This note records the Helm pain surfaced during catalog review and where the current ConfigHub/cub installer proof absorbs it.
Support Boundary
| Field | Value |
|---|---|
| Catalog status | catalog-supported |
| Support level | supported-for-declared-scopes |
| Supported scopes | local-test |
| Production readiness | production-review-ready |
| Variants in this note | default, server-only-ephemeral |
Production support is not implied by this file. A chart can be supported for local proof/demo use while still needing accepted scan, gate, lifecycle, and operating-policy dispositions plus a final target-scoped support decision.
Chart Notes
- The chart renders deterministically under pinned Helm, chart version, kube version, and values.
- The default variant installs Prometheus server, Alertmanager, kube-state-metrics, node-exporter, pushgateway, server PVC, services, and cluster RBAC.
- The server-only-ephemeral variant disables bundled components and server persistence as deliberate variant-controlled outputs.
- Scrape config, remote read/write, ingress, network policy, PDB, and extra-manifest slots are extension surfaces that must be explicit before production.
- Bundled dependency ownership, storage/retention, workload rollout, and cluster RBAC are scan/gate review points.
- StatefulSet and HA behavior become future variants, not hidden defaults.
Catalog Mitigations
- Supported for local-test and proof-demo usage through real cub installer and ConfigHub receipts.
- default preserves the normal Prometheus chart install shape.
- server-only-ephemeral is supported as the simplest short-lived local proof path.
- Cluster RBAC, extension-slot policy, and scan/gate warnings are recorded as production review input.
- Production recommendation remains a separate decision; target security posture, scrape scope, storage, and resource policy must be chosen for the target scope.
- server-only-ephemeral is the narrower first production-review base; default includes the bundled monitoring stack and node-exporter host access.
Control Points
| Control point | Status | Mitigation / evidence | |||
|---|---|---|---|---|---|
| source-lock | handled | source-lock.yaml | |||
| dependency-lock | handled | chart dependencies are locked and reviewed, including alertmanager, kube-state-metrics, node-exporter, and pushgateway. | |||
| capability-profile | handled | Kubernetes API and version branches are bound to the named Kubernetes capability profile. | |||
| bundle-dependencies | scan-and-review | dependency-lock.yaml | |||
| monitoring-workloads | scan-and-review | apps/v1\ | Deployment\ | monitoring\ | prometheus-server |
| storage-retention | variant-controlled | v1\ | PersistentVolumeClaim\ | monitoring\ | prometheus-server |
| scrape-config | scan-and-review | v1\ | ConfigMap\ | monitoring\ | prometheus-server |
| cluster-rbac | scan-and-review | rbac.authorization.k8s.io/v1\ | ClusterRole\ | \ | prometheus-server |
| component-selection | variant-controlled | alertmanager/kube-state-metrics/node-exporter/pushgateway values | |||
| extension-slots | controlled-by-empty-defaults | extra scrape configs, remote read/write, ingress, network policy, PDB, and extra manifests are explicit variant inputs. | |||
| installer-support-object | handled | v1\ | Namespace\ | \ | monitoring |
Control Point Index
- bundle-dependencies
- capability-profile
- cluster-rbac
- component-selection
- dependency-lock
- extension-slots
- installer-support-object
- monitoring-workloads
- rbac-review
- scrape-config
- source-lock
- storage-retention
Proof Links
- Catalog map: CATALOG.md
- Machine index: artifact-index.yaml
- Helm plan: helm-plan.yaml
- Control points: control-points.yaml
- Chart dossier: chart-dossier.yaml