Generated. Do not edit by hand.
npm run chart:evidence-router
npm run chart:evidence-router:verifyThis is a per-chart routing index for the top-100 catalog corpus. It does not define chart status. For status, use the linked source rows:
| Question | Source |
|---|---|
| Can a Helm user try this chart? | ../chart-use-guide/chart-use-guide.csv |
| What works, what needs prerequisites, what needs operator review, and what is blocked? | ../top100-user-readiness/readiness.csv |
| Which chart/base proof lanes have receipts? | ../outcome-coverage/base-outcomes.csv |
| Which hooks or source quirks are routed? | ../hook-coverage/top100-hook-coverage.csv, ../quirk-work-queue/top100-queue.csv |
| Which production decisions or live receipts exist? | ../production-support-decisions/decisions.csv, ../runtime-gitops/receipt-index.csv, ../live-helm-confighub-compare/summary.csv, ../gitops-health-residue/summary.md |
Use router.csv when you know the chart name and need the catalog path, base rows, variant revisions, receipts, hook route, quirk route, and decision files in one place.
Routes
| Chart | User status | First base | Evidence rows | Hooks and quirks | Decisions and receipts | Next action |
|---|---|---|---|---|---|---|
| argo-cd/argo-cd@9.5.15 | ready-to-try | default | coverage covered<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;existing-secret;extension-slots | production default:supported:fresh-target-evidence-passed<br>decision<br>GitOps no-crds:Argo CD OCI:blocked<br>GitOps receipts<br>live compare 1, live compare 2 | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
| bitnami/mongodb@19.0.7 | ready-to-try | existing-secret-replicaset | coverage covered<br>bases existing-secret-replicaset;static-passwords<br>variants 1, variants 2 | quirks generated-secrets;extension-slots;install-vs-upgrade-divergence;required-values;lookup;generated-facts;tpl;capabilities;rbac;storage<br>route P0: model remote dependency closure in chart facts and source/dependency lock evidence: dependency closure facts plus refresh-survival check<br>quirk evidence 1: mongodb/charts/common/templates/_capabilities.tpl, quirk evidence 2: mongodb/charts/common/templates/_secrets.tpl, quirk evidence 3: mongodb/templates/secrets.yaml, quirk evidence 4: mongodb/templates/mcp/ingress-tls-secret.yaml | production static-passwords:supported:fresh-target-evidence-passed<br>decision<br>live compare 1, live compare 2 | choose whether static-passwords is in production scope; close or document its render-only live-readiness issue first |
| bitnami/mysql@14.0.3 | ready-to-try | existing-secret | coverage covered<br>bases existing-secret;static-passwords<br>variants 1, variants 2 | quirks generated-secrets;existing-secret;install-vs-upgrade-divergence;required-values;lookup;generated-facts;tpl;capabilities;storage<br>route P0: model remote dependency closure in chart facts and source/dependency lock evidence: dependency closure facts plus refresh-survival check<br>quirk evidence 1: mysql/charts/common/templates/_capabilities.tpl, quirk evidence 2: mysql/charts/common/templates/_secrets.tpl, quirk evidence 3: mysql/templates/tls-secret.yaml, quirk evidence 4: mysql/templates/primary/statefulset.yaml | production static-passwords:supported:fresh-target-evidence-passed<br>decision<br>live compare 1, live compare 2 | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
| bitnami/nginx@24.0.2 | ready-to-try | http-clusterip | coverage covered<br>bases existing-tls-ingress;http-clusterip<br>variants 1, variants 2 | quirks generated-secrets;existing-secret;extension-slots;install-vs-upgrade-divergence;lookup;generated-facts;tpl;capabilities<br>route P0: model remote dependency closure in chart facts and source/dependency lock evidence: dependency closure facts plus refresh-survival check<br>quirk evidence 1: nginx/charts/common/templates/_capabilities.tpl, quirk evidence 2: nginx/charts/common/templates/_secrets.tpl, quirk evidence 3: nginx/templates/ingress-tls-secret.yaml, quirk evidence 4: nginx/templates/tls-secret.yaml | production http-clusterip:supported:fresh-target-evidence-passed<br>decision<br>GitOps http-clusterip:Argo CD OCI:pass<br>GitOps receipts<br>live compare 1, live compare 2 | choose whether http-clusterip is in production scope; close or document its render-only live-readiness issue first |
| bitnami/postgresql@18.6.7 | ready-to-try | existing-secret | coverage covered<br>bases existing-secret;static-passwords<br>variants 1, variants 2 | quirks generated-secrets;existing-secret;install-vs-upgrade-divergence;required-values;lookup;generated-facts;tpl;capabilities;storage<br>route P0: model remote dependency closure in chart facts and source/dependency lock evidence: dependency closure facts plus refresh-survival check<br>quirk evidence 1: postgresql/charts/common/templates/_capabilities.tpl, quirk evidence 2: postgresql/charts/common/templates/_secrets.tpl, quirk evidence 3: postgresql/templates/secrets.yaml, quirk evidence 4: postgresql/templates/tls-secrets.yaml | production static-passwords:supported:fresh-target-evidence-passed<br>decision<br>GitOps existing-secret:Flux OCI:pass<br>GitOps receipts<br>live compare 1, live compare 2 | choose whether static-passwords is in production scope; close or document its render-only live-readiness issue first |
| bitnami/rabbitmq@16.0.14 | ready-to-try | existing-secret | coverage covered<br>bases existing-secret;static-passwords<br>variants 1, variants 2 | quirks generated-secrets;existing-secret;install-vs-upgrade-divergence;required-values;lookup;generated-facts;tpl;capabilities;storage<br>route P0: model remote dependency closure in chart facts and source/dependency lock evidence: dependency closure facts plus refresh-survival check<br>quirk evidence 1: rabbitmq/charts/common/templates/_capabilities.tpl, quirk evidence 2: rabbitmq/templates/svc-headless.yaml, quirk evidence 3: rabbitmq/charts/common/templates/_secrets.tpl, quirk evidence 4: rabbitmq/templates/ingress-tls-secrets.yaml | production static-passwords:supported:fresh-target-evidence-passed<br>decision<br>live compare 1, live compare 2 | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
