apiVersion: "catalog.confighub.com/v1alpha1"
kind: "SveltosOciDeliveryProofReceipt"
metadata:
  name: "kyverno-staging-oci-delivery"
spec:
  recordedAt: "2026-07-27T05:43:24.883Z"
  flow:
    path: "source -> ConfigHub review -> local work -> OCI -> Argo CD -> Sveltos -> Kubernetes"
    portableShape: "work -> OCI"
    access:
      configHubReview: "ConfigHub account and server required"
      portablePackaging: "local command; no ConfigHub Server required"
      portablePull: "anonymous; no ConfigHub account required"
  source:
    profile: "examples/sveltos/kyverno-fleet/clusterprofile-pilot.yaml"
    sourceLock: "examples/sveltos/kyverno-fleet/source-lock.yaml"
    rawSha256: "2385f9255fd7237f5289b057549f1056ee9b04fe48394ce52a937b2b6aedf793"
    canonicalSha256: "f5115db99a6b0cb90e8f71b1d74def3d042fff2fd21be24a835b3295a63b0387"
  prerequisite:
    source: "https://raw.githubusercontent.com/projectsveltos/sveltos/v1.12.0/manifest/manifest.yaml"
    version: "v1.12.0"
    manifestSha256: "7ce065d86662c9cc431c07021d5b1cbe812b00f7ddde57dc465a44b03f5a7280"
    objectCount: 84
    crdCount: 29
    appliedObjectCount: 82
    omittedOptionalServiceMonitorCount: 2
    deployments:
      -
        name: "access-manager"
        desired: 1
        updated: 1
        ready: 1
        available: 1
        observedGenerationMatches: true
      -
        name: "addon-controller"
        desired: 1
        updated: 1
        ready: 1
        available: 1
        observedGenerationMatches: true
      -
        name: "classifier-manager"
        desired: 1
        updated: 1
        ready: 1
        available: 1
        observedGenerationMatches: true
      -
        name: "event-manager"
        desired: 1
        updated: 1
        ready: 1
        available: 1
        observedGenerationMatches: true
      -
        name: "hc-manager"
        desired: 1
        updated: 1
        ready: 1
        available: 1
        observedGenerationMatches: true
      -
        name: "mcp-server"
        desired: 1
        updated: 1
        ready: 1
        available: 1
        observedGenerationMatches: true
      -
        name: "sc-manager"
        desired: 1
        updated: 1
        ready: 1
        available: 1
        observedGenerationMatches: true
      -
        name: "shard-controller"
        desired: 1
        updated: 1
        ready: 1
        available: 1
        observedGenerationMatches: true
      -
        name: "sveltos-agent-manager"
        desired: 1
        updated: 1
        ready: 1
        available: 1
        observedGenerationMatches: true
      -
        name: "techsupport-controller"
        desired: 1
        updated: 1
        ready: 1
        available: 1
        observedGenerationMatches: true
    installationMethod: "pinned manifest applied as a management-cluster prerequisite"
  configHubReview:
    organization: "helm-catalog"
    space: "hx-sveltos-20260727054324"
    unit: "clusterprofile"
    unitId: "68a2acb7-d72f-4b69-92e2-44b11cd75508"
    target:
      ref: "bitnami-redis-27-0-0-stage-pilot-live-20260705/oci-target"
      id: "7d32ab9b-6259-40e6-871d-e78f84761d2b"
      provider: "OCI"
    policy:
      profile: "catalog-standard"
      resourceClass: "system-configuration"
      filter:
        ref: "platform/helm-catalog-prod-gates"
        id: "8784a447-0e4d-4471-b924-eae5377778a2"
        hash: "53b704e063e156905f5b7f56e7a001cdacd8d300506981e9f6ce97167a0d0b5b"
        triggerRefs:
          - "platform/digest-pinned-images"
          - "platform/lifecycle-route-evidence"
          - "platform/probes-declared"
          - "platform/require-approval"
          - "platform/vet-placeholders"
          - "platform/vet-schemas"
        triggerIds:
          - "04746183-327b-484e-b061-91d2c7753a76"
          - "2651b7cc-31a2-4833-adde-11e018656dee"
          - "3f5dd412-1cf2-4583-a73a-12817f899c87"
          - "4d7664a3-9ac0-4160-868f-95eaa0b59f8f"
          - "5ce74cb1-7129-43c8-a48c-a0ba4322de3d"
          - "9d281daf-79f4-4244-84cc-fbde411e3c11"
      approvalGate: "platform/require-approval/vet-approvedby"
    pilot:
      selector:
        environment: "staging"
        rollout: "pilot"
      contentHash: 690027374
      beforeApproval:
        result: "blocked"
        gate: "platform/require-approval/vet-approvedby"
        dryRun: true
        exitCode: 1
      approval:
