How AI Helps Build The Catalog
The main AI use today is not autonomous production change. It is catalog work: finding what a chart does, proposing safe starting points, generating checks, and turning evidence into language people can read.
| AI helps with | How we keep it honest |
|---|---|
| Read chart behavior | AI helps inspect chart docs, values, templates, hooks, CRDs, defaults, and prerequisites so the catalog starts from the right questions. |
| Draft base variants | AI can suggest useful chart-specific base variants, such as default, existing Secret, no-CRDs, server-only, HA, or production-like choices. The generator and receipts decide what is accepted. |
| Generate checks | AI helps draft tests, summaries, and verifier commands. A page is not treated as true until committed data and verification commands back it. |
| Triage failures | AI helps sort a failure into render input, target prerequisite, lifecycle route, runtime health, or unsupported chart behavior. |
| Explain evidence | AI helps turn receipts, diffs, and generated data into plain English for chart pages and docs. |
Read how render, record, and route work · Check the verification commands
When Users Bring AI
AI can also help a user propose Helm values, patches, variants, or fixes. ConfigHub makes that safer by turning the suggestion into exact Kubernetes objects, diffs, known extras, checks, and approvals before it reaches a cluster.
If the suggestion changes what Helm renders, it should become a new or updated recorded base variant. If it edits an already-rendered object, it should become a reviewed ConfigHub change. Either way, the user sees the diff before release.
The reviewed config remains the source of truth. AI explains and proposes; ConfigHub records and verifies.
A Change We Checked In ConfigHub
The example starts with a proposed AICR training change that asks for eight H100 nodes even though the recorded target limit is four. It also replaces a pinned image with latest and leaves an API key placeholder. The reviewed file fixes all three problems.
In the live run, ConfigHub read the nested AICR fields. It reported the mutable image and blocked the inline API key. The reviewed version cleared both checks. Ordinary Deployment image and probe checks did not run against either custom resource.
ConfigHub stored the reviewed Kubernetes object, blocked a dry run until its exact head revision was approved, and allowed the same dry run to an OCI target after approval. Nothing was applied to Kubernetes. The four-node limit remains a separate target-specific check because the ConfigHub policy cannot yet read that recorded target fact.
Good AI Tasks
| Task | Fit | Boundary |
|---|---|---|
| Explain a diff | Good fit | AI can summarize which objects changed. Keep the actual diff visible as the record. |
| Create a variant | Good fit with review | AI can draft labels, targets, and transforms. A person or policy gate approves the exact result. |
| Patch a fleet | Good fit with scope | AI can draft the patch; ConfigHub shows which apps, variants, and objects it touches before rollout. |
| Triage a broken chart | Good fit | AI can help decide whether the problem is values, cluster prerequisites, lifecycle steps, image pulls, or runtime health. |
| Use a domain app | Good fit | Give the agent purpose-built commands, such as Kubernetes RBAC analysis, instead of raw YAML editing. |
| Change production live state directly | Not the default path | The safer path is propose, diff, approve, deliver, observe. Direct writes need clear authority, scope, and rollback. |
Agentic Custom Apps
A useful pattern is a small domain app that exposes higher-level operations to an agent while ConfigHub remains the configuration store. The app supplies the domain model, dry-run behavior, guardrails, and explicit commit path.
ConfigHub's RBAC Manager for Agents is a concrete example of that shape. It is a CLI/plugin with skills for RBAC inventory, effective-access queries, hygiene findings, guarded edits, fleet edits, and promotion. That is more differentiated than asking an agent to edit YAML directly.
Guides And Evidence
Deployment
See where each configuration tool fits and how a reviewed result reaches a cluster.
Verification
Npm commands check generated pages, docs, data, render outputs, and live receipts.
AI-assisted changes
How AI can propose a Helm or ConfigHub change without bypassing review.
Live change review
A reviewed AICR object is stored in ConfigHub, blocked until approval, and dry-run again after approval.
Broken chart triage
How to decide whether a failure is render, target, lifecycle, runtime, or unsupported behavior.
RBAC Manager for Agents
A domain-specific custom app pattern built from a CLI plugin plus skills over ConfigHub data.
Blast radius
How value-source maps and scored receipts show which objects a change is expected to affect.