| bitnami/redis@25.5.3 | ready-to-try | reuse-existing-secret | coverage covered<br>bases default;reuse-existing-secret<br>variants 1, variants 2 | quirks generated-secrets;install-vs-upgrade-divergence;required-values;lookup;generated-facts;tpl;capabilities;storage<br>route P0: model remote dependency closure in chart facts and source/dependency lock evidence: dependency closure facts plus refresh-survival check<br>quirk evidence 1: redis/charts/common/templates/_capabilities.tpl, quirk evidence 2: redis/charts/common/templates/_secrets.tpl, quirk evidence 3: redis/templates/tls-secret.yaml, quirk evidence 4: redis/templates/scripts-configmap.yaml | production default:supported:fresh-target-evidence-passed<br>decision<br>GitOps reuse-existing-secret:Flux OCI:pass<br>GitOps receipts<br>live compare 1, live compare 2 | choose whether default is in production scope; close or document its render-only live-readiness issue first |
| external-secrets/external-secrets@2.5.0 | ready-to-try | default | coverage covered<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;existing-secret;extension-slots | production default:supported:fresh-target-evidence-passed<br>decision<br>GitOps default:Argo CD OCI:pass;default:Argo CD OCI:pass;default:Argo CD OCI:blocked;no-crds:Argo CD OCI:blocked<br>GitOps receipts 1, GitOps receipts 2, GitOps receipts 3, GitOps receipts 4<br>live compare 1, live compare 2 | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
| grafana/grafana@10.5.15 | ready-to-try | existing-secret-ingress | coverage covered<br>bases existing-secret-ingress;static-passwords<br>variants 1, variants 2 | quirks extension-slots | production existing-secret-ingress:superseded:not-production-supported-because-source-chart-is-deprecated<br>decision<br>live compare 1, live compare 2 | resolve image digests for each affected variant before production OCI support |
| grafana/loki@7.0.0 | ready-to-try | single-binary-filesystem | coverage covered<br>bases simple-scalable-minio;single-binary-filesystem<br>variants 1, variants 2 | quirks crds;generated-secrets;webhooks;extension-slots;required-values;lookup;generated-facts;tpl;capabilities;rbac;storage<br>route P0: model remote dependency closure in chart facts and source/dependency lock evidence: dependency closure facts plus refresh-survival check<br>quirk evidence 1: loki/charts/minio/templates/_helpers.tpl, quirk evidence 2: loki/charts/minio/templates/console-ingress.yaml, quirk evidence 3: loki/charts/minio/templates/ingress.yaml, quirk evidence 4: loki/templates/monitoring/dashboards/configmap-1.yaml | production single-binary-filesystem:supported:fresh-target-evidence-passed<br>decision<br>live compare 1, live compare 2 | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
| grafana/tempo@1.24.4 | ready-to-try | local-persistent | coverage covered<br>bases local-persistent;s3-query-observability<br>variants 1, variants 2 | quirks extension-slots | production local-persistent:superseded:not-production-supported-because-source-chart-is-deprecated<br>decision<br>GitOps health s3-query-observability:resource-or-condition-residue<br>health residue 1, health residue 2<br>live compare 1, live compare 2 | resolve image digests for each affected variant before production OCI support |
| hashicorp/consul@2.0.0 | ready-to-try | default-control-plane | coverage covered<br>bases default-control-plane;secure-mesh-existing-secrets<br>variants 1, variants 2 | quirks webhooks;extension-slots;install-vs-upgrade-divergence;required-values;tpl;capabilities;rbac;storage<br>route P2: promote version-conditional rendering into chart facts and variant-path coverage: chart facts axis plus capability/version matrix row<br>quirk evidence: consul/templates/server-statefulset.yaml | production default-control-plane:supported:fresh-target-evidence-passed<br>decision<br>GitOps secure-mesh-existing-secrets:Flux OCI:blocked<br>GitOps receipts<br>GitOps health secure-mesh-existing-secrets:resource-or-condition-residue<br>health residue 1, health residue 2<br>live compare 1, live compare 2 | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
| hashicorp/vault@0.32.0 | ready-to-try | default | coverage covered<br>bases default;dev-mode;ha-raft-ui<br>variants 1, variants 2, variants 3 | quirks webhooks;extension-slots;required-values;tpl;capabilities;rbac;storage<br>route P1: promote version-conditional rendering into chart facts and variant-path coverage: chart facts axis plus capability/version matrix row<br>quirk evidence 1: vault/templates/server-ha-active-service.yaml, quirk evidence 2: vault/templates/server-ha-standby-service.yaml, quirk evidence 3: vault/templates/server-headless-service.yaml | production default:rejected:parity-passed-production-support-rejected<br>decision<br>GitOps health ha-raft-ui:resource-or-condition-residue<br>health residue 1, health residue 2<br>live compare 1, live compare 2, live compare 3 | resolve image digests for each affected variant before production OCI support |
