This note records the Helm pain surfaced during catalog review and where the current ConfigHub/cub installer proof absorbs it.
Support Boundary
| Field | Value |
|---|---|
| Catalog status | catalog-supported |
| Support level | supported-for-declared-scopes |
| Supported scopes | local-test |
| Production readiness | production-review-ready |
| Variants in this note | static-passwords, existing-secret |
Production support is not implied by this file. A chart can be supported for local proof/demo use while still needing accepted scan, gate, lifecycle, and operating-policy dispositions plus a final target-scoped support decision.
Chart Notes
- Default chart rendering is nondeterministic unless auth.password is bound before render.
- Default chart rendering is also nondeterministic unless auth.erlangCookie is bound before render.
- static-passwords variant persists auth.password and auth.erlangCookie as generated facts and renders chart Secrets deterministically.
- existing-secret variant does not render the credential Secret and instead declares rabbitmq/rabbitmq-auth and rabbitmq/rabbitmq-erlang-cookie as target facts.
- existing-secret variant still renders rabbitmq-config because configuration is chart-owned in both promoted variants.
- Chart declares the Bitnami common dependency and records it in dependency-lock.yaml.
- Promoted variants render no hook objects; future hook-producing values must map to lifecycle policy.
- RabbitMQ renders a StatefulSet with volumeClaimTemplates and needs storage/upgrade/rollback policy.
- configuration, advancedConfiguration, initScripts, secret names, and extraDeploy are template-powered extension surfaces; promoted variants keep raw slots empty.
Catalog Mitigations
- Supported for local-test and proof-demo usage through real cub installer and ConfigHub receipts.
- existing-secret is the package default. It renders no RabbitMQ password or Erlang cookie Secret and is supported when the declared RabbitMQ Secret target facts are satisfied.
- static-passwords is kept as an explicit demo path. It ships a fixed, shared demo password and RabbitMQ Erlang cookie baked into rendered Secrets (base64) - identical on every install and readable from the manifest.
- Production recommendation remains a separate decision; the production disposition lane records current review-ready or blocking state.
- Target production review must choose storage class, RabbitMQ recovery policy, and backup/restore mechanism before use.
Control Points
| Control point | Status | Mitigation / evidence | |||
|---|---|---|---|---|---|
| source-lock | handled | source-lock.yaml | |||
| dependency-lock | handled | chart declares the Bitnami common dependency; promoted variants lock its metadata. | |||
| capability-profile | handled | Kubernetes API and version branches are bound to the named Kubernetes capability profile. | |||
| generated-facts | variant-controlled | The static-passwords variant binds the generated password and Erlang cookie before render so Helm output is deterministic. | |||
| target-facts | variant-controlled | The existing-secret variant declares target Secrets for password and Erlang cookie; it still renders the configuration Secret. | |||
| hook-policy | not-present-in-promoted-render | Promoted RabbitMQ variants render no hook objects with the pinned inputs; if enabled by future values, hooks must map to lifecycle policy before production. | |||
| stateful-workload | scan-and-review | apps/v1\ | StatefulSet\ | rabbitmq\ | rabbitmq |
| pvc-policy | scan-and-review | StatefulSet volumeClaimTemplates need storage, retention, upgrade, and rollback policy. | |||
| tpl | controlled-by-empty-defaults | configuration, advancedConfiguration, initScripts, secret names, and extraDeploy can use templating; promoted variants keep raw extension slots empty. | |||
| installer-support-object | handled | v1\ | Namespace\ | \ | rabbitmq |
Control Point Index
- capability-profile
- clustering-policy
- dependency-lock
- generated-facts
- hook-policy
- installer-support-object
- lifecycle-policy
- pvc-policy
- source-lock
- stateful-workload
- stateful-workload-policy
- target-facts
- tpl
- tpl-extension-slot
Proof Links
- Catalog map: CATALOG.md
- Machine index: artifact-index.yaml
- Helm plan: helm-plan.yaml
- Control points: control-points.yaml
- Chart dossier: chart-dossier.yaml