apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "ProductionReadinessPlan"
metadata:
  name: "prometheus-community-kube-prometheus-stack"
  chart: "prometheus-community/kube-prometheus-stack"
  version: "86.1.0"
spec:
  role: "Serious-chart proof for Helm-to-ConfigHub catalog promotion. This chart exercises CRDs, admission webhooks, generated facts, umbrella dependencies, cluster RBAC, raw/tpl extension slots, and target prerequisites."
  currentProof:
    renderParity: "pass for default and no-crds bases"
    liveParity: "pass for default base"
    configHubLanes: "recorded for default base"
    noCrdsBase: "render-parity pass; broader live and ConfigHub lanes still need receipts before broader claims"
  baseRouting:
    default:
      useWhen: "ConfigHub owns initial Prometheus Operator CRD publication for the target scope."
      includesCRDs: true
      requiredTargetFacts:
        - "The package applies its ten CRDs first and waits for them to become established"
        - "The packaged admission setup route creates Secret monitoring/kube-prometheus-stack-admission with ca, cert, and key"
      requiredBeforeProduction:
        - "CRD install and upgrade policy"
        - "admission webhook TLS lifecycle receipt"
        - "fresh webhook observation receipt"
        - "Grafana credential custody and rotation decision"
        - "cluster RBAC and security acceptance or hardened base"
    noCrds:
      useWhen: "CRDs are owned by a platform team, cluster bootstrap lane, or separate GitOps application."
      includesCRDs: false
      requiredTargetFacts:
        - "10 Prometheus Operator CRDs already present and schema-compatible"
        - "The packaged admission setup route creates Secret monitoring/kube-prometheus-stack-admission with ca, cert, and key"
      requiredBeforeProduction:
        - "CRD ownership receipt"
        - "schema compatibility receipt for the target Kubernetes version"
        - "fresh webhook observation receipt"
        - "cluster RBAC and security acceptance or hardened base"
  quirkControls:
    -
      quirk: "umbrella dependencies"
      configHubHome: "dependency-lock.yaml"
      requiredReceipt: "dependency-lock review"
    -
      quirk: "CRD lifecycle"
      configHubHome: "base routing and target facts"
      requiredReceipt: "crd-lifecycle-receipt"
    -
      quirk: "admission webhook hook lifecycle"
      configHubHome: "target facts plus lifecycle observation"
      requiredReceipt: "admission-webhook-observation-receipt"
    -
      quirk: "generated Grafana password"
      configHubHome: "generated fact bound before render"
      requiredReceipt: "credential-custody-receipt"
    -
      quirk: "raw/tpl monitoring extension slots"
      configHubHome: "new reviewed base when populated"
      requiredReceipt: "extension-slot-review-receipt"
    -
      quirk: "cluster RBAC and security posture"
      configHubHome: "scan gate and production disposition"
      requiredReceipt: "security-acceptance-or-hardened-base-receipt"
  notProvenBy:
    - "render parity alone"
    - "one live default-base parity run"
    - "the no-crds render proof without CRD ownership evidence"
    - "empty extension slots without a rule for future populated slots"