Serious Chart Playbooks

UNOFFICIAL/EXPERIMENTAL

Use these notes when working on charts that exercise several Helm pain points at once. The goal is to keep hard charts as proof points, not exceptions hidden behind easy demos.

kube-prometheus-stack

Use kube-prometheus-stack to test CRDs, webhooks, hooks, generated facts, storage, RBAC, high fanout, upgrade deltas, and blast-radius claims.

Start with:

open docs/reference/kube-prometheus-stack-serious-chart-review.md
open data/high-fanout-demo/summary.md
open data/blast-radius-accuracy/summary.md

Consul

Use Consul to test existing Secrets, TLS identity, ACL/gossip prerequisites, gateway topology, many Units, and target topology.

Start with:

open recipes/hashicorp/consul/2.0.0/gitops-runtime-review.yaml
open data/live-parity-rerun-plan/summary.md

Keep the target rule precise: Consul secure mesh needs a Kubernetes target with three schedulable nodes. It does not require ConfigHub workers.

cert-manager And External Secrets

Use these to test CRDs, webhooks, controller-populated fields, generated webhook Secrets, and lifecycle observations.

Start with:

open data/lifecycle-observations/cert-manager-eso/summary.md
open data/secret-lifecycle/summary.md

Loki

Use Loki to test required values, storage mode, object-store credentials, stateful workloads, and target-fit decisions.

Start with:

open recipes/grafana/loki/7.0.0/CATALOG.md
open recipes/grafana/loki/7.0.0/helm-pain-report.yaml

Argo Workflows

Use Argo Workflows to test install-critical hooks. The default upstream route ships full CRDs through a pre-install hook. The maintained practical path is the minimal-crds base; the default path remains prerequisite-bound unless the full CRD hook route is explicitly handled.

Start with:

open data/hook-route-candidates/selected-routes/argo-cd-argo-workflows-minimal-crds.yaml
open data/lifecycle-boundary/summary.md