Per-chart cub adoption caveats
where a chart needs a heads-up vs plain Helm · 124 charts · generated from package sources
4 charts bake a shared placeholder password
58 charts ship CRDs (need first-ordering on cub-direct)
124 charts carry the 3 universal caveats
Three caveats that apply to every chart (cub-direct path)
- Customize with `--input` or a base edit, not Helm's `--set` — cub rejects `--set`/`--values` (the typo guard); declared values use `--input`, the rest by choosing/editing a kustomize base.
Managed: Guided errors + migration cheat-sheet (#1020, docs/user/helm-to-cub-migration.md). - Upgrades don't auto-delete removed objects on cub-direct — A plain `kubectl apply` leaves orphans when an upgrade removes a resource.
Managed: Managed applier uses `--prune` (#1019), or use Argo CD or Flux with pruning enabled and tested. - A manual `kubectl edit` conflicts on server-side re-apply — Safer than Helm's silent overwrite, but a Helm user expects the overwrite.
Managed: Managed applier surfaces a plain-words message + `--force-conflicts` (#1019).
Use a controller (Argo/Flux) and all three are handled for you; on bare cub-direct the managed applier (#1019) handles them.
Per-chart caveats — all 124 charts
| Chart | Default base | Shared password? | Secret fix base | Ships CRDs? | CRD-separable base |
|---|---|---|---|---|---|
| aqua/trivy-operator | default | no | no-crds | yes (12) | no-crds |
| argo-cd/argo-cd | default | no | default | yes (3) | — |
| argo-cd/argo-events | default | no | — | yes (3) | no-crds |
| argo-cd/argo-rollouts | default | no | — | yes (5) | no-crds |
| argo-cd/argo-workflows | default | no | — | yes (8) | — |
| argo-cd/argocd-image-updater | default | no | — | yes (1) | — |
| autoscaler/cluster-autoscaler | default | no | — | no | — |
| autoscaler/vertical-pod-autoscaler | default | no | default | yes (2) | no-crds |
| aws-controllers-k8s/ec2-chart | default | no | eks-inference | yes (22) | — |
| aws-controllers-k8s/eks-chart | default | no | eks-inference | yes (10) | — |
| aws-controllers-k8s/iam-chart | default | no | eks-inference | yes (9) | — |
| aws-ebs-csi-driver/aws-ebs-csi-driver | default | no | — | no | — |
| bitnami/apache | default | no | — | no | — |
| bitnami/contour | default | no | legacy | yes (5) | — |
| bitnami/elasticsearch | default | no | — | no | — |
| bitnami/memcached | default | no | — | no | — |
| bitnami/mongodb | existing-secret-replicaset | no | existing-secret-replicaset | no | — |
| bitnami/mysql | existing-secret | no | existing-secret | no | — |
| bitnami/nginx | http-clusterip | no | existing-tls-ingress | no | — |
| bitnami/opensearch | default | no | — | no | — |
| bitnami/phpmyadmin | default | no | — | no | — |
| bitnami/postgresql | existing-secret | no | existing-secret | no | — |
| bitnami/rabbitmq | existing-secret | no | existing-secret | no | — |
| bitnami/redis | reuse-existing-secret | no | reuse-existing-secret | no | — |
| bitnami/spark | default | no | — | no | — |
| bitnami/zookeeper | default | no | — | no | — |
| cloudnative-pg/cloudnative-pg | default | no | — | yes (11) | — |
| cloudpirates/nginx | default | no | — | no | — |
| cloudpirates/rabbitmq | default | yes | existing-secret | no | — |
| cloudpirates/redis | default | yes | reuse-existing-secret | no | — |
| coredns/coredns | default | no | — | no | — |
| crossplane-stable/crossplane | default | no | — | no | — |
| descheduler/descheduler | default | no | — | no | — |
| dex/dex | default | no | — | no | — |
| dra-driver-nvidia/dra-driver-nvidia-gpu | default | no | — | yes (2) | — |
| eks/aws-efa-k8s-device-plugin | default | no | — | no | — |
| elastic/eck-operator | default | no | — | yes (12) | no-crds |
| elastic/filebeat | default | no | — | no | — |
| elastic/kibana | default | no | — | no | — |
| elastic/logstash | default | no | — | no | — |
| elastic/metricbeat | default | no | — | no | — |
| external-dns/external-dns | default | no | — | yes (1) | no-crds |
| external-secrets/external-secrets | default | no | — | yes (25) | — |
| fairwinds-stable/goldilocks | default | no | — | no | — |
| fairwinds-stable/vpa | default | no | default | yes (2) | no-crds |
| falcosecurity/falco | default | no | — | no | — |
| falcosecurity/falcosidekick | default | yes | — | no | — |
| fluent/fluent-bit | default | no | — | no | — |
| fluent/fluentd | default | no | — | no | — |
| gatekeeper/gatekeeper | default | no | — | yes (17) | no-crds |
| gitlab/gitlab-runner | default | no | — | no | — |
| grafana/alloy | default | no | — | yes (1) | no-crds |
