The top-20 catalog entries have local-test proof and accepted production disposition receipts. They are not production-supported until a target-scoped support decision is recorded.
A support decision names the exact base variant, target scope, delivery path, runtime expectations, accepted risks, and evidence refresh required for a production claim.
Required Decision Fields
| Field | Meaning |
|---|---|
| chart and version | The maintained chart entry. |
| supported base | The base variant that is in production scope. Other bases stay local-test or review-only unless separately approved. |
| target scope | Cluster type, namespace, GitOps controller, storage assumptions, CRD ownership, required Secrets, and other target prerequisites. |
| delivery path | ConfigHub OCI, Argo, Flux, direct apply, or another declared route. |
| scan decision | Findings fixed, accepted, blocked, or moved into a hardened base. |
| image decision | Digest-pinned images or an explicit exception for the supported scope. |
| lifecycle decision | Hooks, CRDs, webhooks, generated facts, controller-populated fields, and observation freshness policy. |
| live evidence | The receipt or command that refreshes live/e2e evidence for the selected scope. |
| support boundary | What the catalog promises, and what remains operator-owned. |
Current Queue
| Decision state | Charts |
|---|---|
| close-dispositions-first | 1 |
| lifecycle-support-scope-decision | 4 |
| resolve-images-before-production-oci | 10 |
| scope-decision-needed | 1 |
| security-acceptance-or-hardened-base | 4 |
Workstreams
The queue is easier to work by decision state. Each row below groups charts with the same remaining production-support decision.
| Workstream | Charts | Next action |
|---|---|---|
| Image digest resolution | 10 | Pin images by digest or record the explicit exception before claiming production OCI support.<br>argo-cd/argo-cd@9.5.15 (default)<br>bitnami/mysql@14.0.3 (static-passwords)<br>bitnami/rabbitmq@16.0.14 (static-passwords)<br>external-secrets/external-secrets@2.5.0 (default)<br>grafana/grafana@10.5.15 (existing-secret-ingress)<br>and 5 more |
| Lifecycle support boundary | 4 | Record which lifecycle behavior is supported, observed, excluded, or operator-owned.<br>bitnami/mongodb@19.0.7 (static-passwords)<br>bitnami/postgresql@18.6.7 (static-passwords)<br>bitnami/redis@25.5.3 (default)<br>ingress-nginx/ingress-nginx@4.15.1 (internal-clusterip) |
| Security acceptance or hardened base | 4 | Accept the current security findings for the target scope or create a hardened base variant.<br>longhorn/longhorn@1.11.2 (default)<br>prometheus-community/kube-prometheus-stack@85.3.3 (default)<br>prometheus-community/prometheus@29.8.0 (server-only-ephemeral)<br>secrets-store-csi-driver/secrets-store-csi-driver@1.6.0 (default) |
| Close open dispositions | 1 | Write or fix the missing disposition receipts before making a support decision.<br>jetstack/cert-manager@v1.20.2 (crds-enabled) |
| Scope decision | 1 | Write the missing target-scoped support boundary.<br>bitnami/nginx@24.0.2 (http-clusterip) |
| Chart | Candidate base | Base readiness | Decision state | Next action |
|---|---|---|---|---|
jetstack/cert-manager@v1.20.2 | crds-enabled | start-here | close-dispositions-first | write or fix the receipt for target fact preflight |
bitnami/mongodb@19.0.7 | static-passwords | render-only | lifecycle-support-scope-decision | choose whether static-passwords is in production scope; close or document its render-only live-readiness issue first |
bitnami/postgresql@18.6.7 | static-passwords | render-only | lifecycle-support-scope-decision | choose whether static-passwords is in production scope; close or document its render-only live-readiness issue first |
bitnami/redis@25.5.3 | default | render-only | lifecycle-support-scope-decision | choose whether default is in production scope; close or document its render-only live-readiness issue first |
ingress-nginx/ingress-nginx@4.15.1 | internal-clusterip | start-here | lifecycle-support-scope-decision | record the target-scoped lifecycle support decision, then refresh live/e2e evidence for that scope |
argo-cd/argo-cd@9.5.15 | default | start-here | resolve-images-before-production-oci | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
bitnami/mysql@14.0.3 | static-passwords | start-here | resolve-images-before-production-oci | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
bitnami/rabbitmq@16.0.14 | static-passwords | start-here | resolve-images-before-production-oci | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
external-secrets/external-secrets@2.5.0 | default | start-here | resolve-images-before-production-oci | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
grafana/grafana@10.5.15 | existing-secret-ingress | start-here | resolve-images-before-production-oci | resolve image digests for each affected variant before production OCI support |
grafana/loki@7.0.0 | single-binary-filesystem | start-here | resolve-images-before-production-oci | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
grafana/tempo@1.24.4 | local-persistent | start-here | resolve-images-before-production-oci | resolve image digests for each affected variant before production OCI support |
hashicorp/consul@2.0.0 | default-control-plane | start-here | resolve-images-before-production-oci | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
hashicorp/vault@0.32.0 | default | start-here | resolve-images-before-production-oci | resolve image digests for each affected variant before production OCI support |
metrics-server/metrics-server@3.13.0 | default | start-here | resolve-images-before-production-oci | image policy decision recorded for a target scope; create digest-pinned bases or overrides for stricter scopes |
bitnami/nginx@24.0.2 | http-clusterip | render-only | scope-decision-needed | choose whether http-clusterip is in production scope; close or document its render-only live-readiness issue first |
longhorn/longhorn@1.11.2 | default | start-here | security-acceptance-or-hardened-base | choose the supported production base, then record explicit security acceptance or create a hardened base before claiming production support |
prometheus-community/kube-prometheus-stack@85.3.3 | default | render-only | security-acceptance-or-hardened-base | choose the supported production base, then record explicit security acceptance or create a hardened base before claiming production support |
prometheus-community/prometheus@29.8.0 | server-only-ephemeral | render-only | security-acceptance-or-hardened-base | choose the supported production base, then record explicit security acceptance or create a hardened base before claiming production support |
secrets-store-csi-driver/secrets-store-csi-driver@1.6.0 | default | start-here | security-acceptance-or-hardened-base | choose the supported production base, then record explicit security acceptance or create a hardened base before claiming production support |
Rule
This file describes the contract. It does not create production support. A chart becomes production-supported only after its proposed decision artifact is written, reviewed, and backed by fresh evidence for the selected target scope.