prometheus-community/kube-prometheus-stack@85.3.3 Production Support Workdown

This generated page is a human workdown for one target-scoped production support decision. It does not replace the source decision artifact:

support-decision.yaml

Current Decision

Open Work

Closeout Sequence

1. Keep the target-scoped evidence fresh for the declared support boundary.

Required Before Final Support

• None.

Support Boundary

Included:

• prometheus-community/kube-prometheus-stack@85.3.3 default base
• ConfigHub OCI delivery through Argo for the declared cub-lk vanilla kind target scope
• rendered objects, labels, gates, receipts, and support objects produced by the recorded base
• declared target-fact preflight for the Prometheus Operator admission webhook TLS Secret
• recorded mutable-image exception for the declared public monitoring support scope
• recorded scan and lifecycle decisions for the declared public monitoring support scope

Excluded:

• private values overlays, wrapper charts, and populated extension slots unless separately reviewed
• digest-pinned or hardened production bases unless separately reviewed
• non-vanilla Kubernetes distributions unless separately reviewed
• other delivery controllers or target scopes unless separately reviewed

Evidence

• recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/default/r001/receipts/helm-equivalence-receipt.yaml - The candidate base is Helm-equivalent under recorded inputs.
• recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/default/r001/receipts/scan-receipt.yaml - The rendered-object scan receipt exists for the candidate base.
• runs/live-helm-confighub-compare/prometheus-community-kube-prometheus-stack-default/receipt.yaml - The selected live Helm-vs-ConfigHub comparison receipt exists for the candidate base.
• data/production-support-decisions/prometheus-community-kube-prometheus-stack/fresh-target-evidence-2026-06-09.yaml - Fresh target-scoped ConfigHub OCI and Argo evidence passed for the declared cub-lk vanilla kind support scope.
• data/image-digest-workdown/receipts/prometheus-community-kube-prometheus-stack/default/image-digest-resolution.yaml - The rendered mutable image references for the candidate base have registry digest-resolution evidence.
• data/production-support-decisions/prometheus-community-kube-prometheus-stack/image-policy-decision.yaml - The target-scoped image policy decision accepts mutable rendered tags for this public monitoring support draft with explicit limits.
• data/production-support-decisions/prometheus-community-kube-prometheus-stack/security-decision.yaml - The target-scoped production security decision accepts the recorded scan findings for this public monitoring support draft.
• data/production-support-decisions/prometheus-community-kube-prometheus-stack/lifecycle-decision.yaml - The target-scoped lifecycle decision binds the selected hook route to proof-scope observation evidence.
• data/production-disposition/receipts/prometheus-community-kube-prometheus-stack/cluster-rbac-review.yaml - The cluster rbac review receipt exists for this chart.
• data/production-disposition/receipts/prometheus-community-kube-prometheus-stack/crd-lifecycle-and-upgrade-policy.yaml - The crd lifecycle and upgrade policy receipt exists for this chart.
• data/production-disposition/receipts/prometheus-community-kube-prometheus-stack/extension-slot-provenance-and-scan-policy.yaml - The extension slot provenance and scan policy receipt exists for this chart.
• data/production-disposition/receipts/prometheus-community-kube-prometheus-stack/generated-fact-ownership.yaml - The generated fact ownership receipt exists for this chart.
• data/production-disposition/receipts/prometheus-community-kube-prometheus-stack/scan-gate-warning-disposition.yaml - The scan gate warning disposition receipt exists for this chart.
• data/production-disposition/receipts/prometheus-community-kube-prometheus-stack/target-fact-preflight.yaml - The target fact preflight receipt exists for this chart.
• data/production-disposition/receipts/prometheus-community-kube-prometheus-stack/webhook-readiness-and-failure-policy.yaml - The webhook readiness and failure policy receipt exists for this chart.
• data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/default/latest.yaml - The hook lifecycle route is selected; the lifecycle decision binds it to proof-scope observation evidence.

Next Action

Keep the target-scoped evidence fresh before using this supported scope as a production-support example.

Regenerate:

npm run production:support-decisions
npm run production:support-decisions:verify