apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "InstallGate"
metadata:
  name: "kube-prometheus-stack-no-crds-r001"
spec:
  variantRevision: "../variant-revision.yaml"
  renderedObjectSetSHA256: "671c6f820a2cc2b381d056f112ad1750b36d08b01e9e1ff5bc503cfa81a56e87"
  decision: "warn"
  allowedScopes:
    - "local-test"
  blockedScopes:
    - "production"
  reasons:
    - "Helm equivalence passed for no-crds"
    - "CRD install/upgrade behavior needs explicit lifecycle policy before production"
    - "Admission webhook availability needs a fresh observation receipt after apply"
    - "Grafana admin password binding must be owned by generated-fact policy before production"
    - "Cluster-scoped RBAC needs production review"
    - "omits Prometheus Operator CRDs while preserving Grafana, webhooks, RBAC, rules, ServiceMonitors, the packaged CRD source, and the admission-webhook setup route"