| ingress-nginx/ingress-nginx@4.15.1 | ready-to-try | internal-clusterip | coverage covered<br>bases admission-disabled;default;internal-clusterip<br>variants 1, variants 2, variants 3 | quirks webhooks;required-values;tpl;capabilities;rbac<br>route P1: promote version-conditional rendering into chart facts and variant-path coverage: chart facts axis plus capability/version matrix row<br>quirk evidence 1: ingress-nginx/templates/NOTES.txt, quirk evidence 2: ingress-nginx/templates/controller-daemonset.yaml, quirk evidence 3: ingress-nginx/templates/controller-deployment.yaml | production internal-clusterip:supported:fresh-target-evidence-passed<br>decision<br>GitOps admission-disabled:Argo CD OCI:watch;internal-clusterip:Argo CD OCI:pass<br>GitOps receipts 1, GitOps receipts 2<br>live compare 1, live compare 2, live compare 3 | record the target-scoped lifecycle support decision, then refresh live/e2e evidence for that scope |
| jetstack/cert-manager@v1.20.2 | ready-to-try | crds-enabled | coverage covered<br>bases crds-enabled;default<br>variants 1, variants 2 | quirks extension-slots | production crds-enabled:supported:fresh-target-evidence-passed<br>decision<br>live compare 1, live compare 2 | write or fix the receipt for target fact preflight |
| longhorn/longhorn@1.11.2 | ready-to-try | default | coverage covered<br>bases default;ui-ingress<br>variants 1, variants 2 | quirks required-values;generated-facts;tpl;rbac<br>route P2: classify generated values as generated facts, target facts, or existing-secret bases: generated-facts policy plus field reachability row<br>quirk evidence 1: longhorn/templates/NOTES.txt, quirk evidence 2: longhorn/templates/crds.yaml | production default:supported:fresh-target-evidence-passed<br>decision<br>live compare 1, live compare 2 | choose the supported production base, then record explicit security acceptance or create a hardened base before claiming production support |
| metrics-server/metrics-server@3.13.0 | ready-to-try | default | coverage covered<br>bases default;external-tls-ca<br>variants 1, variants 2 | quirks generated-secrets;existing-secret;lookup;generated-facts;capabilities;rbac<br>route P0: add an APIService readiness model and runtime observation route: chart facts axis plus lifecycle observation receipt<br>quirk evidence 1: metrics-server/templates/_helpers.tpl, quirk evidence 2: metrics-server/templates/pdb.yaml, quirk evidence 3: metrics-server/templates/psp.yaml, quirk evidence 4: metrics-server/templates/apiservice.yaml | production default:supported:fresh-target-evidence-passed<br>decision<br>GitOps default:Argo CD OCI:pass<br>GitOps receipts<br>live compare 1, live compare 2 | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
| prometheus-community/kube-prometheus-stack@85.3.3 | ready-to-try | default | coverage covered<br>bases default;no-crds<br>variants 1, variants 2 | hooks maintained-observed: preflight-or-presync;postsync-check-or-observation;upgrade-action-with-receipt;preserve-ordering;preserve-cleanup-policy;webhook-readiness-observation;target-facts-or-preflight<br>hook evidence 1, hook evidence 2<br>quirks hooks;crds;generated-secrets;existing-secret;webhooks;extension-slots;install-vs-upgrade-divergence;required-values;lookup;generated-facts;tpl;capabilities;rbac;storage<br>route P0: model remote dependency closure in chart facts and source/dependency lock evidence: dependency closure facts plus refresh-survival check<br>quirk evidence 1: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/ciliumnetworkpolicy-createSecret.yaml, quirk evidence 2: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/ciliumnetworkpolicy-patchWebhook.yaml | production default:supported:fresh-target-evidence-passed<br>decision<br>GitOps default:Argo CD OCI:pass;no-crds:Argo CD OCI:pass<br>GitOps receipts 1, GitOps receipts 2<br>live compare 1, live compare 2 | choose the supported production base, then record explicit security acceptance or create a hardened base before claiming production support |
| prometheus-community/prometheus@29.8.0 | ready-to-try | server-only-ephemeral | coverage covered<br>bases default;server-only-ephemeral<br>variants 1, variants 2 | quirks generated-secrets;extension-slots;required-values;generated-facts;tpl;capabilities;rbac;storage<br>route P0: model remote dependency closure in chart facts and source/dependency lock evidence: dependency closure facts plus refresh-survival check<br>quirk evidence 1: prometheus/charts/prometheus-node-exporter/templates/daemonset.yaml, quirk evidence 2: prometheus/templates/deploy.yaml, quirk evidence 3: prometheus/charts/kube-state-metrics/templates/NOTES.txt, quirk evidence 4: prometheus/charts/prometheus-node-exporter/templates/NOTES.txt | production server-only-ephemeral:supported:fresh-target-evidence-passed<br>decision<br>GitOps server-only-ephemeral:Flux OCI:pass<br>GitOps receipts<br>live compare 1, live compare 2 | choose the supported production base, then record explicit security acceptance or create a hardened base before claiming production support |
| secrets-store-csi-driver/secrets-store-csi-driver@1.6.0 | ready-to-try | default | coverage covered<br>bases default;sync-secret-rotation<br>variants 1, variants 2 | quirks extension-slots | production default:supported:fresh-target-evidence-passed<br>decision<br>live compare 1, live compare 2 | choose the supported production base, then record explicit security acceptance or create a hardened base before claiming production support |
| traefik/traefik@40.2.0 | not-ready-yet | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;generated-secrets;existing-secret;webhooks;extension-slots;required-values;lookup;generated-facts;tpl;capabilities;rbac;storage<br>route P0: promote version-conditional rendering into chart facts and variant-path coverage: chart facts axis plus capability/version matrix row<br>quirk evidence 1: traefik/templates/NOTES.txt, quirk evidence 2: traefik/templates/_helpers.tpl, quirk evidence 3: traefik/templates/deployment.yaml | GitOps health no-crds:resource-or-condition-residue<br>health residue 1, health residue 2<br>live compare 1, live compare 2 | review limitation before promotion: existing-secret (chart ships no Secret toggle) |
