This note records the Helm pain surfaced during catalog review and where the current ConfigHub/cub installer proof absorbs it.
Support Boundary
| Field | Value |
|---|---|
| Catalog status | catalog-supported |
| Support level | supported-for-declared-scopes |
| Supported scopes | local-test |
| Production readiness | production-review-ready |
| Variants in this note | default-control-plane, secure-mesh-existing-secrets |
Production support is not implied by this file. A chart can be supported for local proof/demo use while still needing accepted scan, gate, lifecycle, and operating-policy dispositions plus a final target-scoped support decision.
Chart Notes
- default-control-plane records the chart-default posture: TLS and ACLs disabled, server StatefulSet, injector webhook, webhook cert manager, 28 CRDs, and broad RBAC.
- secure-mesh-existing-secrets enables TLS, ACL management, gossip encryption, mesh/ingress/terminating gateways, and UI ingress using declared target Secrets.
- The secure variant disables gossip auto-generation and uses existing Secrets for CA, server cert, gossip key, and ACL bootstrap token.
- Both variants render 28 CRDs, including Gateway API CRDs that can conflict with cluster-managed CRD ownership.
- Helm hooks are excluded from proof renders, while the secure variant's normal ACL init Job remains visible as an install lifecycle object.
- secure-mesh-existing-secrets needs a target topology that can schedule three Consul server replicas with pod anti-affinity; one-node kind is useful for object parity but not for live readiness.
- target-topology.yaml records the target shape required for the secure mesh base.
- target-prerequisite-plan.yaml records the stricter Secret and namespace-reference contracts for the secure mesh base. The server TLS Secret must be valid for Consul's expected DNS identities, and deployment namespaces must match the rendered Consul service and Secret references or be rerendered deliberately. A SAN-aware live rehearsal got the regular Helm leg to healthy runtime, but the ConfigHub isolated-namespace legs still need a fixed-namespace or rerendered-base proof path.
- server extra config, injector, controller, gateway, and tpl-controlled strings are powerful extension surfaces; promoted variants keep them controlled.
Catalog Mitigations
- Supported for local-test and proof-demo usage through real cub installer and ConfigHub receipts.
- default-control-plane is the simplest local Consul control-plane path.
- secure-mesh-existing-secrets is supported when the declared Secret target facts are satisfied.
- default-control-plane has regular Helm, ConfigHub kubectl apply, and ConfigHub OCI/Argo live parity with healthy runtime, and is the stronger first production-review base.
- secure-mesh-existing-secrets is useful review input for TLS, ACL, gossip, gateway, UI ingress, and mesh topology, but remains target-fit-needed until target capacity and bootstrap policy are proven.
- CRD ownership, cluster RBAC, target Secret preflight, webhook readiness, lifecycle boundary, extension slots, storage/rollback, and scan/gate warnings are recorded as production review input.
- Production recommendation remains a separate decision; Consul needs target CRD ownership, TLS/ACL/secret rotation, mesh/gateway posture, security policy, backup/restore, and fresh runtime checks before support.
Control Points
| Control point | Status | Mitigation / evidence | |||
|---|---|---|---|---|---|
| source-lock | handled | source-lock.yaml | |||
| dependency-lock | handled | chart declares no subchart dependencies; the empty closure is recorded explicitly. | |||
| capability-profile | handled | Kubernetes API and version branches are bound to the named Kubernetes capability profile. | |||
| target-facts | variant-controlled | The secure-mesh-existing-secrets variant declares target Secrets for TLS, gossip encryption, and ACL bootstrap material. The server TLS Secret contract includes certificate identity, not just Secret/key presence. | |||
| crd-ownership | scan-and-review | The chart templates 28 CRDs, including Gateway API CRDs that may already be cluster-managed. | |||
| stateful-workload | scan-and-review | apps/v1\ | StatefulSet\ | consul\ | consul-consul-server |
| target-topology | target-fit-required | The secure-mesh-existing-secrets base renders three Consul server replicas with pod anti-affinity, so the strict one-node kind target is expected to leave two server pods pending. Use a multi-node target or a separate single-node/evaluation base for live readiness. A three-node rehearsal first exposed invalid server TLS SANs; after SAN-aware target facts, the regular Helm leg converged. | |||
| namespace-references | target-fit-required | The secure-mesh-existing-secrets base contains Consul service DNS, Secret namespace, and ACL init command references that are part of the rendered contract. Deploying the same render into a different namespace needs an explicit namespace-reference preflight, fixed-namespace live mode, or a rerendered base. | |||
| admission-webhook | scan-and-review | admissionregistration.k8s.io/v1\ | MutatingWebhookConfiguration\ | consul\ | consul-consul-connect-injector |
| cluster-rbac | scan-and-review | Default and secure variants render broad cluster RBAC for server, injector, gateway resources, and webhook certificate manager. | |||
| mesh-gateway-policy | variant-controlled | The secure-mesh-existing-secrets variant enables mesh, ingress, and terminating gateways with ClusterIP services. | |||
| ui-ingress-policy | variant-controlled | networking.k8s.io/v1\ | Ingress\ | consul\ | consul-consul-ui |
| lifecycle-policy | scan-and-review | Hooks are disabled in the proof render, while normal ACL init Job remains visible in the secure variant. | |||
| extension-slots | controlled-by-empty-defaults | server extra config, injector, controller, gateway, and tpl-controlled strings are controlled in promoted variants. | |||
| installer-support-object | handled | v1\ | Namespace\ | \ | consul |
Control Point Index
- admission-webhook
- capability-profile
- cluster-rbac
- crd-ownership
- dependency-lock
- extension-slots
- installer-support-object
- lifecycle-policy
- mesh-gateway-policy
- namespace-references
- raw-template-extension-slots
- source-lock
- stateful-workload
- target-facts
- target-topology
- ui-ingress-policy
Proof Links
- Catalog map: CATALOG.md
- Machine index: artifact-index.yaml
- Helm plan: helm-plan.yaml
- Control points: control-points.yaml
- Chart dossier: chart-dossier.yaml