This note records the Helm pain surfaced during catalog review and where the current ConfigHub/cub installer proof absorbs it.
Support Boundary
| Field | Value |
|---|---|
| Catalog status | catalog-supported |
| Support level | supported-for-declared-scopes |
| Supported scopes | local-test |
| Production readiness | production-review-ready |
| Variants in this note | default, reuse-existing-secret |
Production support is not implied by this file. A chart can be supported for local proof/demo use while still needing accepted scan, gate, lifecycle, and operating-policy dispositions plus a final target-scoped support decision.
Chart Notes
- Redis is stateful; PVC and credential behavior require explicit variant policy.
- Bitnami Redis can generate credentials unless a password/existing secret path is provided.
- Supported bases pin the Bitnami Redis image by digest instead of rendering the chart default latest tag.
- Default and reuse-existing-secret are the first proof variants; HA is a later slice.
Catalog Mitigations
- First deliberately supported catalog entry.
- reuse-existing-secret is the package default. It renders no Redis Secret and requires redis/redis-existing-secret key redis-password before apply.
- The base named default is kept as an explicit demo path. It ships a fixed, shared demo password baked into the rendered Secret (base64 confighub-redis-password) - identical on every install and readable from the manifest.
- Production recommendation remains a separate decision; the production disposition lane records current review-ready or blocking state.
- Both variants are Helm-equivalent through cub installer setup.
Control Points
| Control point | Status | Mitigation / evidence | |||
|---|---|---|---|---|---|
| source-lock | handled | source-lock.yaml | |||
| dependency-lock | handled | dependency-lock.yaml | |||
| generated-facts | handled-for-default-proof | auth.password is bound before render and owned by revisions/default/r001/receipts/generated-fact-receipt.yaml. | |||
| target-facts | required-for-reuse-existing-secret | variants/reuse-existing-secret/variant.yaml | |||
| capability-profile | handled | recorded in control-points.yaml | |||
| hook-policy | handled | no-hooks | |||
| secret-handling | handled | cub installer separates one rendered Secret from uploaded manifests. | |||
| image-digest | handled | recorded in control-points.yaml | |||
| installer-support-object | handled | v1\ | Namespace\ | \ | redis |
Control Point Index
- capability-profile
- dependency-lock
- generated-facts
- hook-policy
- image-digest
- installer-support-object
- secret-handling
- source-lock
- target-facts
Proof Links
- Catalog map: CATALOG.md
- Machine index: artifact-index.yaml
- Helm plan: helm-plan.yaml
- Control points: control-points.yaml
- Chart dossier: chart-dossier.yaml