This note records the Helm pain surfaced during catalog review and where the current ConfigHub/cub installer proof absorbs it.
Support Boundary
| Field | Value |
|---|---|
| Catalog status | catalog-supported |
| Support level | supported-for-declared-scopes |
| Supported scopes | local-test |
| Production readiness | production-review-ready |
| Variants in this note | static-passwords, existing-secret |
Production support is not implied by this file. A chart can be supported for local proof/demo use while still needing accepted scan, gate, lifecycle, and operating-policy dispositions plus a final target-scoped support decision.
Chart Notes
- Default chart rendering is nondeterministic unless auth.rootPassword, auth.password, and auth.replicationPassword are bound before render.
- static-passwords variant persists all three password fields as generated facts and renders the Secret deterministically.
- existing-secret variant does not render a Secret and instead declares mysql/mysql-auth as a target fact.
- Chart declares the Bitnami common dependency and records it in dependency-lock.yaml.
- Supported bases render no hook objects, and future hook-producing paths must map to lifecycle policy before production.
- MySQL renders a StatefulSet with volumeClaimTemplates and needs storage/upgrade/rollback policy.
- initdb and extended configuration are template-powered extension slots; promoted variants keep them empty.
Catalog Mitigations
- Supported for local-test and proof-demo usage through real cub installer and ConfigHub receipts.
- existing-secret is the package default. It renders no MySQL Secret and is supported when the declared MySQL Secret target facts are satisfied.
- static-passwords is kept as an explicit demo path. It ships a fixed, shared demo password baked into the rendered Secret (base64) - identical on every install and readable from the manifest.
- Production recommendation remains a separate decision; the production disposition lane records current review-ready or blocking state.
- Target production review must choose storage class and database backup/restore mechanism before use.
Control Points
| Control point | Status | Mitigation / evidence | |||
|---|---|---|---|---|---|
| source-lock | handled | source-lock.yaml | |||
| dependency-lock | handled | chart declares the Bitnami common dependency; promoted variants lock its metadata. | |||
| capability-profile | handled | Kubernetes API and version branches are bound to the named Kubernetes capability profile. | |||
| generated-facts | variant-controlled | The static-passwords variant binds all generated password fields before render so Helm output is deterministic. | |||
| target-facts | variant-controlled | The existing-secret variant declares the target Secret instead of rendering one. | |||
| hook-policy | handled-for-render | The retained source scan records hook count 0 for this pinned chart version. Supported bases render no hook objects; future hook-producing paths must map to lifecycle policy before production. | |||
| stateful-workload | scan-and-review | apps/v1\ | StatefulSet\ | mysql\ | mysql |
| pvc-policy | scan-and-review | StatefulSet volumeClaimTemplates need storage, retention, upgrade, and rollback policy. | |||
| tpl | controlled-by-empty-defaults | initdb and extended configuration slots use templating; promoted variants do not populate them. | |||
| installer-support-object | handled | v1\ | Namespace\ | \ | mysql |
Control Point Index
- capability-profile
- dependency-lock
- generated-facts
- hook-lifecycle-policy
- hook-policy
- installer-support-object
- pvc-policy
- source-lock
- stateful-workload
- stateful-workload-policy
- target-facts
- tpl
- tpl-extension-slot
Proof Links
- Catalog map: CATALOG.md
- Machine index: artifact-index.yaml
- Helm plan: helm-plan.yaml
- Control points: control-points.yaml
- Chart dossier: chart-dossier.yaml