This is the next human/product promotion slice after the top-20 local-test support pass.
The point is not to declare these charts supported yet. The point is to choose five proof-grade/default charts where adding real user-shaped variants will test whether the catalog is actually simpler and safer than plain Helm. Some already have basic machine-generated variants such as default/no-crds. Wave 2 is about promoting useful user-shaped variants, not merely counting rendered bases.
Selected Charts
| Rank | Chart | Version | Proposed real variants | Why |
|---|---|---|---|---|
| 8 | traefik/traefik | 40.2.0 | default, external-crds, internal-clusterip-dashboard-off, cloud-loadbalancer | Very high-rank ingress controller with CRDs, RBAC, webhooks, generated/source signals, and exposure choices. |
| 18 | external-dns/external-dns | 1.21.1 | route53-irsa, cloudflare-existing-secret, dry-run-txt-registry | Small, familiar controller where the useful variants are provider and credential choices, not YAML ceremony. |
| 30 | vmware-tanzu/velero | 12.0.1 | aws-s3-existing-secret, azure-blob-existing-secret, filesystem-backup-node-agent | Backup/restore is a strong production story: provider credentials, object storage, CRDs, and restore safety are visible. |
| 35 | istio-official/istiod | 1.30.0 | revisioned-control-plane, external-ca, minimal-profile | Service mesh control plane proves ConfigHub can explain hard platform charts without pretending they are simple. |
| 38 | kyverno/kyverno | 3.8.1 | default-admission, external-crds, ha-admission-reports | Policy engine exercises hooks, lookup, generated facts, CRDs, admission webhooks, and controller sizing. |
Acceptance
For each chart, promotion requires:
- actual
variants/<name>/variant.yamlfiles; - matching
packages/.../bases/<name>package bases; - rendered object inventory and immutable revision per variant;
- Helm-equivalence, render, scan, install-gate, and package receipts;
- explicit production dispositions for scan/gate warnings;
- live/e2e observation requirements before production support is claimed.
Until then these remain proof-grade candidates, not catalog-supported recipes.