Status: working reference. Built from the actual bases of all 20 top-20 catalog charts, not invented.
The problem, in one table
Every chart today has exactly 2 bases (a default:true + one fork), but the names are ad-hoc. The same dimension is named many ways, so a user can't predict the menu:
- default role is named 6 ways:
default(×11),static-passwords(×5 secret charts),single-binary-filesystem(loki),http-clusterip(nginx),local-persistent(tempo),default-control-plane(consul). - existing-secret is named 5 ways across 7 charts:
reuse-existing-secret,existing-secret,existing-secret-replicaset,existing-secret-ingress,secure-mesh-existing-secrets. - ingress is named 3 ways:
ui-ingress,existing-tls-ingress,…-ingress. - no-crds vs crds: 3 charts ship
no-crds, cert-manager ships the inversecrds-enabled.
Canonical fork vocabulary (proposed)
| dimension | meaning | composes? |
|---|---|---|
default | honest OOTB base (role = default:true); zero placeholders where possible | - |
parameterized | same shape as default; fill-safe fields exposed as placeholders | - |
existing-secret | BYO secret instead of generated (the F3 fix-path) | yes |
ingress-tls | externally exposed via ingress (+ TLS) | yes |
ha | high-availability / scalable deployment mode | yes |
no-crds | CRDs owned externally (GitOps/controller) | yes |
minimal | lean: drop optional components / persistence | yes |
tls | BYO TLS material / CA | yes |
Forks compose (e.g. existing-secret + ingress-tls). The catalog should name a fork by its canonical dimension(s), not a bespoke string.
Current → canonical mapping (all 20)
| chart | default base (current) | fork (current) | → canonical |
|---|---|---|---|
| redis | default | reuse-existing-secret | existing-secret |
| postgresql | static-passwords | existing-secret | existing-secret |
| rabbitmq | static-passwords | existing-secret | existing-secret |
| mysql | static-passwords | existing-secret | existing-secret |
| mongodb | static-passwords | existing-secret-replicaset | existing-secret + ha |
| grafana | static-passwords | existing-secret-ingress | existing-secret + ingress-tls |
| consul | default-control-plane | secure-mesh-existing-secrets | existing-secret (+ mesh) |
| external-secrets | default | no-crds | no-crds ✓ |
| argo-cd | default | no-crds | no-crds ✓ |
| kube-prometheus-stack | default | no-crds | no-crds ✓ |
| cert-manager | default | crds-enabled | crds (inverse - default should be no-crds for GitOps) |
| longhorn | default | ui-ingress | ingress-tls |
| nginx | http-clusterip | existing-tls-ingress | ingress-tls (+ existing-secret for TLS) |
| metrics-server | default | external-tls-ca | tls |
| vault | default | ha-raft-ui | ha |
| loki | single-binary-filesystem | simple-scalable-minio | ha (scalable + object store) |
| tempo | local-persistent | s3-query-observability | ha (object store) |
| prometheus | default | server-only-ephemeral | minimal |
| ingress-nginx | default | admission-disabled | minimal |
| secrets-store-csi-driver | default | sync-secret-rotation | (chart feature: rotation) |
What the data shows
- No chart has a
parameterizedbase yet - the doctrine's explicit fill-surface is net-new across the catalog. - The catalog is under-forked: every chart has only 2 bases; the doctrine allows
default + parameterized + ≤4 forks. Most charts have obvious additional standard forks they don't yet ship (e.g. the secret charts could all offeringress-tlsandha). - Secret-chart defaults are the F3 hazard: all 5
static-passwordsdefaults are the silently-broken-over-GitOps case. Under the doctrine their honest default either declares the required secret fill or shipsexisting-secretas the recommended base.
Migration recommendation
- Adopt the canonical dimension names; keep bespoke shape names only as descriptive suffixes where they add meaning (e.g.
hafor vault, withraftan implementation detail, not the fork name). - Alias old names → canonical for one release so existing references don't break.
- Normalize the
defaultrole: the menu always presents thedefault:truebase as "default" regardless of its underlying descriptive name. - Flip cert-manager's default to
no-crds(GitOps-consistent), withcrdsas the fork.
Sources
The current top-20 package bases, Catalog Doctrine, and the generated status and outcome data under data/.