The top-20 catalog entries are supported for local-test. This file states exactly what must be closed before production support can be claimed.
The lifecycle columns separate retained source-hook evidence from recipe-level lifecycle policy and related CRD/webhook/controller observations.
Accepted disposition receipts recorded: 105
| Chart | Local-test variants | Production state | Accepted | Open | Source hooks | Lifecycle basis | Live/e2e receipts |
|---|---|---|---|---|---|---|---|
argo-cd/argo-cd@9.5.15 | default, no-crds | production-review-ready | 7 | 0 | 0 | recipe-hook-policy:no-hooks | 5 |
bitnami/mongodb@19.0.7 | static-passwords, existing-secret-replicaset | production-review-ready | 6 | 0 | 0 | recipe-hook-policy:no-hooks | 8 |
bitnami/mysql@14.0.3 | static-passwords, existing-secret | production-review-ready | 5 | 0 | 0 | recipe-hook-policy:no-hooks | 2 |
bitnami/nginx@24.0.2 | http-clusterip, existing-tls-ingress | production-review-ready | 4 | 0 | 0 | none | 8 |
bitnami/postgresql@18.6.7 | static-passwords, existing-secret | production-review-ready | 5 | 0 | 0 | recipe-hook-policy:no-hooks | 8 |
bitnami/rabbitmq@16.0.14 | static-passwords, existing-secret | production-review-ready | 5 | 0 | 0 | recipe-hook-policy:no-hooks | 2 |
bitnami/redis@25.5.3 | default, reuse-existing-secret | production-review-ready | 4 | 0 | 0 | recipe-hook-policy:no-hooks | 5 |
external-secrets/external-secrets@2.5.0 | default, no-crds | production-review-ready | 6 | 0 | 0 | lifecycle-observations:2/2 | 2 |
grafana/grafana@10.5.15 | static-passwords, existing-secret-ingress | production-review-ready | 5 | 0 | 0 | none | 2 |
grafana/loki@7.0.0 | single-binary-filesystem, simple-scalable-minio | production-review-ready | 5 | 0 | 0 | recipe-lifecycle-policy | 2 |
grafana/tempo@1.24.4 | local-persistent, s3-query-observability | production-review-ready | 4 | 0 | 0 | none | 2 |
hashicorp/consul@2.0.0 | default-control-plane, secure-mesh-existing-secrets | production-review-ready | 8 | 0 | 0 | recipe-lifecycle-policy | 2 |
hashicorp/vault@0.32.0 | dev-mode, default, ha-raft-ui | production-review-ready | 6 | 0 | 0 | none | 3 |
ingress-nginx/ingress-nginx@4.15.1 | default, admission-disabled, internal-clusterip | production-review-ready | 5 | 0 | 0 | recipe-hook-policy:no-hooks | 3 |
jetstack/cert-manager@v1.20.2 | default, crds-enabled | production-blocked | 6 | 1 | 0 | recipe-hook-policy:no-hooks; lifecycle-observations:2/2 | 2 |
longhorn/longhorn@1.11.2 | default, ui-ingress | production-review-ready | 5 | 0 | 0 | recipe-hook-policy:no-hooks | 2 |
metrics-server/metrics-server@3.13.0 | default, external-tls-ca | production-review-ready | 5 | 0 | 0 | recipe-hook-policy:no-hooks | 2 |
prometheus-community/kube-prometheus-stack@85.3.3 | default, no-crds | production-review-ready | 7 | 0 | 2 | source-hooks:2 | 5 |
prometheus-community/prometheus@29.8.0 | default, server-only-ephemeral | production-review-ready | 3 | 0 | 0 | none | 5 |
secrets-store-csi-driver/secrets-store-csi-driver@1.6.0 | default, sync-secret-rotation | production-review-ready | 4 | 0 | 0 | none | 2 |
Closest Rows
These rows have accepted production-disposition receipts or three or fewer open dispositions. They are the clearest next production-review work queue. The same queue is available as next-actions.csv.
