Redis Reuse Existing Secret Variant Spec

This slice proves the first easy variant path after default.

The variant is named reuse-existing-secret.

Purpose:

Move Redis credential ownership out of Helm-generated Secret output and into
an explicit target secret requirement.

Helm Values

The variant must set:

auth:
  existingSecret: redis-existing-secret
  existingSecretPasswordKey: redis-password

It must not set or store auth.password.

Required Files

recipes/bitnami/redis/25.5.3/
  effective-values-reuse-existing-secret.yaml
  variants/reuse-existing-secret/variant.yaml
  revisions/reuse-existing-secret/r001/
    variant-revision.yaml
    rendered/release-objects.yaml
    rendered/object-inventory.yaml
    receipts/helm-equivalence-receipt.yaml
    receipts/render-receipt.yaml
    receipts/scan-receipt.yaml
    receipts/install-gate.yaml

Invariants

The verifier must prove:

New to cub? Install the cub CLI first. You can pull and render public catalog packages without an account. Commands that save or change ConfigHub data require you to sign in.

What this command does. cub installer is a released, open-source plugin for the cub CLI. cub installer setup pulls a catalog package and writes its Kubernetes files locally. It does not apply those files to a cluster; use kubectl, Argo CD, or Flux for delivery. The generated scripts stop before doing any work when the plugin or kustomize is missing.

variant metadata.name == reuse-existing-secret
rendered Helm object count == 13
rendered Secret count == 0
target secret requirement is recorded
regular Helm output and cub installer setup output are semantically equivalent
cub installer adds only the Namespace support object

The proof must make the happy path visible:

default variant: Helm renders Redis Secret
reuse-existing-secret variant: Helm does not render Redis Secret
safe operation: target must provide redis-existing-secret/redis-password