| external-dns/external-dns@1.21.1 | works-with-target-prerequisites | default | coverage partial<br>bases default;dry-run-txt-registry;no-crds<br>variants 1, variants 2, variants 3 | quirks crds;existing-secret;extension-slots;required-values;tpl;rbac<br>route P2: promote required inputs into typed prompts, placeholders, or supported base choices: input contract row | live compare 1, live compare 2, live compare 3 | run catalog promotion review |
| gitlab/gitlab-runner@0.89.0 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks existing-secret;extension-slots;generated-facts;tpl;capabilities<br>route P2: classify generated values as generated facts, target facts, or existing-secret bases: generated-facts policy plus field reachability row<br>quirk evidence: gitlab-runner/templates/NOTES.txt | GitOps health default:resource-or-condition-residue<br>health residue 1, health residue 2<br>live compare | add at least one user-shaped variant before catalog promotion |
| kyverno/kyverno@3.8.1 | not-ready-yet | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | hooks maintained-observed: upgrade-action-with-receipt;delete-cleanup-policy;explicit-test-check;preserve-ordering;preserve-cleanup-policy;target-facts-or-preflight<br>hook evidence 1, hook evidence 2<br>quirks hooks;crds;generated-secrets;existing-secret;extension-slots;install-vs-upgrade-divergence;required-values;lookup;generated-facts;tpl;capabilities;rbac;storage<br>route P0: model remote dependency closure in chart facts and source/dependency lock evidence: dependency closure facts plus refresh-survival check<br>quirk evidence 1: kyverno/charts/reports-server/templates/hooks/pre-delete-api-service-cleanup.yaml, quirk evidence 2: kyverno/templates/hooks/post-upgrade-migrate-resources.yaml, quirk evidence 3: kyverno/templates/hooks/pre-delete-remove-webhooks.yaml | live compare 1, live compare 2 | review limitation before promotion: existing-secret (chart ships no Secret toggle) |
| cloudnative-pg/cloudnative-pg@0.28.2 | works-with-target-prerequisites | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;existing-secret;webhooks;extension-slots;generated-facts;tpl;rbac<br>route P0: model remote dependency closure in chart facts and source/dependency lock evidence: dependency closure facts plus refresh-survival check<br>quirk evidence 1: cloudnative-pg/charts/cluster/templates/sidecar-configmap.yaml, quirk evidence 2: cloudnative-pg/templates/NOTES.txt | live compare 1, live compare 2 | run catalog promotion review |
| fluent/fluent-bit@0.57.6 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | hooks maintained-observed: explicit-test-check;preserve-cleanup-policy<br>hook evidence 1, hook evidence 2<br>quirks hooks;extension-slots;tpl;capabilities;rbac<br>route P0: choose a lifecycle route and commit a route or observation receipt: hook lifecycle route receipt<br>quirk evidence 1: fluent-bit/templates/tests/test-connection.yaml, quirk evidence 2: fluent-bit/templates/_helpers.tpl, quirk evidence 3: fluent-bit/templates/clusterrole.yaml, quirk evidence 4: fluent-bit/templates/psp.yaml | live compare | add at least one user-shaped variant before catalog promotion |
| runix/pgadmin4@1.62.0 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks existing-secret;extension-slots;required-values;tpl;capabilities;storage<br>route P2: promote version-conditional rendering into chart facts and variant-path coverage: chart facts axis plus capability/version matrix row<br>quirk evidence 1: pgadmin4/templates/_helpers.tpl, quirk evidence 2: pgadmin4/templates/hpa.yaml | live compare | add at least one user-shaped variant before catalog promotion |
| nfs-subdir-external-provisioner/nfs-subdir-external-provisioner@4.0.18 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks capabilities;rbac;storage<br>route P2: promote version-conditional rendering into chart facts and variant-path coverage: chart facts axis plus capability/version matrix row<br>quirk evidence 1: nfs-subdir-external-provisioner/templates/_helpers.tpl, quirk evidence 2: nfs-subdir-external-provisioner/templates/deployment.yaml | live compare | add at least one user-shaped variant before catalog promotion |
| kedacore/keda@2.19.0 | works-with-operator-review | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;webhooks;extension-slots;tpl;capabilities;rbac<br>route P0: add an APIService readiness model and runtime observation route: chart facts axis plus lifecycle observation receipt | GitOps default:Argo CD OCI:pass<br>GitOps receipts<br>live compare 1, live compare 2 | run APIService promotion review: choose supported base, target scope, CRD ownership path, and evidence refresh rule using the committed aggregation receipt |
| prometheus-community/kube-state-metrics@7.4.0 | works-with-target-prerequisites | default | coverage partial<br>bases cluster-metrics-readonly;default<br>variants 1, variants 2 | quirks existing-secret;extension-slots;generated-facts;tpl;capabilities;rbac;storage<br>route P2: classify generated values as generated facts, target facts, or existing-secret bases: generated-facts policy plus field reachability row<br>quirk evidence: kube-state-metrics/templates/NOTES.txt | live compare 1, live compare 2 | run catalog promotion review |
| elastic/eck-operator@3.4.0 | works-with-target-prerequisites | default | coverage partial<br>bases default;ha;no-crds<br>variants 1, variants 2, variants 3 | quirks crds;existing-secret;webhooks;extension-slots;required-values;tpl;capabilities;rbac;storage<br>route P2: bind the render to named capability profiles and test the important alternate profile: capability profile matrix row | live compare 1, live compare 2, live compare 3 | run catalog promotion review |