| Chart | Accepted | Open | Open dispositions | Next receipt | External scan reading |
|---|---|---|---|---|---|
hashicorp/consul@2.0.0 | 8 | 0 | - | default-control-plane: warn, 5 finding(s) (liveness-port:1;readiness-port:1;startup-port:1;unset-cpu-requirements:1;unset-memory-requirements:1); secure-mesh-existing-secrets: warn, 6 finding(s) (job-ttl-seconds-after-finished:1;liveness-port:1;readiness-port:1;startup-port:1;unset-cpu-requirements:1) | |
argo-cd/argo-cd@9.5.15 | 7 | 0 | - | default: warn, 18 finding(s) (unset-cpu-requirements:9;unset-memory-requirements:9); no-crds: warn, 18 finding(s) (unset-cpu-requirements:9;unset-memory-requirements:9) | |
prometheus-community/kube-prometheus-stack@85.3.3 | 7 | 0 | - | default: warn, 27 finding(s) (dangling-service:7;unset-cpu-requirements:6;unset-memory-requirements:6;no-read-only-root-fs:3;sensitive-host-mounts:3); no-crds: warn, 27 finding(s) (dangling-service:7;unset-cpu-requirements:6;unset-memory-requirements:6;no-read-only-root-fs:3;sensitive-host-mounts:3) | |
bitnami/mongodb@19.0.7 | 6 | 0 | - | existing-secret-replicaset: warn, 2 finding(s) (pdb-unhealthy-pod-eviction-policy:2); static-passwords: warn, 1 finding(s) (pdb-unhealthy-pod-eviction-policy:1) | |
external-secrets/external-secrets@2.5.0 | 6 | 0 | - | default: warn, 6 finding(s) (unset-cpu-requirements:3;unset-memory-requirements:3); no-crds: warn, 6 finding(s) (unset-cpu-requirements:3;unset-memory-requirements:3) | |
hashicorp/vault@0.32.0 | 6 | 0 | - | default: warn, 9 finding(s) (no-read-only-root-fs:2;unset-cpu-requirements:2;unset-memory-requirements:2;liveness-port:1;readiness-port:1); dev-mode: warn, 9 finding(s) (no-read-only-root-fs:2;unset-cpu-requirements:2;unset-memory-requirements:2;liveness-port:1;readiness-port:1); ha-raft-ui: warn, 12 finding(s) (dangling-service:2;no-read-only-root-fs:2;unset-cpu-requirements:2;unset-memory-requirements:2;liveness-port:1) | |
bitnami/mysql@14.0.3 | 5 | 0 | - | existing-secret: warn, 1 finding(s) (pdb-unhealthy-pod-eviction-policy:1); static-passwords: warn, 1 finding(s) (pdb-unhealthy-pod-eviction-policy:1) | |
bitnami/postgresql@18.6.7 | 5 | 0 | - | existing-secret: warn, 1 finding(s) (pdb-unhealthy-pod-eviction-policy:1); static-passwords: warn, 1 finding(s) (pdb-unhealthy-pod-eviction-policy:1) | |
bitnami/rabbitmq@16.0.14 | 5 | 0 | - | existing-secret: warn, 1 finding(s) (pdb-unhealthy-pod-eviction-policy:1); static-passwords: warn, 1 finding(s) (pdb-unhealthy-pod-eviction-policy:1) | |
grafana/grafana@10.5.15 | 5 | 0 | - | existing-secret-ingress: warn, 3 finding(s) (no-read-only-root-fs:1;unset-cpu-requirements:1;unset-memory-requirements:1); static-passwords: warn, 3 finding(s) (no-read-only-root-fs:1;unset-cpu-requirements:1;unset-memory-requirements:1) | |
grafana/loki@7.0.0 | 5 | 0 | - | simple-scalable-minio: warn, 18 finding(s) (unset-memory-requirements:9;unset-cpu-requirements:8;no-read-only-root-fs:1); single-binary-filesystem: warn, 12 finding(s) (unset-cpu-requirements:6;unset-memory-requirements:6) | |
