<!-- Generated by npm run catalog:weirdness. Do not edit by hand. -->

# prometheus-community/kube-prometheus-stack 85.3.3 Weirdness And Mitigations

This note records the Helm pain surfaced during catalog review and where the
current ConfigHub/cub installer proof absorbs it.

## Support Boundary

| Field | Value |
| --- | --- |
| Catalog status | catalog-supported |
| Support level | supported-for-declared-scopes |
| Supported scopes | local-test |
| Production readiness | production-review-ready |
| Variants in this note | default, no-crds |

Production support is not implied by this file. A chart can be supported for
local proof/demo use while still needing accepted scan, gate, lifecycle, and
operating-policy dispositions plus a final target-scoped support decision.

## Chart Notes

- Default chart render is nondeterministic unless grafana.adminPassword is bound before render.
- default variant binds grafana.adminPassword and renders 10 Prometheus Operator CRDs.
- no-crds variant omits CRDs for clusters that manage CRDs separately and records those CRDs as target facts.
- Chart declares CRD, kube-state-metrics, node-exporter, Grafana, and windows-exporter dependencies and records them in dependency-lock.yaml.
- Config-only delivery stages the kube-prometheus-stack-admission TLS Secret as a target fact; regular Helm creates that material through hook lifecycle.
- Admission webhook readiness must still be observed after apply because rendered objects plus staged Secret do not prove webhook health.
- CRD manifests include YAML enum scalars such as bare equals signs; the proof parser handles these as scalar strings.
- Rules, scrape configs, datasource config, and extraManifests are tpl/raw extension slots; promoted variants keep raw slots empty.

## Catalog Mitigations

- Supported for local-test and proof-demo usage through real cub installer and ConfigHub receipts.
- default preserves the normal kube-prometheus-stack install shape.
- no-crds is supported when CRD lifecycle is owned outside this package.
- default is the stronger first production-review base because it includes CRDs and has local observation evidence.
- no-crds is supported only when compatible Prometheus Operator CRDs are already staged and observed in the target cluster.
- CRD ownership, cluster RBAC, generated Grafana credential binding, raw monitoring extension slots, webhook readiness, and scan/gate warnings are recorded as production review input.
- Production recommendation remains a separate decision; kube-prometheus-stack needs target CRD ownership, webhook TLS lifecycle, resource/security posture, scrape scope, and fresh runtime checks before support.
- The committed ConfigHub apply and OCI/Argo live rows demonstrate semantic parity but remain runtime-watch until Prometheus Operator readiness is resolved for the target.

## Control Points

| Control point | Status | Mitigation / evidence |
| --- | --- | --- |
| source-lock | handled | source-lock.yaml |
| dependency-lock | handled | chart declares CRD, kube-state-metrics, node-exporter, Grafana, and windows-exporter dependencies; promoted variants lock their metadata. |
| capability-profile | handled | OpenShift and ServiceMonitor branches are bound to the named Kubernetes capability profile. |
| crd-policy | variant-controlled-and-target-fact | CRDs are ordinary rendered objects in the default variant; no-crds records those same CRDs as target prerequisites. |
| admission-webhook | target-fact-and-observe | Config-only delivery must stage the kube-prometheus-stack-admission Secret because Helm normally creates the TLS material through hook lifecycle. |
| generated-facts | variant-controlled | Both promoted variants bind Grafana admin password before render so Helm output is deterministic. |
| cluster-rbac | scan-and-review | scan receipts |
| tpl | controlled-by-empty-defaults | Prometheus/Grafana rules, scrape configs, datasource config, and extraManifests can use templating; promoted variants keep raw slots empty. |
| installer-support-object | handled | v1\|Namespace\|\|monitoring |

## Control Point Index

- admission-webhook
- admission-webhook-observation
- capability-profile
- cluster-rbac
- cluster-rbac-scan
- crd-lifecycle-policy
- crd-policy
- dependency-lock
- generated-facts
- installer-support-object
- source-lock
- tpl
- tpl-extension-slot

## Proof Links

- Catalog map: [CATALOG.md](CATALOG.md)
- Machine index: [artifact-index.yaml](artifact-index.yaml)
- Helm plan: [helm-plan.yaml](helm-plan.yaml)
- Control points: [control-points.yaml](control-points.yaml)
- Chart dossier: [chart-dossier.yaml](chart-dossier.yaml)