| elastic/kibana@8.5.1 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks extension-slots;tpl | GitOps health default:resource-or-condition-residue<br>health residue 1, health residue 2<br>live compare | add at least one user-shaped variant before catalog promotion |
| descheduler/descheduler@0.36.0 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks extension-slots;required-values;tpl;rbac<br>route P2: promote required inputs into typed prompts, placeholders, or supported base choices: input contract row | live compare | add at least one user-shaped variant before catalog promotion |
| prometheus-community/prometheus-blackbox-exporter@11.10.0 | works-with-operator-review | default | coverage partial<br>bases cluster-metrics-readonly;default<br>variants 1, variants 2 | quirks extension-slots;tpl;capabilities<br>route P2: bind the render to named capability profiles and test the important alternate profile: capability profile matrix row | live compare 1, live compare 2 | run catalog promotion review |
| bitnami/elasticsearch@22.1.6 | not-ready-yet | legacy | coverage partial<br>bases default;ha;legacy<br>variants 1, variants 2, variants 3 | quirks generated-secrets;existing-secret;extension-slots;install-vs-upgrade-divergence;required-values;lookup;generated-facts;tpl;capabilities;storage<br>route P0: model remote dependency closure in chart facts and source/dependency lock evidence: dependency closure facts plus refresh-survival check<br>quirk evidence 1: elasticsearch/charts/common/templates/_capabilities.tpl, quirk evidence 2: elasticsearch/charts/kibana/charts/common/templates/_capabilities.tpl, quirk evidence 3: elasticsearch/charts/common/templates/_secrets.tpl, quirk evidence 4: elasticsearch/charts/kibana/charts/common/templates/_secrets.tpl | GitOps health default:resource-or-condition-residue;ha:resource-or-condition-residue<br>health residue 1, health residue 2, health residue 3<br>live compare 1, live compare 2, live compare 3 | review limitation before promotion: existing-secret (chart ships no Secret toggle) |
| stakater/reloader@2.2.12 | works-with-operator-review | default | coverage partial<br>bases controller-default-reviewed;default<br>variants 1, variants 2 | quirks extension-slots;tpl;capabilities;rbac<br>route P2: bind the render to named capability profiles and test the important alternate profile: capability profile matrix row | live compare 1, live compare 2 | run catalog promotion review |
| jaegertracing/jaeger@4.8.0 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks generated-secrets;existing-secret;extension-slots;install-vs-upgrade-divergence;lookup;generated-facts;tpl;capabilities<br>route P0: model remote dependency closure in chart facts and source/dependency lock evidence: dependency closure facts plus refresh-survival check<br>quirk evidence 1: jaeger/charts/common/templates/_capabilities.tpl, quirk evidence 2: jaeger/charts/common/templates/_secrets.tpl | live compare | add at least one user-shaped variant before catalog promotion |
| grafana/alloy@1.8.2 | works-with-operator-review | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;extension-slots;required-values;tpl;capabilities;rbac;storage<br>route P1: promote version-conditional rendering into chart facts and variant-path coverage: chart facts axis plus capability/version matrix row<br>quirk evidence 1: alloy/templates/_helpers.tpl, quirk evidence 2: alloy/templates/controllers/statefulset.yaml, quirk evidence 3: alloy/templates/service.yaml, quirk evidence 4: alloy/templates/configmap.yaml | live compare 1, live compare 2 | run catalog promotion review |
| nats/nats@2.14.0 | works-with-target-prerequisites | default | coverage partial<br>bases default;ha<br>variants 1, variants 2 | quirks existing-secret;extension-slots;required-values;tpl<br>route P2: add bundled-file inventory to the source lock and value/provenance map: source-lock bundled file index<br>quirk evidence: nats/templates/_helpers.tpl | live compare 1, live compare 2 | run catalog promotion review |
| dex/dex@0.24.0 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks existing-secret;extension-slots;tpl;capabilities;rbac<br>route P2: promote version-conditional rendering into chart facts and variant-path coverage: chart facts axis plus capability/version matrix row<br>quirk evidence 1: dex/templates/hpa.yaml, quirk evidence 2: dex/templates/ingress.yaml, quirk evidence 3: dex/templates/networkpolicy.yaml | GitOps health default:resource-or-condition-residue<br>health residue 1, health residue 2<br>live compare | add at least one user-shaped variant before catalog promotion |
| prometheus-community/alertmanager@1.37.0 | works-with-operator-review | default | coverage partial<br>bases default;ha<br>variants 1, variants 2 | quirks extension-slots;tpl;storage<br>route P2: record storage prerequisite, retention, and runtime binding checks for supported targets: target-scoped storage support decision | live compare 1, live compare 2 | run catalog promotion review |
| falcosecurity/falco@9.0.0 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks existing-secret;extension-slots;required-values;lookup;tpl;capabilities;rbac;storage<br>route P0: model remote dependency closure in chart facts and source/dependency lock evidence: dependency closure facts plus refresh-survival check<br>quirk evidence 1: falco/charts/falco-talon/templates/_helpers.tpl, quirk evidence 2: falco/charts/falcosidekick/templates/_helpers.tpl, quirk evidence 3: falco/charts/falco-talon/templates/configmap-grafana-dashboard.yaml, quirk evidence 4: falco/charts/falco-talon/templates/configmap.yaml | live compare | add at least one user-shaped variant before catalog promotion |