        revision: 2
        recordedApprovals: 1
        approverIdentityRecordedInReceipt: false
        contentHashUnchanged: true
      afterApproval:
        result: "allowed"
        dryRun: true
        exitCode: 0
      approvedDataMatchesSource: true
      privateRelease:
        space: "hx-sveltos-20260727054324"
        reference: "oci://oci.hub.confighub.com:443/space/hx-sveltos-20260727054324:latest"
        manifestDigest: "sha256:f7f8fbfd93b6f33ce0cd5e5ea23250eae096d09ff08c0d8e55077ad2f9d6610a"
        bundleDigest: "sha256:974756f52fba3361474b94e8243a6a990be7b6796954de4f42d8a44060d54ce1"
        releaseId: "95cb272d-b72d-4352-9fa0-1f62c2c5df9c"
      portableRelease:
        reference: "oci://127.0.0.1:32807/sveltos-kyverno-staging:pilot"
        clusterReference: "oci://host.docker.internal:32807/sveltos-kyverno-staging"
        targetRevision: "pilot"
        manifestDigest: "sha256:0de702823d0d0cb41bfa667e29f40871f6d28e3122815ccd2f2931a9aacbc3bc"
        objectCount: 1
        approvedDataSha256: "551a612c40704c7e107ddcd8101d7d6a7f329d7d1afef6e9955ce8b70522b5e5"
        pulledDataSha256: "551a612c40704c7e107ddcd8101d7d6a7f329d7d1afef6e9955ce8b70522b5e5"
        objectsMatchApprovedData: true
        anonymousPull: true
        registryLifetime: "temporary"
    fleet:
      selector:
        environment: "staging"
      change:
        path: "spec.clusterSelector.matchLabels.rollout"
        before: "pilot"
        after: "removed"
        otherSourceFieldsChanged: false
      contentHash: 1930257855
      beforeApproval:
        result: "blocked"
        gate: "platform/require-approval/vet-approvedby"
        dryRun: true
        exitCode: 1
      approval:
        revision: 4
        recordedApprovals: 1
        approverIdentityRecordedInReceipt: false
        contentHashUnchanged: true
      afterApproval:
        result: "allowed"
        dryRun: true
        exitCode: 0
      approvedDataMatchesCandidate: true
      privateRelease:
        space: "hx-sveltos-20260727054324"
        reference: "oci://oci.hub.confighub.com:443/space/hx-sveltos-20260727054324:latest"
        manifestDigest: "sha256:0e177fbb247e4642ff925a1beef0f403f7999a72b36d70eff88a26a2f997c179"
        bundleDigest: "sha256:66d6a1b3089bb936f25a311be4cf896bf461c6e982d7e4ef40c0f6ed02e54f62"
        releaseId: "61ad3d8d-5e55-489f-8733-eee53cef8a0c"
      portableRelease:
        reference: "oci://127.0.0.1:32807/sveltos-kyverno-staging:fleet"
        clusterReference: "oci://host.docker.internal:32807/sveltos-kyverno-staging"
        targetRevision: "fleet"
        manifestDigest: "sha256:a9907fd5f277f4dff5a4ec78841562657b7fd706e2ddf1e14a347d6a66493911"
        objectCount: 1
        approvedDataSha256: "6c873f78591921ab8c0e114a12977802c06900e690502f7f7ea7147992b1c7fe"
        pulledDataSha256: "6c873f78591921ab8c0e114a12977802c06900e690502f7f7ea7147992b1c7fe"
        objectsMatchApprovedData: true
        anonymousPull: true
        registryLifetime: "temporary"
  management:
    organization: "DP1-Sandbox"
    cluster: "hx-sveltos-mgmt-20260727054324"
    creationCommand: "cub cluster up"
    registrations:
      -
        method: "programmatic SveltosCluster registration"
        namespace: "projectsveltos"
        cluster: "hx-sveltos-pilot-20260727054324"
        labels:
          environment: "staging"
          rollout: "pilot"
          sveltos-agent: "present"
        credential:
          type: "short-lived Kubernetes service-account token"
          duration: "2h"
          storedInRepository: false
          removedWithClusters: true
        ready: true
        kubernetesVersion: "v1.35.0"
      -
        method: "programmatic SveltosCluster registration"
        namespace: "projectsveltos"
        cluster: "hx-sveltos-next-20260727054324"
        labels:
          environment: "staging"
          rollout: "next"
          sveltos-agent: "present"
        credential:
          type: "short-lived Kubernetes service-account token"
          duration: "2h"
          storedInRepository: false
          removedWithClusters: true
        ready: true
        kubernetesVersion: "v1.35.0"
    waves:
      pilot:
        source: "approved ConfigHub Unit data"
        applicationDelivery: "ConfigHub cluster Space release OCI"
        workloadDelivery: "temporary portable OCI"
