# Per-chart cub adoption caveats — where a chart needs a heads-up vs plain Helm

**UNOFFICIAL/EXPERIMENTAL.** Generated by `scripts/generate-cub-adoption-caveats.mjs`; do not hand-edit. Regenerate with `npm run cub-adoption-caveats:generate`. Secret values are never decoded or printed — only password key names are read.

This is the per-chart view of the adoption audit (docs/planning/helm-vs-cub-adoption-audit.md, PR #1016): for each of the 100 charts, which "worse-than / more-confusing-than plain Helm" rough edges apply, and the exact fix.

## Three caveats that apply to EVERY chart (cub-direct path)

These are the same for all 100 charts, so they are stated once here rather than repeated per chart. **Use a controller (Argo/Flux) and all three are handled for you**; on the bare cub-direct path the managed applier handles them.

1. **Customize with `--input` or a base edit, not Helm's `--set`** — cub rejects `--set`/`--values` (the typo guard); declared values use `--input`, the rest by choosing/editing a kustomize base.
   - *Managed:* Guided errors + migration cheat-sheet (#1020, docs/user/helm-to-cub-migration.md).
2. **Upgrades don't auto-delete removed objects on cub-direct** — A plain `kubectl apply` leaves orphans when an upgrade removes a resource.
   - *Managed:* Managed applier uses `--prune` (#1019), or use a controller (Argo/Flux) which prunes natively.
3. **A manual `kubectl edit` conflicts on server-side re-apply** — Safer than Helm's silent overwrite, but a Helm user expects the overwrite.
   - *Managed:* Managed applier surfaces a plain-words message + `--force-conflicts` (#1019).

## Per-chart caveats (these vary by chart)

**2/100 charts** still bake a shared placeholder password in their default setup; **41/100 charts** ship CRDs that need first-ordering on cub-direct. Full data for all 100 charts: [caveats.csv](./caveats.csv) · [summary.html](./summary.html).

### Shared placeholder password (#1012) — 2 charts

If a chart appears here, its default base bakes a password Secret that is **the same for everyone**. The safer package shape is an existing-Secret base: create or supply the Secret before apply, keep the Secret material outside the rendered chart, and make any fixed-password demo base explicit.

| Chart | Default base | Password keys | Fix |
| --- | --- | --- | --- |
| falcosecurity/falcosidekick | `default` | 1 | replace the placeholder before prod |
| runix/pgadmin4 | `default` | 1 | replace the placeholder before prod |

### CRDs need first-ordering on cub-direct (#1015) — 41 charts

On the bare `kubectl apply` path a chart's CRs can apply before its CRDs are established. A controller handles ordering; on cub-direct, apply CRDs first and wait, or use the managed applier (#1019).

| Chart | Default base | CRDs | Fix |
| --- | --- | --- | --- |
| aqua/trivy-operator | `default` | 12 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| argo-cd/argo-cd | `default` | 3 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| argo-cd/argo-events | `default` | 3 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| argo-cd/argo-rollouts | `default` | 5 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| argo-cd/argo-workflows | `default` | 8 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| argo-cd/argocd-image-updater | `default` | 1 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| autoscaler/vertical-pod-autoscaler | `default` | 2 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| bitnami/contour | `default` | 5 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| cloudnative-pg/cloudnative-pg | `default` | 10 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| elastic/eck-operator | `default` | 12 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| external-dns/external-dns | `default` | 1 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| external-secrets/external-secrets | `default` | 23 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| fairwinds-stable/vpa | `default` | 2 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| gatekeeper/gatekeeper | `default` | 17 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| grafana/alloy | `default` | 1 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| grafana/pyroscope | `default` | 1 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| grafana/rollout-operator | `default` | 2 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| hashicorp/consul | `default-control-plane` | 28 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| hashicorp/terraform | `default` | 1 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| jaegertracing/jaeger-operator | `default` | 1 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| jetstack/cert-manager | `default` | 6 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| jetstack/trust-manager | `default` | 3 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| kedacore/keda | `default` | 6 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| kyverno/kyverno | `default` | 22 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| kyverno/kyverno-policies | `default` | 1 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| linkerd/linkerd-crds | `default` | 8 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| longhorn/longhorn | `default` | 22 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| minio-operator/operator | `default` | 2 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| minio-operator/tenant | `default` | 1 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| nats/nack | `default` | 6 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| open-telemetry/opentelemetry-operator | `default` | 6 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| percona/pg-operator | `default` | 8 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| percona/psmdb-operator | `default` | 3 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| percona/pxc-operator | `default` | 3 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| rook-release/rook-ceph | `default` | 25 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| rook-release/rook-ceph-cluster | `default` | 5 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| sealed-secrets/sealed-secrets | `default` | 1 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| secrets-store-csi-driver/secrets-store-csi-driver | `default` | 2 | apply CRDs first + wait, or use a controller (#1015/#1019) |
| strimzi/strimzi-kafka-operator | `default` | 10 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| traefik/traefik | `default` | 25 | `no-crds` base separates CRDs; apply CRDs first + wait, or use a controller (#1015/#1019) |
| velero/velero | `default` | 13 | apply CRDs first + wait, or use a controller (#1015/#1019) |

## How to read this

- A chart **not** listed in either per-chart table still has the three universal caveats — those are the floor.
- Every fix here is proven: managed delivery applier ([#1019](https://github.com/confighub/helm-expt/pull/1019)) and setup guidance ([#1020](https://github.com/confighub/helm-expt/pull/1020)).
- The cleanest blanket fix for the delivery caveats (prune, CRD ordering, SSA) is **use a controller** — they were never config quirks, only bare-apply behaviors.