1. The app's files
The app is apps/shop-web.yaml in confighub/cub-workshop, at the commit the Workshop's app list checked.
apiVersion: apps/v1
kind: Deployment
metadata:
name: shop-web
namespace: shop
spec:
replicas: 3
selector: { matchLabels: { app: shop-web } }
template:
metadata: { labels: { app: shop-web } }
spec:
containers:
- name: web
image: registry.k8s.io/e2e-test-images/agnhost:2.47
ports: [{ containerPort: 8080 }]
---
apiVersion: v1
kind: Service
metadata:
name: shop-web
namespace: shop
spec:
selector: { app: shop-web }
ports: [{ port: 80, targetPort: 8080 }]
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: shop-web
namespace: shop
spec:
ingressClassName: nginx
rules:
- host: shop.example.com
http:
paths:
- path: /
pathType: Prefix
backend: { service: { name: shop-web, port: { number: 80 } } }
tls:
- hosts: [shop.example.com]
secretName: shop-web-tls
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: shop-web-tls
namespace: shop
spec:
secretName: shop-web-tls
issuerRef: { name: letsencrypt, kind: ClusterIssuer }
dnsNames: [shop.example.com]
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: shop-web
namespace: shop
spec:
selector: { matchLabels: { app: shop-web } }
endpoints: [{ port: web }]
2. What the app needs
The check reads the files and names what a platform must provide. It runs nothing.
what shop-web needs
New to cub? Install the cub CLI first. Public catalog packages pull and render anonymously, and you sign in only once a command saves or changes ConfigHub data.
$ cub app check shop-web.yaml
App: shop-web
Rendering the workload (free, no infrastructure)
Installs
5 objects: 1 Deployment, 1 Service, 1 Ingress, 1 Certificate, 1 ServiceMonitor
namespaces that must already exist: shop
Dependencies (this app needs a platform to provide these)
[NEEDS] an ingress controller
Ingress shop-web (class nginx)
[NEEDS] cert-manager
Certificate shop-web-tls
[NEEDS] a Prometheus operator (kube-prometheus-stack)
ServiceMonitor shop-web
Install onto a platform that carries those services. cub stack sandbox shop-platform
checks one that already places shop-web; then your Argo CD or Flux reconciles it.3. Check it on a platform that carries those
shop-platform is a stack the Workshop plugin ships: ingress-nginx, cert-manager, kube-prometheus-stack and RabbitMQ, with shop-web on them. The check renders all of it and tests the app's needs against the platform.
shop-web on shop-platform
$ cub stack sandbox shop-platform
Stack: shop-platform - A web platform with monitoring and a message queue, with the shop app running on it: ingress, certificates, the Prometheus stack, RabbitMQ, and shop-web.
Resolving 5 components: cert-manager, ingress-nginx, kube-prometheus-stack, rabbitmq, shop-web
Check
[PASS] no resource conflicts across components (192 objects)
[PASS] CRD ordering: 10 CRDs are delivered before the 51 custom resources that need them
[PASS] served API versions: 51 custom resource(s) match their bundled CRD; target availability is not checked
[WARN] 1 custom resource(s) rely on CRDs this stack does not deliver, which must already exist: cert-manager.io (1)
[PASS] app needs met: shop-web needs an ingress controller, cert-manager, a Prometheus operator (kube-prometheus-stack), all carried by this stack
[WARN] 5 admission webhook(s) need a caBundle - cert-manager is in the stack and can issue it
[WARN] namespaces: 0 created, 6 must already exist (cert-manager, ingress-nginx, kube-system, monitoring, rabbitmq, shop)
[WARN] target prerequisite unknown: ClusterIssuer/letsencrypt; Include ClusterIssuer/letsencrypt in the stack, or verify it exists on the selected target before delivery.
[PASS] schema validation: 192 object(s) valid against the default and ecosystem catalogs (flux-schema/0.16.0)
=> CHECKED
Sandbox render (free, no infrastructure)
192 objects total
cert-manager: 42 [mgmt]
ingress-nginx: 11 [mgmt]
kube-prometheus-stack: 124 [mgmt]
rabbitmq: 10 [workload]
shop-web: 5 [workload] [authored]
Ready. `cub stack upload shop-platform --run` uploads the base Spaces and links the declared bindings in ConfigHub.One thing stays outside the stack. The Certificate asks for a ClusterIssuer called letsencrypt, and nothing in the stack creates it, so it must already exist on the cluster.
4. Technical notes and disclaimers
- Both checks ran on 2026-10-26 with cub v0.9.0 and Workshop plugin 0.6.61. The recorded files and their receipt hold every input and output.
- Neither check contacts a cluster. A check that passes is not proof the app runs.