This note records the Helm pain surfaced during catalog review and where the current ConfigHub/cub installer proof absorbs it.
Support Boundary
| Field | Value |
|---|---|
| Catalog status | catalog-supported |
| Support level | supported-for-declared-scopes |
| Supported scopes | local-test |
| Production readiness | production-review-ready |
| Variants in this note | http-clusterip, existing-tls-ingress |
Production support is not implied by this file. A chart can be supported for local proof/demo use while still needing accepted scan, gate, lifecycle, and operating-policy dispositions plus a final target-scoped support decision.
Chart Notes
- Default chart rendering is nondeterministic because tls.autoGenerated creates fresh certificate material.
- http-clusterip disables TLS generation and keeps service exposure internal.
- existing-tls-ingress requires declared backend and ingress TLS Secrets instead of rendering generated certs.
- Supported bases pin the Bitnami NGINX image by digest instead of rendering the chart default latest tag.
- existing-tls-ingress adds explicit ingress host, ingress class, and TLS Secret reference.
- serverBlock, streamServerBlock, extraDeploy, git-clone, metrics, and sidecar slots are powerful extension surfaces; promoted variants keep them empty or disabled.
Catalog Mitigations
- Supported for local-test and proof-demo usage through real cub installer and ConfigHub receipts.
- http-clusterip is the simplest low-friction happy path.
- existing-tls-ingress is supported when the declared TLS Secret target facts are satisfied.
- Production recommendation remains a separate decision; the production disposition lane records current review-ready or blocking state.
Control Points
| Control point | Status | Mitigation / evidence | |||
|---|---|---|---|---|---|
| source-lock | handled | source-lock.yaml | |||
| dependency-lock | handled | chart declares no subchart dependencies; the empty closure is recorded explicitly. | |||
| capability-profile | handled | Kubernetes API and version branches are bound to the named Kubernetes capability profile. | |||
| generated-facts | variant-controlled | The chart default auto-generates TLS material; promoted variants either disable TLS or require existing TLS Secrets before render. | |||
| target-facts | variant-controlled | The existing-tls-ingress variant declares backend and ingress TLS Secrets instead of rendering generated certs. | |||
| deployment-workload | scan-and-review | apps/v1\ | Deployment\ | nginx\ | nginx |
| edge-ingress-policy | variant-controlled | networking.k8s.io/v1\ | Ingress\ | nginx\ | nginx |
| network-policy | scan-and-review | networking.k8s.io/v1\ | NetworkPolicy\ | nginx\ | nginx |
| availability-policy | scan-and-review | policy/v1\ | PodDisruptionBudget\ | nginx\ | nginx |
| extension-slots | controlled-by-empty-defaults | serverBlock, streamServerBlock, extraDeploy, git-clone, metrics, and sidecar slots are empty or disabled in promoted variants. | |||
| installer-support-object | handled | v1\ | Namespace\ | \ | nginx |
Control Point Index
- availability-policy
- capability-profile
- dependency-lock
- deployment-workload
- edge-ingress-policy
- extension-slots
- generated-facts
- installer-support-object
- metrics-addon-policy
- network-policy
- raw-template-extension-slots
- source-lock
- static-site-supply-chain
- target-facts
Proof Links
- Catalog map: CATALOG.md
- Machine index: artifact-index.yaml
- Helm plan: helm-plan.yaml
- Control points: control-points.yaml
- Chart dossier: chart-dossier.yaml