRD files inside the operator image, with its ServiceAccount, ClusterRole and ClusterRoleBinding. The bases are rendered with --no-hooks, and the four objects are packaged under prerequisites/k8s-nim-operator-lifecycle with a lifecycle-actions.yaml record. Nothing runs them automatically and none has been run on a cluster." - "The release name and namespace are the ones the AICR NIM inference recipes use. NVIDIA's own install instructions name both nim-operator." - "The operator Deployment, ServiceAccount, Role, RoleBinding and metrics Service carry no metadata.namespace, because the chart templates leave it to Helm. A flattened copy must be applied into the nvidia-nim namespace." - "The packaged Chart.lock lists 2 dependencies, dynamo-platform and dynamo-crds, both gated by dynamo.enabled, which every base leaves false." - "The chart archive was pulled anonymously from the NGC Helm repository. The operator image is nvcr.io/nvidia/cloud-native/k8s-nim-operator, with imagePullPolicy Always. The NIM model images the operator later pulls need an NGC key; nothing in this entry deploys one." - "The retained root proves exact source bytes, deterministic rendering, and deterministic ConfigHub installer packaging. It does not claim publication, live convergence, or production support." painPoints: - id: "source-lock" detectedPainPoint: "source-lock requires source-lock.yaml" evidence: - "source-lock.yaml" configHubHome: "source-lock" disposition: "absorbed-into-recipe" linkedReceipt: "source-lock.yaml" supportedVariantStatus: "handled" - id: "dependency-lock" detectedPainPoint: "dependency-lock requires dependency-lock.yaml" evidence: - "dependency-lock.yaml" configHubHome: "dependency-lock" disposition: "absorbed-into-recipe" linkedReceipt: "dependency-lock.yaml" supportedVariantStatus: "handled" - id: "capability-profile" detectedPainPoint: "capability-profile is detected in this chart and mapped to a ConfigHub control point" evidence: - "control-points.yaml" configHubHome: "capability-profile" disposition: "handled-by-capability-profile" linkedReceipt: "revisions/default/r001/receipts/render-receipt.yaml" supportedVariantStatus: "handled" - id: "lifecycle-policy" detectedPainPoint: "the bases are rendered with --no-hooks; every base's values also render 4 pre-upgrade Helm hook objects. They are packaged under prerequisites/k8s-nim-operator-lifecycle with a lifecycle-actions.yaml record, and nothing runs them automatically. No hook has been run on a cluster for this entry." evidence: - "no-hooks" configHubHome: "lifecycle-policy" disposition: "handled-by-lifecycle-policy" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "attention-required" - id: "crd-lifecycle" detectedPainPoint: "crd-lifecycle is detected in this chart and mapped to a ConfigHub control point" evidence: - "control-points.yaml" configHubHome: "lifecycle-policy" disposition: "handled-by-lifecycle-policy" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "review-required" - id: "target-facts" detectedPainPoint: "the nine apps.nvidia.com CRDs must be established before the operator starts; the four pre-upgrade hook objects are a packaged lifecycle action, not part of the base" evidence: - "control-points.yaml" configHubHome: "target-fact-requirement" disposition: "handled-by-target-fact-values" linkedReceipt: "value-model.yaml" supportedVariantStatus: "review-required" - id: "catalog-coverage" detectedPainPoint: "exact source and deterministic package are retained; publication, live qualification and production support remain separate gates" evidence: - "control-points.yaml" configHubHome: "recipe" disposition: "needs-operator-decision" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "packaged-with-controls" - id: "scan-gate" detectedPainPoint: "Current scan gate is warn-production-blocked" evidence: - "helm-plan.yaml" - "scan receipts" - "install gates" configHubHome: "scan-gate" disposition: "handled-by-scan-or-gate" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "warn-production-blocked" - id: "value-model-diagnostics" detectedPainPoint: "Helm values can be unknown, dead, misspelled, shadowed, or ignored unless the values model records the analysis boundary." evidence: - "value-model.yaml" configHubHome: "value-model" disposition: "absorbed-into-value-model" linkedReceipt: "value-model.yaml" supportedVariantStatus: "unknown=not-exhaustively-checked-by-nvidia-gpu-stack-coverage-proof; dead=not-exhaustively-checked-by-nvidia-gpu-stack-coverage-proof; ignored=not-exhaustively-checked-by-nvidia-gpu-stack-coverage-proof" answerForSkepticalHelmUser: "nvidia/k8s-nim-operator@3.1.2 maps its detected Helm pain to 8 ConfigHub control areas: source-lock, dependency-lock, capability-profile, lifecycle-policy, target-fact-requirement, recipe, scan-gate, value-model. No supported scopes are declared; production readiness remains not-reviewed-for-production."