apiVersion: "helm-expt.confighub.com/v1alpha1" kind: "HelmPainReport" metadata: name: "nvidia-nodewright-v0.19.0" spec: chart: name: "nvidia/nodewright" version: "v0.19.0" source: "oci://ghcr.io/nvidia/nodewright/charts" digest: "24c507791b3fd10cd4fba44831e621d98a7f9faa7833a81add0357bf2d7307ff" supportedScopeStatus: "no-unhandled-pain-points-for-supported-scopes" supportedScopes: [] supportedVariants: [] productionReadiness: "not-reviewed-for-production" notes: - "This package is the exact nodewright@v0.19.0 chart, locked by archive URL and SHA-256." - "With chart defaults nodewright@v0.19.0 renders 20 objects as release nodewright-operator in namespace nodewright, the release name and namespace the AICR entry that pins this version uses: 4 CRDs from the chart's templates directory, the controller-manager Deployment, its ServiceAccount and RBAC, a metrics Service and a webhook Service, a MutatingWebhookConfiguration and a ValidatingWebhookConfiguration, a NetworkPolicy, a LimitRange and a PodDisruptionBudget. It renders no Secret." - "The same values also render six Helm hook objects that no base holds: four pre-upgrade (the selector-migration Job with its ServiceAccount, Role and RoleBinding) and two pre-delete Jobs. They are packaged under prerequisites/nodewright-lifecycle with a lifecycle-actions.yaml record. Nothing runs them automatically and none has been run on a cluster." - "The aicr-eks-training base renders 20 objects with the values the AICR v1.0.0 EKS training entry supplies (examples/aicr/eks-h100-training-kubeflow-v1-0-0/argocd-helm-bundle/005-nodewright-operator/values.yaml): the full name overridden to skyhook-operator, the manager given CPU and memory requests and limits, selected onto the system-worker node group and tolerating every taint, and the namespace LimitRange defaults set. The AICR v1.0.0 entry retains these values and no render of this component, so this base is bound to the bundle's checksum list and its Application pin and is not compared with an AICR render." - "The webhook configurations carry no CA bundle. The operator mints a self-signed serving certificate at run time, stores it in a Secret named webhook-cert and writes the CA into both configurations. That Secret is not in any base." - "The two nodewright.nvidia.com CRDs carry helm.sh/resource-policy: keep, so helm uninstall leaves them and the custom resources they hold. A flattened copy has no such memory; deleting the delivered objects deletes those CRDs and every Nodewright object with them." - "The PodDisruptionBudget carries no metadata.namespace, because the chart template leaves it to Helm. A flattened copy must be applied into the release namespace." - "The chart contains no lookup, no .Capabilities branch, no generated credential and no subchart." - "The retained root proves exact source bytes, deterministic rendering, and deterministic ConfigHub installer packaging. It does not claim publication, live convergence, or production support." painPoints: - id: "source-lock" detectedPainPoint: "source-lock requires source-lock.yaml" evidence: - "source-lock.yaml" configHubHome: "source-lock" disposition: "absorbed-into-recipe" linkedReceipt: "source-lock.yaml" supportedVariantStatus: "handled" - id: "dependency-lock" detectedPainPoint: "dependency-lock requires dependency-lock.yaml" evidence: - "dependency-lock.yaml" configHubHome: "dependency-lock" disposition: "absorbed-into-recipe" linkedReceipt: "dependency-lock.yaml" supportedVariantStatus: "handled" - id: "capability-profile" detectedPainPoint: "capability-profile is detected in this chart and mapped to a ConfigHub control point" evidence: - "control-points.yaml" configHubHome: "capability-profile" disposition: "handled-by-capability-profile" linkedReceipt: "revisions/default/r001/receipts/render-receipt.yaml" supportedVariantStatus: "handled" - id: "lifecycle-policy" detectedPainPoint: "the bases are rendered with --no-hooks; every base's values also render 4 pre-upgrade and 2 pre-delete Helm hook objects. They are packaged under prerequisites/nodewright-lifecycle with a lifecycle-actions.yaml record, and nothing runs them automatically. No hook has been run on a cluster for this entry." evidence: - "no-hooks" configHubHome: "lifecycle-policy" disposition: "handled-by-lifecycle-policy" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "attention-required" - id: "crd-lifecycle" detectedPainPoint: "crd-lifecycle is detected in this chart and mapped to a ConfigHub control point" evidence: - "control-points.yaml" configHubHome: "lifecycle-policy" disposition: "handled-by-lifecycle-policy" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "review-required" - id: "target-facts" detectedPainPoint: "the CRDs must be established before the operator starts; the operator mints its own webhook certificate at run time, and until it has, the webhook configurations reject writes to its custom resources; the pre-upgrade and pre-delete hook objects are packaged lifecycle actions, not part of the base" evidence: - "control-points.yaml" configHubHome: "target-fact-requirement" disposition: "handled-by-target-fact-values" linkedReceipt: "value-model.yaml" supportedVariantStatus: "review-required" - id: "catalog-coverage" detectedPainPoint: "exact source and deterministic package are retained; publication, live qualification and production support remain separate gates" evidence: - "control-points.yaml" configHubHome: "recipe" disposition: "needs-operator-decision" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "packaged-with-controls" - id: "scan-gate" detectedPainPoint: "Current scan gate is warn-production-blocked" evidence: - "helm-plan.yaml" - "scan receipts" - "install gates" configHubHome: "scan-gate" disposition: "handled-by-scan-or-gate" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "warn-production-blocked" - id: "value-model-diagnostics" detectedPainPoint: "Helm values can be unknown, dead, misspelled, shadowed, or ignored unless the values model records the analysis boundary." evidence: - "value-model.yaml" configHubHome: "value-model" disposition: "absorbed-into-value-model" linkedReceipt: "value-model.yaml" supportedVariantStatus: "unknown=not-exhaustively-checked-by-aicr-nested-charts-coverage-proof; dead=not-exhaustively-checked-by-aicr-nested-charts-coverage-proof; ignored=not-exhaustively-checked-by-aicr-nested-charts-coverage-proof" answerForSkepticalHelmUser: "nvidia/nodewright@v0.19.0 maps its detected Helm pain to 8 ConfigHub control areas: source-lock, dependency-lock, capability-profile, lifecycle-policy, target-fact-requirement, recipe, scan-gate, value-model. No supported scopes are declared; production readiness remains not-reviewed-for-production."