apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "TargetPrerequisitePlan"
metadata:
  name: "projectcalico-tigera-operator-v3.32.0-crd-prerequisites"
  chart: "projectcalico/tigera-operator"
  version: "v3.32.0"
spec:
  summary: "The default base includes four operator.tigera.io custom resources, but a vanilla target does not have their CRDs. The package now carries an operator-only Kustomize bootstrap. The public try script applies that bootstrap, waits for the four CRDs, and then applies the complete rendered output. The comparison harness removes the temporary operator before testing Helm, direct apply, and ConfigHub OCI through Argo so that all three lanes start from the same prepared target."
  bases:
    default:
      status: "crd-bootstrap-route-observed"
      currentProofLimit: "The route is proven in a fresh kind target. It is not a production claim for clusters where Calico owns live networking, and it does not prove upgrades or uninstall safety for every target state."
      requiredBeforeApply:
        -
          kind: "CustomResourceDefinition"
          name: "apiservers.operator.tigera.io"
          namespace: "cluster"
          status: "target-prerequisite"
          purpose: "The APIServer custom resource cannot be accepted until this CRD is established."
        -
          kind: "CustomResourceDefinition"
          name: "goldmanes.operator.tigera.io"
          namespace: "cluster"
          status: "target-prerequisite"
          purpose: "The Goldmane custom resource cannot be accepted until this CRD is established."
        -
          kind: "CustomResourceDefinition"
          name: "installations.operator.tigera.io"
          namespace: "cluster"
          status: "target-prerequisite"
          purpose: "The Installation custom resource cannot be accepted until this CRD is established."
        -
          kind: "CustomResourceDefinition"
          name: "whiskers.operator.tigera.io"
          namespace: "cluster"
          status: "target-prerequisite"
          purpose: "The Whisker custom resource cannot be accepted until this CRD is established."
      requiredBeforeObserve:
        -
          kind: "CrdBootstrapOperation"
          name: "tigera-operator-crds"
          namespace: "cluster"
          status: "observed-lifecycle-operation"
          purpose: "Run the packaged operator-only Kustomize bootstrap until the four required CRDs are Established. The public install keeps those same operator objects as part of the full base; the comparison harness removes them before the three comparison lanes."
        -
          kind: "NetworkingTargetDecision"
          name: "calico-target-fit"
          namespace: "cluster"
          status: "target-scope-decision"
          purpose: "After CRDs are established, the operator still needs a target shape suitable for Calico/Tigera networking. That target fit is separate from render parity."
      mustObserve:
        - "The required operator.tigera.io CRDs are Established before APIServer, Goldmane, Installation, and Whisker are applied."
        - "The temporary bootstrap operator and its RBAC are removed before the comparison starts."
        - "Regular Helm and ConfigHub direct apply both get past the resource-mapping stage."
        - "The tigera-operator Deployment reaches Available=True."
        - "ConfigHub OCI/Argo syncs the staged object set and any remaining controller-health condition is recorded."
      requiredReceipts:
        - "runs/live-helm-confighub-compare/projectcalico-tigera-operator-default/target-profile-kind-tigera-crds.yaml"
        - "runs/live-helm-confighub-compare/projectcalico-tigera-operator-default/receipt.yaml"
        - "runs/hook-lifecycle/projectcalico-tigera-operator/default/latest/receipt.yaml"
        - "runs/public-preset-script/projectcalico-tigera-operator-default/latest/receipt.yaml"
  evidence:
    liveParityReceipt: "runs/live-helm-confighub-compare/projectcalico-tigera-operator-default/receipt.yaml"
    targetProfileReceipt: "runs/live-helm-confighub-compare/projectcalico-tigera-operator-default/target-profile-kind-tigera-crds.yaml"
    hookLifecycleReceipt: "runs/hook-lifecycle/projectcalico-tigera-operator/default/latest/receipt.yaml"
    publicTryScriptReceipt: "runs/public-preset-script/projectcalico-tigera-operator-default/latest/receipt.yaml"
    previousBlockedEvent: "Without the bootstrap route, regular Helm and direct apply both reported no matches for APIServer, Goldmane, Installation, and Whisker in operator.tigera.io/v1."
    semanticParity: "pass with zero object differences for direct apply and ConfigHub OCI/Argo"
  nextInvestigation:
    - "Decide whether production users should keep this operator bootstrap or use a separately reviewed CRD artifact."
    - "Test upgrades when the target already has an older Tigera CRD version."
    - "Review the explicit pre-delete cleanup action on a target where Calico owns live networking."
  notProvenBy:
    - "render parity alone"
    - "the local kind result as a production networking claim"
    - "assuming the bootstrap route is safe for every existing Calico installation"