apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "HelmPainReport"
metadata:
  name: "prometheus-community-prometheus-29.9.0"
spec:
  chart:
    name: "prometheus-community/prometheus"
    version: "29.9.0"
    source: "https://prometheus-community.github.io/helm-charts"
    digest: "a87e983b2dfe2d7052213869e41c7536e2de8c2231bbeb844add1372a1ddd09c"
  supportedScopeStatus: "no-unhandled-pain-points-for-supported-scopes"
  supportedScopes:
    []
  supportedVariants:
    []
  productionReadiness: "not-reviewed-for-production"
  notes:
    - "The chart renders deterministically under pinned Helm, chart version, kube version, and values."
    - "The default variant installs Prometheus server, Alertmanager, kube-state-metrics, node-exporter, pushgateway, server PVC, services, and cluster RBAC."
    - "The server-only-ephemeral variant disables bundled components and server persistence as deliberate variant-controlled outputs."
    - "Scrape config, remote read/write, ingress, network policy, PDB, and extra-manifest slots are extension surfaces that must be explicit before production."
    - "Bundled dependency ownership, storage/retention, workload rollout, and cluster RBAC are scan/gate review points."
    - "StatefulSet and HA behavior become future variants, not hidden defaults."
  painPoints:
    -
      id: "source-lock"
      detectedPainPoint: "source-lock requires source-lock.yaml"
      evidence:
        - "source-lock.yaml"
      configHubHome: "source-lock"
      disposition: "absorbed-into-recipe"
      linkedReceipt: "source-lock.yaml"
      supportedVariantStatus: "handled"
    -
      id: "dependency-lock"
      detectedPainPoint: "chart dependencies are locked and reviewed, including alertmanager, kube-state-metrics, node-exporter, and pushgateway."
      evidence:
        - "dependency-lock.yaml"
      configHubHome: "dependency-lock"
      disposition: "absorbed-into-recipe"
      linkedReceipt: "dependency-lock.yaml"
      supportedVariantStatus: "handled"
    -
      id: "capability-profile"
      detectedPainPoint: "Kubernetes API and version branches are bound to the named Kubernetes capability profile."
      evidence:
        - "control-points.yaml"
      configHubHome: "capability-profile"
      disposition: "handled-by-capability-profile"
      linkedReceipt: "revisions/default/r001/receipts/render-receipt.yaml"
      supportedVariantStatus: "handled"
    -
      id: "bundle-dependencies"
      detectedPainPoint: "bundle-dependencies requires dependency-lock.yaml"
      evidence:
        - "dependency-lock.yaml"
      configHubHome: "recipe"
      disposition: "handled-by-scan-or-gate"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "scan-and-review"
    -
      id: "monitoring-workloads"
      detectedPainPoint: "monitoring-workloads affects apps/v1|Deployment|monitoring|prometheus-server"
      evidence:
        - "apps/v1|Deployment|monitoring|prometheus-server"
      configHubHome: "recipe"
      disposition: "handled-by-scan-or-gate"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "scan-and-review"
    -
      id: "storage-retention"
      detectedPainPoint: "storage-retention affects v1|PersistentVolumeClaim|monitoring|prometheus-server"
      evidence:
        - "v1|PersistentVolumeClaim|monitoring|prometheus-server"
      configHubHome: "operate-policy"
      disposition: "needs-operator-decision"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "variant-controlled"
    -
      id: "scrape-config"
      detectedPainPoint: "scrape-config affects v1|ConfigMap|monitoring|prometheus-server"
      evidence:
        - "v1|ConfigMap|monitoring|prometheus-server"
      configHubHome: "recipe"
      disposition: "handled-by-scan-or-gate"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "scan-and-review"
    -
      id: "cluster-rbac"
      detectedPainPoint: "cluster-rbac affects rbac.authorization.k8s.io/v1|ClusterRole||prometheus-server"
      evidence:
        - "rbac.authorization.k8s.io/v1|ClusterRole||prometheus-server"
      configHubHome: "scan-gate"
      disposition: "handled-by-scan-or-gate"
      linkedReceipt: "revisions/default/r001/receipts/scan-receipt.yaml"
      supportedVariantStatus: "scan-and-review"
    -
      id: "component-selection"
      detectedPainPoint: "component-selection requires alertmanager/kube-state-metrics/node-exporter/pushgateway values"
      evidence:
        - "alertmanager/kube-state-metrics/node-exporter/pushgateway values"
      configHubHome: "recipe"
      disposition: "needs-operator-decision"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "variant-controlled"
    -
      id: "extension-slots"
      detectedPainPoint: "extra scrape configs, remote read/write, ingress, network policy, PDB, and extra manifests are explicit variant inputs."
      evidence:
        - "control-points.yaml"
      configHubHome: "extension-slot"
      disposition: "needs-operator-decision"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "controlled-by-empty-defaults"
    -
      id: "installer-support-object"
      detectedPainPoint: "installer-support-object affects v1|Namespace||monitoring"
      evidence:
        - "v1|Namespace||monitoring"
      configHubHome: "recipe"
      disposition: "absorbed-into-recipe"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "handled"
    -
      id: "scan-gate"
      detectedPainPoint: "Current scan gate is warn-production-blocked"
      evidence:
        - "helm-plan.yaml"
        - "scan receipts"
        - "install gates"
      configHubHome: "scan-gate"
      disposition: "handled-by-scan-or-gate"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "warn-production-blocked"
    -
      id: "value-model-diagnostics"
      detectedPainPoint: "Helm values can be unknown, dead, misspelled, shadowed, or ignored unless the values model records the analysis boundary."
      evidence:
        - "value-model.yaml"
      configHubHome: "value-model"
      disposition: "absorbed-into-value-model"
      linkedReceipt: "value-model.yaml"
      supportedVariantStatus: "unknown=not-checked; dead=not-checked; ignored=not-checked"
  answerForSkepticalHelmUser: "prometheus-community/prometheus@29.9.0 maps its detected Helm pain to 8 ConfigHub control areas: source-lock, dependency-lock, capability-profile, recipe, operate-policy, scan-gate, extension-slot, value-model. Supported scopes have explicit variants, receipts, scans/gates, and control-point dispositions; production readiness remains not-reviewed-for-production."