This note records the Helm pain surfaced during catalog review and where the current ConfigHub/cub installer proof absorbs it.
Support Boundary
| Field | Value |
|---|---|
| Catalog status | catalog-supported |
| Support level | supported-for-declared-scopes |
| Supported scopes | local-test |
| Production readiness | production-review-ready |
| Variants in this note | dev-mode, default, ha-raft-ui |
Production support is not implied by this file. A chart can be supported for local proof/demo use while still needing accepted scan, gate, lifecycle, and operating-policy dispositions plus a final target-scoped support decision.
Chart Notes
- The chart renders deterministically under pinned Helm, chart version, kube version, and values.
- The default variant keeps the chart defaults: standalone Vault server, injector webhook, and TLS disabled in the rendered Vault config.
- The ha-raft-ui variant enables integrated Raft HA and the UI Service as deliberate variant-controlled outputs.
- The dev-mode variant uses the upstream chart's dev server path for local proof and demos; it starts without init/unseal and is not a production support claim.
- The chart does not initialize or unseal Vault; init/unseal and recovery material are operating controls, not hidden render inputs.
- operating-policy.yaml records the post-render procedure required before default and HA bases can be called ready.
- The HA Raft variant needs a target that can schedule three Vault server replicas; one-node kind is useful for object parity but not for HA readiness.
- Injector webhook, cluster RBAC, TLS posture, storage, and service exposure are scan/gate review points.
- extra environment, Secret, volume, plugin, init, and sidecar extension slots are powerful config surfaces; promoted variants keep them empty.
Catalog Mitigations
- Supported for local-test and proof-demo usage through real cub installer and ConfigHub receipts.
- default is the simplest local Vault chart path and the safer first production-review base.
- ha-raft-ui is supported as a richer HA/Raft/UI proof, but has target-sensitive service-selector and runtime caveats.
- RBAC, injector webhook, extension slots, storage/init/unseal/recovery, TLS posture, service exposure, and scan/gate warnings are recorded as production review input.
- Production recommendation remains a separate decision; Vault needs explicit init/unseal, recovery material, TLS, backup/restore, and live observation procedures before support.
Control Points
| Control point | Status | Mitigation / evidence | |||
|---|---|---|---|---|---|
| source-lock | handled | source-lock.yaml | |||
| dependency-lock | handled | chart declares no subchart dependencies; the empty closure is recorded explicitly. | |||
| capability-profile | handled | Kubernetes API and version branches are bound to the named Kubernetes capability profile. | |||
| stateful-workload | scan-and-review | apps/v1\ | StatefulSet\ | vault\ | vault |
| admission-webhook | scan-and-review | admissionregistration.k8s.io/v1\ | MutatingWebhookConfiguration\ | \ | vault-agent-injector-cfg |
| service-exposure | variant-controlled | v1\ | Service\ | vault\ | vault-ui |
| tls-posture | scan-and-review | v1\ | ConfigMap\ | vault\ | vault-config |
| cluster-rbac | scan-and-review | rbac.authorization.k8s.io/v1\ | ClusterRole\ | \ | vault-agent-injector-clusterrole |
| operate-policy | policy-required | Vault init, unseal, seal migration, recovery material, and freshness evidence are post-render operating controls. | |||
| target-topology | target-review | The ha-raft-ui base renders three Vault server replicas. A one-node kind target is useful for object parity, but HA live readiness needs a target that can schedule the declared topology plus an init/unseal operating path. | |||
| extension-slots | controlled-by-empty-defaults | extra environment, Secret, volume, plugin, init, and sidecar slots are empty in promoted variants. | |||
| installer-support-object | handled | v1\ | Namespace\ | \ | vault |
Control Point Index
- admission-webhook
- capability-profile
- cluster-rbac
- dependency-lock
- extension-slots
- installer-support-object
- operate-policy
- rbac-review
- secret-extension-slots
- service-exposure
- source-lock
- stateful-workload
- target-topology
- tls-posture
Proof Links
- Catalog map: CATALOG.md
- Machine index: artifact-index.yaml
- Helm plan: helm-plan.yaml
- Control points: control-points.yaml
- Chart dossier: chart-dossier.yaml