        portablePackaging: "scripted from the approved Unit data"
        application:
          name: "sveltos-profile-20260727054324"
          unit: "hx-sveltos-mgmt-20260727054324-cluster/sveltos-profile-application"
          source: "oci://host.docker.internal:32807/sveltos-kyverno-staging"
          sourceRevision: "pilot"
          approvedConfigHubSpace: "hx-sveltos-20260727054324"
          destinationCluster: "management"
          clusterRootReleaseDigest: "sha256:6d05c7fab22cfe7039b3046b518f4a7bf7a1c6f67623b35cdf747d6f6818cf1a"
        argo:
          result: "pass"
          sync: "Synced"
          health: "Healthy"
          revision: "sha256:0de702823d0d0cb41bfa667e29f40871f6d28e3122815ccd2f2931a9aacbc3bc"
          expectedRevision: "sha256:0de702823d0d0cb41bfa667e29f40871f6d28e3122815ccd2f2931a9aacbc3bc"
          digestMatchesPortableOci: true
        approvedFieldsMatchLive: true
        liveAddedFieldPaths:
          - "metadata.annotations"
          - "metadata.finalizers"
          - "spec.continueOnConflict"
          - "spec.continueOnError"
          - "spec.reloader"
          - "spec.stopMatchingBehavior"
          - "spec.tier"
        targets:
          -
            cluster: "hx-sveltos-pilot-20260727054324"
            selected: true
            reconciliation:
              result: "pass"
              selectedCluster: "hx-sveltos-pilot-20260727054324"
              clusterSummary: "projectsveltos/kyverno-staging-sveltos-hx-sveltos-pilot-20260727054324"
              helmFeatureStatus: "Provisioned"
              helmRelease:
                name: "kyverno"
                namespace: "kyverno"
                chart: "kyverno-3.8.1"
                applicationVersion: "v1.18.1"
                status: "deployed"
              deployments:
                -
                  name: "kyverno-admission-controller"
                  desired: 3
                  available: 3
                  observedGenerationMatches: true
                -
                  name: "kyverno-background-controller"
                  desired: 1
                  available: 1
                  observedGenerationMatches: true
                -
                  name: "kyverno-cleanup-controller"
                  desired: 1
                  available: 1
                  observedGenerationMatches: true
                -
                  name: "kyverno-reports-controller"
                  desired: 1
                  available: 1
                  observedGenerationMatches: true
          -
            cluster: "hx-sveltos-next-20260727054324"
            selected: false
            observation:
              result: "pass"
              selected: false
              helmReleasePresent: false
              namespacePresent: false
              clusterSummaryPresent: false
      fleet:
        source: "approved ConfigHub Unit data"
        applicationDelivery: "ConfigHub cluster Space release OCI"
        workloadDelivery: "temporary portable OCI"
        portablePackaging: "scripted from the approved Unit data"
        application:
          name: "sveltos-profile-20260727054324"
          unit: "hx-sveltos-mgmt-20260727054324-cluster/sveltos-profile-application"
          source: "oci://host.docker.internal:32807/sveltos-kyverno-staging"
          sourceRevision: "fleet"
          approvedConfigHubSpace: "hx-sveltos-20260727054324"
          destinationCluster: "management"
          clusterRootReleaseDigest: "sha256:e7c5ea3e85f41e075ea9216f3aa13b9656490567a73cebe5fde630316d41ff5b"
        argo:
          result: "pass"
          sync: "Synced"
          health: "Healthy"
          revision: "sha256:a9907fd5f277f4dff5a4ec78841562657b7fd706e2ddf1e14a347d6a66493911"
          expectedRevision: "sha256:a9907fd5f277f4dff5a4ec78841562657b7fd706e2ddf1e14a347d6a66493911"
          digestMatchesPortableOci: true
        approvedFieldsMatchLive: true
        liveAddedFieldPaths:
          - "metadata.annotations"
          - "metadata.finalizers"
          - "spec.continueOnConflict"
          - "spec.continueOnError"
          - "spec.reloader"
          - "spec.stopMatchingBehavior"
          - "spec.tier"
        targets:
          -
            cluster: "hx-sveltos-pilot-20260727054324"
            selected: true
            reconciliation:
              result: "pass"
              selectedCluster: "hx-sveltos-pilot-20260727054324"