| prometheus-community/prometheus-node-exporter@4.55.0 | works-with-target-prerequisites | default | coverage partial<br>bases cluster-metrics-readonly;default<br>variants 1, variants 2 | quirks existing-secret;extension-slots;required-values;generated-facts;tpl;capabilities;rbac<br>route P2: promote version-conditional rendering into chart facts and variant-path coverage: chart facts axis plus capability/version matrix row<br>quirk evidence 1: prometheus-node-exporter/templates/daemonset.yaml, quirk evidence 2: prometheus-node-exporter/templates/NOTES.txt | live compare 1, live compare 2 | run catalog promotion review |
| bitnami/spark@10.0.3 | not-ready-yet | legacy | coverage partial<br>bases default;ha;legacy<br>variants 1, variants 2, variants 3 | quirks generated-secrets;existing-secret;extension-slots;install-vs-upgrade-divergence;lookup;generated-facts;tpl;capabilities;storage | GitOps health default:resource-or-condition-residue;ha:resource-or-condition-residue<br>health residue 1, health residue 2, health residue 3<br>live compare 1, live compare 2, live compare 3 | review limitation before promotion: existing-secret (chart ships no Secret toggle) |
| elastic/logstash@8.5.1 | works-with-operator-review | default | coverage partial<br>bases default;ha<br>variants 1, variants 2 | quirks extension-slots;tpl;capabilities;storage | live compare 1, live compare 2 | run catalog promotion review |
| prometheus-community/prometheus-adapter@5.3.0 | works-with-operator-review | apiservice-v1-capability | coverage partial<br>bases apiservice-v1-capability;cluster-metrics-readonly;default<br>variants 1, variants 2, variants 3 | quirks extension-slots;tpl;capabilities;rbac | live compare 1, live compare 2, live compare 3 | Run ConfigHub proof, local live, live Helm-vs-ConfigHub parity, and the APIService runtime contract for the maintained apiservice-v1-capability base before catalog promotion. |
| projectcalico/tigera-operator@v3.32.0 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks hooks;required-values;lookup;rbac | live compare | add at least one user-shaped variant before catalog promotion |
| fairwinds-stable/goldilocks@10.3.0 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks crds;generated-secrets;existing-secret;webhooks;extension-slots;lookup;generated-facts;tpl;capabilities;rbac | live compare | add at least one user-shaped variant before catalog promotion |
| prometheus-community/prometheus-operator-crds@29.0.0 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks crds;existing-secret;generated-facts | live compare | add at least one user-shaped variant before catalog promotion |
| bitnami/zookeeper@13.8.7 | not-ready-yet | legacy | coverage partial<br>bases default;ha;legacy<br>variants 1, variants 2, variants 3 | quirks generated-secrets;existing-secret;extension-slots;install-vs-upgrade-divergence;lookup;generated-facts;tpl;capabilities;storage | GitOps health default:resource-or-condition-residue;ha:resource-or-condition-residue<br>health residue 1, health residue 2, health residue 3<br>live compare 1, live compare 2, live compare 3 | review limitation before promotion: existing-secret (chart ships no Secret toggle) |
| elastic/filebeat@8.5.1 | works-with-operator-review | default | coverage partial<br>bases default;node-or-cluster-collector<br>variants 1, variants 2 | quirks extension-slots;tpl;rbac | GitOps health default:resource-or-condition-residue;node-or-cluster-collector:resource-or-condition-residue<br>health residue 1, health residue 2, health residue 3<br>live compare 1, live compare 2 | run catalog promotion review |
| hashicorp/terraform@1.1.2 | works-with-operator-review | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;required-values | GitOps health default:resource-or-condition-residue;no-crds:resource-or-condition-residue<br>health residue 1, health residue 2, health residue 3<br>live compare 1, live compare 2 | run catalog promotion review |
| coredns/coredns@1.45.2 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks existing-secret;extension-slots;required-values;generated-facts;tpl;capabilities;rbac | live compare | add at least one user-shaped variant before catalog promotion |
| fairwinds-stable/vpa@4.11.0 | works-with-operator-review | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;webhooks;extension-slots;lookup;tpl;capabilities;rbac | live compare 1, live compare 2 | review APIService render-path notes: current maintained bases do not render APIService objects; create a separate APIService-enabled base only if product chooses that path |
| bitnami/phpmyadmin@20.0.0 | not-ready-yet | legacy | coverage partial<br>bases default;legacy<br>variants 1, variants 2 | quirks generated-secrets;existing-secret;extension-slots;install-vs-upgrade-divergence;required-values;lookup;generated-facts;tpl;capabilities;storage | GitOps health default:resource-or-condition-residue<br>health residue 1, health residue 2<br>live compare 1, live compare 2 | review limitation before promotion: existing-secret (chart ships no Secret toggle) |
| prometheus-community/prometheus-pushgateway@3.6.0 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks generated-secrets;extension-slots;required-values;tpl;storage | live compare | add at least one user-shaped variant before catalog promotion |
| fluent/fluentd@0.5.3 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks extension-slots;tpl;capabilities;rbac;storage | GitOps health default:resource-or-condition-residue<br>health residue 1, health residue 2<br>live compare | add at least one user-shaped variant before catalog promotion |
| jaegertracing/jaeger-operator@2.57.0 | works-with-operator-review | no-crds | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;webhooks;extension-slots | live compare 1, live compare 2 | run catalog promotion review |