ingress-nginx/ingress-nginx@4.15.1 | 5 | 0 | - | admission-disabled: warn, 4 finding(s) (liveness-port:1;no-read-only-root-fs:1;readiness-port:1;unset-memory-requirements:1); default: warn, 4 finding(s) (liveness-port:1;no-read-only-root-fs:1;readiness-port:1;unset-memory-requirements:1); internal-clusterip: warn, 4 finding(s) (liveness-port:1;no-read-only-root-fs:1;readiness-port:1;unset-memory-requirements:1) | |
longhorn/longhorn@1.11.2 | 5 | 0 | - | default: warn, 24 finding(s) (no-read-only-root-fs:5;run-as-non-root:5;unset-cpu-requirements:5;unset-memory-requirements:5;dangling-service:2); ui-ingress: warn, 24 finding(s) (no-read-only-root-fs:5;run-as-non-root:5;unset-cpu-requirements:5;unset-memory-requirements:5;dangling-service:2) | |
metrics-server/metrics-server@3.13.0 | 5 | 0 | - | default: warn, 1 finding(s) (unset-memory-requirements:1); external-tls-ca: warn, 1 finding(s) (unset-memory-requirements:1) | |
bitnami/nginx@24.0.2 | 4 | 0 | - | existing-tls-ingress: warn, 1 finding(s) (pdb-unhealthy-pod-eviction-policy:1); http-clusterip: warn, 1 finding(s) (pdb-unhealthy-pod-eviction-policy:1) | |
bitnami/redis@25.5.3 | 4 | 0 | - | default: warn, 2 finding(s) (pdb-unhealthy-pod-eviction-policy:2); reuse-existing-secret: warn, 2 finding(s) (pdb-unhealthy-pod-eviction-policy:2) | |
grafana/tempo@1.24.4 | 4 | 0 | - | local-persistent: warn, 3 finding(s) (no-read-only-root-fs:1;unset-cpu-requirements:1;unset-memory-requirements:1); s3-query-observability: warn, 6 finding(s) (no-read-only-root-fs:2;unset-cpu-requirements:2;unset-memory-requirements:2) | |
secrets-store-csi-driver/secrets-store-csi-driver@1.6.0 | 4 | 0 | - | default: warn, 8 finding(s) (no-read-only-root-fs:3;run-as-non-root:3;privilege-escalation-container:1;privileged-container:1); sync-secret-rotation: warn, 8 finding(s) (no-read-only-root-fs:3;run-as-non-root:3;privilege-escalation-container:1;privileged-container:1) | |
prometheus-community/prometheus@29.8.0 | 3 | 0 | - | default: warn, 21 finding(s) (unset-cpu-requirements:6;unset-memory-requirements:6;no-read-only-root-fs:4;sensitive-host-mounts:3;host-network:1); server-only-ephemeral: warn, 6 finding(s) (no-read-only-root-fs:2;unset-cpu-requirements:2;unset-memory-requirements:2) | |
jetstack/cert-manager@v1.20.2 | 6 | 1 | target fact preflight | data/production-disposition/receipts/jetstack-cert-manager/target-fact-preflight.yaml | crds-enabled: warn, 6 finding(s) (unset-cpu-requirements:3;unset-memory-requirements:3); default: warn, 6 finding(s) (unset-cpu-requirements:3;unset-memory-requirements:3) |
Production Decision Queue
These rows are ready for a target-scoped production support decision, not already production-supported. The queue separates the first base a user should try from production evidence still needed for image pinning, scan acceptance, runtime fit, and final support scope.