| grafana/grafana | existing-secret-ingress | no | existing-secret-ingress | no | — |
| grafana/loki | default | no | — | no | — |
| grafana/promtail | default | no | — | no | — |
| grafana/pyroscope | default | no | — | yes (1) | no-crds |
| grafana/rollout-operator | default | no | — | yes (2) | no-crds |
| grafana/tempo | local-persistent | no | s3-query-observability | no | — |
| haproxytech/kubernetes-ingress | default | no | — | no | — |
| hashicorp/consul | default-control-plane | no | — | yes (28) | — |
| hashicorp/terraform | default | no | — | yes (1) | — |
| hashicorp/vault | dev-mode | no | — | no | — |
| ingress-nginx/ingress-nginx | default | no | default | no | — |
| istio/gateway | default | no | — | no | — |
| istio/istiod | default | no | — | no | — |
| jaegertracing/jaeger | default | no | — | no | — |
| jaegertracing/jaeger-operator | default | no | — | yes (3) | — |
| jetstack/cert-manager | default | no | — | yes (6) | — |
| jetstack/cert-manager-csi-driver | default | no | — | no | — |
| jetstack/trust-manager | default | no | default | yes (3) | no-crds |
| k8s-ephemeral-storage-metrics/k8s-ephemeral-storage-metrics | default | no | — | yes (1) | — |
| kai-scheduler/kai-scheduler | default | no | — | yes (6) | — |
| karpenter/karpenter | default | no | — | yes (5) | — |
| kedacore/keda | default | no | — | yes (6) | no-crds |
| kubeflow/kubeflow-trainer | default | no | — | yes (4) | — |
| kyverno/kyverno | default | no | — | yes (22) | — |
| kyverno/kyverno-policies | default | no | — | no | — |
| linkerd/linkerd-crds | default | no | — | yes (8) | — |
| longhorn/longhorn | default | no | — | yes (25) | — |
| metallb/metallb | default | no | — | yes (13) | — |
| metrics-server/metrics-server | default | no | external-tls-ca | no | — |
| minio-operator/operator | default | no | — | yes (2) | — |
| minio-operator/tenant | default | no | — | yes (1) | — |
| mysql/mysql-operator | default | no | — | yes (5) | — |
| nats/nack | default | no | — | yes (6) | no-crds |
| nats/nats | default | no | — | no | — |
| nats/surveyor | default | no | — | no | — |
| nfs-subdir-external-provisioner/nfs-subdir-external-provisioner | default | no | — | no | — |
| node-feature-discovery/node-feature-discovery | default | no | — | yes (3) | — |
| nvidia/cluster-readiness-engine | default | no | — | yes (8) | — |
| nvidia/gpu-operator | default | no | — | yes (8) | — |
| nvidia/k8s-nim-operator | default | no | — | yes (9) | — |
| nvidia/nodewright | default | no | — | yes (4) | — |
| nvidia/nvidia-device-plugin | default | no | — | no | — |
| nvidia/nvsentinel | default | no | — | yes (1) | — |
| oauth2-proxy/oauth2-proxy | default | no | — | no | — |
| open-telemetry/opentelemetry-operator | default | no | default | yes (6) | no-crds |
| opencost/opencost | default | no | — | no | — |
| percona/pg-operator | default | no | — | yes (8) | no-crds |
| percona/psmdb-operator | default | no | — | yes (4) | — |
| percona/pxc-operator | default | no | — | yes (3) | no-crds |
| policy-reporter/policy-reporter | default | no | — | no | — |
| projectcalico/tigera-operator | default | no | — | yes (4) | — |
| prometheus-community/alertmanager | default | no | — | no | — |
| prometheus-community/kube-prometheus-stack | default | no | — | yes (10) | no-crds |
| prometheus-community/kube-state-metrics | default | no | — | no | — |
| prometheus-community/prometheus | default | no | — | no | — |
| prometheus-community/prometheus-adapter | default | no | — | no | — |
| prometheus-community/prometheus-blackbox-exporter | default | no | — | no | — |
| prometheus-community/prometheus-node-exporter | default | no | — | no | — |
| prometheus-community/prometheus-operator-crds | default | no | — | no | — |
| prometheus-community/prometheus-pushgateway | default | no | — | no | — |
| rook-release/rook-ceph | default | no | — | yes (25) | — |
| rook-release/rook-ceph-cluster | default | no | — | yes (5) | — |
| runix/pgadmin4 | default | yes | — | no | — |
| sealed-secrets/sealed-secrets | default | no | — | yes (1) | no-crds |
| secrets-store-csi-driver/secrets-store-csi-driver | default | no | — | yes (2) | — |
| stakater/reloader | default | no | — | no | — |
| strimzi/strimzi-kafka-operator | default | no | — | yes (10) | no-crds |
| traefik/traefik | default | no | — | yes (25) | — |
| valkey/valkey | default | no | — | no | — |
| velero/velero | default | no | — | yes (13) | — |
| vm/victoria-logs-single | default | no | — | no | — |
| vm/victoria-metrics-single | default | no | — | no | — |