| bitnami/memcached@8.5.5 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks generated-secrets;existing-secret;extension-slots;install-vs-upgrade-divergence;lookup;generated-facts;tpl;capabilities;storage | live compare | add at least one user-shaped variant before catalog promotion |
| strimzi/strimzi-kafka-operator@1.0.0 | works-with-operator-review | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;extension-slots;tpl;capabilities;rbac | live compare 1, live compare 2 | run catalog promotion review |
| opencost/opencost@2.5.21 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks extension-slots;required-values;tpl;capabilities;rbac;storage | GitOps health default:resource-or-condition-residue<br>health residue 1, health residue 2<br>live compare | add at least one user-shaped variant before catalog promotion |
| gatekeeper/gatekeeper@3.22.2 | works-with-target-prerequisites | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks hooks;crds;existing-secret;webhooks;extension-slots;capabilities;rbac | live compare 1, live compare 2 | run catalog promotion review |
| bitnami/contour@21.1.4 | not-ready-yet | legacy | coverage partial<br>bases default;legacy;no-crds<br>variants 1, variants 2, variants 3 | quirks crds;generated-secrets;existing-secret;extension-slots;install-vs-upgrade-divergence;lookup;generated-facts;tpl;capabilities;rbac | GitOps health default:sync-not-complete;legacy:sync-not-complete;no-crds:resource-or-condition-residue<br>health residue 1, health residue 2, health residue 3, health residue 4<br>live compare 1, live compare 2, live compare 3 | review limitation before promotion: existing-secret (chart ships no Secret toggle) |
| kyverno/kyverno-policies@3.8.0 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks extension-slots;required-values;lookup;tpl | GitOps health default:sync-not-complete<br>health residue 1, health residue 2<br>live compare | add at least one user-shaped variant before catalog promotion |
| elastic/metricbeat@8.5.1 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks extension-slots;tpl;capabilities;rbac;storage | GitOps health default:resource-or-condition-residue<br>health residue 1, health residue 2<br>live compare | add at least one user-shaped variant before catalog promotion |
| minio-operator/operator@7.1.1 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks crds;rbac | live compare | add at least one user-shaped variant before catalog promotion |
| percona/pxc-operator@1.19.1 | works-with-operator-review | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;extension-slots;install-vs-upgrade-divergence;lookup;rbac | live compare 1, live compare 2 | run catalog promotion review |
| bitnami/apache@11.4.29 | not-ready-yet | legacy | coverage partial<br>bases default;legacy<br>variants 1, variants 2 | quirks generated-secrets;existing-secret;extension-slots;install-vs-upgrade-divergence;lookup;generated-facts;tpl;capabilities | GitOps health default:resource-or-condition-residue;legacy:resource-or-condition-residue<br>health residue 1, health residue 2, health residue 3<br>live compare 1, live compare 2 | review limitation before promotion: existing-secret (chart ships no Secret toggle) |
| grafana/pyroscope@2.0.2 | not-ready-yet | default | coverage partial<br>bases default;ha;no-crds<br>variants 1, variants 2, variants 3 | quirks crds;generated-secrets;existing-secret;extension-slots;required-values;lookup;generated-facts;tpl;capabilities;rbac;storage | GitOps health default:resource-or-condition-residue;ha:resource-or-condition-residue;no-crds:resource-or-condition-residue<br>health residue 1, health residue 2, health residue 3, health residue 4<br>live compare 1, live compare 2, live compare 3 | review limitation before promotion: existing-secret (chart ships no Secret toggle) |
| aws-ebs-csi-driver/aws-ebs-csi-driver@2.60.1 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks extension-slots;required-values;tpl;capabilities;rbac | GitOps health default:resource-or-condition-residue<br>health residue 1, health residue 2<br>live compare | add at least one user-shaped variant before catalog promotion |
| falcosecurity/falcosidekick@0.13.1 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks existing-secret;extension-slots;required-values;capabilities;rbac;storage | live compare | add at least one user-shaped variant before catalog promotion |
| aqua/trivy-operator@0.32.1 | works-with-target-prerequisites | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;existing-secret;extension-slots | live compare 1, live compare 2 | run catalog promotion review |
| argo-cd/argo-events@2.4.21 | works-with-operator-review | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;extension-slots | live compare 1, live compare 2 | run catalog promotion review |
| argo-cd/argo-rollouts@2.40.9 | works-with-operator-review | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;extension-slots | live compare 1, live compare 2 | run catalog promotion review |
| argo-cd/argo-workflows@1.0.14 | works-with-operator-review | minimal-crds | coverage partial<br>bases controller-default-reviewed;default;minimal-crds<br>variants 1, variants 2, variants 3 | quirks extension-slots | live compare 1, live compare 2, live compare 3 | run catalog promotion review |
| argo-cd/argocd-image-updater@1.2.2 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks crds;existing-secret;extension-slots | live compare | add at least one user-shaped variant before catalog promotion |
| autoscaler/cluster-autoscaler@9.57.0 | works-with-operator-review | default | coverage partial<br>bases controller-default-reviewed;default<br>variants 1, variants 2 | quirks extension-slots | live compare 1, live compare 2 | run catalog promotion review |
| autoscaler/vertical-pod-autoscaler@0.9.0 | works-with-target-prerequisites | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;existing-secret;extension-slots | live compare 1, live compare 2 | run catalog promotion review |