| Chart | First base | Base readiness | Decision focus | Image subjects needing resolution | Next action |
|---|---|---|---|---|---|
argo-cd/argo-cd@9.5.15 | default | start-here | image-digest-resolution | 2 | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
bitnami/mongodb@19.0.7 | static-passwords | render-only | runtime-or-prerequisite-scope | 0 | choose whether static-passwords is in production scope; close or document its render-only live-readiness issue first |
bitnami/mysql@14.0.3 | static-passwords | start-here | image-digest-resolution | 2 | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
bitnami/nginx@24.0.2 | http-clusterip | render-only | runtime-or-prerequisite-scope | 0 | choose whether http-clusterip is in production scope; close or document its render-only live-readiness issue first |
bitnami/postgresql@18.6.7 | static-passwords | render-only | runtime-or-prerequisite-scope | 0 | choose whether static-passwords is in production scope; close or document its render-only live-readiness issue first |
bitnami/rabbitmq@16.0.14 | static-passwords | start-here | image-digest-resolution | 2 | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
bitnami/redis@25.5.3 | default | render-only | runtime-or-prerequisite-scope | 0 | choose whether default is in production scope; close or document its render-only live-readiness issue first |
external-secrets/external-secrets@2.5.0 | default | start-here | image-digest-resolution | 2 | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
grafana/grafana@10.5.15 | existing-secret-ingress | start-here | image-digest-resolution | 2 | resolve image digests for each affected variant before production OCI support |
grafana/loki@7.0.0 | single-binary-filesystem | start-here | image-digest-resolution | 2 | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
grafana/tempo@1.24.4 | local-persistent | start-here | image-digest-resolution | 2 | resolve image digests for each affected variant before production OCI support |
hashicorp/consul@2.0.0 | default-control-plane | start-here | image-digest-resolution | 2 | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
hashicorp/vault@0.32.0 | default | start-here | image-digest-resolution | 3 | resolve image digests for each affected variant before production OCI support |
ingress-nginx/ingress-nginx@4.15.1 | internal-clusterip | start-here | lifecycle-support-scope | 0 | record the target-scoped lifecycle support decision, then refresh live/e2e evidence for that scope |
jetstack/cert-manager@v1.20.2 | crds-enabled | start-here | missing-disposition | 2 | write or fix the receipt for target fact preflight |
longhorn/longhorn@1.11.2 | default | start-here | security-acceptance-or-hardened-base | 2 | choose the supported production base, then record explicit security acceptance or create a hardened base before claiming production support |
metrics-server/metrics-server@3.13.0 | default | start-here | image-digest-resolution | 2 | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
prometheus-community/kube-prometheus-stack@85.3.3 | default | render-only | security-acceptance-or-hardened-base | 2 | choose the supported production base, then record explicit security acceptance or create a hardened base before claiming production support |
prometheus-community/prometheus@29.8.0 | server-only-ephemeral | render-only | security-acceptance-or-hardened-base | 2 | choose the supported production base, then record explicit security acceptance or create a hardened base before claiming production support |
secrets-store-csi-driver/secrets-store-csi-driver@1.6.0 | default | start-here | security-acceptance-or-hardened-base | 2 | choose the supported production base, then record explicit security acceptance or create a hardened base before claiming production support |
Standard Disposition Types
CRD lifecycle and upgrade policy
- owner: catalog-review
- required evidence: CRD ownership decision; upgrade ordering; rollback/deprecation policy
- unblock rule: supported only when CRD ownership and upgrade behavior are explicit
webhook readiness and failure policy
- owner: catalog-review
- required evidence: webhook deployment readiness; failurePolicy review; certificate/bootstrap handling
- unblock rule: supported only when webhook failure modes are known before apply
cluster RBAC review
- owner: security-review
- required evidence: cluster-scoped RBAC inventory; least-privilege disposition; operator acceptance
- unblock rule: supported only after cluster-scoped permissions have an explicit disposition
storage backup restore and rollback policy
- owner: operate-review
- required evidence: PVC/storage class assumptions; backup/restore path; rollback constraints
- unblock rule: supported only when stateful rollback is not hand-waved
generated fact ownership
- owner: catalog-review
- required evidence: generated secret/cert inventory; persistence or target binding; rotation policy
- unblock rule: supported only when generated material is captured or deliberately externalized
target fact preflight
- owner: installer-review
- required evidence: installer externalRequires/facts; preflight command or documented block; freshness expectation
- unblock rule: supported only when required target facts are checkable before apply
hook and lifecycle phase policy
- owner: catalog-review
- required evidence: hook inventory; phase mapping; unsupported hook blockers
- unblock rule: supported only when hooks are mapped to lifecycle policy or intentionally excluded
extension slot provenance and scan policy
- owner: catalog-review
- required evidence: tpl/raw value inventory; allowed extension slots; scan coverage for rendered additions
- unblock rule: supported only when extensions are explicit and scanned after render
scan/gate warning disposition
- owner: security-review
- required evidence: local scan receipt; external scan receipt; waiver or fix decision
- unblock rule: supported only when warnings are accepted, fixed, or variant-blocking
Rule
A chart becomes production-review-ready when each required disposition is accepted, fixed, or turned into an explicit variant blocker, and the result is backed by rendered-digest-bound scan and live/e2e receipts. Production support still requires a separate target-scoped support decision.