apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "InstallGate"
metadata:
  name: "kube-prometheus-stack-default-r001"
spec:
  variantRevision: "../variant-revision.yaml"
  renderedObjectSetSHA256: "9fac2a0e4140eee298c84ce61f13dd8ca392bb92e2037d0ef0aaa4d8015ee491"
  decision: "warn"
  allowedScopes:
    - "local-test"
  blockedScopes:
    - "production"
  reasons:
    - "Helm equivalence passed for default"
    - "CRD install/upgrade behavior needs explicit lifecycle policy before production"
    - "Admission webhook availability needs a fresh observation receipt after apply"
    - "Grafana admin password binding must be owned by generated-fact policy before production"
    - "Cluster-scoped RBAC needs production review"
    - "includes Prometheus Operator CRDs, Grafana, webhook configurations, generated Grafana admin password binding, and the packaged admission-webhook setup route"