This generated report separates two related but different claims:
Helm hook lifecycle support: hook-bearing charts need a selected route and a
receipt before production support.
Hook-like lifecycle observation: some charts have Helm hook, controller, CRD,
webhook, or runtime behavior that rendered YAML cannot prove through render
parity alone.The distinction matters because passing cert-manager and External Secrets lifecycle observations do not mean every Helm hook is solved. Cert-manager proves a chart-specific route for its known startup API check hook. External Secrets proves controller-owned webhook behavior in bases that do not use a Helm hook.
Current Reading
maintained hook queue rows: 5
hook route receipts present: 5/5
hook lifecycle observations present: 5/5
hook partial lifecycle observations: 0/5
hook routes awaiting observation: 0/5
hook rows still needing route receipt: 0/5
hook-like lifecycle observations passing: 4/4
selected candidate routes observed: 4/4Rows
| Lane | Chart | Base | Status | Route or policy | What it proves | What it does not prove |
|---|---|---|---|---|---|---|
| helm-hook-lifecycle-queue | prometheus-community/kube-prometheus-stack@85.3.3 | default | lifecycle-observed | preflight-or-presync;postsync-check-or-observation;upgrade-action-with-receipt;preserve-ordering;preserve-cleanup-policy;webhook-readiness-observation;target-facts-or-preflight | hook route has a lifecycle observation or execution receipt | universal Helm hook support or support for unrelated hook-bearing charts |
| helm-hook-lifecycle-queue | kyverno/kyverno@3.8.1 | default | lifecycle-observed | upgrade-action-with-receipt;delete-cleanup-policy;explicit-test-check;preserve-ordering;preserve-cleanup-policy;target-facts-or-preflight | hook route has a lifecycle observation or execution receipt | universal Helm hook support or support for unrelated hook-bearing charts |
| helm-hook-lifecycle-queue | fluent/fluent-bit@0.57.6 | default | lifecycle-observed | explicit-test-check;preserve-cleanup-policy | hook route has a lifecycle observation or execution receipt | universal Helm hook support or support for unrelated hook-bearing charts |
| helm-hook-lifecycle-queue | projectcalico/tigera-operator@v3.32.0 | default | lifecycle-observed | delete-cleanup-policy;preserve-ordering;preserve-cleanup-policy;target-facts-or-preflight | hook route has a lifecycle observation or execution receipt | universal Helm hook support or support for unrelated hook-bearing charts |
| helm-hook-lifecycle-queue | gatekeeper/gatekeeper@3.22.2 | default | lifecycle-observed | preflight-or-presync;upgrade-action-with-receipt;preserve-ordering;preserve-cleanup-policy;webhook-readiness-observation | hook route has a lifecycle observation or execution receipt | universal Helm hook support or support for unrelated hook-bearing charts |
| hook-like-lifecycle-observation | jetstack/cert-manager@v1.20.2 | default | pass | startupapicheck-becomes-post-apply-api-dry-run | CRD ownership policy, startup API readiness route, webhook CA bundle injection, and server dry-run | universal Helm hook support or support for unrelated hook-bearing charts |
| hook-like-lifecycle-observation | jetstack/cert-manager@v1.20.2 | crds-enabled | pass | startupapicheck-becomes-post-apply-api-dry-run | CRD ownership policy, startup API readiness route, webhook CA bundle injection, and server dry-run | universal Helm hook support or support for unrelated hook-bearing charts |
| hook-like-lifecycle-observation | external-secrets/external-secrets@2.5.0 | default | pass | no-helm-hook | CRD ownership policy, webhook CA bundle injection, controller-populated webhook Secret data, and server dry-run | universal Helm hook support or support for unrelated hook-bearing charts |
| hook-like-lifecycle-observation | external-secrets/external-secrets@2.5.0 | no-crds | pass | no-helm-hook | CRD ownership policy, webhook CA bundle injection, controller-populated webhook Secret data, and server dry-run | universal Helm hook support or support for unrelated hook-bearing charts |
| selected-hook-route | argo-cd/argo-workflows@1.0.14 | default | lifecycle-observed | The package carries the eight full upstream CRD files and applies them server-side with forced conflict resolution before the ordinary rendered objects. | selected hook candidate route has runtime observation for this base | the same route for other bases, upgrade behavior outside the observed run, production support |
| selected-hook-route | argo-cd/argo-workflows@1.0.14 | minimal-crds | lifecycle-observed | The install-critical full-CRD Helm hook is avoided for this base by rendering minimal CRDs as ordinary desired objects with crds.full=false. | selected hook candidate route has runtime observation for this base | the same route for other bases, the upstream Helm-hook path, upgrade behavior outside the observed run, production support |
| selected-hook-route | bitnami/contour@21.1.4 | legacy | lifecycle-observed | The package runs Contour's certificate-generation Job before applying the ordinary rendered objects, then checks the two TLS Secrets and removes the temporary Job and RBAC. | selected hook candidate route has runtime observation for this base | the same route for other bases, upgrade behavior outside the observed run, production support |
| selected-hook-route | kedacore/keda@2.19.0 | no-crds | lifecycle-observed | KEDA creates its own webhook certificate Secret after the operator starts, so delivery must wait for that handoff before judging the remaining pods. | selected hook candidate route has runtime observation for this base | the same route for other bases, the upstream Helm-hook path, upgrade behavior outside the observed run, production support |
Files
| File | Purpose |
|---|---|
data/lifecycle-boundary/lifecycle-boundary.csv | One row per hook queue item or lifecycle observation row. |
data/hook-lifecycle/source-top100-hooks.csv | Source-scan inventory of top-100 public charts where the retained source scan found Helm hooks. |
data/hook-lifecycle/maintained-hook-queue.csv | Maintained hook queue rows that need route, execution, or observation receipts. |
data/lifecycle-observations/cert-manager-eso/summary.csv | Current cert-manager and External Secrets lifecycle observations. |
data/lifecycle-boundary/selected-routes.csv | Base-specific selected routes promoted from hook route candidates. |
data/hook-route-candidates/selected-routes/*.yaml | Receipt files for selected candidate routes. |
Regenerate:
npm run lifecycle:boundary
npm run lifecycle:boundary:verify