This generated report records local live rows that passed only after explicit webhook serving certificate material was staged before apply. These rows prove a route for replacing hidden chart lifecycle side effects with declared target or generated facts. They do not claim production certificate management.
Snapshot
staged certificate routes: 8
passing observations: 8
routes with staged CRDs: 3Rows
| Chart | Base | Route | Staged Secret | Staged CRDs | Observation | Receipt |
|---|---|---|---|---|---|---|
ingress-nginx/ingress-nginx@4.15.1 | default | generated-fact-staged-secret | ingress-nginx/ingress-nginx-admission | 0 | observation | staging receipt |
fairwinds-stable/vpa@4.11.0 | default | generated-fact-staged-secret | default/vpa-tls-secret | 0 | observation | staging receipt |
fairwinds-stable/vpa@4.11.0 | no-crds | target-facts-staged-crds-and-secret | default/vpa-tls-secret | 2 | observation | staging receipt |
prometheus-community/kube-prometheus-stack@86.1.0 | default | generated-fact-staged-secret | monitoring/kube-prometheus-stack-admission | 0 | observation | staging receipt |
prometheus-community/kube-prometheus-stack@86.1.0 | no-crds | target-facts-staged-crds-and-secret | monitoring/kube-prometheus-stack-admission | 10 | observation | staging receipt |
prometheus-community/kube-prometheus-stack@85.3.3 | no-crds | target-facts-staged-crds-and-secret | monitoring/kube-prometheus-stack-admission | 10 | observation | staging receipt |
autoscaler/vertical-pod-autoscaler@0.9.0 | default | generated-fact-staged-secret | default/vpa-tls-certs | 0 | observation | staging receipt |
autoscaler/vertical-pod-autoscaler@0.9.0 | no-crds | generated-fact-staged-secret | default/vpa-tls-certs | 0 | observation | staging receipt |
What This Proves
The live Kubernetes workload can converge when the webhook serving certificate is represented as explicit prerequisite material instead of an implicit Helm hook or controller side effect. For no-CRDs bases, the route also proves the declared CRDs can be staged before applying the config-only rendered objects.
What This Does Not Prove
These receipts do not prove production CA trust, admission policy safety, certificate rotation, or long-term serving certificate management. Production support still needs a target-scoped decision for how the Secret is created, owned, rotated, and audited. No-CRDs rows also need a target-scoped CRD ownership and upgrade policy.
Machine-readable files:
data/webhook-cert-lifecycle/evidence.csv
data/webhook-cert-lifecycle/receipts/*.yamlRegenerate and verify:
npm run webhook-cert:lifecycle
npm run webhook-cert:lifecycle:verify