apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "InstallGate"
metadata:
  name: "kube-prometheus-stack-no-crds-r001"
spec:
  variantRevision: "../variant-revision.yaml"
  renderedObjectSetSHA256: "3f6049fc2b7a40bbfb009b347880e3f319a87c9b60a6fd274220287a10167fc2"
  decision: "warn"
  allowedScopes:
    - "local-test"
  blockedScopes:
    - "production"
  reasons:
    - "Helm equivalence passed for no-crds"
    - "CRD install/upgrade behavior needs explicit lifecycle policy before production"
    - "Admission webhook availability needs a fresh observation receipt after apply"
    - "Grafana admin password binding must be owned by generated-fact policy before production"
    - "Cluster-scoped RBAC needs production review"
    - "omits Prometheus Operator CRDs while preserving Grafana, webhooks, RBAC, rules, ServiceMonitors, the packaged CRD source, and the admission-webhook setup route"