This note records the Helm pain surfaced during catalog review and where the current ConfigHub/cub installer proof absorbs it.
Support Boundary
| Field | Value |
|---|---|
| Catalog status | catalog-supported |
| Support level | supported-for-declared-scopes |
| Supported scopes | local-test |
| Production readiness | production-review-ready |
| Variants in this note | default, no-crds |
Production support is not implied by this file. A chart can be supported for local proof/demo use while still needing accepted scan, gate, lifecycle, and operating-policy dispositions plus a final target-scoped support decision.
Chart Notes
- Default chart render is nondeterministic unless grafana.adminPassword is bound before render.
- default variant binds grafana.adminPassword and renders 10 Prometheus Operator CRDs.
- no-crds variant omits CRDs for clusters that manage CRDs separately and records those CRDs as target facts.
- Chart declares CRD, kube-state-metrics, node-exporter, Grafana, and windows-exporter dependencies and records them in dependency-lock.yaml.
- Config-only delivery stages the kube-prometheus-stack-admission TLS Secret as a target fact; regular Helm creates that material through hook lifecycle.
- Admission webhook readiness must still be observed after apply because rendered objects plus staged Secret do not prove webhook health.
- CRD manifests include YAML enum scalars such as bare equals signs; the proof parser handles these as scalar strings.
- Rules, scrape configs, datasource config, and extraManifests are tpl/raw extension slots; promoted variants keep raw slots empty.
Catalog Mitigations
- Supported for local-test and proof-demo usage through real cub installer and ConfigHub receipts.
- default preserves the normal kube-prometheus-stack install shape.
- no-crds is supported when CRD lifecycle is owned outside this package.
- default is the stronger first production-review base because it includes CRDs and has local observation evidence.
- no-crds is supported only when compatible Prometheus Operator CRDs are already staged and observed in the target cluster.
- CRD ownership, cluster RBAC, generated Grafana credential binding, raw monitoring extension slots, webhook readiness, and scan/gate warnings are recorded as production review input.
- Production recommendation remains a separate decision; kube-prometheus-stack needs target CRD ownership, webhook TLS lifecycle, resource/security posture, scrape scope, and fresh runtime checks before support.
- The committed ConfigHub apply and OCI/Argo live rows demonstrate semantic parity but remain runtime-watch until Prometheus Operator readiness is resolved for the target.
Control Points
| Control point | Status | Mitigation / evidence | |||
|---|---|---|---|---|---|
| source-lock | handled | source-lock.yaml | |||
| dependency-lock | handled | chart declares CRD, kube-state-metrics, node-exporter, Grafana, and windows-exporter dependencies; promoted variants lock their metadata. | |||
| capability-profile | handled | OpenShift and ServiceMonitor branches are bound to the named Kubernetes capability profile. | |||
| crd-policy | variant-controlled-and-target-fact | CRDs are ordinary rendered objects in the default variant; no-crds records those same CRDs as target prerequisites. | |||
| admission-webhook | target-fact-and-observe | Config-only delivery must stage the kube-prometheus-stack-admission Secret because Helm normally creates the TLS material through hook lifecycle. | |||
| generated-facts | variant-controlled | Both promoted variants bind Grafana admin password before render so Helm output is deterministic. | |||
| cluster-rbac | scan-and-review | scan receipts | |||
| tpl | controlled-by-empty-defaults | Prometheus/Grafana rules, scrape configs, datasource config, and extraManifests can use templating; promoted variants keep raw slots empty. | |||
| installer-support-object | handled | v1\ | Namespace\ | \ | monitoring |
Control Point Index
- admission-webhook
- admission-webhook-observation
- capability-profile
- cluster-rbac
- cluster-rbac-scan
- crd-lifecycle-policy
- crd-policy
- dependency-lock
- generated-facts
- installer-support-object
- source-lock
- tpl
- tpl-extension-slot
Proof Links
- Catalog map: CATALOG.md
- Machine index: artifact-index.yaml
- Helm plan: helm-plan.yaml
- Control points: control-points.yaml
- Chart dossier: chart-dossier.yaml