| bitnami/opensearch@2.0.10 | works-with-target-prerequisites | legacy | coverage partial<br>bases default;ha;legacy<br>variants 1, variants 2, variants 3 | quirks existing-secret;extension-slots | GitOps health default:resource-or-condition-residue;ha:resource-or-condition-residue<br>health residue 1, health residue 2, health residue 3<br>live compare 1, live compare 2, live compare 3 | run catalog promotion review |
| crossplane-stable/crossplane@2.3.1 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks existing-secret;extension-slots | live compare | add at least one user-shaped variant before catalog promotion |
| grafana/promtail@6.17.1 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks existing-secret;extension-slots | live compare | add at least one user-shaped variant before catalog promotion |
| grafana/rollout-operator@0.49.0 | works-with-operator-review | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;extension-slots | live compare 1, live compare 2 | run catalog promotion review |
| haproxytech/kubernetes-ingress@1.52.0 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks existing-secret;extension-slots | live compare | add at least one user-shaped variant before catalog promotion |
| istio/gateway@1.30.0 | works-with-operator-review | default | coverage partial<br>bases controller-default-reviewed;default<br>variants 1, variants 2 | quirks none-flagged | GitOps health controller-default-reviewed:resource-or-condition-residue;default:resource-or-condition-residue<br>health residue 1, health residue 2, health residue 3<br>live compare 1, live compare 2 | run catalog promotion review |
| istio/istiod@1.30.0 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks existing-secret;extension-slots | GitOps health default:resource-or-condition-residue<br>health residue 1, health residue 2<br>live compare | add at least one user-shaped variant before catalog promotion |
| jetstack/cert-manager-csi-driver@v0.14.0 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks none-flagged | live compare | add at least one user-shaped variant before catalog promotion |
| jetstack/trust-manager@v0.22.1 | works-with-target-prerequisites | no-crds | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;existing-secret;extension-slots | GitOps health default:resource-or-condition-residue<br>health residue 1, health residue 2<br>live compare 1, live compare 2 | run catalog promotion review |
| linkerd/linkerd-crds@1.8.0 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks crds;existing-secret | GitOps health default:sync-not-complete<br>health residue 1, health residue 2<br>live compare | add at least one user-shaped variant before catalog promotion |
| minio-operator/tenant@7.1.1 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks existing-secret;extension-slots | GitOps health default:resource-or-condition-residue<br>health residue 1, health residue 2<br>live compare | add at least one user-shaped variant before catalog promotion |
| nats/nack@0.34.0 | works-with-target-prerequisites | no-crds | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;existing-secret;extension-slots | live compare 1, live compare 2 | run catalog promotion review |
| nats/surveyor@0.20.9 | works-with-operator-review | default | coverage partial<br>bases default;default-reviewed<br>variants 1, variants 2 | quirks extension-slots | GitOps health default-reviewed:resource-or-condition-residue;default:resource-or-condition-residue<br>health residue 1, health residue 2, health residue 3<br>live compare 1, live compare 2 | run catalog promotion review |
| open-telemetry/opentelemetry-operator@0.114.0 | works-with-target-prerequisites | no-crds | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;existing-secret;extension-slots | GitOps health default:resource-or-condition-residue<br>health residue 1, health residue 2<br>live compare 1, live compare 2 | run catalog promotion review |
| percona/pg-operator@3.0.0 | works-with-operator-review | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds | live compare 1, live compare 2 | run catalog promotion review |
| percona/psmdb-operator@1.22.0 | works-with-operator-review | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds | live compare 1, live compare 2 | run catalog promotion review |
| rook-release/rook-ceph@v1.19.5 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks crds | live compare | add at least one user-shaped variant before catalog promotion |
| rook-release/rook-ceph-cluster@v1.19.5 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks existing-secret;extension-slots | GitOps health default:resource-or-condition-residue<br>health residue 1, health residue 2<br>live compare | add at least one user-shaped variant before catalog promotion |
| sealed-secrets/sealed-secrets@2.18.6 | works-with-target-prerequisites | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;existing-secret;extension-slots | live compare 1, live compare 2 | run catalog promotion review |
| velero/velero@12.0.1 | works-with-target-prerequisites | default | coverage partial<br>bases default;no-crds<br>variants 1, variants 2 | quirks crds;existing-secret;extension-slots | live compare 1, live compare 2 | run catalog promotion review |
| vm/victoria-logs-single@0.12.5 | needs-better-base-variant | default | coverage partial<br>bases default<br>variants | quirks existing-secret;extension-slots | live compare | add at least one user-shaped variant before catalog promotion |
| vm/victoria-metrics-single@0.39.0 | works-with-operator-review | default | coverage partial<br>bases default;default-reviewed<br>variants 1, variants 2 | quirks extension-slots | live compare 1, live compare 2 | run catalog promotion review |