This note records the Helm pain surfaced during catalog review and where the current ConfigHub/cub installer proof absorbs it.
Support Boundary
| Field | Value |
|---|---|
| Catalog status | catalog-supported |
| Support level | supported-for-declared-scopes |
| Supported scopes | local-test |
| Production readiness | production-review-ready |
| Variants in this note | static-passwords, existing-secret-replicaset |
Production support is not implied by this file. A chart can be supported for local proof/demo use while still needing accepted scan, gate, lifecycle, and operating-policy dispositions plus a final target-scoped support decision.
Chart Notes
- Default chart rendering is nondeterministic unless auth.rootPassword is bound before render.
- static-passwords variant persists auth.rootPassword as a generated fact and renders the Secret deterministically.
- existing-secret-replicaset variant does not render a Secret and instead declares mongodb/mongodb-auth as a target fact.
- The mongodb-replica-set-key target fact must be valid MongoDB keyfile material; a generic password-like string can pass presence checks but fail runtime bootstrap.
- existing-secret-replicaset variant changes architecture to replicaset and renders primary plus arbiter StatefulSets.
- Supported bases pin the Bitnami MongoDB image by digest instead of rendering the chart default latest tag.
- Chart declares the Bitnami common dependency and records it in dependency-lock.yaml.
- Retained source-scan evidence records hook count 0 for this pinned chart line; supported bases render no hook objects and keep the no-hooks lifecycle boundary explicit.
- MongoDB renders persistent storage, NetworkPolicy, and PDB objects that need production policy.
- initdb and extended configuration are template-powered extension slots; promoted variants keep them empty.
Catalog Mitigations
- Supported for local-test and proof-demo usage through real cub installer and ConfigHub receipts.
- existing-secret-replicaset is the package default. It renders no MongoDB Secret and is supported when the declared MongoDB Secret target facts are satisfied.
- static-passwords is kept as an explicit demo path. It ships a fixed, shared demo password baked into the rendered Secret (base64) - identical on every install and readable from the manifest.
- Production recommendation remains a separate decision; the production disposition lane records current review-ready or blocking state.
- Target production review must choose storage class, MongoDB backup/restore mechanism, and whether the replica-set base is appropriate for the target.
- The existing-secret-replicaset base now passes two-cluster parity when the target Secret supplies MongoDB-valid replica-set key material.
Control Points
| Control point | Status | Mitigation / evidence | |||
|---|---|---|---|---|---|
| source-lock | handled | source-lock.yaml | |||
| dependency-lock | handled | chart declares the Bitnami common dependency; promoted variants lock its metadata. | |||
| capability-profile | handled | Kubernetes API and version branches are bound to the named Kubernetes capability profile. | |||
| generated-facts | variant-controlled | The static-passwords variant binds the generated root password before render so Helm output is deterministic. | |||
| target-facts | variant-controlled | The existing-secret-replicaset variant declares the target Secret and its MongoDB-valid replica-set key requirement instead of rendering one. | |||
| image-digest | handled | Supported bases pin the Bitnami MongoDB image by digest. | |||
| hook-policy | handled-for-render | The retained source scan records hook count 0 for this pinned chart line. Supported bases render no hook objects; future hook-producing paths must map to lifecycle policy before production. | |||
| replicaset-topology | variant-controlled | apps/v1\ | StatefulSet\ | mongodb\ | mongodb |
| stateful-workload | scan-and-review | MongoDB Deployment/PVC and StatefulSet workloads need storage, retention, upgrade, and rollback policy. | |||
| pvc-policy | scan-and-review | Persistent volumes and StatefulSet volumeClaimTemplates need storage class, retention, backup, restore, and rollback policy. | |||
| network-policy | scan-and-review | networking.k8s.io/v1\ | NetworkPolicy\ | mongodb\ | mongodb |
| pdb-policy | scan-and-review | policy/v1\ | PodDisruptionBudget\ | mongodb\ | mongodb |
| tpl | controlled-by-empty-defaults | initdb and extended configuration slots use templating; promoted variants do not populate them. | |||
| installer-support-object | handled | v1\ | Namespace\ | \ | mongodb |
Control Point Index
- capability-profile
- dependency-lock
- generated-facts
- hook-lifecycle-policy
- hook-policy
- image-digest
- installer-support-object
- network-policy
- pdb-policy
- pvc-policy
- replicaset-topology
- source-lock
- stateful-workload
- stateful-workload-policy
- target-facts
- tpl
- tpl-extension-slot
Proof Links
- Catalog map: CATALOG.md
- Machine index: artifact-index.yaml
- Helm plan: helm-plan.yaml
- Control points: control-points.yaml
- Chart dossier: chart-dossier.yaml