              clusterSummary: "projectsveltos/kyverno-staging-sveltos-hx-sveltos-pilot-20260727054324"
              helmFeatureStatus: "Provisioned"
              helmRelease:
                name: "kyverno"
                namespace: "kyverno"
                chart: "kyverno-3.8.1"
                applicationVersion: "v1.18.1"
                status: "deployed"
              deployments:
                -
                  name: "kyverno-admission-controller"
                  desired: 3
                  available: 3
                  observedGenerationMatches: true
                -
                  name: "kyverno-background-controller"
                  desired: 1
                  available: 1
                  observedGenerationMatches: true
                -
                  name: "kyverno-cleanup-controller"
                  desired: 1
                  available: 1
                  observedGenerationMatches: true
                -
                  name: "kyverno-reports-controller"
                  desired: 1
                  available: 1
                  observedGenerationMatches: true
          -
            cluster: "hx-sveltos-next-20260727054324"
            selected: true
            reconciliation:
              result: "pass"
              selectedCluster: "hx-sveltos-next-20260727054324"
              clusterSummary: "projectsveltos/kyverno-staging-sveltos-hx-sveltos-next-20260727054324"
              helmFeatureStatus: "Provisioned"
              helmRelease:
                name: "kyverno"
                namespace: "kyverno"
                chart: "kyverno-3.8.1"
                applicationVersion: "v1.18.1"
                status: "deployed"
              deployments:
                -
                  name: "kyverno-admission-controller"
                  desired: 3
                  available: 3
                  observedGenerationMatches: true
                -
                  name: "kyverno-background-controller"
                  desired: 1
                  available: 1
                  observedGenerationMatches: true
                -
                  name: "kyverno-cleanup-controller"
                  desired: 1
                  available: 1
                  observedGenerationMatches: true
                -
                  name: "kyverno-reports-controller"
                  desired: 1
                  available: 1
                  observedGenerationMatches: true
  workloads:
    -
      cluster: "hx-sveltos-pilot-20260727054324"
      role: "pilot"
      creationCommand: "kind create cluster"
      drift:
        result: "pass"
        object: "apps/v1/Deployment/kyverno/kyverno-admission-controller"
        reviewedReplicas: 3
        changedReplicas: 1
        restoredReplicas: 3
        pollAttempts: 17
        pollIntervalSeconds: 3
    -
      cluster: "hx-sveltos-next-20260727054324"
      role: "second-wave"
      creationCommand: "kind create cluster"
      drift:
        result: "pass"
        object: "apps/v1/Deployment/kyverno/kyverno-admission-controller"
        reviewedReplicas: 3
        changedReplicas: 1
        restoredReplicas: 3
        pollAttempts: 18
        pollIntervalSeconds: 3
  cleanup:
    policySpace: "pass"
    managementCluster: "pass"
    managementSpace: "pass"
    pilotCluster: "pass"
    secondCluster: "pass"
    registry: "pass"
    localFiles: "pass"
  limits:
    - "The pinned Sveltos controllers were installed directly as a prerequisite on the throwaway management cluster."
    - "The reviewed ClusterProfile, not the Sveltos controller installation, was delivered through ConfigHub, OCI, and Argo CD."
    - "The portable OCI used a temporary anonymous registry; this is not a permanent public package."
    - "The proof used two local kind workload clusters. It does not prove a large production fleet or a failure-and-pause rollout."
    - "The proof covers this Kyverno ClusterProfile, not every Sveltos feature or add-on."
status:
  result: "pass"
  claim: "ConfigHub stored and approved a pilot Sveltos ClusterProfile, then approved one selector change that added a second staging cluster. Each revision was published at a different OCI digest and reconciled through Argo CD. Sveltos installed Kyverno 3.8.1 on the pilot first, then on both clusters, and repaired replica drift on each target."