apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "HookLifecycleObservationReceipt"
metadata:
  name: "gatekeeper-gatekeeper-default-install-and-upgrade-route-lifecycle"
spec:
  chart: "gatekeeper/gatekeeper"
  version: "3.22.2"
  base: "default"
  result: "pass"
  observedAt: "2026-06-11T03:45:44Z"
  package:
    path: "packages/gatekeeper/gatekeeper/3.22.2"
  recipe:
    path: "recipes/gatekeeper/gatekeeper/3.22.2"
  variantRevision: "recipes/gatekeeper/gatekeeper/3.22.2/revisions/default/r001/variant-revision.yaml"
  lifecycleModel:
    hookTypes:
      - "pre-install"
      - "pre-upgrade"
    route: "preflight-or-presync-install-and-upgrade-route-observation"
    claim: "The fresh-install route observes the separated Secret prerequisite, CRD establishment, controller readiness, webhook service readiness, controller-populated TLS material, and server-side admission dry-run. The pre-upgrade route rehearsal re-applies the pinned rendered CRDs, then rechecks CRD Established, webhook routing, and admission dry-run. It does not claim cross-version Gatekeeper upgrade support."
  run:
    mode: "single-kind-cluster-cub-installer-install-lifecycle-observation"
    cluster: "hx-hook-gatekeeper-8yg8b0"
    namespace: "default"
    cleanup:
      result: "pass"
      detail: "deleted kind cluster"
  checks:
    -
      name: "kind-create"
      result: "pass"
      detail: "created fresh kind cluster"
    -
      name: "cub-installer-setup"
      result: "pass"
      detail: "rendered Gatekeeper cub installer package output"
      evidencePath: "cub-installer-setup.txt"
      evidenceSHA256: "90e8315c99eb022f87bfef1e7f60fd329530ece522deea682a54e4e41415fe4a"
    -
      name: "kubectl-apply-separated-secrets"
      result: "pass"
      detail: "applied separated Gatekeeper Secret prerequisite"
      evidencePath: "kubectl-apply-secrets.txt"
      evidenceSHA256: "6c593fa091df62f761902632983d1209ecbe4f4b912efc1cac3c8f28b8723490"
    -
      name: "kubectl-apply-manifests"
      result: "pass"
      detail: "applied Gatekeeper cub installer manifests"
      evidencePath: "kubectl-apply-manifests.txt"
      evidenceSHA256: "e0437392ca07562b1676cc014e7c8562c21f0a9ac793b8d66c1f9bbc40b23361"
    -
      name: "crds-established"
      result: "pass"
      detail: "all rendered Gatekeeper CRDs reached Established"
      evidencePath: "crds-established.txt"
      evidenceSHA256: "c8a644f9d0c2344ea2d726b41196f685a2e2f2ec6d4de1b6db05a1852b40efd8"
      crdCount: 17
    -
      name: "controller-manager-ready"
      result: "pass"
      detail: "Gatekeeper controller manager rolled out"
      evidencePath: "deployment-gatekeeper-controller-manager-rollout.txt"
      evidenceSHA256: "fa740948d5596bbaef34fa5342f3d42baca871ec720076ccfee72fa21df481a3"
    -
      name: "audit-ready"
      result: "pass"
      detail: "Gatekeeper audit deployment rolled out"
      evidencePath: "deployment-gatekeeper-audit-rollout.txt"
      evidenceSHA256: "c27887d5708820a76a7c5a177071c1f8479267717cc3fae6e812086d2a2411ca"
    -
      name: "webhook-service-endpoints"
      result: "pass"
      detail: "Gatekeeper webhook Service has ready endpoints"
      evidencePath: "service-gatekeeper-webhook-endpoints.yaml"
      evidenceSHA256: "b29db1de99b2fd984a54bb07be232eeec259ee4a71bf251772f086a3f0e0f981"
    -
      name: "webhook-secret-populated"
      result: "pass"
      detail: "Gatekeeper controller populated webhook TLS Secret keys"
      evidencePath: "secret-gatekeeper-webhook-server-cert.json"
      evidenceSHA256: "16ca2e68b1fc479839d7fb25578212821d0e365a69f59cde5053aa484971a33f"
    -
      name: "webhook-configurations-routed"
      result: "pass"
      detail: "Gatekeeper webhook configurations point at the rendered Service and contain CA bundles"
      evidencePath: "webhook-configurations.json"
      evidenceSHA256: "09658ac09727ec045f74f68273521eb29c3bb4f05a0a522fddf0232a8c604096"
    -
      name: "admission-server-dry-run"
      result: "pass"
      detail: "server-side dry-run exercised the live admission path"
      evidencePath: "admission-server-dry-run.yaml"
      evidenceSHA256: "33cb6887b20d304645036bfb00b8c55e5e19d0114aa0cfc54cef7825191ad084"
    -
      name: "pre-upgrade-crd-route-apply"
      result: "pass"
      detail: "re-applied rendered Gatekeeper CRDs as the explicit pre-upgrade route"
      evidencePath: "pre-upgrade-crd-route-apply.txt"
      evidenceSHA256: "b65a35f9e05eca97e146787b80b690ecc44c13320c618ad2c2641538dc431fbb"
      crdCount: 17
    -
      name: "pre-upgrade-crds-established"
      result: "pass"
      detail: "Gatekeeper CRDs remained Established after the explicit pre-upgrade route"
      evidencePath: "pre-upgrade-crds-established.txt"
      evidenceSHA256: "c8a644f9d0c2344ea2d726b41196f685a2e2f2ec6d4de1b6db05a1852b40efd8"
      crdCount: 17
    -
      name: "pre-upgrade-webhook-configurations-routed"
      result: "pass"
      detail: "Gatekeeper webhook configurations stayed routed after the explicit pre-upgrade route"
      evidencePath: "pre-upgrade-webhook-configurations.json"
      evidenceSHA256: "09658ac09727ec045f74f68273521eb29c3bb4f05a0a522fddf0232a8c604096"
    -
      name: "pre-upgrade-admission-server-dry-run"
      result: "pass"
      detail: "server-side dry-run exercised admission after the explicit pre-upgrade route"
      evidencePath: "pre-upgrade-admission-server-dry-run.yaml"
      evidenceSHA256: "95f99cf3346c390cc3708bf49785f7d9a0f27073e06a2421e9009259d1a25a74"