This generated report answers the NGINX-style question:
Which charts expose powerful Helm inputs such as raw manifests, tpl snippets,
extra config blocks, sidecars, or chart-specific config file slots?Extension slots are useful, but they are not ordinary safe defaults. If a user populates one, the result should be treated as a reviewed install shape with its own render parity, scans, gates, and receipts.
Headline
top-20 catalog charts with explicit extension-slot control points: 13/20
top-20 catalog charts without extension slots in chart facts: 7/20
top-100 chart facts with extension slots surfaced: 82/100
matched top-500 proof rows with extension-slot control points: 53
top-500 source rows using tpl: 362/500
top-500 source rows with raw/extra manifest values: 254/500
top-500 source rows using tpl or raw/extra manifest values: 363/500The top-500 tpl and raw/extra manifest counts are broader than the explicit control-point count. They are source-scan signals that a chart may have template-powered or arbitrary object injection inputs. The explicit control-point count is narrower: it only covers rows already matched to current recipe/package proof artifacts.
Top-20 Catalog Charts
| Chart | Built variants | Example surfaces | Control point |
|---|---|---|---|
argo-cd/argo-cd@9.5.15 | default+no-crds | raw/extra manifests; tpl-powered values | tpl:controlled-by-empty-defaults |
bitnami/mongodb@19.0.7 | existing-secret-replicaset+static-passwords | tpl-powered values | tpl:controlled-by-empty-defaults |
bitnami/nginx@24.0.2 | existing-tls-ingress+http-clusterip | NGINX config blocks; raw/extra manifests; sidecars | extension-slots:controlled-by-empty-defaults |
external-secrets/external-secrets@2.5.0 | default+no-crds | raw/extra manifests; tpl-powered values | tpl:controlled-by-empty-defaults |
grafana/grafana@10.5.15 | existing-secret-ingress+static-passwords | sidecars; monitoring config; Secret/env injection | extension-slots:controlled-by-empty-defaults |
grafana/loki@7.0.0 | simple-scalable-minio+single-binary-filesystem | raw/extra manifests; Secret/env injection; tpl-powered values | tpl:controlled-by-empty-defaults |
grafana/tempo@1.24.4 | local-persistent+s3-query-observability | volumes/mounts; tpl-powered values | extension-slots:controlled-by-empty-defaults |
hashicorp/consul@2.0.0 | default-control-plane+secure-mesh-existing-secrets | controller/gateway config; tpl-powered values | extension-slots:controlled-by-empty-defaults |
hashicorp/vault@0.32.0 | default+dev-mode+ha-raft-ui | sidecars; volumes/mounts; Secret/env injection | extension-slots:controlled-by-empty-defaults |
jetstack/cert-manager@v1.20.2 | crds-enabled+default | raw/extra manifests; tpl-powered values | tpl:controlled-by-empty-defaults |
prometheus-community/kube-prometheus-stack@85.3.3 | default+no-crds | raw/extra manifests; monitoring config; tpl-powered values | tpl:controlled-by-empty-defaults |
prometheus-community/prometheus@29.8.0 | default+server-only-ephemeral | raw/extra manifests; monitoring config | extension-slots:controlled-by-empty-defaults |
secrets-store-csi-driver/secrets-store-csi-driver@1.6.0 | default+sync-secret-rotation | chart-specific tpl/raw/config slots | extension-slots:controlled-by-empty-defaults |
Top-20 Charts Without Extension Slots
These charts still have normal Helm choices and production review work. They do not currently expose NGINX-like raw manifest, tpl snippet, config block, sidecar, or add-on slots in the chart facts.
| Chart | Built variants | Current hard gap | Route |
|---|---|---|---|
bitnami/mysql@14.0.3 | static-passwords+existing-secret | ha (curated proof lane - bespoke teaching needed) | use the supported base; route Helm-input changes through a reviewed cub installer base and post-render changes through cub variant create |
bitnami/postgresql@18.6.7 | static-passwords+existing-secret | ha (curated proof lane - bespoke teaching needed) | use the supported base; route Helm-input changes through a reviewed cub installer base and post-render changes through cub variant create |
bitnami/rabbitmq@16.0.14 | static-passwords+existing-secret | ha (curated proof lane - bespoke teaching needed) | use the supported base; route Helm-input changes through a reviewed cub installer base and post-render changes through cub variant create |
bitnami/redis@25.5.3 | default+reuse-existing-secret | - | use the supported base; route Helm-input changes through a reviewed cub installer base and post-render changes through cub variant create |
ingress-nginx/ingress-nginx@4.15.1 | default+admission-disabled+internal-clusterip | - | use the supported base; route Helm-input changes through a reviewed cub installer base and post-render changes through cub variant create |
longhorn/longhorn@1.11.2 | default+ui-ingress | - | use the supported base; route Helm-input changes through a reviewed cub installer base and post-render changes through cub variant create |
metrics-server/metrics-server@3.13.0 | default+external-tls-ca | existing-secret (chart ships no Secret toggle) | use the supported base; route Helm-input changes through a reviewed cub installer base and post-render changes through cub variant create |
How To Use This
| User change | Route |
|---|---|
| Leave the extension slot empty or disabled. | Use the supported catalog base. |
Fill serverBlock, extraDeploy, raw manifests, sidecars, scrape configs, or similar values. | Create a new reviewed cub installer base variant and rerun render parity, scans, gates, and receipts. |
| Change target, region, labels, approval policy, observation policy, or other ConfigHub metadata after render. | Use a derived ConfigHub variant with cub variant create. |
NGINX is the clearest concrete example. Its supported bases keep serverBlock, streamServerBlock, extraDeploy, cloneStaticSiteFromGit, metrics, and sidecar slots empty or disabled. See NGINX Configuration Files.
Files
| File | Purpose |
|---|---|
data/extension-slots/extension-slots.csv | One row per top-100 chart where chart facts surface extension slots. |
data/quirk-coverage/summary.md | Quirk-axis coverage summary, including broader top-500 counts. |
data/outcome-coverage/feature-outcomes.csv | One row per chart feature, including extension-slot status. |
Regenerate:
npm run extension-slots
npm run extension-slots:verify