Helm · AICR · OCI packages

Simplify configuration testing and verification

Using configuration tools can be tricky. We are here to help.

Read and test the exact Kubernetes objects before anything runs. Keep the reviewed result as files or OCI, or save it in ConfigHub so your team can change, promote, and roll it out. Start with a catalog package, your own Helm values, AICR, or an existing OCI.

Run a catalog package Check my config
starts with: Helm charts · AICR packages · OCI · Kubernetes YAML
catalog package → files + OCI · no cluster touched
$ cub installer setup \
  --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-redis:25.5.3 \
  --base reuse-existing-secret \
  --namespace redis --work-dir ./redis \
  --non-interactive --output-oci ./redis-rendered.oci

Rendered 14 manifest(s) to ./redis/out/manifests
Wrote rendered OCI ./redis-rendered.oci:latest
  objects:   sha256:... (14 manifest files)
  pull-back: verified
checked: anonymous package pull, 14 non-secret objects, OCI pull-back, and the same selected base from Redis 25.5.3 to 27.0.0

What this command does. cub installer is a released, open-source plugin for the cub CLI. cub installer setup pulls a catalog package and writes its Kubernetes files locally. It does not apply those files to a cluster; use kubectl, Argo CD, or Flux for delivery. The generated scripts stop before doing any work when the plugin or kustomize is missing.

Five simple things

What you can do

Look at what a package does, and whether it is safe, before you install it. Each verb works on a catalog package or on your own config. Every chart has a detailed playbook.

01

Understand

Read what it installs and where it bites.

open source
02

Test

Is my config well-formed and safe?

open source
03

Ask

A concrete answer, cited to a receipt.

open source
04

Vary

Make a supported variant, keep it safe.

free account to keep
05

Check my AI

Grade what your agent produced.

open source
Config testing

Four things you can prove before you ship

Not claims — runnable checks, each recorded as a receipt you can open, and re-runnable as drift after install.

✓ provableSafe to deploy?Well-formed, scans clean, e2e green, fits your cluster.
✓ provableDeploys without disruption?CRDs first, hook phases, prerequisites present.
✓ provableRollback safe, no data loss?What is stateful, destroy-gates, blast radius.
✓ provableRollback will succeed?A prior good revision, recorded and restorable.
One resource, three depths

Test locally. Keep the result in the path.

Testing is the first step. The reviewed files can go straight to OCI for Argo CD or Flux. Put them in ConfigHub when you want a shared record that can be edited, promoted, approved, and rolled out.

Open source no server or account

Inspect and test a catalog package or your own config. Keep the exact result as local files or write it to OCI for the delivery tools you already use.

ConfigHub server free account

Save the reviewed objects as shared data. Make environment variants, see exact diffs, promote a change, publish OCI, and check what reached each target.

Enterprise paid

Use private catalogs, team access, policy gates, and staged rollout across larger application and platform fleets.